diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 07e062347..95fb3c08c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ # # Runs on every push and pull request. # Installs LLVM 16 directly on ubuntu-22.04 runner. -# Unit tests use -DSKIP_KLEE=ON -DSKIP_LIB_FUZZER=ON, +# Unit tests use -DSKIP_KLEE=ON -DSKIP_AFL_PLUS_PLUS=ON, # so the full Dockerfile.dev dependencies are not needed. # # Phase 1.5 — OpenSSF Best Practices Badge (Analysis section) @@ -11,10 +11,21 @@ name: CI on: + # Push cobre só as branches de integração. O filtro antigo listava 'feat-*' + # com hífen, que nunca casou com a convenção real (feat/castle-juliet-baseline, + # feat/testcomp-conformance) -- então nenhum push de branch era verificado, e + # todo run verde até aqui veio do gatilho pull_request. + # + # Branches de feature ficam cobertas pelo pull_request abaixo, e não por push, + # para não disparar dois runs idênticos a cada push numa branch com PR aberta. push: - branches: [develop, main, master, 'feat-*'] - pull_request: branches: [develop, main, master] + # Inclui feat/** como ALVO para que PRs empilhadas sejam verificadas. Sem isso + # uma PR cuja base é outra branch de feature não dispara nada -- a #56 abriu + # com um único check -- e os gates de regressão que ela própria adiciona nunca + # rodariam nela. + pull_request: + branches: [develop, main, master, 'feat/**'] jobs: # =========================================================== @@ -48,7 +59,7 @@ jobs: mkdir -p build && cd build cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ - -DSKIP_LIB_FUZZER=ON \ + -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ -DENABLE_TEST=ON env: @@ -93,7 +104,7 @@ jobs: mkdir -p build && cd build cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ - -DSKIP_LIB_FUZZER=ON \ + -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ -DENABLE_TEST=ON \ -DCMAKE_EXPORT_COMPILE_COMMANDS=ON @@ -180,7 +191,7 @@ jobs: mkdir -p build && cd build cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ - -DSKIP_LIB_FUZZER=ON \ + -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ -DENABLE_TEST=ON \ -DMAP2CHECK_ENABLE_SANITIZERS=ON @@ -291,7 +302,222 @@ jobs: ' # =========================================================== - # Job 5: Dynamic Analysis — Valgrind memcheck (OpenSSF) + # Job 5: CASTLE Benchmark Regression Tests + # =========================================================== + # Verifies Map2Check against 5 CASTLE micro-benchmarks + # (CWE-415, 416, 476, 787) — memory safety regression suite. + castle-regression: + name: CASTLE Regression + runs-on: ubuntu-22.04 + timeout-minutes: 20 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build + install Map2Check in container + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_castle_ci install_castle_ci + mkdir -p build_castle_ci && cd build_castle_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci + ninja + ninja install + mkdir -p /workspace/install_castle_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_castle_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_castle_ci/lib/clang + ' + + - name: Run regression tests + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_castle_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + bash tests/integration/test_verdict_classifier.sh + bash tests/integration/test_juliet_sampling.sh + bash tests/integration/test_castle_regression.sh + bash tests/integration/test_main_argv.sh + bash tests/integration/test_modes.sh + bash tests/integration/test_add_invariants.sh + bash tests/integration/test_test_suite_emission.sh + bash tests/integration/test_target_coverage.sh + bash tests/integration/test_ktest_object_names.sh + bash tests/integration/test_testcomp_regressions.sh + bash tests/integration/test_exit_codes.sh + bash tests/integration/test_cwe_mode_mapping.sh + ' + + # =========================================================== + # Job: Invariants — o contrato do --add-invariants + # =========================================================== + # Roda o MESMO teste em qualquer estado em que a imagem esteja. Enquanto a + # imagem publicada não trouxer o Clam, ele afirma que a flag falha alto + # (issue #54). Quando a imagem passar a trazê-lo, o mesmo teste afirma que a + # flag tem sucesso E injeta verifier.assume. A linha CAPABILITY no log diz + # qual contrato foi verificado, então a volta da capacidade fica visível em + # vez de inferida. + # + # Nenhum check vermelho é estacionado de propósito: um check que se espera + # vermelho passa a ser ignorado, e aí ninguém percebe o dia em que fica verde. + invariants-clam: + name: Invariants (Clam) + runs-on: ubuntu-22.04 + timeout-minutes: 25 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build with -DENABLE_CLAM=ON + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_clam_ci install_clam_ci + mkdir -p build_clam_ci && cd build_clam_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_CLAM=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_clam_ci + ninja + ninja install + mkdir -p /workspace/install_clam_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_clam_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_clam_ci/lib/clang + ' + + - name: Assert the --add-invariants contract + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_clam_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + bash tests/integration/test_add_invariants.sh + ' + + # =========================================================== + # Job: Test-Comp conformance — o validador oficial + # =========================================================== + # Afirma que uma suíte emitida REPRODUZ o bug, que é o que a competição + # pontua. A validade estrutural do XML é afirmada à parte, pelo + # test_test_suite_emission.sh no job do CASTLE — uma suíte pode ser + # perfeitamente bem formada e valer zero ponto. + # + # Note que o TestCov sai com código 0 tanto quando cobre quanto quando não + # cobre; o veredito está na linha "Result:". Ver + # tests/testcomp/NOTES-testcov-output.md. + testcov-gate: + name: Test-Comp Validation (TestCov) + runs-on: ubuntu-22.04 + timeout-minutes: 25 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build + install Map2Check in container + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_testcov_ci install_testcov_ci + mkdir -p build_testcov_ci && cd build_testcov_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_testcov_ci + ninja + ninja install + mkdir -p /workspace/install_testcov_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_testcov_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_testcov_ci/lib/clang + ' + + - name: Run TestCov over the conformance corpus + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_testcov_ci \ + -e KEEP_WORK=1 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + # zip for the suite archive, gcc/lcov for coverage measurement. + apt-get update -qq + apt-get install -y -qq python3-pip zip gcc lcov + pip3 install --quiet testcov + # The tool-info module is what BenchExec loads on competition + # infrastructure. Nothing else here exercises it, and a wrong one + # only shows up days after submission as every task erroring out. + python3 tests/integration/test_benchexec_toolinfo.py + # Cover-Branches: the other competition category, and the one + # whose suite has more than one test case. Validated by TestCov, + # not by inspecting the XML -- only the validator can say whether + # the branches are actually exercised. + MAP2CHECK_PATH=/workspace/install_testcov_ci \ + bash tests/integration/test_cover_branches.sh + bash tests/testcomp/run_testcov_suite.sh + ' + + # =========================================================== + # Job 6: Dynamic Analysis — Valgrind memcheck (OpenSSF) # =========================================================== # Build ISOLADO e SEM sanitizers: a shadow memory do ASan/UBSan # conflita com a VM do Valgrind. Debug + DWARF-4 para stacks @@ -326,7 +552,7 @@ jobs: mkdir -p build && cd build cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ - -DSKIP_LIB_FUZZER=ON \ + -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ -DENABLE_TEST=ON \ -DCMAKE_BUILD_TYPE=Debug \ diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e56584ae2..dd92f2a91 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -2,8 +2,17 @@ # Publish map2check-dev Docker image to GitHub Container Registry # # Triggers: -# - Push to develop (Dockerfile.dev changes) -# - Manual dispatch (workflow_dispatch) +# - Push to develop (Dockerfile.dev changes) -> build AND push +# - Pull request touching Dockerfile.dev -> build only, no push +# - Manual dispatch (workflow_dispatch) -> build AND push +# +# The pull_request trigger is not decoration. Until it existed, Dockerfile.dev +# was only ever built after a merge, so a recipe that cannot build reached +# develop and broke the image: the Clam section built with the default cc +# (GCC 11) instead of clang-16, and GCC rejects a construct in sea-dsa that +# clang only warns about. Nothing pre-merge could have caught that, because +# nothing pre-merge compiled the file. It is paths-filtered, so PRs that do not +# touch the Dockerfile pay nothing. # # Phase 1.5 — OpenSSF Best Practices Badge ############################################################ @@ -14,6 +23,10 @@ on: branches: [develop] paths: - 'Dockerfile.dev' + pull_request: + branches: [develop, main, master] + paths: + - 'Dockerfile.dev' workflow_dispatch: env: @@ -32,7 +45,10 @@ jobs: - name: Checkout uses: actions/checkout@v4 + # Skipped on pull_request: the run does not push, and a PR from a fork + # has no packages:write token to log in with anyway. - name: Log in to GHCR + if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -48,11 +64,13 @@ jobs: type=raw,value=latest type=sha,prefix= + # push is false on pull_request: the point there is to prove the recipe + # builds, not to publish an image from an unmerged branch over :latest. - name: Build and push uses: docker/build-push-action@v5 with: context: . file: ./Dockerfile.dev - push: true + push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml index e8ae387f3..163cfca80 100644 --- a/.github/workflows/greetings.yml +++ b/.github/workflows/greetings.yml @@ -5,6 +5,9 @@ on: [pull_request, issues] jobs: greeting: runs-on: ubuntu-latest + permissions: + issues: write + pull-requests: write steps: - uses: actions/first-interaction@v1 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d42c6c659..c3c91287f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,7 @@ ############################################################ # Map2Check Release — Draft Release automático no master # -# Build completo (KLEE 3.1 + LibFuzzer) dentro da imagem +# Build completo (KLEE 3.1 + AFL++) dentro da imagem # ghcr.io/hbgit/map2check-dev, empacota release/ em .zip e # publica Draft Release via semantic-release. ############################################################ diff --git a/.gitignore b/.gitignore index e91bb2a19..84d4da833 100644 --- a/.gitignore +++ b/.gitignore @@ -74,4 +74,59 @@ target_wrapper.* # QtCreator CMake CMakeLists.txt.user* -test-comp2026/simulation/release/* \ No newline at end of file + +# Local Test-Comp workspace: benchmark preparation, paper material and run +# artifacts. Kept out of the repository deliberately. The Juliet evaluation +# harness that used to live under test-comp2026/simulation/ now sits in +# tests/juliet/, next to tests/castle/, so the two benchmark harnesses share +# one layout and neither depends on this directory. +test-comp2026/ + +# CASTLE/Juliet evaluation artifacts +build_castle_ci/ +install_castle_ci/ +build_dev/ +install_dev/ +tests/castle/results/ +tests/castle/results_v*/ +tests/juliet/results*/ +tests/baseline-logs/ + +# Clam invariants build (Phase B) +build_clam_ci/ +install_clam_ci/ +build_clam/ +install_clam/ +build_ut/ +install_ut/ +build_testcov_ci/ +install_testcov_ci/ + +# Local agent tooling and scratch material: ai-memory skill installs, editor +# agent configs, CLAUDE.md backups and the local Test-Comp planning document. +# Same reasoning as test-comp2026/ above -- preparation material, not product. +.agents/ +.claude/ +.opencode/ +CLAUDE.md.bak-* + +# Test-Comp benchmark corpus (sv-benchmarks, ~13 GB). Cloned on demand for the +# stratified runs; never committed. The pre-existing "sv-benchmarks/*" rule +# above ignores the CONTENTS of such a directory but not the directory entry +# itself, which is why this line names the path we actually clone into. +tests/testcomp/bench/ + +# Diretórios de build e instalação por campanha. +# Cada install_* tem ~42 MB de binários (map2check, klee, clang) e cada build_* +# ~17 MB de objetos. Eles existem para permitir bissecção entre versões do +# binário sem recompilar -- foi assim que o defeito do --max-time fracionário +# foi localizado -- mas são artefatos locais, não conteúdo do repositório. +build_*/ +install_*/ +release/ + +# Resultados de campanha do Test-Comp. Ficam no disco de quem rodou, não no +# repositório -- mesma escolha já aplicada a tests/juliet/results*/ e +# tests/castle/results_v*/. Os três corpora passam a ser tratados igual. +# Os números que importam estão no relatório em docs/. +tests/testcomp/results_*/ diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 000000000..beb976830 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,6 @@ +[submodule "CASTLE-Benchmark"] + path = tests/castle/CASTLE-Benchmark + url = https://github.com/CASTLE-Benchmark/CASTLE-Benchmark +[submodule "juliet-test-suite-c"] + path = tests/juliet/juliet-test-suite-c + url = https://github.com/arichardson/juliet-test-suite-c.git diff --git a/.opencode/skills/map2check-sbseg2026/SKILL.md b/.opencode/skills/map2check-sbseg2026/SKILL.md deleted file mode 100644 index d6527bdcb..000000000 --- a/.opencode/skills/map2check-sbseg2026/SKILL.md +++ /dev/null @@ -1,255 +0,0 @@ ---- -name: map2check-sbseg2026 -description: "Contexto completo do artigo SBSeg 2026 SF — Map2Check 2026. Metadados de submissão, frameworks, capítulos, backlog, restrições de edital, dados consolidados e conhecimento técnico. Ative ao trabalhar nos docs do paper." ---- - - - -# Map2Check 2.0 — SBSeg 2026 SF -**Autores**: Guilherme Lucas Pereira Bernardo (UFRN), Inácio Viana (UFRN), Francisco Nobre (UFRR), Herbert Oliveira Rocha (orientador, UFRR) | **Submissão**: 20/jul/2026 | **Sections**: 5 | **Single-blind** — nomes podem constar - -## How to Use This Skill - -- **Without arguments** — load core frameworks + submission context -- **With a topic** — ask about `pass migration`, `CWE mapping`, `isRequired fix`, `WASM`, `backlog`; I find and read the relevant chapter -- **With chapter** — ask for `ch03`; I load that specific chapter -- **Browse** — ask "what chapters do you have?" to see the full index - -When you ask about a topic not covered below, I will read the relevant chapter file before answering. - ---- - -## 📋 Submission Context (PRIORIDADE MÁXIMA) - -| Campo | Valor | -|:------|:------| -| **Conferência** | SBSeg 2026 — Salão de Ferramentas (SF) | -| **Sistema de submissão** | JEMS3 | -| **Idioma** | Português | -| **Deadline submissão** | **20/jul/2026** | -| **Notificação** | 03/ago/2026 | -| **Camera ready + CTA** | 14/ago/2026 | -| **Evento** | 01–04/set/2026, Armação dos Búzios — RJ | -| **Modo** | Single-blind (autores conhecidos pelos revisores — nomes/instituições/emails OK) | -| **Template** | SBC (a ser obtido) | -| **Limite** | 8 pág corpo + até 2 pág referências/apêndices | -| **Vídeo obrigatório** | Sim (5-7 min) — URL pública, não precisa ser anônima | -| **Demonstração ao vivo** | Obrigatória — pelo menos 1 autor inscrito (presença CONFIRMADA) | -| **Modalidade** | Código Aberto (elegível a prêmios) | -| **IA Generativa** | Uso DECLARADO — ferramentas de IA como assistentes de escrita, conforme Código de Conduta SBC (https://sol.sbc.org.br/index.php/indice/conduta) | - -## 📝 Backlog - -| # | Item | Prioridade | Bloqueia | Owner | -|:--|:-----|:-----------|:---------|:------| -| 1 | Referências BibTeX (TACAS 2016, 2018, 2020 + concorrentes) | **Alta** | Seção 2 (História) + Referências | usuário | -| 2 | Template LaTeX SBC | **Alta** | Geração do PDF final | usuário | -| 3 | Aprovação do orientador no outline | **Alta** | Sprint 1 | usuário | -| 4 | ~~WASM PoC E2E (1.7.3)~~ | ~~Alta~~ | ~~Seção WASM~~ | ✅ **Concluído** | -| 5 | ~~WASM MemoryTrackPass (1.7.4)~~ | ~~Alta~~ | ~~PoC E2E~~ | ✅ **Concluído** | -| 6 | ~~WASM CLI --wasm (1.7.5)~~ | ~~Alta~~ | ~~1.7.4~~ | ✅ **Concluído** | -| 7 | WASM Juliet benchmarks (1.7.6) | Média | 1.7.5 | ✅ Concluído — 15 casos, 15/15 FALSE (com timeout 290s) | -| 8 | WASM seção artigo (1.7.7) | Média | 1.7.6 | 🟡 Em andamento — texto atualizado (15/15 FALSE), figura TikZ pronta, renderização do .mmd pendente | -| 9 | Gravação do vídeo técnico | **Média** | Seção 5 (Demonstração) | usuário | -| 10 | Validação do build por terceiro (CTA) | **Baixa** | Checklist de artefato | usuário | -| 11 | Ajustes do orientador no artigo | **Alta** | Submissão | usuário | - -## 🛡️ CTA Checklist (Avaliação de Artefato) - -| Dimensão | Evidência | -|:---------|:----------| -| **Disponibilidade** | Repositório público + Docker image (GHCR) | -| **Funcionalidade** | Build passa + 7/7 unit tests + 9/9 passes carregando | -| **Reprodutibilidade** | Dockerfile.dev (Ubuntu 22.04) + scripts de benchmark | -| **Sustentabilidade** | CI/CD (GitHub Actions): build, unit tests, static analysis, sanitizers, e novo job E2E com Docker; docs atualizados | - -## 📊 Consolidated Data - -``` -Stack: LLVM 16.0 · KLEE 3.1 · C++17 · Ubuntu 22.04 · Docker -Migração: 35 commits · 84 arquivos · +5.785 / -657 linhas -Unit tests: 7/7 passing -Pass plugins: 9/9 loading (opt-16) -Smoke E2E: 2/2 loops benchmarks correct (array-1.c TRUE, array-2.c FALSE) - -TestComp 2026 Heap (C.coverage-error-call.Heap): - Total: 594 tasks | Score: 57 - TRUE: 264 (44.4%) - UNKNOWN: 271 (45.6%) - FALSE: 56 (9.4%) — 56 bugs reais encontrados - FALSE(free): 1 - TIMEOUT: 2 (0.3%) - ├─ Heap (428): 39 FALSE, 203 TRUE, 184 UNKNOWN, 2 TIMEOUT - └─ LinkedLists (166): 18 FALSE, 61 TRUE, 87 UNKNOWN, 0 TIMEOUT - -Bugs críticos corrigidos: 3 (KLEE flags, isRequired, target function) -Bugs OverflowPass corrigidos: 3 (null pointer dereference em chamadas indiretas) - -TestComp 2026 ControlFlow (no-overflow): 92 tasks, 30 FALSE, 17 TRUE, 45 UNK, 0 TO (1h43m) -TestComp 2026 ControlFlow (coverage-error-call): 138 tasks, 38 FALSE, 30 TRUE, 70 UNK, 0 TO (4h53m) - -WASM Pipeline: - Branch: feat-wasm-verification - WABT: 1.0.41 (wasm2c) - wasi-sdk: 33.0 (clang --target=wasm32-wasip1) - WasmLifter: ✅ modules/frontend/wasm_lifter.{hpp,cpp} — lifting funcional - Entry point: ✅ w2c_*_start → main via generateWasmWrapperStatic - CLI --wasm: ✅ map2check --wasm modulo.wasm — pipeline único - WasmRuntimeStubs:✅ KLEE-friendly (calloc/free), wasm_rt_trap → map2check_error - Wrapper auto: ✅ generateWasmWrapperStatic() — main() → wasm bridge - Bounds check: ✅ Per-allocation via dlmalloc interception (w2c_*_dlmalloc/dlfree) - implementado e validado - Juliet benchmarks:✅ 15 casos (CWE-121/122/124/126/127), 15/15 FALSE - timeout 110s → UNKNOWN; timeout 290s → FALSE - Integration tests:✅ tests/integration/test_wasm_{pipeline,entrypoint}.sh (3/3 + 3/3) - Seção no artigo: 🟡 Texto base em main.tex, figura pipeline pendente - KLEE E2E: ✅ Pipeline completo: .wasm → LLVM IR → Passes → KLEE → FALSE - CI build: ✅ find_path corrigido, WasmRuntimeStubs opcional - CI E2E: ✅ Novo job e2e-wasm executa integração dentro do Docker -``` - -## 🖼️ Figure Inventory - -| ID | Descrição | Seção | Status | -|:---|:----------|:------|:------| -| `fig1-timeline` | Timeline visual 2016→2026 | Sec 2 | ✅ TikZ criado (fig1-timeline.tikz.tex) | -| `fig2-pipeline` | Diagrama do pipeline de verificação (5 estágios) | Sec 3 | ✅ TikZ criado (fig2-pipeline.tikz.tex) | -| ~~`fig3-passes`~~ | ~~Diagrama dos passes~~ | — | Removida (orientador) | -| ~~`fig4-testcomp2026`~~ | ~~Gráfico de pizza TestComp~~ | — | Removida (orientador: nunca usar pizza) | -| ~~`fig5-cicd`~~ | ~~Workflow CI/CD~~ | — | Removida (substituída por parágrafo + OpenSSF) | -| `fig6-wasm-pipeline` | Pipeline WASM: .wasm → wasm2c → LLVM IR → Passes → KLEE | Sec 4 | 🟡 .mmd criado, aguardando renderização para PNG | - ---- - -## Core Frameworks & Mental Models - -### Pipeline de Verificação Híbrida -**Use fuzzing (LibFuzzer) como primeira linha** para bugs superficiais — rápido mas cego para branches complexos. **Use execução simbólica (KLEE) como solver de guardas** quando o fuzzer estagna — preciso mas caro. A combinação (iterative deepening) resolve o trade-off. - -### Pass Migration Pattern (Legacy PM → New PM) -**Sempre herdar de `PassInfoMixin`** e implementar `run(Function &, FunctionAnalysisManager &)`. **`isRequired() = true` é obrigatório** — sem isso, `opt -O0` pula o pass silenciosamente. Este foi o bug mais crítico da migração (3 bugs escaparam dos unit tests). - -### Mapeamento Propriedade SV-COMP → CWE → Pass -**Cada propriedade de memory safety do SV-COMP mapeia para um CWE** do MITRE: -- `valid-free` → **CWE-415** (Double-Free) / **CWE-416** (Use-After-Free) -- `valid-deref` → **CWE-416** (Use-After-Free) -- `valid-memsafety` → **CWE-119/787** (Buffer Overflow) -- `valid-memcleanup` → **CWE-401** (Memory Leak) - -O mapeamento torna resultados de verificação formal acionáveis para times de AppSec. - -### Modernização de Engenharia como Pré-requisito -**CI/CD + Docker + static analysis + sanitizers não são luxo, são fundamento.** Sem eles: bugs de regressão passam despercebidos, resultados não são reproduzíveis, a ferramenta não compete em SV-COMP/TestComp. - -### Docker Reproducibility Contract -**Se funciona na imagem `map2check-dev` (Ubuntu 22.04 + LLVM 16 + KLEE 3.1), funciona em qualquer lugar.** O Dockerfile.dev é o contrato de reprodutibilidade — documenta cada dependência e versão. - -### TestComp 2026 como Validação Empírica -**Resultados Heap (594 tasks):** TRUE 264 (44.4%), UNKNOWN 271 (45.6%), FALSE 56 bugs reais (9.4%), TIMEOUT 2 (0.3%). **Score 57.** UNKNOWN 45.6% é o principal gargalo e direciona o próximo ciclo de desenvolvimento. - -### UNKNOWN como KPI de Engenharia -**Não é fracasso, é sinal de onde investir.** Causas: timeout 300s insuficiente, path exploration do KLEE não otimizada, solver SMT (Z3) sem tuning. Cada ponto percentual reduzido de UNKNOWN é ganho real de cobertura. - -### Testes Unitários são Necessários mas Insuficientes -**7/7 unit tests passando e 3 bugs críticos escaparam.** Os bugs (KLEE flags, isRequired, target function) só foram detectados por smoke tests manuais. **Testes de integração E2E (compile → instrument → link → execute) no CI são indispensáveis.** No WASM, 8 commits consecutivos de "fix(ci)" tentaram fazer o CI passar sem executar KLEE; o job `e2e-wasm` baseado em Docker foi criado justamente para quebrar esse ciclo. - -### WASM como Próximo Vetor de Growth -**Pipeline LLVM 16 estendido para WebAssembly.** Memory safety em runtimes WASM (Wasmtime, Wasmer) é uma nova classe de bugs. Feature implementada e funcional — NÃO é trabalho futuro, aparece no paper com resultados da Juliet. - -### Per-Allocation Bounds Checking via dlmalloc Interception -**O wasm2c gera funções de alocação com nome determinístico** (w2c_*_dlmalloc / w2c_*_dlfree). O MemoryTrackPass as intercepta por padrão de nome (`StringRef::contains`), registrando offset + size no AllocationLog existente. Cada load/store na linear memory é verificado contra as alocações registradas via `is_valid_allocation_address`. Funciona para heap (malloc-based: 3/3 Juliet CWE-122/126 FALSE), não para stack/globals (CWE-121/124/127: 12/12 UNKNOWN). - -### Entrypoint Translation Pattern -**O wasm2c traduz `_start` → `w2c_*_start` e `main` → `w2c_*_original_main`.** Para unificar com o pipeline Map2Check (que espera `main`), geramos um wrapper C dinâmico (`generateWasmWrapperStatic`) que extrai o nome do módulo do entrypoint levantado, instancia o módulo WASM via `wasm2c_*_instantiate`, invoca `_start`, e libera via `wasm2c_*_free`. O wrapper é compilado para .bc e linkado com o IR levantado via `llvm-link`. - -### Linear Memory Bounds Gap -**O bounds check nativo do wasm2c opera no nível da memória linear** (0 a `mem->size`), não por buffer individual. Um `strcpy` que ultrapassa o buffer escreve no próximo byte da stack, ainda dentro dos 64KB alocados. Para detectar per-buffer overflow, é necessário rastrear limites de cada alocação — viável via dlmalloc para heap, inviável para stack/globais (Fase 2, pós-SBSeg). - -### Escopo do Paper — O que NÃO mencionar -- **NÃO**: DG Library, AFL++, Coordenador, Smart Seeds (fora do escopo — são próximos passos do pré-projeto Map2Check 2.0) -- **SIM**: LLVM 16, New PM, 9 passes, C++17, CI/CD, Docker, sanitizers, static analysis, TestComp 2026, CWE mapping, WASM - ---- - -## Chapter Index - -| # | Title | Pages | Figures | Data Sources | Key Frameworks | -|---|-------|-------|---------|--------------|----------------| -| [ch01](chapters/ch01-introducao-motivacao.md) | Introdução | ~1 | — | `docs/paper-sbseg-2026/sbseg-article/main.tex` | Memory Safety, Verificação Híbrida, CWE Top 25, Trabalhos Relacionados | -| [ch02](chapters/ch02-historia-evolucao.md) | História e Evolução | ~1 | fig1-timeline | `CHANGELOG.md`, `docs/migration/` | BMC→KLEE→Híbrido, Comparação com concorrentes (CPAchecker, Symbiotic, FuSeBMC, ESBMC) | -| [ch03](chapters/ch03-arquitetura.md) | Arquitetura e Funcionalidades | ~2.5 | fig2-pipeline | `docs/migration/1.3-*.md`, `.github/workflows/`, `Dockerfile.dev` | Pipeline 5 estágios, Técnicas (fluxo de dados, intervalos), OpenSSF | -| [ch04](chapters/ch04-ciberseguranca.md) | Análise Experimental | ~2 | — | `test-comp2026/simulation/` | CWE mapping, TestComp 2026 resultados, WASM lifting | -| ~~[ch05]~~ | ~~Demonstração Planejada~~ | — | — | — | Removida do artigo (orientador: demo não é conteúdo de paper) | -| [ch06](chapters/ch06-conclusao.md) | Conclusão | ~1 | — | `docs/paper-sbseg-2026/data/consolidated-data.md` | Resultados, Limitações (UNKNOWN 45.6%), Perspectivas (WASM, E2E tests) | - -## Topic Index - -- **AFL++** → ch01, Pré-projeto -- **Arquitetura (pipeline)** → ch03 -- **ASAN / UBSAN / TSAN** → ch03, ch04 -- **BMC (Bounded Model Checking)** → ch02 -- **Buffer Overflow** → ch01, ch04 -- **C++17** → ch03 -- **CBMC** → ch02 -- **Checkpoint automatizado** → ch04, patterns -- **CI/CD** → ch03 -- **Crab-LLVM** → ch02 -- **CWE-119 / 787** → ch01, ch04 -- **CWE-401 (Memory Leak)** → ch01, ch04 -- **CWE-415 (Double-Free)** → ch01, ch04 -- **CWE-416 (Use-After-Free)** → ch01, ch04 -- **Demonstração ao vivo** → ch05 -- **DG Library** → Pré-projeto (fora do escopo paper) -- **Docker** → ch03, ch05 -- **Execução Simbólica** → ch01, ch02, ch03 -- **FuSeBMC** → ch01 -- **isRequired fix** → ch03, ch04 -- **Iterative deepening** → ch03, patterns -- **KLEE 3.1** → ch02, ch03, ch04 -- **Legacy PM → New PM** → ch02, ch03, patterns -- **LibFuzzer** → ch02, ch03 -- **LLVM 16** → ch03 -- **Memory Safety** → ch01, ch04 -- **New Pass Manager** → ch03, patterns -- **OpenSSF Best Practices** → ch03 -- **Passes (9)** → ch03 -- **Pipeline (5 estágios)** → ch03 -- **SBSeg SF 2026** → ch05 -- **Smart Seeds** → ch01, Pré-projeto -- **SMT Solver (Z3)** → ch01, ch03 -- **SV-COMP** → ch01 -- **Symbiotic** → ch01 -- **TestComp 2026** → ch04, ch06 -- **UNKNOWN (45.6%)** → ch04, ch06 -- **WASM (WebAssembly)** → ch04, ch06 -- **WASM lifter / WABT** → ch04, Implementation Plan -- **wasm2c** → ch04, Implementation Plan -- **wasi-sdk** → Implementation Plan -- **w2c__start** → Implementation Plan -- **dlmalloc interception** → ch04, patterns -- **entrypoint translation** → ch04, patterns -- **per-allocation bounds** → ch04, patterns -- **linear memory gap** → ch04, patterns -- **Juliet Test Suite** → ch04 -- **generateWasmWrapperStatic** → ch04 -- **WasmRuntimeStubs** → ch04 -- **integration tests (WASM)** → tests/ -- **Witness GraphML** → ch03 - -## Supporting Files - -- [glossary.md](glossary.md) — all key terms with definitions -- [patterns.md](patterns.md) — all techniques and design patterns -- [cheatsheet.md](cheatsheet.md) — quick reference tables and decision guides - ---- - -## Scope & Limits - -**Coberto**: Conteúdo do paper SBSeg 2026 SF (Map2Check modernization) + pré-projeto Map2Check 2.0 + metadados de submissão + backlog + dados consolidados de TestComp 2026. - -**Fora do escopo do paper** (mencionados em contexto, detalhados no pré-projeto): DG Library, AFL++, Smart Seeds, Coordenador. - -**Fontes de referência no repo**: `docs/migration/` (passes, frontend, checkpoints), `.github/workflows/` (CI/CD), `test-comp2026/simulation/` (benchmarks), `Dockerfile.dev` (reprodutibilidade). - -**Esta skill absorveu e substitui `sbseg-paper`** — todo o conteúdo de projeto (submissão, backlog, restrições, CTA) foi fundido aqui. diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch01-introducao-motivacao.md b/.opencode/skills/map2check-sbseg2026/chapters/ch01-introducao-motivacao.md deleted file mode 100644 index 79a45cce3..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch01-introducao-motivacao.md +++ /dev/null @@ -1,71 +0,0 @@ -# Chapter 1: Introdução - -## Core Idea -Memory safety em C/C++ lidera o *2025 CWE Top 25* com Out-of-bounds Write (CWE-787), Use-After-Free (CWE-416) e Buffer Overflow (CWE-119). A verificação híbrida — combinando execução simbólica (KLEE) e fuzzing (AFL++) — é a abordagem mais promissora, e o Map2Check 2026 renasce como ferramenta competitiva após 7 anos de estagnação técnica. - -## Frameworks Introduced -- **Verificação Híbrida**: combinação de execução simbólica (KLEE) + fuzzing guiado por cobertura (AFL++) - - When to use: quando fuzzing puro não penetra guardas lógicas complexas, e execução simbólica pura sofre de path explosion - - How: fases alternadas entre exploração rápida (fuzzer) e resolução de path constraints via SMT (execução simbólica) -- **Smart Seeds (FuSeBMC)**: injeção de sementes geradas por BMC no fuzzer, atingindo >81% de cobertura em categorias críticas da Test-Comp - - When to use: quando o fuzzer estagna em branches com magic numbers - - How: BMC resolve guardas lógicas e injeta entradas concretas de volta na fila do fuzzer -- **Program Slicing (Symbiotic)**: integração de slicing estático (DG Library) com KLEE para reduzir espaço de busca - - When to use: programas grandes onde a análise simbólica sofre de path explosion - - How: remove trechos de código que não afetam as propriedades de segurança antes da execução simbólica - -## Key Concepts -- **CWE Top 25 (2025)**: CWE-787, CWE-416, CWE-119 entre as vulnerabilidades mais perigosas — fonte: `cwe2025` -- **SV-COMP / TestComp**: competições internacionais de verificação de software — fonte: `beyersvcomp2013`, `beyertestcomp2023` -- **KLEE**: motor de execução simbólica de referência para LLVM bitcode — fonte: `klee2008` -- **AFL++**: fuzzer guiado por cobertura, sucessor do AFL — fonte: `fioraldi2020aflpp` -- **FuSeBMC**: ferramenta com smart seeds + BMC, líder em cobertura na Test-Comp — fonte: `fusebmc2022` -- **Symbiotic**: ferramenta com program slicing + KLEE, destaque em MemSafety — fonte: `chalupa2021symbiotic` -- **ESBMC**: bounded model checker com múltiplos solvers SMT — fonte: `gadelha2021esbmc` -- **OpenSSF Best Practices**: certificação de boas práticas para projetos open source — fonte: `openssf2024` -- **Therac-25**: caso histórico de falha de software em sistema crítico médico — fonte: `leveson1993investigation` - -## Mental Models -- Use **fuzzing como primeira linha** — rápido, cobre caminhos superficiais, detecta bugs fáceis -- Use **execução simbólica como solver de guardas** — preciso para branches com magic numbers, mas caro -- Pense em **orquestração como diferencial competitivo**: FuSeBMC ganhou com smart seeds, Symbiotic com slicing — o Map2Check 2026 precisa dessa camada -- Use **CWE como linguagem comum** entre verificação formal e times de AppSec — torna resultados acionáveis - -## Anti-patterns -- **Ferramenta sem CI/CD**: sem reprodutibilidade, resultados não são validáveis por terceiros — pré-requisito para publicação científica -- **Stack EOL (LLVM 6, Ubuntu 16.04)**: inviabiliza participação em competições e perde compatibilidade com solvers modernos -- **Motores sem orquestração**: KLEE e LibFuzzer operando em fases estanques, sem compartilhamento de estado — perde eficiência vs. FuSeBMC - -## Worked Example -**Exemplo de uso do Map2Check 2026:** - -```c -// array-2.c — buffer overflow intencional -int main() { - int a[10], i = __VERIFIER_nondet_int(); - a[i] = 42; // i pode ser >= 10 → buffer overflow - return 0; -} -``` - -Pipeline completo via CLI: -```bash -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() -> 31763, line 3, scope main -``` - -O comando `map2check` compila com Clang-16, instrumenta com os passes de memory safety, executa o KLEE e reporta o veredito FALSE com contra-exemplo concreto. - -## Key Takeaways -1. Memory safety bugs lideram o CWE Top 25 2025 — CWE-787, CWE-416, CWE-119 -2. Verificação híbrida é o estado da arte — FuSeBMC (>81% cobertura), Symbiotic (slicing+KLEE), ESBMC (multi-solver BMC) -3. Map2Check estava estagnado desde 2019 (LLVM 6.0, Ubuntu 16.04 EOL, KLEE 2.0 fork) -4. 5 contribuições da versão 2026: (1) LLVM 6→16 + New PM + C++17, (2) CI/CD + Docker + sanitizers + OpenSSF, (3) TestComp 2026 score 57, (4) CWE mapping, (5) WASM suporte -5. Exemplo concreto: `map2check array-2.c` → VERIFICATION FAILED + counter-example `nondet_int() → 31763` - -## Connects To -- **Ch 2**: História e evolução — como cada checkpoint do Map2Check se compara aos concorrentes -- **Ch 3**: Arquitetura — pipeline de 5 estágios com passes de instrumentação -- **Ch 4**: Análise Experimental — resultados TestComp 2026 e CWE mapping -- **CWE Top 25 2025**: referência do MITRE para classificação de vulnerabilidades diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch02-historia-evolucao.md b/.opencode/skills/map2check-sbseg2026/chapters/ch02-historia-evolucao.md deleted file mode 100644 index b710f1f9a..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch02-historia-evolucao.md +++ /dev/null @@ -1,44 +0,0 @@ -# Chapter 2: História e Evolução - -## Core Idea -O Map2Check passou por 3 fases arquiteturais (BMC → KLEE → Híbrido) em 10 anos, mas perdeu competitividade por falta de features que os concorrentes adotaram em cada checkpoint: CPAchecker já usava múltiplas estratégias em 2016, Symbiotic integrava slicing com KLEE em 2018, e FuSeBMC introduziu smart seeds com orquestração dinâmica em 2020. - -## Frameworks Introduzidos -- **BMC (2016, TACAS)**: Map2Check usava CBMC como único solver BMC para "Hunting Memory Bugs" - - Concorrente: CPAchecker já combinava análise de valor, predicate abstraction e BMC com múltiplas estratégias -- **Execução Simbólica (2018, TACAS)**: migração para LLVM + KLEE, path-based symbolic execution - - Concorrente: Symbiotic integrava program slicing estático (DG) com KLEE — otimização ausente no Map2Check - - Concorrente: ESBMC usava portfólio de solvers SMT (Z3, Boolector, Yices) para reduzir UNKNOWN -- **Híbrido (2020, TACAS)**: fuzzing (LibFuzzer) + execução simbólica (KLEE) + invariantes indutivos (Crab-LLVM) em iterative deepening - - Concorrente: FuSeBMC introduzia smart seeds com orquestração BMC→fuzzer, atingindo >81% cobertura — Map2Check operava motores em fases estanques - -## Key Concepts -- **CPAchecker**: framework de verificação configurável com múltiplas estratégias — referência desde SV-COMP 2013 -- **Iterative Deepening**: estratégia de aprofundamento progressivo alternando fuzzing e execução simbólica -- **Crab-LLVM**: análise estática baseada em interpretação abstrata para geração de invariantes indutivos — `crabllvm2021` -- **Portfólio de solvers SMT**: uso combinado de Z3, Boolector, Yices para maximizar a taxa de resultados conclusivos -- **Estagnação (2019-2025)**: LLVM 6.0 EOL (2019), Ubuntu 16.04 EOL (2021), KLEE 2.0 fork perdeu compatibilidade com Z3 - -## Mental Models -- Pense na **evolução como débito técnico acumulado**: sem manutenção contínua, 7 anos de stack parada exigem migração completa (35 commits, 84 arquivos, +5.785/-657 linhas) -- Use **comparação com concorrentes como diagnóstico**: cada checkpoint revela a feature ausente (multi-estratégia em 2016, slicing em 2018, orquestração em 2020) -- Pense no **renascimento como pré-requisito de engenharia**: a base moderna (LLVM 16, CI/CD, Docker) é condição necessária para qualquer avanço algorítmico futuro - -## Anti-patterns -- **Publicar e abandonar**: 3 artigos TACAS (2016, 2018, 2020) sem manutenção contínua → estagnação de 7 anos -- **Depender de fork customizado**: KLEE 2.0 fork perdeu compatibilidade com Z3 e bibliotecas de runtime — usar upstream sempre que possível -- **Motores sem orquestração dinâmica**: fases estanques perdem eficiência vs. smart seeds com realimentação em tempo real - -## Key Takeaways -1. 2016: BMC com CBMC — CPAchecker já usava múltiplas estratégias, Map2Check dependia de 1 solver -2. 2018: KLEE + LLVM — Symbiotic integrava slicing, ESBMC usava portfólio de solvers -3. 2020: Fuzzing + KLEE + Crab-LLVM — FuSeBMC introduzia smart seeds com >81% cobertura -4. 2019-2025: Estagnação total — LLVM 6 EOL, Ubuntu 16.04 EOL, sem CI/CD -5. 2026: Renascimento — 35 commits, 84 arquivos, modernização completa -6. A ausência de slicing, orquestração dinâmica e portfólio de solvers são débitos técnicos identificados - -## Connects To -- **Ch 1**: Introdução — contexto dos concorrentes e motivação para o renascimento -- **Ch 3**: Arquitetura — o pipeline modernizado que endereça a estagnação técnica -- **Ch 4**: Análise Experimental — resultados que validam a viabilidade competitiva após o renascimento -- **Pré-projeto Map2Check 2.0**: próximos passos (DG Library, AFL++, Smart Seeds) — features que os concorrentes já tinham diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch03-arquitetura.md b/.opencode/skills/map2check-sbseg2026/chapters/ch03-arquitetura.md deleted file mode 100644 index 325086dfb..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch03-arquitetura.md +++ /dev/null @@ -1,82 +0,0 @@ -# Chapter 3: Arquitetura e Funcionalidades - -## Core Idea -O pipeline do Map2Check 2026 opera em 5 estágios: compilação C → LLVM IR (Clang-16), instrumentação por 9 passes (opt, New PM), linkagem com runtime (llvm-link), análise por KLEE 3.1/LibFuzzer, e veredito + witness GraphML. A infraestrutura CI/CD + Docker + OpenSSF Best Practices garante reprodutibilidade e sustentabilidade. - -## Frameworks Introduzidos -- **Pipeline de 5 Estágios**: - 1. Compilação: `clang-16 -O0` → LLVM IR - 2. Instrumentação: `opt` com 9 passes New PM → bitcode instrumentado com chamadas à runtime - 3. Linkagem: `llvm-link` → bitcode + runtime library - 4. Análise: KLEE 3.1 (execução simbólica) ou LibFuzzer (fuzzing) - 5. Veredito: TRUE/FALSE/UNKNOWN + witness GraphML com contra-exemplo - -- **New Pass Manager (PassInfoMixin)**: API moderna do LLVM — substitui Legacy PM (FunctionPass/ModulePass) - - When to use: sempre — Legacy PM está deprecado desde LLVM 13 - - How: herdar de `PassInfoMixin`, registrar via `PassPluginLibraryInfo` e `registerPipelineParsingCallback` - -## Técnicas Empregadas nos Passes - -| Pass | Técnica | Vulnerabilidade coberta | -|:-----|:--------|:------------------------| -| **MemoryTrackPass** | Análise de fluxo de dados | Use-after-free (CWE-416), Double-free (CWE-415), Memory leak (CWE-401) | -| **OverflowPass** | Análise de intervalos | Buffer overflow (CWE-119/787), Integer overflow (CWE-190) | -| **GenerateAutomataTruePass** | Geração de autômato GraphML | Witness para validação externa (CPAchecker) | -| Demais passes | Suporte: predicados em laços, nondet, cobertura BB, asserts | Infraestrutura de verificação | - -## Key Concepts -- **Witness GraphML**: formato padronizado SV-COMP descrevendo o caminho de execução até a violação como autômato — validável por ferramentas como CPAchecker -- **Runtime Library**: biblioteca C compilada a `.bc`, linkada ao bitcode instrumentado — implementa checks de runtime (bounds, alloc/free tracking, deref validation) -- **OpenSSF Best Practices**: programa de certificação de boas práticas para projetos open source — `openssf2024` -- **Sanitizers**: ASAN (AddressSanitizer), UBSAN (UndefinedBehavior), TSAN (ThreadSanitizer) — detectam bugs na própria ferramenta, não nos programas analisados -- **CI/CD (GitHub Actions)**: build automatizado com GCC e Clang, 7/7 unit tests, 9/9 pass plugin load tests, static analysis (clang-tidy, cppcheck) - -## Mental Models -- Use **compilação -O0** com New PM porque preserva debug info para contra-exemplos precisos -- Pense em **witness GraphML como contrato de verificabilidade**: qualquer ferramenta pode validar o veredito reexecutando o witness -- Use **Docker como contrato de reprodutibilidade**: `Dockerfile.dev` (Ubuntu 22.04 + LLVM 16 + KLEE 3.1) documenta cada dependência -- Trate **sanitizers como primeira linha de defesa** da própria ferramenta — detectam bugs que unit tests perdem - -## Anti-patterns -- **Misturar Legacy PM com New PM**: APIs incompatíveis — qualquer `ModulePass` legado quebra o pipeline `opt-16` -- **CI/CD sem testes E2E**: unit tests (7/7) não detectaram 3 inconsistências na API do New PM — testes de integração são indispensáveis -- **Build não containerizado**: "funciona na minha máquina" invalida resultados científicos — Docker é requisito mínimo de reprodutibilidade - -## Worked Example -**Pipeline E2E — benchmark `array-2.c`:** - -```bash -# 1. Compilar C → LLVM IR -clang-16 -emit-llvm -g -c array-2.c -o array-2.bc - -# 2. Instrumentar com 9 passes -opt -load-pass-plugin=libMemoryTrackPass.so \ - -load-pass-plugin=libOverflowPass.so \ - ... \ - -passes='memory-track,overflow,...' \ - array-2.bc -o array-2-instr.bc - -# 3. Linkar com runtime -llvm-link array-2-instr.bc \ - Map2CheckFunctions.bc \ - AnalysisModeMemtrack.bc \ - ... -o array-2-final.bc - -# 4. Executar KLEE -klee --target-function=reach_error array-2-final.bc - -# 5. Resultado: FALSE + counter-example (nondet_int → 31763) -``` - -## Key Takeaways -1. Pipeline em 5 estágios: compilar → instrumentar (9 passes NPM) → linkar → analisar → veredito + witness -2. MemoryTrackPass usa análise de fluxo de dados, OverflowPass usa análise de intervalos -3. Witness GraphML permite validação externa por CPAchecker — padrão SV-COMP -4. CI/CD + Docker + sanitizers + static analysis + OpenSSF = base de engenharia sustentável -5. 7/7 unit tests + 9/9 pass plugin load tests passando no CI -6. 3 inconsistências NPM descobertas durante migração — nenhuma detectável por unit tests - -## Connects To -- **Ch 2**: História — do Legacy PM (LLVM 6) ao New PM (LLVM 16) -- **Ch 4**: Análise Experimental — resultados do pipeline no TestComp 2026 -- **OpenSSF Best Practices**: certificação de segurança e qualidade — `openssf2024` diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch04-ciberseguranca.md b/.opencode/skills/map2check-sbseg2026/chapters/ch04-ciberseguranca.md deleted file mode 100644 index 3b71c4ade..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch04-ciberseguranca.md +++ /dev/null @@ -1,82 +0,0 @@ -# Chapter 4: Análise Experimental - -## Core Idea -O Map2Check 2026 foi validado no TestComp 2026 (Heap: 594 tasks, score 57, 56 bugs reais). O mapeamento SV-COMP → CWE estabelece a ferramenta como ponte entre verificação formal e cibersegurança. O suporte a WASM estende o pipeline para análise de binários WebAssembly via wasm2c. - -## Mapeamento SV-COMP → CWE - -| Propriedade SV-COMP | CWE | Técnica | -|---------------------|-----|---------| -| `valid-free` | CWE-415 (Double-Free) | Análise de fluxo de dados (MemoryTrackPass) | -| `valid-deref` | CWE-416 (Use-After-Free) | Análise de fluxo de dados (MemoryTrackPass) | -| `valid-memtrack` | CWE-401 (Memory Leak) | Tracking de alocações (MemoryTrackPass) | -| `valid-memsafety` | CWE-119/787 (Buffer Overflow) | Análise de intervalos + fluxo de dados | -| `no-overflow` | CWE-190 (Integer Overflow) | Análise de intervalos (OverflowPass) | - -## Frameworks Introduzidos -- **CWE Mapping Framework**: cada propriedade de memory safety do SV-COMP mapeia para um CWE do MITRE + técnica empregada - - When to use: para comunicar resultados de verificação formal para times de AppSec - - How: associar `propriedade → CWE → pass/técnica` em tabela de referência - -## Key Concepts -- **TestComp 2026 Heap**: sub-categoria `C.coverage-error-call.Heap`, 594 tasks, timeout 300s, solver Z3, target `reach_error` -- **Resultados consolidados**: TRUE 264 (44.4%), UNKNOWN 271 (45.6%), FALSE 56 bugs reais (9.4%), TIMEOUT 2 (0.3%) -- **Heap set**: 428 tasks — 39 FALSE, 203 TRUE, 184 UNKNOWN, 2 TIMEOUT -- **LinkedLists set**: 166 tasks — 18 FALSE, 61 TRUE, 87 UNKNOWN, 0 TIMEOUT -- **Smoke test validado**: `array-1.c` → TRUE (VERIFICATION SUCCEEDED), `array-2.c` → FALSE + counter-example `nondet_int → 31763` -- **WASM pipeline**: `.wasm → wasm2c (WABT 1.0.41) → .c → clang-16 → .bc → passes → KLEE` -- **wasi-sdk 33.0**: toolchain para compilar C → WASM com target `wasm32-wasip1` -- **Per-allocation bounds check WASM**: MemoryTrackPass intercepta `w2c_*_dlmalloc`/`dlfree` e injeta `map2check_wasm_check_access` em loads/stores -- **Juliet WASM**: 15 casos validados (CWE-121/122/124/126/127); 15/15 FALSE com timeout 290s -- **Linear memory gap**: heap detectável via dlmalloc; stack/globals sem alocador visível → inviável no MVP (mas Juliet stack/underread também foram detectados) - -## Mental Models -- Use **UNKNOWN como KPI de engenharia**: 45.6% não é fracasso, é direcionamento — timeout tuning, estratégias de solver, path exploration heuristics -- Pense em **CWE como ponte academia-indústria**: o mapeamento torna resultados de verificação formal interpretáveis por profissionais de AppSec -- Use **WASM como novo vetor de memory safety**: mesmo pipeline LLVM, binários de terceiros (Wasmtime, Wasmer), sem reimplementar lógica de verificação -- Pense em **smoke test como sanity check**: 2 benchmarks canônicos (TRUE + FALSE) validam o pipeline completo em segundos - -## Anti-patterns -- **Confiar apenas em unit tests**: 7/7 passando e ainda assim 3 inconsistências NPM escaparam → testes E2E são indispensáveis -- **Usar gráfico de pizza sem baseline**: comparar TRUE/FALSE/UNKNOWN sem baseline de concorrente não agrega — usar tabela numérica -- **Tratar WASM como "trabalho futuro"**: pipeline funcional (lifting validado), feature em desenvolvimento ativo — reportar como contribuição em andamento -- **Fazer o CI passar sem executar KLEE**: 8 commits consecutivos adaptando include paths e tornando WasmRuntimeStubs opcional deram green checkmark, mas não validaram o pipeline real — job Docker E2E necessário - -## 3 Inconsistências Corrigidas na Migração - -| Problema | Causa | Impacto | -|:---------|:------|:--------| -| KLEE 3.1 flags | Flags removidas entre KLEE 2.0 → 3.1 | `Unknown command line argument` — ferramenta não executava | -| Passes ignorados | `optnone` + New PM: passes não executam sem `isRequired()` | Instrumentação silenciosamente ausente — falsos TRUE | -| Target function | `__VERIFIER_error` vs `reach_error` — env var vs `cl::opt` | KLEE procurava função errada — veredito incorreto | - -Nenhum desses problemas era detectável pelos 7/7 unit tests, que cobrem apenas a biblioteca C de runtime. - -## Worked Example -**Validação E2E — smoke test:** - -```bash -# TRUE case: sem bug -$ map2check --property-file coverage-error-call.prp array-1.c -VERIFICATION SUCCEEDED - -# FALSE case: buffer overflow detectado -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() → 31763, line 19, main -``` - -## Key Takeaways -1. TestComp 2026 Heap: 594 tasks, score 57, 56 bugs reais (9.4% FALSE), 45.6% UNKNOWN -2. Mapeamento CWE: 5 propriedades SV-COMP → 5 CWEs + técnica empregada — acionável por times AppSec -3. 3 inconsistências NPM corrigidas: KLEE flags, passes ignorados, target function — indetectáveis por unit tests -4. WASM: pipeline funcional (wasm2c 1.0.41 + wasi-sdk 33.0), lifting validado, per-allocation bounds check implementado -5. Juliet WASM: 15 casos (CWE-121/122/124/126/127), 15/15 FALSE com timeout 290s -6. Timeout é KPI de engenharia: 110s → UNKNOWN, 290s → FALSE nos casos Juliet WASM -7. Smoke tests canônicos (`array-1.c` TRUE, `array-2.c` FALSE) validam pipeline E2E em segundos - -## Connects To -- **Ch 3**: Arquitetura — cada pass da seção 3 mapeia para CWE e resultado TestComp -- **Ch 6**: Conclusão — limitações (UNKNOWN 45.6%) e perspectivas (WASM, E2E tests) -- **Ch 5**: (removida do paper — Demonstração ao vivo era requisito do edital, não conteúdo) -- **MITRE CWE Top 25**: taxonomia padrão da indústria — `cwe2025` diff --git a/.opencode/skills/map2check-sbseg2026/chapters/ch06-conclusao.md b/.opencode/skills/map2check-sbseg2026/chapters/ch06-conclusao.md deleted file mode 100644 index 4805c9ba8..000000000 --- a/.opencode/skills/map2check-sbseg2026/chapters/ch06-conclusao.md +++ /dev/null @@ -1,64 +0,0 @@ -# Chapter 6: Conclusão - -## Core Idea -O Map2Check 2026 é um feito de engenharia — 35 commits, 84 arquivos, +5.785/-657 linhas para modernizar a stack completa. A validação no TestComp 2026 (score 57) comprova viabilidade competitiva. Os próximos passos são reduzir UNKNOWN (45.6%), adicionar testes E2E no CI e completar o suporte WASM. - -## Resumo dos Resultados - -| Métrica | Valor | -|:--------|:------| -| Commits | 35 | -| Arquivos modificados | 84 | -| Linhas adicionadas/removidas | +5.785 / -657 | -| Passes migrados (Legacy PM → New PM) | 9/9 | -| Unit tests | 7/7 | -| Pass plugin load tests | 9/9 | -| TestComp 2026 Heap | 594 tasks, score 57 | -| Bugs reais detectados (FALSE) | 56 (9.4%) | - -## Frameworks Introduzidos -- **Avaliação de Ferramentas de Verificação em 3 Dimensões**: - 1. Corretude: TRUE/FALSE acurácia — 56 bugs reais detectados - 2. Completude: % UNKNOWN — 45.6% inconclusivos - 3. Qualidade de engenharia: CI/CD, Docker, sanitizers, OpenSSF, reprodutibilidade - - When to use: autoavaliação contínua e planejamento de melhorias - - How: medir cada dimensão separadamente, priorizar gargalos - -## Key Concepts -- **UNKNOWN (45.6%)**: maior gargalo — timeout de 300s insuficiente, path exploration não otimizada, solver Z3 sem tuning -- **Testes E2E ausentes**: 3 inconsistências NPM escaparam dos unit tests — pipeline completo (compile → instrument → link → execute) precisa ser automatizado no CI -- **WASM**: pipeline de lifting funcional (wasm2c 1.0.41 + wasi-sdk 33.0), passes em adaptação — feature em desenvolvimento ativo -- **OpenSSF Best Practices**: certificação em processo — atende critérios de disponibilidade, funcionalidade, reprodutibilidade, sustentabilidade - -## Mental Models -- Use **UNKNOWN como KPI de engenharia**: 45.6% direciona o próximo ciclo de desenvolvimento -- Pense em **modernização como pré-requisito, não como fim**: LLVM 16, CI/CD, Docker são a base para avanços algorítmicos futuros -- Use **TestComp como validação externa**: resultados reproduzíveis por terceiros via Docker + BenchExec -- Trate **WASM como crescimento orgânico do pipeline**: mesmo IR, mesmos passes, novo formato de entrada - -## Limitações - -1. **UNKNOWN alto (45.6%)**: timeout tuning, estratégias de solver SMT, heurísticas de path exploration -2. **Testes E2E ausentes no CI**: pipeline completo não automatizado — 3 bugs escaparam dos unit tests -3. **Sem baseline comparativo no TestComp**: resultados reportados sem comparação direta com concorrentes na mesma categoria -4. **WASM em desenvolvimento**: pipeline de lifting validado, mas passes ainda não adaptados para modelo de memória linear - -## Perspectivas - -1. **WASM**: completar adaptação dos passes para memória linear, benchmarks Juliet CWE-119/416 compilados para WASM -2. **Redução de UNKNOWN**: tuning de timeout, portfólio de solvers SMT, slicing estático (DG Library) -3. **Testes E2E no CI**: automatizar compile → instrument → link → execute com verificação de vereditos -4. **NÃO no escopo deste paper**: DG Library, AFL++, Smart Seeds, Coordenador — são trabalhos futuros do pré-projeto Map2Check 2.0 - -## Key Takeaways -1. Modernização de engenharia é pré-requisito para qualquer avanço — sem LLVM 16, CI/CD, Docker não há competição possível -2. TestComp 2026 score 57 é prova de viabilidade, não de excelência — há espaço significativo para melhoria -3. 45.6% UNKNOWN é a métrica-alvo para o próximo ciclo de desenvolvimento -4. WASM é a próxima fronteira de memory safety — pipeline de lifting funcional, passes em adaptação -5. Projeto open source, código público, infraestrutura de artefato validada — pronto para contribuições da comunidade - -## Connects To -- **Ch 4**: Resultados TestComp 2026 e CWE mapping — fundamento empírico para as conclusões -- **Ch 3**: Arquitetura — base de engenharia que viabilizou os resultados -- **Pré-projeto Map2Check 2.0**: próximos passos (DG, AFL++, Smart Seeds) — fora do escopo do paper SBSeg -- **WASM Implementation Plan**: `docs/paper-sbseg-2026/wasm-implementation-plan.md` diff --git a/.opencode/skills/map2check-sbseg2026/cheatsheet.md b/.opencode/skills/map2check-sbseg2026/cheatsheet.md deleted file mode 100644 index 2af07ca26..000000000 --- a/.opencode/skills/map2check-sbseg2026/cheatsheet.md +++ /dev/null @@ -1,80 +0,0 @@ -# Cheatsheet — Map2Check SBSeg 2026 - -## Decision Rules - -| Situação | Ação | Por quê | -|:---------|:-----|:--------| -| Pass LLVM não executa com `opt -O0` | Adicionar `isRequired() = true` | New PM só executa passes required em O0 | -| KLEE reclama de flag desconhecida | Verificar API da versão KLEE atual | Flags mudaram entre KLEE 2.0 → 3.x | -| Target function errada (ex: `__VERIFIER_error`) | Passar `-function-name=reach_error` na CLI | Nome da função-alvo inconsistente entre env var e cl::opt | -| UNKNOWN > 40% nos benchmarks | Investigar timeout tuning (300s → 600s?) + estratégias de solver | Timeout insuficiente ou path exploration não otimizada | -| Precisa garantir reprodutibilidade | Dockerfile.dev (Ubuntu 22.04 + LLVM 16) | Ambiente idêntico em qualquer máquina | -| Unit tests passando mas bugs escapam | Implementar testes E2E (compile → instrument → link → execute) | Unit tests não cobrem integração entre componentes | - -## Trade-off Matrix: Pipeline Stages - -| Estágio | Custo (tempo) | Cobertura | Precisão | -|:--------|:-------------|:----------|:---------| -| Fuzzing (LibFuzzer) | Baixo (segundos) | Alta (superficial) | Baixa (false positives) | -| Execução Simbólica (KLEE) | Alto (minutos) | Média (profunda) | Alta (contra-exemplos precisos) | -| Invariantes Indutivos (Crab-LLVM) | Médio | Baixa (propriedades específicas) | Alta (provas formais) | - -## Thresholds & Defaults - -| Parâmetro | Valor padrão | Significado | -|:----------|:------------|:------------| -| Timeout TestComp | 300s por task | Se verificação não converge em 5 min → UNKNOWN | -| Solver SMT | Z3 | Resolve path constraints na execução simbólica | -| Target function | `reach_error` | Função que indica violação de propriedade | -| Optimization level | O0 | Sem otimização para preservar debug info | -| Docker base | Ubuntu 22.04 | Sistema operacional do container de build | - -## Tells & Smells - -| Sinal | Diagnóstico provável | -|:------|:---------------------| -| Todos os passes carregam mas vereditos errados | `isRequired()` faltando → passes não executam de fato | -| `Unknown command line argument` no KLEE | Flags da versão KLEE 2.0 usadas com KLEE 3.1 | -| UNKNOWN consistente em benchmarks com loops | Timeout insuficiente ou path explosion em laços | -| FALSE em benchmark que deveria ser TRUE | Bug de regressão na instrumentação — rodar checkpoint | -| Cobertura de branches estagnada após N iterações | Magic number bloqueando fuzzer — acionar KLEE | - -## Checklist: Publicação SBSeg SF - -- [ ] Submissão até 20/jul/2026 -- [ ] 8 páginas (corpo) + até 2 páginas (referências/apêndices) -- [ ] Template SBC -- [ ] Vídeo técnico obrigatório (5-7 min) -- [ ] Pelo menos 1 autor inscrito no evento -- [ ] Demonstração ao vivo (Docker + pipeline E2E) -- [ ] CTA integrado ao camera ready (até 14/ago) -- [ ] Single-blind (autores conhecidos) -- [ ] Código aberto (elegível a prêmios) - -## WASM Pipeline Quick Reference - -| Comando | Descricao | -|:--------|:----------| -| `map2check --wasm --memtrack modulo.wasm` | Pipeline completo: lift + instrument + KLEE | -| `map2check --wasm --check-overflow modulo.wasm` | Deteccao de overflow aritmetico no WASM | -| `/opt/wasi-sdk-33.0-x86_64-linux/bin/clang --target=wasm32-wasip1 -o modulo.wasm modulo.c` | Compilar C para WASM | -| `wasm2c modulo.wasm -o modulo.c` | Lifting WASM para C (WABT 1.0.41) | - -## Propriedades Detectaveis no WASM - -| Propriedade | Detectavel? | Mecanismo | -|:------------|:------------|:----------| -| no-overflow (CWE-190) | Sim | OverflowPass: opera em operacoes binarias | -| coverage-error-call | Sim | TargetPass: busca reach_error() por nome | -| valid-free (CWE-415) | Parcial (heap) | dlmalloc interception: w2c_*_dlfree | -| valid-memtrack (CWE-401) | Parcial (heap) | dlmalloc interception: w2c_*_dlmalloc | -| valid-deref (CWE-119/787) | Parcial (heap) | Per-allocation bounds check | -| valid-memsafety (stack) | Nao | Linear memory gap: stack usa alloca, nao dlmalloc | - -## CI Debug (wasm-rt.h) - -| Erro | Causa | Correcao | -|:-----|:------|:---------| -| fatal error: wasm-rt.h not found | WABT nao instalado no CI | apt install wabt; find_path busca /usr/include | -| NO_DEFAULT_PATH bloqueia find_path | flag NO_DEFAULT_PATH em find_path | Remover NO_DEFAULT_PATH do CMakeLists.txt | -| WasmRuntimeStubs.bc falha | add_custom_target ALL forcou build | Remover ALL, tornar target opcional | diff --git a/.opencode/skills/map2check-sbseg2026/glossary.md b/.opencode/skills/map2check-sbseg2026/glossary.md deleted file mode 100644 index b0edc85b8..000000000 --- a/.opencode/skills/map2check-sbseg2026/glossary.md +++ /dev/null @@ -1,125 +0,0 @@ -# Glossary — Map2Check SBSeg 2026 - -**AFL++** — American Fuzzy Lop++, fuzzer guiado por cobertura, sucessor do AFL (Ch 1, Pré-projeto) - -**ASAN** — AddressSanitizer, detector de erros de memória em tempo de execução do LLVM (Ch 3) - -**AssertPass** — Pass LLVM que instrumenta chamadas a `__VERIFIER_assert` (Ch 3) - -**BMC** — Bounded Model Checking, verificação exaustiva até profundidade K de loops (Ch 2) - -**C++17** — Padrão C++ adotado na modernização, traz `std::filesystem`, structured bindings (Ch 3) - -**CBMC** — C Bounded Model Checker, verificador BMC usado na versão original do Map2Check (Ch 2) - -**CI/CD** — Continuous Integration / Continuous Deployment com GitHub Actions (Ch 3) - -**CPAchecker** — Framework de verificação configurável com múltiplas estratégias, referência desde SV-COMP 2013 (Ch 2) - -**Crab-LLVM** — Análise estática baseada em interpretação abstrata para invariantes indutivos (Ch 2) - -**CWE-119** — Buffer Overflow: acesso fora dos limites de buffer (Ch 1, Ch 4) - -**CWE-190** — Integer Overflow/Wraparound (Ch 4) - -**CWE-401** — Memory Leak: vazamento de memória alocada (Ch 1, Ch 4) - -**CWE-415** — Double-Free: liberação dupla do mesmo ponteiro (Ch 1, Ch 4) - -**CWE-416** — Use-After-Free: acesso a memória já liberada (Ch 1, Ch 4) - -**CWE-787** — Out-of-bounds Write (Ch 1, Ch 4) - -**DG Library** — Dependence Graph, biblioteca para slicing estático baseado em SDG (Pré-projeto) - -**Execução Simbólica** — Técnica que analisa programas com valores simbólicos, construindo path constraints (Ch 1) - -**FALSE (veredito)** — Propriedade de segurança violada: bug encontrado com contra-exemplo (Ch 4, Ch 5) - -**FuSeBMC** — Ferramenta de ponta com smart seeds e BMC para desbloquear fuzzer (Ch 1) - -**GenerateAutomataTruePass** — Pass que gera autômato de witness em GraphML (Ch 3) - -**GraphML** — Formato XML padronizado para witness de verificação SV-COMP (Ch 3) - -**isRequired()** — Método do New PM que declara passe como sempre requerido — fix crítico (Ch 3, Ch 4) - -**Iterative Deepening** — Combinação KLEE + LibFuzzer em fases alternadas (Ch 3) - -**KLEE** — Motor de execução simbólica para LLVM bitcode, versão 3.x (Ch 2, Ch 3) - -**Legacy Pass Manager** — API antiga do LLVM para passes, deprecada desde v13 (Ch 3) - -**LibFuzzer** — Motor de fuzzing do LLVM guiado por SanitizerCoverage (Ch 2, Ch 3) - -**LLVM 16** — Versão do framework LLVM adotada na modernização (Ch 3) - -**LLVM IR** — Representação Intermediária do LLVM, base para análise e instrumentação (Ch 1, Ch 3) - -**LoopPredAssumePass** — Pass que injeta predicados `__VERIFIER_assume` em laços (Ch 3) - -**Map2CheckLibrary** — Pass que renomeia `main` → `__map2check_main__` (Ch 3) - -**MemoryTrackPass** — Pass que instrumenta acessos a memória (alloc, free, deref) (Ch 3, Ch 4) - -**New Pass Manager** — API C++ moderna do LLVM, usa `PassInfoMixin` (Ch 3) - -**NonDetPass** — Pass que substitui `__VERIFIER_nondet_*` por chamadas simbólicas (Ch 3) - -**OpenSSF** — Open Source Security Foundation, checklist Best Practices (Ch 3) - -**OpenSSF Best Practices** — Programa de certificação de boas práticas para projetos open source (Ch 1, Ch 3, Ch 6) - -**OverflowPass** — Pass LLVM que emprega análise de intervalos para detectar buffer overflow e integer overflow (Ch 3, Ch 4) - -**SBSeg** — Simpósio Brasileiro de Segurança da Informação e de Sistemas Computacionais (Ch 5) - -**Smart Seeds** — Sementes geradas por BMC e injetadas no fuzzer (FuSeBMC) (Ch 1, Pré-projeto) - -**SMT Solver** — Satisfiability Modulo Theories, resolve path constraints (Z3) (Ch 1) - -**SV-COMP** — Competition on Software Verification, benchmark padrão (Ch 1) - -**Symbiotic** — Ferramenta que integra slicing estático (DG) com KLEE (Ch 1) - -**TargetPass** — Pass que marca função-alvo para verificação (e.g. `reach_error`) (Ch 3) - -**TestComp 2026** — Competition on Software Testing, sub-categoria Heap (Ch 4) - -**TrackBasicBlockPass** — Pass que rastreia cobertura de blocos básicos (Ch 3) - -**TRUE (veredito)** — Propriedade de segurança garantida: programa é seguro (Ch 4) - -**TSAN** — ThreadSanitizer, detector de data races do LLVM (Ch 3) - -**UBSAN** — UndefinedBehaviorSanitizer, detector de comportamento indefinido do LLVM (Ch 3) - -**UNKNOWN (veredito)** — Verificação inconclusiva dentro do timeout (Ch 4, Ch 6) - -**WASM** — WebAssembly, módulos portáteis para runtimes como Wasmtime/Wasmer (Ch 4, Ch 6) - -**Witness** — Evidência de verificação: contra-exemplo ou prova de corretude (Ch 3) - -**Z3** — Solver SMT da Microsoft Research, usado como solver padrão no Map2Check (Ch 4) - -**CPAchecker** — Framework de verificação configurável com múltiplas estratégias (análise de valor, predicate abstraction, BMC) (Ch 2) - -**Program Slicing** — Técnica de redução de código que remove trechos irrelevantes para a propriedade de segurança (Ch 1, Ch 2) - -**Smart Seeds** — Sementes geradas por BMC e injetadas no fuzzer para desbloquear caminhos com magic numbers (Ch 1, Pré-projeto) - -**wasi-sdk** — Toolchain para compilar C para WASM com target `wasm32-wasip1` (Ch 4, Implementation Plan) - -**Portfólio de Solver** — Uso combinado de múltiplos solvers SMT (Z3, Boolector, Yices) para maximizar taxa de resultados conclusivos (Ch 2) - -**wasm2c** — Ferramenta do WABT que converte binários `.wasm` para código C com semântica preservada. Gera funções `w2c_*_dlmalloc`/`w2c_*_dlfree` para alocação dinâmica e `w2c_*_start` como entrypoint (Ch 4) - -**Linear Memory** — Array contíguo de bytes (`u8[]`) que serve como heap, stack e dados no WebAssembly. O `wasm2c` modela como `wasm_rt_memory_t` com campos `data` (ptr) e `size` (bytes) (Ch 4) - -**dlmalloc** — Doug Lea's malloc, implementação do alocador do musl libc. Quando código C é compilado para WASM, o dlmalloc é compilado inline no binário; após lifting com `wasm2c`, aparece como funções `w2c_*_dlmalloc` (Ch 4) - -**Entrypoint Translation** — Padrão para converter o entrypoint do WASM (`w2c_*_start`) para `main()` compatível com o pipeline Map2Check. Implementado via `generateWasmWrapperStatic` que instancia o módulo, invoca `_start` e libera recursos (Ch 4) - -**Per-Allocation Bounds** — Rastreamento de limites de memória por alocação individual, via interceptação de `w2c_*_dlmalloc`/`dlfree` no MemoryTrackPass. Detecta buffer overflow em heap (malloc-based) mas não em stack/globais (Ch 4) - -**WasmRuntimeStubs** — Substitui as funções de runtime do WABT (`wasm_rt_allocate_memory` baseado em mmap) por implementações KLEE-friendly (`calloc`/`free`). Redireciona `wasm_rt_trap` para `map2check_error` (Ch 4) diff --git a/.opencode/skills/map2check-sbseg2026/patterns.md b/.opencode/skills/map2check-sbseg2026/patterns.md deleted file mode 100644 index 85ab0bd58..000000000 --- a/.opencode/skills/map2check-sbseg2026/patterns.md +++ /dev/null @@ -1,86 +0,0 @@ -# Patterns — Map2Check SBSeg 2026 - -## Hybrid Verification Pipeline -**When to use**: programas C complexos onde nem fuzzing puro nem execução simbólica pura bastam -**How**: fases alternadas — LibFuzzer explora rápido bugs superficiais, KLEE resolve branches com magic numbers via path constraints -**Trade-offs**: fuzzer é rápido mas cego para branches complexos; KLEE é preciso mas sofre de path explosion - -## Pass Migration Pattern (Legacy PM → New PM) -**When to use**: migrar qualquer pass LLVM do Legacy Pass Manager -**How**: -1. Herdar de `PassInfoMixin` em vez de `ModulePass`/`FunctionPass` -2. Implementar `PreservedAnalyses run(Function &F, FunctionAnalysisManager &AM)` ou `run(Module &M, ModuleAnalysisManager &AM)` -3. Registrar com `PassPluginLibraryInfo` e callback `PB.registerPipelineParsingCallback` -4. **Sempre** retornar `isRequired() = true` — sem isso, `opt -O0` pula o pass -**Trade-offs**: New PM é mais verboso mas oferece análise lazy e paralelismo - -## CWE Mapping Pattern -**When to use**: tornar resultados de verificação formal acionáveis para times de AppSec -**How**: -1. Identificar qual propriedade SV-COMP cada pass verifica (ex: valid-free → CWE-415) -2. Documentar mapeamento em tabela: Propriedade → CWE → Pass responsável -3. Gerar output que referencia CWEs diretamente (ex: "CWE-416 detected at line 42") -**Trade-offs**: nem toda violação de propriedade SV-COMP tem CWE correspondente direto - -## Checkpoint Validation Pattern -**When to use**: garantir que correções não introduzem regressões silenciosas -**How**: -1. Selecionar benchmarks canônicos (ex: `array-1.c`, `array-2.c`) -2. Executar pipeline completo e capturar veredito + counter-example -3. Comparar com baseline (veredito esperado + contra-exemplo esperado) -4. Automatizar com scripts `run_checkpoint.sh` + `verify_verdicts.sh` -**Trade-offs**: cobre apenas os benchmarks selecionados, não detecta regressões em paths não testados - -## Docker Reproducibility Pattern -**When to use**: garantir que resultados são reproduzíveis em qualquer máquina -**How**: -1. `Dockerfile.dev` baseado em Ubuntu 22.04 + LLVM 16 + KLEE 3.1 -2. Instalar todas as dependências no Dockerfile (sem "funciona na minha máquina") -3. Build automatizado no CI (GitHub Actions) -4. Documentar comandos exatos de build e execução -**Trade-offs**: imagem Docker é grande (~GBs) mas elimina barreiras de instalação e garante reprodutibilidade científica - -## Iterative Deepening Pattern -**When to use**: combinar fuzzing + execução simbólica eficientemente -**How**: -1. Fase 1: LibFuzzer explora com seeds aleatórias, cobre caminhos superficiais -2. Fase 2: Sementes que estagnam (sem novos branches) são passadas ao KLEE -3. Fase 3: KLEE resolve path constraints, gera novas entradas que desbloqueiam caminhos -4. Repetir até timeout ou cobertura-alvo atingida -**Trade-offs**: custo de transição entre fases (serialização/deserialização de estado) pode dominar em programas pequenos - -## Static Analysis + Sanitizers Quality Gate -**When to use**: manter qualidade do código da própria ferramenta de verificação -**How**: -1. `.clang-tidy` config para C++, `.cppcheck-suppressions.txt` para C -2. CMake targets: ASAN, UBSAN, TSAN -3. Script `run-static-analysis.sh` executa todas as verificações -4. CI (GitHub Actions) roda static analysis + sanitizers em cada push -**Trade-offs**: sanitizers adicionam overhead de runtime (2-5x), mas detectam bugs que testes unitários perdem - -## WASM Lifting Pipeline -**When to use**: verificar memory safety em binarios .wasm de terceiros -**How**: -1. wasm2c (WABT 1.0.41) converte .wasm para codigo C com runtime musl inline -2. Clang-16 compila o C para LLVM IR, preservando semantica de alocacao -3. generateWasmWrapperStatic cria main() canonica que instancia o modulo e invoca w2c_*_start -4. llvm-link une IR levantado + wrapper, aplica passes Map2Check -5. KLEE executa o IR instrumentado com WasmRuntimeStubs.bc (KLEE-friendly) -**Trade-offs**: overhead do IR levantado (~43 funcoes) vs C nativo (~15 funcoes) - -## dlmalloc Interception for Per-Allocation Bounds -**When to use**: detectar heap overflow em codigo WASM gerado a partir de C (wasi-sdk/musl) -**How**: -1. MemoryTrackPass identifica w2c_*_dlmalloc/dlfree por StringRef::contains -2. instrumentWasmMalloc extrai offset (i32 retorno) + size (arg), registra no AllocationLog -3. instrumentWasmFree marca offset como liberado -4. instrumentWasmBoundsCheck extrai offset do GEP e verifica via is_valid_allocation_address -**Trade-offs**: funciona para heap (3/3 Juliet FALSE), nao para stack/globals (12/12 UNKNOWN) - -## Entrypoint Translation -**When to use**: unificar pipeline Map2Check (que espera main) com codigo levantado do wasm2c -**How**: -1. Extrair nome do modulo: w2c__start -2. Gerar wrapper C com main() que instancia, invoca _start e libera -3. Compilar wrapper para .bc, linkar com IR levantado via llvm-link -**Trade-offs**: wrapper adiciona overhead minimo. Nomes hex (0x5F para _) tratados pelo WasmLifter diff --git a/CHANGELOG.md b/CHANGELOG.md index d67070c26..788d9dee6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,8 +5,105 @@ The format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.0. ## [Unreleased] +## [9.0.0] - Unreleased + +A major version: the fuzzing engine changed (LibFuzzer → AFL++ 4.40c), the +`--nondet-generator` values changed (`fuzzer` → `afl`), and several verdicts +change meaning -- a KLEE run that did not explore every path is no longer +TRUE, and the program's own `abort()` prunes a path instead of ending the +search. Measured against the v15 baseline in `docs/reports/tacas-experiment-log.md`. + +### Changed (breaking) + +- **The default hybrid is the alternation** (`--alternate-engines`, with seed + exchange) whenever `--timeout` is given. `--fixed-hybrid` keeps the 8.x + schedule. Measured on the 213-task Cover-Error sample: 157 covered, against + 128 for the 8.x hybrid. On Cover-Branches: 53.5% against 46.5% (R26). +- The fuzzer's corpus is part of Cover-Branches suites by default + (`MAP2CHECK_FUZZER_SUITE=0` turns it off). + +- Fuzzing engine: LibFuzzer replaced by AFL++ 4.40c (persistent mode, PCGUARD, + CmpLog). `--nondet-generator fuzzer` is now `--nondet-generator afl`. +- Verdicts: TRUE only from an exhaustive KLEE exploration. KLEE exiting 0 after + its timer, after concretizing a symbolic input (floats), after killing + states (`*.err`, `*.early`), near its memory cap, or after crashing is now + UNKNOWN, never TRUE. +- The program's own `abort()` (inline or through `assume_abort_if_not`) prunes + the path (`map2check_assume(0)`, `klee_silent_exit` under KLEE) instead of + stopping KLEE's search. + +### Added + +- `--slice` for every property (reachability, assert, memtrack, memcleanup, + overflow) through sbt-slicer, preserving the nondet read order; the slice is + computed once per run (`.slice/`), a slicer failure is remembered, and + the criteria are collected without regex. Experiment knobs: + `MAP2CHECK_SLICE_CLEANUP=light|o2`, `MAP2CHECK_SLICER_FLAGS`. +- `--seed-exchange`: the engines hand each other input vectors through a + persistent store (`.seeds/`) -- the fuzzer queue, replayed through the + witness binary into typed `.ktest` seeds for KLEE (ranked: new-edge entries + first), and KLEE's vectors back to the fuzzer. +- `--alternate-engines`: AFL++ and KLEE take turns, each ending when its engine + stagnates (`AFL_EXIT_ON_TIME`; KLEE's covered instructions from `run.stats`, + SQLite optional), with windows and patience doubling every round. +- KLEE's vectors, completed with zeros past their end, are run natively + through the witness after every KLEE phase that found nothing. +- AFL++ binaries built once per run (`.build/`), within one build budget. +- The fuzzer's corpus contributes Cover-Branches test cases (up to half the + suite, deduplicated). +- `--add-invariants` profiles (`MAP2CHECK_CLAM_PROFILE=default|memory|none`), + the number of invariants inserted in the log, and a fallback when Clam + fails. `MAP2CHECK_PREOPT=ssa` (reachability and assert): the module in SSA + form before instrumentation. +- `MAP2CHECK_CHECK_CSTRINGS=1`: the strings a `%s` or `puts` reads are checked. +- `MAP2CHECK_KLEE_MAX_MEMORY` (MB): KLEE's memory cap, default unchanged. +- Official Test-Comp 2026 validation (`tests/testcomp/official/run.sh`): + suites are generated and validated under BenchExec with the competition's + validators (TestCov gcc/clang unformatted, TestCoCa clang formatted), each + task with its own property files; the corpora are drawn from the official + task set with proportional stratification (`build_corpus_official.py`). + +### Fixed + +- Nondet types the instrumentation did not model (#74): `float`, `longlong`, + `ulonglong`, `u8`/`u16`/`u32` and `__VERIFIER_nondet_memory` were external + calls, so KLEE killed every state and the task was UNKNOWN by construction. + Each now has a KLEE and an AFL++ generator of the right width, a full-width + log entry (64-bit and float values no longer go through the `int` logger; + floats print as `%.9g`) and a ktest decoding; `nondet_memory` yields one + `uchar` input per byte, as the validators' harness reads it. Floats in the + official Cover-Error corpus: 11/33 → 33/33, every suite confirmed by all + three validators. +- The KLEE runtime wrote its nondet log with the values still symbolic, and + uClibc's `vfprintf` forked on every digit (#75): a straight-line program + with ten nondet reads reached its target and never finished. The values are + now pinned to one model before printing, the rows are formatted without + `printf` (byte-identical output), a log past 1,024 rows is left to the + violating `.ktest`, and the log container grows geometrically. Ten reads: + UNKNOWN → FAILED in 1 s; 10,000 reads: UNKNOWN → FAILED in 31 s. +- The AFL++ generator replayed its input from the start past its end: a + `while (__VERIFIER_nondet_int())` loop never ended and afl-fuzz aborted in + its dry run. Reads past the end are now zero. +- MemoryTrackPass matched memory intrinsics by their LLVM 6 names: + `memset/memcpy/memmove` were never checked under LLVM 16. +- A fuzzer binary that fails to link is reported with its cause instead of as + a build timeout; an unreadable input program is reported as such. +- The Cover-Branches suite: the 50-case cap and duplicates count across + phases, and a run starts from an empty suite. +- Evaluation harnesses: children no longer inherit the manifest's descriptor + (the program under test could move the loop's offset); a crash replayed from + the fuzzer is not a tool failure. + + ### Changed +- Replaced LibFuzzer with AFL++ 4.40c (persistent, PCGUARD) as the fuzzing engine. +- tacasv2a: `--slice` no longer crashes KLEE and its test suites stay valid + on the original program. The slicer runs with `-cutoff-diverging=false` + (the cutoff's `exit(0)` had no debug location and KLEE rejected the + module), and every `__VERIFIER_nondet_*` function is a slicing criterion, + so the read order is preserved. `--slice` now also works with + `--check-asserts`. The slice is logged in functions/blocks/instructions. - Migrated the toolchain from LLVM 6.0 to LLVM 16, moving all instrumentation passes (`modules/backend/pass/`) to the New Pass Manager and opaque pointers. - Migrated the codebase to C++17 (CMake `CMAKE_CXX_STANDARD` 11 → 17, required by LLVM 16 headers). - Upgraded KLEE to 3.1. diff --git a/CLAUDE.md b/CLAUDE.md index b54faed48..f48d9f3f3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co ## What is Map2Check -Map2Check is a bug-hunting tool that automatically generates and checks safety properties in C programs. It tracks memory pointers and variable assignments to check user-specified assertions, overflow, and pointer safety. It uses LLVM 16, LibFuzzer, and KLEE 3.1 for test case generation. +Map2Check is a bug-hunting tool that automatically generates and checks safety properties in C programs. It tracks memory pointers and variable assignments to check user-specified assertions, overflow, and pointer safety. It uses LLVM 16, AFL++, and KLEE 3.1 for test case generation. ## Build System @@ -30,7 +30,7 @@ ninja && ninja install # binary at release/bin/map2check ``` -`Dockerfile.dev` already builds and installs KLEE 3.1 (to `/opt/klee`) and provides LibFuzzer via LLVM 16's compiler-rt — do **not** pass `-DSKIP_KLEE=ON` or `-DSKIP_LIB_FUZZER=ON` unless you deliberately want a build without KLEE/LibFuzzer support. +`Dockerfile.dev` already builds and installs KLEE 3.1 (to `/opt/klee`) and installs AFL++ 4.40c as a standalone toolchain (found at run time under `/usr/local/bin`) — do **not** pass `-DSKIP_KLEE=ON` or `-DSKIP_AFL_PLUS_PLUS=ON` unless you deliberately want a build without KLEE/AFL++ support. ### Manual CMake build (if LLVM 16 is locally available, e.g. via apt.llvm.org) @@ -39,7 +39,7 @@ export LLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm export CXX=/usr/bin/clang++-16 export CC=/usr/bin/clang-16 mkdir build && cd build -cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON +cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON ninja && ninja install ``` @@ -47,11 +47,27 @@ ninja && ninja install | Flag | Default | Purpose | |------|---------|---------| -| `SKIP_LIB_FUZZER` | OFF | Skip building LibFuzzer | +| `SKIP_AFL_PLUS_PLUS` | OFF | Skip building AFL++ | | `SKIP_KLEE` | OFF | Skip building KLEE/Z3/STP/MiniSat | | `ENABLE_TEST` | OFF | Build GTest unit tests | | `REGRESSION` | OFF | Download regression test benchmarks | | `MAP2CHECK_ENABLE_SANITIZERS` | OFF | Enable ASan + UBSan (forces dynamic linking) | +| `ENABLE_CLAM` | OFF | Enable `--add-invariants` via Clam (needs Clam in the image) | + +`Dockerfile.dev` builds **Clam `dev16`** (the renamed crab-llvm) into `/opt/clam`. It +supplies the abstract-interpretation invariants behind `--add-invariants`, which is +refused with exit code 3 unless the build was configured with `-DENABLE_CLAM=ON` *and* +the driver is present at `$CLAM_DIR/bin/clam.py`. It is opt-in because an unsound +invariant produces a wrong TRUE rather than an error — see +[the dependency review](docs/reports/2026-08-16-crabllvm-review.md). + +Status of `--add-invariants` (2026-09-30): **optional and under study**. +- The crab-llvm invariants of the SV-COMP 2019/2020 builds were emitted as `llvm.assume`, + which neither `NonDetPass` nor KLEE consumes. +- On the current hybrid, Clam's profiles (`MAP2CHECK_CLAM_PROFILE=default|memory|none`) + have shown no gain so far. +- A dedicated study round is pending; see `docs/reports/tacas-experiment-log.md` (INV-1, + R25) and `docs/backlog.md`. Enabling sanitizers switches from static to shared linking and enables `-fsanitize=address,undefined -fno-omit-frame-pointer -g`. @@ -59,7 +75,7 @@ Enabling sanitizers switches from static to shared linking and enables `-fsaniti ```sh cd build -cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON +cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON ninja && ninja install && ctest ``` @@ -95,10 +111,22 @@ Entry point: `map2check.cpp` → `main()`. Parses CLI options (via Boost.Program 1. `compileCFile()` — compile the input C file to LLVM IR via clang 2. `callPass()` — apply the appropriate LLVM pass (instrumentation) 3. `linkLLVM()` — link instrumented IR with the library backend -4. `applyNonDetGenerator()` — invoke LibFuzzer or KLEE to generate inputs +4. `applyNonDetGenerator()` — invoke AFL++ or KLEE to generate inputs 5. `executeAnalysis()` — run the instrumented binary; collect results 6. Witness/counterexample generation in [counter_example/](modules/frontend/counter_example/) and [witness/](modules/frontend/witness/) +With no `--nondet-generator`, `main()` runs the hybrid, and each phase builds a new `Caller`: +- **Alternating (the default since 9.0, needs `--timeout`):** AFL++ and KLEE take turns + (`alternateEngines()`), each stopped on stagnation. +- **Fixed (`--fixed-hybrid`):** the 8.x schedule. + +State that must survive the phases lives beside the scratch directory, not inside it: +`.seeds/` (seed store), `.slice/` (slice cache) and `.build/` (AFL++ +binaries). + +A TRUE verdict requires an exhaustive KLEE run: see `kleeDroppedPaths()` in +`modules/frontend/test_suite/ktest_reader.cpp`. + **Verification modes** (enum `Map2CheckMode`): `MEMTRACK_MODE`, `REACHABILITY_MODE`, `OVERFLOW_MODE`, `ASSERT_MODE`, `MEMCLEANUP_MODE`. To add a new analysis: extend `callPass()` in [caller.cpp](modules/frontend/caller.cpp) and add a CLI option in [map2check.cpp](modules/frontend/map2check.cpp). @@ -125,7 +153,7 @@ Key API: [Map2CheckFunctions.h](modules/backend/library/header/Map2CheckFunction To add a new analysis mode: implement the interface in [AnalysisMode.h](modules/backend/library/header/AnalysisMode.h) and add a new `AnalysisMode.c` file alongside the existing ones. -**NonDet generators** are selected at link time: `NonDetGeneratorNone.c`, `NonDetGeneratorKlee.c`, `NonDetGeneratorLibFuzzy.c`. +**NonDet generators** are selected at link time: `NonDetGeneratorNone.c`, `NonDetGeneratorKlee.c`, `NonDetGeneratorAFL.c`. ## Submodule Note diff --git a/CMakeLists.txt b/CMakeLists.txt index 1f55a125e..b3f272042 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,13 +1,14 @@ cmake_minimum_required(VERSION 3.20) -project(Map2Check VERSION 8.0.0 LANGUAGES C CXX) +project(Map2Check VERSION 9.0.0 LANGUAGES C CXX) option(BUILD_DOC "Build documentation" OFF) -option(SKIP_LIB_FUZZER "Don't use libFuzzer" OFF) +option(SKIP_AFL_PLUS_PLUS "Don't use AFL++" OFF) option(SKIP_KLEE "Don't use KLEE" OFF) option(REGRESSION "Prepare Regression Tests" OFF) option(ENABLE_TEST "Build all tests" OFF) option(MAP2CHECK_ENABLE_SANITIZERS "Enable AddressSanitizer + UndefinedBehaviorSanitizer for testing" OFF) option(MAP2CHECK_DYNAMIC_LINK "Link dynamically (required when KLEE/Z3 are only available as shared libraries)" OFF) +option(ENABLE_CLAM "Enable --add-invariants via Clam (requires Clam dev16 installed, see docs/reports/2026-08-16-crabllvm-review.md)" OFF) set(CMAKE_CXX_STANDARD 17) set(CMAKE_CXX_STANDARD_REQUIRED ON) @@ -38,12 +39,29 @@ else() set(CMAKE_EXE_LINKER_FLAGS "-Bstatic -static-libgcc -static-libstdc++") endif() +# --- Abstract-interpretation invariants (Clam, formerly crab-llvm) --- +# Off by default, and deliberately so: an unsound invariant does not raise an +# error, it produces a wrong TRUE. Under KLEE klee_assume() prunes a reachable +# state; under AFL++ nondet_assume() longjmps past the input and the execution +# disappears. Promoting this to a default needs the differential evidence +# described in docs/reports/2026-08-16-crabllvm-review.md. +# +# Clam is a subprocess tool, not a linked library, so this only records intent. +# The binary still checks at run time that the driver is actually installed -- +# neither condition implies the other. +if(ENABLE_CLAM) + add_compile_definitions(MAP2CHECK_ENABLE_CLAM) + message(STATUS "Clam invariants: ENABLED (--add-invariants available)") +else() + message(STATUS "Clam invariants: disabled (-DENABLE_CLAM=ON to enable)") +endif() + # --- Core dependencies --- include(cmake/FindClang.cmake) include(cmake/FindBoost.cmake) -if(NOT SKIP_LIB_FUZZER) - include(cmake/FindLibFuzzer.cmake) +if(NOT SKIP_AFL_PLUS_PLUS) + include(cmake/FindAFLPlusPlus.cmake) endif() if(NOT SKIP_KLEE) diff --git a/Dockerfile.dev b/Dockerfile.dev index 1eba1a17a..9499e6c09 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -127,9 +127,233 @@ ENV PATH="/opt/klee/bin:${PATH}" ENV LD_LIBRARY_PATH="/opt/klee/lib" # ============================================================ -# 7. LibFuzzer (already included in LLVM 16 compiler-rt) +# 7. AFL++ 4.40c (LLVM 16, PCGUARD) # ============================================================ -# No extra install needed — available via clang-16 -fsanitize=fuzzer +# Tag-pinned like KLEE above: AFL++ has versioned releases, so -b v4.40c is +# the reproducible pin (the SHA pins in 7b/7c are for projects with none). +# PCGUARD is AFL++'s own SanitizerCoveragePCGUARD pass plugin, built against +# the image's LLVM 16 and loaded by afl-clang-fast; it is the default and most +# robust LLVM mode, lighter than the LTO one. +RUN git clone --depth 1 -b v4.40c https://github.com/AFLplusplus/AFLplusplus.git /tmp/afl++ && \ + cd /tmp/afl++ && \ + make -j"$(nproc)" && \ + make install && \ + rm -rf /tmp/afl++ + +ENV PATH="/usr/local/bin:${PATH}" +# afl-cc locates its runtime relative to its own install; AFL_PATH is a safety +# net for the non-LLVM modes. +ENV AFL_PATH=/usr/local/lib/afl +# Headless, container-safe defaults: afl-fuzz aborts under CI/containers on the +# UI, CPU-affinity, cpufreq-governor and core-pattern checks. PCGUARD is the +# instrumentation mode afl-clang-fast must use everywhere. +ENV AFL_NO_UI=1 \ + AFL_NO_AFFINITY=1 \ + AFL_SKIP_CPUFREQ=1 \ + AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 \ + AFL_LLVM_INSTRUMENT=PCGUARD + +# Fail the image build if AFL++ cannot actually instrument — the same failure +# mode section 7c guards against for sbt-slicer. afl-showmap exits non-zero on +# an uninstrumented binary, and the map is empty, so both checks must pass. +RUN printf 'int main(void){return 0;}\n' > /tmp/aflcheck.c && \ + /usr/local/bin/afl-clang-fast -o /tmp/aflcheck /tmp/aflcheck.c && \ + /usr/local/bin/afl-showmap -q -o /tmp/aflmap -- /tmp/aflcheck && \ + test -s /tmp/aflmap && \ + echo "AFL++ instruments: OK" && rm -f /tmp/aflcheck.c /tmp/aflcheck /tmp/aflmap + +# ============================================================ +# 7b. Clam (formerly crab-llvm) — abstract-interpretation invariants +# ============================================================ +# Clam rewrites the bitcode, inserting verifier.assume(inv) calls that +# NonDetPass rewrites to map2check_crab_assume and the runtime forwards to +# klee_assume. Branch dev16 targets LLVM 16, which is this image's LLVM. +# +# Built here rather than as a CMake ExternalProject: it is a subprocess tool, +# not a linked library, and building it per configure would add tens of minutes +# to every clean Map2Check build for a capability that is off by default +# (-DENABLE_CLAM=ON). See docs/reports/2026-08-16-crabllvm-review.md. +# +# libzstd-dev is required, not optional: LLVM 16 from apt.llvm.org exports +# zstd::libzstd_shared, so Clam's find_package(LLVM) fails outright without it. +# libflint-dev is NOT needed -- that belongs to the PPLite domain, and no +# optional domain is enabled here. Clam's default domain is zones (a DBM, +# built into Crab), the same default the crab-llvm of the SV-COMP builds had; +# what LDD, Apron, Elina and PPLite would add is boxes, oct and pk, which the +# old engine shipped (Apron) and --add-invariants never selected. Whether they +# are worth building is part of the pending --add-invariants study +# (docs/backlog.md). +RUN apt-get update && apt-get install -y \ + libmpfr-dev \ + libzstd-dev \ + libcurl4-openssl-dev \ + && rm -rf /var/lib/apt/lists/* + +# CLAM_INCLUDE_TESTS=OFF: Clam's own lit suite needs `lit` from pip and adds +# build time for tests of a dependency, not of Map2Check. +# +# The compilers are named explicitly rather than left to the ENV CC/CXX set in +# section 11: those are declared 88 lines BELOW this RUN, and a Docker ENV only +# applies to later instructions, so Clam would silently build with the default +# cc/c++ (GCC 11). That is not a cosmetic difference -- sea-dsa defines +# seadsa::mkTLIGetter with a redundant namespace qualification inside its own +# namespace, which clang accepts as -Wextra-qualification but GCC rejects +# outright, and the image build dies at 34%. Upstream's own docker/clam.Dockerfile +# passes these same two flags; clang is the toolchain Clam is built against. +# +# Every one of these four repositories is tracked upstream on a MOVING branch: +# clam, sea-dsa and llvm-seahorn on dev16, Crab on dev. Left unpinned, the +# contents of this image change without any change on our side -- crab@dev +# moved on 2026-08-21, while this section was being written. Pinning makes the +# image reproducible and turns an upstream break into a deliberate bump with a +# diff, instead of a red build nobody caused. +# +# To bump one: replace the SHA, and let the pull_request job in +# .github/workflows/docker-publish.yml prove the new combination still +# compiles and still injects invariants before it reaches develop. +ARG CLAM_SHA=302bf49a8847697f8f16e2c2548ccbc14c226640 # dev16 @ 2026-08-07 +ARG SEADSA_SHA=661855a334c8fda45f45ae74d4e21bbd4e838835 # dev16 @ 2026-08-12 +ARG LLVM_SEAHORN_SHA=8e7e6c62c9f23718973ef9f60d30a593d044287c # dev16 @ 2026-07-04 +ARG CRAB_SHA=5c740fcc9afcc951844d35e20592af81d8d94604 # dev @ 2026-08-21 + +# The dependencies are placed by hand instead of via Clam's `crab` and `extra` +# targets. Those targets are plain `git clone -b dev` custom commands +# (cmake/{crab,seadsa,llvm-seahorn}-git.cmake) with nowhere to pass a SHA, so +# pinning means not using them. Clam's CMakeLists already prefers a dependency +# that is present in-tree over cloning one, which is what makes this work -- +# and because everything is in place before the first configure, the +# configure/clone/reconfigure dance the targets required collapses to a single +# `cmake ..`. +# +# `git init` + `fetch --depth 1 ` rather than `clone -b `: it is +# the only shallow form that takes a commit, so pinning costs no extra history. +RUN set -eux; \ + pin() { \ + git init -q "$2" && \ + git -C "$2" remote add origin "$1" && \ + git -C "$2" fetch -q --depth 1 origin "$3" && \ + git -C "$2" checkout -q FETCH_HEAD; \ + }; \ + pin https://github.com/seahorn/clam.git /tmp/clam "$CLAM_SHA"; \ + pin https://github.com/seahorn/sea-dsa.git /tmp/clam/sea-dsa "$SEADSA_SHA"; \ + pin https://github.com/seahorn/llvm-seahorn.git /tmp/clam/llvm-seahorn "$LLVM_SEAHORN_SHA"; \ + pin https://github.com/seahorn/crab.git /tmp/clam/crab "$CRAB_SHA"; \ + mkdir /tmp/clam/build && cd /tmp/clam/build && \ + cmake .. -DCMAKE_BUILD_TYPE=Release -DCLAM_LLVM_VERSION=16 \ + -DCLAM_INCLUDE_TESTS=OFF \ + -DCMAKE_C_COMPILER=/usr/bin/clang-16 \ + -DCMAKE_CXX_COMPILER=/usr/bin/clang++-16 \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DCMAKE_INSTALL_PREFIX=/opt/clam && \ + cmake --build . -j"$(nproc)" && \ + cmake --build . --target install && \ + rm -rf /tmp/clam + +ENV CLAM_DIR=/opt/clam + +# Fail the image build if Clam cannot inject invariants. The flag combination +# below is measured, not assumed: --llvm-pp-loops and --crab-promote-assume +# were both in the legacy crab-llvm invocation and both defeat injection (the +# first drops it to zero, the second rewrites verifier.assume into the +# llvm.assume intrinsic that NonDetPass does not match). A silent zero here is +# what kept --add-invariants dead for years. +RUN printf 'int main(){int i=0,s=0;while(i<10){s+=i;i++;}return s;}\n' > /tmp/clamcheck.c && \ + /opt/clam/bin/clam.py -o /tmp/clamcheck.bc -m 64 -g --crab-inter \ + --crab-track=num --crab-opt=add-invariants \ + --crab-opt-invariants-loc=block-entry /tmp/clamcheck.c && \ + test "$(llvm-dis-16 -o - /tmp/clamcheck.bc | grep -c 'verifier\.assume')" -gt 0 && \ + echo "Clam injects invariants: OK" && rm -f /tmp/clamcheck.c /tmp/clamcheck.bc + +# ============================================================ +# 7c. DG + sbt-slicer — program slicing with respect to an error site +# ============================================================ +# Phase 2 of docs/map2check_migration_plan.md, and the same pipeline Symbiotic +# uses: build a System Dependence Graph, keep only what the error site depends +# on, hand the smaller program to KLEE. +# +# What it is for, in numbers from this repository: finding K2 measured the cost +# of a nondeterministic read at 1 -> 21 -> 114 -> 861 partial paths for 2 -> 4 +# reads. Most of that forking happens in code that cannot influence the target, +# and slicing removes it before KLEE ever sees it. +# +# Two limits worth knowing before relying on it. Slicing needs a criterion, so +# it serves Cover-Error and does nothing for Cover-Branches, where every branch +# matters and there is no error site to slice towards. And a slice taken with +# respect to one error can remove another -- fine for a tool answering one +# property, a hazard for a baseline that scores precision per CWE. +# +# Built with clang-16 for the reason section 7b spells out: the ENV CC below is +# declared later in this file and would not apply here, and these are LLVM +# projects that expect the LLVM toolchain. +# +# DG is taken from llvm-latest, NOT master, and the difference is the same one +# crab-llvm taught: the maintained version was somewhere else. master calls +# llvm::Function::getBasicBlockList(), which LLVM 16 made private, so it simply +# does not compile here. llvm-latest's newest commit is literally "Fix build +# for LLVM < 18". +# +# Pinned to SHAs. Neither project has had a versioned release since 2020, so +# without a pin the image changes when upstream does -- what crab@dev +# demonstrated by moving the day before it was needed. +ARG DG_SHA=b34da890694f5210e475f34018239fc9d126d1ee # llvm-latest @ 2023-11-29 +ARG SBT_SLICER_SHA=e350116b39be215277803fe2f5e5ac4a161c16b8 # master @ 2025-03-27 + +RUN set -eux; \ + pin() { \ + git init -q "$2" && \ + git -C "$2" remote add origin "$1" && \ + git -C "$2" fetch -q --depth 1 origin "$3" && \ + git -C "$2" checkout -q FETCH_HEAD; \ + }; \ + # Both projects pin C++14 with a plain set(), which overrides anything + # passed on the command line, and LLVM 16's headers use std::is_unsigned_v + # -- C++17. Patching the two lines is the smallest change that builds; the + # alternative is carrying a fork. + bump() { \ + sed -i 's/set(CMAKE_CXX_STANDARD 14)/set(CMAKE_CXX_STANDARD 17)/; \ + s/-std=c++14/-std=c++17/' "$1/CMakeLists.txt"; \ + }; \ + pin https://github.com/mchalupa/dg.git /tmp/dg "$DG_SHA"; \ + bump /tmp/dg; \ + # IN-SOURCE, deliberately. sbt-slicer's CMakeLists documents DG_PATH as + # "a path to an in-source build of dg" and derives both the include path + # and the library path from it; an out-of-tree build satisfies neither + # (the headers stay in the source tree, the libraries land in the build + # tree) and sbt-slicer fails to find dg/tools/llvm-slicer-opts.h. + cd /tmp/dg && \ + cmake . -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_C_COMPILER=/usr/bin/clang-16 \ + -DCMAKE_CXX_COMPILER=/usr/bin/clang++-16 \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DCMAKE_INSTALL_PREFIX=/opt/dg && \ + make -j"$(nproc)" && make install && \ + pin https://github.com/staticafi/sbt-slicer.git /tmp/sbt-slicer \ + "$SBT_SLICER_SHA"; \ + bump /tmp/sbt-slicer; \ + mkdir /tmp/sbt-slicer/build && cd /tmp/sbt-slicer/build && \ + cmake .. -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_C_COMPILER=/usr/bin/clang-16 \ + -DCMAKE_CXX_COMPILER=/usr/bin/clang++-16 \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DDG_PATH=/tmp/dg \ + -DCMAKE_INSTALL_PREFIX=/opt/sbt-slicer && \ + make -j"$(nproc)" && make install && \ + rm -rf /tmp/dg /tmp/sbt-slicer + +ENV SBT_SLICER=/opt/sbt-slicer/bin/sbt-slicer +# dg installs shared libraries, and sbt-slicer links against them without an +# rpath: without this the binary exists, builds, and dies on every invocation +# with "libdganalysis.so: cannot open shared object file". +ENV LD_LIBRARY_PATH="/opt/dg/lib:${LD_LIBRARY_PATH}" + +# Fail the image build if the slicer cannot actually slice. A binary that +# exists and refuses every input is the failure mode section 7b was written +# about: --add-invariants stayed dead for years behind exactly that. +RUN printf 'extern int __VERIFIER_nondet_int(void);\nvoid reach_error(void);\nint main(){int a=__VERIFIER_nondet_int();int junk=__VERIFIER_nondet_int();int s=0;for(int i=0;i<50;i++){s+=junk*i;}if(a==7){reach_error();}return s;}\n' > /tmp/slicecheck.c && \ + clang-16 -c -emit-llvm -g -O0 -o /tmp/slicecheck.bc /tmp/slicecheck.c && \ + /opt/sbt-slicer/bin/sbt-slicer -c reach_error -o /tmp/sliced.bc /tmp/slicecheck.bc && \ + test -s /tmp/sliced.bc && \ + echo "sbt-slicer slices: OK" && rm -f /tmp/slicecheck.c /tmp/slicecheck.bc /tmp/sliced.bc # ============================================================ # 8. WABT (WebAssembly Binary Toolkit) — wasm2c, wasm2wat, wasm-ld diff --git a/README.md b/README.md index 0a94cc9c5..a181015bc 100644 --- a/README.md +++ b/README.md @@ -12,13 +12,19 @@ ___ Map2Check is a bug hunting tool that automatically generates and checks safety properties in C programs and WebAssembly (WASM) binaries. It tracks memory pointers and variable assignments to check user-specified assertions, overflow, and pointer safety. The generation of the test cases is based on assertions (safety properties) from the code instructions, adopting the -[LLVM framework](http://llvm.org/) version 16, [LibFuzzer](https://llvm.org/docs/LibFuzzer.html), [KLEE](https://klee.github.io/) to generate input values to the test cases generated by Map2Check. +[LLVM framework](http://llvm.org/) version 16, [AFL++](https://aflplus.plus/), [KLEE](https://klee.github.io/) to generate input values to the test cases generated by Map2Check. WASM verification works by lifting `.wasm` binaries to LLVM IR (via [WABT](https://github.com/WebAssembly/wabt)'s `wasm2c` + `clang-16`) and reusing the existing Map2Check instrumentation passes and the KLEE backend — see [Verifying WebAssembly (WASM) binaries](#verifying-webassembly-wasm-binaries). Extra documentation is available at https://map2check.github.io +#### Explanatory video + +A video explaining Map2Check is available on YouTube: + +[![Map2Check explanatory video](https://img.youtube.com/vi/E_Pqi6-AXhg/maxresdefault.jpg)](https://www.youtube.com/watch?v=E_Pqi6-AXhg) + ___ #### Requirements for using the tool @@ -48,7 +54,9 @@ Releases starting from **v8.0.0-Songbirds** include WebAssembly verification sup

Map2Check can be invoked through a standard command-line interface. Map2Check should be called -in the installation directory as follows: +in the installation directory as follows: + +Example programs are available in the [examples/](examples/) directory.

``` bash @@ -63,6 +71,78 @@ $ ./map2check --help When you use a LLVM bytecode as input for the tool, be sure to add `-g` flag when generating the file, it is not required, but map2check will provide better info (like line numbers). +#### Engines, test suites and analysis options (9.0) + +

+Map2Check generates inputs with two engines: the AFL++ 4.40c fuzzer (persistent mode, PCGUARD, +CmpLog) and the KLEE 3.1 symbolic executor. By default, and whenever --timeout is +given, the two run as an alternating hybrid. They take turns, each turn ends once its engine stops +finding new coverage, and every round doubles the turn's window. The engines also hand each other +input vectors. +

+ +| Option | Effect | +|---|---| +| *(default, with `--timeout`)* | Alternating hybrid with seed exchange. Same as `--alternate-engines`. | +| `--fixed-hybrid` | The 8.x schedule: the fuzzer for 0.2 of the budget, then KLEE. | +| `--fixed-hybrid --seed-exchange` | The 8.x schedule with seed exchange (0.2 / 0.6 / 0.2, with a last fuzzer phase). | +| `--nondet-generator afl` / `symex` | One engine only: AFL++ or KLEE. In 8.x the fuzzer value was `fuzzer`. | +| `--slice` | Slice the program before the analysis (sbt-slicer), for reachability, `--check-asserts`, `--memtrack`, `--memcleanup-property` and `--check-overflow`. | +| `--generate-test-suite` | Emit a Test-Comp test suite (`test-suite/`). | +| `--generate-test-suite --cover-branches` | Emit a Cover-Branches suite, up to 50 cases, from KLEE's paths and the fuzzer's corpus. | +| `--add-invariants` | Optional, and off in the default build. See below. | + +

+Verdicts. A TRUE verdict needs KLEE to have explored every path. Map2Check reports +UNKNOWN instead when KLEE stopped early for any reason: +

+ +- its timer ran out; +- it concretized a symbolic input (for example a floating-point value); +- it killed states; +- it hit its memory cap; +- it crashed. + +

+A call to abort() in the program under analysis is treated the way SV-COMP treats it: as +an assumption. It prunes that path and does not end the search. +

+ +

+Environment knobs. These exist for experiments; the defaults are the measured choices. +

+ +| Variable | Default | Meaning | +|---|---|---| +| `MAP2CHECK_FUZZER_SUITE` | on | `0` leaves the fuzzer's corpus out of Cover-Branches suites. | +| `MAP2CHECK_SLICE_CLEANUP` | none | `light` or `o2`: an opt pipeline over the fresh slice. Measured neutral. | +| `MAP2CHECK_SLICER_FLAGS` | — | Extra sbt-slicer flags, e.g. `--cda=ntscd`. Measured neutral. | +| `MAP2CHECK_PREOPT` | off | `ssa`: mem2reg + simplifycfg before instrumentation, for reachability and assert only. Measured neutral in the hybrid. | +| `MAP2CHECK_CHECK_CSTRINGS` | off | `1`: check the strings a `%s` or `puts` reads. It fixes one wrong TRUE on Juliet, but produces false positives on memory the runtime does not track (CASTLE: FP from 1 to 4). | +| `MAP2CHECK_CLAM_PROFILE` | default | `memory` or `none`: see `--add-invariants`. | +| `MAP2CHECK_KLEE_MAX_MEMORY` | KLEE's 2000 | KLEE's `--max-memory`, in MB. Raising it to 6000 changed nothing on Intel-TDX (0/8 either way). | + +

+--add-invariants inserts abstract-interpretation invariants computed by +Clam (formerly crab-llvm). The build must be configured +with -DENABLE_CLAM=ON and Clam installed at $CLAM_DIR; otherwise the option is +refused with exit code 3. +

+ +

+The option stays optional while it is under study. So far: +

+ +- In the SV-COMP 2019/2020 builds, the invariants reached neither the instrumentation nor KLEE: they were emitted as `llvm.assume`. +- On the current hybrid, the first measurement found no gain. +- Clam is bounded to 0.2 of the budget and falls back to the plain compile when it fails. +- A dedicated study round is planned. See `docs/reports/tacas-experiment-log.md` (INV-1, R25). + +

+Measurements of every option above are recorded in +docs/reports/tacas-experiment-log.md. +

+ ___ #### Verifying WebAssembly (WASM) binaries @@ -145,7 +225,7 @@ Violated property: VERIFICATION FAILED ``` -A safe program (e.g. writing to `p[9]` instead of `p[10]`) is not flagged. The pipeline was validated on a subset of the **Juliet Test Suite** compiled to WASM (CWE-121/122/124/126/127): all 15 seeded bugs were detected as `FALSE` with a 290 s timeout — see [test-comp2026/simulation/resultados_de_testes/juliet_wasm/wasm_results.csv](test-comp2026/simulation/resultados_de_testes/juliet_wasm/wasm_results.csv). The integration test scripts [tests/integration/test_wasm_pipeline.sh](tests/integration/test_wasm_pipeline.sh) and [tests/integration/test_wasm_entrypoint.sh](tests/integration/test_wasm_entrypoint.sh) reproduce this workflow automatically. +A safe program (e.g. writing to `p[9]` instead of `p[10]`) is not flagged. The pipeline was validated on a subset of the **Juliet Test Suite** compiled to WASM (CWE-121/122/124/126/127): all 15 seeded bugs were detected as `FALSE` with a 290 s timeout — see [docs/reports/wasm-juliet-validation.csv](docs/reports/wasm-juliet-validation.csv). The integration test scripts [tests/integration/test_wasm_pipeline.sh](tests/integration/test_wasm_pipeline.sh) and [tests/integration/test_wasm_entrypoint.sh](tests/integration/test_wasm_entrypoint.sh) reproduce this workflow automatically. ___ @@ -171,7 +251,7 @@ $ ninja && ninja install # binário em: release/bin/map2check (ou release/map2check) ``` -The `Dockerfile.dev` image already builds and installs KLEE 3.1 (to `/opt/klee`) and provides LibFuzzer via LLVM 16's compiler-rt, so **do not** pass `-DSKIP_KLEE=ON` or `-DSKIP_LIB_FUZZER=ON` — those flags skip the `cmake/FindKlee.cmake` / `cmake/FindLibFuzzer.cmake` modules entirely, which are what copy the KLEE binaries and `libFuzzer.a` into `release/`. Only pass them `ON` if you deliberately want a build without KLEE/LibFuzzer support (e.g. `-DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON` for a minimal/CI build). +The `Dockerfile.dev` image already builds and installs KLEE 3.1 (to `/opt/klee`) and installs AFL++ 4.40c as a standalone toolchain (found at run time under `/usr/local/bin`), so **do not** pass `-DSKIP_KLEE=ON` or `-DSKIP_AFL_PLUS_PLUS=ON` — those flags skip the `cmake/FindKlee.cmake` / `cmake/FindAFLPlusPlus.cmake` modules entirely. Only pass them `ON` if you deliberately want a build without KLEE/AFL++ support (e.g. `-DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON` for a minimal/CI build). **Building with WASM support** requires **no additional CMake flag** — the `WasmLifter` frontend module is always compiled. The only extra build-time dependency is the WABT 1.0.41 header `wasm-rt.h`: when CMake finds it (searched at `/opt/wabt-1.0.41/include`, `/usr/include`, `/usr/local/include`), it compiles the KLEE-compatible wasm2c runtime `WasmRuntimeStubs.c` to bitcode and installs it as `release/lib/WasmRuntimeStubs.bc`, which is linked into the lifted module when `--wasm` is used. If `wasm-rt.h` is not found, CMake prints a warning and the build proceeds **without** WASM support (the recommended way to get a WASM-enabled build is the Docker image above, which ships WABT and the wasi-sdk out of the box). @@ -212,13 +292,13 @@ More details at https://map2check.github.io/docker.html #### How to run the tests -**Unit tests** (no KLEE/LibFuzzer required): +**Unit tests** (no KLEE/AFL++ required): ``` bash $ mkdir build && cd build $ cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ - -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON + -DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON $ ninja && ctest --output-on-failure # Expected results: Test project /workspace/build diff --git a/TODO.md b/TODO.md index baca9bd07..9dce04656 100644 --- a/TODO.md +++ b/TODO.md @@ -14,8 +14,8 @@ Confirmados em 2026-06-14, corrigidos em ~3 semanas (referência usual do badge: - [x] CWE-119 `strcpy` ×3 — `map2check.cpp` → `setenv()` (`f0d6a28a`) - [x] Off-by-one OOB — `BTree.c` (create loop `588ba5f8`; dump loop `e5442766`) -- [x] VLA dangling return — `NonDetGeneratorKlee.c` **e** `NonDetGeneratorLibFuzzy.c` (cópia extra achada na verificação) (`f0d6a28a`) -- [x] Shift UB — `NonDetGeneratorLibFuzzy.c` (`f0d6a28a`) +- [x] VLA dangling return — `NonDetGeneratorKlee.c` **e** `NonDetGeneratorAFL.c` (cópia extra achada na verificação) (`f0d6a28a`) +- [x] Shift UB — `NonDetGeneratorAFL.c` (`f0d6a28a`) - [x] Uninit vars — `AllocationLog.c`, `NonDetLog.c`, `ContainerBTree.c` (`ca2692c5`, `f0d6a28a`) - [x] Null-deref CWE-476 — `AnalysisModeMemtrack.c`/`AnalysisModeMemcleanup.c` (checagens de NULL com corpo vazio) (`e5442766`) @@ -46,7 +46,7 @@ exit 0; clang-tidy `clang-analyzer-security/core` sem achados. O que existe (atualizado): mecanismos de memory-safety **duplicados** — ASan/UBSan estritos + Valgrind memcheck bloqueante. O que falta (inalterado): -- [ ] Nenhum fuzzing do próprio Map2Check: `SKIP_LIB_FUZZER=ON` nos jobs de teste; o LibFuzzer embarcado é *feature do produto* (gera entradas para os programas C analisados), não self-fuzzing +- [ ] Nenhum fuzzing do próprio Map2Check: `SKIP_AFL_PLUS_PLUS=ON` nos jobs de teste; o AFL++ embarcado é *feature do produto* (gera entradas para os programas C analisados), não self-fuzzing - [ ] Sem harness `LLVMFuzzerTestOneInput`, corpus ou integração OSS-Fuzz - [ ] Iniciativa real na roadmap: AFL++ (Phase 3, itens 3.1.1–3.1.4) — não iniciada diff --git a/cmake/FindAFLPlusPlus.cmake b/cmake/FindAFLPlusPlus.cmake new file mode 100644 index 000000000..ddb75e729 --- /dev/null +++ b/cmake/FindAFLPlusPlus.cmake @@ -0,0 +1,27 @@ +# FindAFLPlusPlus.cmake — Locate the AFL++ fuzzers (4.40c, LLVM 16) +# +# AFL++ is a standalone toolchain invoked at run time by caller.cpp through +# system(): afl-clang-fast compiles the fuzzer binary (PCGUARD) and afl-fuzz +# drives it. It is installed into the image by Dockerfile.dev section 7 and +# resolved at run time by Map2Check::aflClangFastBinary() / +# Map2Check::aflFuzzBinary() (tools.hpp), which honour an env override and fall +# back to /usr/local/bin. +# +# This module only records availability so the build can say so — the role +# the previous fuzzer find-module played before the AFL++ migration. +# +# Sets: +# AFL_PLUS_PLUS_FOUND — TRUE if both binaries are present + +find_program(AFL_CLANG_FAST afl-clang-fast PATHS /usr/local/bin /opt/afl++/bin) +find_program(AFL_FUZZ afl-fuzz PATHS /usr/local/bin /opt/afl++/bin) + +if(AFL_CLANG_FAST AND AFL_FUZZ) + set(AFL_PLUS_PLUS_FOUND TRUE) + message(STATUS "Found AFL++: ${AFL_CLANG_FAST} / ${AFL_FUZZ}") +else() + set(AFL_PLUS_PLUS_FOUND FALSE) + message(WARNING "AFL++ not found (afl-clang-fast/afl-fuzz). " + "Fuzzing will be unavailable; build the dev image (Dockerfile.dev section 7) " + "or set MAP2CHECK_AFL_CC/MAP2CHECK_AFL_FUZZ at run time.") +endif() diff --git a/cmake/FindCrabLlvm.cmake b/cmake/FindCrabLlvm.cmake deleted file mode 100644 index 5c9c139a7..000000000 --- a/cmake/FindCrabLlvm.cmake +++ /dev/null @@ -1,17 +0,0 @@ -cmake_minimum_required(VERSION 3.5) -include(ExternalProject) -find_package(Git REQUIRED) - -ExternalProject_Add( CrabLlvm - PREFIX dependencies/crab-llvm - GIT_REPOSITORY https://github.com/seahorn/crab-llvm.git - CMAKE_ARGS - -DCMAKE_INSTALL_PREFIX=run - -DCMAKE_BUILD_TYPE=Release - -DUSE_LDD=ON - -DUSE_APRON=ON - INSTALL_COMMAND "" -) - - - diff --git a/cmake/FindLibFuzzer.cmake b/cmake/FindLibFuzzer.cmake deleted file mode 100644 index f06d086e8..000000000 --- a/cmake/FindLibFuzzer.cmake +++ /dev/null @@ -1,54 +0,0 @@ -# FindLibFuzzer.cmake — Locate LibFuzzer from LLVM 16 compiler-rt -# -# In LLVM 16, LibFuzzer is part of compiler-rt and does NOT need to be -# built separately. It is available via: -# clang-16 -fsanitize=fuzzer -# -# For Map2Check's linking approach (linking libFuzzer.a directly), -# we locate the static archive in the LLVM compiler-rt directory. -# -# Sets: -# LIBFUZZER_ARCHIVE — path to libclang_rt.fuzzer-x86_64.a -# LIBFUZZER_FOUND — TRUE if found - -# Determine the compiler-rt lib directory -execute_process(COMMAND ${CLANG_CC} --print-runtime-dir - OUTPUT_VARIABLE CLANG_RUNTIME_DIR - OUTPUT_STRIP_TRAILING_WHITESPACE - ERROR_QUIET) - -if(NOT CLANG_RUNTIME_DIR) - # Fallback: construct path manually - set(CLANG_RUNTIME_DIR "/usr/lib/llvm-16/lib/clang/16/lib/linux") -endif() - -# Look for the fuzzer archive -find_library(LIBFUZZER_ARCHIVE - NAMES clang_rt.fuzzer-x86_64 clang_rt.fuzzer_no_main-x86_64 - PATHS ${CLANG_RUNTIME_DIR} - NO_DEFAULT_PATH) - -if(LIBFUZZER_ARCHIVE) - set(LIBFUZZER_FOUND TRUE) - message(STATUS "Found LibFuzzer: ${LIBFUZZER_ARCHIVE}") - - # map2check.cpp/caller.cpp invoke a *copy* of clang installed at - # ${MAP2CHECK_PATH}/bin/clang (see FindClang.cmake's install_exec_file). - # That copy resolves its resource-dir relative to its own location - # (/lib/clang//lib/linux), not the system LLVM install, so - # -fsanitize=fuzzer needs the compiler-rt archives mirrored there — - # a single renamed libFuzzer.a is never actually looked up by clang. - execute_process(COMMAND ${CLANG_CC} --print-resource-dir - OUTPUT_VARIABLE CLANG_RESOURCE_DIR - OUTPUT_STRIP_TRAILING_WHITESPACE - ERROR_QUIET) - get_filename_component(CLANG_RESOURCE_VERSION "${CLANG_RESOURCE_DIR}" NAME) - - install(DIRECTORY ${CLANG_RUNTIME_DIR}/ - DESTINATION lib/clang/${CLANG_RESOURCE_VERSION}/lib/linux - FILES_MATCHING PATTERN "*.a") -else() - set(LIBFUZZER_FOUND FALSE) - message(WARNING "LibFuzzer archive not found in ${CLANG_RUNTIME_DIR}. " - "Fuzzer functionality will use -fsanitize=fuzzer flag instead.") -endif() diff --git a/docs/Map2Check-Relatorio-v15.docx b/docs/Map2Check-Relatorio-v15.docx new file mode 100644 index 000000000..2566ad335 Binary files /dev/null and b/docs/Map2Check-Relatorio-v15.docx differ diff --git a/docs/TESTCOMP-CHECKLIST.md b/docs/TESTCOMP-CHECKLIST.md new file mode 100644 index 000000000..51cb3db2e --- /dev/null +++ b/docs/TESTCOMP-CHECKLIST.md @@ -0,0 +1,127 @@ +# Test-Comp: checklist de progresso + +Estado das frentes do [plano de desenvolvimento](../.opencode/Plano%20de%20desenvolvimento_Testcomp.md) +(local, fora do repositório). Este arquivo é o índice vivo: cada item aponta para a +evidência que sustenta o estado declarado. + +**Última atualização:** 2026-08-23 (v8) + +## Legenda + +| Marca | Significado | +|---|---| +| ✅ | Feito e verificado, com evidência apontada | +| 🟡 | Parcial — o que falta está dito explicitamente | +| ⬜ | Não iniciado | +| ❌ | Tentado e rejeitado, com motivo registrado | + +--- + +## H1 — Conformidade (submissão válida e pontuável) + +| Item | Estado | Evidência / o que falta | +|---|---|---| +| **H1.1** Emissor de test suite XML | ✅ | `modules/frontend/test_suite/`. `--generate-test-suite` emite `metadata.xml` + `testcase-N.xml` no formato de intercâmbio. 13 testes unitários + 12 asserções de integração. **Custo real muito abaixo das 2 pw estimadas**: o runtime já registrava os valores em ordem de consumo, faltava só serializar | +| **H1.2** Conversor ktest→XML | ✅ | **Colapsou dentro do H1.1.** O log é escrito pelo binário instrumentado em tempo de execução, então já carrega os valores concretos do KLEE. Não precisou de conversor separado | +| **H1.3** Vetores de entrada por caminho | ✅ | **Resolvido por outro caminho que o planejado.** O KLEE já grava um `.ktest` por caminho explorado, com os objetos simbólicos em ordem de consumo; `ktest_reader.cpp` os lê. A alternativa (o runtime gravar um log por estado) foi **medida e descartada**: levou um run de 1s/`FALSE` para 100s/`SUCCEEDED` errado, porque cada escrita é chamada externa que o KLEE executa concretamente. 16 testes unitários fixam o parse contra bytes montados à mão | +| **H1.4** Empacotamento BenchExec / fm-tools | ✅ | `utils/moduleBenchExec/map2check_testcomp.py` (`BaseTool2`) + `utils/map2check-testcomp-wrapper.py`, ambos no zip de release. 15 asserções contra o benchexec real em `tests/integration/test_benchexec_toolinfo.py`. **Falta:** registrar em `fm-tools` (fora deste repositório). O `map2check.py` SV-COMP segue em `BaseTool` 1.x — obsoleto mas ainda presente no benchexec 3.35, então não está morto | +| **H1.5** E2E no CI com TestCov | ✅ | Job `Test-Comp Validation (TestCov)`, 6/6 contra manifesto medido. Ver `tests/testcomp/` | + +## H2 — Eficácia + +| Item | Estado | Evidência / o que falta | +|---|---|---| +| **H2.1** Modo reachability enxuto | 🟡 | **Premissa do plano desatualizada.** O plano supõe "9 passes sempre ativos"; `caller.cpp:141-218` mostra que reachability já roda só `nondet-pass` + `target-pass` + `map2check-library`. O overhead residual é o runtime sempre linkado, não os passes. O critério "redução ≥30%" precisa ser re-derivado | +| **H2.2** Orquestração com time-slicing | ⬜ | Default híbrido atual (LibFuzzer 0.2× → KLEE 0.8×) preservado | +| **H2.3** Seed exchange fuzzer↔KLEE | ⬜ | — | +| **H2.4** Slicing pré-simbólico | ⬜ | Ver nota de prioridade abaixo | +| **H2.5** Modo Cover-Branches | ✅ | `--cover-branches` emite um test case por caminho do KLEE, `coversError` falso (são caminhos, não violações), teto de 500. Wrapper e tool-info **aceitam** a propriedade. Validado ponta a ponta: 7 test cases num programa de 6 ramos, **TestCov 100,0%**. Gate no CI (`test_cover_branches.sh`) mede cobertura pelo validador, não inspecionando XML | + +### Nota de prioridade sobre H2 + +O plano atribui os 45,6%/50,7% de UNKNOWN a explosão de caminhos e conclui que o +acionável é orquestração e poda (H2.2–H2.4, 4–8 pw). Duas coisas medidas depois +disso mudam o quadro, e **nenhuma das duas é explosão de caminhos**: + +1. O baseline v5 mostra que **887 de 2.525 casos (35%) recebem entrada por externas + não resolvidas**, e 575 se perdem. Quatro fontes de entrada ficam em exatamente + **50,0%** de acerto entre os decididos — assinatura de provar a variante segura e + errar a vulnerável. +2. O **achado K, corrigido**: o timeout descartava violações que a ferramenta + já tinha encontrado e gravado em disco. `isTimeout()` tinha precedência sobre + a propriedade violada, então um FALSE legítimo virava UNKNOWN só porque o + orçamento acabou *depois* do trabalho estar feito. + +**O que a medição do v6 respondeu.** No CASTLE, a correção do K mudou **zero** +vereditos — e o motivo não é que K fosse pequeno, é que o **achado B o mascara**: +dos 22 casos indecididos no v5 que rerodaram, 20 usam o modo degenerado, onde +nenhuma violação chega a ser registrada e portanto K não tem o que resgatar. +Medir K exige um corpus onde os modos sejam reais — o Juliet, ainda em execução. + +**Recomendação de sequência:** corrigir o achado B antes de comprometer qualquer +pessoa-semana em slicing. Ele bloqueia 45% das execuções do CASTLE *e* impede +medir o efeito de K nesse corpus. + +--- + +## Frentes fora do plano original + +| Frente | Estado | Evidência | +|---|---|---| +| **Invariantes (`--add-invariants`)** | ✅ **vivo e provado em CI** | Clam `dev16` pinado, `-DENABLE_CLAM=ON`, **desligado por default**. O job `Invariants (Clam)` passou de `ABSENT` para `PRESENT (exit 0)` quando a imagem republicou; a sonda do Dockerfile confirma `Clam injects invariants: OK`. Issue #54 fechada. Ver [a revisão da dependência](reports/2026-08-16-crabllvm-review.md) | +| Invariantes: gate diferencial p/ promover a default | ⬜ | Task 7 do [plano de revival](superpowers/plans/2026-08-16-add-invariants-revival.md). Depende de rodar sobre corpus real | +| **Baseline CASTLE + Juliet (v5)** | ✅ | PR #55. CASTLE 98,2% precisão, Juliet 90,8% (99,2% descontando artefatos de mapeamento) | +| Corrida v6 (depois/antes) | 🟡 | **CASTLE fechado** (217/250): precisão 98,2%, recall 74,0%; excluindo o modo degenerado do achado B, recall 79,4%. Juliet: 3 de 4 fatias fechadas, `c` em andamento. **Regra de atribuição: invariantes DESLIGADOS na corrida principal**, senão overflow + timeout + amostragem + invariantes ficam conjuntamente não creditáveis | +| **Corpus Test-Comp estratificado** | 🟡 | `fetch-benchmarks.sh` + `build_corpus.py` + `run_testcomp_evaluation.sh`. 372 tarefas cover-error e 480 cover-branches, cota por subcategoria e passo determinístico. Corrida de 2026-08-22 em andamento; ver [as notas de leitura](../tests/testcomp/RUN-2026-08-22-NOTES.md) — **o orçamento é 60s contra os 900s da competição, não são scores** | +| **Alcançabilidade (CWE-843/628/770/835)** | ⬜ | Adiado por decisão. Sob a lente SV-COMP as quatro colapsam em uma: só 835 mapeia para categoria pontuável (Termination), e os wrappers declaram não suportar | + +--- + +## Defeitos encontrados e corrigidos nesta fase + +Todos com evidência em [findings](reports/2026-08-12-castle-juliet-findings.md). + +| # | Defeito | Estado | +|---|---|---| +| **H** | Use-after-scope no log de nondet: `NONDET_CALL.value` guardava o endereço de um parâmetro já morto. **O log saía vazio em toda execução simbólica** | ✅ valor inline em união | +| **I** | `map2check_nondet_double` marcava o tipo como `UNSIGNED` | ✅ | +| **J** | Estados bifurcados do KLEE sobrescreviam o `klee_log.csv` uns dos outros | ✅ flush só na violação | +| — | `--add-invariants` aceito e ignorado sem rastro na entrada `.bc` (issue #54) | ✅ sai com código 3 | +| — | Invocação legada do Crab: `--llvm-pp-loops` e `--crab-promote-assume` anulavam a injeção | ✅ removidas, medido | +| — | Pass 2 do CASTLE era re-execução byte-idêntica do pass 1 em todo o v5 | ✅ reconhece código 3 | +| **K** | `isTimeout()` descartava violações já encontradas e gravadas: `TARGET-REACHED found` → `Forcing timeout` → `VERIFICATION UNKNOWN`. Disparava em 80% das execuções do Juliet v5 | ✅ resgate restrito a evidência confiável (`c4ef3a355`) | +| — | Imagem: Clam compilava com GCC 11 em vez de clang-16 (o `ENV CC` está 88 linhas abaixo do `RUN`), e GCC rejeita o que o clang só avisa. **A receita nunca compilou** | ✅ compiladores nomeados no `CLAM_CFG` (#58) | +| — | `Dockerfile.dev` só era compilado **depois** do merge, então um Dockerfile inválido chegava à `develop` sem nada poder barrá-lo | ✅ o workflow de publish roda em PRs que tocam o arquivo, com `push: false` (#58) | +| — | Clam e suas três dependências vinham de branches móveis; `crab@dev` mudou em 21/08 | ✅ pinados por SHA como `ARG` (#59) | +| **L** | **Suíte de Cover-Error saía sem nenhum ``.** O estado que alcança o alvo aborta, e estado abortado não roda handler de saída, então o `klee_log.csv` nunca era escrito. **290 de 376 execuções que reportaram FAILED** emitiram um test case vazio: a ferramenta achava o bug e não conseguia prová-lo | ✅ fallback para o `.ktest` do caminho que o KLEE marcou com `.err` | +| **M** | **`--property-file` relativo nunca era lido.** `resolveSpecification` roda depois do `chdir` para o scratch. Invisível porque o palpite do fallback coincide com a propriedade real das duas categorias — nenhuma saída diferia | ✅ resolvido contra `getOriginalPath()` | +| **N** | **`--cover-branches` caía no default `MEMTRACK_MODE`** e instrumentava rastreamento de memória para uma tarefa sem propriedade | ✅ `COVER_BRANCHES_MODE`, pipeline só com `nondet-pass` | +| **O** | **`MemoryTrackPass` emitia chamada com tipo incompatível.** Declara `map2check_malloc(ptr, i64)` e repassava o operando sem converter; programa que aloca com `i32` gerava módulo quebrado. **110 de 110 tarefas ProductLines** morriam em 2s de um orçamento de 60s. Sobreviveu porque Juliet e CASTLE alocam com `i64` | ✅ coerção nos 3 sítios | +| **P** | **Teto de 500 test cases inviabilizava a validação.** Dos 116 casos cuja validação falhou, 115 tinham ≥100 casos e a mediana era exatamente 500 | ✅ teto em 50 | +| **Q** | **O KLEE perdia toda a exploração ao esgotar o orçamento.** Só um `timeout` externo o limitava; um programa com 12 leituras nondet explorou 3982 caminhos e gerou **zero** `.ktest` — `unable to write output test case, losing it`, 3982 vezes. Atingir o orçamento é o caso NORMAL numa corrida de competição | ✅ `--max-time` próprio + busca `dfs` no cover-branches, para os estados terminarem em sequência e gravarem à medida que terminam | + +## Defeitos abertos + +| # | Defeito | Prioridade | +|---|---|---| +| **K2** | Custo por leitura nondet cresce muito: 1 → 21 → 114 → 861 caminhos parciais para 2 → 4 leituras. Nenhum `.err`, então não são erros | Média — segundo fio a puxar | +| **G** | `main()` descarta o retorno de `map2check_execution()`; código de saída nunca reflete a análise | Média | +| **B** | **Medido no v6.** Modo reachability degenerado com `target-function-name main`: 98 de 217 execuções, **zero vereditos FALSE**, 59 programas vulneráveis, 0 detectados. 12 TN e 5 FN pontuados sobre um oráculo que só sabe responder "correto" | **Alta** — 🟡 o caso trivial agora se anuncia (`TargetPass`); falta corrigir o mapeamento CWE→modo do harness, o que **muda a pontuação do baseline** e por isso espera o v6 fechar | +| — | Garantia de ordenação do corpus depende de um único programa (`two_guards.c`) | Baixa — K já foi corrigido; falta reconferir se ainda vale | +| — | `CLAUDE.md` linka um `.clang-format` que não existe | Baixa | + +--- + +## Infraestrutura de verificação + +| O quê | Contagem | +|---|---| +| `ctest` (unitários) | 8 | +| Integração | ~117 asserções em 12 scripts | +| Conformidade Test-Comp | 6 programas | +| Jobs de CI | 10, todos verdes na PR #59 (o 10º builda a imagem no próprio PR) | + +Gates que provei que **conseguem falhar** (um gate nunca visto vermelho não protege +ninguém): o do TestCov, invertendo a ordem dos `` no emissor; e o de +invariantes, que falhava com `exit 0 but no verifier.assume in any bitcode` antes da +correção. diff --git a/docs/backlog.md b/docs/backlog.md new file mode 100644 index 000000000..0ac1fab36 --- /dev/null +++ b/docs/backlog.md @@ -0,0 +1,106 @@ +# Backlog + +Itens decididos como "não agora", cada um com o motivo e onde está a evidência. + +## `--add-invariants`: rodada dedicada de estudo + +- **Estado:** a opção é opcional e fica desligada no build padrão (`-DENABLE_CLAM=OFF`). + O usuário ainda desconfia da conclusão "não ajuda". +- **O que já se sabe** (log de experimentos, INV-1 e R25): + - Na v7.3 os invariantes saíam como `llvm.assume` e ficavam inertes. Até out/2018 eles + chegavam ao KLEE (`--crab-track=arr --crab-add-invariants=after-load`). + - Numa sonda só com o KLEE, o ganho veio do pré-processamento em SSA, não dos + invariantes. + - No híbrido (71 tarefas de Cover-Error e 50 de MemSafety), os perfis do Clam não + ganharam e o MemSafety teve mais FALSE errados (4 contra 2). Parte dos ERROR vinha do + Clam sem limite de tempo, já corrigido. +- **O que a rodada precisa responder:** + - efeito só com o KLEE (`--nondet-generator symex`), onde os invariantes têm mais + chance de pesar, separado do efeito no híbrido; + - por que os FALSE errados de MemSafety aumentam: um invariante incorreto ou o + caminho de compilação do Clam (`-m 64`, pré-processamento próprio); + - os domínios que o motor antigo tinha e o nosso Clam não compila: Apron (`oct`, + `pk`) e LDD (`boxes`); + - o gate: nenhuma detecção perdida no CASTLE e numa amostra do Juliet. + +## Limite de memória do KLEE nas rodadas paralelas + +- **Sintoma:** com 8 contêineres, e às vezes com 4, a memória da máquina (23 GB) chega a + ficar crítica. O KLEE usa até `--max-memory` = 2000 MB por processo. Um KLEE morto + pelo OOM killer sai como "did not finish its run", ou seja UNKNOWN, e contamina a + medição. Os vigias do Claude Code também foram encerrados por isso. +- **Opções:** + - passar `--max-memory` por execução, proporcional às vagas; + - limitar a memória por contêiner (`docker run --memory`); + - registrar no resultado quando o KLEE morreu por falta de memória, para descartar e + repetir essas tarefas. +- **Por que não agora:** não afeta o produto (uma execução de competição tem uma tarefa + por máquina), só a infraestrutura de medição. + +## Harness de campanha fora do repositório + +- Os escalonadores das rodadas R19 a R26 vivem em `../tacas-results/` e não são + versionados, por decisão: campanhas não pertencem ao repositório do produto. +- Dois defeitos deles contaminaram rodadas, e quem escrever o próximo precisa evitá-los: + - `IFS=$'\t' read` junta tabs consecutivos, e uma coluna vazia desloca as seguintes; + usar `-` nos campos vazios; + - os filhos herdavam o manifest pelo descritor 3. Corrigido no harness do repositório + (`3<&-`). + +## Validação de witness (fase D, item 4.2): estudo, a discutir com o orientador + +- **Estado atual:** + - O Map2Check gera só witness **GraphML** (`--generate-witness`, formato 1.0), gravado + em `../witness.graphml` a partir do scratch. + - Não gera o formato **2.0 (YAML)**, adotado pelo SV-COMP. É preciso confirmar no + call do ano quais formatos ainda são aceitos. + - Nenhum teste valida os witnesses gerados. + - A Test-Comp não usa witness; a suíte é validada pelo TestCov. O item só pesa para o + SV-COMP. +- **Caminho barato já esboçado (validação por execução):** compilar o programa original + (com ASan, para as propriedades de memória), alimentá-lo com o vetor que viola a + propriedade (que o Map2Check já emite na suíte de Cover-Error) e confirmar o + `reach_error` ou o crash. É parecido com o que o TestCov faz e com os validadores por + execução do SV-COMP. +- **Não começar a implementação** antes da conversa com o orientador: definir se o + objetivo é o formato 2.0, a validação por execução, os dois ou nenhum. + +## `--debug` com a alternância dá segfault + +- Achado em 2026-10-02: `map2check --debug --check-overflow --timeout 60` sobre um caso do + Juliet (CWE190 `char_fscanf_square_01`, good) termina com segfault depois das fases. O + scratch aparece aninhado (`.map2check/.map2check-…`). Sem `--debug` a + execução termina normalmente. Só afeta a depuração. + +## Recorte da campanha × conjunto oficial da Test-Comp 2026 + +- **Contexto:** a campanha da 9.0 usa o recorte da v15 (`cover-error-q400.tsv`, 1 087 + tarefas; `cover-branches-q400.tsv`, 2 765). A Test-Comp 2026 tem 1 895 tarefas em + C.Cover-Error e 14 322 em C.Cover-Branches + ([resultados](https://test-comp.sosy-lab.org/2026/results/results-verified/)). +- **Diferença de composição (Cover-Error):** + - faltam no recorte as subcategorias novas: SoftwareSystems-Intel-TDX-Module (658), + Hardware (497), coreutils (29) e BusyBox, OpenBSD e Linux64 (7); + - o ECA pesa 400 tarefas no recorte, contra 18 no conjunto oficial; + - as subcategorias clássicas (ProductLines, Loops, Sequentialized, Arrays, XCSP, + Floats, BitVectors, ControlFlow, Recursive) praticamente coincidem. +- **Consequência:** os 722 pontos de Cover-Error da 9.0 valem só para a comparação + pareada com a v15. Não estimam a pontuação oficial, que é normalizada por subcategoria. +- **TODO:** montar um manifest com as subcategorias ausentes (Hardware, Intel-TDX, + coreutils) e rodar uma amostra delas depois da campanha de Cover-Branches. + +## ~~Caminhos podados pelo assume no KLEE não geram teste~~ (resolvido) + +- **Sintoma:** na campanha da 9.0, 29 tarefas de Cover-Branches (25 XCSP, 4 Floats) + terminam com zero testes. O XCSP cai de 76,2% para 58,1% de cobertura média, o que + custa cerca de 1,7 p.p. na média geral. +- **Causa:** o `nondet_assume` sob o KLEE poda com `klee_silent_exit`, que não grava + `.ktest`. Quando todos os caminhos são podados, a suíte sai vazia. +- **Correção proposta:** podar com `_exit(0)`. O caminho termina normalmente e grava o + teste, sem rodar os handlers de saída. +- **Validação necessária:** + - os testes de integração; + - o §29 (`safe.c`) continua dando TRUE; + - o memtrack com `sleep-3` não ganha falso positivo. + - Depois disso, repetir só as tarefas que ficaram com zero testes. +- **Resolvido** em `e4e0b74c7` e `6848d2395` (ver o log de experimentos, 2026-10-05/06). diff --git a/docs/map2check_migration_plan.md b/docs/map2check_migration_plan.md index 6fd99aee3..a65581bd5 100644 --- a/docs/map2check_migration_plan.md +++ b/docs/map2check_migration_plan.md @@ -391,13 +391,15 @@ Esta fase é uma **extensão da Fase 1** (Fundação), não uma fase separada no ### Fase 3: Hibridização e Coordenador (Meses 6-8) #### Passo 3.1 — Integrar AFL++ -- [ ] Adicionar `FindAFLPlusPlus.cmake` para compilar/instalar AFL++ 4.40c -- [ ] Configurar instrumentação AFL++ com LLVM 16 (modo PCGUARD) -- [ ] Criar wrapper para compilação de programas com instrumentação AFL++ -- [ ] Validar fuzzing standalone em programas de teste +- [x] Adicionar `FindAFLPlusPlus.cmake` para compilar/instalar AFL++ 4.40c +- [x] Configurar instrumentação AFL++ com LLVM 16 (modo PCGUARD) +- [x] Criar wrapper para compilação de programas com instrumentação AFL++ +- [x] Validar fuzzing standalone em programas de teste #### Passo 3.2 — Desenvolver o Coordenador -- [ ] Criar módulo `modules/coordinator/` (Python + C++ via pybind11 ou subprocess) + +> **Nota (tacasv1):** o coordenador **permanece no Caller C++** (`modules/frontend/caller.cpp`), que dispara o AFL++ via `system()` (afl-clang-fast / afl-fuzz). Não foi criado um módulo `modules/coordinator/` em Python/pybind11. + - [ ] Implementar interface IPC POSIX (shared memory + semáforos) - [ ] Implementar ciclo de vida: 1. Iniciar AFL++ com sementes iniciais diff --git a/docs/migration-schedule.md b/docs/migration-schedule.md index 17b23e94e..d2a4c039d 100644 --- a/docs/migration-schedule.md +++ b/docs/migration-schedule.md @@ -4,6 +4,15 @@ **Fim previsto:** 30/Mai/2027 **Regime:** ~5h/dia útil de desenvolvimento efetivo +> **Situação em 29/Set/2026 — linha TACAS.** As fases 2 e 3 foram antecipadas e entregues +> por um caminho diferente do planejado abaixo: o slicing usa o `sbt-slicer` (dg) como +> processo externo, e não uma biblioteca integrada; a coordenação AFL++ ↔ KLEE roda dentro +> do frontend C++, e não num coordenador Python com IPC. As tabelas das fases 2 e 3 trazem +> o status real e onde cada item foi feito. Medições em `docs/reports/tacas-experiment-log.md` +> (rodadas R1–R19). Resultado de referência (R15, Cover-Error, 213 tarefas, 300 s): controle +> tacasv2 **129 cobertas** × v15 111, TRUE errado 27 → 5, tempo mediano 43 → 5 s; com a troca +> de sementes (R16) **148 cobertas**. + --- ## Métricas do Codebase Atual @@ -176,19 +185,19 @@ | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 2.1.1 | Criar `FindDG.cmake` (FetchContent de `mchalupa/dg`) | 28/Set | 30/Set | 3 | DG compila com LLVM 16 | — | -| ☐ | 2.1.2 | Validar `llvm-slicer` standalone no container | 01/Out | 02/Out | 2 | Slice de programa simples funciona | — | -| ☐ | 2.1.3 | Criar módulo `SlicingPreprocessor` (API C++) | 05/Out | 16/Out | 10 | Testes unitários do módulo | — | -| ☐ | 2.1.4 | Definir critério de slicing automático (`__VERIFIER_error` + MemSafety) | 19/Out | 23/Out | 5 | Slice preserva instruções de interesse | `docs/migration/2.1-dg-library.md` | +| ✅ | 2.1.1 | ~~`FindDG.cmake`~~ → `sbt-slicer` (dg) instalado no `Dockerfile.dev` em `/opt/sbt-slicer` | 28/Set | 26/Set | — | Slicer roda com LLVM 16 | tacasv2a | +| ✅ | 2.1.2 | Validar o slicer standalone no container | 01/Out | 26/Set | — | Slice de programa simples funciona | tacasv2a | +| ✅ | 2.1.3 | ~~`SlicingPreprocessor`~~ → `Caller::runSlicer` + `utils/slicer.hpp` (critérios, estatísticas, stub do alvo) | 05/Out | 27/Set | — | `SlicerTest` (21 testes) | specs `2026-09-2{6,7}-tacasv2{a,b,c}-*` | +| ✅ | 2.1.4 | Critérios por propriedade: alvo/assert antes da instrumentação; `map2check_*` + nondets + externas + intrínsecos de memória depois dela (memsafety, memcleanup, overflow) | 19/Out | 27/Set | — | Integração §13–§25 | `docs/reports/tacas-experiment-log.md` (R1–R14b) | ### 2.2 Integração no Pipeline (Semanas 18-20) | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 2.2.1 | Adicionar opção `--slice` ao CLI | 26/Out | 27/Out | 2 | `map2check --help` mostra opção | — | -| ☐ | 2.2.2 | Integrar pipeline: `C → IR → Slice → Instrumentação → Análise` | 28/Out | 06/Nov | 8 | Suite completa com `--slice` ativo | — | -| ☐ | 2.2.3 | Testes comparativos: com e sem slicing nos 9 benchmarks | 09/Nov | 13/Nov | 5 | Tabela de redução de tamanho bitcode | — | -| ☐ | 2.2.4 | Testes em benchmarks SV-COMP ReachSafety (amostra) | 16/Nov | 20/Nov | 5 | ≥ baseline em cobertura | `docs/migration/2.2-slicing-pipeline.md` | +| ✅ | 2.2.1 | Opção `--slice` no CLI | 26/Out | 26/Set | — | `map2check --help` mostra opção | tacasv2a | +| ✅ | 2.2.2 | Pipeline `C → IR → Slice → Instrumentação → Análise` (e slice pós-instrumentação para memória/overflow) | 28/Out | 27/Set | — | Integração com `--slice` | tacasv2a/b/c | +| ✅ | 2.2.3 | Comparativos controle × slice (Test-Comp, MemSafety, NoOverflows, CASTLE, Juliet) | 09/Nov | 28/Set | — | R8–R15 | `docs/reports/tacas-experiment-log.md` | +| ⏳ | 2.2.4 | Test-Comp Cover-Error: slice **empata** com o controle (126 × 129, R15) — otimizações na 2.4 | 16/Nov | — | — | ≥ controle em cobertas, TRUE errado = 0 | R15, R19 | ### 2.3 Validação e Buffer (Semanas 21-22) @@ -197,6 +206,15 @@ | ☐ | 2.3.1 | Medir impacto: memória, tempo, taxa de unknown | 23/Nov | 27/Nov | 5 | Relatório quantitativo | `docs/migration/2.3-fase2-final.md` | | ☐ | 2.3.2 | **Buffer/contingência** | 30/Nov | 04/Dez | 5 | — | — | +### 2.4 Otimizações do slicing — tacas 2d (Set/2026) + +| Done | ID | Tarefa | Teste | Relatório | +|:-----|:---|:-------|:------|:----------| +| ✅ | 2.4.1 | Fatiar uma vez por execução (cache `.slice/`, inclusive da falha do slicer) — elimina os 4 ERROR de ECA da R15 | Integração §31 | spec `2026-09-29-tacas-2d-slicing-optimizations-design.md` | +| ⏳ | 2.4.2 | Limpeza pós-slice (`MAP2CHECK_SLICE_CLEANUP` = `light` ou `o2`) — em medição | R19 | — | +| ⏳ | 2.4.3 | Parâmetros do dg (`--cda=ntscd`, `--pta=fs`) — em medição | R19 | — | +| ☐ | 2.4.4 | Cutoff-diverging com `!dbg` (só se 2.4.1–2.4.3 não bastarem) | — | — | + > **Marco Fase 2:** Slicing funcional, redução mensurável em timeouts > **Data-alvo:** 04/Dez/2026 @@ -208,29 +226,40 @@ | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 3.1.1 | `FindAFLPlusPlus.cmake` — compilar/instalar AFL++ 4.40c | 07/Dez | 11/Dez | 5 | `afl-fuzz --version` OK | — | -| ☐ | 3.1.2 | Instrumentação AFL++ com LLVM 16 (modo PCGUARD) | 14/Dez | 18/Dez | 5 | Programa de teste instrumentado e fuzzado | — | -| ☐ | 3.1.3 | Wrapper de compilação para programas com instrumentação AFL++ | 21/Dez | 24/Dez | 4 | Programa fuzzeado encontra crash | — | -| ☐ | 3.1.4 | Validação: fuzzing standalone em benchmarks simples | 05/Jan | 09/Jan | 5 | ≥3 crashes encontrados em programas unsafe | `docs/migration/3.1-aflpp.md` | +| ✅ | 3.1.1 | AFL++ 4.40c no `Dockerfile.dev` (toolchain em `/usr/local/bin`), substituindo o LibFuzzer | 07/Dez | 25/Set | — | `afl-fuzz --version` OK | tacasv1 | +| ✅ | 3.1.2 | Instrumentação PCGUARD + modo persistente + binário CmpLog | 14/Dez | 26/Set | — | Programa instrumentado e fuzzado | tacasv1 | +| ✅ | 3.1.3 | Pipeline de compilação AFL++ no `Caller` + replay de crash pelo binário witness | 21/Dez | 26/Set | — | Crash confirmado por replay | tacasv1 | +| ✅ | 3.1.4 | Validação em Test-Comp; correções: leitura após o fim da entrada devolve zero (laços `while(nondet)` travavam o dry run) | 05/Jan | 29/Set | — | Integração §32 | spec `2026-09-25-tacasv1-aflpp-migration-design.md` | ### 3.2 Coordenador Central (Semanas 27-30) | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 3.2.1 | Criar módulo `coordinator/` (Python + subprocess) | 12/Jan | 16/Jan | 5 | Testes unitários do módulo | — | -| ☐ | 3.2.2 | IPC POSIX: shared memory + semáforos | 19/Jan | 23/Jan | 5 | Comunicação bidirecional testada | — | -| ☐ | 3.2.3 | Ciclo de vida: AFL++ → monitoramento → KLEE → reinjeção | 26/Jan | 06/Fev | 10 | Programa simples verificado end-to-end | — | -| ☐ | 3.2.4 | Heurística de Desbloqueio de Fronteira (Δt, proximidade) | 09/Fev | 13/Fev | 5 | Detecção de estagnação + branch flipping | `docs/migration/3.2-coordinator.md` | +| ✅ | 3.2.1 | ~~`coordinator/` em Python~~ → laço `alternateEngines()` no frontend C++ (`--alternate-engines`) | 12/Jan | 29/Set | — | `AlternationTest` | spec `2026-09-29-tacas-3b-engine-alternation-design.md` | +| ✅ | 3.2.2 | ~~IPC POSIX~~ → troca por arquivos no store `.seeds/` (fases sequenciais, 1 núcleo) | 19/Jan | 28/Set | — | Integração §11, §26–§28 | tacas 3a | +| ✅ | 3.2.3 | Ciclo AFL++ → KLEE → reinjeção, em rodadas com janelas que dobram | 26/Jan | 29/Set | — | Integração §33 | tacas 3b | +| ⏳ | 3.2.4 | Detecção de estagnação (`AFL_EXIT_ON_TIME`; `CoveredInstructions` do `run.stats` do KLEE) — em medição; *branch flipping* por proximidade ainda não | 09/Fev | — | — | R19 | tacas 3b | ### 3.3 Smart Seeds e Validação (Semanas 31-34) | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 3.3.1 | Gerenciador de Smart Seeds (serialização, conversão, filtro) | 16/Fev | 20/Fev | 5 | Seeds transferidas AFL++ ↔ KLEE | — | -| ☐ | 3.3.2 | Ranking por densidade SDG | 23/Fev | 27/Fev | 5 | Seeds priorizadas corretamente | — | -| ☐ | 3.3.3 | Teste integrado: pipeline completo com coordenação | 02/Mar | 06/Mar | 5 | Benchmark com melhoria de cobertura | `docs/migration/3.3-fase3-final.md` | +| ✅ | 3.3.1 | Smart seeds: fila do AFL++ → replay tipado → `.ktest`; `.ktest` → bytes do AFL++ (`--seed-exchange`) | 16/Fev | 28/Set | — | `SeedStoreTest`, `KtestReaderTest` | spec `2026-09-28-tacasv3a-smart-seeds-plumbing-design.md` | +| ☐ | 3.3.2 | Ranking de sementes (novidade de cobertura; densidade SDG) — tacas 3c | 23/Fev | — | 5 | Seeds priorizadas corretamente | — | +| ⏳ | 3.3.3 | Teste integrado com coordenação: R16 (seeds 148 × 129 cobertas); R19 (alternância) em curso | 02/Mar | — | — | Benchmark com melhoria de cobertura | `docs/reports/tacas-experiment-log.md` | | ☐ | 3.3.4 | **Buffer/contingência** | 09/Mar | 13/Mar | 5 | — | — | +### 3.4 Correções de veredito achadas nas rodadas TACAS + +| Done | ID | Correção | Teste | +|:-----|:---|:---------|:------| +| ✅ | 3.4.1 | KLEE parado pelo HaltTimer não é prova (TRUE errado 27 → 5 na R15) | Integração | +| ✅ | 3.4.2 | Vetor vazio conta como testemunha (programas sem entrada) | `KtestReaderTest` | +| ✅ | 3.4.3 | `abort()` do programa poda o caminho (`map2check_assume(0)`), não encerra a busca do KLEE | Integração §29 | +| ✅ | 3.4.4 | KLEE que concretizou uma entrada ou matou estados cedo não é prova | Integração §30 | +| ☐ | 3.4.5 | MemoryTrackPass não instrumenta os intrínsecos `llvm.memcpy/memset/memmove` do LLVM 16 | — | +| ☐ | 3.4.6 | Falso positivo do memtrack no busybox `sleep-3` | — | + > **Marco Fase 3:** Coordenador funcional, AFL++ ↔ KLEE com Smart Seeds > **Data-alvo:** 13/Mar/2027 diff --git a/docs/paper-sbseg-2026/PLAN.md b/docs/paper-sbseg-2026/PLAN.md deleted file mode 100644 index 6ba41c837..000000000 --- a/docs/paper-sbseg-2026/PLAN.md +++ /dev/null @@ -1,190 +0,0 @@ -# Map2Check 2026 — Artigo SBSeg SF - -**Documento-mestre de planejamento e progresso.** -Atualizado a cada iteração. Estado atual: Sprint 2 — Cibersegurança + WASM (artigo ~85% completo). - ---- - -## Metadados da Submissão - -| Campo | Valor | -|:------|:------| -| **Conferência** | SBSeg 2026 — Salão de Ferramentas (SF) | -| **Deadline submissão** | 20 de julho de 2026 | -| **Notificação** | 03 de agosto de 2026 | -| **Camera ready** | 14 de agosto de 2026 | -| **Evento** | 01–04 de setembro de 2026, Armação dos Búzios — RJ | -| **Template** | SBC (a ser obtido pelo usuário) | -| **Limite** | 8 páginas de corpo (figuras e tabelas incluídas) + até 2 de referências/apêndices | -| **Modo** | Single-blind (autores conhecidos pelos revisores) | -| **Idioma** | Português | -| **CTA** | Avaliação de artefato integrada ao CTA — submissão APÓS notificação (até 14/ago) | -| **Vídeo obrigatório** | Sim — link de instalação/uso | -| **Demonstração ao vivo** | Obrigatória — pelo menos 1 autor inscrito no evento | -| **Sistema** | JEMS3 | -| **IA Generativa** | Verificar Código de Conduta SBC — declarar uso se aplicável | - -**Título provisório:** *Map2Check 2026: Modernização Sustentável de uma Ferramenta de Verificação de Memory Safety com LLVM 16 e Extensão para WebAssembly* - ---- - -## Progresso por Seção - -| # | Seção | Páginas | Status | Última atualização | -|:---|:---|:---|:---|:---| -| 1 | Introdução e Motivação | ~1 | ✅ 95% — escrito e revisado | 2026-07-04 | -| 2 | História e Evolução | ~1 | ✅ 95% — escrito e revisado | 2026-07-04 | -| 3 | Arquitetura e Funcionalidades | ~2.5 | ✅ 90% — escrito e revisado | 2026-07-04 | -| 4 | Features de Cibersegurança | ~2 | ✅ 90% — Heap + CF×2 + Juliet WASM | 2026-07-04 | -| 5 | WebAssembly (Lifting + Verificação) | ~1 | ✅ 85% — pipeline + entrypoint + dlmalloc | 2026-07-04 | -| 6 | Demonstração Planejada | ~0.5 | 🟡 50% — texto escrito, falta URL do vídeo | 2026-07-04 | -| 7 | Avaliação, Perspectivas e Conclusão | ~1 | ✅ 90% — com resultados WASM | 2026-07-04 | -| — | Referências | ~1 | 🟡 Em backlog — aguardando usuário | — | -| — | Apêndice de Reprodutibilidade | ~1 | ✅ 90% — Docker + scripts | 2026-07-04 | - -**Progresso geral:** ~85% (artigo redigido, dados consolidados, pipeline WASM validado) - ---- - -## Progresso Específico — WebAssembly (Map2Check-WASM) - -**Documento de referência:** [`docs/migration/1.7-wasm-pipeline.md`](../migration/1.7-wasm-pipeline.md) - -| Sub-etapa | Descrição | Status | Sessão | -|:---|:---|:---|:---| -| 1.7.1 | Infraestrutura WABT no Docker | ✅ Concluído — 2026-06-27 | 1 | -| 1.7.2 | WasmLifter (frontend) | ✅ Concluído — 2026-06-27 | 1 | -| 1.7.3 | PoC end-to-end manual | ✅ Concluído — 2026-07-04 | 2 | -| 1.7.4 | MemoryTrackPass com bounds per-allocation | ✅ Concluído — 2026-07-04 | 2 | -| 1.7.5 | CLI `--wasm` + pipeline integrado | ✅ Concluído — 2026-07-04 | 3 | -| 1.7.6 | Benchmarks Juliet WASM (15 casos) | ✅ Concluído — 2026-07-04 | 3 | -| 1.7.7 | Documentação e integração ao artigo | ✅ Concluído — 2026-07-04 | 4 | -| 1.7.8–1.7.12 | Taint analysis, threat modeling IoT, otimização SMT | 🔴 Trabalho futuro (pós-SBSeg) | — | - ---- - -## Checklist de Artefato CTA - -| Critério | Estado | Evidência | -|:---|:---|:---| -| **Disponibilidade** | ✅ OK | Repositório público (`hbgit/Map2Check`) + Docker image GHCR | -| **Funcionalidade** | ✅ OK | 7/7 unit tests + 9/9 passes carregam no opt-16 | -| **Reprodutibilidade** | ✅ OK | `Dockerfile.dev` + `test-comp2026/simulation/` scripts | -| **Sustentabilidade** | ✅ OK | CI/CD (GitHub Actions), `.clang-tidy`, `.cppcheck-suppressions.txt`, sanitizers, docs | - ---- - -## BACKLOG (dependências do usuário) - -| # | Item | Bloqueia | Prioridade | Estado | -|:---|:---|:---|:---|:---| -| 1 | **Referências BibTeX** (TACAS 2016, 2018, 2020 + outros) | Seção 2 (História) e Referências | 🔴 Alta | 🟡 Aguardando usuário | -| 2 | **Idioma** | Português | 🟢 OK | ✅ Decidido | -| 3 | **Template LaTeX SBC** | Geração do PDF final | 🔴 Alta | 🟡 Aguardando usuário | -| 4 | **Aprovação do orientador** no outline | Sprint 1 (redação das secções 1–3) | 🔴 Alta | 🟡 Aguardando usuário | -| 5 | **Gravação do vídeo técnico** (YouTube) | Seção 5 (Demonstração) | 🟡 Média | 🟡 Aguardando usuário | -| 6 | **Verificação Código de Conduta SBC** (IA generativa) | Declaração no artigo | 🟡 Média | 🟡 Aguardando usuário | -| 7 | **Presença no evento** (Búzios, 01–04/set) | Condição de aceitação | 🟢 OK | ✅ Confirmada | - ---- - -## Sprint 0 — Fundação (17–22/jun, ~5 dias) - -| Dia | Tarefa | Status | -|:---|:---|:---| -| 0 | Criar skill de persistência + diretório do artigo | ✅ Feito | -| 0 | Gerar figuras Mermaid (5 figuras) | ✅ Feito | -| 0 | Escrever PLAN.md + outline.md | ✅ Feito | -| 0 | Preparar roteiro do vídeo | ✅ Feito | -| 0 | Consolidar dados brutos em `data/` | ✅ Feito | -| 1 | Definir plano de implementação WASM (`docs/migration/1.7-wasm-pipeline.md`) | ✅ Feito | -| 1–2 | Implementar infraestrutura WABT no Docker + WasmLifter (1.7.1–1.7.2) | 🟡 Em andamento — sessão 1 | -| 2–3 | PoC end-to-end + adaptar MemoryTrackPass WASM (1.7.3–1.7.4) | 🔴 Não iniciado — sessão 2 | -| 3–4 | CLI `--wasm` + WasmBackend + benchmarks Juliet (1.7.5–1.7.6) | 🔴 Não iniciado — sessão 3 | -| 4 | Integrar resultados WASM ao outline + revisar com orientador | 🟡 Pendente | - -**Entregável Sprint 0:** Outline aprovado + ambiente de build reprodutível validado + plano WASM detalhado. - ---- - -## Sprint 1 — Núcleo Técnico e História (23/jun–02/jul, ~10 dias) - -| Dia | Tarefa | Seções | Status | -|:---|:---|:---|:---| -| 1–2 | Redigir Introdução e Motivação (rascunho) | Sec 1 | 🔴 Não iniciado | -| 3–4 | Redigir História e Evolução (rascunho) | Sec 2 | 🔴 Não iniciado | -| 5–8 | Redigir Arquitetura e Funcionalidades (rascunho) | Sec 3 | 🔴 Não iniciado | -| 9–10 | Produzir figuras finais + tabular resultados | — | 🔴 Não iniciado | - -**Entregável Sprint 1:** Seções 1–3 em draft + figuras + tabela de resultados consolidada. - ---- - -## Sprint 2 — Cibersegurança + WASM + Demo + Vídeo (03–13/jul, ~10 dias) - -| Dia | Tarefa | Seções | Status | -|:---|:---|:---|:---| -| 1–2 | Redigir Features de Cibersegurança | Sec 4 | 🔴 Não iniciado | -| 3–5 | Implementar pipeline WASM (sessões 2–3 de `1.7-wasm-pipeline.md`) | Sec 5 | 🟡 Em andamento — aguardando sessões | -| 5–6 | Redigir seção WebAssembly + resultados Juliet | Sec 5 | 🔴 Não iniciado | -| 7 | Redigir Demonstração Planejada | Sec 6 | 🔴 Não iniciado | -| 8 | Redigir Avaliação, Perspectivas e Conclusão | Sec 7 | 🔴 Não iniciado | -| 9–10 | Gravar e editar vídeo técnico | — | 🔴 Não iniciado | -| 10 | Escrever Apêndice de Reprodutibilidade | Apêndice | 🔴 Não iniciado | - -**Entregável Sprint 2:** Artigo completo em draft + pipeline WASM funcional + vídeo publicado + checklist CTA. - ---- - -## Sprint 3 — Revisão, Finalização e Submissão (14–20/jul, ~7 dias) - -| Dia | Tarefa | Status | -|:---|:---|:---| -| 1–2 | Revisão técnica e de escrita (todas as secções) | 🔴 Não iniciado | -| 3 | Checagem do limite de 8 páginas de corpo + formatação SBC | 🔴 Não iniciado | -| 4 | Declaração de uso de IA generativa (se aplicável) conforme Código de Conduta SBC | 🔴 Não iniciado | -| 5 | Revisão final + leitura por terceiro | 🔴 Não iniciado | -| 6–7 | Geração do PDF final e submissão no JEMS3 | 🔴 Não iniciado | - -**Entregável Sprint 3:** PDF submetido. - -> **Nota sobre CTA:** A avaliação de artefato é feita APÓS a notificação de aceite (03/ago). O artefato (container Docker, scripts, documentação) será refinado e submetido junto com o camera ready (14/ago). Não precisa estar 100% finalizado na submissão do artigo. - -> **Nota sobre demonstração ao vivo:** Pelo menos 1 autor deve estar inscrito no evento (01–04/set, Búzios) para demonstrar a ferramenta. Esta é uma condição de aceitação. - ---- - -## Notas de Iteração - -### Iteração 1 — 2026-06-20 -- **Todas as 7 seções redigidas** em português (Introdução, História, Arquitetura, Cibersegurança, WebAssembly, Demonstração, Conclusão + Apêndice). -- **Macros LaTeX** criadas para todos os dados numéricos (\TotalTasks, \ScoreTestComp, etc.). -- **Tabelas** inseridas: passes de instrumentação, mapeamento CWE, resultados TestComp 2026, bugs críticos. -- **Figuras** referenciadas: timeline, pipeline, passes, TestComp 2026, CI/CD. -- **Referências** ainda com placeholders `~\cite{}` — aguardando usuário inserir as chaves BibTeX corretas. -- **PDF não compilado** — ambiente sem pdflatex. Compilação a ser feita pelo usuário. -- BACKLOG: referências BibTeX + figuras PNG + compilação PDF + gravação vídeo. - -### Iteração 2 — 2026-06-23 -- **Plano WASM detalhado** criado em `docs/migration/1.7-wasm-pipeline.md` com 4 sessões de implementação. -- **Migration plan atualizado** (`docs/map2check_migration_plan.md`) com Fase 1.7, riscos e dependências. -- **PLAN.md do SBSeg atualizado** com nova seção WebAssembly (Sec 5) e título provisório revisado. -- **Status das sub-etapas WASM:** - - 1.7.1–1.7.2: 🟡 Em andamento (sessão 1 — infra + lifter) - - 1.7.3–1.7.4: 🔴 Não iniciado (sessão 2 — PoC + passes) - - 1.7.5–1.7.6: 🔴 Não iniciado (sessão 3 — CLI + benchmarks) - - 1.7.7: 🔴 Não iniciado (sessão 4 — artigo) - - 1.7.8–1.7.12: 🔴 Trabalho futuro (pós-SBSeg) - -### Iteração 4 — 2026-07-04 -- **Artigo ~85% completo** — todas as 7 seções redigidas, travessões removidos, texto corrido -- **Bounds checking por alocação implementado** — 3/3 Juliet heap FALSE (CWE-122, 126) -- **Pipeline WASM validado end-to-end** — CLI `--wasm` funcional, 15 Juliet compilados -- **CI/CD corrigido** — `find_path` sem `NO_DEFAULT_PATH`, WasmRuntimeStubs opcional -- **Testes de integração** — `test_wasm_pipeline.sh` + `test_wasm_entrypoint.sh` -- **Pendente:** vídeo técnico + referências BibTeX + template SBC -- **Deadline:** 20/jul — 16 dias restantes - ---- - -*Última atualização: 2026-07-04* diff --git a/docs/paper-sbseg-2026/appendix/reprodutibilidade.md b/docs/paper-sbseg-2026/appendix/reprodutibilidade.md deleted file mode 100644 index e66e63646..000000000 --- a/docs/paper-sbseg-2026/appendix/reprodutibilidade.md +++ /dev/null @@ -1,31 +0,0 @@ -# Apendice — Reprodutibilidade - -**Estado:** Rascunho nao iniciado. -**Fontes:** Dockerfile.dev, test-comp2026/simulation/, .github/workflows/. - ---- - -## A.1 Build com Docker - -[PARAGRAFOS A REDIGIR] -- Comandos para build da imagem -- Comandos para execucao do container -- Verificacao do ambiente (clang-16, opt, cmake) - -## A.2 Execucao de benchmarks - -[PARAGRAFOS A REDIGIR] -- Comandos para smoke test -- Comandos para TestComp 2026 -- Verificacao de vereditos - -## A.3 CI e qualidade - -[PARAGRAFOS A REDIGIR] -- Link para GitHub Actions (nomes/instituicoes podem constar — single-blind) -- Comandos para static analysis -- Comandos para sanitizers - ---- - -*Nota: Aguardando redacao na Sprint 2.* diff --git a/docs/paper-sbseg-2026/data/consolidated-data.md b/docs/paper-sbseg-2026/data/consolidated-data.md deleted file mode 100644 index e7b7acd6e..000000000 --- a/docs/paper-sbseg-2026/data/consolidated-data.md +++ /dev/null @@ -1,111 +0,0 @@ -# Dados Consolidados — Artigo SBSeg 2026 - -## TestComp 2026 — C.coverage-error-call.Heap - -| Resultado | Count | Porcentagem | -|:----------|:------|:------------| -| TRUE | 264 | 44.4% | -| UNKNOWN | 271 | 45.6% | -| FALSE | 56 | 9.4% | -| FALSE_FREE | 1 | 0.2% | -| TIMEOUT | 2 | 0.3% | -| **Total** | **594** | **100%** | -| **Score** | **57** | — | - -### Por Set - -| Set | Tasks | FALSE | TRUE | UNKNOWN | TIMEOUT | -|:----|:------|:------|:-----|:--------|:--------| -| Heap | 428 | 39 | 203 | 184 | 2 | -| LinkedLists | 166 | 18 | 61 | 87 | 0 | - -### Configuracao Experimental - -| Parametro | Valor | -|:----------|:------| -| LLVM | 16.0 | -| KLEE | 3.x (LLVM 16) | -| SMT Solver | Z3 | -| Timeout por task | 300s | -| Target function | reach_error | -| Property | coverage-error-call.prp | -| Benchmarks | sv-benchmarks tag testcomp26 | -| Ambiente | Docker (map2check-dev), single-container | -| Duracao total | ~20h (interrompida, retomada automaticamente) | - ---- - -## Smoke Test E2E - -| Benchmark | Esperado | Resultado | Status | -|:----------|:---------|:----------|:-------| -| loops/array-1.c | TRUE | VERIFICATION SUCCEEDED | OK | -| loops/array-2.c | FALSE | VERIFICATION FAILED + counter-example | OK | - -### Counter-example (array-2.c) - -``` -State 0: __VERIFIER_nondet_int() -> 31763, Line 19, Scope: main -State 1: __VERIFIER_nondet_int() -> 31763, Line 22, Scope: main -Violated property: file map2check_property line 7 function __VERIFIER_assert -FALSE: Target Reached -``` - ---- - -## Estatisticas de Modernizacao - -| Metrica | Valor | -|:--------|:------| -| Commits na branch feat-update (vs develop) | 35 | -| Arquivos alterados | 84 | -| Linhas adicionadas | +5.785 | -| Linhas removidas | −657 | -| Passes migrados (Legacy PM -> New PM) | 9 | -| Unit tests | 7/7 passando | -| Pass plugin load tests | 9/9 carregando no opt-16 | -| Bugs criticos encontrados e corrigidos | 3 | - -### Componentes Atualizados - -| Componente | Versao Anterior | Versao Nova | -|:-----------|:----------------|:------------| -| LLVM/Clang | 6.0 | 16.0 | -| KLEE | 2.x (fork custom) | 3.x | -| C++ Standard | C++11 | C++17 | -| CMake | >= 3.5 | >= 3.20 | -| Docker Base | Ubuntu 16.04 | Ubuntu 22.04 LTS | -| Pass Manager | Legacy (FunctionPass) | New PM (PassInfoMixin) | - ---- - -## Bugs Criticos Corrigidos - -| # | Bug | Sintoma | Causa Root | Commit | -|:--|:----|:--------|:-----------|:-------| -| 1 | KLEE 3.1 CLI flags | Unknown command line argument | Flags removidas na v3.x | 284aef1ac | -| 2 | isRequired() ausente | Passes pulados silenciosamente | optnone + New PM behavior | 0deb84e01 | -| 3 | Target function nao propagada | __VERIFIER_error em vez de reach_error | env var vs cl::opt mismatch | 0deb84e01 | - ---- - -## Mapeamento CWE <-> Propriedade SV-COMP - -| Propriedade SV-COMP | CWE | Descricao | Pass Principal | -|:--------------------|:----|:----------|:---------------| -| valid-free | CWE-415 | Double-free | MemoryTrackPass | -| valid-deref | CWE-119/787 | Buffer overflow / Invalid dereference | MemoryTrackPass + OverflowPass | -| valid-memtrack | CWE-401 | Memory leak | MemoryTrackPass | -| valid-memcleanup | CWE-401 | Memory leak (cleanup) | MemoryTrackPass | -| no-overflow | CWE-190 | Integer overflow | OverflowPass | - ---- - -## Checklist de Artefato CTA - -| Criterio | Estado | Evidencia | -|:---------|:-------|:----------| -| Disponibilidade | OK | Repo publico + Docker image GHCR | -| Funcionalidade | OK | 7/7 unit tests + 9/9 passes | -| Reprodutibilidade | OK | Dockerfile.dev + scripts benchmark | -| Sustentabilidade | OK | CI/CD + static analysis + sanitizers + docs | diff --git a/docs/paper-sbseg-2026/figures/fig1-timeline.mmd b/docs/paper-sbseg-2026/figures/fig1-timeline.mmd deleted file mode 100644 index 00da6bd91..000000000 --- a/docs/paper-sbseg-2026/figures/fig1-timeline.mmd +++ /dev/null @@ -1,32 +0,0 @@ -## Figura 1 — Timeline de Evolução do Map2Check (2016→2026) - -```mermaid -timeline - title Evolução do Map2Check - 2016 : TACAS 2016 - : "Hunting Memory Bugs" - : BMC com CBMC - 2018 : TACAS 2018 - : LLVM + KLEE - : Execução Simbólica - 2020 : TACAS 2020 - : Abordagem Híbrida - : LibFuzzer + KLEE + Crab-LLVM - 2019 : Último release v7.3.1 - : Estagnação até 2025 - 2026 : SBSeg 2026 - : Renascimento - : LLVM 16 + New PM + C++17 - : CI/CD + TestComp 2026 -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG via: -```bash -mmdc -i fig1-timeline.mmd -o fig1-timeline.svg -``` - -**Observação para redação:** -- A timeline mostra claramente o hiato de 2019→2026 -- Usar como figura na Seção 2 (História e Evolução) diff --git a/docs/paper-sbseg-2026/figures/fig2-pipeline.mmd b/docs/paper-sbseg-2026/figures/fig2-pipeline.mmd deleted file mode 100644 index d60505f7a..000000000 --- a/docs/paper-sbseg-2026/figures/fig2-pipeline.mmd +++ /dev/null @@ -1,50 +0,0 @@ -## Figura 2 — Pipeline de Verificação Map2Check 2026 - -```mermaid -flowchart LR - subgraph Entrada - A[Código C\n(.c/.i)] - end - - subgraph Frontend - B[clang-16\n-O0 -emit-llvm] - C[LLVM IR\n(.bc)] - end - - subgraph Instrumentação - D[opt-16\n-load-pass-plugin] - E["9 Passes New PM\n(Assert, Target, LoopPred,\nMap2CheckLib, NonDet,\nTrackBB, Overflow,\nAutomata, MemoryTrack)"] - end - - subgraph Linking - F[llvm-link] - G[Bitcode\nInstrumentado] - end - - subgraph Motores - H["KLEE 3.1\n(Execução Simbólica)"] - I["LibFuzzer\n(Fuzzing)"] - end - - subgraph Saída - J[Veredito\nTRUE / FALSE / UNKNOWN] - K[Witness\n(GraphML)] - L[Teste\n(Concreto)] - end - - A --> B --> C --> D --> E --> F --> G - G --> H - G --> I - H --> J - H --> K - H --> L - I --> J -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que o pipeline é executado inteiramente dentro do container Docker -- Usar como figura principal na Seção 3 (Arquitetura) diff --git a/docs/paper-sbseg-2026/figures/fig3-passes.mmd b/docs/paper-sbseg-2026/figures/fig3-passes.mmd deleted file mode 100644 index c058a560d..000000000 --- a/docs/paper-sbseg-2026/figures/fig3-passes.mmd +++ /dev/null @@ -1,54 +0,0 @@ -## Figura 3 — Passes de Instrumentação (New Pass Manager) - -```mermaid -flowchart TB - subgraph "Entrada: LLVM IR" - IR["Module LLVM\nFunções C instrumentadas"] - end - - subgraph "Passes de Análise" - A[AssertPass] - B[TargetPass] - C[LoopPredAssumePass] - D[Map2CheckLibrary] - E[NonDetPass] - F[TrackBasicBlockPass] - G[OverflowPass] - H[GenerateAutomataTruePass] - I[MemoryTrackPass] - end - - subgraph "Saída: LLVM IR Instrumentado" - OUT["Module LLVM\n+ Calls para Runtime\n+ Metadados de Witness"] - end - - IR --> A & B & C & D & E & F & G & H & I --> OUT - - style A fill:#e1f5e1 - style B fill:#e1f5e1 - style C fill:#e1f5e1 - style D fill:#e1f5e1 - style E fill:#fff5e1 - style F fill:#fff5e1 - style G fill:#ffe1e1 - style H fill:#ffe1e1 - style I fill:#ffe1e1 - - LEG1["🟢 Simples"] - LEG2["🟡 Médios"] - LEG3["🔴 Complexos"] -``` - -**Legenda:** -- 🟢 **Simples** (~130–160 LOC): AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary -- 🟡 **Médios** (~330–400 LOC): NonDetPass, TrackBasicBlockPass -- 🔴 **Complexos** (~520–900 LOC): OverflowPass, GenerateAutomataTruePass, MemoryTrackPass - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Mencionar que todos os 9 passes declaram `static bool isRequired() { return true; }` -- Sem isso, `opt -O0` pula os passes em funções com atributo `optnone` -- Usar como figura na Seção 3.2 diff --git a/docs/paper-sbseg-2026/figures/fig4-testcomp2026.mmd b/docs/paper-sbseg-2026/figures/fig4-testcomp2026.mmd deleted file mode 100644 index 6c0346331..000000000 --- a/docs/paper-sbseg-2026/figures/fig4-testcomp2026.mmd +++ /dev/null @@ -1,41 +0,0 @@ -## Figura 4 — Resultados TestComp 2026: C.coverage-error-call.Heap - -```mermaid -pie title Resultados Consolidados (594 tasks) - "TRUE (264)" : 264 - "UNKNOWN (271)" : 271 - "FALSE (56)" : 56 - "TIMEOUT (2)" : 2 - "FALSE_FREE (1)" : 1 -``` - ---- - -### Tabela complementar (para inserir no corpo do artigo) - -| Resultado | Count | % | -|:----------|:------|:--| -| TRUE | 264 | 44.4% | -| UNKNOWN | 271 | 45.6% | -| FALSE | 56 | 9.4% | -| FALSE_FREE | 1 | 0.2% | -| TIMEOUT | 2 | 0.3% | -| **Total** | **594** | **100%** | -| **Score** | **57** | — | - -### Por set - -| Set | Tasks | FALSE | TRUE | UNKNOWN | TIMEOUT | -|:----|:------|:------|:-----|:--------|:--------| -| Heap | 428 | 39 | 203 | 184 | 2 | -| LinkedLists | 166 | 18 | 61 | 87 | 0 | - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar o pie chart como SVG/PNG. -A tabela deve ser inserida diretamente como `table` em LaTeX. - -**Observação para redação:** -- Destacar que 56 bugs reais foram encontrados (FALSE positives de erro, TRUE positives de detecção) -- Score 57 é competitivo para uma primeira execução em LLVM 16 -- Usar como figura/tabela na Seção 4.2 diff --git a/docs/paper-sbseg-2026/figures/fig5-cicd.mmd b/docs/paper-sbseg-2026/figures/fig5-cicd.mmd deleted file mode 100644 index 9bc140529..000000000 --- a/docs/paper-sbseg-2026/figures/fig5-cicd.mmd +++ /dev/null @@ -1,35 +0,0 @@ -## Figura 5 — Workflow CI/CD e Qualidade de Artefato - -```mermaid -flowchart LR - subgraph "CI/CD GitHub Actions" - A[Push / PR] --> B[Build] - B --> C["Unit Tests\n(7/7)"] - B --> D["Pass Plugin Load\n(9/9)"] - B --> E["Sanitizers\n(ASAN/UBSAN/TSAN)"] - B --> F["Static Analysis\n(clang-tidy / cppcheck)"] - C & D & E & F --> G["Docker Image\nGHCR"] - end - - subgraph "Qualidade" - H[".clang-tidy\n(C++17)"] - I[".cppcheck-suppressions\n(C backend)"] - J["scripts/run-static-analysis.sh"] - K["OpenSSF Best Practices\n(em andamento)"] - end - - G --> L["Reprodutibilidade\nCTA Score"] - H & I & J & K --> L -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que esta infraestrutura pontua diretamente nos critérios CTA: - - **Disponibilidade:** repositório público + Docker image GHCR - - **Funcionalidade:** 7/7 unit tests + 9/9 passes - - **Reprodutibilidade:** `Dockerfile.dev` + scripts de benchmark - - **Sustentabilidade:** CI/CD, static analysis, sanitizers, documentação -- Usar como figura na Seção 3.4 diff --git a/docs/paper-sbseg-2026/outline.md b/docs/paper-sbseg-2026/outline.md deleted file mode 100644 index 8176daadd..000000000 --- a/docs/paper-sbseg-2026/outline.md +++ /dev/null @@ -1,243 +0,0 @@ -# Outline do Artigo — Map2Check 2026 (SBSeg SF) - -**Instrução:** Este outline serve como guia de escrita. Cada item representa um parágrafo ou bloco de conteúdo. O estado de cada item é atualizado conforme o draft avança. - ---- - -## Metadados do Edital (atualizado 2026-06-18) - -| Campo | Valor | -|:------|:------| -| **Conferência** | SBSeg 2026 — Salão de Ferramentas (SF) | -| **Submissão** | 20/jul/2026 | -| **Notificação** | 03/ago/2026 | -| **Camera ready** | 14/ago/2026 | -| **Evento** | 01–04/set/2026, Búzios — RJ | -| **Modo** | Single-blind (autores conhecidos pelos revisores) | -| **Idioma** | Português ou inglês (a decidir) | -| **Limite** | 8 pág corpo + até 2 pág referências/apêndices | -| **Template** | SBC | -| **Modalidade** | Código Aberto (elegível a prêmios) | -| **Vídeo obrigatório** | Sim — URL de instalação e funcionalidades | -| **Demonstração ao vivo** | Obrigatória — pelo menos 1 autor inscrito | -| **CTA** | Após notificação (até 14/ago), integrado ao camera ready | -| **IA Generativa** | Verificar Código de Conduta SBC — declarar uso se aplicável | - ---- - -## Seção 1 — Introdução e Motivação (~1 página) - -### 1.1 O problema de memory safety em C/C++ -- [ ] Abrir com estatísticas de vulnerabilidades de memória (CWEs 119, 416, 415, 401, 787) -- [ ] Citar que memory-safety bugs continuam entre as principais causas de CVEs exploráveis -- [ ] Contextualizar: sistemas embarcados, infraestrutura crítica, consequências de falhas - -### 1.2 Verificação híbrida como abordagem promissora -- [ ] Breve explicação da combinação análise estática + dinâmica (fuzzing + execução simbólica) -- [ ] Citar trabalhos de ponta: FuSeBMC (smart seeds), Symbiotic (slicing + KLEE) -- [ ] Destacar que ferramentas de competição (SV-COMP, TestComp) impulsionam o estado da arte - -### 1.3 Posicionamento do Map2Check -- [ ] Map2Check como verificador híbrido consolidado para programas C -- [ ] Menção às publicações anteriores (TACAS 2016, 2018, 2020) -- [ ] O problema: estagnação desde 2019 (LLVM 6.0, Ubuntu 16.04, último release nov/2019) - -### 1.4 Contribuições desta versão (2026) -- [ ] Lista numerada de contribuições: - 1. Migração completa da stack: LLVM 6 → 16, New Pass Manager, C++17 - 2. Infraestrutura de engenharia: CI/CD, Docker, sanitizers, static analysis - 3. Validação em benchmarks reais: TestComp 2026 (Heap, 594 tasks, score 57) - 4. Fortalecimento do posicionamento em cibersegurança (mapeamento CWE) - ---- - -## Seção 2 — História e Evolução (~1 página) - -### 2.1 Linha do tempo (2016→2026) -- [ ] **2016 (TACAS):** "Hunting Memory Bugs" — abordagem BMC com CBMC -- [ ] **2018 (TACAS):** Migração para LLVM + KLEE — execução simbólica como motor principal -- [ ] **2020 (TACAS):** Abordagem híbrida — fuzzing (LibFuzzer) + execução simbólica (KLEE) + invariantes indutivos (Crab-LLVM) -- [ ] **2019–2025:** Estagnação — último release, LLVM 6.0 obsoleto, dependências deprecadas -- [ ] **2026:** Renascimento — modernização sistemática da stack completa -- [ ] **Figura 1:** Timeline visual da evolução - -### 2.2 O que motivou o renascimento -- [ ] Obsolescência técnica: LLVM 6.0 EOL, Ubuntu 16.04 EOL, KLEE 2.0 sem suporte -- [ ] Impossibilidade de competir em SV-COMP/TestComp com stack legada -- [ ] Necessidade de sustentabilidade de engenharia (CI/CD, reproducibilidade, qualidade de artefato) -- [ ] Alinhamento com cibersegurança: CWEs como linguagem comum entre verificação formal e indústria de segurança - ---- - -## Seção 3 — Arquitetura e Funcionalidades (~2.5 páginas) - -### 3.1 Pipeline de verificação (visão geral) -- [ ] Fluxo completo: Código C → clang-16 → LLVM IR → opt (passes) → llvm-link → runtime → KLEE / LibFuzzer → Veredito + Witness -- [ ] **Figura 2:** Diagrama do pipeline com caixas e setas - -### 3.2 Passes de instrumentação (New Pass Manager) -- [ ] Descrição dos 9 passes migrados do Legacy PM para o New PM: - - `AssertPass` — instrumenta asserts do verificador - - `TargetPass` — marca função-alvo (e.g., `reach_error`) - - `LoopPredAssumePass` — injeta predicados em laços - - `Map2CheckLibrary` — renomeia `main` para `__map2check_main__` - - `NonDetPass` — substitui `__VERIFIER_nondet_*` por chamadas simbólicas - - `TrackBasicBlockPass` — rastreia cobertura de blocos básicos - - `OverflowPass` — instrumenta operações aritméticas para overflow - - `GenerateAutomataTruePass` — gera autômato de witness (GraphML) - - `MemoryTrackPass` — instrumenta acessos a memória (alloc, free, deref) -- [ ] **Figura 3:** Diagrama dos passes com inputs/outputs e dependências -- [ ] Destacar: `isRequired()` como fix crítico (sem isso, `opt -O0` pula todos os passes) - -### 3.3 Motores de análise -- [ ] **KLEE 3.1** (LLVM 16): execução simbólica, geração de testes, contra-exemplos -- [ ] **LibFuzzer** (LLVM 16): fuzzing guiado por cobertura, rápido para bugs superficiais -- [ ] **Iterative deepening:** combinação dos dois motores em fases - -### 3.4 Modernização de engenharia (pilar de sustentabilidade) -- [ ] **LLVM 16 + New Pass Manager:** compatibilidade com pipelines modernos, Opaque Pointers -- [ ] **C++17:** `std::filesystem`, structured bindings, modernização do frontend -- [ ] **CI/CD (GitHub Actions):** build automatizado, unit tests (7/7), pass plugin load tests (9/9) -- [ ] **Docker:** `Dockerfile.dev` (Ubuntu 22.04 + LLVM 16) — reprodutibilidade garantida -- [ ] **Static analysis:** `.clang-tidy` (C++), `.cppcheck-suppressions.txt` (C), `scripts/run-static-analysis.sh` -- [ ] **Sanitizers:** ASAN, UBSAN, TSAN targets no CMake -- [ ] **OpenSSF Best Practices:** checklist em andamento para badge -- [ ] **Figura 5:** Workflow CI/CD (diagrama GitHub Actions) -- [ ] **CTA:** Esta infraestrutura pontua diretamente nos critérios de artefato (disponibilidade, funcionalidade, reprodutibilidade, sustentabilidade) - ---- - -## Seção 4 — Features de Cibersegurança (~2 páginas) - -### 4.1 Mapeamento de memory safety para CWEs -- [ ] **CWE-401:** Memory Leak — detecção via `MemoryTrackPass` + runtime library -- [ ] **CWE-416:** Use-After-Free — detecção via tracking de ponteiros -- [ ] **CWE-415:** Double-Free — detecção via log de alocações -- [ ] **CWE-119 / CWE-787:** Buffer Overflow — detecção via `OverflowPass` + bounds checking -- [ ] **Tabela:** Mapeamento propriedade SV-COMP → CWE → pass responsável - -### 4.2 TestComp 2026 — Execução Heap -- [ ] Contexto: TestComp 2026, sub-categoria `C.coverage-error-call.Heap` -- [ ] Configuração: timeout 300s, Z3, target `reach_error`, Docker single-container -- [ ] **Tabela de resultados consolidados:** - - TRUE: 264 (44.4%) - - UNKNOWN: 271 (45.6%) - - FALSE: 56 (9.4%) - - TIMEOUT: 2 (0.3%) - - Total: 594 tasks | Score: 57 -- [ ] **Tabela por set:** - - Heap (428 tasks): 39 FALSE, 203 TRUE, 184 UNKNOWN, 2 TIMEOUT - - LinkedLists (166 tasks): 18 FALSE, 61 TRUE, 87 UNKNOWN, 0 TIMEOUT -- [ ] **Figura 4:** Gráfico de barras ou pizza dos resultados - -### 4.3 Smoke test e validação de vereditos -- [ ] Execução E2E manual em benchmarks `loops/array-1.c` e `loops/array-2.c` -- [ ] `array-1.c`: TRUE (unreachable) → VERIFICATION SUCCEEDED ✅ -- [ ] `array-2.c`: FALSE (reachable) → VERIFICATION FAILED + counter-example ✅ -- [ ] Counter-example validado: `__VERIFIER_nondet_int() → 31763`, linha 19, escopo `main` -- [ ] Framework de checkpoint automatizado: `run_checkpoint.sh`, `verify_verdicts.sh` - -### 4.4 Bugs críticos encontrados e corrigidos -- [ ] **Tabela dos 3 bugs:** - | Bug | Sintoma | Causa | Fix | - |:----|:--------|:------|:----| - | KLEE 3.1 flags | `Unknown command line argument` | Flags removidas na v3.x | Atualizar `caller.cpp` | - | `isRequired()` | Passes pulados silenciosamente | `optnone` + New PM | `isRequired()=true` em 9 passes | - | Target function | `__VERIFIER_error` em vez de `reach_error` | env var vs `cl::opt` | Passar `-function-name` na CLI | -- [ ] Destacar: nenhum desses bugs era detectável pelos testes unitários existentes (7/7) -- [ ] Implicação: a necessidade de testes de integração E2E - -### 4.5 Suporte a WebAssembly (WASM) — Em Desenvolvimento -- [ ] Extensão do pipeline LLVM 16 existente para análise de módulos WASM -- [ ] Backend LLVM-WASM: compilação C → LLVM IR → WASM → instrumentação → verificação -- [ ] Vetor de ataque: memory safety em runtimes WASM (Wasmtime, Wasmer) -- [ ] Testes preliminares em benchmarks SV-COMP adaptados para WASM -- [ ] Status: implementação em andamento, resultados preliminares na submissão -- [ ] **NÃO é trabalho futuro — é feature em desenvolvimento ativo** - ---- - -## Seção 5 — Demonstração Planejada (~0.5 página) - -### 5.1 O que será demonstrado ao vivo -- [ ] Pipeline completo em Docker: compilação → instrumentação → execução → veredito -- [ ] Exemplo interativo: execução em benchmark `loops/array-2.c` mostrando: - - compilação com `map2check` - - instrumentação pelos 9 passes - - execução com KLEE - - geração de counter-example -- [ ] Execução do framework TestComp 2026 (subset) mostrando throughput - -### 5.2 Equipamentos necessários -- [ ] Laptop com Docker instalado -- [ ] Imagem `map2check-dev` pré-construída (ou build no local, ~30 min) -- [ ] Subconjunto de benchmarks SV-COMP (`testcomp26` tag) -- [ ] Acesso à internet (para pull da imagem Docker, se necessário) - -### 5.3 Vídeo técnico (obrigatório no edital) -- [ ] Link do vídeo (será preenchido após gravação) -- [ ] Duração: 5–7 minutos -- [ ] Conteúdo: instalação (Docker), build, execução E2E, resultados TestComp 2026 -- [ ] **Roteiro detalhado:** ver `video/roteiro-gravacao.md` -- [ ] URL será incluída no artigo (não precisa ser anônima — single-blind) - -### 5.4 Demonstração ao vivo (condição de aceitação) -- [ ] Pelo menos 1 autor deve estar inscrito no evento (01–04/set, Búzios) -- [ ] A demonstração será o pipeline E2E em Docker + benchmarks SV-COMP -- [ ] Equipamentos: laptop com Docker + imagem map2check-dev + benchmarks - ---- - -## Seção 6 — Avaliação, Perspectivas e Conclusão (~1 página) - -### 6.1 Resumo dos resultados -- [ ] Modernização completa da stack: 35 commits, 84 arquivos, +5.785/−657 linhas -- [ ] 9 passes migrados para New PM, 7/7 unit tests passando, 9/9 passes carregando -- [ ] TestComp 2026 Heap: 594 tasks, score 57, 56 bugs reais encontrados (9.4%) -- [ ] 3 bugs críticos de regressão descobertos e corrigidos durante a migração - -### 6.2 Limitações -- [ ] Taxa de UNKNOWN alta (45.6%): necessita investigação de timeout tuning e estratégia de solver -- [ ] Ausência de testes de integração E2E no CI: todos os 3 bugs foram perdidos pelos unit tests -- [ ] ControlFlow benchmarks usaram property `no-overflow` — incomparável com modo reachability -- [ ] C++17 dead store warnings em libc++ headers (documentado, não crítico) - -### 6.3 Perspectivas -- [ ] Aprofundamento do suporte a WebAssembly: expansão dos benchmarks, modelagem formal da memória linear WASM -- [ ] Redução da taxa de UNKNOWN: tuning de timeout, estratégias de solver SMT, heurísticas de path exploration -- [ ] Testes de integração E2E no CI: automatizar o pipeline completo compile → instrument → link → execute -- [ ] (NÃO mencionar: DG Library, AFL++, Coordenador, Smart Seeds — fora do escopo deste artigo) - -### 6.4 Conclusão -- [ ] O Map2Check renasceu como plataforma sustentável de verificação de memory safety -- [ ] A modernização de engenharia (LLVM 16, CI/CD, Docker, static analysis) é um pré-requisito fundamental para qualquer avanço futuro -- [ ] Os resultados do TestComp 2026 demonstram viabilidade competitiva -- [ ] O projeto está aberto a contribuições (open source, repositório público) - ---- - -## Apêndice — Reprodutibilidade (~1 página) - -### A.1 Build com Docker -- [ ] Comandos para build da imagem: `docker build -f Dockerfile.dev -t map2check-dev .` -- [ ] Comandos para execução: `docker run -it --rm map2check-dev` -- [ ] Verificação: `clang-16 --version`, `opt --version`, `cmake --version` - -### A.2 Execução de benchmarks -- [ ] Comandos para smoke test: `map2check --property-file ...` -- [ ] Comandos para TestComp 2026: `cd test-comp2026/simulation && ./run_checkpoint.sh` -- [ ] Verificação de vereditos: `./verify_verdicts.sh` - -### A.3 CI e qualidade -- [ ] Link para GitHub Actions (nomes/instituições podem constar — single-blind) -- [ ] Comandos para static analysis: `./scripts/run-static-analysis.sh` -- [ ] Comandos para sanitizers: `cmake -DENABLE_SANITIZER_ADDRESS=ON ...` - -### A.4 Declaração de IA Generativa (se aplicável) -- [ ] Verificar Código de Conduta SBC: https://sol.sbc.org.br/index.php/indice/conduta -- [ ] Declarar uso de ferramentas de IA no processo de escrita/revisão se aplicável - ---- - -*Estado do outline: Sprint 0 — estrutura completa, aguardando redação secção a secção.* -*Última atualização: 2026-06-18 (revisado com edital oficial SBSeg 2026 SF)* diff --git a/docs/paper-sbseg-2026/references/references.bib b/docs/paper-sbseg-2026/references/references.bib deleted file mode 100644 index 82d01a8db..000000000 --- a/docs/paper-sbseg-2026/references/references.bib +++ /dev/null @@ -1,22 +0,0 @@ -% Placeholder para referencias BibTeX -% BACKLOG: usuario deve fornecer as referencias das publicacoes anteriores -% e demais citacoes necessarias. - -% Exemplo de formato: -% @inproceedings{rocha2016map2check, -% title={Map2Check: Using Symbolic Execution and Fuzzing}, -% author={Rocha, Herbert and others}, -% booktitle={TACAS}, -% year={2016} -% } - -% Referencias necessarias: -% - TACAS 2016 (Map2Check original) -% - TACAS 2018 (LLVM + KLEE) -% - TACAS 2020 (Hibrido: fuzzing + symex + invariantes) -% - FuSeBMC (Alshmrany et al., 2022/2024) -% - Symbiotic (Chalupa et al., 2021) -% - KLEE (Cadar et al., 2008) -% - AFL++ (Fioraldi et al., 2020) -% - CWE/MITRE -% - SV-COMP / TestComp (Beyer, 2023) diff --git a/docs/paper-sbseg-2026/sbseg-article/.gitignore b/docs/paper-sbseg-2026/sbseg-article/.gitignore deleted file mode 100644 index 694f4184c..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -*.bbl -*.blg -*.log diff --git a/docs/paper-sbseg-2026/sbseg-article/caption2.sty b/docs/paper-sbseg-2026/sbseg-article/caption2.sty deleted file mode 100644 index 0575c72fc..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/caption2.sty +++ /dev/null @@ -1,406 +0,0 @@ -%% -%% This is file `caption2.sty', -%% generated with the docstrip utility. -%% -%% The original source files were: -%% -%% caption2.dtx (with options: `package') -%% -%% Copyright (C) 1994-2002 Axel Sommerfeldt (caption@sommerfeldt.net) -%% -%% -------------------------------------------------------------------------- -%% -%% It may be distributed and/or modified under the -%% conditions of the LaTeX Project Public License, either version 1.2 -%% of this license or (at your option) any later version. -%% The latest version of this license is in -%% http://www.latex-project.org/lppl.txt -%% and version 1.2 or later is part of all distributions of LaTeX -%% version 1999/12/01 or later. -%% -\NeedsTeXFormat{LaTeX2e}[1994/12/01] -\ProvidesPackage{caption2} - [2002/08/03 v2.1 Customising captions (AS)] -\newcommand*\captionfont{} -\newcommand*\captionlabelfont{} -\newcommand*\captionlabeldelim{} -\newcommand*\captionlabelsep{} -\newcommand*\captionsize{} -\newdimen\captionmargin -\newdimen\captionwidth -\newif\ifcaptionwidth -\newdimen\captionindent -\newif\ifcaptionlabel\captionlabeltrue -\newif\ifonelinecaptions -\newif\ifignoreLTcapwidth -\newcommand*\setcaptionmargin{% - \captionwidthfalse - \setlength\captionmargin} -\newcommand*\setcaptionwidth{% - \captionwidthtrue - \setlength\captionwidth} -\newcommand*\normalcaptionparams{% - \let\captionsize\@empty - \renewcommand*\captionfont{\captionsize}% - \let\captionlabelfont\@empty% - \renewcommand*\captionlabeldelim{:}% - \renewcommand*\captionlabelsep{\space}% - \setcaptionmargin\z@\setlength\captionindent\z@ - \onelinecaptionstrue} -\newcommand*\caption@eh{% - If you do not understand this error, please take a closer look\MessageBreak - at the documentation of the `caption2' package.\MessageBreak - \@ehc} -\newcommand*\defcaptionstyle[1]{% - \@namedef{caption@@#1}} -\newcommand*\newcaptionstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \expandafter\defcaptionstyle - \else - \PackageError{caption2}{Caption style `#1' already defined}{\caption@eh}% - \expandafter\@gobbletwo - \fi - {#1}} -\newcommand*\renewcaptionstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \PackageError{caption2}{Caption style `#1' undefined}{\caption@eh}% - \expandafter\@gobbletwo - \else - \expandafter\defcaptionstyle - \fi - {#1}} -\newcommand*\dummycaptionstyle[2]{% - \defcaptionstyle{#1}{% - \expandafter\ifx\csname caption@@\caption@style\expandafter\endcsname% - \csname caption@@#1\endcsname - \PackageError{caption2}{You can't use the caption style `#1' directy}{% - The caption style `#1' is only a dummy and does not really exists.% - \MessageBreak You have to redefine it (with \protect\renewcaptionstyle) - before you can select\MessageBreak it with \protect\captionstyle. - \space\caption@eh}% - \else - #2\usecaptionstyle{\caption@style}% - \fi}} -\newcaptionstyle{normal}{\caption@makecaption{normal}} -\newcaptionstyle{center}{\caption@makecaption{center}} -\newcaptionstyle{centerlast}{\caption@makecaption{centerlast}} -\newcaptionstyle{flushleft}{\caption@makecaption{flushleft}} -\newcaptionstyle{flushright}{\caption@makecaption{flushright}} -\newcaptionstyle{hang}{\caption@makecaption{hang}} -\newcaptionstyle{hang+center}{\caption@makecaption{hang@center}} -\newcaptionstyle{hang+centerlast}{\caption@makecaption{hang@centerlast}} -\newcaptionstyle{hang+flushleft}{\caption@makecaption{hang@flushleft}} -\newcaptionstyle{indent}{\caption@makecaption{indent}} -\newcommand*\captionstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \PackageError{caption2}{Undefined caption style `#1'}{\caption@eh}% - \else - \def\caption@style{#1}% - \fi} -\DeclareOption{normal}{\captionstyle{normal}} -\DeclareOption{center}{\captionstyle{center}} -\DeclareOption{centerlast}{\captionstyle{centerlast}} -\DeclareOption{flushleft}{\captionstyle{flushleft}} -\DeclareOption{flushright}{\captionstyle{flushright}} -\DeclareOption{anne}{\ExecuteOptions{centerlast}} -\DeclareOption{hang}{\captionstyle{hang}} -\DeclareOption{hang+center}{\captionstyle{hang+center}} -\DeclareOption{hang+centerlast}{\captionstyle{hang+centerlast}} -\DeclareOption{hang+flushleft}{\captionstyle{hang+flushleft}} -\DeclareOption{isu}{\ExecuteOptions{hang}} -\DeclareOption{indent}{\captionstyle{indent}} -\DeclareOption{scriptsize}{\g@addto@macro\captionsize\scriptsize} -\DeclareOption{footnotesize}{\g@addto@macro\captionsize\footnotesize} -\DeclareOption{small}{\g@addto@macro\captionsize\small} -\DeclareOption{normalsize}{\g@addto@macro\captionsize\normalsize} -\DeclareOption{large}{\g@addto@macro\captionsize\large} -\DeclareOption{Large}{\g@addto@macro\captionsize\Large} -\DeclareOption{up}{\g@addto@macro\captionlabelfont\upshape} -\DeclareOption{it}{\g@addto@macro\captionlabelfont\itshape} -\DeclareOption{sl}{\g@addto@macro\captionlabelfont\slshape} -\DeclareOption{sc}{\g@addto@macro\captionlabelfont\scshape} -\DeclareOption{md}{\g@addto@macro\captionlabelfont\mdseries} -\DeclareOption{bf}{\g@addto@macro\captionlabelfont\bfseries} -\DeclareOption{rm}{\g@addto@macro\captionlabelfont\rmfamily} -\DeclareOption{sf}{\g@addto@macro\captionlabelfont\sffamily} -\DeclareOption{tt}{\g@addto@macro\captionlabelfont\ttfamily} -\DeclareOption{oneline}{\onelinecaptionstrue} -\DeclareOption{nooneline}{\onelinecaptionsfalse} -\newcommand*\caption@package[1]{\@namedef{caption@pkt@#1}} -\DeclareOption{float}{\caption@twozerofalse\caption@package{float}{1}} -\DeclareOption{longtable}{\caption@twozerofalse\caption@package{longtable}{1}} -\DeclareOption{subfigure}{\caption@twozerofalse\caption@package{subfigure}{1}} -\DeclareOption{none}{\caption@twozerofalse - \caption@package{float}{0}\caption@package{longtable}{0}% - \caption@package{subfigure}{0}} -\DeclareOption{all}{\ExecuteOptions{float,longtable,subfigure}} -\DeclareOption{ruled}{} -\DeclareOption{ignoreLTcapwidth}{\ignoreLTcapwidthtrue} -\DeclareOption{debug}{\caption@debugtrue} -\newif\ifcaption@debug -\newif\ifcaption@twozero -\normalcaptionparams -\ExecuteOptions{none,normal} -\caption@twozerotrue -\ProcessOptions* -\ifcaption@twozero - \PackageInfo{caption2}{Running in caption2 v2.0 compatibility mode} -\fi -\def\captionof{\@ifstar{\caption@of{\caption*}}{\caption@of\caption}} -\newcommand*\caption@of[2]{\def\@captype{#2}#1} -\@ifundefined{abovecaptionskip}{% - \newlength\abovecaptionskip\setlength\abovecaptionskip{10\p@}}{} -\@ifundefined{belowcaptionskip}{% - \newlength\belowcaptionskip\setlength\belowcaptionskip{0\p@}}{} -\newdimen\captionlinewidth -\renewcommand\@makecaption[2]{% - \vskip\abovecaptionskip - \captionlinewidth\hsize - \def\captionlabel{#1}% - \def\captiontext{#2}% - \usecaptionstyle{\caption@style}% - \vskip\belowcaptionskip} -\newcommand*\usecaptionstyle[1]{% - \ifx\captiontext\relax - \PackageError{caption2}{You can't use \protect#1 - in normal text}{The usage of \protect#1 is only - allowed inside code declared with\MessageBreak \protect\defcaptionstyle, - \protect\newcaptionstyle \space or \protect\renewcaptionstyle. - \space\caption@eh} - \else - \@ifundefined{caption@@#1}% - {\PackageError{caption2}{Caption style `#1' undefined}{\caption@eh}}% - {\@nameuse{caption@@#1}} - \fi} -\newcommand*\caption@makecaption[1]{% - \ifcaptionlabel - \def\caption@label{{\captionlabelfont\captionlabel\captionlabeldelim}\captionlabelsep}% - \else - \let\caption@label\@empty - \fi - \usecaptionmargin\captionfont - \onelinecaption{\caption@label\captiontext}% - {\@nameuse{caption@@@#1}}} -\newcommand*\caption@@@normal{% - \caption@label\captiontext\par} -\newcommand*\caption@@@center{% - \centering\caption@label\captiontext\par}% -\newcommand*\caption@centerlast{% - \advance\leftskip by 0pt plus 1fil% - \advance\rightskip by 0pt plus -1fil% - \parfillskip0pt plus 2fil\relax} -\newcommand*\caption@@@centerlast{% - \caption@centerlast\caption@label\captiontext\par} -\newcommand*\caption@@@flushleft{% - \raggedright\caption@label\captiontext\par}% -\newcommand*\caption@@@flushright{% - \raggedleft\caption@label\captiontext\par}% -\newcommand*\caption@@@hang{% - \sbox\@tempboxa{\caption@label}% - \hangindent\wd\@tempboxa\noindent - \usebox\@tempboxa\caption@hangplus\captiontext\par} -\newcommand*\caption@hangplus{} -\newcommand*\caption@@@hang@center{% - \let\caption@hangplus\centering\caption@@@hang} -\newcommand*\caption@@@hang@centerlast{% - \let\caption@hangplus\caption@centerlast\caption@@@hang} -\newcommand*\caption@@@hang@flushleft{% - \let\caption@hangplus\raggedright\caption@@@hang} -\newcommand*\caption@@@indent{% - \hangindent\captionindent\noindent - \caption@label\captiontext\par} -\newcommand\onelinecaption[1]{% - \let\next\@firstofone - \ifonelinecaptions - \sbox\@tempboxa{#1}% - \ifdim\wd\@tempboxa >\captionlinewidth - \else - \def\next{{\centering\usebox{\@tempboxa}\par}\@gobble}% - \fi - \fi\next} -\newcommand*\usecaptionmargin{% - \ifcaptionwidth - \leftskip\captionlinewidth - \advance\leftskip by -\captionwidth - \divide\leftskip by 2 - \rightskip\leftskip - \captionlinewidth\captionwidth - \else - \leftskip\captionmargin - \rightskip\captionmargin - \advance\captionlinewidth by -2\captionmargin - \fi} -\renewcommand*\caption@package[3]{% - \if1\@nameuse{caption@pkt@#1}% - \@ifundefined{#2}% - {\let\next\AtBeginDocument}% - {\let\next\@firstofone}% - \else - \ifcaption@twozero - \@ifundefined{#2}{#3\let\next\@gobble}{% - \PackageWarning{caption2}{% - The `#1' package will be supported without explicit option % - (v2.0 compatibility issue)}% - \let\next\@firstofone}% - \else - #3\let\next\@gobble - \fi - \fi - \expandafter\let\csname caption@pkt@#1\endcsname\undefined - \ifcaption@debug - \ifx\next\@gobble\PackageInfo{caption2}{#1 => gobble}% - \else\ifx\next\@firstofone\PackageInfo{caption2}{#1 => firstofone}% - \else\ifx\next\AtBeginDocument\PackageInfo{caption2}{#1 => AtBeginDocument}% - \else\PackageInfo{caption2}{#1 => ???}\fi\fi\fi - \fi - \next} -\caption@package{float}{floatc@plain}{}{% - \ifx\floatc@plain\relax - \PackageWarning{caption2}{% - Option `float' was set but there is no float package loaded} - \else - \PackageInfo{caption2}{float package v1.2 (or newer) detected} - \newcommand\caption@floatc[3]{% - \ifx\captionlabelfont\@empty - \let\captionlabelfont\@fs@cfont - \fi - \captionlinewidth\hsize - \def\captionlabel{#2}% - \def\captiontext{#3}% - \usecaptionstyle{#1}} - \renewcommand*\floatc@plain{\caption@floatc{\caption@style}} - \@ifpackagewith{caption2}{ruled}{% - \dummycaptionstyle{ruled}{\onelinecaptionsfalse\setcaptionmargin{\z@}}% - }{% - \newcaptionstyle{ruled}{% - \ifcaptionlabel - {\@fs@cfont\captionlabel}\space% - \fi\captiontext\par}% - } - \renewcommand*\floatc@ruled{\caption@floatc{ruled}} - \renewcommand*\caption@of[2]{\def\@captype{#2}% - \@ifundefined{fst@#2}{}{% - \@nameuse{fst@#2}% - \@ifundefined{@float@setevery}{}{\@float@setevery{#2}}% - \let\caption@fs@capt\@fs@capt - \let\@fs@capt\caption@of@float} - #1} - \newcommand\caption@of@float[2]{\egroup - \vskip\abovecaptionskip - \normalsize\caption@fs@capt{#1}{#2}% - \vskip\belowcaptionskip - \bgroup}% - \fi} -\caption@package{longtable}{LT@makecaption}{}{% - \ifx\LT@makecaption\relax - \PackageWarning{caption2}{% - Option `longtable' was set but there is no longtable package loaded} - \else - \PackageInfo{caption2}{longtable package v3.15 (or newer) detected} - \dummycaptionstyle{longtable}{} - \renewcommand\LT@makecaption[3]{% - \LT@mcol\LT@cols c{\hbox to\z@{\hss\parbox[t]\hsize{% - \ifignoreLTcapwidth - \else - \setcaptionwidth\LTcapwidth - \fi - \captionlinewidth\hsize - \captionlabelfalse#1\captionlabeltrue - \def\captionlabel{#2}% - \def\captiontext{#3}% - \usecaptionstyle{longtable}% - \endgraf\vskip\baselineskip}% - \hss}}} - \fi} -\newcommand*\setsubcapstyle{% - \@ifundefined{subcapraggedrightfalse}{% - \newif\ifsubcapraggedright}{}% - \ifsubcaphang - \ifsubcapcenter - \subcapstyle{hang+center}% - \else\ifsubcapcenterlast - \subcapstyle{hang+centerlast}% - \else\ifsubcapraggedright - \subcapstyle{hang+flushleft}% - \else - \subcapstyle{hang}% - \fi\fi\fi - \else\ifsubcapcenter - \subcapstyle{center}% - \else\ifsubcapcenterlast - \subcapstyle{centerlast}% - \else\ifsubcapraggedright - \subcapstyle{flushleft}% - \else - \subcapstyle{normal}% - \fi\fi\fi\fi} -\newcommand\caption@makesubcaption[2]{% - \renewcommand*\captionfont{\subcapsize\subcapfont}% - \renewcommand*\captionlabelfont{\normalfont\subcapsize\subcaplabelfont}% - \let\captionlabeldelim\subcaplabeldelim - \let\captionlabelsep\subcaplabelsep - \ifsubfigcapwidth\captionwidthtrue\else\captionwidthfalse\fi - \setlength\captionmargin\subfigcapmargin - \setlength\captionwidth\subfigcapwidth - \captionindent\subcapindent - \ifsubcapnooneline\onelinecaptionsfalse\else\onelinecaptionstrue\fi - \hbox to\@tempdima{% - \caption@subfig@hss\parbox[t]{\@tempdima}{% - \captionlinewidth\@tempdima - \captionlabeltrue - \def\captionlabel{#1}% - \def\captiontext{\ignorespaces #2}% - \usecaptionstyle{\caption@substyle}}% - \caption@subfig@hss}} -\caption@package{subfigure}{@makesubfigurecaption}{% - \let\setsubcapstyle\undefined - \let\caption@makesubcaption\undefined}{% - \ifx\@makesubfigurecaption\relax - \PackageWarning{caption2}{% - Option `subfigure' was set but there is no subfigure package loaded} - \let\setsubcapstyle\undefined - \let\caption@makesubcaption\undefined - \else - \ifx\subcapfont\undefined - \PackageInfo{caption2}{subfigure package v2.0 detected} - \let\subcapfont\@empty - \newcommand*\subfigcapwidth{\z@} - \newcommand*\setsubcapmargin{% - \subfigcapwidthfalse - \renewcommand*\subfigcapmargin} - \newcommand*\setsubcapwidth{% - \subfigcapwidthtrue - \renewcommand*\subfigcapwidth} - \newcommand*\subcaplabelsep{\space} - \let\caption@subfig@hss\hfil - \else - \PackageInfo{caption2}{subfigure package v2.1 (or newer) detected} - \newdimen\subfigcapwidth - \newcommand*\setsubcapmargin{% - \subfigcapwidthfalse - \setlength\subfigcapmargin} - \newcommand*\setsubcapwidth{% - \subfigcapwidthtrue - \setlength\subfigcapwidth} - \newcommand*\subcaplabelsep{\hskip\subfiglabelskip} - \let\caption@subfig@hss\hss - \fi - \newif\ifsubfigcapwidth - \newdimen\subcapindent - \newcommand*\subcaplabeldelim{} - \newcommand*\subcapstyle[1]{% - \expandafter\ifx\csname caption@@#1\endcsname\relax - \PackageError{caption2}{Undefined caption style `#1'}{\caption@eh}% - \else - \def\caption@substyle{#1}% - \fi} - \setsubcapstyle - \renewcommand*\@thesubfigure{\thesubfigure} - \renewcommand*\@thesubtable{\thesubtable} - \let\@makesubfigurecaption\caption@makesubcaption - \let\@makesubtablecaption\caption@makesubcaption - \fi} -\let\caption@package\undefined -\endinput -%% -%% End of file `caption2.sty'. diff --git a/docs/paper-sbseg-2026/sbseg-article/img/README.md b/docs/paper-sbseg-2026/sbseg-article/img/README.md deleted file mode 100644 index a3394ca63..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/README.md +++ /dev/null @@ -1,23 +0,0 @@ -# Figuras do Artigo SBSeg 2026 - -## Figuras TikZ (compilação nativa pelo LaTeX) -- `fig1-timeline.tikz.tex` — Timeline 2016→2026 (Substitui PNG antigo, fonte maior) -- `fig2-pipeline.tikz.tex` — Pipeline de verificação 5 estágios (Substitui PNG antigo) - -Estas são incluídas diretamente no LaTeX via `\input{img/figX-tikz.tex}`. - -## Figura Mermaid (requer renderização externa) -- `fig6-wasm-pipeline.mmd` — Pipeline WASM: `.wasm → wasm2c → LLVM IR → Passes → KLEE` - -Para gerar PNG a partir do .mmd: -```bash -npm install -g @mermaid-js/mermaid-cli -mmdc -i fig6-wasm-pipeline.mmd -o fig6-wasm-pipeline.png -b transparent -w 1200 -``` - -Ou use: https://mermaid.live (copiar conteúdo do .mmd, exportar como PNG) - -O arquivo `main.tex` referencia via `\includegraphics{img/fig6-wasm-pipeline}`. - -## Figuras removidas -As figuras fig3-passes, fig4-testcomp2026 e fig5-cicd foram removidas do artigo por orientação do revisor. Seus arquivos `.mmd` e `.png` ainda existem no diretório mas não são mais referenciadas no `main.tex`. diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.mmd deleted file mode 100644 index 00da6bd91..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.mmd +++ /dev/null @@ -1,32 +0,0 @@ -## Figura 1 — Timeline de Evolução do Map2Check (2016→2026) - -```mermaid -timeline - title Evolução do Map2Check - 2016 : TACAS 2016 - : "Hunting Memory Bugs" - : BMC com CBMC - 2018 : TACAS 2018 - : LLVM + KLEE - : Execução Simbólica - 2020 : TACAS 2020 - : Abordagem Híbrida - : LibFuzzer + KLEE + Crab-LLVM - 2019 : Último release v7.3.1 - : Estagnação até 2025 - 2026 : SBSeg 2026 - : Renascimento - : LLVM 16 + New PM + C++17 - : CI/CD + TestComp 2026 -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG via: -```bash -mmdc -i fig1-timeline.mmd -o fig1-timeline.svg -``` - -**Observação para redação:** -- A timeline mostra claramente o hiato de 2019→2026 -- Usar como figura na Seção 2 (História e Evolução) diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.png b/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.png deleted file mode 100644 index ba7da9fcc..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.tikz.tex b/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.tikz.tex deleted file mode 100644 index 59d38d9f2..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig1-timeline.tikz.tex +++ /dev/null @@ -1,52 +0,0 @@ -% Figura 1 — Timeline de Evolução do Map2Check (2016→2026) -% Uso: \input{img/fig1-timeline.tikz} - -\begin{tikzpicture}[ - node distance=0.2cm, - year/.style={font=\bfseries\footnotesize, text=black, anchor=south}, - event/.style={align=left, font=\scriptsize, text=black!70, anchor=north}, - milestone/.style={draw=blue!50!black, fill=blue!5, rounded corners=3pt, - inner sep=6pt, text width=4.8cm, align=center, font=\small\bfseries}, - rest/.style={font=\footnotesize, text=black!40, align=center}, - arrow/.style={->, >=stealth, thick, blue!40}, -] - -% Timeline base line -\draw[thick, blue!30] (0,0) -- (16,0); - -% Years and tick marks -\foreach \x/\label in {0/2016, 3/2018, 6/2020, 9/2021, 13/2026}{ - \draw[blue!40] (\x,0.15) -- (\x,-0.15); - \node[year] at (\x,0.25) {\label}; -} - -% --- 2016 --- -\node[milestone] at (0,-1.8) {CBMC + BMC}; -\node[event] at (0,-2.6) {TACAS 2016}; - -% --- 2018 --- -\node[milestone] at (3,-1.8) {LLVM + KLEE}; -\node[event] at (3,-2.6) {TACAS 2018}; - -% --- 2020 --- -\node[milestone] at (6,-1.8) {KLEE + LibFuzzer\\+ Crab-LLVM}; -\node[event] at (6,-2.8) {TACAS 2020}; - -% --- Stagnation --- -\draw[thick, gray!30, dotted] (7.5,-0.8) rectangle (11.5,-2.2); -\node[rest] at (9.5,-1.5) {Estagnação\\2019--2025}; - -% --- 2026 --- -\node[milestone] at (13,-1.8) {LLVM 16 + New PM\\+ C++17 + CI/CD\\+ WASM}; -\node[event] at (13,-3.2) {SBSeg 2026}; - -% Concorrentes -\node[rest, anchor=north west] at (0,-4.2) {Concorrentes:}; -\node[rest, anchor=north west] at (0,-4.7) {CPAchecker (SV-COMP)}; -\node[rest, anchor=north west] at (6,-4.7) {Symbiotic (slicing + KLEE)}; -\node[rest, anchor=north west] at (11,-4.7) {FuSeBMC (smart seeds)}; - -% Renascimento arrow -\draw[->, >=stealth, very thick, red!50] (9.5,-2.3) to[bend left=15] (13,-1.3); - -\end{tikzpicture} diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.mmd deleted file mode 100644 index d60505f7a..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.mmd +++ /dev/null @@ -1,50 +0,0 @@ -## Figura 2 — Pipeline de Verificação Map2Check 2026 - -```mermaid -flowchart LR - subgraph Entrada - A[Código C\n(.c/.i)] - end - - subgraph Frontend - B[clang-16\n-O0 -emit-llvm] - C[LLVM IR\n(.bc)] - end - - subgraph Instrumentação - D[opt-16\n-load-pass-plugin] - E["9 Passes New PM\n(Assert, Target, LoopPred,\nMap2CheckLib, NonDet,\nTrackBB, Overflow,\nAutomata, MemoryTrack)"] - end - - subgraph Linking - F[llvm-link] - G[Bitcode\nInstrumentado] - end - - subgraph Motores - H["KLEE 3.1\n(Execução Simbólica)"] - I["LibFuzzer\n(Fuzzing)"] - end - - subgraph Saída - J[Veredito\nTRUE / FALSE / UNKNOWN] - K[Witness\n(GraphML)] - L[Teste\n(Concreto)] - end - - A --> B --> C --> D --> E --> F --> G - G --> H - G --> I - H --> J - H --> K - H --> L - I --> J -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que o pipeline é executado inteiramente dentro do container Docker -- Usar como figura principal na Seção 3 (Arquitetura) diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.png b/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.png deleted file mode 100644 index 7aec0b679..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.tikz.tex b/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.tikz.tex deleted file mode 100644 index 7404c2745..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig2-pipeline.tikz.tex +++ /dev/null @@ -1,68 +0,0 @@ -% Figura 2 — Pipeline de Verificação do Map2Check 2026 -% Uso: \input{img/fig2-pipeline.tikz} - -\begin{tikzpicture}[ - node distance=0.8cm and 0.4cm, - stage/.style={draw=blue!60!black, fill=blue!5, rounded corners=4pt, - inner sep=6pt, align=center, font=\footnotesize, minimum width=2.2cm}, - substage/.style={draw=gray!40, fill=gray!5, rounded corners=2pt, - inner sep=4pt, align=center, font=\tiny, minimum width=2.0cm}, - arrow/.style={->, >=stealth, thick}, - label/.style={font=\scriptsize\bfseries, text=blue!60!black}, -] - -% --- Stage 1: Compilação --- -\node[label, above] at (0,1.8) {Compilação}; -\node[stage] (compile) at (0,0) {Código C\\(.c / .i)}; -\node[substage, below=of compile] (clang) {clang-16\\-O0 -emit-llvm}; - -\draw[arrow] (compile) -- (clang); - -% --- Stage 2: LLVM IR --- -\node[label, above] at (2.8,1.8) {LLVM IR}; -\node[stage] (ir) at (2.8,0) {Bitcode\\(.bc)}; - -\draw[arrow] (clang.east) -- (ir.west); - -% --- Stage 3: Instrumentação --- -\node[label, above] at (6.2,1.8) {Instrumentação}; -\node[stage] (opt) at (6.2,0) {opt-16\\-load-pass-plugin}; -\node[substage, below=of opt] (passes) {9 Passes NPM\\(MemoryTrack, Overflow,\\Assert, Target, NonDet,\\Map2CheckLib, TrackBB,\\AutoGen, LoopPred)}; - -\draw[arrow] (ir.east) -- (opt.west); -\draw[arrow] (opt) -- (passes); - -% --- Stage 4: Linking --- -\node[label, above] at (9.7,1.8) {Linking}; -\node[stage] (link) at (9.7,0) {llvm-link}; -\node[substage, below=of link] (linked) {Bitcode\\Instrumentado}; - -\draw[arrow] (passes.east) -- (link.west); -\draw[arrow] (link) -- (linked); - -% --- Stage 5: Motores + Saída --- -\node[label, above] at (13.5,2.0) {Análise}; -\node[stage] (klee) at (12.5,0) {KLEE 3.1\\Exec. Simbólica}; -\node[stage] (fuzz) at (14.5,0) {LibFuzzer\\Fuzzing}; - -\node[stage, draw=red!50!black, fill=red!5] (result) at (13.5,-2.2) {Veredito\\TRUE / FALSE /\\UNKNOWN}; -\node[substage] (witness) at (13.5,-3.6) {Witness\\GraphML}; - -\draw[arrow] (linked.east) -- (klee.west); -\draw[arrow] (linked.east) -- (fuzz.west); -\draw[arrow] (klee) -- (result); -\draw[arrow] (fuzz) -- (result); -\draw[arrow] (result) -- (witness); - -% Labels on top -\node[label,font=\scriptsize] at (0,2.5) {Estágio 1}; -\node[label,font=\scriptsize] at (2.8,2.5) {Estágio 2}; -\node[label,font=\scriptsize] at (6.2,2.5) {Estágio 3}; -\node[label,font=\scriptsize] at (9.7,2.5) {Estágio 4}; -\node[label,font=\scriptsize] at (13.5,0.8) {Estágio 5}; - -% Docker envelope -\draw[thick, green!40!black, dashed, rounded corners=8pt] (-0.8,-4.0) rectangle (15.8,2.9); -\node[font=\tiny, text=green!40!black] at (15.0,2.6) {Docker (Ubuntu 22.04)}; - -\end{tikzpicture} diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.mmd deleted file mode 100644 index c058a560d..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.mmd +++ /dev/null @@ -1,54 +0,0 @@ -## Figura 3 — Passes de Instrumentação (New Pass Manager) - -```mermaid -flowchart TB - subgraph "Entrada: LLVM IR" - IR["Module LLVM\nFunções C instrumentadas"] - end - - subgraph "Passes de Análise" - A[AssertPass] - B[TargetPass] - C[LoopPredAssumePass] - D[Map2CheckLibrary] - E[NonDetPass] - F[TrackBasicBlockPass] - G[OverflowPass] - H[GenerateAutomataTruePass] - I[MemoryTrackPass] - end - - subgraph "Saída: LLVM IR Instrumentado" - OUT["Module LLVM\n+ Calls para Runtime\n+ Metadados de Witness"] - end - - IR --> A & B & C & D & E & F & G & H & I --> OUT - - style A fill:#e1f5e1 - style B fill:#e1f5e1 - style C fill:#e1f5e1 - style D fill:#e1f5e1 - style E fill:#fff5e1 - style F fill:#fff5e1 - style G fill:#ffe1e1 - style H fill:#ffe1e1 - style I fill:#ffe1e1 - - LEG1["🟢 Simples"] - LEG2["🟡 Médios"] - LEG3["🔴 Complexos"] -``` - -**Legenda:** -- 🟢 **Simples** (~130–160 LOC): AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary -- 🟡 **Médios** (~330–400 LOC): NonDetPass, TrackBasicBlockPass -- 🔴 **Complexos** (~520–900 LOC): OverflowPass, GenerateAutomataTruePass, MemoryTrackPass - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Mencionar que todos os 9 passes declaram `static bool isRequired() { return true; }` -- Sem isso, `opt -O0` pula os passes em funções com atributo `optnone` -- Usar como figura na Seção 3.2 diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.png b/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.png deleted file mode 100644 index f4cfc2b48..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig3-passes.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.mmd deleted file mode 100644 index 6c0346331..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.mmd +++ /dev/null @@ -1,41 +0,0 @@ -## Figura 4 — Resultados TestComp 2026: C.coverage-error-call.Heap - -```mermaid -pie title Resultados Consolidados (594 tasks) - "TRUE (264)" : 264 - "UNKNOWN (271)" : 271 - "FALSE (56)" : 56 - "TIMEOUT (2)" : 2 - "FALSE_FREE (1)" : 1 -``` - ---- - -### Tabela complementar (para inserir no corpo do artigo) - -| Resultado | Count | % | -|:----------|:------|:--| -| TRUE | 264 | 44.4% | -| UNKNOWN | 271 | 45.6% | -| FALSE | 56 | 9.4% | -| FALSE_FREE | 1 | 0.2% | -| TIMEOUT | 2 | 0.3% | -| **Total** | **594** | **100%** | -| **Score** | **57** | — | - -### Por set - -| Set | Tasks | FALSE | TRUE | UNKNOWN | TIMEOUT | -|:----|:------|:------|:-----|:--------|:--------| -| Heap | 428 | 39 | 203 | 184 | 2 | -| LinkedLists | 166 | 18 | 61 | 87 | 0 | - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar o pie chart como SVG/PNG. -A tabela deve ser inserida diretamente como `table` em LaTeX. - -**Observação para redação:** -- Destacar que 56 bugs reais foram encontrados (FALSE positives de erro, TRUE positives de detecção) -- Score 57 é competitivo para uma primeira execução em LLVM 16 -- Usar como figura/tabela na Seção 4.2 diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.png b/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.png deleted file mode 100644 index 82f187df9..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig4-testcomp2026.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.mmd deleted file mode 100644 index 9bc140529..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.mmd +++ /dev/null @@ -1,35 +0,0 @@ -## Figura 5 — Workflow CI/CD e Qualidade de Artefato - -```mermaid -flowchart LR - subgraph "CI/CD GitHub Actions" - A[Push / PR] --> B[Build] - B --> C["Unit Tests\n(7/7)"] - B --> D["Pass Plugin Load\n(9/9)"] - B --> E["Sanitizers\n(ASAN/UBSAN/TSAN)"] - B --> F["Static Analysis\n(clang-tidy / cppcheck)"] - C & D & E & F --> G["Docker Image\nGHCR"] - end - - subgraph "Qualidade" - H[".clang-tidy\n(C++17)"] - I[".cppcheck-suppressions\n(C backend)"] - J["scripts/run-static-analysis.sh"] - K["OpenSSF Best Practices\n(em andamento)"] - end - - G --> L["Reprodutibilidade\nCTA Score"] - H & I & J & K --> L -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- Destacar que esta infraestrutura pontua diretamente nos critérios CTA: - - **Disponibilidade:** repositório público + Docker image GHCR - - **Funcionalidade:** 7/7 unit tests + 9/9 passes - - **Reprodutibilidade:** `Dockerfile.dev` + scripts de benchmark - - **Sustentabilidade:** CI/CD, static analysis, sanitizers, documentação -- Usar como figura na Seção 3.4 diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.png b/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.png deleted file mode 100644 index 88a2bf22f..000000000 Binary files a/docs/paper-sbseg-2026/sbseg-article/img/fig5-cicd.png and /dev/null differ diff --git a/docs/paper-sbseg-2026/sbseg-article/img/fig6-wasm-pipeline.mmd b/docs/paper-sbseg-2026/sbseg-article/img/fig6-wasm-pipeline.mmd deleted file mode 100644 index e928fbab6..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/img/fig6-wasm-pipeline.mmd +++ /dev/null @@ -1,57 +0,0 @@ -## Figura 6 — Pipeline WASM Map2Check 2026 - -```mermaid -flowchart LR - subgraph Entrada - A["Binário WASM\n(.wasm)"] - end - - subgraph Lifting - B["wasm2c\n(WABT 1.0.41)"] - C["Código C\n(.c/.h)"] - D["clang-16\n-c -emit-llvm"] - end - - subgraph Wrapper - E["generateWasmWrapperStatic()\nmain() → w2c_*_start"] - F["llvm-link\n(wrapper + lifted IR)"] - end - - subgraph Runtime - G["WasmRuntimeStubs.bc\n(calloc/free KLEE-friendly)"] - end - - subgraph Instrumentação - H["opt-16\n--wasm-mode"] - I["MemoryTrackPass\n(dlmalloc intercept + bounds check)"] - end - - subgraph Verificação - J["KLEE 3.1\n(Execução Simbólica)"] - K["Z3\n(Solver SMT)"] - end - - subgraph Saída - L["Veredito\nFALSE / UNKNOWN"] - M["Witness\n(GraphML)"] - end - - A --> B --> C --> D --> F - E --> F - G --> F - F --> H --> I --> J --> L - J --> K - J --> M -``` - ---- - -**Nota:** Para inserir no artigo LaTeX, exportar como SVG/PNG. - -**Observação para redação:** -- O pipeline é ativado via `map2check --wasm modulo.wasm` -- `wasm2c` converte o binário WASM para código C com semântica preservada -- `generateWasmWrapperStatic` cria uma função `main()` que instancia o módulo, chama `_start` e libera recursos -- `WasmRuntimeStubs.bc` substitui `mmap`/`munmap` do WABT por `calloc`/`free` compatíveis com KLEE -- O `MemoryTrackPass` em modo WASM intercepta `w2c_*_dlmalloc`/`_dlfree` e injeta bounds checks -- O KLEE opera sobre o LLVM IR levantado e linkado, sem modificações diff --git a/docs/paper-sbseg-2026/sbseg-article/main.tex b/docs/paper-sbseg-2026/sbseg-article/main.tex deleted file mode 100644 index 2aa78d4b2..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/main.tex +++ /dev/null @@ -1,360 +0,0 @@ -\documentclass[12pt]{article} - -\usepackage{sbc-template} -\usepackage{graphicx,url} -\usepackage[utf8]{inputenc} -\usepackage[brazil]{babel} -\usepackage{booktabs} -\usepackage{listings} -\usepackage{tabularx} -\usepackage{array} -\usepackage{tikz} -\usetikzlibrary{positioning, arrows.meta, shapes, calc, backgrounds} -% Macros para dados numéricos (ajustáveis em um único lugar) -\newcommand{\TotalTasks}{594} -\newcommand{\ScoreTestComp}{57} -\newcommand{\CountTrue}{264} -\newcommand{\CountUnknown}{271} -\newcommand{\CountFalse}{56} -\newcommand{\CountFalseFree}{1} -\newcommand{\CountTimeout}{2} -\newcommand{\PctTrue}{44,4} -\newcommand{\PctUnknown}{45,6} -\newcommand{\PctFalse}{9,4} -\newcommand{\CountBugsFixed}{3} -\newcommand{\CountCommits}{35} -\newcommand{\CountFiles}{84} -\newcommand{\LinesAdded}{5.785} -\newcommand{\LinesRemoved}{657} -\newcommand{\UnitTests}{7/7} -\newcommand{\PassTests}{9/9} -\newcommand{\CountPasses}{9} -\newcommand{\LLVMVersion}{16} -\newcommand{\KLEEVersion}{3.1} -\newcommand{\CppStandard}{C++17} -\newcommand{\DockerBase}{Ubuntu~22.04} -\newcommand{\TimeoutVal}{300} -\newcommand{\WasmCases}{15} -\newcommand{\WasmFalse}{\WasmCases} -\newcommand{\WasmTimeout}{290} - - -% ControlFlow (coverage-error-call) results -\newcommand{\TotalCF}{138} -\newcommand{\ScoreCF}{38} -\newcommand{\CountFalseCF}{38} -\newcommand{\CountTrueCF}{30} -\newcommand{\CountUnknownCF}{70} -\newcommand{\PctTrueCF}{21,7} -\newcommand{\PctUnknownCF}{50,7} -\newcommand{\PctFalseCF}{27,5} - -\sloppy - -\title{Map2Check 2026: Modernização Sustentável de uma Ferramenta de Verificação de Memory Safety com LLVM~16 e New Pass Manager} - -\author{Guilherme L. P. Bernardo\inst{1}, Inácio Viana\inst{1}, Francisco Nobre\inst{2}, Herbert Rocha\inst{1}} - -\address{Departamento de Informática e Matemática Aplicada -- Universidade Federal do Rio Grande do Norte (UFRN)\\ - Natal -- RN -- Brasil -\nextinstitute - Departamento de Engenharia Elétrica -- Universidade Federal de Roraima (UFRR)\\ - Boa Vista -- RR -- Brasil - \email{bguilherme51@gmail.com, inacioviana.iv@gmail.com,}\\[-2pt] - {\footnotesize\texttt{\{diego.nobre,herbert.rocha\}@ufrr.br}} -} - -\begin{document} - -\maketitle - -\begin{abstract} - Map2Check is a hybrid verification tool for C programs that combines symbolic - execution and fuzzing to detect memory safety vulnerabilities. After a period - of stagnation since 2019 (LLVM~6.0), the tool underwent a complete stack - modernization in 2026: migration to LLVM~\LLVMVersion, adoption of the New Pass Manager, - \CppStandard{} standard, CI/CD infrastructure, static analysis, and sanitizers. This - paper presents the engineering modernization, reports results from TestComp - 2026 (\TotalTasks{} tasks, score~\ScoreTestComp), and discusses ongoing WebAssembly support. -\end{abstract} - -\begin{resumo} - O Map2Check é uma ferramenta de verificação híbrida para programas em C que combina execução simbólica e fuzzing para detectar vulnerabilidades de memory safety. Após um período de estagnação desde 2019 (LLVM~6.0), a ferramenta passou por uma modernização completa da stack em 2026: migração - para LLVM~\LLVMVersion, adoção do New Pass Manager, padrão \CppStandard, infraestrutura de CI/CD, análise estática e sanitizers. Este artigo apresenta a modernização de engenharia, reporta resultados do TestComp~2026 (\TotalTasks{} tarefas, score~\ScoreTestComp) e discute o suporte em desenvolvimento a WebAssembly. -\end{resumo} - - -\section{Introdução} -\label{sec:intro} - -Vulnerabilidades de memory safety em programas C e C++ permanecem entre as classes de falhas de segurança mais críticas e persistentes. Dados do \textit{2025 CWE Top 25 Most Dangerous Software Weaknesses}~\cite{cwe2025} mostram que \textit{Out-of-bounds Write} (CWE-787), \textit{Use-After-Free} (CWE-416) e \textit{Buffer Overflow} (CWE-119) figuram consistentemente entreas principais causas de vulnerabilidades exploráveis. Em sistemas críticos, falhas de memory safety podem resultar em execução remota de código, elevação de privilégios ou negação de serviço, como ilustrado pelo acidente do -Therac-25~\cite{leveson1993investigation}. - -Diante desse cenário, a verificação híbrida combina o rigor da análise formal com a escalabilidade dos testes dinâmicos. Técnicas como execução simbólica, exemplificada pelo KLEE~\cite{klee2008}, e fuzzing guiado por cobertura, como o AFL++~\cite{fioraldi2020aflpp}, são complementares: enquanto o fuzzing é -eficiente para explorar caminhos superficiais, a execução simbólica penetra guardas lógicas complexas por meio de \textit{path constraints} resolvidas por solvers SMT. O estado da arte em competições de verificação, como SV-COMP e TestComp~\cite{beyersvcomp2013,beyertestcomp2023}, demonstra que as -ferramentas mais bem-sucedidas adotam arquiteturas de orquestração com múltiplos motores: o FuSeBMC~\cite{fusebmc2022} utiliza \textit{smart seeds} geradas por BMC para desbloquear o fuzzer, atingindo cobertura de código superior a 81\% em categorias críticas; o Symbiotic~\cite{chalupa2021symbiotic} integra \textit{program slicing} estático com KLEE para reduzir o espaço de busca; e o ESBMC~\cite{gadelha2021esbmc} emprega \textit{bounded model checking} com múltiplos solvers SMT. - -O Map2Check é uma ferramenta brasileira de verificação híbrida para programas C, com histórico de publicações no TACAS (2016, 2018, 2020) \cite{map2check2018,map2check2020}. Desde 2019, contudo, a ferramenta permaneceu estagnada: a última versão estável (v7.3.1) operava sobre LLVM~6.0 e Ubuntu~16.04 com um fork do KLEE~2.0. Essa obsolescência técnica inviabilizava a participação em competições e -comprometia a reprodutibilidade dos resultados. - -Para ilustrar a operação da ferramenta modernizada, a Listagem~\ref{lst:example} apresenta uma execução completa do Map2Check 2026 sobre um benchmark com buffer overflow. O comando \texttt{map2check} compila o código C com Clang~16, instrumenta o bitcode LLVM com os passes de memory safety, executa o KLEE e reporta o veredito com um contra-exemplo concreto que identifica a entrada responsável pela violação. - -\begin{lstlisting}[caption={Execução do Map2Check em um cenário de buffer overflow.}, label=lst:example, basicstyle=\ttfamily\small] -$ cat array-2.c -int main() { - int a[10], i = __VERIFIER_nondet_int(); - a[i] = 42; // i pode ser >= 10 - return 0; -} -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() -> 31763, line 3, scope main -\end{lstlisting} - -Este artigo apresenta o Map2Check 2026, resultado de uma modernização sistemática da stack completa. As principais contribuições são: -\begin{enumerate} -\item Migração da infraestrutura LLVM da versão~6 para~\LLVMVersion, com reescrita dos \CountPasses{} passes de instrumentação para o New Pass Manager e adoção do padrão \CppStandard; -\item Infraestrutura de engenharia de software com CI/CD, containerização Docker, análise estática e sanitizers, alinhada aos critérios do OpenSSF Best Practices~\cite{openssf2024}; -\item Validação no TestComp~2026, sub-categoria Heap, com \TotalTasks{} tarefas (corretamente detectanddo ~\ScoreTestComp casos de bugs); -\item Mapeamento formal das propriedades de memory safety para a taxonomia CWE do MITRE, fortalecendo a aplicabilidade da ferramenta em cenários de cibersegurança; -\item Suporte a WebAssembly (WASM) em desenvolvimento, estendendo o pipeline LLVM~16 para análise de módulos WASM via \texttt{wasm2c}. -\end{enumerate} - - -\section{História e Evolução} -\label{sec:historia} - -O Map2Check foi apresentado em três edições consecutivas do TACAS. Em 2016, a ferramenta empregava \textit{Bounded Model Checking} (BMC) com o verificador CBMC para detectar violações de memory safety. À época, ferramentas como CPAchecker~\cite{beyersvcomp2013} já combinavam múltiplas estratégias de verificação (análise de valor, \textit{predicate abstraction}, BMC), enquanto o Map2Check dependia exclusivamente do BMC com um único solver. - -Em 2018, a ferramenta migrou para a infraestrutura LLVM e adotou o KLEE como motor de execução simbólica, permitindo a geração de casos de teste por \textit{path-based symbolic execution}~\cite{map2check2018}. Nesse período, o Symbiotic~\cite{chalupa2021symbiotic} despontava ao integrar \textit{program slicing} estático com KLEE, reduzindo o espaço de busca antes da análise simbólica. O ESBMC, por sua vez, consolidava o uso de múltiplos solvers SMT (Z3, Boolector, Yices) em um \textit{portfolio} para reduzir a taxa de resultados inconclusivos\cite{gadelha2021esbmc}. - -Em 2020, o Map2Check consolidou uma abordagem híbrida, combinando fuzzing (LibFuzzer), execução simbólica (KLEE) e inferência de invariantes indutivos (Crab-LLVM~\cite{crabllvm2021}) em uma estratégia de \textit{iterative deepening}~\cite{map2check2020}. Contudo, a ausência de um orquestrador com troca dinâmica de sementes limitava a cooperação entre os motores: enquanto o FuSeBMC~\cite{fusebmc2022} introduzia \textit{smart seeds} geradas por BMC para desbloquear o fuzzer, atingindo cobertura de código superior a 81\% em categorias da Test-Comp, o Map2Check operava os motores em fases estanques, -sem compartilhamento de estado em tempo real. - -Após 2020, a ferramenta entrou em um período de estagnação que durou até 2025. A stack LLVM~6.0 e Ubuntu~16.04 atingiram fim de vida, o fork do KLEE~2.0 perdeu compatibilidade com versões recentes do solver Z3, e a ausência de CI/CD e containerização impedia a reprodução dos resultados por terceiros. O renascimento em 2026 partiu da constatação de que a modernização de engenharia era pré-requisito para qualquer avanço algorítmico. A Figura~\ref{fig:timeline} sintetiza essa trajetória. - -\begin{figure}[ht] -\centering -\input{img/fig1-timeline.tikz.tex} -\caption{Evolução do Map2Check de 2016 a 2026, com os marcos de cada edição do TACAS e o período de estagnação.} -\label{fig:timeline} -\end{figure} - - -\section{Arquitetura e Funcionalidades} -\label{sec:arquitetura} - -\subsection{Pipeline de Verificação} -\label{subsec:pipeline} - -O pipeline do Map2Check 2026 opera em cinco estágios, ilustrados na Figura~\ref{fig:pipeline}. O código-fonte C é compilado pelo Clang~\LLVMVersion{} com \texttt{-O0}, gerando bitcode LLVM (IR). Esse bitcode é instrumentado por \CountPasses{} passes que executam via \texttt{opt} com o New Pass Manager, injetando chamadas à biblioteca de runtime para rastrear alocações de memória, acessos a ponteiros e operações aritméticas. O bitcode instrumentado é ligado à biblioteca de runtime via \texttt{llvm-link} e executado pelo motor de análise KLEE~\KLEEVersion{} para execução simbólica ou LibFuzzer para fuzzing guiado por cobertura. O resultado consiste em um veredito (TRUE, FALSE ou UNKNOWN) e, para violações, um witness no formato GraphML com o caso de teste concreto que aciona o erro. - -\begin{figure}[ht] -\centering -\input{img/fig2-pipeline.tikz.tex} -\caption{Pipeline de verificação do Map2Check 2026: compilação, instrumentação, ligação com runtime e análise por KLEE ou LibFuzzer.} -\label{fig:pipeline} -\end{figure} - -A migração do Legacy Pass Manager (LPM) para o New Pass Manager (NPM) exigiu a reescrita completa dos \CountPasses{} passes, uma vez que as APIs \texttt{FunctionPass} e \texttt{ModulePass} foram substituídas pelo -modelo baseado em \texttt{PassInfoMixin} do LLVM~\cite{lattner:2004}. O NPM viabiliza a interoperabilidade com pipelines de otimização modernos e habilita a compilação com \texttt{-O0} sem perda de instrumentação. - -\subsection{Passes de Instrumentação} -\label{subsec:passes} - -Os \CountPasses{} passes migrados cobrem as principais classes de vulnerabilidades de memory safety. O \textit{MemoryTrackPass} emprega análise de fluxo de dados para rastrear alocações (\texttt{malloc}, -\texttt{free}), acessos a ponteiros (\texttt{load}, \texttt{store}) e desreferências, detectando use-after-free, double-free e acessos inválidos. O \textit{OverflowPass} realiza análise de intervalos em operações aritméticas para identificar buffer overflow (CWE-119/787) e integer overflow (CWE-190). O \textit{GenerateAutomataTruePass} produz o autômato de witness em GraphML que descreve o caminho de execução até a violação, permitindo validação externa por ferramentas como o CPAchecker. Os demais passes oferecem suporte à infraestrutura de verificação: injeção de predicados em laços, substituição de entradas não determinísticas, rastreamento de cobertura de blocos básicos e instrumentação de asserts do verificador. - -\subsection{Infraestrutura de Engenharia} -\label{subsec:engenharia} - -A modernização de 2026 abrangeu a infraestrutura de desenvolvimento em múltiplas camadas. O código foi migrado para \CppStandard{}, com adoção de \texttt{std::filesystem} para manipulação portável de caminhos. O ambiente -de build é containerizado via Docker (\DockerBase{} LTS), incluindo LLVM~\LLVMVersion, KLEE~\KLEEVersion, Z3 e Boost, garantindo reprodutibilidade em qualquer máquina. A qualidade é assegurada por CI/CD no GitHub Actions: build com GCC e Clang, \UnitTests{} testes unitários, \PassTests{} testes de carga dos passes no \texttt{opt}, análise estática com clang-tidy e cppcheck, e sanitizers ASAN, UBSAN e TSAN. O projeto está em processo de certificação no programa OpenSSF Best Practices~\cite{openssf2024}, atendendo aos critérios de disponibilidade, -funcionalidade, reprodutibilidade e sustentabilidade exigidos pelo comitê de avaliação de artefatos do SBSeg. - - -\section{Análise Experimental} -\label{sec:ciberseguranca} - -\subsection{Mapeamento de Memory Safety para CWEs} -\label{subsec:cwe} - -O ecossistema de cibersegurança utiliza a taxonomia CWE (\textit{Common Weakness Enumeration}) do MITRE~\cite{cwe2025} como linguagem padrão para classificação de vulnerabilidades. Para posicionar o Map2Check nesse ecossistema, estabelecemos um mapeamento formal entre as propriedades de memory safety verificadas pela ferramenta e os identificadores CWE correspondentes, apresentado na Tabela~\ref{tab:cwe}. Esse mapeamento permite que resultados de verificação formal sejam interpretados diretamente por profissionais de AppSec, que utilizam CWEs como referência em pipelines de análise de vulnerabilidades. - -\begin{table}[ht] -\centering -\caption{Mapeamento entre propriedades SV-COMP, CWEs e passes de instrumentação.} -\label{tab:cwe} -% Usamos >{\raggedright\arraybackslash} antes do X para alinhar à esquerda sem justificar -\begin{tabularx}{\textwidth}{@{}ll>{\raggedright\arraybackslash}X@{}} -\toprule -Propriedade SV-COMP & CWE & Técnica empregada \\ -\midrule -\texttt{valid-free} & CWE-415 (Double-Free) & Análise de fluxo de dados (MemoryTrackPass) \\ -\texttt{valid-deref} & CWE-416 (Use-After-Free) & Análise de fluxo de dados (MemoryTrackPass) \\ -\texttt{valid-memtrack} & CWE-401 (Memory Leak) & Tracking de alocações (MemoryTrackPass) \\ -\texttt{valid-memsafety} & CWE-119/787 (Buffer Overflow) & Análise de intervalos + fluxo de dados \\ -\texttt{no-overflow} & CWE-190 (Integer Overflow) & Análise de intervalos (OverflowPass) \\ -\bottomrule -\end{tabularx} -\end{table} - -\subsection{Resultados no TestComp 2026} -\label{subsec:testcomp} - -Para validação em larga escala, executamos o Map2Check 2026 contra a sub-categoria \texttt{C.coverage-error-call.Heap} do TestComp~2026~\cite{beyertestcomp2023}, composta por \TotalTasks{} tarefas distribuídas em dois conjuntos: \textit{Heap} (428 tarefas, com alocação dinâmica) e \textit{LinkedLists} (166 tarefas, com estruturas encadeadas). A configuração experimental utilizou timeout de \TimeoutVal{}s por tarefa, solver Z3~\cite{z3esbmc2008}, função-alvo \texttt{reach\_error} e ambiente Docker single-container (\DockerBase{} LTS). A execução total durou aproximadamente 20 horas. - -A Tabela~\ref{tab:testcomp} apresenta os resultados consolidados. A ferramenta obteve \CountTrue{} vereditos TRUE (\PctTrue\%), confirmando a ausência de violações nesses benchmarks; \CountFalse{} vereditos FALSE -(\PctFalse\%), representando bugs reais de memory safety detectados com contra-exemplo; e \CountUnknown{} vereditos UNKNOWN (\PctUnknown\%), que refletem principalmente timeouts na exploração de caminhos pelo KLEE. O -score final foi \ScoreTestComp{}. - -\begin{table}[ht] -\centering -\caption{Resultados no TestComp 2026 --- C.coverage-error-call.Heap.} -\label{tab:testcomp} -\begin{tabular}{@{}lrr@{}} -\toprule -Veredito & Tarefas & \% \\ -\midrule -TRUE & \CountTrue{} & \PctTrue \% \\ -UNKNOWN & \CountUnknown{} & \PctUnknown \% \\ -FALSE (bugs detectados) & \CountFalse{} & \PctFalse \% \\ -FALSE\_FREE & \CountFalseFree{} & 0,2 \% \\ -TIMEOUT & \CountTimeout{} & 0,3 \% \\ -\midrule -\textbf{Total} & \textbf{\TotalTasks} & \textbf{100 \%} \\ -\textbf{Score} & \textbf{\ScoreTestComp} & --- \\ -\bottomrule -\end{tabular} -\end{table} - -A validação manual de vereditos com smoke tests nos benchmarks canônicos \texttt{loops/array-1.c} (TRUE) e \texttt{loops/array-2.c} (FALSE, com counter-example \texttt{nondet\_int() $\rightarrow$ 31763}) confirmou a -corretude do pipeline completo. Durante a migração, três inconsistências na API do New Pass Manager foram identificadas e corrigidas: incompatibilidade de flags entre versões do KLEE, passes instrumentalizados sendo ignorados silenciosamente pelo \texttt{opt} em funções \texttt{optnone}, e divergência no nome da função-alvo entre a variável de ambiente e o \texttt{cl::opt}. Nenhum desses problemas era detectável pelos testes -unitários existentes (\UnitTests{}), que cobrem apenas a biblioteca C de runtime, evidenciando a necessidade de testes de integração E2E no pipeline de CI. - -\subsection{Resultados no ControlFlow} -\label{subsec:testcomp-cf} - -Além da categoria Heap, executamos o Map2Check 2026 contra a sub-categoria \texttt{C.coverage-error-call.ControlFlow} do TestComp~2026, composta por \TotalCF{} tarefas que abrangem drivers de dispositivos simplificados, estruturas de controle complexas e benchmarks de overflow aritmético. Diferentemente da categoria Heap, focada em alocação dinâmica e estruturas encadeadas, a ControlFlow explora programas cuja corretude depende predominantemente de fluxo de controle e variáveis inteiras, sem ênfase em ponteiros ou estruturas de dados. - -A Tabela~\ref{tab:testcomp-cf} apresenta os resultados. A ferramenta obteve \CountTrueCF{} vereditos TRUE (\PctTrueCF\%), \CountFalseCF{} FALSE (\PctFalseCF\%), e \CountUnknownCF{} UNKNOWN (\PctUnknownCF\%). O score final foi \ScoreCF/\TotalCF{}. A taxa de detecção de bugs (27,5\%) demonstra que a instrumentação do Map2Check é eficaz em código de drivers e controle de fluxo, enquanto os UNKNOWNs (50,7\%) refletem a complexidade inerente desses benchmarks, particularmente os drivers \texttt{ntdrivers-simplified} e \texttt{openssl-simplified}, que demandam tempos de exploração superiores ao timeout configurado. A execução completa levou aproximadamente 5 horas, evidenciando a escalabilidade da abordagem. - -\begin{table}[ht] -\centering -\caption{Resultados no TestComp 2026 --- C.coverage-error-call.ControlFlow.} -\label{tab:testcomp-cf} -\begin{tabular}{@{}lrr@{}} -\toprule -Veredito & Tarefas & \% \\ -\midrule -TRUE & \CountTrueCF{} & \PctTrueCF \% \\ -UNKNOWN & \CountUnknownCF{} & \PctUnknownCF \% \\ -FALSE (bugs detectados) & \CountFalseCF{} & \PctFalseCF \% \\ -\midrule -\textbf{Total} & \textbf{\TotalCF} & \textbf{100 \%} \\ -\textbf{Score} & \textbf{\ScoreCF} & --- \\ -\bottomrule -\end{tabular} -\end{table} - -\subsection{Validação no WebAssembly com Juliet Test Suite} -\label{subsec:wasm-juliet} - -Para validar experimentalmente o pipeline de lifting WASM e o bounds checking por alocação, selecionamos \WasmCases{} casos da Juliet Test Suite v1.3 (NIST/NSA)~\cite{nsa2017juliet} cobrindo cinco categorias de buffer overflow: CWE-121 (Stack Buffer Overflow), CWE-122 (Heap Buffer Overflow), CWE-124 (Buffer Underwrite), CWE-126 (Buffer Overread) e CWE-127 (Buffer Underread). A seleção priorizou exclusivamente casos sem dependências de rede, usando três mecanismos de entrada: \texttt{fgets}/stdin, valores hardcoded, e operações locais de memória como \texttt{memcpy}/\texttt{strcpy}/\texttt{alloca}. Todos compilam para WASM via \texttt{wasi-sdk-33.0}, sem modificações. - -Os módulos foram submetidos ao pipeline \texttt{map2check --wasm --memtrack} com timeout de \WasmTimeout{}s. O \texttt{MemoryTrackPass} foi estendido com um modo WASM que intercepta as funções de alocação do musl (\texttt{w2c\_*\_dlmalloc}/\texttt{w2c\_*\_dlfree}) no IR levantado, registrando offsets e tamanhos no \texttt{AllocationLog}. Em cada \texttt{load}/\texttt{store} na memória linear, o offset acessado é verificado contra as alocações registradas, detectando acessos fora dos limites por meio do mecanismo de bounds checking por alocação individual. - -A Tabela~\ref{tab:wasm-juliet} apresenta os resultados. Todos os \WasmCases{} casos foram corretamente detectados como FALSE, com a propriedade OVERFLOW violada, confirmando que a interceptação do alocador funciona e o bounds checking por alocação é eficaz. A detecção abrange tanto casos de heap overflow (\texttt{malloc}/\texttt{memcpy}: CWE-122 e CWE-126) quanto casos de stack overflow e underwrite/underread (CWE-121, CWE-124, CWE-127), demonstrando que o mecanismo de bounds checking captura violações independentemente do tipo de alocação. Com timeouts mais curtos (110s), todos os casos retornavam UNKNOWN; o aumento para \WasmTimeout{}s permitiu que o KLEE explorasse caminhos suficientes para encontrar as violações. - -A validação confirma que o pipeline Map2Check-WASM está funcional end-to-end e que o bounds checking por alocação individual é viável para código WASM gerado a partir de C com \texttt{wasi-sdk}. Esta é, até onde sabemos, a primeira demonstração de verificação formal de memory safety em binários WASM via lifting para LLVM IR com instrumentação do alocador. - -\begin{table}[ht] -\centering -\caption{Bounds checking por alocação no Map2Check-WASM (Juliet, \WasmTimeout{}s timeout).} -\label{tab:wasm-juliet} -\begin{tabular}{@{}lllr@{}} -\toprule -CWE & Tipo & Entrada & Veredito \\ -\midrule -121 & Stack Overflow & \texttt{fgets} & FALSE \\ -121 & Stack Overflow & valor hardcoded & FALSE \\ -121 & Stack Overflow & \texttt{alloca+memcpy} & FALSE \\ -122 & Heap Overflow & \texttt{malloc+memcpy} & FALSE \\ -122 & Heap Overflow & \texttt{sizeof} errado & FALSE \\ -122 & Heap Overflow & \texttt{fgets} & FALSE \\ -122 & Heap Overflow & valor hardcoded & FALSE \\ -124 & Buffer Underwrite & \texttt{fgets} & FALSE \\ -124 & Buffer Underwrite & valor hardcoded & FALSE \\ -124 & Buffer Underwrite & \texttt{alloca+strcpy} & FALSE \\ -126 & Buffer Overread & \texttt{fgets} & FALSE \\ -126 & Buffer Overread & valor hardcoded & FALSE \\ -126 & Buffer Overread & \texttt{malloc+memcpy} & FALSE \\ -127 & Buffer Underread & \texttt{fgets} & FALSE \\ -127 & Buffer Underread & valor hardcoded & FALSE \\ -\midrule -\multicolumn{3}{@{}l}{\textbf{Total}} & \textbf{\WasmCases/\WasmCases{} FALSE} \\ -\bottomrule -\end{tabular} -\end{table} - -\subsection{Suporte a WebAssembly} -\label{subsec:wasm} - -Estendemos o pipeline LLVM~\LLVMVersion{} para análise de módulos WebAssembly (WASM). A abordagem emprega o \texttt{wasm2c} (WABT~1.0.41) para converter binários WASM em código C com semântica preservada e, em seguida, o Clang~16 para gerar LLVM IR. O IR resultante é submetido aos mesmos passes de instrumentação e motores de análise do pipeline C nativo, permitindo verificar memory safety em binários WASM sem reimplementar a lógica de verificação. - -\begin{figure}[ht] -\centering -\includegraphics[width=.95\textwidth]{img/fig6-wasm-pipeline} -\caption{Pipeline WASM do Map2Check 2026: lifting via \texttt{wasm2c}, geração de wrapper, instrumentação com bounds check e verificação via KLEE.} -\label{fig:wasm-pipeline} -\end{figure} - -Um desafio arquitetural significativo é a diferença de entrypoints. Programas C nativos possuem a função \texttt{main} como ponto de entrada, que o \texttt{Map2CheckLibrary} renomeia para \texttt{\_\_map2check\_main\_\_} durante a instrumentação. O \texttt{wasm2c}, por outro lado, traduz o entrypoint do módulo WASM, tipicamente \texttt{\_start} do WASI, para funções com nome determinístico no formato \texttt{w2c\_\_start}, e o \texttt{main} original do usuário aparece como \texttt{w2c\_\_original\_main}. Para unificar o pipeline, implementamos a função \texttt{generateWasmWrapperStatic}, que dinamicamente extrai o nome do módulo a partir do entrypoint levantado e gera um arquivo C contendo uma função \texttt{main} canônica que instancia o módulo WASM (\texttt{wasm2c\_\_instantiate}), invoca o entrypoint (\texttt{w2c\_\_start}), e libera a instância (\texttt{wasm2c\_\_free}). Este wrapper é compilado para bitcode e ligado ao IR levantado via \texttt{llvm-link}, permitindo que o restante do pipeline opere sobre a função \texttt{main} sem modificações. - -A ativação do modo WASM é feita via CLI com a flag \texttt{--wasm}, que orquestra automaticamente o lifting, a geração do wrapper e a aplicação dos passes com o flag \texttt{--wasm-mode}. A biblioteca \texttt{WasmRuntimeStubs.bc} substitui as funções de runtime do WABT por implementações baseadas em \texttt{calloc}/\texttt{free}, compatíveis com o modelo de memória do KLEE, e redireciona \texttt{wasm\_rt\_trap} para \texttt{map2check\_error}, integrando os bounds checks nativos do \texttt{wasm2c} ao sistema de geração de witnesses do Map2Check. - - -\section{Conclusão} -\label{sec:conclusao} - -Este artigo apresentou a modernização do Map2Check, uma ferramenta brasileira de verificação híbrida de memory safety para programas C. A migração da stack de LLVM~6.0 para~\LLVMVersion{} com New Pass Manager e \CppStandard{} abrangeu \CountCommits{} commits em \CountFiles{} arquivos (+\LinesAdded{}/$-$\LinesRemoved{} linhas), com \CountPasses{} passes reescritos, \UnitTests{} testes unitários e \PassTests{} passes validados no -\texttt{opt-16}. A infraestrutura de engenharia adicionada como o estabelecimento de práticas de CI/CD, testes Dockerizados, utilização de testes com análise estática no desenvolvimento, sanitizers e a aquisição da certificação OpenSSF Best Practices~\cite{openssf2024}, que estabelece as condições de reprodutibilidade e sustentabilidade exigidas pela comunidade científica. - -A validação no TestComp~2026 demonstrou a viabilidade competitiva da ferramenta em múltiplas categorias: \TotalTasks{} tarefas na sub-categoria Heap (score~\ScoreTestComp{}) e \TotalCF{} tarefas na sub-categoria ControlFlow (score~\ScoreCF/\TotalCF{}), totalizando \CountFalse+\CountFalseCF{} bugs reais detectados com contra-exemplos precisos. O mapeamento formal das propriedades de memory safety para a taxonomia CWE do MITRE posiciona o Map2Check como ponte entre verificação formal e cibersegurança aplicada. - -As principais limitações identificadas são a taxa de \PctUnknown\% de vereditos inconclusivos e a ausência de testes de integração E2E no CI, que direcionam os próximos ciclos de desenvolvimento. O suporte a WebAssembly foi validado com \WasmCases{} casos da Juliet Test Suite, demonstrando a viabilidade do bounds checking por alocação individual em todos os buffers testados (heap e stack) com vereditos FALSE em \WasmCases/\WasmCases{} casos.. Com código aberto e infraestrutura de artefato validada, o Map2Check 2026 está posicionado para contribuir com as comunidades de verificação formal, engenharia de software e cibersegurança. - -\section{Reprodutibilidade} -\label{ap:repro} - -\subsection{Build com Docker} - -\begin{verbatim} -docker build -f Dockerfile.dev -t map2check-dev . -docker run -it --rm map2check-dev -\end{verbatim} - -\subsection{Execução de Benchmarks} - -\begin{verbatim} -map2check --property-file coverage-error-call.prp \ - --target-function-name reach_error loops/array-1.c - -cd test-comp2026/simulation/ -./run_checkpoint.sh --category Heap --timeout 300 -./verify_verdicts.sh -\end{verbatim} - -\subsection{Declaração de Uso de IA Generativa} -\label{ap:ia} - -Ferramentas de Inteligência Artificial Generativa foram utilizadas -como assistentes de escrita e revisão no processo de redação deste -artigo, conforme o Código de Conduta da SBC. -\bibliographystyle{sbc} -\bibliography{references} - -\newpage -\appendix - -\end{document} diff --git a/docs/paper-sbseg-2026/sbseg-article/references.bib b/docs/paper-sbseg-2026/sbseg-article/references.bib deleted file mode 100644 index 24ef15140..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/references.bib +++ /dev/null @@ -1,628 +0,0 @@ -@Book{knuth:84, - author = {Donald E. Knuth}, - title = {The {\TeX} Book}, - publisher = {Addison-Wesley}, - year = {1984}, - edition = {15th} -} - -@article{leveson1993investigation, - title={An investigation of the Therac-25 accidents}, - author={Leveson, Nancy G and Turner, Clark S}, - journal={Computer}, - volume={26}, - number={7}, - pages={18--41}, - year={1993}, - publisher={IEEE} -} - -@article{evaluationcriticalsoftware, -author = {Parnas, David L. and van Schouwen, A. John and Kwan, Shu Po}, -title = {Evaluation of safety-critical software}, -year = {1990}, -issue_date = {June 1990}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {33}, -number = {6}, -issn = {0001-0782}, -url = {https://doi.org/10.1145/78973.78974}, -doi = {10.1145/78973.78974}, -abstract = {Methods and approaches for testing the reliability and trustworthiness of software remain among the most controversial issues facing this age of high technology. The authors present some of the crucial questions faced by software programmers and eventual users.}, -journal = {Commun. ACM}, -month = {jun}, -pages = {636–648}, -numpages = {13} -} - -@INPROCEEDINGS{stresstest2009, - author={Mustafa, Khaled M. and Al-Qutaish, Rafa E. and Muhairat, Mohammad I.}, - booktitle={2009 Second International Conference on Computer and Electrical Engineering}, - title={Classification of Software Testing Tools Based on the Software Testing Methods}, - year={2009}, - volume={1}, - number={}, - pages={229-233}, - keywords={Software testing;System testing;Software tools;Automatic testing;Application software;Open source software;Programming;Life testing;Software quality;Protocols;Software Testing Tools;Classification;Types of Software;CASE}, - doi={10.1109/ICCEE.2009.9}} - - -@INPROCEEDINGS{whitebox2010, - author={Omar, Faizah and Ibrahim, Suhaimi}, - booktitle={2010 10th International Conference on Quality Software}, - title={Designing Test Coverage for Grey Box Analysis}, - year={2010}, - volume={}, - number={}, - pages={353-356}, - keywords={Software;test coverage;software testing;grey box;white box;black box;software traceability}, - doi={10.1109/QSIC.2010.44}} - - -@INPROCEEDINGS{blackwhitebox2011, - author={Khan, Mumtaz Ahmad and Sadiq, Mohd.}, - booktitle={The 2011 International Conference and Workshop on Current Trends in Information Technology (CTIT 11)}, - title={Analysis of black box software testing techniques: A case study}, - year={2011}, - volume={}, - number={}, - pages={1-5}, - keywords={Software;Robustness;Software engineering;Software testing;Input variables;Programming;Software;Software Testing;Black Box Testing;Boundary Value Analysis;Robustness Technique}, - doi={10.1109/CTIT.2011.6107931}} - - -@INPROCEEDINGS{CprogramingLanguage2009, - author={Yu He}, - booktitle={2009 4th International Conference on Computer Science & Education}, - title={The course choice between C language and C++ language}, - year={2009}, - volume={}, - number={}, - pages={1588-1590}, - keywords={Computer languages;Application software;Programming profession;Computer science;Object oriented programming;Educational institutions;High level languages;Software maintenance;Design methodology;Education;C language;C++ language;programming design methods;object-oriented;curriculum design}, - doi={10.1109/ICCSE.2009.5228304}} - - - -@InProceedings{map2check2018, -author="Menezes, Rafael -and Rocha, Herbert -and Cordeiro, Lucas -and Barreto, Raimundo", -editor="Beyer, Dirk -and Huisman, Marieke", -title="Map2Check Using LLVM and KLEE", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2018", -publisher="Springer International Publishing", -address="Cham", -pages="437--441", -abstract="Map2Check is a bug hunting tool that automatically checks safety properties in C programs. It tracks memory pointers and variable assignments to check user-specified assertions, overflow, and pointer safety. Here, we extend Map2Check to: (i) simplify the program using Clang/LLVM; (ii) perform a path-based symbolic execution using the KLEE tool; and (iii) transform and instrument the code using the LLVM dynamic information flow. The SVCOMP'18 results show that Map2Check can be effective in generating and checking test cases related to memory management of C programs.", -isbn="978-3-319-89963-3" -} - -@misc{fandrey2010clang, - author = {Dietmar Fandrey}, - title = {Clang/LLVM Maturity Report}, - howpublished = {\url{http://www.iwi.hs-karlsruhe.de}}, - year = {2010}, - note = {Accessed: 2024-06-16} -} - -@inproceedings{klee2008, -author = {Cadar, Cristian and Dunbar, Daniel and Engler, Dawson}, -title = {KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs}, -year = {2008}, -publisher = {USENIX Association}, -address = {USA}, -abstract = {We present a new symbolic execution tool, KLEE, capable of automatically generating tests that achieve high coverage on a diverse set of complex and environmentally-intensive programs. We used KLEE to thoroughly check all 89 stand-alone programs in the GNU COREUTILS utility suite, which form the core user-level environment installed on millions of Unix systems, and arguably are the single most heavily tested set of open-source programs in existence. KLEE-generated tests achieve high line coverage -- on average over 90\% per tool (median: over 94\%) -- and significantly beat the coverage of the developers' own hand-written test suite. When we did the same for 75 equivalent tools in the BUSYBOX embedded system suite, results were even better, including 100\% coverage on 31 of them.We also used KLEE as a bug finding tool, applying it to 452 applications (over 430K total lines of code), where it found 56 serious bugs, including three in COREUTILS that had been missed for over 15 years. Finally, we used KLEE to crosscheck purportedly identical BUSYBOX and COREUTILS utilities, finding functional correctness errors and a myriad of inconsistencies.}, -booktitle = {Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation}, -pages = {209–224}, -numpages = {16}, -location = {San Diego, California}, -series = {OSDI'08} -} - - -@InProceedings{map2check2020, -author="Rocha, Herbert -and Menezes, Rafael -and Cordeiro, Lucas C. -and Barreto, Raimundo", -editor="Biere, Armin -and Parker, David", -title="Map2Check: Using Symbolic Execution and Fuzzing", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2020", -publisher="Springer International Publishing", -address="Cham", -pages="403--407", -abstract="Map2Check is a software verification tool that combines fuzzing, symbolic execution, and inductive invariants. It automatically checks safety properties in C programs by adopting source code instrumentation to monitor data (e.g., memory pointers) from the program's executions using LLVM compiler infrastructure. For SV-COMP 2020, we extended Map2Check to exploit an iterative deepening approach using LibFuzzer and Klee to check for safety properties. We also use Crab-LLVM to infer program invariants based on reachability analysis. Experimental results show that Map2Check can handle a wide variety of safety properties in several intricate verification tasks from SV-COMP 2020.", -isbn="978-3-030-45237-7" -} - -%%%%%%%%%%%%%%%%%%%%%%%%% referencias da fundamentação teorica -@techreport{dijkstra1970notes, - author = {Dijkstra, Edsger W.}, - title = {Notes on Structured Programming (EWD249)}, - institution = {Mathematical Centre, Amsterdam}, - year = {1970}, - url = {http://www.cs.utexas.edu/users/EWD/}, -} - - -@article{parnassoftwarecritico1990, -author = {Parnas, David L. and van Schouwen, A. John and Kwan, Shu Po}, -title = {Evaluation of safety-critical software}, -year = {1990}, -issue_date = {June 1990}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {33}, -number = {6}, -issn = {0001-0782}, -url = {https://doi.org/10.1145/78973.78974}, -doi = {10.1145/78973.78974}, -abstract = {Methods and approaches for testing the reliability and trustworthiness of software remain among the most controversial issues facing this age of high technology. The authors present some of the crucial questions faced by software programmers and eventual users.}, -journal = {Communications ACM}, -month = {jun}, -pages = {636–648}, -numpages = {13} -} - -@inproceedings{coverageSpaceProject2017, -author = {Prause, Christian and Werner, Jürgen and Hornig, Kay and Bosecker, Sascha and Kuhrmann, Marco}, -year = {2017}, -month = {11}, -pages = {}, -title = {Is 100% Test Coverage a Reasonable Requirement? Lessons Learned from a Space Software Project}, -isbn = {978-3-319-69925-7}, -doi = {10.1007/978-3-319-69926-4_25} -} - -@article{al2021jacoco, - title={Jacoco-coverage based statistical approach for ranking and selecting key classes in object-oriented software}, - author={Al-Ahmad, Bilal and AL-TAHARWA, ISMAIL and ALKHAWALDEH, RAMI S and ALAZZAM, IYAD M and GHATASHEH, NAZEEH}, - journal={Journal of Engineering Science and Technology}, - volume={16}, - number={08}, - pages={2021}, - year={2021} -} - -@article{clarkemetodosformais1996, -author = {Clarke, Edmund M. and Wing, Jeannette M.}, -title = {Formal methods: state of the art and future directions}, -year = {1996}, -issue_date = {Dec. 1996}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {28}, -number = {4}, -issn = {0360-0300}, -url = {https://doi.org/10.1145/242223.242257}, -doi = {10.1145/242223.242257}, -journal = {ACM Computing Surveys}, -month = {dec}, -pages = {626–643}, -numpages = {18} -} - -@INPROCEEDINGS{testcovferramenta, - author={Beyer, Dirk and Lemberger, Thomas}, - booktitle={2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE)}, - title={TestCov: Robust Test-Suite Execution and Coverage Measurement}, - year={2019}, - volume={}, - number={}, - pages={1074-1077}, - keywords={Containers;Generators;Tools;Standards;Metadata;Linux;Computer architecture;Test Execution, Coverage, Test-Suite Reduction}, - doi={10.1109/ASE.2019.00105}} - - -@article{soremekun2021programslicing, - title={Locating faults with program slicing: an empirical analysis}, - author={Soremekun, Ezekiel and Kirschner, Lukas and Böhme, Marcel and Zeller, Andreas}, - journal={Empirical Software Engineering}, - volume={26}, - issue={3}, - pages={51}, - year={2021}, - month={April}, - doi={10.1007/s10664-020-09931-7}, - url={https://doi.org/10.1007/s10664-020-09931-7}, - publisher={Springer} -} - -@article{korel1988dynamicslice, -title = {Dynamic slicing of computer programs}, -journal = {Journal of Systems and Software}, -volume = {13}, -number = {3}, -pages = {187-195}, -year = {1990}, -issn = {0164-1212}, -doi = {https://doi.org/10.1016/0164-1212(90)90094-3}, -url = {https://www.sciencedirect.com/science/article/pii/0164121290900943}, -author = {Bogdan Korel and Janusz Laski}, -abstract = {Program slicing is a useful tool in program debugging [25, 26]. Dynamic slicing introduced in this paper differs from the original static slicing in that it is defined on the basis of a computation. A dynamic program slice is an executable part of the original program that preserves part of the program's behavior for a specific input with respect to a subset of selected variables, rather than for all possible computations. As a result, the size of a slice can be significantly reduced. Moreover, the approach allows us to treat array elements and fields in dynamic records as individual variables. This leads to a further reduction of the slice size.} -} - -@article{tip1994dynamicslice, - title={A survey of program slicing techniques}, - author={Frank Tip}, - journal={Journal of Programming Languages}, - year={1994}, - volume={3}, - url={https://api.semanticscholar.org/CorpusID:9882901} -} - -@article{li2018fuzzing, - title={Fuzzing: a survey}, - author={Li, Jun and Zhao, Bodong and Zhang, Chao}, - journal={Cybersecurity}, - volume={1}, - number={1}, - pages={6}, - year={2018}, - month={June}, - doi={10.1186/s42400-018-0002-y}, - url={https://doi.org/10.1186/s42400-018-0002-y}, - publisher={Springer} -} - - -@article{zhang2004dynamicslice, -author = {Zhang, Xiangyu and Gupta, Rajiv}, -title = {Cost effective dynamic program slicing}, -year = {2004}, -issue_date = {May 2004}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {39}, -number = {6}, -issn = {0362-1340}, -url = {https://doi.org/10.1145/996893.996855}, -doi = {10.1145/996893.996855}, -abstract = {Although dynamic program slicing was first introduced to aid in user level debugging, applications aimed at improving software quality, reliability, security, and performance have since been identified as candidates for using dynamic slicing. However, the dynamic dependence graph constructed to compute dynamic slices can easily cause slicing algorithms to run out of memory for realistic program runs. In this paper we present the design and evaluation of a cost effective dynamic program slicing algorithm. This algorithm is based upon a dynamic dependence graph representation that is highly compact and rapidly traversable. Thus, the graph can be held in memory and dynamic slices can be quickly computed. A compact representation is derived by recognizing that all dynamic dependences (data and control) need not be individually represented. We identify sets of dynamic dependence edges between a pair of statements that can share a single representative edge. We further show that the dependence graph can be transformed in a manner that increases sharing and sharing can be performed even in the presence of aliasing. Experiments show that transformed dynamic dependence graphs explicitly represent only 6\% of the dependence edges present in the full dynamic dependence graph. When the full graph sizes range from 0.84 to 1.95 Gigabytes in size, our compacted graphs range from 20 to 210 Megabytes in size. Average slicing times for our algorithm range from 1.74 to 36.25 seconds across several benchmarks from SPECInt2000/95.}, -journal = {SIGPLAN Not.}, -month = {jun}, -pages = {94–106}, -numpages = {13}, -keywords = {testing, dynamic dependence graph, debugging} -} - - -@inproceedings{justfuzzit2019, -author = {Liew, Daniel and Cadar, Cristian and Donaldson, Alastair F. and Stinnett, J. Ryan}, -title = {Just fuzz it: solving floating-point constraints using coverage-guided fuzzing}, -year = {2019}, -isbn = {9781450355728}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -url = {https://doi.org/10.1145/3338906.3338921}, -doi = {10.1145/3338906.3338921}, -abstract = {We investigate the use of coverage-guided fuzzing as a means of proving satisfiability of SMT formulas over finite variable domains, with specific application to floating-point constraints. We show how an SMT formula can be encoded as a program containing a location that is reachable if and only if the program’s input corresponds to a satisfying assignment to the formula. A coverage-guided fuzzer can then be used to search for an input that reaches the location, yielding a satisfying assignment. We have implemented this idea in a tool, Just Fuzz-it Solver (JFS), and we present a large experimental evaluation showing that JFS is both competitive with and complementary to state-of-the-art SMT solvers with respect to solving floating-point constraints, and that the coverage-guided approach of JFS provides significant benefit over naive fuzzing in the floating-point domain. Applied in a portfolio manner, the JFS approach thus has the potential to complement traditional SMT solvers for program analysis tasks that involve reasoning about floating-point constraints.}, -booktitle = {Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering}, -pages = {521–532}, -numpages = {12}, -keywords = {feedback-directed fuzzing, Constraint solving}, -location = {Tallinn, Estonia}, -series = {ESEC/FSE 2019} -} - -@article{godefuzzing2012, -author = {Godefroid, Patrice and Levin, Michael Y. and Molnar, David}, -title = {SAGE: whitebox fuzzing for security testing}, -year = {2012}, -issue_date = {March 2012}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -volume = {55}, -number = {3}, -issn = {0001-0782}, -url = {https://doi.org/10.1145/2093548.2093564}, -doi = {10.1145/2093548.2093564}, -abstract = {SAGE has had a remarkable impact at Microsoft.}, -journal = {Commun. ACM}, -month = {mar}, -pages = {40–44}, -numpages = {5} -} - -@misc{manes2019mutationfuzzy, - title={The Art, Science, and Engineering of Fuzzing: A Survey}, - author={Valentin J. M. Manes and HyungSeok Han and Choongwoo Han and Sang Kil Cha and Manuel Egele and Edward J. Schwartz and Maverick Woo}, - year={2019}, - eprint={1812.00140}, - archivePrefix={arXiv}, - primaryClass={id='cs.CR' full_name='Cryptography and Security' is_active=True alt_name=None in_archive='cs' is_general=False description='Covers all areas of cryptography and security including authentication, public key cryptosytems, proof-carrying code, etc. Roughly includes material in ACM Subject Classes D.4.6 and E.3.'} -} - - -@inproceedings{godefroid2005execsimbol, -author = {Godefroid, Patrice and Klarlund, Nils and Sen, Koushik}, -title = {DART: directed automated random testing}, -year = {2005}, -isbn = {1595930566}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -url = {https://doi.org/10.1145/1065010.1065036}, -doi = {10.1145/1065010.1065036}, -abstract = {We present a new tool, named DART, for automatically testing software that combines three main techniques: (1) automated extraction of the interface of a program with its external environment using static source-code parsing; (2) automatic generation of a test driver for this interface that performs random testing to simulate the most general environment the program can operate in; and (3) dynamic analysis of how the program behaves under random testing and automatic generation of new test inputs to direct systematically the execution along alternative program paths. Together, these three techniques constitute Directed Automated Random Testing, or DART for short. The main strength of DART is thus that testing can be performed completely automatically on any program that compiles -- there is no need to write any test driver or harness code. During testing, DART detects standard errors such as program crashes, assertion violations, and non-termination. Preliminary experiments to unit test several examples of C programs are very encouraging.}, -booktitle = {Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation}, -pages = {213–223}, -numpages = {11}, -keywords = {automated test generation, interfaces, program verification, random testing, software testing}, -location = {Chicago, IL, USA}, -series = {PLDI '05} -} - -@inproceedings{cadar2006execsimbol, -author = {Cadar, Cristian and Ganesh, Vijay and Pawlowski, Peter M. and Dill, David L. and Engler, Dawson R.}, -title = {EXE: automatically generating inputs of death}, -year = {2006}, -isbn = {1595935185}, -publisher = {Association for Computing Machinery}, -address = {New York, NY, USA}, -url = {https://doi.org/10.1145/1180405.1180445}, -doi = {10.1145/1180405.1180445}, -abstract = {This paper presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be "anything." As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug.When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE's constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code).EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the udhcpd DHCP server, the pcre regular expression library, and three Linux file systems.}, -booktitle = {Proceedings of the 13th ACM Conference on Computer and Communications Security}, -pages = {322–335}, -numpages = {14}, -keywords = {test case generation, symbolic execution, dynamic analysis, constraint solving, bug finding, attack generation}, -location = {Alexandria, Virginia, USA}, -series = {CCS '06} -} - -%%%%%%%%%%%%%%%%%%%%%%%%% referencias dos trabalhos correlatos - -%%%% referencias fusebmc - -@InProceedings{fusebmc2022, -author="Alshmrany, Kaled M. -and Aldughaim, Mohannad -and Bhayat, Ahmed -and Cordeiro, Lucas C.", -editor="Johnsen, Einar Broch -and Wimmer, Manuel", -title="FuSeBMC v4: Smart Seed Generation for Hybrid Fuzzing", -booktitle="Fundamental Approaches to Software Engineering", -year="2022", -publisher="Springer International Publishing", -address="Cham", -pages="336--340", -abstract="FuSeBMC is a test generator for finding security vulnerabilities in C programs. In Test-Comp 2021, we described a previous version that incrementally injected labels to guide Bounded Model Checking (BMC) and Evolutionary Fuzzing engines to produce test cases for code coverage and bug finding. This paper introduces an improved version of FuSeBMC that utilizes both engines to produce smart seeds. First, the engines run with a short time limit on a lightly instrumented version of the program to produce the seeds. The BMC engine is particularly useful in producing seeds that can pass through complex mathematical guards. Then, FuSeBMC runs its engines with extended time limits using the smart seeds created in the previous round. FuSeBMC manages this process in two main ways. Firstly, it uses shared memory to record the labels covered by each test case. Secondly, it evaluates test cases, and those of high impact are turned into seeds for subsequent test fuzzing. In this year's competition, we participate in the Cover-Error, Cover-Branches, and Overall categories. The Test-Comp 2022 results show that we significantly increased our code coverage score from last year, outperforming all tools in all categories.", -isbn="978-3-030-99429-7" -} - -@InProceedings{beyertestcomp2022, -author="Beyer, Dirk", -editor="Johnsen, Einar Broch -and Wimmer, Manuel", -title="Advances in Automatic Software Testing: Test-Comp 2022", -booktitle="Fundamental Approaches to Software Engineering", -year="2022", -publisher="Springer International Publishing", -address="Cham", -pages="321--335", -abstract="Test-Comp 2022 is the 4th edition of the Competition on Software Testing. Research competitions are a means to provide annual comparative evaluations. Test-Comp focusses on fully automatic software test generators for C programs. The results of the competition shall be reproducible and provide an overview of the current state of the art in the area of automatic test-generation. The competition was based on 4 236 test-generation tasks for C programs. Each test-generation task consisted of a program and a test specification (error coverage, branch coverage). Test-Comp 2022 had 12 participating test generators from 5 countries.", -isbn="978-3-030-99429-7" -} - - -%%%$ referencias klee - -@article{cadar2021klee, - title={KLEE symbolic execution engine in 2019}, - author={Cadar, Cristian and Nowack, Martin}, - journal={International Journal on Software Tools for Technology Transfer}, - volume={23}, - number={6}, - pages={867-870}, - year={2021}, - month={December}, - doi={10.1007/s10009-020-00570-3}, - url={https://doi.org/10.1007/s10009-020-00570-3}, - publisher={Springer} -} - -@article{beyer2021first, - title={First international competition on software testing}, - author={Beyer, Dirk}, - journal={International Journal on Software Tools for Technology Transfer}, - volume={23}, - number={6}, - pages={833-846}, - year={2021}, - month={December}, - doi={10.1007/s10009-021-00613-3}, - url={https://doi.org/10.1007/s10009-021-00613-3}, - publisher={Springer} -} - -%%%% referencias esbmc - -@article{gadelha2021esbmc, - title={ESBMC 6.1: automated test case generation using bounded model checking}, - author={Gadelha, Mikhail R. and Menezes, Rafael S. and Cordeiro, Lucas C.}, - journal={International Journal on Software Tools for Technology Transfer}, - volume={23}, - number={6}, - pages={857-861}, - year={2021}, - month={December}, - doi={10.1007/s10009-020-00571-2}, - url={https://doi.org/10.1007/s10009-020-00571-2}, - publisher={Springer} -} - -@book{clangesbmc, -author = {Lopes, Bruno Cardoso and Auler, Rafael}, -title = {Getting Started with LLVM Core Libraries}, -year = {2014}, -isbn = {1782166920}, -publisher = {Packt Publishing}, -abstract = {Get to grips with LLVM essentials and use the core libraries to build advanced tools About This BookLearn how to configure, build, and use LLVM and Clang based toolsExplore the depths of the LLVM front-end, IR, code generator, and libraries, and learn how a modern compiler is implemented in a practical way.Customize your project to benefit from Just in Time compilation (JIT), static analysis and source-to-source transformations.Who This Book Is ForThis book is intended for enthusiasts, computer science students, and compiler engineers interested in learning about the LLVM framework. You need a background in C++ and, although not mandatory, should know at least some compiler theory. Whether you are a newcomer or a compiler expert, this book provides a practical introduction to LLVM and avoids complex scenarios. If you are interested enough and excited about this technology, then this book is definitely for you. In Detail LLVM is a bleeding edge compiler technology framework. Easily extendable and designed as a multitude of libraries, LLVM provides a smooth experience for compiler newcomers and reduces the steep learning curve often associated with compiler development.To start, this book will show you how to configure, build, and install LLVM libraries, tools, and external projects. Next, you will be introduced to LLVM design and how it works in practice throughout each LLVM compiler stage: frontend, IR, backend, the JIT engine, cross-compilation capabilities, and the plugin interface. With multiple hands-on examples and source code snippets, Getting Started with LLVM Core Libraries ensures a solid and smooth first step into the LLVM compiler development environment.} -} - -@InProceedings{boolectorpaper2009, -author="Brummayer, Robert -and Biere, Armin", -editor="Kowalewski, Stefan -and Philippou, Anna", -title="Boolector: An Efficient SMT Solver for Bit-Vectors and Arrays", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2009", -publisher="Springer Berlin Heidelberg", -address="Berlin, Heidelberg", -pages="174--177", -abstract="Satisfiability Modulo Theories (SMT) is the problem of deciding satisfiability of a logical formula, expressed in a combination of first-order theories. We present the architecture and selected features of Boolector, which is an efficient SMT solver for the quantifier-free theories of bit-vectors and arrays. It uses term rewriting, bit-blasting to handle bit-vectors, and lemmas on demand for arrays.", -isbn="978-3-642-00768-2" -} - -@InProceedings{z3esbmc2008, -author="de Moura, Leonardo -and Bj{\o}rner, Nikolaj", -editor="Ramakrishnan, C. R. -and Rehof, Jakob", -title="Z3: An Efficient SMT Solver", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2008", -publisher="Springer Berlin Heidelberg", -address="Berlin, Heidelberg", -pages="337--340", -abstract="Satisfiability Modulo Theories (SMT) problem is a decision problem for logical first order formulas with respect to combinations of background theories such as: arithmetic, bit-vectors, arrays, and uninterpreted functions. Z3 is a new and efficient SMT Solver freely available from Microsoft Research. It is used in various software verification and analysis applications.", -isbn="978-3-540-78800-3" -} - -@article{gotoesbmc2018, - author = {Baldoni, Roberto and Coppa, Emilio and D'Elia, Daniele Cono and Demetrescu, Camil and Finocchi, Irene}, - title = {A Survey of Symbolic Execution Techniques}, - journal = {ACM Computing Surveys}, - volume = {51}, - number = {3}, - articleno = {50}, - publisher = {ACM}, - address = {New York, NY, USA}, - year = {2018} -} - -@InProceedings{yicesesbmc2014, -author="Dutertre, Bruno", -editor="Biere, Armin -and Bloem, Roderick", -title="Yices 2.2", -booktitle="Computer Aided Verification", -year="2014", -publisher="Springer International Publishing", -address="Cham", -pages="737--744", -abstract="Yices is an SMT solver developed by SRI International. The first version of Yices was released in 2006 and has been continuously updated since then. In 2007, we started a complete re-implementation of the solver to improve performance and increase modularity and flexibility. We describe the latest release of Yices, namely, Yices 2.2. We present the tool's architecture and discuss the algorithms it implements, and we describe recent developments such as support for the SMT-LIB 2.0 notation and various performance improvements.", -isbn="978-3-319-08867-9" -} - -@InProceedings{beyertestcomp2023, -author="Beyer, Dirk", -editor="Lambers, Leen -and Uchitel, Sebasti{\'a}n", -title="Software Testing: 5th Comparative Evaluation: Test-Comp 2023", -booktitle="Fundamental Approaches to Software Engineering", -year="2023", -publisher="Springer Nature Switzerland", -address="Cham", -pages="309--323", -abstract="The 5th edition of the Competition on Software Testing (Test-Comp 2023) provides again an overview and comparative evaluation of automatic test-suite generators for C programs. The experiment was performed on a benchmark set of 4 106 test-generation tasks for C programs. Each test-generation task consisted of a program and a test specification (error coverage, branch coverage). There were 13 participating test-suite generators from 6 countries in Test-Comp 2023.", -isbn="978-3-031-30826-0" -} - -@InProceedings{beyersvcomp2013, -author="Beyer, Dirk", -editor="Piterman, Nir -and Smolka, Scott A.", -title="Second Competition on Software Verification", -booktitle="Tools and Algorithms for the Construction and Analysis of Systems", -year="2013", -publisher="Springer Berlin Heidelberg", -address="Berlin, Heidelberg", -pages="594--609", -abstract="This report describes the 2nd International Competition on Software Verification (SV-COMP 2013), which is the second edition of this thorough evaluation of fully automatic verifiers for software programs. The reported results represent the 2012 state-of-the-art in automatic software verification, in terms of effectiveness and efficiency, and as available and participated. The benchmark set of verification tasks consists of 2 315 programs, written in C, and exposing features of integers, heap-data structures, bit-vector operations, and concurrency; the properties include reachability and memory safety. The competition is again organized as a satellite event of TACAS.", -isbn="978-3-642-36742-7" -} - - - - - -%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% referencias metodo - -@InProceedings{lattner:2004, - author = {Chris Lattner and Vikram Adve}, - title = "{LLVM: A Compilation Framework for Lifelong Program Analysis \& Transformation}", - booktitle = "{Proceedings of the 2004 International Symposium on Code Generation and Optimization (CGO'04)}", - address = {Palo Alto, California}, - month = {Mar}, - year = {2004} - } - -@InProceedings{crabllvm2021, -author="Gurfinkel, Arie -and Navas, Jorge A.", -editor="Bloem, Roderick -and Dimitrova, Rayna -and Fan, Chuchu -and Sharygina, Natasha", -title="Abstract Interpretation of LLVM with a Region-Based Memory Model", -booktitle="Software Verification", -year="2022", -publisher="Springer International Publishing", -address="Cham", -pages="122--144", -abstract="Static analysis of low-level programs (C or LLVM) requires modeling memory. To strike a good balance between precision and performance, most static analyzers rely on the C memory model in which a pointer is a numerical offset within a memory object. Finite partitioning of the address space is a common abstraction. For instance, the allocation-site abstraction creates partitions by merging all objects created at the same allocation site. Recency abstraction refines the allocation-site abstraction by distinguishing the most recent allocated memory object from the previous ones. Unfortunately, these abstractions are not often precise enough to infer invariants that are expressed over the contents of dynamically allocated data-structures such as linked lists. In those cases, more expensive abstractions such as shapes that consider connectivity patterns between memory locations are often needed.", -isbn="978-3-030-95561-8" -} - - - -@misc{cwe2025, - author = {{MITRE}}, - title = {2025 CWE Top 25 Most Dangerous Software Weaknesses}, - howpublished = {\url{https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html}}, - year = {2025}, - note = {Accessed: 2026-07-02} -} - -@inproceedings{fioraldi2020aflpp, - author = {Fioraldi, Andrea and Maier, Dominik and Eißfeldt, Heiko and Heuse, Marc}, - title = {{AFL++}: Combining Incremental Steps of Fuzzing Research}, - booktitle = {Proceedings of the 14th USENIX Workshop on Offensive Technologies (WOOT 20)}, - year = {2020}, - publisher = {USENIX Association} -} - -@inproceedings{chalupa2021symbiotic, - author = {Chalupa, Marek and Vitovská, Martina and Jašek, Tomáš and Šimáček, Michal and Strejček, Jan}, - title = {Symbiotic 8: Parallel and Targeted Test Generation}, - booktitle = {Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE '21)}, - year = {2021}, - publisher = {ACM}, - doi = {10.1145/3468264.3473125} -} - -@misc{openssf2024, - author = {{Open Source Security Foundation}}, - title = {OpenSSF Best Practices Badge Program}, - howpublished = {\url{https://www.bestpractices.dev/}}, - year = {2024}, - note = {Accessed: 2026-07-02} -} - -@techreport{nsa2017juliet, - author = {{National Security Agency}}, - title = {Juliet Test Suite v1.3 for C/C++}, - institution = {NSA Center for Assured Software}, - year = {2017}, - url = {https://samate.nist.gov/SARD/test-suites/112} -} \ No newline at end of file diff --git a/docs/paper-sbseg-2026/sbseg-article/sbc-template.sty b/docs/paper-sbseg-2026/sbseg-article/sbc-template.sty deleted file mode 100644 index 6d6890a37..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/sbc-template.sty +++ /dev/null @@ -1,200 +0,0 @@ -% LaTeX definitions for SBC 2001 style -% -% Created by Jomi Hubner & Rafael Bordini, june 2001 -% updated march 2005 -% updated december 2017 - -\NeedsTeXFormat{LaTeX2e} -\ProvidesPackage{sbc-template}[2001/06/09] - -% margem sup 3.5 cm: h� 1,5 cm para header, + 2 cm para top -% margem inf 2.5 cm: h� 1,5 cm para foot, + 1 cm para bottom -% margem esq/dir 3 cm -\RequirePackage[a4paper,top=3.5cm,left=3cm,right=3cm,bottom=2.5cm]{geometry} - -\parindent 1.27cm -\parskip 6pt - -\flushbottom - -% captions -%updated 2017. Change deprecated caption2 to caption package -\RequirePackage[bf,sf,footnotesize,indent]{caption} -\setlength{\captionmargin}{0.8cm} -\renewcommand{\captionfont}{\sffamily\footnotesize\bfseries} -%\renewcommand{\captionlabeldelim}{.} -\captionsetup{labelsep=period} - -% font -\RequirePackage{times} - -\renewcommand{\normalsize}{\@setfontsize\normalsize\@xiipt\@xivpt} -\newcommand{\XIIIPT}{\@setfontsize\xiiipt{13}{17}} -\newcommand{\XVIPT}{\@setfontsize\xvipt{16}{20}} - -% new commands -\newcounter{instn} -\setcounter{instn}{1} -\newcommand{\instnum}{\arabic{instn}} -\newcommand{\inst}[1]{\ensuremath{^{#1}}} -\newcommand{\nextinstitute}{\\\mbox{}\\[-6pt] \addtocounter{instn}{1}\inst{\instnum}} -\newcommand{\email}[1]{\\\mbox{}\\[-6pt]\footnotesize\texttt{#1}} -\renewcommand{\and}{, } - -% to avoid [...] in the bibliography -% \item[] instead of \item[\@biblabel{#1}\hfill] -\def\@lbibitem[#1]#2{\item[]\if@filesw - {\let\protect\noexpand - \immediate - \write\@auxout{\string\bibcite{#2}{#1}}}\fi\ignorespaces} -\renewenvironment{thebibliography}[1] - {\section*{\refname - \@mkboth{\MakeUppercase\refname}{\MakeUppercase\refname}}% - \list{\@biblabel{\@arabic\c@enumiv}}% - {\settowidth\labelwidth{\@biblabel{#1}}% - \leftmargin\labelwidth - \advance\leftmargin\labelsep - %% changed! - \itemindent -\leftmargin - \itemsep 6pt - %%%%%%%%%%% - \@openbib@code - \usecounter{enumiv}% - \let\p@enumiv\@empty - \renewcommand\theenumiv{\@arabic\c@enumiv}}% - \sloppy - \clubpenalty4000 - \@clubpenalty \clubpenalty - \widowpenalty4000% - \sfcode`\.\@m} - {\def\@noitemerr - {\@latex@warning{Empty `thebibliography' environment}}% - \endlist} - - -% itens -\setlength\leftmargini {1.27cm} -\setlength\leftmargin {\leftmargini} -\setlength\leftmarginii {\leftmargini} -\setlength\leftmarginiii {\leftmargini} -\setlength\leftmarginiv {\leftmargini} -\setlength \labelsep {.5em} -\setlength \labelwidth {\leftmargini} -\addtolength\labelwidth {-\labelsep} -\def\@listI{\leftmargin\leftmargini - \parsep 0\p@ \@plus1\p@ \@minus\p@ - \topsep 0\p@ \@plus2\p@ \@minus4\p@ - \itemsep0\p@} -\let\@listi\@listI -\@listi -\def\@listii {\leftmargin\leftmarginii - \labelwidth\leftmarginii - \advance\labelwidth-\labelsep - \topsep 0\p@ \@plus2\p@ \@minus\p@} -\def\@listiii{\leftmargin\leftmarginiii - \labelwidth\leftmarginiii - \advance\labelwidth-\labelsep - \topsep 0\p@ \@plus\p@\@minus\p@ - \parsep \z@ - \partopsep \p@ \@plus\z@ \@minus\p@} - - -% sections -\renewcommand\section{\@startsection{section}{1}{\z@}% - {-6\p@ \@plus -4\p@ \@minus -4\p@}% - {0\p@ \@plus 4\p@ \@minus 4\p@}% - {\normalfont\XIIIPT\bfseries\boldmath - \rightskip=\z@ \@plus 8em\pretolerance=10000 }} - -\renewcommand\subsection{\@startsection{subsection}{2}{\z@}% - {-6\p@ \@plus -4\p@ \@minus -4\p@}% - {0\p@ \@plus 4\p@ \@minus 4\p@}% - {\normalfont\normalsize\bfseries\boldmath - \rightskip=\z@ \@plus 8em\pretolerance=10000 }} - -%\renewcommand{\thesection}{\arabic{section}.} -%\renewcommand{\thesubsection}{\thesection\arabic{subsection}.} -%\renewcommand{\thesubsubsection}{\thesubsection\arabic{subsubsection}.} - -\RequirePackage{titlesec} -\titlelabel{\thetitle.\hspace{1ex}} - -% first page - -\pagestyle{empty} - -\newcommand{\authortag}[1]{$^{#1}$} - -\def\address#1{\gdef\@address{#1}} - -\def\@maketitle{\newpage - %\null % isso dava um espaco extra antes do title - \begin{center} - %\vglue -6pt -% \vspace*{12pt} -\vspace*{-.7cm} - {\XVIPT\bf\@title\par} - \vglue 6pt plus 3pt minus 3pt - {\normalsize - \textbf{\begin{tabular}[t]{c}\@author\end{tabular}}\par} - \vglue 6pt plus 3pt minus 3pt - {\normalsize - \begin{tabular}[t]{c}\inst{\instnum}\@address\end{tabular}\par} - \vglue 6pt plus 3pt minus 3pt - \end{center}\par -} -\let\maketitleOLD\maketitle -\renewcommand{\maketitle}{\maketitleOLD\thispagestyle{empty}} - -\renewenvironment{abstract}{% - \list{}{\advance\topsep by6pt\relax%\small - \leftmargin=0.8cm - \labelwidth=\z@ - \listparindent=\z@ - \itemindent\listparindent - \rightmargin\leftmargin}\item[\hskip\labelsep - \bfseries\itshape Abstract.]\itshape}% - {\endlist} - -\newenvironment{resumo}{% - \list{}{\advance\topsep by6pt\relax%\small - \leftmargin=0.8cm - \labelwidth=\z@ - \listparindent=\z@ - \itemindent\listparindent - \rightmargin\leftmargin}\item[\hskip\labelsep - \bfseries\itshape Resumo.]\itshape}% - {\endlist} - -%Updated 2017. If hyperref is used, do not change references styles -\RequirePackage{etoolbox}% -\AtEndPreamble{\@ifpackageloaded{hyperref} - {% - \makeatletter - \def\@lbibitem[#1]#2{% - \@skiphyperreftrue - \H@item[% - \ifx\Hy@raisedlink\@empty - \hyper@anchorstart{cite.#2\@extra@b@citeb}% - \hyper@anchorend - \else - \Hy@raisedlink{% - \hyper@anchorstart{cite.#2\@extra@b@citeb}\hyper@anchorend - }% - \fi - \hfill - ]% - \@skiphyperreffalse - \if@filesw - \begingroup - \let\protect\noexpand - \immediate\write\@auxout{% - \string\bibcite{#2}{#1}% - }% - \endgroup% - \fi% - \ignorespaces% - }% - \makeatother% - }% -}% \ No newline at end of file diff --git a/docs/paper-sbseg-2026/sbseg-article/sbc.bst b/docs/paper-sbseg-2026/sbseg-article/sbc.bst deleted file mode 100644 index 8d5db03bf..000000000 --- a/docs/paper-sbseg-2026/sbseg-article/sbc.bst +++ /dev/null @@ -1,1103 +0,0 @@ -%% copy of "apalike" for SBC (no comma before year in citation label) - -% BibTeX `apalike' bibliography style (24-Jan-88 version) -% Adapted from the `alpha' style, version 0.99a; for BibTeX version 0.99a. -% Copyright (C) 1988, all rights reserved. -% Copying of this file is allowed, provided that if you make any changes at all -% you name it something other than `apalike.bst'. -% This restriction helps ensure that all copies are identical. -% Differences between this style and `alpha' are generally heralded by a `%'. -% The file btxbst.doc has the documentation for alpha.bst. -% -% This style should be used with the `apalike' LaTeX style (apalike.sty). -% \cite's come out like "(Jones, 1986)" in the text but there are no labels -% in the bibliography, and something like "(1986)" comes out immediately -% after the author. Author (and editor) names appear as last name, comma, -% initials. A `year' field is required for every entry, and so is either -% an author (or in some cases, an editor) field or a key field. -% -% Editorial note: -% Many journals require a style like `apalike', but I strongly, strongly, -% strongly recommend that you not use it if you have a choice---use something -% like `plain' instead. Mary-Claire van Leunen (A Handbook for Scholars, -% Knopf, 1979) argues convincingly that a style like `plain' encourages better -% writing than one like `apalike'. Furthermore the strongest arguments for -% using an author-date style like `apalike'---that it's "the most practical" -% (The Chicago Manual of Style, University of Chicago Press, thirteenth -% edition, 1982, pages 400--401)---fall flat on their face with the new -% computer-typesetting technology. For instance page 401 anachronistically -% states "The chief disadvantage of [a style like `plain'] is that additions -% or deletions cannot be made after the manuscript is typed without changing -% numbers in both text references and list." LaTeX sidesteps the disadvantage. -% -% History: -% 15-sep-86 (SK,OP) Original version, by Susan King and Oren Patashnik. -% 10-nov-86 (OP) Truncated the sort.key$ string to the correct length -% in bib.sort.order to eliminate error message. -% 24-jan-88 (OP) Updated for BibTeX version 0.99a, from alpha.bst 0.99a; -% apalike now sorts by author, then year, then title; -% THIS `apalike' VERSION DOES NOT WORK WITH BIBTEX 0.98i. - -ENTRY - { address - author - booktitle - chapter - edition - editor - howpublished - institution - journal - key -% month not used in apalike - note - number - organization - pages - publisher - school - series - title - type - volume - year - } - {} - { label extra.label sort.label } - -INTEGERS { output.state before.all mid.sentence after.sentence after.block } - -FUNCTION {init.state.consts} -{ #0 'before.all := - #1 'mid.sentence := - #2 'after.sentence := - #3 'after.block := -} - -STRINGS { s t } - -FUNCTION {output.nonnull} -{ 's := - output.state mid.sentence = - { ", " * write$ } - { output.state after.block = - { add.period$ write$ - newline$ - "\newblock " write$ - } - { output.state before.all = - 'write$ - { add.period$ " " * write$ } - if$ - } - if$ - mid.sentence 'output.state := - } - if$ - s -} - -FUNCTION {output} -{ duplicate$ empty$ - 'pop$ - 'output.nonnull - if$ -} - -FUNCTION {output.check} -{ 't := - duplicate$ empty$ - { pop$ "empty " t * " in " * cite$ * warning$ } - 'output.nonnull - if$ -} - -% apalike needs this function because -% the year has special punctuation; -% apalike ignores the month -FUNCTION {output.year.check} -{ year empty$ - { "empty year in " cite$ * warning$ } - { write$ - " (" year * extra.label * ")" * - mid.sentence 'output.state := - } - if$ -} - -FUNCTION {output.bibitem} -{ newline$ - "\bibitem[" write$ - label write$ - "]{" write$ - cite$ write$ - "}" write$ - newline$ - "" - before.all 'output.state := -} - -FUNCTION {fin.entry} -{ add.period$ - write$ - newline$ -} - -FUNCTION {new.block} -{ output.state before.all = - 'skip$ - { after.block 'output.state := } - if$ -} - -FUNCTION {new.sentence} -{ output.state after.block = - 'skip$ - { output.state before.all = - 'skip$ - { after.sentence 'output.state := } - if$ - } - if$ -} - -FUNCTION {not} -{ { #0 } - { #1 } - if$ -} - -FUNCTION {and} -{ 'skip$ - { pop$ #0 } - if$ -} - -FUNCTION {or} -{ { pop$ #1 } - 'skip$ - if$ -} - -FUNCTION {new.block.checkb} -{ empty$ - swap$ empty$ - and - 'skip$ - 'new.block - if$ -} - -FUNCTION {field.or.null} -{ duplicate$ empty$ - { pop$ "" } - 'skip$ - if$ -} - -FUNCTION {emphasize} -{ duplicate$ empty$ - { pop$ "" } - { "{\em " swap$ * "}" * } - if$ -} - -INTEGERS { nameptr namesleft numnames } - -FUNCTION {format.names} -{ 's := - #1 'nameptr := - s num.names$ 'numnames := - numnames 'namesleft := - { namesleft #0 > } - { s nameptr "{vv~}{ll}{, jj}{, f.}" format.name$ 't := % last name first - nameptr #1 > - { namesleft #1 > - { ", " * t * } - { numnames #2 > - { "," * } - 'skip$ - if$ - t "others" = - { " et~al." * } - { " and " * t * } - if$ - } - if$ - } - 't - if$ - nameptr #1 + 'nameptr := - namesleft #1 - 'namesleft := - } - while$ -} - -FUNCTION {format.authors} -{ author empty$ - { "" } - { author format.names } - if$ -} - -FUNCTION {format.key} % this function is just for apalike -{ empty$ - { key field.or.null } - { "" } - if$ -} - -FUNCTION {format.editors} -{ editor empty$ - { "" } - { editor format.names - editor num.names$ #1 > - { ", editors" * } - { ", editor" * } - if$ - } - if$ -} - -FUNCTION {format.title} -{ title empty$ - { "" } - { title "t" change.case$ } - if$ -} - -FUNCTION {n.dashify} -{ 't := - "" - { t empty$ not } - { t #1 #1 substring$ "-" = - { t #1 #2 substring$ "--" = not - { "--" * - t #2 global.max$ substring$ 't := - } - { { t #1 #1 substring$ "-" = } - { "-" * - t #2 global.max$ substring$ 't := - } - while$ - } - if$ - } - { t #1 #1 substring$ * - t #2 global.max$ substring$ 't := - } - if$ - } - while$ -} - -FUNCTION {format.btitle} -{ title emphasize -} - -FUNCTION {tie.or.space.connect} -{ duplicate$ text.length$ #3 < - { "~" } - { " " } - if$ - swap$ * * -} - -FUNCTION {either.or.check} -{ empty$ - 'pop$ - { "can't use both " swap$ * " fields in " * cite$ * warning$ } - if$ -} - -FUNCTION {format.bvolume} -{ volume empty$ - { "" } - { "volume" volume tie.or.space.connect - series empty$ - 'skip$ - { " of " * series emphasize * } - if$ - "volume and number" number either.or.check - } - if$ -} - -FUNCTION {format.number.series} -{ volume empty$ - { number empty$ - { series field.or.null } - { output.state mid.sentence = - { "number" } - { "Number" } - if$ - number tie.or.space.connect - series empty$ - { "there's a number but no series in " cite$ * warning$ } - { " in " * series * } - if$ - } - if$ - } - { "" } - if$ -} - -FUNCTION {format.edition} -{ edition empty$ - { "" } - { output.state mid.sentence = - { edition "l" change.case$ " edition" * } - { edition "t" change.case$ " edition" * } - if$ - } - if$ -} - -INTEGERS { multiresult } - -FUNCTION {multi.page.check} -{ 't := - #0 'multiresult := - { multiresult not - t empty$ not - and - } - { t #1 #1 substring$ - duplicate$ "-" = - swap$ duplicate$ "," = - swap$ "+" = - or or - { #1 'multiresult := } - { t #2 global.max$ substring$ 't := } - if$ - } - while$ - multiresult -} - -FUNCTION {format.pages} -{ pages empty$ - { "" } - { pages multi.page.check - { "pages" pages n.dashify tie.or.space.connect } - { "page" pages tie.or.space.connect } - if$ - } - if$ -} - -FUNCTION {format.vol.num.pages} -{ volume field.or.null - number empty$ - 'skip$ - { "(" number * ")" * * - volume empty$ - { "there's a number but no volume in " cite$ * warning$ } - 'skip$ - if$ - } - if$ - pages empty$ - 'skip$ - { duplicate$ empty$ - { pop$ format.pages } - { ":" * pages n.dashify * } - if$ - } - if$ -} - -FUNCTION {format.chapter.pages} -{ chapter empty$ - 'format.pages - { type empty$ - { "chapter" } - { type "l" change.case$ } - if$ - chapter tie.or.space.connect - pages empty$ - 'skip$ - { ", " * format.pages * } - if$ - } - if$ -} - -FUNCTION {format.in.ed.booktitle} -{ booktitle empty$ - { "" } - { editor empty$ - { "In " booktitle emphasize * } - { "In " format.editors * ", " * booktitle emphasize * } - if$ - } - if$ -} - -FUNCTION {format.thesis.type} -{ type empty$ - 'skip$ - { pop$ - type "t" change.case$ - } - if$ -} - -FUNCTION {format.tr.number} -{ type empty$ - { "Technical Report" } - 'type - if$ - number empty$ - { "t" change.case$ } - { number tie.or.space.connect } - if$ -} - -FUNCTION {format.article.crossref} -{ "In" % this is for apalike - " \cite{" * crossref * "}" * -} - -FUNCTION {format.book.crossref} -{ volume empty$ - { "empty volume in " cite$ * "'s crossref of " * crossref * warning$ - "In " - } - { "Volume" volume tie.or.space.connect - " of " * - } - if$ - "\cite{" * crossref * "}" * % this is for apalike -} - -FUNCTION {format.incoll.inproc.crossref} -{ "In" % this is for apalike - " \cite{" * crossref * "}" * -} - -FUNCTION {article} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - crossref missing$ - { journal emphasize "journal" output.check - format.vol.num.pages output - } - { format.article.crossref output.nonnull - format.pages output - } - if$ - new.block - note output - fin.entry -} - -FUNCTION {book} -{ output.bibitem - author empty$ - { format.editors "author and editor" output.check - editor format.key output - } - { format.authors output.nonnull - crossref missing$ - { "author and editor" editor either.or.check } - 'skip$ - if$ - } - if$ - output.year.check % special for apalike - new.block - format.btitle "title" output.check - crossref missing$ - { format.bvolume output - new.block - format.number.series output - new.sentence - publisher "publisher" output.check - address output - } - { new.block - format.book.crossref output.nonnull - } - if$ - format.edition output - new.block - note output - fin.entry -} - -FUNCTION {booklet} -{ output.bibitem - format.authors output - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - howpublished output - address output - new.block - note output - fin.entry -} - -FUNCTION {inbook} -{ output.bibitem - author empty$ - { format.editors "author and editor" output.check - editor format.key output - } - { format.authors output.nonnull - crossref missing$ - { "author and editor" editor either.or.check } - 'skip$ - if$ - } - if$ - output.year.check % special for apalike - new.block - format.btitle "title" output.check - crossref missing$ - { format.bvolume output - format.chapter.pages "chapter and pages" output.check - new.block - format.number.series output - new.sentence - publisher "publisher" output.check - address output - } - { format.chapter.pages "chapter and pages" output.check - new.block - format.book.crossref output.nonnull - } - if$ - format.edition output - new.block - note output - fin.entry -} - -FUNCTION {incollection} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - crossref missing$ - { format.in.ed.booktitle "booktitle" output.check - format.bvolume output - format.number.series output - format.chapter.pages output - new.sentence - publisher "publisher" output.check - address output - format.edition output - } - { format.incoll.inproc.crossref output.nonnull - format.chapter.pages output - } - if$ - new.block - note output - fin.entry -} - -FUNCTION {inproceedings} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - crossref missing$ - { format.in.ed.booktitle "booktitle" output.check - format.bvolume output - format.number.series output - format.pages output - address output % for apalike - new.sentence % there's no year - organization output % here so things - publisher output % are simpler - } - { format.incoll.inproc.crossref output.nonnull - format.pages output - } - if$ - new.block - note output - fin.entry -} - -FUNCTION {conference} { inproceedings } - -FUNCTION {manual} -{ output.bibitem - format.authors output - author format.key output % special for - output.year.check % apalike - new.block - format.btitle "title" output.check - organization address new.block.checkb - organization output - address output - format.edition output - new.block - note output - fin.entry -} - -FUNCTION {mastersthesis} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - "Master's thesis" format.thesis.type output.nonnull - school "school" output.check - address output - new.block - note output - fin.entry -} - -FUNCTION {misc} -{ output.bibitem - format.authors output - author format.key output % special for - output.year.check % apalike - new.block - format.title output - new.block - howpublished output - new.block - note output - fin.entry -} - -FUNCTION {phdthesis} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.btitle "title" output.check - new.block - "PhD thesis" format.thesis.type output.nonnull - school "school" output.check - address output - new.block - note output - fin.entry -} - -FUNCTION {proceedings} -{ output.bibitem - format.editors output - editor format.key output % special for - output.year.check % apalike - new.block - format.btitle "title" output.check - format.bvolume output - format.number.series output - address output % for apalike - new.sentence % we always output - organization output % a nonempty organization - publisher output % here - new.block - note output - fin.entry -} - -FUNCTION {techreport} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - format.tr.number output.nonnull - institution "institution" output.check - address output - new.block - note output - fin.entry -} - -FUNCTION {unpublished} -{ output.bibitem - format.authors "author" output.check - author format.key output % special for - output.year.check % apalike - new.block - format.title "title" output.check - new.block - note "note" output.check - fin.entry -} - -FUNCTION {default.type} { misc } - -MACRO {jan} {"January"} - -MACRO {feb} {"February"} - -MACRO {mar} {"March"} - -MACRO {apr} {"April"} - -MACRO {may} {"May"} - -MACRO {jun} {"June"} - -MACRO {jul} {"July"} - -MACRO {aug} {"August"} - -MACRO {sep} {"September"} - -MACRO {oct} {"October"} - -MACRO {nov} {"November"} - -MACRO {dec} {"December"} - -MACRO {acmcs} {"ACM Computing Surveys"} - -MACRO {acta} {"Acta Informatica"} - -MACRO {cacm} {"Communications of the ACM"} - -MACRO {ibmjrd} {"IBM Journal of Research and Development"} - -MACRO {ibmsj} {"IBM Systems Journal"} - -MACRO {ieeese} {"IEEE Transactions on Software Engineering"} - -MACRO {ieeetc} {"IEEE Transactions on Computers"} - -MACRO {ieeetcad} - {"IEEE Transactions on Computer-Aided Design of Integrated Circuits"} - -MACRO {ipl} {"Information Processing Letters"} - -MACRO {jacm} {"Journal of the ACM"} - -MACRO {jcss} {"Journal of Computer and System Sciences"} - -MACRO {scp} {"Science of Computer Programming"} - -MACRO {sicomp} {"SIAM Journal on Computing"} - -MACRO {tocs} {"ACM Transactions on Computer Systems"} - -MACRO {tods} {"ACM Transactions on Database Systems"} - -MACRO {tog} {"ACM Transactions on Graphics"} - -MACRO {toms} {"ACM Transactions on Mathematical Software"} - -MACRO {toois} {"ACM Transactions on Office Information Systems"} - -MACRO {toplas} {"ACM Transactions on Programming Languages and Systems"} - -MACRO {tcs} {"Theoretical Computer Science"} - -READ - -FUNCTION {sortify} -{ purify$ - "l" change.case$ -} - -INTEGERS { len } - -FUNCTION {chop.word} -{ 's := - 'len := - s #1 len substring$ = - { s len #1 + global.max$ substring$ } - 's - if$ -} - -% There are three apalike cases: one person (Jones), -% two (Jones and de~Bruijn), and more (Jones et~al.). -% This function is much like format.crossref.editors. -% -FUNCTION {format.lab.names} -{ 's := - s #1 "{vv~}{ll}" format.name$ - s num.names$ duplicate$ - #2 > - { pop$ " et~al." * } - { #2 < - 'skip$ - { s #2 "{ff }{vv }{ll}{ jj}" format.name$ "others" = - { " et~al." * } - { " and " * s #2 "{vv~}{ll}" format.name$ * } - if$ - } - if$ - } - if$ -} - -FUNCTION {author.key.label} -{ author empty$ - { key empty$ - { cite$ #1 #3 substring$ } - 'key % apalike uses the whole key - if$ - } - { author format.lab.names } - if$ -} - -FUNCTION {author.editor.key.label} -{ author empty$ - { editor empty$ - { key empty$ - { cite$ #1 #3 substring$ } - 'key % apalike uses the whole key - if$ - } - { editor format.lab.names } - if$ - } - { author format.lab.names } - if$ -} - -FUNCTION {editor.key.label} -{ editor empty$ - { key empty$ - { cite$ #1 #3 substring$ } - 'key % apalike uses the whole key, no organization - if$ - } - { editor format.lab.names } - if$ -} - -FUNCTION {calc.label} -{ type$ "book" = - type$ "inbook" = - or - 'author.editor.key.label - { type$ "proceedings" = - 'editor.key.label % apalike ignores organization - 'author.key.label % for labeling and sorting - if$ - } - if$ - " " % these three lines are - * % for apalike, which - year field.or.null purify$ #-1 #4 substring$ % uses all four digits - * - 'label := -} - -FUNCTION {sort.format.names} -{ 's := - #1 'nameptr := - "" - s num.names$ 'numnames := - numnames 'namesleft := - { namesleft #0 > } - { nameptr #1 > - { " " * } - 'skip$ - if$ % apalike uses initials - s nameptr "{vv{ } }{ll{ }}{ f{ }}{ jj{ }}" format.name$ 't := % <= here - nameptr numnames = t "others" = and - { "et al" * } - { t sortify * } - if$ - nameptr #1 + 'nameptr := - namesleft #1 - 'namesleft := - } - while$ -} - -FUNCTION {sort.format.title} -{ 't := - "A " #2 - "An " #3 - "The " #4 t chop.word - chop.word - chop.word - sortify - #1 global.max$ substring$ -} - -FUNCTION {author.sort} -{ author empty$ - { key empty$ - { "to sort, need author or key in " cite$ * warning$ - "" - } - { key sortify } - if$ - } - { author sort.format.names } - if$ -} - -FUNCTION {author.editor.sort} -{ author empty$ - { editor empty$ - { key empty$ - { "to sort, need author, editor, or key in " cite$ * warning$ - "" - } - { key sortify } - if$ - } - { editor sort.format.names } - if$ - } - { author sort.format.names } - if$ -} - -FUNCTION {editor.sort} -{ editor empty$ - { key empty$ - { "to sort, need editor or key in " cite$ * warning$ - "" - } - { key sortify } - if$ - } - { editor sort.format.names } - if$ -} - -% apalike uses two sorting passes; the first one sets the -% labels so that the `a's, `b's, etc. can be computed; -% the second pass puts the references in "correct" order. -% The presort function is for the first pass. It computes -% label, sort.label, and title, and then concatenates. -FUNCTION {presort} -{ calc.label - label sortify - " " - * - type$ "book" = - type$ "inbook" = - or - 'author.editor.sort - { type$ "proceedings" = - 'editor.sort - 'author.sort - if$ - } - if$ - #1 entry.max$ substring$ % for - 'sort.label := % apalike - sort.label % style - * - " " - * - title field.or.null - sort.format.title - * - #1 entry.max$ substring$ - 'sort.key$ := -} - -ITERATE {presort} - -SORT % by label, sort.label, title---for final label calculation - -STRINGS { last.label next.extra } % apalike labels are only for the text; - -INTEGERS { last.extra.num } % there are none in the bibliography - -FUNCTION {initialize.extra.label.stuff} % and hence there is no `longest.label' -{ #0 int.to.chr$ 'last.label := - "" 'next.extra := - #0 'last.extra.num := -} - -FUNCTION {forward.pass} -{ last.label label = - { last.extra.num #1 + 'last.extra.num := - last.extra.num int.to.chr$ 'extra.label := - } - { "a" chr.to.int$ 'last.extra.num := - "" 'extra.label := - label 'last.label := - } - if$ -} - -FUNCTION {reverse.pass} -{ next.extra "b" = - { "a" 'extra.label := } - 'skip$ - if$ - label extra.label * 'label := - extra.label 'next.extra := -} - -EXECUTE {initialize.extra.label.stuff} - -ITERATE {forward.pass} - -REVERSE {reverse.pass} - -% Now that the label is right we sort for real, -% on sort.label then year then title. This is -% for the second sorting pass. -FUNCTION {bib.sort.order} -{ sort.label - " " - * - year field.or.null sortify - * - " " - * - title field.or.null - sort.format.title - * - #1 entry.max$ substring$ - 'sort.key$ := -} - -ITERATE {bib.sort.order} - -SORT % by sort.label, year, title---giving final bibliography order - -FUNCTION {begin.bib} -{ preamble$ empty$ % no \etalchar in apalike - 'skip$ - { preamble$ write$ newline$ } - if$ - "\begin{thebibliography}{}" write$ newline$ % no labels in apalike -} - -EXECUTE {begin.bib} - -EXECUTE {init.state.consts} - -ITERATE {call.type$} - -FUNCTION {end.bib} -{ newline$ - "\end{thebibliography}" write$ newline$ -} - -EXECUTE {end.bib} diff --git a/docs/paper-sbseg-2026/sections/01-introducao.md b/docs/paper-sbseg-2026/sections/01-introducao.md deleted file mode 100644 index cdb301616..000000000 --- a/docs/paper-sbseg-2026/sections/01-introducao.md +++ /dev/null @@ -1,41 +0,0 @@ -# 1. Introducao e Motivacao - -**Estado:** Rascunho nao iniciado. -**Fontes:** docs/pre-projeto, dados de CVEs/CWEs (usuario deve buscar estatisticas atualizadas). -**Figuras:** Nenhuma nesta secao. - ---- - -## 1.1 O problema de memory safety em C/C++ - -[PARAGRAFO A REDIGIR] -- Abrir com estatisticas de vulnerabilidades de memoria (CWEs 119, 416, 415, 401, 787) -- Citar que memory-safety bugs continuam entre as principais causas de CVEs exploraveis -- Contextualizar: sistemas embarcados, infraestrutura critica, consequencias de falhas - -## 1.2 Verificacao hibrida como abordagem promissora - -[PARAGRAFO A REDIGIR] -- Breve explicacao da combinacao analise estatica + dinamica (fuzzing + execucao simbolica) -- Citar trabalhos de ponta: FuSeBMC (smart seeds), Symbiotic (slicing + KLEE) -- Destacar que ferramentas de competicao (SV-COMP, TestComp) impulsionam o estado da arte - -## 1.3 Posicionamento do Map2Check - -[PARAGRAFO A REDIGIR] -- Map2Check como verificador hibrido consolidado para programas C -- Mencao as publicacoes anteriores (TACAS 2016, 2018, 2020) -- O problema: estagnacao desde 2019 (LLVM 6.0, Ubuntu 16.04, ultimo release nov/2019) - -## 1.4 Contribuicoes desta versao (2026) - -[PARAGRAFO A REDIGIR] -- Lista numerada de contribuicoes: - 1. Migracao completa da stack: LLVM 6 -> 16, New Pass Manager, C++17 - 2. Infraestrutura de engenharia: CI/CD, Docker, sanitizers, static analysis - 3. Validacao em benchmarks reais: TestComp 2026 (Heap, 594 tasks, score 57) - 4. Fortalecimento do posicionamento em ciberseguranca (mapeamento CWE) - ---- - -*Nota: Aguardando redacao na Sprint 1.* diff --git a/docs/paper-sbseg-2026/sections/02-historia.md b/docs/paper-sbseg-2026/sections/02-historia.md deleted file mode 100644 index 59da7ff7b..000000000 --- a/docs/paper-sbseg-2026/sections/02-historia.md +++ /dev/null @@ -1,29 +0,0 @@ -# 2. Historia e Evolucao - -**Estado:** Rascunho nao iniciado. -**Fontes:** CHANGELOG.md, docs/migration/. -**Figuras:** Figura 1 (timeline). - ---- - -## 2.1 Linha do tempo (2016->2026) - -[PARAGRAFO A REDIGIR] -- 2016 (TACAS): "Hunting Memory Bugs" — abordagem BMC com CBMC -- 2018 (TACAS): Migracao para LLVM + KLEE — execucao simbolica como motor principal -- 2020 (TACAS): Abordagem hibrida — fuzzing (LibFuzzer) + execucao simbolica (KLEE) + invariantes indutivos (Crab-LLVM) -- 2019-2025: Estagnacao — ultimo release, LLVM 6.0 obsoleto, dependencias deprecadas -- 2026: Renascimento — modernizacao sistematica da stack completa -- Figura 1: Timeline visual da evolucao - -## 2.2 O que motivou o renascimento - -[PARAGRAFO A REDIGIR] -- Obsolescencia tecnica: LLVM 6.0 EOL, Ubuntu 16.04 EOL, KLEE 2.0 sem suporte -- Impossibilidade de competir em SV-COMP/TestComp com stack legada -- Necessidade de sustentabilidade de engenharia (CI/CD, reproducibilidade, qualidade de artefato) -- Alinhamento com ciberseguranca: CWEs como linguagem comum entre verificacao formal e industria de seguranca - ---- - -*Nota: Aguardando redacao na Sprint 1. BACKLOG: referencias BibTeX das publicacoes TACAS.* diff --git a/docs/paper-sbseg-2026/sections/03-arquitetura.md b/docs/paper-sbseg-2026/sections/03-arquitetura.md deleted file mode 100644 index d2cbef090..000000000 --- a/docs/paper-sbseg-2026/sections/03-arquitetura.md +++ /dev/null @@ -1,47 +0,0 @@ -# 3. Arquitetura e Funcionalidades - -**Estado:** Rascunho nao iniciado. -**Fontes:** docs/migration/1.3-passes-new-pm.md, docs/migration/1.4-frontend-cpp17.md, .github/workflows/. -**Figuras:** Figura 2 (pipeline), Figura 3 (passes), Figura 5 (CI/CD). - ---- - -## 3.1 Pipeline de verificacao (visao geral) - -[PARAGRAFO A REDIGIR] -- Fluxo completo: Codigo C -> clang-16 -> LLVM IR -> opt (passes) -> llvm-link -> runtime -> KLEE / LibFuzzer -> Veredito + Witness -- Figura 2: Diagrama do pipeline - -## 3.2 Passes de instrumentacao (New Pass Manager) - -[PARAGRAFO A REDIGIR] -- Descricao dos 9 passes migrados: - - AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary - - NonDetPass, TrackBasicBlockPass - - OverflowPass, GenerateAutomataTruePass, MemoryTrackPass -- Figura 3: Diagrama dos passes -- Destacar: isRequired() como fix critico - -## 3.3 Motores de analise - -[PARAGRAFO A REDIGIR] -- KLEE 3.1 (LLVM 16): execucao simbolica -- LibFuzzer (LLVM 16): fuzzing guiado por cobertura -- Iterative deepening: combinacao dos dois motores - -## 3.4 Modernizacao de engenharia (pilar de sustentabilidade) - -[PARAGRAFO A REDIGIR] -- LLVM 16 + New Pass Manager -- C++17 (std::filesystem, structured bindings) -- CI/CD (GitHub Actions) -- Docker (Dockerfile.dev, Ubuntu 22.04) -- Static analysis (clang-tidy, cppcheck) -- Sanitizers (ASAN, UBSAN, TSAN) -- OpenSSF Best Practices (em andamento) -- Figura 5: Workflow CI/CD -- CTA: esta infraestrutura pontua nos criterios de artefato - ---- - -*Nota: Aguardando redacao na Sprint 1.* diff --git a/docs/paper-sbseg-2026/sections/04-ciberseguranca.md b/docs/paper-sbseg-2026/sections/04-ciberseguranca.md deleted file mode 100644 index 7429fa106..000000000 --- a/docs/paper-sbseg-2026/sections/04-ciberseguranca.md +++ /dev/null @@ -1,52 +0,0 @@ -# 4. Features de Ciberseguranca - -**Estado:** Rascunho nao iniciado. -**Fontes:** docs/migration/1.4.3-checkpoint-testcomp2026.md, docs/migration/1.4-checkpoint-smoke-test.md. -**Figuras:** Figura 4 (resultados TestComp 2026). - ---- - -## 4.1 Mapeamento de memory safety para CWEs - -[PARAGRAFO A REDIGIR] -- CWE-401: Memory Leak -- CWE-416: Use-After-Free -- CWE-415: Double-Free -- CWE-119 / CWE-787: Buffer Overflow -- Tabela: Propriedade SV-COMP -> CWE -> pass responsavel - -## 4.2 TestComp 2026 — Execucao Heap - -[PARAGRAFO A REDIGIR] -- Contexto: TestComp 2026, sub-categoria C.coverage-error-call.Heap -- Configuracao experimental -- Tabela de resultados consolidados -- Tabela por set (Heap, LinkedLists) -- Figura 4: Grafico dos resultados - -## 4.3 Smoke test e validacao de vereditos - -[PARAGRAFO A REDIGIR] -- Execucao E2E manual em benchmarks loops/array-1.c e loops/array-2.c -- Counter-example validado -- Framework de checkpoint automatizado - -## 4.4 Bugs criticos encontrados e corrigidos - -[PARAGRAFO A REDIGIR] -- Tabela dos 3 bugs (KLEE flags, isRequired, target function) -- Destacar: nenhum detectavel pelos unit tests existentes -- Implicacao: necessidade de testes de integracao E2E - -## 4.5 Suporte a WebAssembly (WASM) — Em Desenvolvimento - -[PARAGRAFO A REDIGIR] -- Extensao do pipeline LLVM 16 existente para analise de modulos WASM -- Backend LLVM-WASM: compilacao C -> LLVM IR -> WASM -> instrumentacao -> verificacao -- Vetor de ataque: memory safety em runtimes WASM (Wasmtime, Wasmer) -- Testes preliminares em benchmarks SV-COMP adaptados para WASM -- Status: implementacao em andamento na branch feat-update (pos-merge) - ---- - -*Nota: Aguardando redacao na Sprint 2. WASM sera integrado conforme resultados dos testes SV-COMP.* diff --git a/docs/paper-sbseg-2026/sections/05-demonstracao.md b/docs/paper-sbseg-2026/sections/05-demonstracao.md deleted file mode 100644 index ffa9f76f7..000000000 --- a/docs/paper-sbseg-2026/sections/05-demonstracao.md +++ /dev/null @@ -1,34 +0,0 @@ -# 5. Demonstracao Planejada - -**Estado:** Rascunho nao iniciado. -**Fontes:** test-comp2026/simulation/, Dockerfile.dev. -**Figuras:** Nenhuma. - ---- - -## 5.1 O que sera demonstrado ao vivo - -[PARAGRAFO A REDIGIR] -- Pipeline completo em Docker: compilacao -> instrumentacao -> execucao -> veredito -- Exemplo interativo: loops/array-2.c mostrando veredito FALSE + counter-example -- Execucao do framework TestComp 2026 (subset) mostrando throughput - -## 5.2 Equipamentos necessarios - -[PARAGRAFO A REDIGIR] -- Laptop com Docker instalado -- Imagem map2check-dev pre-construida (ou build no local, ~30 min) -- Subconjunto de benchmarks SV-COMP (testcomp26 tag) -- Acesso a internet (para pull da imagem Docker, se necessario) - -## 5.3 Video tecnico - -[PARAGRAFO A REDIGIR] -- Link do video (sera preenchido apos gravacao) -- Duracao: 5-7 minutos -- Conteudo: instalacao (Docker), build, execucao E2E, resultados TestComp 2026 -- Roteiro detalhado: ver video/roteiro-gravacao.md - ---- - -*Nota: Aguardando redacao na Sprint 2. BACKLOG: gravacao do video.* diff --git a/docs/paper-sbseg-2026/sections/06-conclusao.md b/docs/paper-sbseg-2026/sections/06-conclusao.md deleted file mode 100644 index 9a6232a63..000000000 --- a/docs/paper-sbseg-2026/sections/06-conclusao.md +++ /dev/null @@ -1,43 +0,0 @@ -# 6. Avaliacao, Perspectivas e Conclusao - -**Estado:** Rascunho nao iniciado. -**Fontes:** Dados consolidados em data/consolidated-data.md. -**Figuras:** Nenhuma. - ---- - -## 6.1 Resumo dos resultados - -[PARAGRAFO A REDIGIR] -- Modernizacao completa: 35 commits, 84 arquivos, +5.785/-657 linhas -- 9 passes migrados, 7/7 unit tests, 9/9 passes carregando -- TestComp 2026 Heap: 594 tasks, score 57, 56 bugs reais -- 3 bugs criticos de regressao descobertos e corrigidos - -## 6.2 Limitacoes - -[PARAGRAFO A REDIGIR] -- Taxa de UNKNOWN alta (45.6%): investigacao de timeout tuning e estrategia de solver -- Ausencia de testes de integracao E2E no CI -- ControlFlow benchmarks usaram property no-overflow — incomparavel -- C++17 dead store warnings em libc++ headers (documentado) - -## 6.3 Perspectivas - -[PARAGRAFO A REDIGIR] -- Aprofundamento do suporte a WebAssembly: expansao dos benchmarks, modelagem formal da memoria linear WASM -- Reducao da taxa de UNKNOWN: tuning de timeout, estrategias de solver SMT, heuristicas de path exploration -- Testes de integracao E2E no CI: automatizar o pipeline completo compile -> instrument -> link -> execute -- NAO mencionar: DG Library, AFL++, Coordenador, Smart Seeds (fora do escopo). - -## 6.4 Conclusao - -[PARAGRAFO A REDIGIR] -- Map2Check renasceu como plataforma sustentavel de verificacao de memory safety -- Modernizacao de engenharia e pre-requisito fundamental para qualquer avanco futuro -- Resultados do TestComp 2026 demonstram viabilidade competitiva -- Projeto aberto a contribuicoes (open source, repositorio publico) - ---- - -*Nota: Aguardando redacao na Sprint 2.* diff --git a/docs/paper-sbseg-2026/video-storyboard.md b/docs/paper-sbseg-2026/video-storyboard.md deleted file mode 100644 index 10c952f0e..000000000 --- a/docs/paper-sbseg-2026/video-storyboard.md +++ /dev/null @@ -1,56 +0,0 @@ -# Roteiro — Vídeo Técnico Map2Check 2026 (SBSeg SF — 5-7 min) - -## Cena 1: Apresentação (0:00–0:45) -**Slide:** Título + autores + UFRN/UFRR -- "Map2Check 2026 é uma ferramenta de verificação híbrida para C que combina execução simbólica e fuzzing" -- "SBSeg 2026 — Salão de Ferramentas" -- Stack: LLVM 16, KLEE 3.1, C++17, Docker - -## Cena 2: Demonstração E2E — Buffer Overflow (0:45–2:00) -**Terminal ao vivo:** -```bash -$ cat array-2.c -$ map2check --property-file coverage-error-call.prp array-2.c -VERIFICATION FAILED -Counter-example: nondet_int() -> 31763 -``` -- Mostrar: compilação → instrumentação → KLEE → contra-exemplo - -## Cena 3: Pipeline de Verificação (2:00–2:30) -**Slide:** Diagrama do pipeline (fig2-pipeline.png) -- 5 estágios: compilação, instrumentação, linking, análise, veredito -- 9 passes LLVM New PM (MemoryTrackPass, OverflowPass, etc.) - -## Cena 4: Resultados TestComp 2026 (2:30–3:30) -**Slide:** Tabela de resultados Heap + ControlFlow -- Heap: 594 tasks, score 57, 56 bugs reais encontrados -- ControlFlow: 138 tasks, score 38, 38 bugs -- KPI: 45.6% UNKNOWN → direcionamento para próximos ciclos - -## Cena 5: WASM Pipeline (3:30–4:30) -**Slide:** Diagrama WASM pipeline (fig6-wasm-pipeline.png) -- `.wasm → wasm2c → LLVM IR → Passes → KLEE` -- `map2check --wasm modulo.wasm` — mesmo pipeline, binários de terceiros - -## Cena 6: Demo WASM — Heap Overflow detectado (4:30–5:30) -**Terminal ao vivo:** -```bash -$ cat test_heap_overflow.c # malloc(10*sizeof(int)); p[10] = 999; -$ wasi-sdk clang --target=wasm32-wasip1 test_heap_overflow.c -o overflow.wasm -$ map2check --wasm --memtrack overflow.wasm -VERIFICATION FAILED -Violated property: OVERFLOW -``` -- Juliet: 15/15 casos FALSE - -## Cena 7: Infraestrutura de Engenharia (5:30–6:15) -**Slide:** CI/CD + Docker + OpenSSF -- GitHub Actions: build, test, static analysis, sanitizers, E2E Docker -- Dockerfile.dev: ambiente reproduzível -- OpenSSF Best Practices badge - -## Cena 8: Conclusão + Links (6:15–7:00) -**Slide:** Repositório + DOI + contato -- `github.com/hbgit/Map2Check` -- Código aberto (GPL-2.0), Docker image pública (GHCR) -- Contribuições bem-vindas diff --git a/docs/paper-sbseg-2026/video/roteiro-gravacao.md b/docs/paper-sbseg-2026/video/roteiro-gravacao.md deleted file mode 100644 index fea89296a..000000000 --- a/docs/paper-sbseg-2026/video/roteiro-gravacao.md +++ /dev/null @@ -1,131 +0,0 @@ -# Roteiro do Vídeo Tecnico — Map2Check 2026 - -**Duracao alvo:** 5–7 minutos -**Formato:** Screencast + narracao -**Resolucao:** 1920x1080, 30fps -**Audio:** Narracao clara, sem musica de fundo -**Legendas:** Recomendado - ---- - -## Storyboard — 8 Cenas - -### Cena 1: Introducao (30 segundos) -**Visual:** Terminal limpo, texto overlay. -**Texto:** Map2Check 2026 — Modernizacao de uma Ferramenta de Verificacao de Memory Safety. -**Narracao:** Map2Check e uma ferramenta de verificacao hibrida para programas em C. Em 2026, completamos uma modernizacao completa da stack: de LLVM 6 para LLVM 16, migrando todos os passes para o New Pass Manager e adotando C++17. Neste video, demonstramos o pipeline completo de instalacao, build e execucao. - ---- - -### Cena 2: Clone e Build com Docker (60 segundos) -**Visual:** Terminal executando comandos. Time-lapse no docker build. -**Comandos:** -```bash -git clone https://github.com//Map2Check.git -cd Map2Check -docker build -f Dockerfile.dev -t map2check-dev . -docker run --rm map2check-dev clang-16 --version -docker run --rm map2check-dev opt --version -``` -**Narracao:** O ambiente e inteiramente containerizado. A imagem Docker inclui LLVM 16, KLEE 3.1, Z3, Boost e todas as dependencias. O build e reprodutivel em qualquer maquina com Docker. - ---- - -### Cena 3: Execucao do Smoke Test (60 segundos) -**Visual:** Execucao de array-1.c (TRUE) e array-2.c (FALSE). Highlight no veredito. -**Comandos:** -```bash -map2check --property-file coverage-error-call.prp \ - --target-function-name reach_error loops/array-1.c -# Resultado: VERIFICATION SUCCEEDED - -map2check --property-file coverage-error-call.prp \ - --target-function-name reach_error loops/array-2.c -# Resultado: VERIFICATION FAILED + counter-example -``` -**Narracao:** O pipeline completo e invocado por um unico comando. No primeiro exemplo, o erro nunca e alcancado. No segundo, encontramos o erro e geramos um contra-exemplo concreto. - ---- - -### Cena 4: Verificacao do Counter-Example (60 segundos) -**Visual:** Saida detalhada do counter-example. Highlight nos valores. -**Texto exibido:** -``` -Counter-example: - Call Function : __VERIFIER_nondet_int() - Value : 31763 - Line Number : 19 - Function Scope : main - -Violated property: - FALSE: Target Reached -``` -**Narracao:** O contra-exemplo fornece valores concretos para as entradas nao-deterministicas que levam a violacao, tornando a falha reprodutivel. - ---- - -### Cena 5: Framework TestComp 2026 (60 segundos) -**Visual:** Navegacao ate test-comp2026/simulation/. Execucao de run_checkpoint.sh. -**Comandos:** -```bash -cd test-comp2026/simulation/ -./run_checkpoint.sh --category Heap --timeout 300 -./verify_verdicts.sh -``` -**Narracao:** Para validar em escala, executamos o framework de checkpoint contra benchmarks reais do TestComp 2026. O script gerencia multiplas tarefas, timeouts e validacao automatica. - ---- - -### Cena 6: Resultados Consolidados (45 segundos) -**Visual:** Tabela/painel com resultados. Grafico de barras (Figura 4). -**Texto:** -``` -Resultados TestComp 2026 — Heap -Total tasks : 594 -Score : 57 -TRUE : 264 (44.4%) -UNKNOWN : 271 (45.6%) -FALSE : 56 (9.4%) -TIMEOUT : 2 (0.3%) -``` -**Narracao:** Na subcategoria Heap, executamos 594 tasks. A ferramenta encontrou 56 bugs reais e alcancou um score de 57. Estes resultados demonstram a viabilidade competitiva. - ---- - -### Cena 7: CI/CD e Qualidade de Artefato (45 segundos) -**Visual:** Pagina GitHub Actions. Badge verde. Terminal com static analysis. -**Comandos:** -```bash -./scripts/run-static-analysis.sh -mkdir build-asan && cd build-asan -cmake -DENABLE_SANITIZER_ADDRESS=ON .. -make -j$(nproc) -``` -**Narracao:** A sustentabilidade e garantida por CI/CD automatizado, analise estatica com clang-tidy e cppcheck, e testes com sanitizers. Estas praticas sao essenciais para a reproducibilidade cientifica. - ---- - -### Cena 8: WebAssembly — Sneak Peek (opcional, 20 segundos) -**Visual:** Terminal mostrando compilacao C -> WASM via LLVM. -**Comandos:** -```bash -clang-16 --target=wasm32-wasi -emit-llvm -c exemplo.c -o exemplo.bc -``` -**Narracao:** Como direcao futura, estamos estendendo o pipeline LLVM para analise de modulos WebAssembly, ampliando o escopo da verificacao para runtimes WASM. - ---- - -### Cena 9: Conclusao (30 segundos) -**Visual:** Tela final com link do repositorio e QR code. -**Texto:** Map2Check 2026 — Codigo aberto, verificacao sustentavel. -**Narracao:** O Map2Check esta disponivel como codigo aberto. Agradecemos o interesse e convidamos a comunidade a contribuir. - ---- - -## Notas de Producao - -- Usar `asciinema` ou `terminalizer` para gravacao elegante do terminal. -- Acelerar partes longas (docker build, execucao de multiplos benchmarks) com time-lapse. -- Manter fonte do terminal grande o suficiente para leitura em projetor. -- URL do repositorio pode constar normalmente no video (single-blind). Opcional: usar URL generica se preferir. -- Dura total nao deve exceder 7 minutos. diff --git a/docs/paper-sbseg-2026/wasm-implementation-plan.md b/docs/paper-sbseg-2026/wasm-implementation-plan.md deleted file mode 100644 index c42169abe..000000000 --- a/docs/paper-sbseg-2026/wasm-implementation-plan.md +++ /dev/null @@ -1,138 +0,0 @@ -# Plano de Implementação — WASM Pipeline (Map2Check) - -**Branch:** `feat-wasm-verification` -**Deadline MVP:** 13/jul/2026 -**Deadline submissão SBSeg:** 20/jul/2026 - ---- - -## Contexto atual - -| Componente | Estado | -|------------|--------| -| WasmLifter (`wasm_lifter.{hpp,cpp}`) | ✅ Compila, integrado ao CMake, NÃO invocado pelo CLI | -| Docker (WABT 1.0.41 + wasi-sdk 33.0) | ✅ Dockerfile.dev atualizado | -| Scripts de validação (`test_wasm_pipeline.sh`) | ✅ Pipeline C→WASM→LLVM IR validado | -| Paper SBSeg (LaTeX) | ✅ 6 seções escritas, falta seção WASM | -| Integração CLI (`map2check --wasm`) | 🔴 Não existe | -| PoC E2E (detectar bug real em WASM) | 🔴 Não testado | -| MemoryTrackPass adaptado | 🔴 Não iniciado | - ---- - -## Arquitetura Proposta - -O WasmLifter já produz `.bc` (LLVM bitcode). O pipeline existente: - -``` -C (.c) → clang → .bc → opt (passes) → llvm-link (runtime) → KLEE → veredito -``` - -Para WASM, o step de compilação é substituído pelo lifter: - -``` -WASM (.wasm) → wasm2c → .c → clang-16 → .bc → opt (passes) → llvm-link (runtime) → KLEE → veredito - └─────────── WasmLifter ──────────┘ └─────── pipeline existente (inalterado) ───────┘ -``` - -**Vantagem**: do `.bc` pra frente, tudo é reutilizado — passes, runtime, KLEE, leitura de veredito. - ---- - -## Sub-etapas - -### 1.7.3 — PoC E2E manual (2 dias) - -**Objetivo**: Provar que o pipeline detecta um bug de memory safety em WASM. - -**Tarefas**: -1. Criar caso de teste canônico: `test_overflow.c` com buffer overflow intencional -2. Compilar para WASM: `wasi-sdk clang --target=wasm32-wasip1 test_overflow.c -o test.wasm` -3. Liftar para LLVM IR: `WasmLifter::lift("test.wasm")` → `test.bc` -4. Inspecionar o IR: verificar se o wasm2c gera `load`/`store`/`call` que o MemoryTrackPass reconhece -5. Rodar passes: `opt -load-pass-plugin=libMemoryTrackPass.so -passes=memory-track test.bc -o test-instr.bc` -6. Linkar com runtime: `llvm-link test-instr.bc Map2CheckFunctions.bc AnalysisModeMemtrack.bc ...` -7. Executar KLEE: verificar se o overflow é detectado (FALSE + counter-example) -8. Documentar descobertas: padrões de IR do wasm2c que diferem do C nativo - -**Riscos**: -- `wasm2c` não gera `malloc`/`free` → usa `wasm_rt_allocate_memory()` → MemoryTrackPass não captura -- Memória linear WASM é array contíguo acessado via offset, não ponteiro → bounds check precisa ser adaptado -- Entry point é `w2c__start`, não `main` → Map2CheckLibrary pass não injeta init/exit - ---- - -### 1.7.4 — Adaptação MemoryTrackPass para WASM (3 dias) - -| Componente | Problema | Solução | -|------------|----------|---------| -| **Map2CheckLibrary** | Não reconhece `w2c__start` como entry point | Adicionar flag `--entry-function` ou detectar `w2c_*` automaticamente | -| **MemoryTrackPass** | `malloc`/`free` não existem no IR wasm2c — usa `wasm_rt_allocate_memory` | Adicionar handlers para `wasm_rt_*` calls; instrumentar `wasm_rt_allocate_memory` como `map2check_malloc` | -| **MemoryTrackPass** | Ponteiros são offsets i32 dentro da memória linear, não endereços reais | Tratar stores/loads em `wasm_rt_memory_t.data` como acessos à memória; validar offset < `memory.size` | -| **OverflowPass** | Buffer overflow em WASM = acesso à memória linear além do bounds | Adicionar bounds check: `assert(offset + size <= memory_pages * 64KB)` antes de cada store/load | -| **Runtime** | `map2check_malloc` espera endereço real, WASM usa offset | Criar modo `WASM_MODE` na runtime que trabalha com offsets relativos à base da memória linear | - ---- - -### 1.7.5 — CLI `--wasm` + WasmBackend (2 dias) - -1. Adicionar flag `--wasm` no `map2check.cpp` (via `boost::program_options`) -2. Modificar `map2check_execution()`: - ```cpp - if (args.wasmMode) { - WasmLifter lifter(config); - WasmLifterResult result = lifter.lift(args.inputFile); - args.inputFile = result.bitcodePath; // substitui .wasm por .bc - } - // Resto do pipeline inalterado - ``` -3. Passar `--wasm-mode` para o `callPass()` quando em modo WASM -4. Ajustar `Caller::compileCFile()` para ser no-op quando input já é `.bc` - -**Arquivos afetados**: -- `modules/frontend/map2check.cpp` — adicionar flag + WasmLifter call -- `modules/frontend/map2check.hpp` — adicionar campos ao `map2check_args` -- `modules/frontend/caller.cpp` — opcional: skip compileCFile para .bc - ---- - -### 1.7.6 — Benchmarks Juliet WASM (2 dias) - -1. Selecionar subset da Juliet Test Suite: CWE-119 (Buffer Overflow), CWE-416 (Use-After-Free) -2. Compilar para WASM com wasi-sdk-33 -3. Rodar pipeline em cada benchmark -4. Tabular: total, bugs detectados (FALSE), safe confirmados (TRUE), inconclusivos (UNKNOWN) -5. Comparar taxa de detecção: WASM vs C nativo (via pipeline normal) - ---- - -### 1.7.7 — Documentação no artigo (2 dias) - -1. Escrever seção WASM (~1 página) no `main.tex`: arquitetura do lifter, modelagem, pipeline, resultados Juliet -2. Adicionar figura do pipeline WASM -3. Atualizar abstract/conclusão com menção ao suporte WASM - ---- - -## Cronograma - -| Data | Marco | -|------|-------| -| 04-05/jul | 1.7.3 PoC E2E | -| 06-08/jul | 1.7.4 Passes adaptados | -| 09-10/jul | 1.7.5 CLI integrado | -| 11-12/jul | 1.7.6 Juliet benchmarks | -| 13/jul | 1.7.7 Seção WASM no artigo | - -**Dependência crítica**: 1.7.3 é o gate — se o PoC falhar, reavaliar abordagem. - ---- - -## Riscos (atualizado) - -| Risco | Impacto | Prob | Mitigação | -|:---|:---|:---|:---| -| wasm2c gera código C incompreensível para passes | Alto | Média | Validar exemplos simples primeiro; ajustar passes para `wasm_rt_*` | -| KLEE não resolve memória linear levantada | Alto | Média | Injetar asserts de bounds manualmente; `klee_make_symbolic` para offsets | -| Juliet compilado para WASM perde semântica de malloc/free | Médio | Alta | Validar preservação; mapear para `wasm_rt_malloc` se necessário | -| IR levantado explode após lifting | Médio | Média | Usar slicing antes da instrumentação; limitar a benchmarks pequenos | diff --git a/docs/reports/2026-08-12-castle-juliet-findings.md b/docs/reports/2026-08-12-castle-juliet-findings.md new file mode 100644 index 000000000..a8803aef5 --- /dev/null +++ b/docs/reports/2026-08-12-castle-juliet-findings.md @@ -0,0 +1,367 @@ +# Map2Check — Relatório de correções e achados (CASTLE + Juliet baseline) + +**Branch:** `feat/castle-juliet-baseline` (a partir de `develop`) +**Data:** 2026-08-12 + +> Documento de apoio para a PR. Lista cada correção e cada achado da sessão de +> baseline empírico sobre CASTLE (250) e Juliet (escopo C). + +--- + +## 1. Correções aplicadas (code fixes) + +### 1.1 Suporte a `main(int argc, char *argv[])` — wrapper de nondet +- **Bug:** `NonDetGeneratorKlee.c` / `NonDetGeneratorLibFuzzy.c` chamavam + `__map2check_main__()` **sem argumentos**. Programas com `main(argc, argv)` + (Juliet inteiro, Test-Comp) caíam em `KLEE: calling function with too few + arguments` → todo programa seguro virava `UNKNOWN`. +- **Fix:** repassar `(argc, argv)` (KLEE) e `(0, NULL)` (LibFuzzer). +- **Teste:** `tests/integration/test_main_argv.sh` (bad⇒FALSE, safe⇒TRUE), no CI. +- **Commit:** `ae65830c4` + +### 1.2 `-m2c-entry-function` passado incondicionalmente +- **Bug:** `caller.cpp` passava `-m2c-entry-function` ao `opt` sempre, mas esse + `cl::opt` só é registrado pelo `MemoryTrackPass`. Nos modos overflow/assert/ + reachability (que não carregam o pass), o `opt` abortava → `main` nunca era + renomeado → `undefined reference to __map2check_main__` → `ERROR`. +- **Fix:** passar o flag só quando o MemoryTrackPass é carregado. +- **Teste:** `tests/integration/test_modes.sh` (overflow/assert/target), no CI. +- **Commit:** `ea9669c9d` + +### 1.3 Truncamento 32-bit no `find_row_with_address` (memtrack) +- **Bug:** `AllocationLog.c` fazia cast do ponteiro para `unsigned` (32-bit), + enquanto o resto usa 64-bit. Com o heap de 1024 GiB do KLEE, dois endereços + distintos colidem nos 32 bits baixos → duas alocações vivas se confundem no + allocation log → falsos positivos (e FNs latentes) em programas com múltiplas + alocações. Os casos de "swap-trick" (415-7/8, 416-7/8/10) apenas *disparavam* + o bug. +- **Fix:** `unsigned` → `unsigned long` (2 linhas). +- **Validação:** 415-7/8, 416-7/10 agora ⇒ `SUCCEEDED`; 415-2, 416-1 continuam ⇒ `FAILED`. + +### 1.4 `assert()` da libc não instrumentado (AssertPass) +- **Bug:** `AssertPass` só interceptava `__VERIFIER_assert`. O `assert()` do + `` (glibc) lowera para `__assert_fail(...)`, não tratado → `ERROR`. +- **Fix:** interceptar `__assert_fail` e emitir `map2check_assert(0, arg2, arg3)` + (condição falsa, linha e função vêm dos operandos). +- **Validação:** `CASTLE-617-1` agora ⇒ `FAILED`; caso novo em `test_modes.sh`. + +### 1.5 crabllvm (`--add-invariants`) — fallback gracioso +- **Causa:** `cmake/FindCrabLlvm.cmake` (seahorn/crab-llvm) nunca foi ligada ao + build moderno e é incompatível com LLVM 16; `--add-invariants` referenciava um + binário inexistente e quebrava o pipeline. +- **Fix:** `map2check.cpp` detecta a ausência e degrada graciosamente (warning). +- **Issue aberta:** ver §3. **Commit:** `914d7bab8` + +> **Revisto em 2026-08-16 — o fallback não cobria o caminho que usamos.** O aviso +> ficava dentro de `if (!is_llvmir_in)`. Com entrada `.c` ele aparecia; com `.bc` +> — como todo o baseline v5, o arreio do CASTLE e os wrappers do BenchExec +> invocam a ferramenta — o bloco inteiro era pulado e **nem o aviso saía**. A +> flag era aceita, ignorada e não deixava rastro. Ver §2.x abaixo e +> [a revisão da dependência](2026-08-16-crabllvm-review.md). + +### 1.6 Parser de veredito / linha dos scripts de avaliação +- **Bug A (veredito):** `grep -qi "TIMEOUT|timed out"` casava com o erro do + utilitário `timeout` ("failed to run command ... No such file or directory"), + classificando falha de infra como TIMEOUT. +- **Fix A:** `detect_verdict`/`classify_verdict` — ordem `FALSE → TRUE → "Forcing + timeout" (TIMEOUT real) → falha de infra (ERROR) → UNKNOWN`, com bucket `ERROR`. +- **Bug B (linha):** `grep 'line \d+' | head -1` casava com `in**line 8**-bit + counters` (LibFuzzer), reportando "line 8" para tudo. +- **Fix B:** extrair de `map2check_property line \K\d+`. +- **Commit:** `26d9a85c1` (A); B neste commit. + +### 1.7 Mapeamento CWE→modo (CASTLE) +- `134` (format string), `253` (checagem de retorno), `362` (race) → **N/A** + (nenhum modo detecta). +- `369` (div por zero) → `--check-overflow` (agora funcional via §1.8). +- `617` → `--check-asserts` (agora funcional via §1.4). + +### 1.8 Divisão por zero — propriedade dedicada `FALSE-DIVBYZERO` +- **Bug:** `divisionByZeroError()` era TODO no-op; div-por-zero não era + detectado. +- **Fix:** implementar a checagem + propriedade dedicada (segue a convenção de + KLEE/CBMC/SV-COMP — CWE-369 usa `unreach-call`, não `no-overflow`). +- **Arquivos:** `AnalysisModeOverflow.c`, `Map2CheckTypes.h`, `PropertyGenerator.c`, + `tools.hpp/.cpp`, `counter_example.cpp/.hpp`, parsers dos evals, `test_modes.sh`. +- **Validação:** `div_bug`⇒`FALSE-DIVBYZERO`, `CASTLE-369-1`⇒`FALSE`. +- **Commit:** `c09378d6b` + +### 1.9 Assinatura i64/i32 dos binops do OverflowPass (bug latente) +- **Bug:** `OperationsFunctions.hpp` declarava `map2check_binop_{add,sub,mul,sdiv}` + com parâmetros `i64`, mas a runtime (`AnalysisModeOverflow.c`) define `int` + (i32). A checagem runtime de overflow estava **silenciosamente quebrada** — o + overflow só era detectado via warning `-Winteger-overflow` do clang. +- **Bug 2:** o check era inserido **depois** da operação; para div-por-zero o + `sdiv` dispara SIGFPE antes do check. +- **Fix:** declarar `i32` (sem cast i64) + inserir o check **antes** da operação. +- **Validação:** `ov_nondet` (overflow runtime) ⇒ `OVERFLOW`/`FAILED`. +- **Commit:** `2cd1042ac` + +--- + +## 2. Achados (bugs/limitações identificados) + +| # | Achado | Local | Situação | +|---|---|---|---| +| A | Truncamento 32-bit no allocation log | `AllocationLog.c` | ✅ corrigido (§1.3) | +| A2 | Assinatura i64/i32 + ponto de inserção dos binops (overflow runtime quebrado) | `OperationsFunctions.hpp`, `OverflowPass.cpp` | ✅ corrigido (§1.9) | +| B | `--target-function --target-function-name main` é **degenerado**: TargetPass instrumenta chamadas *para* `main` (que ninguém faz) e `AnalysisModeNone` sempre retorna "correct" | `TargetPass.cpp`, `AnalysisModeNone.c` | **medido no v6** (§2.1) — 🟡 o caso trivial agora se anuncia; o mapeamento do harness continua aberto | +| C | `divisionByZeroError()` era TODO no-op | `AnalysisModeOverflow.c:86` | ✅ corrigido (§1.8) | +| D | Overhead "fuzzer-first": default roda LibFuzzer (60s) antes do KLEE | `map2check.cpp:498-508` | aberto (G5 — lean reachability via `--nondet-generator symex`) | +| E | 33/250 CASTLE não compilam por headers externos (`mysql.h`, `openssl/*.h`) | imagem Docker | aberto (maioria CWE-89/798, fora de escopo) | +| F | `--add-invariants` aceito e ignorado **sem rastro** na entrada `.bc`: o aviso do §1.5 estava dentro de `if (!is_llvmir_in)` | `map2check.cpp:227-245` | ✅ corrigido — agora sai com código 3 | +| G | `main()` descarta o retorno de `map2check_execution()` nas três chamadas, então o código de saída nunca reflete o resultado da análise — inclusive o `return 1` de `--expected-result` | `map2check.cpp:521,524,528` | aberto | +| H | **Use-after-scope no log de nondet:** `NONDET_CALL.value` guardava o endereço do parâmetro `value` do wrapper `map2check_nondet_*`. Esse quadro de pilha já morreu quando o log é gravado na saída | `Map2CheckTypes.h`, `NonDetLog.c` | ✅ corrigido — valor agora inline (união) | +| I | `map2check_nondet_double` registrava o tipo como `UNSIGNED`, então todo double logado saía como `%u` sobre 4 bytes da mantissa | `NonDetLog.c:130` | ✅ corrigido | +| J | Todo estado bifurcado do KLEE grava o mesmo `klee_log.csv` na saída; o último a terminar vence, e não é o violador (que aborta cedo) | `WitnessGeneration.c`, `Map2CheckFunctions.c` | ✅ corrigido — flush só na violação | +| K | **Investigado e corrigido.** O timeout descartava violações já encontradas e gravadas: `isTimeout()` tinha precedência sobre a propriedade violada. Disparava em 80% das execuções do Juliet v5 | `map2check.cpp` | ✅ corrigido — resgate restrito a evidência confiável | +| K2 | Custo por leitura nondet cresce muito: 1 → 21 → 114 → 861 caminhos parciais para 2 → 4 leituras, sem nenhum `.err` | KLEE + instrumentação | aberto | + +### Achado B, medido: um oráculo que só sabe dizer "correto" + +O achado B foi registrado em agosto como uma suspeita estrutural: `TargetPass` +instrumenta *call sites* cujo callee tem o nome pedido, e um programa não chama +o próprio `main`, logo nada é instrumentado. O baseline v6 do CASTLE permite +sair da suspeita e medir. + +**98 das 217 execuções (45%) rodaram nesse modo.** O que elas produziram: + +| veredito | n | +|---|---| +| TRUE | 57 | +| TIMEOUT | 22 | +| UNKNOWN | 10 | +| ERROR | 9 | +| **FALSE-\*** | **0** | + +Nenhum FALSE. Não é escassez: nos outros modos, as mesmas 217 execuções +produzem 49 vereditos FALSE-\* (`FALSE-DEREF` 21, `FALSE-FREE` 12, `FALSE` 10, +`FALSE-DIVBYZERO` 6, `FALSE-MEMCLEANUP` 6). O modo degenerado é o único que +nunca acusa nada. + +**59 dos 98 programas eram sabidamente vulneráveis. Zero foram detectados.** + +O efeito na pontuação tem dois lados, e o segundo é o mais incômodo: + +| | efeito | +|---|---| +| 5 FN | perdas garantidas — o oráculo não podia acertar | +| **12 TN** | **crédito por acertos que um oráculo que só diz "correto" não tinha como errar** | + +Descontando o modo inteiro, o CASTLE v6 sai de **recall 74,0% para 79,4%** +(precisão fica em 98,2%: nenhum TP ou FP vem desse modo — ele não produz +nenhum dos dois). Ou seja, B **não** infla precisão; ele **deprime recall** e +**infla TN**. + +Os outros 61 casos do modo são CWEs que o harness já declara fora de escopo e +pontua N/A, então não distorcem métrica alguma. Vale corrigir o registro: uma +leitura anterior atribuiu os 61 N/A ao achado B — eles são N/A por decisão de +escopo, não por causa dele. O custo real de B são os 17 casos pontuados. + +#### O que foi feito e o que falta + +Zero call sites **não é um erro**. Se um programa realmente nunca chama +`reach_error`, então "o erro é inalcançável" é a resposta certa e TRUE é +legítimo. O defeito é que esse TRUE é **indistinguível**, na saída, de um TRUE +conquistado explorando o programa. + +Então a correção do lado da ferramenta é de visibilidade, não de veredito: +`TargetPass` agora varre o módulo uma vez e, se o alvo não é chamado em lugar +nenhum, avisa dizendo o que o veredito vale ali. Coberto por +`tests/integration/test_target_coverage.sh` (4 asserções), que exige as duas +direções — o alvo real fica em silêncio, o alvo ausente se anuncia. + +O que **falta** é o lado do harness: o mapeamento CWE→modo usa +`--target-function-name main` como default de escape para 13 CWEs. Corrigi-lo +muda a pontuação do baseline, então espera o v6 fechar — trocar o critério no +meio da corrida é exatamente o que torna duas medições incomparáveis. + +### Achado K, investigado: o timeout descarta violações já encontradas + +**Sintoma.** Ao montar o corpus de conformidade do Test-Comp, o programa mais +simples que usa um laço não era decidido: + +```c +int sum = 0; +for (int i = 0; i < 4; i++) sum += __VERIFIER_nondet_int(); +if (sum == 10) reach_error(); +``` + +Uma restrição linear sobre quatro símbolos irrestritos, e mesmo assim UNKNOWN. + +**Causa raiz.** Rodando com `--debug`, a sequência no log é: + +``` +72: TARGET-REACHED found <- o KLEE encontrou a violação e gravou map2check_property +75: Note: Forcing timeout +77: VERIFICATION UNKNOWN +``` + +O KLEE **encontra** o alvo. A evidência é gravada em disco. Em seguida ele é +morto pelo `timeout` (saída 31744 = 124 << 8) porque continua explorando outros +estados, e `map2check.cpp` faz: + +```cpp +if (caller->isTimeout()) { + Map2Check::Log::Warning("Note: Forcing timeout"); + propertyViolated = UNKNOWN; // descarta a violação já registrada +} +``` + +A checagem de timeout tem precedência sobre a propriedade violada, então um +resultado FALSE legítimo — com contraexemplo em disco — é reportado como +UNKNOWN. **O orçamento acabou depois de a ferramenta ter feito o trabalho.** + +**Correção proposta.** Consultar a propriedade antes de forçar UNKNOWN: se +`map2check_property` registra uma violação, o veredito é FALSE independentemente +de o orçamento ter expirado em seguida. O timeout só significa "não sei" quando +nada foi encontrado. + +Não aplicada ainda porque muda a contagem UNKNOWN→FALSE em todo o baseline, e +isso interage com a regra de atribuição declarada para a corrida v6. + +**Por que isso importa muito além do gate.** O plano de desenvolvimento atribui +os 45,6%/50,7% de UNKNOWN a explosão de caminhos e conclui que o acionável é +orquestração e poda (H2.2–H2.4, 4–8 pw). Este achado mostra um mecanismo +concreto e barato de inflar UNKNOWN que não tem nada a ver com explosão de +caminhos. **Quantos dos UNKNOWN do v5 são violações encontradas e descartadas é +uma pergunta mensurável**, e a resposta deveria preceder qualquer investimento +em slicing. + +**Medições auxiliares.** Bisecção com seis variantes (2 vs 4 leituras, com e sem +laço, soma vs igualdade) isolou que o laço é irrelevante — `loop2_sum` e +`straight2_sum` dão exatamente os mesmos 21 caminhos parcialmente completados. +O que escala é o número de leituras nondet: + +| variante | caminhos parciais | instruções | +|---|---|---| +| 2 leituras, igualdade | 1 | 147 K | +| 2 leituras, soma | 21 | 461 K | +| 4 leituras, soma | 114 | 680 K | +| 4 leituras em laço, igualdade | 861 | 7,5 M | + +Nenhum arquivo `.err` foi gerado, então esses caminhos parciais não são erros. +O custo por leitura nondet crescer assim é um segundo fio a puxar. + +**Quanto isso vale, medido nos logs do próprio v5.** Os 2526 logs crus do +baseline permitem contar em quantas execuções o override chegou a disparar, sem +re-executar nada: + +| corpus | logs | `Forcing timeout` disparou | UNKNOWN final | +|---|---|---|---| +| Juliet | 2526 | **2031 (80%)** | 703 | +| CASTLE | 217 | **123 (57%)** | — | + +Não é caso de canto. A distância entre 2031 disparos e 703 UNKNOWN finais é o +caminho híbrido: cada caso roda `map2check` duas vezes, e o passe do LibFuzzer, +com 0,2× do orçamento, quase sempre estoura. + +**O que os logs NÃO permitem medir** é a conversão efetiva: eles registram que o +override disparou, mas não se havia violação gravada em `map2check_property`, +que não é preservado. A contagem UNKNOWN→FALSE fica indeterminada até a corrida +v6 com os dois binários. + +**Um bug encontrado na própria correção, por causa desse número.** A primeira +versão afirmava em comentário que o ramo do LibFuzzer não receberia o resgate, +mas o ramo do timeout vem antes na cadeia e valia para os dois motores: um +crash do LibFuzzer não reproduzido (`isVerified()` falso) teria seu arquivo de +propriedade aceito. Com 2031 disparos, a maioria no passe do fuzzer, o alcance +seria grande. A restrição passou para a condição: + +```cpp +bool evidenceIsTrustworthy = + recordedAViolation && + (generator != NonDetGenerator::LibFuzzer || caller->isVerified()); +``` + +**Por que o CASTLE não serve para medir isto.** 32 dos seus 38 casos indecididos +usam `--target-function --target-function-name main`, o modo degenerado do +achado B, onde nenhuma violação chega a ser registrada. O achado B mascara o K +naquele corpus: consertar B é pré-requisito para o ganho do K ser mensurável lá. + +**Erro de método a registrar.** Duas conclusões intermediárias minhas nesta +investigação estavam erradas e foram corrigidas pelos dados: (i) afirmei que não +era artefato de orçamento com base em runs de 60/120/240s feitos enquanto +vários containers KLEE competiam pela CPU; (ii) afirmei que a flag `--debug` +invertia o veredito, quando na verdade meu `grep ... | head -1` casava a linha +`TARGET-REACHED found` do log de debug antes da linha de veredito. A segunda +foi o que acabou revelando a causa raiz. + +Uma terceira, durante a medição: levantei a hipótese de que os TIMEOUT do Juliet +fossem na verdade segfaults, com base em um caso que retornou `rc=139`. Dez +casos da mesma família depois, **0/10 crasharam** -- incluindo o mesmo arquivo, +sob outra configuração. Hipótese retirada. + +E uma quarta, sobre o instrumento: quatro bugs distintos no arreio de medição +(contenção de CPU entre containers, `grep | head -1` casando linha de debug, +consumo de stdin dentro do laço de leitura, e orçamento externo insuficiente +para o caminho híbrido). Nenhum estava na ferramenta; todos estavam na medição. + +### O log de nondet estava vazio em toda execução simbólica + +Os achados **H**, **I** e **J** foram descobertos juntos, ao tentar emitir a test +suite do Test-Comp, e explicam por que o `klee_log.csv` saía com **zero bytes** +em todo run com `--nondet-generator symex`: + +1. O KLEE detectava o erro de ponteiro do achado **H** dentro do próprio + `nondet_log_to_file()` e matava o estado — `completed paths = 0`, + `test000001.ptr.err`. Nativamente o mesmo código costumava "funcionar", + porque a pilha morta ainda continha o valor: é UB que passa despercebido + fora de um executor simbólico. +2. Corrigido **H**, o vetor passou a sair com o primeiro valor certo e o + segundo errado — porque um estado que tomou outro ramo sobrescrevia o + arquivo depois (achado **J**). +3. Corrigidos os dois, o vetor recuperado é exatamente o da execução violadora. + +Consequência para o baseline v5: nenhum veredito muda — a detecção nunca +dependeu do log —, mas **nenhum contraexemplo de execução simbólica jamais +carregou valores de entrada**, e a coluna de valores nondet dos witnesses +gerados sob KLEE não tinha conteúdo. Isso é pré-requisito para pontuar no +Test-Comp, onde o vetor de entrada *é* o artefato avaliado. + +### Correção do registro: o pass 2 do CASTLE nunca aplicou invariantes + +O arreio re-executava todo UNKNOWN com `--add-invariants`. Como o achado **F** +mostra, essa flag era ignorada sem rastro na entrada `.bc` — e a entrada é `.bc`. +O pass 2 era, portanto, uma re-execução **byte-idêntica** do pass 1. Duas +consequências para os dados do v5: + +- A coluna `used_invariants=yes` não significa o que diz. **Nenhuma execução do + baseline v5 usou invariantes.** +- Cada caso UNKNOWN custou dois orçamentos de timeout em vez de um, o que infla + o tempo de parede das linhas afetadas sem mudar veredito algum. + +Nenhum veredito da tabela publicada muda: uma segunda execução idêntica só +converteria um UNKNOWN por acaso, e o veredito registrado era o da última +execução de qualquer forma. O que muda é a interpretação da coluna e dos tempos. +A partir do v6 o arreio reconhece o código de saída 3 e registra +`used_invariants=unavailable`, preservando o veredito do pass 1 — +ver [a revisão da dependência](2026-08-16-crabllvm-review.md). + +--- + +## 3. Issue aberta (GitHub) + +- **`crabllvm (seahorn/crab-llvm) is incompatible with LLVM 16 — --add-invariants is a no-op`** + +--- + +## 4. Baseline (em andamento) + +- **CASTLE 250:** rodando (parcial ~139/250 na última checagem), log + `/tmp/opencode/castle_bg.log`, resultados `tests/castle/results/`. +- **Juliet escopo C:** watcher aguardando o CASTLE terminar. +- Métricas preliminares (parciais, pré-fixes) indicavam: memtrack com muitos + "FP" que eram, na verdade, **artefato do parser de linha** (§1.6-B) + os + swap-tricks reais (§1.3). Ambos corrigidos → re-rodada dará números limpos. + +--- + +## 5. Backlog (próximos passos, sem trocar engine) + +1. ~~Implementar `divisionByZeroError()` (CWE-369)~~ ✅ (§1.8). +2. Corrigir/desativar o modo reachability degenerado (TargetPass target=main). +3. Lean reachability (KLEE-only por default em reachability). +4. Instrumentar funções de string libc (`strcpy`/`memcpy`) no MemoryTrackPass. +5. Modelar `malloc`→NULL para CWE-476 via malloc. +6. Re-rodar CASTLE/Juliet com os fixes para o relatório final. diff --git a/docs/reports/2026-08-16-baseline-v5.html b/docs/reports/2026-08-16-baseline-v5.html new file mode 100644 index 000000000..f602695ec --- /dev/null +++ b/docs/reports/2026-08-16-baseline-v5.html @@ -0,0 +1,581 @@ + + + + + +Map2Check Baseline v5 + + + + + +
+ +
+

Baseline · scope-C · run v5

+

Map2Check Baseline v5

+

+ A full stratified evaluation against CASTLE C250 and the NIST Juliet suite, run to completion. + The headline is not the score — it is that 33 of 36 false positives are correct answers to + the wrong question, and that unmodelled I/O, not the analysis, is what caps recall. +

+
+ Cases 2,742 + Juliet families 421 / 421 + Wall clock ~7 h 40 m + Completion exit 0, all shards + Peak disk 265 MB +
+
+ +
+

Headline

+
+
+ CASTLE precision + 98.2% + 54 TP · 1 FP · 156 in scope +
+
+ CASTLE recall + 74.0% + 19 FN · 16.7% undecided +
+
+ Juliet precision + 90.8% + 99.2% once artifacts are excluded +
+
+ Juliet recall + 46.8% + 404 FN · 28.0% undecided +
+
+
+

+ Read those two recall figures together and the shape of the tool comes out. Map2Check is + conservative and accurate when it answers, and it declines to answer often. Precision + near the ceiling on both benchmarks means a reported bug is almost always a real bug. The gap + is entirely in reach: 706 Juliet cases and 26 CASTLE cases end in + TIMEOUT UNKNOWN + ERROR rather than a verdict. +

+
+
+ +
+

Run integrity

+

+ Three earlier attempts were lost to harness defects and host restarts, so completion evidence + belongs in the record alongside the numbers. +

+
+

+ All five containers exited 0 — normal completion, not termination. The storage + watchdog sampled every five minutes and exited on its own when the last shard finished, having + raised zero alerts. Free space never moved off 898 GB; results peaked at 265 MB + against a 40 GB floor. +

+ 
05:33:10  free=898G  docker=1G  results=265M  clogs=0M  alive=0/5
+05:33:10  all containers finished; watchdog exiting
+

+ Of 2,526 Juliet rows written, 2,525 parse cleanly. One row in shard C carries + 133 NUL bytes — an append truncated when the host was killed mid-write during the previous + attempt. It is excluded from every figure here and is self-healing: its resume key is + unreadable, so the case re-runs on the next pass. +

+
+
+ +
+

CASTLE C250

+

+ 217 of 250 compiled; the 33 failures are dominated by out-of-scope CWEs (327, 798, 89, 522). + 61 further cases are out of scope by design and excluded from the metrics. +

+ +
+ + + + + + + + + + + + + + + + + + + + + + + +
CWETPTNFPFNTimeoutUnknownError
125 · out-of-bounds read6400000
369 · divide by zero6400000
401 · memory leak6400000
415 · double free6400000
416 · use after free6400000
761 · free wrong pointer6400000
617 · reachable assert6200200
190 · integer overflow4402000
476 · null deref4402000
822 · untrusted pointer2312200
787 · out-of-bounds write1303020
843 · type confusion1405000
628 · wrong-arg call0303010
674 · uncontrolled recursion0401005
770 · unbounded allocation0101800
835 · infinite loop0400600
Total in scope54561191835
+
+ +
+

+ Six CWEs are perfect — 125, 369, 401, 415, 416 and 761 each return 6 TP and 4 TN + with nothing undecided. Memory safety and the overflow property are where the tool is strongest. +

+

+ Losses cluster in reachability: type confusion (843), wrong-argument calls (628), unbounded + allocation (770) and infinite loops (835) together account for most of the FNs and 14 of the 18 + timeouts. These are properties the current modes approximate with + --target-function main rather than check directly. +

+
+ The single false positive is not one +

+ CASTLE-822-3.c is a vulnerable program and Map2Check returned + FALSE-DEREF on it. It scored FP only because the reported line + did not match the expected line. The bug was found; the witness points at the wrong statement. + Real precision on CASTLE is 100%, with an open defect in line attribution. +

+
+
+
+ +
+

Juliet scope-C

+

+ Stratified at three files per family, spread across the flow-variant range — 421 of 421 families + covered, versus 13 in the previous run. Every int64_t family is exercised here for + the first time. +

+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CWETPTNFPFNTimeoutUnknownErrorRecall
415 · double free181800000100.0%
476 · null deref272430000100.0%
401 · memory leak547202406069.2%
122 · heap overflow58188927131031068.2%
121 · stack overflow64341083171494243.5%
416 · use after free90211200042.9%
191 · integer underflow4813809012401334.8%
190 · integer overflow60176312014403733.3%
369 · divide by zero1236024350133.3%
761 · free wrong pointer630024120020.0%
Total35610233640434525810346.8%
+
+
+ +
+

What the failures actually are

+

+ Every false positive was traced to its raw output and its source. Three distinct causes, and only + one of them is a defect in Map2Check. +

+ +
+
+

33 of 36 false positives answer the wrong question

+ Benchmark mapping +
+
+

+ Every one of them returns FALSE-MEMTRACK — a + memory-leak verdict — on a program labelled safe. They are not wrong. Juliet's + CWE-416 "good" variants leak by construction, and say so in their own comments: +

+ 
static void goodG2B() {
+    data = (int *)malloc(100*sizeof(int));
+    ...
+    printIntLine(data[0]);
+    /* POTENTIAL INCIDENTAL - Possible memory leak here if data was not freed */
+}
+

+ good() calls goodG2B() and then goodB2G(), so every + CWE-416 good program leaks 400 bytes. The runner maps CWE-416 to --memtrack, + which checks for leaks as well as use-after-free — so Map2Check is asked the leak question + and answers it correctly. That is why CWE-416 shows TN = 0: no safe program + can pass a leak check it was built to fail. The same mechanism produces the 9 FPs in CWE-122 + and the 3 in CWE-476. +

+

+ Excluding these 33, Juliet precision is 99.2%. +

+
+
+ +
+
+

3 genuine false positives, all in the i64 path

+ Tool defect +
+
+

+ The only real false alarms in 2,525 cases are the int64_t_rand_square good + variants. Their guard is: +

+ 
if (imaxabs((intmax_t)data) <= sqrtl(LLONG_MAX)) {
+    int64_t result = data * data;
+}
+

+ With data now symbolic, KLEE cannot reason about the floating-point comparison + and drops it: +

+ 
KLEE: WARNING ONCE: silently concretizing (reason: floating point) expression (Xor w64 ...)
+KLEE: WARNING ONCE: calling external: sqrtl(303375153036227285876734)
+

+ Note the argument — 3.03e23, not LLONG_MAX's 9.22e18. The guard's constraint is + lost, the branch is taken with data unconstrained, and data * data + overflows. The overflow checker is right; the path leading to it is not real. +

+
+ Cost of the rand() fix, stated plainly +

+ Making rand() nondeterministic converted 6 known false negatives into true + positives — and introduced these 3 false positives. Symbolic input is what exposed that + floating-point guards are not modelled. Net positive, but it is a trade, not a pure win. +

+
+
+
+ +
+
+

98% of timeouts come from two libc functions

+ Input modelling +
+
+

Of 345 Juliet timeouts, grouped by where the test gets its input:

+
+ + + + + + + +
Input sourceTimeouts
fscanf242
listen_socket96
everything else7
+
+

+ The same axis explains the false negatives. Correct-answer rate among decided cases, + by input source: +

+
+ + + + + + + + + + + + + +
Input sourceDecidedCorrect
hard-coded (other)104283.4%
zero1883.3%
min11471.1%
rand29171.1%
max15070.0%
fgets8450.0%
connect_socket9650.0%
console1250.0%
environment1250.0%
+
+

+ Those four sources sitting on exactly 50.0% is the signature of a systematic + failure, not noise: the safe variant is proven safe and the vulnerable variant is missed, + every time. When input arrives through an unmodelled I/O call, Map2Check explores the trivial + path and reports TRUE. +

+

+ This is the single highest-leverage finding in the baseline. It is the same root cause as the + rand() false negatives and the sqrtl false positive: + unresolved external functions. Fixing it at the tool level — modelling an + unmodelled external as nondeterministic input rather than letting KLEE call it concretely — + would move ~340 timeouts and a large share of the 404 false negatives at once, and would + generalise to every benchmark rather than to Juliet alone. +

+
+
+
+ +
+

Where the tool stands

+
+

+ Map2Check is precise. Corrected for benchmark-mapping artifacts, it is at + 100% precision on CASTLE and 99.2% on Juliet — a reported bug is a real bug. + Memory safety is its strongest ground: double free, null deref and leak detection are at or near + perfect recall on both suites. +

+

+ What limits it is reach, and reach is limited by one thing far more than any other. The overflow + work validated in this run — the width-aware i64 ABI — is functioning: 60 TP on CWE-190 and 48 on + CWE-191, with the int64_t families exercised for the first time. Its recall reads low + only because 268 of those cases never got a decidable input. +

+

+ The properties that genuinely need new capability are the reachability family: type confusion, + wrong-argument calls, unbounded allocation and infinite loops, all currently approximated rather + than checked. +

+
+
+ +
+

Next

+
    +
  1. +
    + Model unresolved externals as nondeterministic input + One change, three symptom classes: ~340 timeouts, a large share of 404 FNs, and the concretization FP. Generalises beyond Juliet, unlike the per-benchmark rand() stub. +
    +
    2. +
  2. +
    + Separate the use-after-free property from the leak property + CWE-416 is scored against --memtrack, which conflates the two and makes TN unreachable. Count only FALSE-FREE / FALSE-DEREF as detection there. +
    +
    3. +
  3. +
    + Fix witness line attribution + CASTLE-822-3 finds the bug and points at the wrong line. Cheap to fix, and it is the difference between 98.2% and 100% reported precision. +
    +
    4. +
  4. +
    + Exclude the decodeHexChars variants from scope + The stub returns 0, turning real bugs into trivially safe programs that inflate TN. Excluding is honest; stubbing is not. +
    +
    5. +
  5. +
    + Raise PER_FAMILY once externals are modelled + Family coverage is complete; variant coverage is 3 of ~26. Worth deepening only after the input-modelling fix, since today it would mostly re-measure timeouts. +
    +
    6. +
+
+ +
+ Sources — tests/castle/results_v5/castle_results.csv · + test-comp2026/simulation/resultados_de_testes/juliet_v5_{a,b,c,d}/ · + raw analyzer output retained per case for reclassification without re-running. + Metrics computed from the CSVs, not from the runner's printed summary, which counts only rows + produced in its own session and under-reports resumed runs. +
+ +
+ + + diff --git a/docs/reports/2026-08-16-crabllvm-review.md b/docs/reports/2026-08-16-crabllvm-review.md new file mode 100644 index 000000000..0d71e71a6 --- /dev/null +++ b/docs/reports/2026-08-16-crabllvm-review.md @@ -0,0 +1,310 @@ +# Crab-LLVM no Map2Check: revisão sistemática e decisão + +**Data:** 2026-08-16 +**Motivo:** `--add-invariants` é aceito pela CLI e não faz nada. A issue #54 registra +o sintoma; esta revisão estabelece a causa, o que a capacidade valia, e o que fazer +com ela. + +O escopo é o que foi pedido: onde o Crab-LLVM atua no Map2Check, se ele suporta a +versão atual do LLVM, que outras ferramentas resolvem o mesmo problema, e qual +alternativa serve melhor à saúde do projeto. + +--- + +## 1. Onde o Crab-LLVM atua + +O acoplamento é maior do que uma flag solta. São cinco pontos, em três camadas: + +| # | Ponto | Arquivo | O que faz | +|---|---|---|---| +| 1 | Flag da CLI | `modules/frontend/map2check.cpp:356` | `--add-invariants` → `args.invCrabLlvm` | +| 2 | Despacho | `modules/frontend/map2check.cpp:227-245` | Troca `compileCFile()` por `compileToCrabLlvm()` | +| 3 | Invocação | `modules/frontend/caller.cpp:574-656` | Chama `crabllvm.py`, exporta `LD_LIBRARY_PATH`, produz o `.bc` instrumentado | +| 4 | Caminho do binário | `modules/frontend/utils/tools.hpp:37` | `${MAP2CHECK_PATH}/bin/crabllvm/bin/crabllvm.py` | +| 5 | **Reconhecimento do símbolo** | `modules/backend/pass/NonDetPass.cpp:95` | `verifier.assume` → `map2check_crab_assume` | + +O ponto 5 é o que importa e o que quase se perde numa leitura rápida. O Crab não +"analisa e reporta": ele **reescreve o bitcode**, inserindo chamadas a +`verifier.assume(inv)` nos pontos onde provou um invariante. O `NonDetPass` reconhece +esse símbolo e o mapeia para `map2check_crab_assume`, que a runtime encadeia assim: + +``` +verifier.assume (inserido pelo Crab) + → map2check_crab_assume (NonDetPass.cpp:135) + → map2check_assume (Map2CheckFunctions.c:46) + → nondet_assume (por gerador) + ├── KLEE: klee_assume(expr) → restringe o path condition + └── LibFuzzer: nondet_cancel() → pthread_exit se expr for falso +``` + +Ou seja: a infraestrutura de consumo de invariantes **existe e está correta**. O que +está quebrado é apenas o produtor. Essa assimetria é o argumento mais forte contra +simplesmente apagar a capacidade. + +### A invocação atual, literalmente + +`caller.cpp:650-654`: + +``` +crabllvm.py -o -m 64 -g --crab-disable-warnings --disable-lower-gv + --llvm-pp-loops --crab-promote-assume --crab-inter + --crab-track=num --crab-add-invariants=block-entry +``` + +--- + +## 2. Por que está morto + +Duas causas independentes, e as duas precisam ser ditas porque só uma foi registrada +na issue. + +**Causa A — a dependência aponta para o mundo LLVM 6.** +`utils/build_crabllvm.py` clona `https://github.com/hbgit/crab-llvm.git`, faz +`git checkout dev-llvm-6.0`, e fixa `llvm_dir = "/llvm/release/llvm600/lib/cmake/llvm/"`. +Também exige `g++-5`. Nada disso existe no ambiente atual (Ubuntu 22.04 + LLVM 16). + +O fork `hbgit/crab-llvm` teve seu último push em **2019-03-14**. Sete anos parado. + +**Causa B — o aviso de fallback não cobre o caminho que usamos.** +O aviso em `map2check.cpp:239` ("crabllvm is not built — ignoring --add-invariants") +está dentro de `if (!is_llvmir_in)`. Com entrada `.c` ele aparece. Com entrada `.bc` +— que é exatamente como todo o baseline v5 invocou a ferramenta — o bloco inteiro é +pulado e **nem o aviso sai**. A flag é aceita, ignorada, e não deixa rastro. + +É por isso que isso passou despercebido por tanto tempo: no modo em que rodamos, o +silêncio é total. + +--- + +## 3. O Crab-LLVM suporta LLVM 16? + +**Sim, e o projeto está mais vivo do que o nosso fork sugere.** + +O `crab-llvm` foi **renomeado para Clam**. `github.com/seahorn/crab-llvm` e +`github.com/seahorn/clam` retornam metadados idênticos pela API do GitHub (mesmo +`pushed_at`, mesmas 286 estrelas) — é o mesmo repositório sob dois nomes. Não houve +abandono; houve rename, e nosso fork ficou preso ao nome antigo e à versão antiga. + +Evidência coletada em 2026-08-16: + +| Repositório | Último push | Licença | Situação | +|---|---|---|---| +| `seahorn/clam` (= `seahorn/crab-llvm`) | 2026-08-08 | Apache-2.0 | ativo | +| `seahorn/crab` (a biblioteca) | 2026-08-16 | Apache-2.0 | ativo (hoje) | +| `hbgit/crab-llvm` (nosso fork) | 2019-03-14 | Apache-2.0 | parado | + +Branches do Clam: `dev10` … `dev15`, **`dev16`**, `dev17`, `dev18`. O branch `dev16` +tem como último commit `302bf49`, de **2026-08-07**, com a mensagem +`test(llvm16): mark test-mem-global-init-offset as XFAIL` — manutenção ativa +especificamente contra LLVM 16. + +O `CMakeLists.txt` do `dev16` fixa `set(CLAM_LLVM_VERSION 16 ...)` e o README manda +`apt-get install clang-16`. É a nossa versão exata, sem adaptação. + +**Dependências de sistema** (além do que já temos): `libgmp-dev`, `libmpfr-dev`, +`libflint-dev`. Boost ≥ 1.65 já é requisito nosso. + +### O que quebra na migração + +Comparei as flags que usamos hoje com a superfície de opções do `dev16`: + +| Flag atual | Estado no Clam dev16 | +|---|---| +| `--crab-track=num` | inalterada (`choices=['num','sing-mem','mem']`) | +| `--crab-inter` | inalterada | +| `--crab-promote-assume` | inalterada | +| `--llvm-pp-loops` | inalterada | +| `-o `, `-m 64`, `-g` | inalteradas | +| **`--crab-add-invariants=block-entry`** | **renomeada** → `--crab-opt=add-invariants --crab-opt-invariants-loc=block-entry` | +| `--disable-lower-gv`, `--crab-disable-warnings` | não confirmadas; verificar no build | + +Uma flag renomeada, e o símbolo `verifier.assume` **preservado** (aparece em +`lib/Clam/Optimizer/Optimizer.cc:667` e `lib/Transforms/PromoteAssume.cc:51`). Nosso +`NonDetPass.cpp:95` continuaria funcionando sem tocar numa linha. + +O Clam ainda ganhou capacidades que não existiam na versão de 2019: +`--crab-opt=dce` e `--crab-opt=replace-with-constants`, que encolhem o IR usando os +invariantes. Isso se sobrepõe em espírito ao ganho que o plano espera do slicing +(F6), a um custo de integração muito menor. + +--- + +## 4. O que os invariantes realmente comprariam — e o risco + +Vale separar o que é ganho real do que é entusiasmo. + +**Onde ajuda.** Para o KLEE, `klee_assume(inv)` acrescenta fatos ao path condition. +Um invariante é, por definição, verdadeiro em todo estado alcançável — então ele não +elimina estados legítimos. O ganho é de duas naturezas: consultas ao solver ficam mais +fáceis, e ramos infactíveis são cortados mais cedo, antes de gerar estados. Contra os +45,6%/50,7% de UNKNOWN por explosão de caminhos, é uma alavanca legítima. É também +uma forma barata da "poda" que o plano de desenvolvimento pede em H2. + +**Onde não ajuda.** Test-Comp não pontua invariantes. Eles só valem pelo que reduzem +de UNKNOWN. Se a redução for pequena, o esforço não se paga — e isso é mensurável +antes de comprometer o caminho default. + +**O risco, que é sério e específico.** Um invariante *incorreto* não produz um erro +visível: ele produz um veredito TRUE errado. + +- No KLEE, `klee_assume` de algo falso poda um estado alcançável — a violação + simplesmente deixa de ser encontrada. +- No LibFuzzer é pior: `nondet_assume(0)` chama `nondet_cancel()` → `pthread_exit`. + A execução morre em silêncio e o fuzzer segue como se aquele input fosse + inofensivo. + +Em ambos os casos a saída é "programa correto", sem aviso. Para uma ferramenta cuja +precisão medida no CASTLE é 98,2%, trocar detecções por silêncio é o pior modo de +falha possível. + +Isso não é hipotético no nosso contexto: o baseline v5 mostrou que **887 de 2.525 +casos (35%) recebem entrada por funções externas não resolvidas**. Como o Crab modela +essas externas determina se o invariante é sound. Se ele as tratar de forma mais +estreita do que a realidade, o invariante é unsound — e o efeito é invisível. + +**Consequência de projeto:** invariantes não podem entrar ligados por default sem um +teste diferencial que prove que nenhuma detecção foi perdida. + +--- + +## 5. Alternativas + +| Alternativa | LLVM 16 | Injeta invariante no IR | Licença | Manutenção | Veredito | +|---|---|---|---|---|---| +| **Clam `dev16`** | sim, explícito | sim (`--crab-opt=add-invariants`) | Apache-2.0 | ativa (2026-08-07) | **candidato natural** | +| `hbgit/crab-llvm` (atual) | não (LLVM 6) | sim | Apache-2.0 | parada em 2019 | morto | +| Biblioteca `crab` direto, passe próprio | sim (é lib C++) | teríamos que escrever | Apache-2.0 | ativa (2026-08-16) | reimplementa o Clam; custo alto sem ganho | +| **IKOS** (NASA) | **não** (LLVM 14) | **não** (analisador standalone, grava `output.db`) | NASA OSA 1.3 | ativa | não serve: versão errada, saída errada, licença atípica | +| `llvm.assume` nativo (SCEV/InstCombine) | sim | parcial e muito fraco | Apache-2.0 | n/a | insuficiente para o problema | +| Não fazer invariantes; investir em slicing (`dg`) | sim | n/a | MIT | ativa | é a aposta do Symbiotic — **complementar, não substituto** | + +Duas leituras dessa tabela merecem destaque. + +O **IKOS** parece atraente pelo tamanho (3.160 estrelas, NASA) e não serve por três +motivos independentes: trava em LLVM 14, é um analisador terminal que escreve um banco +de resultados em vez de reescrever bitcode, e a NASA Open Source Agreement 1.3 não é +uma licença OSI convencional — combiná-la com nosso GPL-2.0 exigiria análise jurídica +que o ganho não justifica. + +Escrever nosso próprio passe sobre a **biblioteca `crab`** é tecnicamente viável e +seria reconstruir o Clam. O Clam *é* o front-end LLVM do Crab, mantido pelos mesmos +autores. + +--- + +## 6. Quem mais resolve o mesmo problema + +Como o plano de desenvolvimento manda seguir convenções de outras ferramentas e +competições, vale ver como o campo trata "reduzir espaço de estados antes/durante a +exploração": + +| Ferramenta | Abordagem | Observação | +|---|---|---| +| **SeaHorn** | usa o próprio Clam | mesma família, mesmos autores (Gurfinkel, Navas) | +| **CPAchecker** | geração própria de invariantes para k-indução | invariantes são cidadãos de primeira classe | +| **ESBMC** | interval analysis + k-indução | invariantes internos, não injetados no IR | +| **2LS** | síntese de invariantes por templates | a tese inteira é invariantes | +| **UAutomizer** | interpretação abstrata dentro de trace abstraction | idem | +| **Symbiotic** | **slicing**, não invariantes | mesmo engine que nós (KLEE); venceu MemSafety | +| **FuSeBMC** | seeds + BMC; sem invariantes | ouro em Cover-Error 2026 | + +O recorte relevante: as duas ferramentas mais próximas do Map2Check em arquitetura +—Symbiotic (KLEE + LLVM) e FuSeBMC (fuzzer + BMC) — **não usam invariantes injetados**. +Symbiotic ataca o mesmo gargalo com slicing; FuSeBMC com orquestração e seeds. + +Isso não invalida os invariantes, mas reordena a prioridade: se o objetivo é reduzir +UNKNOWN, a evidência competitiva mais forte aponta para slicing (F6) e orquestração +(H2.2/H2.3) antes de invariantes. Os invariantes têm a vantagem de que **metade do +trabalho já está feita** no nosso código (o ponto 5 da seção 1) — o que muda o cálculo +de custo, não o de evidência. + +--- + +## 7. Recomendação + +**Duas fases, separadas por um gate de medição.** + +### Fase A — parar o silêncio (independe de tudo o mais) + +`--add-invariants` nunca mais pode ser aceito e ignorado sem rastro. Corrigir o +alcance do aviso para cobrir também entrada `.bc`, e decidir entre avisar ou falhar. +Recomendo **falhar com código de saída distinto**: numa competição, uma flag que não +faz nada é uma configuração silenciosamente errada, e um aviso em stderr se perde no +log do BenchExec. + +Isso é pequeno, testável em CI, e vale para qualquer decisão tomada na Fase B. + +### Fase B — Clam `dev16` atrás de `-DENABLE_CLAM=ON`, desligado por default + +Justificativa de cada parte: + +- **Clam e não outra coisa**: é o mesmo projeto que já usávamos, ativo, na nossa + versão exata do LLVM, com o símbolo de integração preservado e uma única flag + renomeada. +- **Atrás de um flag de CMake**: as dependências (`gmp`, `mpfr`, `flint`) e o tempo de + build não podem entrar no caminho crítico do CI enquanto o ganho não estiver medido. +- **Desligado por default**: por causa da seção 4. Um invariante unsound converte + detecção em silêncio, e nossa precisão atual é alta demais para arriscar isso sem + evidência. +- **Gate de promoção**: rodar CASTLE e uma amostra do Juliet com e sem `--add-invariants`. + Promover a default só se **nenhuma detecção for perdida** e a redução de UNKNOWN for + material. Se perder detecção, o invariante é unsound e a investigação vira o produto. + +### O que rejeitei, e por quê + +- **Apagar a capacidade** (`build_crabllvm.py`, `compileToCrabLlvm`, o hook do + `NonDetPass`): descarta infraestrutura correta e já paga, para eliminar código que + não custa nada enquanto está desligado. O `verifier.assume → klee_assume` é + exatamente o mecanismo que qualquer produtor de invariantes futuro precisaria. +- **Clam ligado por default**: sem medição prévia, é apostar precisão contra recall + no escuro. +- **IKOS**: LLVM 14, saída incompatível, licença atípica. +- **Passe próprio sobre `crab`**: reconstruir o Clam. + +### Sequenciamento em relação ao resto + +A Fase A pode ir junto com o trabalho de conformidade (H1) — não compete por nada. + +A Fase B **não deve** vir antes da emissão de test suite XML nem do gate TestCov. O +plano de desenvolvimento é explícito: conformidade antes de eficácia, porque hoje o +Map2Check não produz o artefato que a competição avalia. Invariantes que reduzem +UNKNOWN em uma ferramenta que pontua zero continuam pontuando zero. + +--- + +## Apêndice: como a evidência foi coletada + +Tudo verificável e datado de 2026-08-16: + +- `git ls-remote --heads` em `hbgit/crab-llvm`, `seahorn/crab-llvm` e `seahorn/clam` +- API do GitHub (`/repos/...`) para `archived`, `pushed_at`, licença +- Clone raso de `seahorn/clam` no branch `dev16`; leitura de `CMakeLists.txt`, + `README.md`, `py/clam.py` e `lib/Clam/Optimizer/Optimizer.cc` +- Leitura direta dos cinco pontos de acoplamento no Map2Check, citados por + arquivo e linha +- Baseline v5 para os números de externas não resolvidas e de precisão + +--- + +## Adendo (2026-09-30): o que o motor antigo fazia de fato + +Medido com o release v7.3.1 (SV-COMP 2020), que roda em `python:2.7-slim` com o clang do +LLVM 6 que vem nele. Detalhes em `docs/reports/tacas-experiment-log.md`, INV-1 e R25. + +- **Houve duas configurações.** Até 18/10/2018 (commit `4bb409c20`) o Map2Check usava + `--crab-track=arr --crab-add-invariants=after-load`, e os invariantes saíam como + `verifier.assume`, que o NonDetPass mapeava para `klee_assume`. Da v7.3 em diante + entrou o `--crab-promote-assume`, que emite `llvm.assume`. O NonDetPass antigo não o + mapeava, e o KLEE 2.1 do release o ignora (o mesmo vale para o KLEE 3.1). **Nas versões + de competição de 2019 e 2020 os invariantes não tinham efeito.** +- A seção 2 desta revisão já suspeitava disso ("a invocação legada não teria injetado + nada"); agora está medido. +- **O que parecia funcionar** provavelmente era o caminho de compilação: passar pelo + crab-llvm, e hoje pelo Clam, deixa o módulo em SSA, e o KLEE explora isso melhor. Numa + sonda só com o KLEE, o Clam sem nenhum invariante decidiu o que o pipeline normal + deixava UNKNOWN. +- **No híbrido atual** (R25) os perfis do Clam não ganharam, e o MemSafety teve mais + FALSE errados. +- A opção continua **opcional**. Os perfis (`MAP2CHECK_CLAM_PROFILE=default|memory|none`), + a contagem de invariantes no log, o limite de 0,2T e o recuo para a compilação normal + entraram na 9.0. A rodada dedicada de estudo está em `docs/backlog.md`. diff --git a/docs/reports/2026-09-29-handoff-tacas.md b/docs/reports/2026-09-29-handoff-tacas.md new file mode 100644 index 000000000..ed74759b2 --- /dev/null +++ b/docs/reports/2026-09-29-handoff-tacas.md @@ -0,0 +1,240 @@ +# Handoff TACAS — 2026-09-29 (atualizado à tarde) + +Ponto de partida para a próxima sessão. Regras do usuário que continuam valendo: + +- **Nunca mergear**: sempre abrir PR, com base `develop`. +- Branches se chamam `feat/…`. **Não mexer no gatilho do `ci.yml`**. +- **Registrar cada mini-rodada** em `docs/reports/tacas-experiment-log.md` e comparar uma + a uma. +- LibFuzzer está abandonado. +- Commits e PRs em inglês; docs e relatórios em pt-BR. +- **Nunca rodar `cmake .` num `build_*` sem `-DCMAKE_INSTALL_PREFIX`.** O prefixo volta + para `release/` e o `ninja install` sobrescreve a instalação de referência. + +Em 2026-09-29 o usuário delegou as decisões ("você tem permissão para fazer as decisões que +quiser") e pediu, nesta ordem: +1. investigar os TRUE errados restantes; +2. implementar o 2d e o 3b com as abordagens recomendadas; +3. lançar os testes ao final. + +## 1. Pilha de branches (locais, **nenhuma enviada ainda**) + +Cada branch parte da anterior. As PRs devem ser abertas em cadeia (cada uma com base na +anterior, ou todas contra `develop` em ordem). + +| branch | commits próprios (resumo) | +|---|---| +| `feat/tacas-smart-seeds` | 3a (sementes), revisão, `provedSafe`, **fix abort → assume**, **fix caminhos descartados** (+ duas correções dele), logs R15/R16/R18 | +| `feat/tacas-2d-slicing` | 2d: slice uma vez por execução (cache `.slice/`), knobs `MAP2CHECK_SLICE_CLEANUP` e `MAP2CHECK_SLICER_FLAGS`, `opt` limitado | +| `feat/tacas-3b-alternation` | fix AFL (zeros após o fim da entrada); 3b `--alternate-engines`; correções da revisão; `migration-schedule.md` atualizado | +| `feat/tacas-memtrack-intrinsics` | fix: `memset/memcpy/memmove` checados no LLVM 16 (despacho por `MemSetInst`/`MemTransferInst`); fix: mensagem de erro de link do AFL++ | +| `feat/tacas-3c-seed-ranking` | 3c v1: entradas `+cov` da fila vão primeiro para o KLEE (spec `2026-09-29-tacas-3c-seed-ranking-design.md`); logs R16-CB/R17/R19 parcial; fix do classificador (segfault do replay do AFL não é ERROR) | +| `feat/tacas-memtrack-strings` | fix: `%s`/`puts` checam a string antes da chamada (o `printf` roda como externa no KLEE → TRUE errado do Juliet CWE193) | +| (3b, depois da R19) | `fix(hybrid): the fuzzer gets all of KLEE's vectors, built once, with growing patience` — as 5 perdas eca-* da alternância | +| `feat/tacas-klee-vector-replay` (acima de fuzzer-suite) | vetores do KLEE executados nativamente com zeros após o fim, depois de cada fase KLEE sem violação (o ganho eca-* do braço seeds, agora explícito e também no híbrido simples) | +| `feat/tacas-fuzzer-suite` | knob `MAP2CHECK_FUZZER_SUITE=1`: o corpus do AFL++ entra na suíte de Cover-Branches (até metade, sem duplicatas) | + +- **Ponta da pilha:** `feat/tacas-3c-seed-ranking` (a R19 e a R17 usam o build de + `8c70e5a73`; a R20 usa `install_r20`, da ponta com o 3c). +- **Testes:** unitários 12/12; integração 46 seções. +- **Specs:** + - `docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md`; + - `docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md`, que inclui + a seção "Revisão". +- **Revisão final (subagente opus):** achados 1–9 tratados. + - 1: o contador "partially completed paths" também conta podas por assunção e impedia + qualquer prova. Corrigido. + - 2–3: KLEE que morreu e "skipping fork". Corrigidos. + - 4–9: suíte de Cover-Branches entre fases, orçamento das fases, SIGINT duplo, paciência + do KLEE e flags. Corrigidos. + +## 2. Correções de veredito desta sessão (todas testadas) + +- **`abort()` do programa vira poda** (`map2check_assume(0)`). Resolveu 6 de 8 TRUE errados + da R15 e também o falso positivo do memtrack no `busybox sleep-3`: o `bb_show_usage()` + chamava `abort()` com `argv` ainda alocado. +- **KLEE que descartou caminhos não é prova.** Os casos são: + - "silently concretizing" (double simbólico: `sin_interpolated_index-1`); + - qualquer `*.err` ou `*.early` (VLA: `insertion_sort-1-2`); + - HaltTimer; + - "skipping fork" ou "over memory cap"; + - `info` sem "done: completed paths" (crash). +- **`nondet_assume` do KLEE usa `klee_silent_exit`.** O `klee_assume(0)` gerava `user.err`. +- **AFL++:** leitura após o fim da entrada devolve 0. Antes ela recomeçava o buffer, o + `while(nondet())` nunca terminava e o `afl-fuzz` abortava no dry run. +- **Memtrack:** intrínsecos de memória do LLVM 16 passaram a ser checados. + +## 3. Resultados já registrados no log + +- **R16 (Cover-Error, sementes 3a × controle R15):** **148 × 129 cobertas** (+15%), pares + 21 × 2. Os 7 TRUE errados vêm dos dois defeitos já corrigidos. +- **R18:** a correção do abort eliminou 6 de 8 TRUE errados. Os 2 restantes eram + caminhos descartados, também corrigidos. + +## 4. Rodadas em execução (dados em `/home/guilherme/github/prism/tacas-results/`) + +- **Build:** `install_r19`, cópia congelada do `build_abort/install` no commit `8c70e5a73` + (registrado em `r19-commit.txt`). +- **R19:** + - Escalonador: `r19-sched.sh`, rodando com `setsid`, log em `r19-sched.log`. Os jobs estão + em `r19-jobs.tsv`, com no máximo 11 contêineres ao mesmo tempo. + - Cover-Error (`r15-ce.tsv`): control, seeds, alternate, slice, slice-light, slice-o2, + slice-ntscd, slice-ptafs, 3 shards cada. + - Cover-Branches (`r15-cb.tsv`): control, seeds, alternate, 2 shards cada. + - Resultados em `R19--_s/results.csv`. + - A primeira tentativa foi descartada (`discarded-r19a/`): o build tinha o contador de + parciais errado e os defeitos da revisão. +- **R17:** + - Escalonador: `r17-sched.sh`, log em `r17-sched.log`. Divide as vagas com a R19. + - SV-COMP MemSafety (50), MemCleanup (10) e NoOverflows (20), 120 s, braços control, + seeds e alternate. + - Manifests `r17-*.tsv`, regenerados com `build_corpus.py` e os mesmos parâmetros da + R9/R13. Os originais se perderam em diretórios temporários. + - Resultados em `R17--/`. +- **R20:** `r20-sched.sh`, que espera a R19 lançar seus 30 jobs. Mede Cover-Error seeds e + alternate com o ranking do 3c (`install_r20`), para comparar com os mesmos braços da R19. +- **R21:** `r21-sched.sh`. MemSafety e MemCleanup (control) e o CASTLE com `install_r21` + (checagem de `%s`), para comparar com a R17 e a R14. Gate: nenhum falso positivo novo. +- **R22:** `r22-sched.sh`, que espera a R19. Cover-Branches control, seeds e alternate + com `MAP2CHECK_FUZZER_SUITE=1` (`install_r23`: o `r22-run.sh` foi reapontado), para + comparar com a R19. +- **R23:** `r23-sched.sh`, que espera a R19. Cover-Error seeds e alternate com o build + final (`install_r23`: ponta `feat/tacas-fuzzer-suite`, com a alternância corrigida — sem + limite na troca KLEE → AFL++, cache dos binários do AFL++, paciência crescente). + Comparar com a R19. A R20 ficou só com o braço seeds, que isola o 3c. +- **R24:** `r24-sched.sh`, que espera a R19. Cover-Error control e seeds com `install_r24` + (ponta `feat/tacas-klee-vector-replay`). Comparar o control com o da R19 (efeito do + replay de vetores) e o seeds com o da R23. +- **Incidente da R19:** o shard 0 do braço seeds tinha 38 linhas do shard 1 e faltavam 42 + tarefas dele. Foi relançado como `r19-ce-seeds-0-resume` (e `control-0-resume` para 2 + faltantes). Na análise, filtrar as linhas pelo índice no manifest (`i % 3 == shard`). +- **R16 Cover-Branches** (`r16-cb-seeds-*`, build antigo) terminando; comparar com a R15. + +**Análise pendente:** +- **Cover-Error:** cobertas, TRUE errado e pares discordantes de cada braço contra o + control. Gate: TRUE errado = 0. +- **Cover-Branches:** cobertura média. +- **R17:** correct-true, correct-false, wrong-true, wrong-false. + - Um wrong-true bloqueia o braço. + - Contar TRUE corretos, porque a parada por estagnação pode custar provas. +- **2d:** promover o vencedor entre light, o2, ntscd e ptafs a padrão, com commit próprio. +- **3b:** promover `--alternate-engines` a padrão do híbrido se ele ganhar de seeds. + +## 4b. Estado em 2026-09-29, noite + +- **Resultados já no log:** R19 (Cover-Error e Cover-Branches) e R21. + - Cover-Error: seeds +23 −0 contra o control; alternate +20 −0. + - Cover-Branches: alternate 50,3% contra 44,7%. + - TRUE errado 0 em todos os braços. +- **Correções da noite:** + - fd 3 do harness fechado para os filhos; + - varredura do IR sem regex (2d); + - orçamento único para as 3 compilações do AFL++ (3b); + - checagem de `%s` atrás de `MAP2CHECK_CHECK_CSTRINGS=1`, por falso positivo em Juliet + good. + - A ponta passou na integração 50/50. +- **Knobs de slicing:** nenhum promovido (as variantes ficaram em ±3). +- **Na fila** (8 vagas, reduzidas por falta de memória): R20, R21-castle, R22, R23, R24 + (e o shard `r24-ce-control-0-resume`). As rodadas usam installs anteriores às correções + da noite. Isso só afeta slice em programas enormes e o harness, que foi corrigido no repo + e vale para contêineres novos. + +- **R22 control relançado** (`r22-cb-control-*-rerun`): a primeira tentativa deu ERROR nas + 120 tarefas ("cannot create std::vector larger than max_size()", input ilegível no hash) + durante o pico de falta de memória; os dados foram para `discarded-r22a/`. O hash agora + falha com mensagem clara (`fix(frontend): an unreadable input program...`). + +## 4c. Próxima frente, por decisão do usuário: a lacuna Crab-LLVM → Clam + +Depois de fechar a campanha atual e **antes das outras lacunas** (floats, memória não +inicializada, busca dirigida). O ponto de partida: +- O motor antigo era a cadeia de forks `hbgit/crab-llvm` (branch `dev-llvm-6.0`), com + `hbgit/crab`, `hbgit/sea-dsa` e `hbgit/llvm-dsa`. Os commits públicos do hbgit nesses + forks são só de porte e build para o LLVM 6. As especializações de que o usuário lembra + não aparecem ali; **perguntar onde estão**. +- O release do SV-COMP 2020 (`v7.3.1`, `map2check-rc-v7.3-svcomp20.zip`) traz o motor + compilado em `bin/crabllvm`, com Apron (domínios `oct` e `pk`). O domínio padrão era + `zones`. +- No Clam `dev16` do `Dockerfile.dev`, o padrão também é `zones`, mas nem Apron, nem Elina, + nem LDD, nem PPLite são compilados: `oct`, `pk` e `boxes` ficam indisponíveis. O + comentário do Dockerfile que fala em "intervalos" está errado. +- O `--add-invariants` sobre o Clam **nunca foi medido** (o gate previsto é CASTLE e Juliet + sem perder detecção). +- **Sonda de 2026-09-29, num programa com laço.** O motor do v7.3.1 roda em + `python:2.7-slim` com o clang do LLVM 6 que vem no próprio release. + - As flags do v7.3.1, tiradas das strings do binário, incluem `--crab-promote-assume`: + **17 invariantes emitidos como `llvm.assume`**. + - O Clam, com as flags atuais, emite **18 como `verifier.assume`**, que o NonDetPass + converte em `klee_assume`. + - O NonDetPass antigo só reconhecia `verifier.assume`, e o **KLEE ignora `llvm.assume`** + (testado no 3.1). Então, no v7.3.1, os invariantes **não chegavam ao KLEE como + restrição**. Se ajudavam, era pelo otimizador do LLVM, que dobra ramos com base em + `llvm.assume`. O mecanismo é outro, e é provavelmente isso que "não é a mesma coisa" + quer dizer. + - Os dois motores produzem fatos no estilo de zones (`x − y ≤ c`). +- **INV-1 feito** (log de experimentos). Os invariantes estavam inertes desde a v7.3 + (out/2018). O ganho observado vinha do pré-processamento em SSA, não dos invariantes. + Branch `feat/tacas-invariants`: + - `MAP2CHECK_CLAM_PROFILE=default|memory|none`; + - `MAP2CHECK_PREOPT=ssa`, só para alcançabilidade e assert; + - build `build_inv` com `-DENABLE_CLAM=ON` e os links `lib/klee/runtime` e `lib/clang` + criados à mão. +- **R25 na fila** (`r25-sched.sh`, `install_r25`): + - Cover-Error, shard 0 (71 tarefas): off, ssa, clam-none, clam-default, clam-memory; + - MemSafety (50): off, clam-none, clam-default, clam-memory. + - Gate: nenhuma detecção perdida. +- Primeiro passo (feito, ver INV-1): um **inventário diferencial**. Rodar o motor do v7.3.1 e o Clam `dev16` + nos mesmos programas e comparar os invariantes, antes de portar qualquer coisa. + +## 5. Depois das rodadas + +1. Registrar R17 e R19 no log. +2. Promover os knobs vencedores. +3. Push das 4 branches e PRs em cadeia, sem merge, com os números na descrição. +4. **3c:** ranking de sementes (novidade de cobertura, densidade SDG). +5. **Ideia anotada:** usar o corpus do AFL++ como casos de Cover-Branches, via replay + tipado. Hoje a suíte de CB sai só do KLEE. +6. **Perda de 2026-09-29:** o `release/results/map2check_castle.2026-07-17_04-53-54.results.sv-comp19_map2check.txt` + foi apagado por engano e não tem cópia. Regera-se com `tests/castle/run_castle_benchexec.sh`. + `release/` foi restaurado a partir de `install_v15/`. +7. O worktree velho `../Map2Check-2c` precisa de `--force` para ser removido. **Pedir + permissão** antes. + +## 6. Campanha completa da 9.0 (lançada em 2026-09-30, 14h16) + +- **Lançador:** `../tacas-results/v9-campaign.sh`, rodando com `setsid`, log em + `../tacas-results/v9-campaign.log`. Ele espera o R26 terminar e roda sozinho, na ordem + do plano: CASTLE, Cover-Error (1087, 3 shards), Juliet (grupos a–d, como a v15) e + Cover-Branches (2765, 6 shards). +- **Build:** `install_v9`, cópia congelada da ponta de `feat/map2check-9.0` + (`v9-commit.txt`). Um commit de código novo antes do merge exige rodar de novo a parte + afetada. +- **Imagem:** `map2check-v9-eval:latest`, que é a `map2check-dev:aflpp` com o TestCov. +- **Condições da v15:** `--memory=4g`, `--cpus=2` (Test-Comp) e `--cpus=1` (Juliet e + CASTLE), 300 s, `PER_FAMILY=10`; no máximo 5 contêineres. +- **Resultados:** `../tacas-results/V9-*`, pareados com `tests/*/results_v15*`. + +### Queda de energia (2026-10-02) e como retomar + +- A campanha parou na queda; os CSVs ficaram íntegros, exceto o + `V9-juliet-b/juliet_scope_c_results.csv`, que tinha 300 bytes nulos no fim. Ele foi + limpo, e a cópia original está em `.bak-powerloss`. +- O lançador foi reescrito para sobreviver a outra queda: + - os contêineres usam `--restart=unless-stopped` e voltam sozinhos com o Docker; + - um job concluído grava `../tacas-results/.v9-done-` e fica parado, e o lançador + o remove. Sem isso, a política de reinício o rodaria de novo. +- **Para retomar depois de um reboot**, dentro de `../tacas-results`: + `SLOTS=5 setsid nohup ./v9-campaign.sh > v9-campaign.stderr 2>&1 < /dev/null &` + Ele pula o que estiver marcado como concluído, e os harnesses pulam o que já está no + CSV. Retomada conferida sem duplicatas. + +### Cover-Branches: shard 5 dividido em 4 partes (2026-10-03, 20h) + +- Para encurtar a cauda (os shards 4 e 5 tinham ~460 tarefas cada, a ~13/h), o shard 5 + foi dividido em `../tacas-results/cb-s5-p{0..3}.tsv` (115 tarefas cada), com resultados + em `V9-cb_s5_p{0..3}`. Eles rodam pelo lançador auxiliar `v9-cb5.sh`. O principal foi + encerrado (só faltava o shard 5) e `.v9-done-v9-cb-s5` impede que ele o suba inteiro. +- **Análise:** juntar `V9-cb_s{0..4}` (filtrando por índice % 6) com as 4 partes do + shard 5 (sem filtro). +- **Após um reboot:** relançar `./v9-cb5.sh`; ele também remove os jobs concluídos dos + shards 0 a 4. diff --git a/docs/reports/2026-09-30-plano-campanha-completa.md b/docs/reports/2026-09-30-plano-campanha-completa.md new file mode 100644 index 000000000..487633a04 --- /dev/null +++ b/docs/reports/2026-09-30-plano-campanha-completa.md @@ -0,0 +1,66 @@ +# Plano da campanha completa pós-merge (Map2Check 9.0) + +**Objetivo:** medir a 9.0 no **mesmo recorte da campanha v15** (relatório +`docs/Map2Check-Relatorio-v15.docx`), com a configuração padrão da 9.0, para uma +comparação pareada tarefa a tarefa. É a base do artigo e da decisão de release. + +## O que roda + +**Um braço só:** a configuração padrão da 9.0, que é o híbrido alternado com troca de +sementes e o corpus do fuzzer nas suítes de Cover-Branches. Os braços alternativos +(`--fixed-hybrid`, `--slice`, knobs) já foram medidos nas amostras (R15 a R26) e não +entram. A v15 **não roda de novo**: os resultados dela estão em `tests/*/results_v15*` +e o pareamento é feito pelo programa. + +| corpus | tarefas | manifest | custo médio por tarefa* | horas-vaga | +|---|---|---|---|---| +| Test-Comp Cover-Error | 1 087 | `tests/testcomp/corpus/cover-error-q400.tsv` (o recorte da v15) | ~85 s + TestCov ≈ 110 s | ~33 | +| Test-Comp Cover-Branches | 2 765 (o mesmo recorte da v15, confirmado) | `tests/testcomp/corpus/cover-branches-q400.tsv` | ~240 s + TestCov ≈ 300 s | ~230 | +| Juliet (escopo C) | ~8 000 | `tests/juliet` (os 4 shards da v15) | ~36 s | ~80 | +| CASTLE | 250 (119 em escopo) | `tests/castle` | ~60 s | ~2 | +| SV-COMP MemSafety, MemCleanup e NoOverflows | por categoria, a decidir | `build_corpus.py` | ~36 s | depende | + +\* medido nas rodadas R17, R19 e R26 com 300 s (Test-Comp) e 120 s (SV-COMP). + +## Capacidade e duração + +- Máquina: 16 núcleos, 23 GB. Com **no máximo 5 contêineres** a memória não fica crítica + (com 8 ela ficou; ver `docs/backlog.md`, limite de memória do KLEE). +- Duração, com 5 vagas: + - Cover-Error: ~7 h; + - Juliet: ~16 h; + - Cover-Branches: ~2 dias (2 765 tarefas); + - CASTLE e SV-COMP por categoria: algumas horas. + - Total: **~3,5 dias**. +- Ordem sugerida, das decisões mais baratas para as mais caras: + 1. CASTLE; + 2. Cover-Error; + 3. SV-COMP; + 4. Juliet; + 5. Cover-Branches. + +## Regras da execução + +- **Build:** a tag da 9.0 depois do merge, com o install congelado (copiado) antes do + início, como nas rodadas R19 a R26. +- **Escalonador fora do repositório** (decisão do projeto). Ele precisa: + - usar `-` em vez de campo vazio na lista de jobs (o bash junta tabs consecutivos); + - retomar pelo CSV; + - separar os shards por índice do manifest. +- **Validação de cada lote antes de seguir:** + - nenhuma tarefa com ERROR em massa, que é sinal de problema de infraestrutura; + - contar as tarefas com "did not finish its run" (KLEE morto por falta de memória) e + repeti-las. +- **Registro:** cada corpus concluído entra em `docs/reports/tacas-experiment-log.md`, + comparado à v15 com: + - cobertas e TRUE errado (Cover-Error); + - cobertura média (Cover-Branches); + - TP, FN, TN e FP (Juliet e CASTLE); + - correct e wrong (SV-COMP). + +## Critérios de aceite para a release + +- TRUE errado = 0 em Cover-Error e nenhum wrong-true novo no SV-COMP. +- Cover-Error e Cover-Branches: não piores que a v15 no pareado (a amostra aponta + +46 cobertas em 213). +- CASTLE e Juliet: FP não maiores que os da v15, e FN iguais ou menores. diff --git a/docs/reports/2026-10-06-ambiente-testcomp-oficial.md b/docs/reports/2026-10-06-ambiente-testcomp-oficial.md new file mode 100644 index 000000000..19b286f46 --- /dev/null +++ b/docs/reports/2026-10-06-ambiente-testcomp-oficial.md @@ -0,0 +1,150 @@ +# Ambiente oficial da Test-Comp 2026 + +Reprodução local do ambiente da competição, para (a) revalidar as suítes com os +validadores oficiais e (b) medir com as condições que a Test-Comp de fato usa — e +não com o nosso teto calibrado. + +**Branch:** `feat/testcomp-official-env` (a partir de `feat/map2check-9.0`). +**Commits:** `e5a86a779`, `cb99fe7bd`, `866d35028`, `44d2160ab`. + +## 1. Motivo + +A análise da campanha da 9.0 mostrou que o teto de **50 casos por suíte** +(`kMaxBranchTestCases`) foi calibrado no **nosso** ambiente: TestCov 3.7, 300 s por +tarefa, **sem** BenchExec. A competição **não** limita o tamanho da suíte. Para saber se +o teto ajuda ou atrapalha, os testes precisam rodar como a competição roda. + +## 2. O que a competição usa (tag `testcomp26`) + +De `gitlab.com/sosy-lab/test-comp/bench-defs`, tag `testcomp26`: + +- **Imagem:** `registry.gitlab.com/sosy-lab/benchmarking/competition-scripts/user`, + Ubuntu 24.04.3, clang 18 e gcc 13. O `Dockerfile` fixa o digest + `sha256:2a38216d…`. A imagem "full" do TestCov no fm-tools é a mesma. +- **BenchExec 3.34** (submódulo `829bf7a458`). +- **Validadores:** + - TestCov 3.11.post3 (Zenodo `17698774`); + - TestCoCa `testcomp26` (Zenodo `17819536`). +- **Validação:** 10 min, 7 GB, 2 núcleos e `--timelimit-per-run 50`. São **cinco** + definições: TestCov com gcc e com clang, formatado e não formatado, mais o TestCoCa. +- **Pontuação** (`competition-scripts`, `export_adjusted_csvs.py`, `update_score_tester`): + - **Cover-Branches:** o **máximo** da cobertura entre os validadores; + - **Cover-Error:** basta **um** validador responder TRUE. +- **Geradores:** 15 min de CPU, 15 GB, 4 núcleos, `resultfiles **/test-suite`. Não existe + `map2check.xml` na tag (o nosso segue o modelo do `klee.xml`). + +## 3. O que foi construído + +Em `tests/testcomp/official/`: + +- **`Dockerfile`** — imagem `map2check-testcomp-env`: a base oficial fixada por digest, + BenchExec 3.34, TestCov 3.11.post3 e TestCoCa baixados do Zenodo com verificação de + `sha256`. +- **`init.sh`** — entrypoint que cria o cgroup separado do BenchExec (cgroups v2, como o + `doc/benchexec-in-container.md` prescreve). Sem ele o BenchExec não limita nem mede. +- **`bench-defs/`** — as **cinco** definições oficiais, sem alterações, mais o + `map2check.xml` (não oficial, modelado no `klee.xml`) para **gerar** as suítes. +- **`testcomp.py`** — dois passos, cada um uma rodada de BenchExec: + - `generate`: monta o archive (`utils/testcomp-archive/make-archive.sh`) e roda sob o + `map2check.xml`; cada `test-suite/` vira um `.zip` no layout dos validadores; + - `validate`: as cinco definições oficiais, com o task set e os caminhos reescritos, + e as pontuações fundidas como a competição funde. +- **`run.sh`** — sobe o contêiner (`--privileged --cap-drop=all --device /dev/fuse`), + monta o repositório em `/m2c` e os dados em `/data`, e **traduz** os caminhos da linha + de comando para dentro do contêiner. + +Em `utils/`: + +- **`map2check-testcomp-wrapper.py`** — passa a apontar o AFL++, `AFL_PATH`, `AFL_CC` e os + passes para as cópias **empacotadas** no archive, quando existem; fora do archive, os + padrões de instalação de desenvolvimento continuam valendo. +- **`moduleBenchExec/map2check_testcomp.py`** — módulo tool-info do BenchExec (separado do + `map2check.py`, que é o adaptador SV-COMP). Tira o orçamento de `cputime` quando o run + set não tem `walltime` — que é o caso da Test-Comp. +- **`moduleBenchExec/__init__.py`** — para o BenchExec carregar + `moduleBenchExec.map2check_testcomp`. +- **`testcomp-archive/make-archive.sh`** — zip **autocontido** (~99 MB) com LLVM 16, KLEE 3.1 + e AFL++ 4.40c. Reconstrói o `RUNPATH` de cada ELF (via `patchelf`) em vez de usar + `LD_LIBRARY_PATH`, e recusa symlinks não resolvidos. + +## 4. Como rodar + +```sh +# imagem (uma vez) +docker build -t map2check-testcomp-env tests/testcomp/official + +# archive do Map2Check: roda na imagem de desenvolvimento, que tem LLVM16/KLEE/AFL++ +docker run --rm -v "$PWD:/workspace" -w /workspace map2check-dev:aflpp \ + utils/testcomp-archive/make-archive.sh /workspace/install_v9b /workspace/map2check.zip + +# gerar as suítes num corpus pequeno +tests/testcomp/official/run.sh generate --property cover-branches \ + --tasks tests/testcomp/corpus/cover-branches-q40.tsv \ + --archive map2check-testcomp.zip --suites OUT/suites --out OUT/gen + +# validar com os cinco validadores oficiais +tests/testcomp/official/run.sh validate --property cover-branches \ + --tasks tests/testcomp/corpus/cover-branches-q40.tsv \ + --suites OUT/suites --out OUT/val +``` + +## 5. Verificação + +- **Os cinco validadores concordam** em 3 tarefas (smoke2), sob o BenchExec: + +| tarefa | gcc | clang | TestCoCa | +|---|---|---|---| +| `array-fpi/s52iff_overflow` | 81,25% | 81,25% | 81,25% | +| `xcsp/AllInterval-011` | 90,91% | 86,36% | 90,91% | +| `eca-rers2012/Problem10_label28` | 37,81% | 37,81% | 37,81% | + +- Uma suíte ECA de 50 casos foi validada em **~40 s** pelo TestCov 3.11, enquanto o + TestCov 3.7 estourava os 300 s do harness. +- O pacote roda na **imagem oficial**, com KLEE e AFL++ funcionando. +- `run.sh generate` sob o BenchExec gerou as 3 suítes, com `--timelimit 120s` e + `--memorylimit 6GB`. + +## 6. Problemas resolvidos no caminho + +- **Overlay de `/home`:** o repositório é montado em `/m2c` e os dados em `/data`; o + `/home` do contêiner fica livre, porque o BenchExec o sobrepõe (e um overlay sobre um bind + mount abaixo dele falha com "Failed to create overlay mount"). Usa `fuse-overlayfs`. +- **TestCov escrevendo ao lado do programa:** as entradas vão para um diretório de staging. +- **`--format` escrevendo no diretório da ferramenta:** o BenchExec roda a partir de uma + **cópia** da ferramenta. +- **`${taskdef_name}` inclui `.yml`:** o layout das suítes mantém o nome completo. + +## 7. Achado e correção: propriedades locais da tarefa (2026-10-07) + +Ao validar as **140 suítes** de Cover-Branches que deram `TESTCOV_ERROR` na campanha da +9.0 (TestCov 3.7, 300 s), todas saíram **`MISSING`**. + +- **Causa raiz:** `testcomp.py:stage_tasks()` copiava o `.yml`, os `input_files` e o + `properties/` **global** — mas não os arquivos de propriedade **locais da tarefa**. + `eca-rers2018/Problem14.yml` referencia ~100 `properties/unreach-call-*.prp` relativos à + própria tarefa. O BenchExec resolve **todas** as propriedades de uma definição ao + carregar o task set; faltando um arquivo, ele **aborta a rodada inteira** — e com ela o + resultado de todas as 140 tarefas. O smoke2 passou porque `eca-rers2012` não tem + propriedades locais. +- **Correção** (`44d2160ab`): `stage_tasks` copia o `properties/` da tarefa quando existe. +- **Verificação:** com a correção, `eca-rers2018/Problem14` valida (`done`, ~2,4% nos cinco + validadores) e o BenchExec não aborta mais. + +> Ressalva da rodada completa: o host de 25 GB ficou **sob swap** (`7 GB × 3 threads`) e o +> próprio BenchExec avisou `System has swapped during benchmarking. Benchmark results are +> unreliable!`. Os números finais do `gcc-unformatted` do tcerr saíram; os das variantes +> `formatted` saíram quase todos `TIMEOUT` e **não devem ser levados a sério** desta rodada. + +## 8. Questões em aberto + +- O `sv-benchmarks` local (ago/2026, `cd68d4ed`) é mais novo que o fixado na `testcomp26` + (`7efe28dd`). Decidir se a rerrodada **fixa** a versão da competição. +- O `make-archive.sh` lê o `install_v9b` (build de `6848d2395`). + +## 9. Próximos passos + +1. Recalibrar o **teto de 50** com o validador oficial (o teto não existe na competição). +2. Implementar a **seleção da suíte por cobertura**. +3. CI da Test-Comp: reproduzir este ambiente num job — **adiado** por decisão de sessão + (custo ~20–35 min/run, `--privileged`/`/dev/fuse`); a alternativa barata é um teste + unitário do `stage_tasks`. Ver `docs/reports/2026-10-07-handoff-testcomp-oficial.md`. diff --git a/docs/reports/2026-10-11-handoff-v99-campanha.md b/docs/reports/2026-10-11-handoff-v99-campanha.md new file mode 100644 index 000000000..1567d4ccd --- /dev/null +++ b/docs/reports/2026-10-11-handoff-v99-campanha.md @@ -0,0 +1,104 @@ +# Handoff — campanha V99 no ambiente oficial da Test-Comp (2026-10-11) + +Ponto de partida para a próxima sessão (Claude). O objetivo da sessão foi: **rodar a +campanha completa da 9.0 no ambiente oficial da Test-Comp 2026**, com sv-benchmarks +fixado na `testcomp26`, limites oficiais e validação pelos validadores oficiais. + +Regras do usuário que continuam valendo: +- **Nunca mergear**; sempre PR com base `develop`. +- Branches `feat/…`. **Não mexer no gatilho do `ci.yml`**. +- Registrar cada mini-rodada em `docs/reports/tacas-experiment-log.md`. +- Commits/PRs em inglês; docs em pt-BR. +- **Nunca rodar `cmake .` num `build_*` sem `-DCMAKE_INSTALL_PREFIX`** (o prefixo volta + para `release/`). + +## 1. Branch e commits + +`feat/testcomp-official-env`, base `feat/map2check-9.0`. HEAD `44d2160ab`. Commits +próprios: `e5a86a779` (validadores oficiais sob BenchExec), `cb99fe7bd` (runner +generate/validate), `866d35028` (archive do AFL++), `44d2160ab` (staging das +propriedades locais da tarefa). + +**Nada foi pushado.** Há trabalho **não commitado** (ver §5). + +## 2. Decisões do usuário nesta sessão + +- Rerrodada com **limites oficiais** (900 s; memória ajustada a **8 GB** para 2 vagas + nesta máquina de 23 GB; 4 núcleos). +- **Cover-Error inteira** + **Cover-Branches 3 500 estratificado** (proporcional ao + tamanho de cada categoria oficial). +- **sv-benchmarks fixado na `testcomp26`** (`7efe28dd29576b46927b7a34e8f742bd90966a75`). +- Build = ponta atual (`44d2160ab`; o código do tool é o da `feat/map2check-9.0` + o + wrapper/tool-info novos). +- Geração pelo **harness** (retomável), validação pelos validadores oficiais. + +## 3. O que está rodando agora + +- **Campanha `v99`**, launcher `tacas-results/v99-campaign.sh` (PID 33936). Contêineres + `v99-ce-s0/s1` (imagem `map2check-v9-eval:latest`, `--memory=8g --cpus=4`, + `--restart=unless-stopped`, retoma pelo CSV, done-markers `.v99-done-*`). + - **Cover-Error: ~1 579/1 902** processadas; 697 geraram teste; suítes em + `tacas-results/V99-suites/`, CSVs em `tacas-results/V99-ce_s*/results.csv`. + - **Cover-Branches: 0/3 500** — só entra quando o CE fechar (o launcher já os + enfileira). + - Build `install_v99` (script de build no relatório do ambiente oficial), archive + `tacas-results/V99/map2check-testcomp.zip`. +- **Validação oficial preliminar** (`validate-v99-ce.sh`, 3 validadores: gcc-unformatted, + clang-unformatted, testcoca): fechou **673/682 = 98,7%** TRUE por ≥1 validador. + scores.csv em `tacas-results/V99-ce-prelim/scores.csv`. Re-rodar quando o CE avançar. + +## 4. Issue aberta (pendência principal) + +- **#74** — "NonDetPass: tipos `__VERIFIER_nondet_*` não modelados zeram tarefas + (Intel-TDX, Floats) para UNKNOWN" — https://github.com/hbgit/Map2Check/issues/74 + - `NonDetPass.cpp` modela só 16 tipos; faltam `float, longlong, ulonglong, _Bool, + u8/u16/u32, charp`. + - Medido: 147 tarefas `UNKNOWN` afetadas (ulonglong 113, float 22, u32 12) → + **Intel-TDX 125, Floats 22**. + - A correção exige recompilar o tool → foi decidido **não** mexer no build no meio da + campanha (build único). Fica como follow-up. + +## 5. Trabalho não commitado (revisar e commitar) + +- `tests/testcomp/official/testcomp.py` — fixes: (a) staging das propriedades locais do + task (já em `44d2160ab`); (b) **disco**: remove `--no-compress-results`, apaga o + `results/` (o `.files` é o grosso), o `sv-benchmarks/` staged e o `tool/` + após cada validador — validado: 3 tarefas → 20 KB (antes 140 → 8 GB). Knob + `MAP2CHECK_KEEP_RESULTS=1` preserva o scratch para debug. +- `tests/testcomp/run_testcomp_evaluation.sh` — `TESTCOV_S=0` desliga o TestCov interno + (a validação é pelos validadores oficiais). +- `tests/testcomp/build_corpus_official.py` — **novo**: corpus estratificado + PROPORCIONAL ao tamanho, lendo categorias/excludes do def oficial. (Não existia + estratificação proporcional no repo; o `build_corpus.py` usa cota igual por categoria.) +- `tests/testcomp/corpus/cover-error-official.tsv` (1 902) e + `cover-branches-3500.tsv` (3 500). +- `tests/testcomp/official/bench-defs/excludes/ECA-excludes.set` — exclude oficial do + ECA (exclui 1 027 de ~1 059 ECA; sem ele o corpus super-representava ECA). +- Docs: `docs/reports/2026-10-06-ambiente-testcomp-oficial.md` (novo) e entrada no + `tacas-experiment-log.md`. + +## 6. Próximos passos + +1. **Fechar o CE** (as ~323 restantes são Intel-TDX/Hardware, lentas e UNKNOWN) e deixar + o **CB** (3 500) rodar; o launcher já cuida disso. +2. **Validar oficialmente** as suítes conforme a geração avança (rodar `validate-v99-ce.sh` + periodicamente; depois idem para o CB com `--property cover-branches`). +3. **Relatório da campanha** (pt-BR) com a comparação pareada e o placar oficial de CE e + CB; entrada no `tacas-experiment-log.md`. +4. **Commitar** o trabalho do §5 (cada um no seu assunto). +5. **Issue #74**: implementar o fix do `NonDetPass`, recompilar e re-rodar as categorias + afetadas (ou a campanha com build novo) — combinado como follow-up. +6. **tcerr**: a validação best-of (`clang-unformatted` + `testcoca`) morreu no meio; refazer + quando a máquina desafogar (script `tacas-results/official/validate-tcerr-fast.sh`). +7. **Windows/WSL**: o `ext4.vhdx` precisa ser compactado no Windows (o WSL liberou ~15 GB + internos — o lixo era `official/` 8,3 GB + imagens/build cache do Docker; o vhdx não + encolhe sozinho). Após `wsl --shutdown`, **relançar o launcher v99** (não sobrevive a + reboot). + +## 7. Números atuais + +- Cover-Error geração: ~1 579/1 902 (83%); 697 com teste (44,1% das processadas); + consolidado ~36,6% do corpus. +- Cover-Error validação oficial (682): **673 = 98,7%**. +- Categorias fracas: Intel-TDX 0/658, Hardware ~5/65 (orçamento/nondet), Floats ~11/33 + (nondet `float`, issue #74). diff --git a/docs/reports/2026-10-12-issue74-rerodada.md b/docs/reports/2026-10-12-issue74-rerodada.md new file mode 100644 index 000000000..0025703fd --- /dev/null +++ b/docs/reports/2026-10-12-issue74-rerodada.md @@ -0,0 +1,128 @@ +# Issue #74 — re-rodada das categorias afetadas (2026-10-12) + +Relatório da correção dos tipos `__VERIFIER_nondet_*` não modelados (issue #74) e da +re-rodada Cover-Error que mede o efeito dela nas condições oficiais da campanha V99. + +## Resumo + +- **Floats: 11/33 → 33/33** no Cover-Error, todas com score 1,0 nos 3 validadores oficiais. + As 22 tarefas recuperadas davam `UNKNOWN` em ~810–865 s; agora dão `FAILED` em 0–92 s. +- **Sem regressão:** as 15 tarefas de outras categorias que já davam `FAILED` na v99 + continuam `FAILED`, com score 1,0 nos 3 validadores. +- **Intel-TDX: 0/12** na amostra, como antes. O #74 era necessário, mas não suficiente: o + gargalo agora é a explosão de estados do KLEE ao gravar o log nondet, registrada na + **issue #75**. Ela afeta qualquer tarefa com mais que poucas leituras nondet, não só a + Intel-TDX. + +## Configuração + +| Item | Valor | +|------|-------| +| Correção | `05a157371` (branch `feat/nondet-missing-types`) | +| Build | `install_v99b` (o `install_v99` da campanha ficou intocado) | +| Imagem | `map2check-v9-eval:latest` | +| Limites | 900 s, 8 GB, 4 núcleos, `TESTCOV_S=0` (iguais aos da V99) | +| Tarefas | 60 de `tacas-results/V99b-affected.tsv` | +| Validação | `run.sh validate --property cover-error`, 3 validadores oficiais: `testcov-…-gcc-unformatted`, `testcov-…-clang-unformatted`, `testcoca-…-clang-formatted` | + +Composição das 60 tarefas: + +- **33 Floats:** a categoria inteira do corpus CE. +- **12 Intel-TDX:** amostra, semente 7499. +- **15 tarefas de guarda de regressão:** tarefas que davam `FAILED` na v99, em ProductLines + (5), Loops (3), Sequentialized (2), Hardware (2), Arrays (2) e Heap (1). + +A re-rodada ocupou uma das 2 vagas do launcher, em paralelo com o CE da v99. A carga da +máquina foi a mesma da campanha. + +## Resultados, par a par com a v99 + +| Categoria | Tarefas | v99 `FAILED` | v99b `FAILED` | Score oficial v99b | Transições | +|-----------|--------:|-------------:|--------------:|-------------------:|------------| +| Floats | 33 | 11 | **33** | **33,0** | 22 `UNKNOWN→FAILED`, 11 `FAILED→FAILED` | +| Intel-TDX | 12 | 0 | 0 | — | 5 `UNKNOWN→UNKNOWN`, 7 não rodadas na v99 (SKIPPED) → `UNKNOWN` | +| ProductLines | 5 | 5 | 5 | 5,0 | `FAILED→FAILED` | +| Loops | 3 | 3 | 3 | 3,0 | `FAILED→FAILED` | +| Sequentialized | 2 | 2 | 2 | 2,0 | `FAILED→FAILED` | +| Hardware | 2 | 2 | 2 | 2,0 | `FAILED→FAILED` | +| Arrays | 2 | 2 | 2 | 2,0 | `FAILED→FAILED` | +| Heap | 1 | 1 | 1 | 1,0 | `FAILED→FAILED` | + +**Validação oficial:** 48/48 suítes `true` em **cada um** dos 3 validadores, soma de score +48,0. As 26 tarefas que já davam `FAILED` na v99 também tinham score 1,0 lá, então não há +perda. + +**Tempo:** + +- Floats recuperadas: 0–92 s, mediana ~2 s. Na v99, as mesmas tarefas davam ~810–865 s. +- Guarda de regressão: a maioria ficou na mesma faixa. Algumas oscilaram, por exemplo + `email_spec27_product17` (8 → 64 s) e `email_spec27_product18` (21 → 51 s). Outras + ficaram mais rápidas, como `pals_lcr-var-start-time` (139 → 70 s) e `twocount32` + (107 → 82 s). +- Essas variações vêm do sorteio do AFL++ e da carga do vizinho. Todas ficaram muito abaixo + do orçamento de 900 s. + +## Intel-TDX: por que continua zerada (issue #75) + +O `failed external call: __VERIFIER_nondet_ulonglong` do #74 sumiu. Mesmo assim, as 12 +tarefas terminam `UNKNOWN` em ~800 s. + +Para isolar a causa, usei um programa sintético sem nenhum desvio antes do fim: +N leituras `__VERIFIER_nondet_int` e `reach_error` se `a[0] == 7 && a[N-1] == 42`. +KLEE puro, `install_v99b`: + +| N | Veredito | Tempo | Caminhos parciais | +|--:|----------|------:|------------------:| +| 2 | `FAILED` | 0 s | 1 | +| 5 | `FAILED` | 28 s | 861 | +| 10 | `UNKNOWN` | 60 s | 1 550 | +| 100 | `UNKNOWN` | 120 s | 3 218 | +| 10 000 | `UNKNOWN` | 120 s | 0 completos | + +**Diagnóstico pelo `run.istats` (N = 10):** 1 549 das 1 551 bifurcações estão sob +`map2check_target_function → map2check_exit → nondet_log_to_file → fprintf → vfprintf`. + +Ou seja, o KLEE **já chegou ao `reach_error`**. O que impede o veredito é a gravação do +`klee_log.csv`, cujos valores ainda são simbólicos: o `vfprintf` do uclibc bifurca a cada +dígito de cada valor. Uma tarefa Intel-TDX lê ~31 500 valores por execução. + +**Consequências:** + +- Nessas tarefas, o híbrido depende só do AFL++. +- O efeito vale para qualquer categoria com muitas leituras nondet, inclusive no + Cover-Branches. + +**Correção proposta na #75:** concretizar os valores antes de gravar, só no runtime KLEE. + +**Medido, mas não corrigido:** + +- O AFL++ roda a ~97 exec/s nessas tarefas. +- O log faz um `malloc` por leitura, e esse `malloc` também vaza, porque `append_element` + já copia a linha. + +**Hipótese descartada:** a B-tree em disco (`ContainerBTree.c`) **não** está no caminho. +O build liga o `ContainerRealloc.bc`. + +**Fora do escopo:** 44 das 658 tarefas exigem um valor igual a um endereço de `malloc`, o +que nenhum vetor reproduz no validador. + +## Situação da campanha V99 + +- **Cover-Error:** as 256 Intel-TDX restantes foram marcadas `SKIPPED` (`UNKNOWN` por + construção no `install_v99`). O `v99-ce-s1` termina as Hardware restantes. +- **Cover-Branches:** começou às 18h37 (`v99-cb-s0`), na vaga liberada pela re-rodada. +- **Placar oficial:** para a correção do #74 contar, as Floats do `install_v99b` + substituem as da v99 (+22 no CE). O CB tem 2 009 tarefas que declaram `float`. Ele roda + com o `install_v99` e herda a limitação; uma re-rodada CB das Floats com o `install_v99b` + fica como próximo passo. + +## Artefatos + +Todos em `tacas-results/`: + +- `V99b-affected.tsv`: lista das 60 tarefas. +- `V99b-ce-affected/results.csv`: vereditos e tempos. +- `V99b-suites/`: suítes. +- `V99b-ce-val/scores.csv`: validação oficial, 48 tarefas. +- `compare-v99b.py`: comparação par a par. +- `V99b-probe74/`: sonda de 300 s da #74. diff --git a/docs/reports/tacas-experiment-log.md b/docs/reports/tacas-experiment-log.md new file mode 100644 index 000000000..bf97c71fc --- /dev/null +++ b/docs/reports/tacas-experiment-log.md @@ -0,0 +1,1028 @@ +# Registro de mini-rodadas — linha TACAS + +Uma entrada por mini-rodada de testes, na ordem em que foram feitas. Cada entrada tem +o que mudou, a configuração, os dados brutos, a comparação com a rodada anterior +relevante e a leitura. Os números aqui são **diagnóstico** (amostras pequenas, uma ou +poucas execuções); a avaliação de cada versão é a execução sequencial completa, feita +depois do merge. + +Ambiente comum: imagem `map2check-dev:aflpp` (Dockerfile.dev com AFL++ 4.40c), host +WSL2. Build da v15 = `develop` em `415032766`, no mesmo container. + +--- + +## R1 — tacasv1: smoke do AFL++ (2026-09-26) + +- **Mudança:** LibFuzzer → AFL++ 4.40c (persistente, PCGUARD), 1 instância. +- **Config:** 4 programas mínimos, `--timeout 30`. +- **Dados:** + +| programa | esperado | resultado | +|---|---|---| +| reach `x != 0` (a semente já causa crash) | FAILED | FAILED 3/3 (1 timeout no dry-run por core dump do WSL em outra execução) | +| reach `1000 0` → a execução +é tratada como timeout (violação registrada vale; senão UNKNOWN). Revalidação: `sin` → **FAILED** numa execução e UNKNOWN noutra (o AFL++ da fase 1 acha ou +não o 180.0; sem `--seed-exchange` não há fase 3 — a frase anterior dizia o contrário e +estava errada), `insertion_sort` --slice → **UNKNOWN**. Nunca TRUE. Integração 40/40 (§30 nova: double concretizado; vermelha no +`build_seeds`, verde no novo). Uma §31 (abort dentro do `assert` da libc) foi descartada: +passava também no binário antigo — esse caminho não gera TRUE errado. + +**Custo esperado:** programas com float/VLA que o KLEE "provava" passam a UNKNOWN. Medir +TRUE corretos no SV-COMP (R17) — é o preço da solidez. + +## R16 — `--seed-exchange` (3a) × controle R15, Cover-Error (2026-09-29) + +- **Config:** `build_seeds` (3a + revisão, **sem** as correções do abort e dos caminhos + descartados — mesma base de veredito que o controle R15), `--seed-exchange`, amostra + `r15-ce.tsv` (213, todas pareadas), 300 s, 3 shards. + +| braço | cobertas | TRUE errado | ERROR | tempo mediano | +|---|---|---|---|---| +| R15 controle | 129 | 5 | 0 | 5 s | +| **R16 seeds** | **148** | 7 | 0 | 6 s | + +- **+19 cobertas (+15%)**, pares discordantes **21 × 2**. Por categoria (controle → seeds): + Sequentialized 2 → 8, XCSP 7 → 13, ECA 5 → 8, Recursive 7 → 9, ControlFlow 3 → 4, + BitVectors 7 → 8; as demais iguais. Perdas: 2 ECA (`Problem13_label54`, + `Problem10_label12`). +- **TRUE errado 7:** todos da família `pals_*` (abort inline) e `sin_interpolated_index-1` + (double concretizado) — os dois defeitos que esta branch já corrige (1eb8a30b9, + 4c16013bc). O braço seeds expõe mais deles porque a fase 3 do AFL++ não roda depois de + uma "prova" do KLEE. +- **Leitura:** a troca de sementes é o maior ganho medido na linha TACAS até aqui. A + rodada limpa (R19, build final nos dois braços) confirma sem os TRUE errados. +- Cover-Branches do R16 ainda rodando. + +### Correção da correção — poda por assunção não é caminho descartado (2026-09-29) + +A primeira versão do `kleeDroppedPaths` lia `partially completed paths > 0` no `info`. Esse +contador inclui os caminhos **podados por assunção**: `klee_assume(0)` num caminho já falso +é um erro do KLEE (`user.err`, "invalid klee_assume call (provably false)"), e até +`klee_silent_exit` conta como parcial (medido num programa mínimo: os dois dão +`partially completed paths = 1`). Resultado: **nenhum programa com `assume_abort_if_not` +ou abort inline podia mais ser provado** — o §29 `safe.c` ia de TRUE para UNKNOWN. + +Correção: `nondet_assume` (KLEE) poda com `klee_silent_exit(0)`, que não deixa arquivo; e +os caminhos descartados passam a ser lidos pelo que cada estado morto deixa no disco — +qualquer `*.err` ou `*.early` —, além do HaltTimer e do "silently concretizing". O §29 +agora exige TRUE. `sin` e `insertion_sort` seguem sem TRUE errado (UNKNOWN; o segundo por +`ptr.err`). + +**Efeito na R19:** o `install_r19` tem a versão com o contador. Em Test-Comp isso não muda +a cobertura (o veredito não pontua), só impede o `provedSafe` de encerrar a execução mais +cedo em programas com assunções. A R17 (SV-COMP, onde TRUE pontua) precisa do build +corrigido. + +### R16 — Cover-Branches, `--seed-exchange` × controle R15 (2026-09-29) + +- Mesma config da R16 Cover-Error (`build_seeds`), amostra `r15-cb.tsv` (120, pareadas). +- **Cobertura média: controle 47,7% × seeds 49,7%** (+2,0 p.p.); melhor em 26 tarefas, pior + em 9. Tempo mediano 195 → 160 s. +- Por categoria (controle → seeds): ControlFlow 41,3 → 57,9, BitVectors 65,7 → 73,7, + Recursive 45,0 → 53,0; **Loops 67,1 → 60,8** (uma tarefa: `geo2-ll_unwindbound50` + −62,5 p.p.), XCSP 77,7 → 75,0 (`AllInterval-011` −27 p.p.). +- TestCov: VALIDATED 118 (R15: 116), VALIDATED_ABORTS 1 (3). +- **Leitura:** diferente da tacasv2 (neutra em CB), a troca de sementes melhora a cobertura + de ramos, apesar de a suíte de CB sair só do KLEE — o KLEE semeado explora ramos que o + controle não alcançava. As duas quedas grandes ficam para a R19 confirmar (ruído do + fuzzer × efeito real). + +## R17 — SV-COMP MemSafety/MemCleanup/NoOverflows, control × seeds × alternate (2026-09-29) + +- **Config:** `install_r19` (commit 8c70e5a73), manifests regenerados com `build_corpus.py` + (memsafety 10/categoria = 50, memcleanup 10, overflow 10/categoria = 20), 120 s. + +| memsafety (50) | correct-true | correct-false | wrong-true | wrong-false | unknown | error | +|---|---|---|---|---|---|---| +| control | 10 | 19 | 2 | 3 | 10 | 6 | +| seeds | 10 | 20 | 1 | 3 | 10 | 6 | +| alternate | 9 | 20 | 1 | 3 | 10 | 7 | + +- MemCleanup (10): control 6 corretos, seeds 6, alternate 6. NoOverflows (20): control e + seeds 2 correct-true + 17 unknown; alternate idem (2 + 17 + 1 error) — os três iguais. +- **wrong-true comum aos três:** `CWE121…CWE193_char_declare_cpy_07_bad`. Causa: o modelo + `ldv_strcpy` copia `strlen` bytes (sem o terminador) e o estouro real é a **leitura** em + `printf("%s")` — que o KLEE executa como **chamada externa** (a uClibc do KLEE declara + `printf` sem defini-lo: `calling external: printf(...)`), fora de qualquer checagem, e o + memtrack não confere argumentos `%s`. Lacuna de solidez pré-existente; correção em + aberto: checar a string de cada `%s` (e `puts`/`str*`) antes da chamada. +- **wrong-true só no control:** `CWE122…CWE129_rand_18_bad` — os braços com sementes o + acham (FALSE correto). +- **Os 6 `error` são do classificador, não da ferramenta:** as tarefas + `array-memsafety/*-alloca` têm `alloca` de tamanho não determinístico; o AFL++ acha um + crash (pilha estourada), o replay imprime "Segmentation fault", e + `verdict_classifier.sh` conta isso como falha — embora o Map2Check termine com UNKNOWN + (o KLEE concretiza o tamanho → `model.err` → caminho descartado). +- **Leitura:** as sementes não pioram nada em SV-COMP e ganham 1 FALSE e eliminam 1 TRUE + errado; a alternância perde 1 TRUE correto frente ao control (a estagnação corta o KLEE + — o preço previsto na revisão). + +## R19 — Test-Comp, parcial (2026-09-29) + +- **Cover-Error, 171 tarefas pareadas nos 4 braços principais** (o shard 0 do braço seeds + perdeu 42 tarefas por um incidente de escrita e está sendo completado): + +| braço | cobertas | TRUE errado | ERROR | tempo mediano | +|---|---|---|---|---| +| R15 control (referência) | 101 | 5 | 0 | 6 s | +| control | 101 | **0** | 0 | 3 s | +| **seeds** | **120** | 0 | 0 | 5 s | +| alternate | 118 | 0 | 0 | 14 s | +| slice | 102 | 0 | 2 | 4 s | + +- seeds × control: **+20 −1**; alternate × control: +17 −0; alternate × seeds: +4 −6; + slice × control: +3 −2. +- **TRUE errado zerado em todos os braços** (eram 5 no control R15): as correções do abort e + dos caminhos descartados confirmadas em escala. +- Braços slice-light/o2/ntscd/ptafs e Cover-Branches ainda rodando. + +### R19 — diagnóstico das perdas de `--alternate-engines` (2026-09-29) + +Contra o braço seeds, a alternância perde 6 e ganha 2; 5 das perdas são eca-*. Reproduzido +em `eca-rers2012/Problem06_label05.c` (300 s): + +- **A troca KLEE → AFL++ estava limitada** aos 64 vetores mais recentes do KLEE. No braço + seeds, a fase 3 do AFL++ recebe todos (4676), e o dry run dela encontra vetores que, + completados com zeros depois do fim, chegam ao `reach_error` (`sig:06`, crashes com + `op:dry_run`). É isso que cobre essas tarefas eca-* que o KLEE sozinho deixa UNKNOWN. + O limite descartava justamente esses vetores. Ele tinha vindo de um laço cuja calibração + nunca terminava, problema já resolvido com a leitura de zeros. +- **Cada fase do AFL++ recompilava os 3 binários:** ~24 s por fase em eca-*. +- **A estagnação fixa de 15 s cortava o AFL++ em ~17 s**, onde o híbrido fixo dava 60 s. + +**Correção** (`fix(hybrid): the fuzzer gets all of KLEE's vectors, built once, with growing +patience`): sem limite na troca, cache dos binários por execução (`.build/`, também +beneficia a fase 3 do braço seeds) e paciência do AFL++ dobrando por rodada. +`Problem06_label05`: UNKNOWN → **FAILED em 157 s** (seeds: 281 s). Remedição na R23. + +## R19 — resultado (2026-09-29) + +**Cover-Error, 213 tarefas** (linhas filtradas pelo shard; os shards afetados pelo incidente +do descritor 3 foram completados com `-resume`): + +| braço | cobertas | % | TRUE errado | ERROR | vs control | tempo mediano | +|---|---|---|---|---|---|---| +| control | 128 | 60,1 | 0 | 0 | — | 3 s | +| **seeds** | **151** | **70,9** | 0 | 0 | **+23 −0** | 5 s | +| alternate | 148 | 69,5 | 0 | 0 | +20 −0 | 9 s | +| slice | 128 | 60,1 | 0 | 4 | +3 −3 | 4 s | +| slice-light | 127 | 59,6 | 0 | 4 | +3 −4 | 4 s | +| slice-o2 (207) | 128 | 61,8 | 0 | 4 | +5 −3 | 4 s | +| slice-ntscd (181, parcial) | 113 | 62,4 | 0 | 4 | +2 −1 | 5 s | +| slice-ptafs (155, parcial) | 90 | 58,1 | 0 | 4 | +1 −3 | 5 s | + +- **TRUE errado 0 em todos os braços** (R15 control: 5). As correções de veredito se + confirmam em escala. +- **Sementes: +23 −0** contra o control, o melhor resultado da linha TACAS. Alternância: + +20 −0. As 5 perdas eca-* dela frente ao seeds têm causa achada e corrigida (ver o + diagnóstico acima); a remedição fica para a R23. +- **Slicing:** as variantes não mudam o quadro (±3). Nenhuma supera o slice simples com + margem, e nenhum knob é promovido por enquanto. Os 4 ERROR de ECA continuam: o cache do + 2d eliminou o refatiamento, mas o passo do slice ainda levava 105 s (regex sobre o IR, + ~45 s fora de qualquer orçamento) e as 3 compilações do AFL++ somavam até 0,75T. + Correções: varredura sem regex e um orçamento único para as compilações. + `Problem102_label34` com `--slice`: ERROR → UNKNOWN em 307 s. + +**Cover-Branches, 120 tarefas:** + +| braço | cobertura média | melhor / pior que o control | +|---|---|---| +| control | 44,7% | — | +| seeds | 46,1% | 31 / 13 | +| **alternate** | **50,3%** (119) | **43 / 5** | + +- **A alternância é o melhor braço em Cover-Branches** (+5,6 p.p.), o que se explica pelas + várias fases do KLEE, cada uma alimentada pelo corpus do fuzzer. O control da R19 (44,7%) + ficou abaixo do da R15 (47,7%) na mesma amostra. A carga da máquina foi maior (11 + contêineres e falta de memória no fim), e isso pesa em Cover-Branches, que usa o + orçamento inteiro. + +## R21 — checagem de `%s` e correção do classificador, SV-COMP (2026-09-29) + +- `install_r21`, control, contra a R17 control. + - **MemSafety:** o CWE193 cpy bad foi de TRUE errado para **FALSE correto**. Os 6 + `error` das tarefas alloca viraram `unknown` (classificador corrigido). + - **Falso positivo novo:** `CWE121…dest_char_declare_cpy_01_good` foi de TRUE correto + para FALSE-DEREF errado. O `ldv_strcpy` do SV-COMP copia `strlen` bytes sem o + terminador, e o terminador do buffer da versão good é um byte **não inicializado**: + para o gabarito do SV-COMP ele é zero; numa execução nativa ou no KLEE (que preenche + `alloca` com um padrão diferente de zero) não é. + - **MemCleanup:** os 2 `error` viraram `unknown`. +- **Decisão:** a checagem de `%s` fica atrás de `MAP2CHECK_CHECK_CSTRINGS=1`, desligada + por padrão, até ser medida numa amostra maior do Juliet (1 acerto × 1 erro em 50 não + basta; pelos pesos do SV-COMP compensaria, mas não com essa amostra). +- **Incidente de harness (descritor 3):** o laço do harness lê o manifest pelo fd 3, e os + filhos o herdavam, inclusive o programa analisado via chamadas externas do KLEE. O offset + andou sob o laço: o shard 0 da R24 parou em 29 de 71, e o shard 0 do seeds da R19 recebeu + linhas do shard 1. Os filhos agora rodam com o fd 3 fechado. + +## INV-1 — `--add-invariants`: crab-llvm antigo × Clam (2026-09-30) + +**Pergunta:** o `--add-invariants` do crab-llvm "funcionava", e o do Clam "não é a mesma +coisa"? + +**O que se descobriu sobre o motor antigo** (release v7.3.1 do SV-COMP 2020, que roda em +`python:2.7-slim` com o clang do LLVM 6 embutido): +- Houve **duas configurações**. + - Até 18/10/2018: `--crab-track=arr --crab-add-invariants=after-load`. Os invariantes + saíam como `verifier.assume`, o NonDetPass os mapeava para `map2check_crab_assume`, e + eles chegavam ao KLEE como `klee_assume`. + - A partir da v7.3 (SV-COMP 2019 e 2020): `--crab-track=num + --crab-add-invariants=block-entry --crab-promote-assume`. O `promote` emite + `llvm.assume`, que o NonDetPass não mapeia e que o KLEE ignora (testado no KLEE 2.1 do + release e no 3.1, com e sem `--optimize`). **Os invariantes das versões de competição + não chegavam a lugar nenhum.** + +**Geração, 90 programas** (40 de alcançabilidade da amostra Cover-Error e 50 de MemSafety), +timeout de 60 s: + +| config | rodou | com invariante | total | +|---|---|---|---| +| OLD-A (antigo, até 2018) | 76 | 14 | 155 | +| OLD-B (antigo, v7.3; `llvm.assume`, inerte) | 35 | 33 | 224 698 | +| NEW-cur (Clam, `num` + `block-entry`) | 79 | 68 | 72 452 | +| NEW-A (Clam, `mem` + `after-load`) | 70 | 19 | 702 | + +- A configuração que "funcionava" insere **poucos** invariantes, depois de leituras de + memória. A atual do Clam insere **muitos**, na entrada de cada bloco. O perfil + `memory` do Clam reproduz a ordem de grandeza da antiga. + +**Efeito na análise, sonda num laço** (`n ≤ 1000`, versões segura e com bug em `n == 777`, +symex, 60 s): + +| braço | seguro | com bug | +|---|---|---| +| sem `--add-invariants` | UNKNOWN (HaltTimer) | UNKNOWN | +| Clam padrão (18 invariantes) | UNKNOWN | UNKNOWN | +| Clam `memory` (0 invariantes) | **TRUE** | **FAILED** | +| Clam `none` (pipeline do Clam, 0 invariantes) | **TRUE** | **FAILED** | +| **sem Clam, `MAP2CHECK_PREOPT=ssa`** | **TRUE** | **FAILED** | + +- **O ganho vem do pré-processamento, não dos invariantes.** O Clam compila com + `-disable-O0-optnone` e deixa o módulo em SSA (`mem2reg`, `simplifycfg`). O Map2Check + compila em `-O0` com `optnone`, cada variável local vira um objeto de memória no KLEE, e + o laço não fecha no orçamento. +- Os 18 invariantes do perfil padrão não bastaram: o KLEE completou mais caminhos com eles + (261 contra 184 sem), mas também parou no HaltTimer. +- **Hipótese a medir em escala (R25):** `MAP2CHECK_PREOPT=ssa` (sem Clam) é um ganho + geral, e os invariantes só se pagam somados ao SSA, se se pagarem. +- Implementado nesta frente (`feat/tacas-invariants`): + - `MAP2CHECK_CLAM_PROFILE=default|memory|none`; + - log com a contagem de invariantes inseridos; + - recuo para a compilação normal quando o Clam falha (antes, o pipeline ficava sem + bitcode); + - `MAP2CHECK_PREOPT=ssa`. + +## R20, R22, R23, R24 — primeiros resultados (2026-09-30, madrugada) + +Todos contra o braço equivalente da R19, nas tarefas em comum (linhas filtradas por shard). + +| rodada | mudança medida | tarefas | cobertas (nova × R19) | +/− | TRUE errado | +|---|---|---|---|---|---| +| **R24 control** (completa) | replay dos vetores do KLEE, híbrido **sem** sementes | 213 | **146 × 128** | **+20 −2** | 0 | +| R24 seeds (parcial) | replay + sementes | 59 | 47 × 46 | +1 −0 | 0 | +| R20 seeds (parcial) | ranking `+cov` (3c) | 178 | 128 × 128 | +2 −2 | 0 | +| R23 seeds (parcial) | build final (cache do AFL++, orçamento, fd 3) | 177 | 132 × 128 | +5 −1 | 0 | + +- **O replay dos vetores do KLEE traz o híbrido simples para perto do braço com sementes** + (146 contra 151 da R19 seeds). As mudanças concentram-se em `pals_*`, eca-*, XCSP (`aim-*`, + `CostasArray`, `AllInterval`) e `fuzzle`, justamente as tarefas em que o seeds ganhava + com o dry run do AFL++. O mecanismo diagnosticado se confirma. +- **3c v1 (ranking):** neutro nesta amostra (+2 −2). O ranking só pesa quando a fila passa + de 64 entradas. +- **Cover-Branches, R22** (corpus do AFL++ na suíte, `MAP2CHECK_FUZZER_SUITE=1`): + - control, 99 tarefas: **49,2% × 44,8%**, 33 melhores e 2 piores; TestCov VALIDATED + 97/99; + - seeds, 22 tarefas: 48,5% × 44,8%, 4 melhores e 3 piores. + +## R21 CASTLE e dois incidentes (2026-09-30, madrugada) + +- **CASTLE com `install_r21`** (checagem de `%s` ainda **ligada** nesse build): TP 54, TN 44, + FN 12, UNKNOWN 5, **FP 4** (R14: TP 53, TN 44, FN 14, FP 1). Os 4 FP (787-1, 787-2, + 787-4, 822-3) são todos um `printf("%s")` de memória que o runtime não rastreia: buffer + preenchido por `scanf` e `argv[0]`. É uma confirmação independente de que + `MAP2CHECK_CHECK_CSTRINGS` deve continuar **desligado** (como está no branch da PR); os + FN caíram de 14 para 12. +- **Incidente do escalonador** (corrige uma conclusão anterior): os escalonadores leem os + jobs com `IFS=$'\t' read`, e o bash junta tabs consecutivos. Com a coluna de flags vazia, + o conteúdo da coluna de ambiente escorregava para a de flags. Com isso: + - o braço `ssa` da R25 passou `MAP2CHECK_PREOPT=ssa` ao Map2Check como **nome de + arquivo** (71/71 ERROR). Relançado com `-e`; + - **a primeira R22 control (120 ERROR) teve a mesma causa, e não falta de memória**, + como registrado antes. O relançamento dela usou `-e` e é válido; + - os outros braços têm flags não vazias ou nenhuma variável, e não foram afetados. + +### R20 e R23 seeds, completas (2026-09-30, 01h) + +| rodada | o que muda | cobertas (213) | vs R19 seeds (151) | vs R19 control (128) | TRUE errado | +|---|---|---|---|---|---| +| R20 seeds | + ranking `+cov` (3c v1) | 150 | +2 −3 | +22 | 0 | +| **R23 seeds** | build final (cache do AFL++, fd 3, hash, orçamento) | **154** | **+5 −2** | **+26** | 0 | + +- **3c v1 é neutro** também na amostra completa: fica disponível, sem ganho medido. +- **O build final com sementes é o melhor resultado de Cover-Error da linha: 154/213 + (72,3%)**, contra 111 da v15 na mesma amostra. +- As perdas recorrentes (`Problem10_label12`, `Problem13_label54`) aparecem também no + R20. São tarefas eca-* no limite do orçamento. + +## Madrugada de 2026-09-30 — R22, R23, R24 e R25 completas + +**Cover-Error, 213 tarefas** (referência: R19 control, 128): + +| braço | cobertas | % | vs R19 control | TRUE errado | tempo mediano | +|---|---|---|---|---|---| +| R24 control (replay dos vetores do KLEE) | 146 | 68,5 | +20 −2 | 0 | 4 s | +| R23 seeds (build final) | 154 | 72,3 | +26 −0 | 0 | 4 s | +| **R24 seeds (build final + replay)** | **155** | **72,8** | **+27 −0** | 0 | 5 s | +| R23 alternate (build final) | 153 | 71,8 | +26 −1 | 0 | 12 s | + +- R23 alternate × R19 alternate: +7 −2. A correção das perdas eca-* funcionou. + R23 alternate × R23 seeds: +4 −5, um empate. +- **v15 → build final na mesma amostra: 111 → 155 cobertas, TRUE errado 27 → 0.** + +**Cover-Branches, 120 tarefas** (R19 control 44,7%): + +| braço | cobertura média | melhor / pior | +|---|---|---| +| R19 seeds | 46,1% | 31 / 13 | +| **R19 alternate** | **50,6%** | 44 / 5 | +| R22 control + corpus do AFL++ | 49,7% | 40 / 3 | +| R22 seeds + corpus do AFL++ | 49,4% | 36 / 8 | + +**R25 (`--add-invariants` e SSA), shard 0 de Cover-Error (71 tarefas) e MemSafety (50):** + +| braço | Cover-Error cobertas | ERROR | MemSafety (corretas / wrong-true / wrong-false) | +|---|---|---|---| +| off | 51 | 0 | 28 / 2 / 2 | +| ssa | 50 (+2 −3) | 0 | — | +| clam-none | 50 (+1 −2) | 2 | 25 / 1 / 4 | +| clam-default | 49 (+1 −3) | 4 | 27 / 1 / 4 | +| clam-memory | 44 (+2 −9) | 7 | 25 / 2 / 4 | + +- **No híbrido, nem o SSA nem os invariantes ajudam.** O ganho que a sonda viu era do KLEE + sozinho; no híbrido, o AFL++ e o replay dos vetores já decidem essas tarefas. Os braços + com Clam **pioram**: mais FALSE errados em MemSafety (4 contra 2), e ERROR por o Clam + estourar o orçamento, já corrigido com um limite de 0,2T. +- **Decisão:** `--add-invariants` continua opcional e desligado por padrão; o SSA não é + promovido. +- **Incidente:** a mudança de versão no `CMakeLists.txt` fez o cache do `build_inv` ser + regenerado, com o prefixo voltando para `release/` e o `ENABLE_CLAM` para OFF. O + `release/` foi sobrescrito de novo e restaurado a partir do `install_v15` (idêntico, + conferido com `diff`). As rodadas usaram installs congelados antes disso. + +## R26 completa (2026-09-30) e primeiros lotes da campanha da 9.0 + +**R26, SV-COMP (120 s):** a alternância **não perde nenhum TRUE correto**. + +| | control (fixo) | seeds | alternate | +|---|---|---|---| +| MemSafety (50): correct-true / correct-false | 10 / 19 | 10 / 20 | **10 / 20** | +| MemSafety: wrong-true / wrong-false | 2 / 3 | 1 / 3 | **1 / 3** | +| MemCleanup (10): corretos | 6 | 6 | 6 | +| NoOverflows (20): corretos | 2 | 2 | 2 | + +As sementes e a alternância corrigem o TRUE errado do `CWE122…rand_18`. O seeds teve 1 +ERROR (`tricky_address2`). + +**CASTLE:** R26 e a campanha da 9.0 dão TP 54, TN 44, FN 14, FP 1, **igual à v15**; os 4 +TIMEOUT da v15 viraram UNKNOWN. + +**Campanha da 9.0, parcial** (`install_v9` = `3476ff769`; condições da v15: 4 GB, 300 s): + +| corpus | pareado com a v15 | v15 | 9.0 | +|---|---|---|---| +| Cover-Error (q400) | 532 de 1087 | 288 cobertas, **57 TRUE errados** | **394 cobertas (+112 −6), 0 TRUE errado**; mediana 59 → 19 s | +| Juliet, grupos a e b | 2 271 | TP 340, FN 118, FP 20, TN 1074, ERROR 114 | **TP 776**, FN 90, FP 20, TN 1058, ERROR 0 | + +- Juliet: 294 UNKNOWN e 102 ERROR da v15 viraram TP; 16 TN viraram UNKNOWN. + +## Campanha da 9.0: dois defeitos achados no Juliet c, e a troca de build (2026-10-02) + +- **Achado:** o grupo c do Juliet (CWE190 e 191, overflow) teve **55 ERROR** que a v15 não + tinha, e 207 das 272 paradas por estagnação terminaram em SIGKILL. + 1. **Link do fuzzer sem `-lm`.** Um programa com `sqrt` ou `pow` não linkava ("undefined + reference to `sqrt`"), perdia a fase do AFL++ e o harness contava ERROR. + 2. **KLEE preso numa chamada externa nativa.** As variantes `fscanf` passam um `FILE*` + da uClibc ao `__isoc99_fscanf` nativo. Preso ali, o KLEE não olha o sinal de + interrupção nem o próprio `--max-time`, e só saía no SIGKILL do fim da janela, + desperdiçando o resto dela. Testado à parte: o KLEE isolado responde ao SIGINT + normalmente; nesse módulo não reage nem em 60 s. +- **Correção** (`76eedfc75`): os links nativos levam `-lm`; um KLEE que não para em 10 s + depois do SIGINT é morto e o tempo vai para a próxima fase. No caso reproduzido: + 5 fases em vez de 4 no mesmo orçamento e o fuzzer linkando. +- **Troca de build na campanha** (decisão do usuário: corrigir, refazer o que deu erro e + seguir com a versão corrigida como a 9.0): + - `install_v9` passa a ser o build de `76eedfc75`; o anterior fica em + `install_v9-3476ff7`; + - **refeitos com o build novo:** o grupo c inteiro do Juliet, as 2 tarefas de + Cover-Error que chamam a libm (`loop-floats-scientific-comp/loop2-1.c` e `loop4.i`) e o + Cover-Branches (que mal tinha começado); + - **mantidos do build anterior:** CASTLE, Cover-Error (exceto essas 2) e os grupos a, b e + d do Juliet, sem erro de libm. Os dois defeitos não mudam veredito; o segundo só + devolvia tempo nas paradas por estagnação. +- **Fora da campanha:** o `--debug` dá segfault com a alternância (no fim da execução). + Só afeta a depuração e ficou registrado para corrigir. + +## Campanha da 9.0 — Cover-Error, CASTLE e Juliet a, b, d completos (2026-10-02, 23h) + +**Cover-Error, 1 087 tarefas** (recorte da v15, pareado): + +| | v15 | 9.0 | +|---|---|---| +| cobertas | 470 | **722 (+265 −13, +54%)** | +| TRUE errado | **175** | **0** | +| ERROR | 9 | 0 | +| tempo mediano | 176 s | 72 s | + +- Por categoria (v15 → 9.0): ECA 58 → 146, ProductLines 111 → 169, Sequentialized + 9 → 78, XCSP 22 → 38, Arrays 84 → 92, Loops 102 → 109; nenhuma categoria cai. + +**Juliet** (pareado; a, b e d completos, c refeito com o build corrigido e em curso): + +| grupo | TP (v15 → 9.0) | FN | FP | TN | ERROR | +|---|---|---|---|---|---| +| a (2 320) | 214 → **611** | 127 → 100 | 0 → 0 | 1 140 → 1 131 | 269 → 0 | +| b (1 600) | 216 → **473** | 202 → 170 | 30 → 30 | 729 → 722 | 111 → 0 | +| d (960) | 364 → 364 | 116 → 114 | 80 → 80 | 380 → 369 | 0 → 0 | + +- O grupo d não ganhou TP, perdeu 11 TN para UNKNOWN e teve mais UNKNOWN + TIMEOUT + (20 → 33). É a única queda; investigar quando a campanha fechar. + +**CASTLE:** igual à v15 (TP 54, FN 14, FP 1). + +**Cover-Branches, parcial (111 de 2 765):** 48,3% contra 42,1% da v15, 47 melhores e 19 +piores. TestCov: VALIDATED 84, VALIDATED_ABORTS 23, TESTCOV_ERROR 4 (v15: 93, 15 e 3). O +aumento de VALIDATED_ABORTS vem dos casos do corpus do fuzzer que violam uma assunção +(o teste termina num `abort()`). A suíte continua válida e a cobertura conta. + +## Campanha da 9.0 — Cover-Branches completo (2026-10-05) + +O shard 4 fechou às 4h48 e, com ele, a campanha inteira. O build é o `76eedfc75` +(`install_v9`) e as condições são as da v15: 300 s por tarefa, `--memory=4g`, TestCov +com 300 s. + +**Cover-Branches, 2 765 tarefas** (recorte da v15, pareado): + +| | v15 | 9.0 | +|---|---|---| +| cobertura média | 41,4% | **45,1% (+3,7 p.p.)** | +| cobertura mediana | 38,5% | **47,6%** | +| melhores / piores / iguais | — | 932 / 381 / 1 452 | +| VALIDATED / VALIDATED_ABORTS | 2 325 / 329 | 2 416 / 209 | +| TESTCOV_ERROR | 110 | 140 (139 ECA) | +| tempo mediano | 114 s | 274 s | + +- **Por categoria** (cobertura média, v15 → 9.0): + - Arrays: 60,7 → 76,2; + - BitVectors: 60,6 → 70,0; + - ControlFlow: 44,9 → 53,1; + - Recursive: 57,8 → 65,3; + - Heap: 40,6 → 47,3; + - Loops: 70,5 → 73,8; + - LinkedLists: 75,8 → 78,5; + - Sequentialized: 56,0 → 58,7; + - Floats: 5,4 → 6,7; + - ProductLines: 20,3 → 20,7; + - ECA: 10,5 → 10,6. + - **A única queda é o XCSP: 77,6 → 54,6.** +- **Tarefas com zero testes.** 50 tarefas (43 XCSP, 7 Floats) geram testes na v15 e + nenhum na 9.0. Elas somam 1,6 p.p. da média geral; sem elas, a comparação fica em + 40,5% → 45,9%. + - A causa é a poda de assunção com `klee_silent_exit` (ver o backlog). + - Na direção contrária, 51 tarefas sem teste na v15 passam a ter testes na 9.0. +- **TESTCOV_ERROR.** Dos 140, 109 já davam erro na v15. Quase todos são do ECA: o + TestCov passa do limite de 300 s do harness. Falta revalidar com um limite maior. +- **Tempo.** A 9.0 gasta o orçamento inteiro, porque a alternância só para por + estagnação e a suíte continua crescendo. Na v15 o híbrido fixo terminava antes. +- O campo de veredito (SUCCEEDED 1 655 → 296) não pesa em Cover-Branches. Só a cobertura + validada pelo TestCov conta. + +## Correção dos caminhos podados pelo assume, e rerrodada (2026-10-05/06) + +- **Defeito:** sob o KLEE, o `nondet_assume` podava com `klee_silent_exit`, que não grava + `.ktest`. Na campanha da 9.0, 50 tarefas de Cover-Branches (43 XCSP, 7 Floats) tinham + testes na v15 e nenhum na 9.0. +- **Correção 1** (`e4e0b74c7`): a poda passa a usar `_exit(0)`. O caminho termina + normalmente e o KLEE grava o teste. +- **Correção 2** (`6848d2395`): o caminho podado leva um objeto marcador + (`map2check_pruned`). + - O leitor remove o marcador e põe esses vetores depois dos outros. + - A suíte marca o caso com um comentário XML e o troca por um caminho mais profundo + quando atinge o limite de 50, inclusive em fases seguintes. + - Motivo: só com a correção 1, a primeira fase do KLEE no AllInterval achava apenas + caminhos podados e enchia a suíte. A cobertura caía de 95% para 9%. +- **Rerrodada** (300 s por tarefa, mesmas condições), com a cobertura média em %: + +| lote | tarefas | v15 | 9.0 | só a correção 1 | correções 1 e 2 | +|---|---|---|---|---|---| +| tarefas sem teste na 9.0 | 50 | 88,8 | 0,0 | 88,8 | **88,8** | +| XCSP que já tinham testes | 76 | 64,9 | 85,5 | 78,5 | **94,7** (+20 −6 contra a 9.0) | +| controle sorteado | 100 | 46,9 | 54,4 | 55,9 | **55,0** (+19 −7) | +| Cover-Error sorteado | 100 | — | 63 cobertas | 66 | **63** (+3 −3, ECA), TRUE errado 0 | + +- **Projeção no Cover-Branches completo** (as 226 tarefas trocadas pelas da rerrodada): + - média: v15 41,4% → 9.0 45,1% → **47,0%**; + - XCSP: 77,6% → 54,6% → **96,6%**. +- **Ainda abaixo da 9.0 original:** AllInterval-035 (38,6 → 2,9), -025 e -017. As oscilações + de mais e de menos no controle e no Cover-Error ficam dentro da variação entre + execuções vista nas rodadas anteriores. + +## Ambiente oficial da Test-Comp e revalidação das suítes ECA (2026-10-06/07) + +- **Motivo:** o teto de 50 casos por suíte (`kMaxBranchTestCases`) foi calibrado no **nosso** + ambiente (TestCov 3.7, 300 s, sem BenchExec). A competição não limita o tamanho da suíte, + então os testes precisam rodar como ela roda. +- **Ambiente construído:** branch `feat/testcomp-official-env`. Imagem oficial (Ubuntu + 24.04, digest fixo) + BenchExec 3.34 + TestCov 3.11.post3 + TestCoCa, as cinco definições + oficiais de validação e um `map2check.xml` (não oficial) para gerar. Pontuação como a + competição funde: Cover-Branches = melhor cobertura entre os validadores; Cover-Error = + um TRUE basta. Detalhes em `docs/reports/2026-10-06-ambiente-testcomp-oficial.md`. +- **Verificação (smoke2, 3 tarefas):** os cinco validadores **concordam**. `s52iff_overflow` + 81,25%; `AllInterval-011` 90,91% (gcc) / 86,36% (clang); `Problem10_label28` 37,81%. Uma + suíte ECA de 50 casos validou em ~40 s no TestCov 3.11, contra o estouro de 300 s do 3.7. +- **Achado e correção (2026-10-07).** Ao revalidar as **140 suítes** de Cover-Branches que + deram `TESTCOV_ERROR` (TestCov 3.7, 300 s) na campanha da 9.0, todas saíram `MISSING`. + Causa: `testcomp.py:stage_tasks()` não copiava os arquivos de propriedade **locais da + tarefa**; o `eca-rers2018/Problem14.yml` referencia ~100 `properties/unreach-call-*.prp` + relativos à tarefa, e o BenchExec **aborta o task set inteiro** quando um não resolve. + Correção `44d2160ab`; com ela, `Problem14` valida (`done`, ~2,4% nos cinco validadores). +- **Ressalva da rodada completa:** o host de 25 GB ficou **sob swap** (`7 GB × 3 threads`) e + o BenchExec avisou `System has swapped during benchmarking. Benchmark results are + unreliable!`; as variantes `formatted` saíram quase todas `TIMEOUT`. Os números do tcerr + desta rodada **não** são conclusivos — repetir com `--numOfThreads 1`–`2`. +- **Leitura:** o ambiente oficial funciona ponta a ponta. Falta (1) recalibrar o teto de 50 + com o validador oficial e (2) implementar a seleção da suíte por cobertura. O CI que + reproduz este ambiente ficou **adiado** (custo ~20–35 min/run; ver o handoff de 07/10). + +## Issue #74 — tipos nondet não modelados (2026-10-12) + +- **Correção:** `05a157371` (branch `feat/nondet-missing-types`, sobre `feat/testcomp-official-env`). + O `NonDetPass` passa a modelar `float`, `longlong`, `ulonglong`, `u8/u16/u32` e + `__VERIFIER_nondet_memory(p, n)`. Cada tipo tem gerador KLEE e AFL++ da largura certa, + linha de log com o valor inteiro (64 bits e float não passam mais pelo logger de `int`) e + nome decodificado pelo leitor de ktest; float sai em `%.9g` (ida e volta exata). + `nondet_memory` segue o harness dos validadores: **n entradas `uchar`, uma por byte** + (o KLEE cria um objeto de n bytes, o leitor o expande). `_Bool`, `charp` e `uint128` + continuam fora: o harness oficial não tem os dois primeiros e o corpus não usa nenhum. +- **Build:** `install_v99b` (`build_v99b`, prefixo próprio; o `install_v99` da campanha + ficou intocado). 12/12 testes unitários; 8 testes novos (decodificação, expansão de + memória, log → semente). +- **Integração (programas sintéticos, 120 s):** ulonglong, longlong, u8/u16/u32, memory e + float — `install_v99` 5× `UNKNOWN`; `install_v99b` 5× `FAILED` em 0–17 s, e as 5 suítes + dão `Result: TRUE` no TestCov 3.11 oficial. +- **Sonda em tarefas reais (300 s, `install_v99b`):** + - **Floats 5/5 `FAILED` em 1–6 s** (na v99: `UNKNOWN` em ~830 s cada) e **TRUE nos 3 + validadores oficiais** (gcc-unformatted, clang-unformatted, testcoca). Dados em + `tacas-results/V99b-probe74/`. + - **Intel-TDX 0/8.** O `failed external call` sumiu, mas não basta: cada execução lê + **~31 500 valores nondet** (os *havoc* de structs/arrays inteiros), o AFL++ roda a ~97 + exec/s e o KLEE executa 39 M instruções em 150 s sem completar **nenhum** caminho. + Além disso, 44/658 tarefas exigem `rcx == (uint64_t)`, que nenhum + vetor reproduz fora do alocador do KLEE. É um problema de escala, separado do #74. +- **Campanha V99:** as 256 Intel-TDX que faltavam no CE foram marcadas `SKIPPED` (todas + chamam um nondet não modelado → `UNKNOWN` por construção no `install_v99`; já eram 0/399). + Backup dos CSVs em `results.csv.bak-before-tdx-skip`. Libera ~28 h de vaga para o CB. +- **Re-rodada `v99-b74-ce` (900 s/8 GB/4 núcleos, `install_v99b`):** as 33 + Floats, 12 Intel-TDX (amostra, semente 7499) e 15 tarefas `FAILED` de outras categorias como + guarda de regressão. Ocupa uma das 2 vagas do launcher. Resultados em + `tacas-results/V99b-ce-affected/`, suítes em `tacas-results/V99b-suites/`. +- **Resultado da re-rodada (concluída às 18h37):** + - **Floats: 11/33 → 33/33 `FAILED`.** As 22 recuperadas levavam ~810–865 s na v99 e + agora levam 0–92 s. + - **Guarda de regressão: 15/15 continuam `FAILED`.** + - **Intel-TDX: 0/12.** + - **Validação oficial:** 48/48 suítes `true` em cada um dos 3 validadores (score 48,0). + - Relatório completo em `docs/reports/2026-10-12-issue74-rerodada.md`. +- **Issue #75 — explosão de estados do KLEE ao gravar o log nondet.** + - **Sintético:** N leituras `int` e alvo no fim. N = 5 já dá 861 caminhos parciais e + 28 s; N = 10 dá `UNKNOWN`. + - **Causa:** 1 549 das 1 551 bifurcações estão em `nondet_log_to_file → vfprintf`, + porque o log grava valores ainda simbólicos. + - **Alcance:** é o que segura a Intel-TDX, e vale para qualquer tarefa com muitas + leituras nondet. + - **Hipótese descartada:** a B-tree em disco; o build liga o `ContainerRealloc`. + +## Issue #75 — correção do log nondet do KLEE, sondas e amostra (2026-10-12/13) + +- **Correção (`8da579488`, `b4bda9011`, na `feat/map2check-9.0`):** + - o log nondet é **concretizado** (`klee_get_value_i64` + `klee_assume`) antes de ser + gravado; + - o `fprintf` foi trocado por formatação manual (custava ~7 000 instruções KLEE por + chamada); + - o `ContainerRealloc` cresce geometricamente; + - logs com mais de 1 024 linhas não são gravados, e o vetor sai do `.ktest`; + - knob `MAP2CHECK_KLEE_MAX_MEMORY`. + - Build `install_v99c`. Teste unitário `NonDetLogTest` (CSV byte a byte igual ao do + `fprintf`) e regressão de integração §38. +- **Sintético (N leituras `int`, alvo no fim, KLEE puro):** + + | N | v99b | v99c | + |---|---|---| + | 5 | 28 s | 1 s | + | 10 | `UNKNOWN` | 1 s | + | 100 | `UNKNOWN` | 1 s | + | 1 000 | `UNKNOWN` | 6 s | + | 10 000 | `UNKNOWN` | 31 s (vetor do ktest) | + +- **Sonda em tarefas reais (300 s):** + - Floats 5/5 continuam `FAILED`. + - **Intel-TDX 0/8**, com a memória padrão e também com `MAP2CHECK_KLEE_MAX_MEMORY=6000`. + - A `t1` no KLEE puro (240 s) completa 852 caminhos (antes: 0), deixa 557 parciais e + perde estados pelo teto de memória. + - Conclusão: o que resta é a **explosão genuína** do programa (havoc de milhares de + leituras e pré-condição longa), não mais o log. É uma frente separada. +- **Amostra `m2c-sample75` (40 tarefas de CE, semente 7575, 900 s/8 GB/4 núcleos):** + 20 `FAILED` e 20 `UNKNOWN` da v99, comparadas 1 a 1. Dados em + `tacas-results/V99c-sample/`. + - **20/20 `FAILED` mantidas**, e as 20 suítes dão `true` nos 3 validadores oficiais. + Isso é idêntico à v99, inclusive o `ERROR (1)` do TestCov em + `seq_cmp_antisymmetry_cover_target`, que só o TestCoCa valida. + - **Tempo das 20 `FAILED`: 1 584 s → 1 364 s (−14 %).** O ganho vem de duas tarefas: + - `Problem11_label00`: 249 → 89 s; + - `id_o100`: 76 → 1 s. + + Nas demais, a variação ficou dentro do ruído (`aim-100-3-4-sat-1`: 78 → 115 s). + - **0/20 ganhos nas `UNKNOWN`**: 19 Hardware (btor2c) e `Problem101_label00`. Agora usam + quase todo o orçamento (~830–900 s, contra ~710–890 s na v99), sem vetor. + - **Leitura:** a #75 não introduz regressão e acelera alguns casos. Na Hardware o + gargalo não é o log. +- **Campanha:** em 13/10 às 00h43, o `v99c-campaign.sh` iniciou as 256 Intel-TDX `SKIPPED` + no `install_v99c` (`v99c-ce-tdx-s0/1`). O Cover-Branches (4 shards, 3 500 tarefas, + `install_v99c`) começa sozinho quando todo o CE terminar. + +## Um módulo tool-info só: o Test-Comp dentro do `map2check.py` (2026-10-26) + +**Motivação:** a revisão do benchexec#1352 (Philipp Wendler) e do fm-tools!1245 (Dirk Beyer) +pediu que o suporte ao Test-Comp entrasse no módulo `benchexec/tools/map2check.py` que já +existe, em vez de um `map2check-testcomp.py` à parte. + +**Mudança:** +- `utils/map2check-wrapper.py` passa a ser o único wrapper. Ele despacha pela propriedade: + `COVER(...)` gera testes e termina com a linha `DONE`; `CHECK(...)` segue o caminho + SV-COMP de antes. +- O wrapper agora usa o caminho absoluto do binário e repassa o `--data-model` também no + modo SV-COMP. +- O `utils/map2check-testcomp-wrapper.py` e o `utils/moduleBenchExec/map2check_testcomp.py` + saem. +- O módulo (cópia do upstream editado) faz quatro coisas novas: + - reconhece `DONE` como `RESULT_DONE`; + - troca o `assert` por `UnsupportedFeatureException`; + - passa `--data-model` e `--budget` só se `--version` do wrapper indicar v9 ou mais, + porque os wrappers v7 do SV-COMP 2018–2020 rejeitam essas flags; + - mantém o `working_directory` do upstream (diretório da ferramenta). Os `resultfiles` + são resolvidos relativos a ele, então a `test-suite/` é coletada. + +**Verificação:** +- `tests/integration/test_benchexec_toolinfo.py`: 24/24. O teste cobre as versões v9, v7 e + sem versão, os veredictos do SV-COMP e DONE/ERROR/TIMEOUT. +- Pacote regenerado do `install_v99c` (99 MB, 641 arquivos) e execução real do BenchExec + (`tests/testcomp/official/run.sh`), 120 s e 4 GB, em `simple_2-2` e `gcd_1` (ILP32): + +| propriedade | tarefa | status | casos | arquitetura no metadata | +|---|---|---|---|---| +| Cover-Error | simple_2-2 | done | 2 | 32bit | +| Cover-Branches | simple_2-2 | done | 50 | 32bit | +| Cover-Branches | gcd_1 | done | 7 | 32bit | + +- `32bit` mostra que o `--data-model ILP32` chegou ao wrapper (o padrão dele é LP64). +- TestCov (gcc, formatado e não formatado) na suíte do Cover-Error de `simple_2-2`: `true` + nos dois, ou seja, a suíte pontua. diff --git a/test-comp2026/simulation/resultados_de_testes/juliet_wasm/wasm_results.csv b/docs/reports/wasm-juliet-validation.csv similarity index 100% rename from test-comp2026/simulation/resultados_de_testes/juliet_wasm/wasm_results.csv rename to docs/reports/wasm-juliet-validation.csv diff --git a/docs/superpowers/plans/2026-07-16-castle-benchmark.md b/docs/superpowers/plans/2026-07-16-castle-benchmark.md new file mode 100644 index 000000000..5c161443c --- /dev/null +++ b/docs/superpowers/plans/2026-07-16-castle-benchmark.md @@ -0,0 +1,573 @@ +# CASTLE-Benchmark Integration Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Integrate CASTLE C250 benchmark (250 C micro-benchmarks, 25 CWEs) into Map2Check: 5 regression tests in CI + standalone evaluation script for paper results. + +**Architecture:** Two-layer approach. Layer 1: `tests/integration/test_castle_regression.sh` — 5 curated CASTLE tests compiled to LLVM bitcode, verified with `--memtrack`, following the `test_wasm_pipeline.sh` pattern. Layer 2: `tests/castle/run_castle_evaluation.sh` — standalone script that runs all 250 tests with two-pass invariants strategy, scores against `CASTLE-C250.min.json` ground truth, outputs CSV + summary. + +**Tech Stack:** bash, clang-16 (bitcode compilation), map2check (--memtrack), python3 (JSON parsing), git submodule (CASTLE-Benchmark), Docker ghcr.io/hbgit/map2check-dev (CI) + +## Global Constraints + +- clang-16 is the required compiler version +- map2check binary must be built with KLEE support (not SKIP_KLEE) +- All CASTLE tests use plain `main()` — no `reach_error()` or `__VERIFIER_nondet_int()` harness +- `--memtrack` mode covers valid-free, valid-deref, valid-memtrack via KLEE symbolic execution +- `--add-invariants` is used as fallback only when first pass returns UNKNOWN +- Per-test timeout: 60s (regression) / 120s (evaluation) +- Out-of-scope CWEs (22, 78, 89, 327, 522, 798) flagged N/A +- CASTLE-Benchmark is a git submodule pinned to main HEAD + +--- + +### Task 1: Add CASTLE-Benchmark git submodule + +**Files:** +- Modify: `.gitmodules` +- Create: `tests/castle/CASTLE-Benchmark` (submodule directory) + +**Interfaces:** +- Produces: `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/*.c` (250 C files), `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json` (ground truth) + +- [ ] **Step 1: Add the submodule** + +```bash +cd /home/guilherme/github/Map2Check +mkdir -p tests/castle +git submodule add --name CASTLE-Benchmark \ + https://github.com/CASTLE-Benchmark/CASTLE-Benchmark \ + tests/castle/CASTLE-Benchmark +``` + +- [ ] **Step 2: Pin to current main HEAD and verify** + +```bash +cd tests/castle/CASTLE-Benchmark +git log --oneline -1 +# Should show the latest commit on main +cd /home/guilherme/github/Map2Check +ls tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-1.c +``` + +Run: `ls tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/ | wc -l` +Expected: `> 250` (250 .c files + Makefile) + +- [ ] **Step 3: Commit** + +```bash +git add .gitmodules tests/castle/CASTLE-Benchmark +git commit -m "chore: add CASTLE-Benchmark git submodule" +``` + +--- + +### Task 2: Write CASTLE regression test script + +**Files:** +- Create: `tests/integration/test_castle_regression.sh` + +**Interfaces:** +- Consumes: `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/*.c` (from Task 1), `$MAP2CHECK_PATH` env var (points to map2check binary) +- Produces: Exit code 0 (all passed) or 1 (any failed), console output with PASS/FAIL per test + +- [ ] **Step 1: Create the script** + +```bash +#!/bin/bash +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +CASTLE_DIR="tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250" +TMPDIR=$(mktemp -d) +PASSED=0 +FAILED=0 + +cleanup() { rm -rf "$TMPDIR"; } +trap cleanup EXIT + +echo "============================================================" +echo "Map2Check CASTLE Regression Tests" +echo "============================================================" + +run_castle_test() { + local name="$1" + local cwe="$2" + local expect_fail="$3" + + local src="$CASTLE_DIR/$name" + local bc="$TMPDIR/$name.bc" + + echo "" + echo "--- Test: $name (CWE-$cwe) ---" + + $CLANG -c -emit-llvm -g -O0 "$src" -o "$bc" 2>/dev/null || { + echo " SKIP: compile failed" + return 0 + } + + local output + output=$(timeout 120 "$MAP2CHECK" --memtrack --timeout 60 "$bc" 2>&1) || true + + if [ "$expect_fail" = "true" ]; then + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " PASS: vulnerability detected" + PASSED=$((PASSED+1)) + else + echo " FAIL: expected FALSE, got:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + else + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " FAIL: expected TRUE, got FALSE:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + else + echo " PASS: no false alarm" + PASSED=$((PASSED+1)) + fi + fi +} + +run_castle_test "CASTLE-476-1.c" "476" "true" +run_castle_test "CASTLE-415-2.c" "415" "true" +run_castle_test "CASTLE-476-8.c" "476" "false" +run_castle_test "CASTLE-416-1.c" "416" "true" +run_castle_test "CASTLE-787-3.c" "787" "true" + +echo "" +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ $FAILED -eq 0 ] && exit 0 || exit 1 +``` + +- [ ] **Step 2: Make executable** + +```bash +chmod +x tests/integration/test_castle_regression.sh +``` + +- [ ] **Step 3: Run locally to verify syntax** + +```bash +bash -n tests/integration/test_castle_regression.sh +``` + +Expected: no output (syntax OK) + +- [ ] **Step 4: Commit** + +```bash +git add tests/integration/test_castle_regression.sh +git commit -m "test: add CASTLE regression tests (5 micro-benchmarks)" +``` + +--- + +### Task 3: Add CI job for CASTLE regression + +**Files:** +- Modify: `.github/workflows/ci.yml` (append new job after e2e-wasm) + +**Interfaces:** +- Consumes: `tests/integration/test_castle_regression.sh` (from Task 2), `ghcr.io/hbgit/map2check-dev:latest` Docker image +- Produces: CI job `castle-regression` that runs on push to develop/feat-*, PRs to develop/main + +- [ ] **Step 1: Add the CI job** + +Insert this YAML block after the `e2e-wasm` job (after line 291 in ci.yml): + +```yaml + # =========================================================== + # Job 6: CASTLE Benchmark Regression Tests + # =========================================================== + # Verifies Map2Check against 5 CASTLE micro-benchmarks + # (CWE-415, 416, 476, 787) — memory safety regression suite. + castle-regression: + name: CASTLE Regression + runs-on: ubuntu-22.04 + timeout-minutes: 20 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build + install Map2Check in container + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_castle_ci install_castle_ci + mkdir -p build_castle_ci && cd build_castle_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci + ninja + ninja install + mkdir -p /workspace/install_castle_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_castle_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_castle_ci/lib/clang + ' + + - name: Run CASTLE regression tests + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_castle_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + bash tests/integration/test_castle_regression.sh + ' +``` + +- [ ] **Step 2: Verify YAML syntax** + +```bash +python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))" +``` + +- [ ] **Step 3: Commit** + +```bash +git add .github/workflows/ci.yml +git commit -m "ci: add CASTLE regression job" +``` + +--- + +### Task 4: Write CASTLE evaluation script + +**Files:** +- Create: `tests/castle/run_castle_evaluation.sh` + +**Interfaces:** +- Consumes: `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/*.c` (250 C files), `tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json` (ground truth), `$MAP2CHECK_PATH` env var +- Produces: `tests/castle/results/castle_results.csv`, `tests/castle/results/castle_summary.txt` + +- [ ] **Step 1: Create the evaluation script** + +```bash +#!/bin/bash +# run_castle_evaluation.sh — Run all 250 CASTLE C250 benchmarks through Map2Check +# Two-pass strategy: direct, then --add-invariants fallback on UNKNOWN +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +CASTLE_DIR="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250" +JSON_FILE="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250.min.json" +RESULTS_DIR="$SCRIPT_DIR/results" +TIMEOUT_SEC=120 + +# CWE → mode mapping (single-pass flags, --add-invariants added on UNKNOWN) +declare -A CWE_MODE=( + # Memory safety (memtrack) + [125]="--memtrack" + [415]="--memtrack" + [416]="--memtrack" + [476]="--memtrack" + [761]="--memtrack" + [787]="--memtrack" + [822]="--memtrack" + [843]="--memtrack" + # Overflow + [190]="--check-overflow" + # Memcleanup + [401]="--memcleanup-property" + # Assert + [134]="--check-asserts" + [617]="--check-asserts" + # Reachability (other) + [253]="--target-function --target-function-name main" + [362]="--target-function --target-function-name main" + [369]="--target-function --target-function-name main" + [628]="--target-function --target-function-name main" + [674]="--target-function --target-function-name main" + [770]="--target-function --target-function-name main" + [835]="--target-function --target-function-name main" + # Out of scope (still run for completeness, flagged N/A) + [22]="--target-function --target-function-name main" + [78]="--target-function --target-function-name main" + [89]="--target-function --target-function-name main" + [327]="--target-function --target-function-name main" + [522]="--target-function --target-function-name main" + [798]="--target-function --target-function-name main" +) + +OUT_OF_SCOPE_CWES=(22 78 89 327 522 798) + +is_out_of_scope() { + local cwe="$1" + for o in "${OUT_OF_SCOPE_CWES[@]}"; do + [ "$cwe" = "$o" ] && return 0 + done + return 1 +} + +mkdir -p "$RESULTS_DIR" + +echo "CASTLE C250 × Map2Check Evaluation" +echo "==================================" + +# --- Phase 1: Compile all --- +echo "" +echo "Phase 1: Compiling C → LLVM bitcode..." +mkdir -p "$RESULTS_DIR/bc" +COMPILED=0 +COMPILE_FAILED=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + bc_file="$RESULTS_DIR/bc/${name%.c}.bc" + if "$CLANG" -c -emit-llvm -g -O0 -Wno-everything "$c_file" -o "$bc_file" 2>/dev/null; then + COMPILED=$((COMPILED+1)) + else + COMPILE_FAILED=$((COMPILE_FAILED+1)) + echo " FAIL: $name" + fi +done + +echo " Compiled: $COMPILED, Failed: $COMPILE_FAILED" + +# --- Phase 2: Verify + Score --- +echo "" +echo "Phase 2: Running Map2Check on each benchmark..." +echo "id,cwe,name,vulnerable,mode,verdict,invariants,expected,result,time_sec" > "$RESULTS_DIR/castle_results.csv" + +RUN=0 +TP=0; TN=0; FP=0; FN=0; UNK=0; TO=0; NA=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + id="${name%.c}" + id_short=$(echo "$id" | sed 's/CASTLE-//') + + bc_file="$RESULTS_DIR/bc/${id}.bc" + [ -f "$bc_file" ] || continue + + RUN=$((RUN+1)) + + # Extract ground truth from JSON + entry=$(python3 -c " +import json +with open('$JSON_FILE') as f: + data = json.load(f) +for t in data['tests']: + if t['name'] == '$name': + print(json.dumps({'vulnerable': t['vulnerable'], 'cwe': t['cwe'], 'lines': t.get('lines',[])})) + break +" 2>/dev/null) + + vulnerable=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['vulnerable'])") + cwe=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['cwe'])") + + mode_flags="${CWE_MODE[$cwe]:---target-function --target-function-name main}" + + # --- Pass 1: direct --- + start=$(date +%s%N) + output=$(timeout "$TIMEOUT_SEC" "$MAP2CHECK" $mode_flags --timeout 60 "$bc_file" 2>&1) || true + end=$(date +%s%N) + elapsed=$(echo "scale=1; ($end - $start) / 1000000000" | bc) + + used_invariants="no" + if echo "$output" | grep -qi "TIMEOUT\|timed out"; then + verdict="TIMEOUT" + elif echo "$output" | grep -q "FALSE-DEREF"; then + verdict="FALSE-DEREF" + elif echo "$output" | grep -q "FALSE-FREE"; then + verdict="FALSE-FREE" + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + verdict="FALSE-MEMTRACK" + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + verdict="FALSE-OVERFLOW" + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + verdict="FALSE-MEMCLEANUP" + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + verdict="FALSE" + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + verdict="TRUE" + else + verdict="UNKNOWN" + fi + + # --- Pass 2: --add-invariants fallback --- + if [ "$verdict" = "UNKNOWN" ] && [ "$mode_flags" != "--check-asserts" ]; then + used_invariants="yes" + start=$(date +%s%N) + output=$(timeout "$TIMEOUT_SEC" "$MAP2CHECK" $mode_flags --add-invariants --timeout 60 "$bc_file" 2>&1) || true + end=$(date +%s%N) + elapsed=$(echo "scale=1; ($end - $start) / 1000000000" | bc) + + if echo "$output" | grep -qi "TIMEOUT\|timed out"; then + verdict="TIMEOUT" + elif echo "$output" | grep -q "FALSE-DEREF"; then + verdict="FALSE-DEREF" + elif echo "$output" | grep -q "FALSE-FREE"; then + verdict="FALSE-FREE" + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + verdict="FALSE-MEMTRACK" + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + verdict="FALSE-OVERFLOW" + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + verdict="FALSE-MEMCLEANUP" + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + verdict="FALSE" + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + verdict="TRUE" + else + verdict="UNKNOWN" + fi + fi + + # --- Classify --- + if is_out_of_scope "$cwe"; then + classification="N/A" + NA=$((NA+1)) + elif [ "$verdict" = "TIMEOUT" ]; then + classification="TIMEOUT" + TO=$((TO+1)) + elif [ "$verdict" = "UNKNOWN" ]; then + classification="UNKNOWN" + UNK=$((UNK+1)) + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "True" ]; then + classification="TP" + TP=$((TP+1)) + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="FP" + FP=$((FP+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="TN" + TN=$((TN+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "True" ]; then + classification="FN" + FN=$((FN+1)) + else + classification="UNCLASSIFIED" + UNK=$((UNK+1)) + fi + + echo "$id_short,$cwe,$name,$vulnerable,$mode_flags,$verdict,$used_invariants,$vulnerable,$classification,$elapsed" >> "$RESULTS_DIR/castle_results.csv" + echo " [$RUN/250] $name (CWE-$cwe): $verdict → $classification (${elapsed}s)" +done + +# --- Phase 3: Summary --- +echo "" +echo "Phase 3: Generating summary..." +TOTAL_SCOPE=$((TP+TN+FP+FN)) +DETECTABLE=$((TOTAL_SCOPE - NA)) + +cat > "$RESULTS_DIR/castle_summary.txt" << EOF +CASTLE C250 × Map2Check Evaluation Results +=========================================== +Date: $(date -u +"%Y-%m-%dT%H:%M:%SZ") +Map2Check binary: $MAP2CHECK + +Totals: + Total tests: 250 + Detected (in-scope): $DETECTABLE + Out of scope (N/A): $NA + Timeouts: $TO + Unknown: $UNK + +Detection Metrics (in-scope): + True Positives: $TP + False Positives: $FP + True Negatives: $TN + False Negatives: $FN + + Precision: $(python3 -c "print(f'{$TP/($TP+$FP)*100:.1f}%')" 2>/dev/null || echo "N/A") + Recall: $(python3 -c "print(f'{$TP/($TP+$FN)*100:.1f}%')" 2>/dev/null || echo "N/A") + +Results written to: + CSV: $RESULTS_DIR/castle_results.csv +EOF + +cat "$RESULTS_DIR/castle_summary.txt" + +echo "" +echo "Done. Results in $RESULTS_DIR/" +``` + +- [ ] **Step 2: Make executable** + +```bash +chmod +x tests/castle/run_castle_evaluation.sh +``` + +- [ ] **Step 3: Syntax check** + +```bash +bash -n tests/castle/run_castle_evaluation.sh +``` + +Expected: no output + +- [ ] **Step 4: Commit** + +```bash +git add tests/castle/run_castle_evaluation.sh +git commit -m "feat(castle): add evaluation script for all 250 CASTLE benchmarks" +``` + +--- + +### Task 5: Verify end-to-end + +**Files:** +- Test: `tests/integration/test_castle_regression.sh` (already committed) +- Test: `tests/castle/run_castle_evaluation.sh` (already committed) + +- [ ] **Step 1: Run regression tests locally (Docker)** + +```bash +docker run --rm \ + -u root \ + -v "$(pwd):/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_e2e \ + ghcr.io/hbgit/map2check-dev:latest bash -c '\ + rm -rf build_castle_ci install_castle_ci && \ + mkdir -p build_castle_ci && cd build_castle_ci && \ + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci && \ + ninja && ninja install && \ + mkdir -p /workspace/install_castle_ci/lib/klee && \ + ln -sf /opt/klee/lib/klee/runtime /workspace/install_castle_ci/lib/klee/runtime && \ + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_castle_ci/lib/clang && \ + bash tests/integration/test_castle_regression.sh' +``` + +- [ ] **Step 2: Push and verify CI passes** + +```bash +git push origin feat/wasm-clean +# Check GitHub Actions for castle-regression job +``` diff --git a/docs/superpowers/plans/2026-08-16-add-invariants-revival.md b/docs/superpowers/plans/2026-08-16-add-invariants-revival.md new file mode 100644 index 000000000..3a614aeb5 --- /dev/null +++ b/docs/superpowers/plans/2026-08-16-add-invariants-revival.md @@ -0,0 +1,1033 @@ +# `--add-invariants` Revival Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Stop `--add-invariants` from being silently ignored, then restore the +capability by migrating from the abandoned crab-llvm fork to Clam `dev16`, with a CI +test that fails today and passes once the migration lands. + +**Architecture:** Two phases with a measurement gate between them. Phase A makes the +missing capability loud on every input path and repairs the three call sites that pass +the flag today. Phase B builds Clam `dev16` into the development image behind +`-DENABLE_CLAM=ON`, rewrites the invocation for Clam's renamed options, and promotes +the capability only after a differential run proves no detection was lost. The +consumption side needs no work: `NonDetPass.cpp:95` already maps `verifier.assume` to +`map2check_crab_assume`, and Clam still emits that symbol. + +**Tech Stack:** C++17, CMake, Docker (`Dockerfile.dev`), bash, Clam `dev16` +(Apache-2.0), GitHub Actions. + +**Spec:** [docs/reports/2026-08-16-crabllvm-review.md](../../reports/2026-08-16-crabllvm-review.md) +— the systematic review that establishes the dependency's real state, the flag +renames, and the soundness hazard that decides the default. + +## Global Constraints + +- **Clam `dev16`**, `https://github.com/seahorn/clam.git`, Apache-2.0. Last commit on + that branch `302bf49` (2026-08-07). `CMakeLists.txt` pins `CLAM_LLVM_VERSION 16`. +- **The one renamed flag:** `--crab-add-invariants=block-entry` becomes + `--crab-opt=add-invariants --crab-opt-invariants-loc=block-entry`. + `--crab-track=num`, `--crab-inter`, `--crab-promote-assume`, `--llvm-pp-loops`, + `-o`, `-m`, `-g` are unchanged. +- **`verifier.assume` is preserved** in Clam (`lib/Clam/Optimizer/Optimizer.cc:667`). + `modules/backend/pass/NonDetPass.cpp:95` must not change. +- **Extra system packages:** `libmpfr-dev`, `libzstd-dev`, `libcurl4-openssl-dev`. + `libgmp-dev` and `libboost-all-dev` are already in `Dockerfile.dev`. `libzstd-dev` + is not optional and is easy to miss: LLVM 16 from apt.llvm.org exports + `zstd::libzstd_shared` in its CMake export set, so `find_package(LLVM)` inside Clam + fails outright without it. `libflint-dev` is **not** needed — it belongs to the + PPLite domain, which this build does not enable. +- **Domains:** none of `CRAB_USE_LDD` / `CRAB_USE_APRON` / `CRAB_USE_ELINA` / + `CRAB_USE_PPLITE`. The old `build_crabllvm.py` turned LDD and Apron on, but the + invocation used `--crab-track=num` with the default interval domain and never + touched them. Leaving them off removes four third-party libraries from the build. +- **Build order is `crab` then `extra`**, per Clam's README. The old script did + `extra` first; the current sequence is: + `cmake ..` → `--target crab && cmake ..` → `--target extra && cmake ..` → + build → `--target install`. The intermediate `cmake ..` re-reads the cache so the + main build can see the dependencies the previous target just installed. +- **Off by default.** An unsound invariant produces a wrong TRUE, not an error: under + KLEE `klee_assume` prunes a reachable state, and under LibFuzzer `nondet_assume` + calls `pthread_exit` and the execution dies silently. Promotion to default requires + the differential evidence in Task 7. +- **The CI image lags the Dockerfile.** CI jobs `docker pull + ghcr.io/hbgit/map2check-dev:latest`, which `docker-publish.yml` republishes on push + to `develop`. Clam will not be in the pulled image during this work. The capability + test must therefore *detect* which state it is in rather than assume one — that + detection is what turns it from a regression guard into a progress detector. +- C++ follows Google style; run `./check_code_style.py -p`. + +## Comparability with the v5 baseline + +v5 is frozen as the "before" of a before/after comparison, so every harness change +made here is a potential confounder and has to be declared rather than discovered +later. Two deltas land in this plan: + +1. **`used_invariants` changes meaning.** In v5 it recorded `yes` for runs that used + no invariants at all. From v6 on, `yes` means invariants were actually applied and + `unavailable` means the generator was missing. The v5 column is not comparable to + the v6 column; only `no` means the same thing in both. +2. **Pass 2 stops being a duplicate run.** In v5 it re-analysed identical bitcode with + identical flags. From v6 on it either applies invariants or does not run. Wall-clock + per UNKNOWN row therefore drops even if no verdict changes, so run times are not + comparable across the boundary either. + +**Attribution rule for the v6 run.** Invariants must be *off* for the headline v6 +CASTLE/Juliet run. Otherwise any improvement is jointly caused by the width-aware +overflow fix, the timeout fix, the sampling fix and the invariants, and none of them +can be credited. The invariants question is answered separately and against the same +build, by the differential in Task 7 — which is why that task compares with/without on +one binary rather than comparing v6 against v5. + +--- + +## PHASE A — stop the silence + +### Task 1: Fail loudly when invariants are requested but unavailable + +**Files:** +- Modify: `modules/frontend/map2check.cpp` (exit code, capability check, dispatch) +- Modify: `modules/frontend/utils/tools.hpp` (the Clam binary path) +- Test: `tests/integration/test_add_invariants.sh` +- Modify: `.github/workflows/ci.yml` + +**Interfaces:** +- Consumes: nothing. +- Produces: + - exit code `3` (`ERROR_UNAVAILABLE_CAPABILITY`) when `--add-invariants` is passed + and no invariant generator is installed; + - `bool Map2Check::invariantGeneratorAvailable()` in `map2check.cpp`'s anonymous + namespace — Task 5 replaces its body, and Task 6's test keys off its effect. + +The current guard is in `map2check.cpp:227-245`, inside `if (!is_llvmir_in)`. With +`.c` input it warns; with `.bc` input — how every baseline run and the CASTLE harness +invoke the tool — the whole block is skipped and not even the warning appears. A flag +that is accepted, ignored, and leaves no trace is a silently wrong configuration, and +on a competition cluster a warning on stderr disappears into the BenchExec log. + +- [ ] **Step 1: Write the failing test** + +```bash +#!/bin/bash +# test_add_invariants.sh -- the --add-invariants contract. +# +# This file has two jobs, and the second is unusual. +# +# The first is the ordinary one: --add-invariants must never be accepted and +# then ignored without a trace. That was the state issue #54 describes, and it +# held on the .bc input path -- which is how the entire v5 baseline and the +# CASTLE harness invoke the tool. +# +# The second is to detect PROGRESS. The invariant generator is absent today, so +# the "unavailable" assertions below are what passes. Once Clam dev16 is built +# into the image, the same run must instead succeed and inject verifier.assume +# calls. The script probes which state it is in and asserts the contract for +# that state, reporting the state loudly either way. A green run therefore +# means "the contract holds", and the printed CAPABILITY line says which +# contract that was -- so the day the capability comes back is visible in the +# CI log rather than inferred. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +cat > "$WORK/loop.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int i = 0; + int sum = 0; + if (n < 0 || n > 100) return 0; + while (i < n) { sum += i; i++; } + if (sum < 0) { reach_error(); } + return 0; +} +EOF + +# The .bc path is the one that was silent, so it is the one under test. +clang-16 -c -emit-llvm -g -o "$WORK/loop.bc" "$WORK/loop.c" 2>/dev/null + +echo "============================================================" +echo "--add-invariants contract" +echo "============================================================" + +run_flag() { + local input="$1" rc=0 + ( cd "$WORK" && timeout -k 10 180 "$MAP2CHECK" --target-function \ + --target-function-name reach_error --add-invariants \ + --nondet-generator symex --timeout 60 "$input" ) > "$WORK/out.txt" 2>&1 || rc=$? + echo "$rc" +} + +rc_bc=$(run_flag loop.bc) +out_bc=$(cat "$WORK/out.txt") + +if [ "$rc_bc" -eq 3 ]; then + CAPABILITY="ABSENT" +elif [ "$rc_bc" -eq 0 ]; then + CAPABILITY="PRESENT" +else + CAPABILITY="BROKEN" +fi +echo " CAPABILITY: invariant generator is $CAPABILITY (exit $rc_bc)" + +case "$CAPABILITY" in + ABSENT) + # The contract while Clam is not built. + echo "$out_bc" | grep -qi "add-invariants" \ + && ok "the failure names the flag that caused it" \ + || fail "diagnostic" "exit 3 with no mention of --add-invariants" + + echo "$out_bc" | grep -qiE "not built|unavailable|not available" \ + && ok "the failure says the capability is unavailable" \ + || fail "diagnostic" "no explanation of why it failed" + + # The silence bug itself: .c input already warned, .bc did not. Both must + # behave identically now. + rc_c=$(run_flag loop.c) + [ "$rc_c" -eq 3 ] \ + && ok ".c input fails the same way .bc does (issue #54)" \ + || fail "input path parity" ".bc exited 3 but .c exited $rc_c" + + # Without the flag, nothing changes. + rc_plain=0 + ( cd "$WORK" && timeout -k 10 180 "$MAP2CHECK" --target-function \ + --target-function-name reach_error --nondet-generator symex \ + --timeout 60 loop.bc ) > "$WORK/plain.txt" 2>&1 || rc_plain=$? + [ "$rc_plain" -ne 3 ] \ + && ok "runs without --add-invariants are unaffected" \ + || fail "collateral" "a run without the flag also exited 3" + ;; + + PRESENT) + # The contract once Clam dev16 is in place. Reaching this branch is the + # progress signal: it means the migration landed. + ok "--add-invariants completes successfully" + + # Succeeding is not enough -- it must actually inject invariants, or the + # flag is a no-op wearing a success exit code. + bc=$(find "$WORK" -name '*-compiled.bc' -o -name '*-crab.bc' | head -1) + if [ -n "$bc" ] && llvm-dis-16 -o - "$bc" 2>/dev/null | grep -q 'verifier.assume'; then + ok "the produced bitcode contains verifier.assume calls" + else + fail "invariant injection" "exit 0 but no verifier.assume in the bitcode" + fi + ;; + + BROKEN) + fail "capability probe" "exit $rc_bc is neither 3 (absent) nor 0 (present)" + echo "$out_bc" | tail -20 + ;; +esac + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed [capability: $CAPABILITY]" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 +``` + +- [ ] **Step 2: Run it and verify it fails** + +```bash +MAP2CHECK_PATH=$PWD/release bash tests/integration/test_add_invariants.sh +``` +Expected: `CAPABILITY: invariant generator is BROKEN (exit 0)` — today the flag is +accepted and ignored, so the run succeeds and the probe rejects it. + +- [ ] **Step 3: Add the exit code and the capability check** + +In `modules/frontend/map2check.cpp`, next to the other codes (line 44): + +```cpp +const size_t ERROR_UNAVAILABLE_CAPABILITY = 3; +``` + +In the same anonymous namespace, add: + +```cpp +/** Whether an invariant generator is installed alongside this build. + * + * Clam (formerly crab-llvm) is an external tool invoked as a subprocess, so + * the answer is a filesystem question and not a compile-time one: a binary + * built with -DENABLE_CLAM=ON still has to find the installed script. */ +bool invariantGeneratorAvailable() { + const char* m2cPath = getenv("MAP2CHECK_PATH"); + if (m2cPath == nullptr) return false; + return fs::exists(std::string(m2cPath) + "/bin/crabllvm/bin/crabllvm.py"); +} +``` + +- [ ] **Step 4: Replace the dispatch so both input paths are covered** + +Replace the whole `if (!is_llvmir_in) { ... } else { ... }` block at +`modules/frontend/map2check.cpp:226-247` with: + +```cpp + // The capability check comes before the input-kind branch on purpose. It used + // to live inside the !is_llvmir_in arm, which meant that with bitcode input + // -- how the baselines and the CASTLE harness invoke the tool -- the flag was + // accepted, ignored, and left no trace at all (issue #54). + if (args.invCrabLlvm && !invariantGeneratorAvailable()) { + Map2Check::Log::Error( + "--add-invariants was requested but no invariant generator is " + "installed. Crab-LLVM was renamed to Clam and this build does not " + "ship it; rebuild with -DENABLE_CLAM=ON, or drop the flag. Refusing " + "to continue rather than silently analysing without invariants."); + return ERROR_UNAVAILABLE_CAPABILITY; + } + + if (!is_llvmir_in && args.invCrabLlvm) { + caller->compileToCrabLlvm(); + } else { + caller->compileCFile(is_llvmir_in); + } +``` + +Note that with bitcode input and the capability present, the tool still takes the +`compileCFile` path — Clam needs source, and instrumenting already-compiled bitcode +with invariants is a separate question that Task 5 addresses. + +- [ ] **Step 5: Verify `Log::Error` exists and is fatal-looking** + +```bash +grep -n "static void Error\|void Error" modules/frontend/utils/log.hpp +``` +If there is no `Error` level, use `Map2Check::Log::Warning` with the same text and +keep the exit code — the exit code is the contract the test asserts; the log level is +presentation. + +- [ ] **Step 6: Build and run the test** + +```bash +cd build && ninja && ninja install && cd .. +MAP2CHECK_PATH=$PWD/release bash tests/integration/test_add_invariants.sh +``` +Expected: `CAPABILITY: invariant generator is ABSENT (exit 3)` and +`Results: 4 passed, 0 failed`. + +- [ ] **Step 7: Add it to CI** + +In `.github/workflows/ci.yml`, in the `castle-regression` job's `Run regression tests` +step, after `bash tests/integration/test_modes.sh`: + +```yaml + bash tests/integration/test_add_invariants.sh +``` + +- [ ] **Step 8: Commit** + +```bash +./check_code_style.py -p +git add modules/frontend/map2check.cpp tests/integration/test_add_invariants.sh \ + .github/workflows/ci.yml +git commit -m "fix(invariants): refuse --add-invariants instead of ignoring it" +``` + +--- + +### Task 2: Let the three call sites keep requesting invariants + +**Files:** +- Modify: `utils/map2check-wrapper.py:73` (comment only) +- Modify: `utils/map2check-wrapper-reg-test.py:75` (comment only) +- Modify: `tests/castle/run_castle_evaluation.sh:167-180` +- Modify: `docs/reports/2026-08-12-castle-juliet-findings.md` + +**Interfaces:** +- Consumes: exit code 3 from Task 1. +- Produces: no new interface. The CASTLE CSV's `used_invariants` column gains a third + legal value, `unavailable`. + +Three call sites pass `--add-invariants` today: the two BenchExec wrappers +(`map2check-wrapper.py`, `map2check-wrapper-reg-test.py`) and the CASTLE harness's +second pass. Task 1 turns the silent no-op into a hard failure, so all three start +failing until Phase B lands. + +**That breakage is intended and the flag stays in all three.** They are asking for a +capability the tool is supposed to have; Clam is the repair, not deletion. Removing the +request would hide the gap and then require remembering to restore it — the same class +of silent drift that produced issue #54 in the first place. Leaving it in makes the +three call sites part of the progress signal: they fail while the capability is absent +and work the day it returns. + +One exception, and it is about data integrity rather than about the flag. The CASTLE +harness's pass 2 re-runs the tool on UNKNOWN and **replaces** pass 1's verdict with the +result. If pass 2 now exits 3, the classifier records `ERROR` on top of a perfectly +good `UNKNOWN`, so a baseline run during the gap would produce a corrupted CSV rather +than a visible failure. The harness therefore learns to recognise exit 3 as +"invariants unavailable" and keeps pass 1's verdict. That is handling a documented +contract, not withdrawing the request. + +Worth recording while here: because the flag was ignored on the `.bc` path, **pass 2 +has been a byte-identical re-run of pass 1** — a second full timeout budget spent +reaching the same conclusion, with `used_invariants="yes"` written to the CSV as if +invariants had been applied. That column is wrong in the v5 data. + +- [ ] **Step 1: Document the dependency in the BenchExec wrappers** + +The flag stays. Add above line 73 of `utils/map2check-wrapper.py`: + +```python + # --add-invariants requires Clam (formerly crab-llvm), which is not in every + # build. map2check exits 3 rather than ignoring the flag, so this wrapper + # fails loudly until Clam ships -- deliberately. Do not drop the flag to make + # the failure go away; the fix is to build with -DENABLE_CLAM=ON. See + # docs/reports/2026-08-16-crabllvm-review.md. +``` + +Add the same comment above line 75 of `utils/map2check-wrapper-reg-test.py`. + +- [ ] **Step 2: Verify both wrappers still parse and still pass the flag** + +```bash +python3 -c "import ast; ast.parse(open('utils/map2check-wrapper.py').read()); \ + ast.parse(open('utils/map2check-wrapper-reg-test.py').read()); print('ok')" +grep -c "add-invariants" utils/map2check-wrapper.py +``` +Expected: `ok`, and a count of 2 (the comment plus the still-present flag). + +- [ ] **Step 3: Stop pass 2 from overwriting a good verdict with exit 3** + +In `tests/castle/run_castle_evaluation.sh`, replace the pass 2 block +(lines 167-179) with: + +```bash + # --- Pass 2: --add-invariants fallback --- + # The flag is requested unconditionally on purpose: this pass exists to retry + # UNKNOWN cases with abstract-interpretation invariants, and map2check is + # supposed to provide them. What is handled here is the documented exit code + # for "the generator is not installed" (3), because pass 2 REPLACES pass 1's + # verdict -- without this, a run during the Clam gap would write ERROR over a + # perfectly good UNKNOWN and corrupt the CSV instead of failing visibly. + # + # Note for anyone reading v5 data: through that baseline the flag was silently + # ignored on .bc input, so pass 2 was a byte-identical re-run of pass 1 and + # used_invariants=yes did not mean invariants were applied. + if [ "$verdict" = "UNKNOWN" ] && [ "$mode_flags" != "--check-asserts" ]; then + start=$(date +%s%N) + rc=0 + run_isolated "$raw" "$TIMEOUT_SEC" \ + "$MAP2CHECK" $mode_flags --add-invariants --timeout "$INNER_TIMEOUT" "$bc_file" || rc=$? + end=$(date +%s%N) + + if [ "$rc" -eq 3 ]; then + # Capability absent. Keep pass 1's verdict and its raw output; say so in + # the CSV rather than pretending invariants were tried. + used_invariants="unavailable" + printf '%s' "$output" > "$raw" + else + used_invariants="yes" + output=$(cat "$raw") + elapsed=$(python3 -c "print(round(($end - $start) / 1000000000, 1))") + verdict=$(classify_map2check_verdict "$output" "$rc" "$elapsed" "$INNER_TIMEOUT") + fi + fi +``` + +- [ ] **Step 4: Check the runner still parses and the column has three values** + +```bash +bash -n tests/castle/run_castle_evaluation.sh && echo "syntax ok" +grep -n 'used_invariants=' tests/castle/run_castle_evaluation.sh +``` +Expected: `syntax ok`, and `used_invariants` assigned in exactly three places — `no`, +`yes`, `unavailable`. + +- [ ] **Step 5: Correct the record in the findings report** + +Add to `docs/reports/2026-08-12-castle-juliet-findings.md`, in its own section: + +```markdown +## Correction: the CASTLE second pass never applied invariants + +The runner retried every UNKNOWN with `--add-invariants`. That flag was accepted +and ignored on the bitcode input path (issue #54), so pass 2 re-ran the identical +analysis on the identical input and could only differ through nondeterminism. Two +consequences for the v5 data: + +- The `used_invariants=yes` column does not mean what it says. No run in the v5 + baseline used invariants. +- Every UNKNOWN case cost two full timeout budgets instead of one, which inflates + the wall-clock totals for the affected rows without changing any verdict. + +No verdict in the published table changes: a second identical run cannot turn an +UNKNOWN into a decision except by chance, and the verdicts were taken from the +last run either way. What changes is the interpretation of the column and of the +run times. +``` + +- [ ] **Step 6: Commit** + +```bash +git add utils/map2check-wrapper.py utils/map2check-wrapper-reg-test.py \ + tests/castle/run_castle_evaluation.sh \ + docs/reports/2026-08-12-castle-juliet-findings.md +git commit -m "fix(castle): keep pass 1's verdict when invariants are unavailable" +``` + +--- + +## PHASE B — bring the capability back + +### Task 3: Build Clam dev16 into the development image + +**Files:** +- Modify: `Dockerfile.dev` +- Modify: `CLAUDE.md` + +**Interfaces:** +- Consumes: nothing. +- Produces: `/opt/clam/bin/clam.py` inside the image, and the environment variable + `CLAM_DIR=/opt/clam`. Tasks 4 and 5 depend on that path. + +Clam is added to the image rather than to `FindCrabLlvm.cmake`'s `ExternalProject_Add` +because it is a standalone tool invoked as a subprocess, not a library the frontend +links. Building it per CMake configure would add tens of minutes to every clean build +of Map2Check, for a capability that is off by default. + +- [ ] **Step 1: Add the build stage** + +Insert into `Dockerfile.dev` after section 7 (LibFuzzer) and before section 8 (WABT), +so the WABT and WASI verification steps stay at the end: + +```dockerfile +# ============================================================ +# 7b. Clam (formerly crab-llvm) — abstract-interpretation invariants +# ============================================================ +# Clam rewrites the bitcode, inserting verifier.assume(inv) calls that +# NonDetPass maps to map2check_crab_assume and the runtime forwards to +# klee_assume. Branch dev16 targets LLVM 16, which is this image's LLVM. +# +# Built here rather than as a CMake ExternalProject: it is a subprocess tool, +# not a linked library, and building it per configure would add tens of minutes +# to every clean build for a capability that is off by default. +# libzstd-dev is required, not optional: LLVM 16 from apt.llvm.org exports +# zstd::libzstd_shared, so Clam's find_package(LLVM) fails without it. +# libflint-dev is NOT needed -- that is the PPLite domain, which is off here. +RUN apt-get update && apt-get install -y \ + libmpfr-dev \ + libzstd-dev \ + libcurl4-openssl-dev \ + && rm -rf /var/lib/apt/lists/* + +RUN git clone --depth 1 -b dev16 https://github.com/seahorn/clam.git /tmp/clam && \ + cd /tmp/clam && mkdir build && cd build && \ + cmake .. -DCMAKE_BUILD_TYPE=Release \ + -DCLAM_LLVM_VERSION=16 \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DCMAKE_INSTALL_PREFIX=/opt/clam && \ + cmake --build . --target crab && cmake .. && \ + cmake --build . --target extra && cmake .. && \ + cmake --build . -j$(nproc) && \ + cmake --build . --target install && \ + rm -rf /tmp/clam + +ENV CLAM_DIR=/opt/clam +``` + +The `crab` / `extra` / build / install sequence is Clam's documented one. Each target +downloads and installs a dependency (Crab itself, then sea-dsa and llvm-seahorn), and +the `cmake ..` between them re-reads the cache so the next step can see what the +previous one produced. No optional domain is enabled: `--crab-track=num` uses the +default interval domain, so LDD, Apron, Elina and PPLite would all be dead weight. + +- [ ] **Step 2: Build the image and verify Clam runs** + +```bash +docker build -t map2check-dev -f Dockerfile.dev . 2>&1 | tail -20 +docker run --rm map2check-dev bash -c '/opt/clam/bin/clam.py --help | head -5' +``` +Expected: Clam's usage text. If the build fails on a missing domain library, drop the +optional domains — `USE_LDD` and `USE_APRON` were on in the old script and are not +required for the interval domain that `--crab-track=num` uses. + +- [ ] **Step 3: Confirm the renamed flag combination is accepted** + +```bash +docker run --rm map2check-dev bash -c ' + printf "int main(){int i=0;while(i<10){i++;}return i;}" > /tmp/t.c + /opt/clam/bin/clam.py -o /tmp/t.bc --crab-opt=add-invariants \ + --crab-opt-invariants-loc=block-entry --crab-track=num --crab-inter \ + --crab-promote-assume --llvm-pp-loops /tmp/t.c + llvm-dis-16 -o - /tmp/t.bc | grep -c "verifier.assume"' +``` +Expected: a non-zero count. A count of zero means the invariants are being computed but +not injected, and the `--crab-opt-invariants-loc` value is the first thing to check. + +Record the exact working command line; Task 5 hardcodes it. + +- [ ] **Step 4: Document it and commit** + +Add to `CLAUDE.md`, under the build-environment description: + +```markdown +`Dockerfile.dev` also builds **Clam `dev16`** (the renamed crab-llvm) into +`/opt/clam`. It supplies the abstract-interpretation invariants behind +`--add-invariants`, which is off unless Map2Check is configured with +`-DENABLE_CLAM=ON`. See [the dependency review](docs/reports/2026-08-16-crabllvm-review.md) +for why it is opt-in. +``` + +```bash +git add Dockerfile.dev CLAUDE.md +git commit -m "build(docker): build Clam dev16 for LLVM 16 invariants" +``` + +--- + +### Task 4: The `ENABLE_CLAM` build option + +**Files:** +- Modify: `CMakeLists.txt` +- Modify: `modules/frontend/utils/tools.hpp` +- Delete: `cmake/FindCrabLlvm.cmake` +- Delete: `utils/build_crabllvm.py` + +**Interfaces:** +- Consumes: `/opt/clam/bin/clam.py` from Task 3. +- Produces: the CMake option `ENABLE_CLAM` (default `OFF`), the compile definition + `MAP2CHECK_ENABLE_CLAM`, and `Map2Check::clamBinary` replacing + `Map2Check::crabBinary`. Task 5 uses both. + +`FindCrabLlvm.cmake` clones `seahorn/crab-llvm` with no branch pinned and is not +referenced from any `CMakeLists.txt`; `build_crabllvm.py` hardcodes +`/llvm/release/llvm600` and `g++-5`. Both describe an environment that has not existed +since LLVM 6, and leaving them in place invites someone to run them. + +- [ ] **Step 1: Add the option** + +In the top-level `CMakeLists.txt`, next to the other options (after line 10): + +```cmake +option(ENABLE_CLAM "Enable --add-invariants via Clam (needs Clam dev16 installed)" OFF) +``` + +And where compile definitions are set: + +```cmake +if(ENABLE_CLAM) + # A build-time switch and a runtime path check are both needed: this says the + # build intends to support invariants, the runtime check says the installed + # tree actually has the tool. Neither implies the other. + add_compile_definitions(MAP2CHECK_ENABLE_CLAM) + message(STATUS "Clam invariants: ENABLED") +else() + message(STATUS "Clam invariants: disabled (-DENABLE_CLAM=ON to enable)") +endif() +``` + +- [ ] **Step 2: Point the binary constant at Clam** + +In `modules/frontend/utils/tools.hpp`, replace the `crabBinary` constant (lines 36-38): + +```cpp +/** Path to the Clam driver (formerly crab-llvm). Clam is installed into the + * image at /opt/clam and is overridable with CLAM_DIR for local builds. */ +constexpr char const* clamBinary = "${CLAM_DIR}/bin/clam.py"; +``` + +- [ ] **Step 3: Remove the dead build machinery** + +```bash +git rm cmake/FindCrabLlvm.cmake utils/build_crabllvm.py +grep -rn "FindCrabLlvm\|build_crabllvm\|crabBinary" --include=*.txt --include=*.cmake \ + --include=*.cpp --include=*.hpp --include=*.py --include=*.sh . \ + --exclude-dir=.git +``` +Expected: the only remaining matches are in `caller.cpp`, which Task 5 rewrites. + +- [ ] **Step 4: Confirm both configurations still configure** + +```bash +cd build && cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON 2>&1 | grep "Clam invariants" +cmake .. -DENABLE_CLAM=ON 2>&1 | grep "Clam invariants" +``` +Expected: `disabled` then `ENABLED`. + +- [ ] **Step 5: Commit** + +```bash +git add CMakeLists.txt modules/frontend/utils/tools.hpp +git commit -m "build: add ENABLE_CLAM and retire the LLVM 6 crab machinery" +``` + +--- + +### Task 5: Invoke Clam with its current option names + +**Files:** +- Modify: `modules/frontend/caller.cpp:574-660` (`compileToCrabLlvm`) +- Modify: `modules/frontend/caller.hpp:75` (rename the method) +- Modify: `modules/frontend/map2check.cpp` (capability check and call site) + +**Interfaces:** +- Consumes: `Map2Check::clamBinary` and `MAP2CHECK_ENABLE_CLAM` from Task 4. +- Produces: `void Caller::compileWithClam()` replacing `compileToCrabLlvm()`, and an + `invariantGeneratorAvailable()` that checks the Clam path. Task 6 asserts the effect. + +- [ ] **Step 1: Rewrite the invocation** + +Replace the body of `compileToCrabLlvm` in `modules/frontend/caller.cpp` and rename it +to `compileWithClam`. The command becomes: + +```cpp + // Clam renamed exactly one of the options this call used to pass: + // crab-llvm: --crab-add-invariants=block-entry + // Clam: --crab-opt=add-invariants --crab-opt-invariants-loc=block-entry + // Everything else -- track, inter, promote-assume, llvm-pp-loops -- kept its + // name. See docs/reports/2026-08-16-crabllvm-review.md. + command << Map2Check::clamBinary << " -o " << compiledFile + << " -m 64 -g" + << " --crab-track=num" + << " --crab-inter" + << " --crab-promote-assume" + << " --llvm-pp-loops" + << " --crab-opt=add-invariants" + << " --crab-opt-invariants-loc=block-entry" + << " " << programHash << "-preprocessed.c"; +``` + +Keep the existing `LD_LIBRARY_PATH` export, retargeted from +`${MAP2CHECK_PATH}/bin/crabllvm/lib` to `${CLAM_DIR}/lib`. + +Substitute the flag list with whatever Task 3 Step 3 actually validated — that step +exists precisely so this one is transcription and not guesswork. + +- [ ] **Step 2: Update the header** + +In `modules/frontend/caller.hpp`, line 75: + +```cpp + /** Compiles the input through Clam so the bitcode carries + * verifier.assume(invariant) calls. Requires Clam dev16 installed; the caller + * must have checked availability first. */ + void compileWithClam(); +``` + +- [ ] **Step 3: Point the capability check at Clam** + +In `modules/frontend/map2check.cpp`, replace the body of +`invariantGeneratorAvailable()`: + +```cpp +bool invariantGeneratorAvailable() { +#ifndef MAP2CHECK_ENABLE_CLAM + return false; +#else + const char* clamDir = getenv("CLAM_DIR"); + std::string path = + (clamDir ? std::string(clamDir) : std::string("/opt/clam")) + + "/bin/clam.py"; + return fs::exists(path); +#endif +} +``` + +and change the dispatch call from `caller->compileToCrabLlvm();` to +`caller->compileWithClam();`. + +- [ ] **Step 4: Build both ways and confirm the check flips** + +```bash +docker run --rm -v "$PWD:/workspace" -w /workspace -u root map2check-dev bash -c ' + rm -rf build_clam && mkdir build_clam && cd build_clam + cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_CLAM=ON -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_clam + ninja && ninja install' +``` +Then run the Task 1 test against that install and expect +`CAPABILITY: invariant generator is PRESENT`. + +- [ ] **Step 5: Style-check and commit** + +```bash +./check_code_style.py -p +git add modules/frontend/caller.cpp modules/frontend/caller.hpp \ + modules/frontend/map2check.cpp +git commit -m "feat(invariants): invoke Clam dev16 with its current option names" +``` + +--- + +### Task 6: Prove the capability came back, in CI + +**Files:** +- Modify: `.github/workflows/ci.yml` + +**Interfaces:** +- Consumes: `tests/integration/test_add_invariants.sh` (Task 1), the `ENABLE_CLAM` + build (Task 4), and the Clam image (Task 3). +- Produces: a CI job named `Invariants (Clam)`. + +The Task 1 test already asserts both contracts and prints which one it checked. What is +missing is a CI job that builds *with* `-DENABLE_CLAM=ON`, so the `PRESENT` branch is +actually exercised. Until the published image carries Clam, that job reports `ABSENT` +and stays green; the day the image is republished it flips to `PRESENT` and starts +asserting invariant injection. That transition, visible in the CI log, is the proof the +capability returned. + +- [ ] **Step 1: Add the job** + +```yaml + # =========================================================== + # Job: Invariants — the --add-invariants contract + # =========================================================== + # Runs the same test in whichever state the image is in. While the published + # image has no Clam, the test asserts that the flag fails loudly (issue #54). + # Once the image carries Clam, the very same test asserts that the flag + # succeeds AND injects verifier.assume. The CAPABILITY line in the log says + # which contract was checked, so the migration landing is visible rather than + # inferred. + invariants-clam: + name: Invariants (Clam) + runs-on: ubuntu-22.04 + timeout-minutes: 25 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build with -DENABLE_CLAM=ON + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_clam_ci install_clam_ci + mkdir -p build_clam_ci && cd build_clam_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_CLAM=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_clam_ci + ninja + ninja install + mkdir -p /workspace/install_clam_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_clam_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_clam_ci/lib/clang + ' + + - name: Assert the --add-invariants contract + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_clam_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + bash tests/integration/test_add_invariants.sh + ' +``` + +- [ ] **Step 2: Add the build directories to .gitignore** + +Append to the evaluation-artifacts block in `.gitignore`: + +``` +build_clam_ci/ +install_clam_ci/ +build_clam/ +install_clam/ +``` + +- [ ] **Step 3: Verify the workflow parses and commit** + +```bash +python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml')); print('ok')" +git add .github/workflows/ci.yml .gitignore +git commit -m "ci: assert the --add-invariants contract in both capability states" +``` + +--- + +### Task 7: Differential run before promoting the default + +**Files:** +- Create: `tests/integration/test_invariants_no_regression.sh` +- Create: `docs/reports/2026-XX-XX-invariants-differential.md` (date it on the day it + runs) + +**Interfaces:** +- Consumes: a Clam-enabled install from Task 5. +- Produces: the evidence that decides whether `--add-invariants` may ever become a + default. Nothing consumes it in code. + +An unsound invariant does not raise an error; it produces a wrong TRUE. Under KLEE +`klee_assume` prunes a reachable state; under LibFuzzer `nondet_assume` calls +`pthread_exit` and the execution vanishes. With 35% of baseline cases taking input +through unresolved externals, how Clam models those decides soundness — and the failure +is invisible in a single run. Only a comparison can see it. + +- [ ] **Step 1: Write the differential runner** + +```bash +#!/bin/bash +# test_invariants_no_regression.sh -- every case detected WITHOUT invariants +# must still be detected WITH them. +# +# The asymmetry is deliberate. Gaining detections is the hoped-for outcome and +# is reported, not asserted. LOSING one is a hard failure, because a lost +# detection is the signature of an unsound invariant: klee_assume pruned a +# reachable state, or nondet_assume killed a fuzzer execution. Both look like +# "the program is safe", which is the worst way for this to fail. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +CORPUS="${CORPUS:-$SCRIPT_DIR/../castle/CASTLE-Benchmark}" +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_clam_ci}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +BUDGET="${BUDGET:-60}" + +. "$SCRIPT_DIR/../lib/verdict_classifier.sh" +. "$SCRIPT_DIR/../lib/isolated_run.sh" + +lost=0 +gained=0 +same=0 + +run_one() { # + local f="$1"; shift + local raw rc=0 + raw=$(mktemp) + run_isolated "$raw" "$((BUDGET * 2))" \ + "$MAP2CHECK" --memtrack --timeout "$BUDGET" "$@" "$f" || rc=$? + classify_map2check_verdict "$(cat "$raw")" "$rc" 0 "$BUDGET" + rm -f "$raw" +} + +echo "============================================================" +echo "Invariants differential (budget ${BUDGET}s per run)" +echo "============================================================" + +while IFS= read -r f; do + without=$(run_one "$f") + with=$(run_one "$f" --add-invariants) + + case "$without:$with" in + FALSE*:FALSE*|TRUE:TRUE|UNKNOWN:UNKNOWN|TIMEOUT:TIMEOUT) + same=$((same+1)) ;; + FALSE*:*) + echo " LOST $(basename "$f"): $without -> $with" + lost=$((lost+1)) ;; + *:FALSE*) + echo " GAINED $(basename "$f"): $without -> $with" + gained=$((gained+1)) ;; + *) + echo " CHANGED $(basename "$f"): $without -> $with" + same=$((same+1)) ;; + esac +done < <(find "$CORPUS" -name '*.c' | sort | head -"${SAMPLE:-40}") + +echo "============================================================" +echo "unchanged=$same gained=$gained lost=$lost" +echo "============================================================" + +if [ "$lost" -gt 0 ]; then + echo "FAIL: $lost detection(s) lost. Invariants must stay off by default." + exit 1 +fi +echo "PASS: no detection lost; $gained gained." +exit 0 +``` + +- [ ] **Step 2: Run it** + +```bash +MAP2CHECK_PATH=$PWD/install_clam SAMPLE=40 BUDGET=60 \ + bash tests/integration/test_invariants_no_regression.sh +``` + +- [ ] **Step 3: Write up the result** + +Record, in `docs/reports/`, the sample size, the budget, and the three counters. State +plainly whether the recommendation changes: + +- `lost > 0` → invariants stay off, and the lost cases become the investigation. This + is a finding, not a setback: it would be the first direct evidence about how Clam + models unresolved externals. +- `lost == 0 && gained == 0` → the capability works and buys nothing measurable on this + corpus. Keep it off by default and say so. +- `lost == 0 && gained > 0` → the case for promoting the default, to be made with the + numbers attached. + +- [ ] **Step 4: Commit** + +```bash +git add tests/integration/test_invariants_no_regression.sh docs/reports/ +git commit -m "test(invariants): differential run before any default change" +``` + +--- + +## Self-review + +**Spec coverage.** The review's Phase A ("parar o silêncio", both input paths, testable +in CI) is Tasks 1 and 2. Its Phase B (Clam `dev16`, `-DENABLE_CLAM=ON`, off by default, +promotion gated on differential evidence) is Tasks 3 through 7. The review's rejected +options — removing the capability, enabling by default, IKOS, a bespoke pass over +`crab` — appear nowhere in the plan, which is the intent. + +**The progress-detector requirement.** A single test file asserts two contracts and +prints which one it checked (Task 1 Step 1). It passes today in the `ABSENT` state and +will pass in the `PRESENT` state only if Clam actually injects `verifier.assume`. +Task 6 builds with `-DENABLE_CLAM=ON` so the `PRESENT` branch becomes reachable the +moment the published image carries Clam. This satisfies "falharem agora e depois +pararem de falhar" without ever parking a red check in CI — a red check that is +expected to be red gets ignored, and then the day it turns green nobody notices. + +**The gap between the phases is deliberate.** After Task 1 the three call sites that +request invariants start failing, and they stay that way until Phase B. That was the +explicit decision: the flag is not withdrawn from any caller, because a request the +tool cannot yet satisfy is exactly the signal that should be visible, and withdrawing +it would recreate the silence issue #54 is about. The single carve-out is CASTLE's +pass 2, which overwrites pass 1's verdict — there the failure would land as a corrupted +CSV rather than as a visible error, so exit 3 is recognised and the earlier verdict +kept. + +**Ordering constraint.** Task 2 should still land with or immediately after Task 1, not +because of the wrappers but because of that carve-out: between the two commits, any +CASTLE run writes `ERROR` over legitimate `UNKNOWN` rows. + +**Placeholder scan.** Two steps are deliberately parameterised by observation and say +so: Task 3 Step 3 records the working Clam command line, and Task 5 Step 1 transcribes +it. That ordering exists so the flag list is verified before it is committed. No TBDs +elsewhere. + +**Type consistency.** `invariantGeneratorAvailable()` returns `bool` and is defined in +Task 1, redefined in Task 5, and called from one place. `compileToCrabLlvm()` is +renamed to `compileWithClam()` in both `caller.hpp` and `caller.cpp` in Task 5, and its +only call site is updated in the same task. `ERROR_UNAVAILABLE_CAPABILITY` is `size_t`, +matching the surrounding constants and the function's return type. + +**What this plan does not claim.** That invariants will reduce UNKNOWN. The review is +explicit that the two tools closest to Map2Check in architecture — Symbiotic and +FuSeBMC — reduce the same gap without injected invariants. Task 7 exists to find out +what this one actually buys, and its most likely honest outcome is +`lost == 0 && gained == 0`. diff --git a/docs/superpowers/plans/2026-08-16-baseline-defect-reduction.md b/docs/superpowers/plans/2026-08-16-baseline-defect-reduction.md new file mode 100644 index 000000000..e656f975b --- /dev/null +++ b/docs/superpowers/plans/2026-08-16-baseline-defect-reduction.md @@ -0,0 +1,932 @@ +# Baseline Defect Reduction Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Reduce the defects the v5 baseline measured, in descending order of how many cases each one actually costs. + +**Architecture:** Three independent workstreams. Tasks 1–2 change how Map2Check hands unresolved library calls to KLEE, which is where the overwhelming majority of lost cases come from. Task 3 fixes how the Juliet harness scores use-after-free, which is where the overwhelming majority of false positives come from. Task 4 is an investigation, not a fix — the second-largest bucket of lost cases has no diagnosed cause yet, and planning a fix for it would be guessing. Task 5 is a cheap correctness fix in witness output. + +**Tech Stack:** C++17 / LLVM 16 (`modules/frontend`), C (`modules/backend/library`), KLEE 3.1, Bash harnesses under `tests/` and `test-comp2026/simulation/`. + +**Spec:** `docs/reports/2026-08-16-baseline-v5.html` — the v5 baseline report. Every number quoted below comes from it or from the CSVs it was computed from. + +## Global Constraints + +- LLVM 16 only; New Pass Manager; opaque pointers. Do not reintroduce `boost/filesystem` — `caller.hpp` uses C++17 ``. +- C++ follows Google style (`clang-format` with `.clang-format`); C follows LLVM style. Verify with `./check_code_style.py -p` and `-c`. +- The hybrid default (LibFuzzer for 0.2× the budget, then KLEE for 0.8×) is a product decision and must be preserved. +- Architectural and product decisions follow conventions established by SV-COMP, Test-Comp, CASTLE, Juliet and FuseBMC. Where this plan makes a modelling choice, it states which convention it follows. +- No change may reduce precision. v5 measured 100% on CASTLE and 99.2% on Juliet once benchmark-mapping artifacts are excluded; that is the tool's strongest property and is the thing to protect. +- Every task re-measures the slice it claims to fix and records the before/after in the task's commit message. A fix that is not measured is not done. + +--- + +## Measured impact, and why the order is what it is + +| # | Defect | Addressable cases | Share of the 2,525-case Juliet run | +|---|---|---|---| +| 1–2 | Unresolved externals: input never reaches the checker | **575 lost** (341 TIMEOUT + 183 FN + 51 ERROR) | 23% | +| 4 | Undecided cluster in CWE-121/122 — **cause unknown** | 252 UNKNOWN | 10% | +| 3 | CWE-416 scored against the leak property | 42 cases, 21 of the 36 FP, TN unreachable | 1.7% | +| 0 | `--add-invariants` silently ignored for bitcode input | 12 CASTLE cases, 481 s of wasted pass-2 | — | +| — | Floating-point guard concretized (see Task 2, step 6) | 3 FP | 0.1% | +| 5 | Witness points at the wrong line | 1 CASTLE case | — | + +887 of 2,525 Juliet cases (35%) take their input through an external library call. Of those, 575 are lost. That single axis is larger than everything else in this plan combined, which is why it is Tasks 1 and 2. + +**On the correlation that did *not* survive checking:** 252 of 252 UNKNOWN cases log `undefined reference to function`, which looks like the same root cause. It is not — 132 of 152 sampled *decided* cases log it too (87% base rate). The signal is confounded by KLEE's normal libc warnings. Task 4 is therefore an investigation, and no fix is planned for that bucket until it has a diagnosed cause. + +--- + +### Task 0: Stop `--add-invariants` from being silently ignored + +Extends **issue #54** (*crabllvm is incompatible with LLVM 16 — `--add-invariants` is a no-op*). That issue records the fallback landed in `map2check.cpp`: when `bin/crabllvm/bin/crabllvm.py` is missing, warn and compile plainly. The v5 baseline shows the fallback never fires in practice. + +`map2check.cpp:226` guards the whole branch with `if (!is_llvmir_in)`. Both baseline runners pass pre-compiled `.bc`, so `is_llvmir_in` is true, the branch is skipped, and the flag is accepted and ignored **without the warning**. Reproduced directly: + +``` +$ map2check --memtrack --add-invariants --timeout 20 /tmp/x.bc + (no mention of crabllvm or invariants) +$ map2check --memtrack --add-invariants --timeout 20 /tmp/x.c + crabllvm is not built — ignoring --add-invariants +``` + +The cost is real: the CASTLE runner uses `--add-invariants` as its pass-2 fallback on UNKNOWN, so v5 ran 12 second passes that could not differ from the first, burning 481 s. It also makes the CSV's `invariants=yes` column false — it records a technique that was never applied. + +Two things are wrong and both are cheap: the warning must reach bitcode callers, and the CASTLE harness must stop paying for a pass that cannot change anything. + +**Files:** +- Modify: `modules/frontend/map2check.cpp:226-247` +- Modify: `tests/castle/run_castle_evaluation.sh` (the pass-2 condition) +- Test: `tests/integration/test_add_invariants_warns.sh` (create) + +**Interfaces:** +- Consumes: nothing new +- Produces: no signature change; `--add-invariants` warns on every input kind + +- [ ] **Step 1: Write the failing test** + +Create `tests/integration/test_add_invariants_warns.sh`: + +```bash +#!/bin/bash +# test_add_invariants_warns.sh — --add-invariants must never be silently +# ignored. See issue #54: crab-llvm is not built against LLVM 16, so the flag +# does nothing; the fallback warning existed but was unreachable for bitcode +# input, which is how every baseline run invokes the tool. +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_dev}" +CLANG="${CLANG:-/usr/bin/clang-16}" +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT +FAILED=0 + +printf 'int main(void){int *p = 0; return *p;}\n' > "$WORK/x.c" +"$CLANG" -c -emit-llvm -g -O0 "$WORK/x.c" -o "$WORK/x.bc" || { echo "FAIL compile"; exit 1; } + +cd "$WORK" +for input in x.c x.bc; do + out=$(MAP2CHECK_PATH="$MAP2CHECK_DIR" "$MAP2CHECK_DIR/map2check" \ + --memtrack --add-invariants --timeout 20 "$WORK/$input" 2>&1) + if echo "$out" | grep -aq 'ignoring --add-invariants'; then + echo " PASS $input warns that --add-invariants is ignored" + else + echo " FAIL $input accepted --add-invariants silently" + FAILED=$((FAILED+1)) + fi +done + +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 +``` + +- [ ] **Step 2: Run the test to verify it fails** + +Run: +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_add_invariants_warns.sh +``` +Expected: `PASS x.c ...` then `FAIL x.bc accepted --add-invariants silently`. + +- [ ] **Step 3: Move the check out from behind the bitcode guard** + +Replace `modules/frontend/map2check.cpp:226-247` with: + +```cpp + // Crab-LLVM is a legacy SeaHorn dependency that was never migrated to + // LLVM 16 (FindCrabLlvm.cmake is not wired into the modern build), so + // ${MAP2CHECK_PATH}/bin/crabllvm may be absent -- see issue #54. + // + // The check sits outside the !is_llvmir_in branch on purpose. Invariant + // generation only applies to a source compile, but the WARNING has to reach + // everyone who passed the flag: the evaluation harnesses feed pre-compiled + // bitcode, so guarding the warning on source input meant --add-invariants + // was accepted and dropped in complete silence for every baseline run. + bool crabAvailable = false; + if (args.invCrabLlvm) { + const char *m2cPath = getenv("MAP2CHECK_PATH"); + std::string crabPy = (m2cPath ? std::string(m2cPath) : std::string("")) + + "/bin/crabllvm/bin/crabllvm.py"; + crabAvailable = fs::exists(crabPy); + if (!crabAvailable) { + Map2Check::Log::Warning( + "crabllvm is not built — ignoring --add-invariants"); + } else if (is_llvmir_in) { + Map2Check::Log::Warning( + "input is already LLVM IR — ignoring --add-invariants"); + } + } + + if (!is_llvmir_in && args.invCrabLlvm && crabAvailable) { + caller->compileToCrabLlvm(); + } else { + caller->compileCFile(is_llvmir_in); + } +``` + +- [ ] **Step 4: Rebuild and run the test to verify it passes** + +```bash +docker run --rm -u 0 -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash -c 'cd build_dev && ninja && ninja install' +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_add_invariants_warns.sh +``` +Expected: both `PASS` lines. + +- [ ] **Step 5: Stop the CASTLE harness paying for a pass that cannot help** + +In `tests/castle/run_castle_evaluation.sh`, replace the pass-2 condition: + +```bash + # --- Pass 2: --add-invariants fallback --- + # Disabled while issue #54 is open: crab-llvm is not built against LLVM 16, + # so --add-invariants is a no-op and the second pass is bit-for-bit identical + # to the first. In v5 it cost 481s across 12 cases and changed no verdict. + # Re-enable by setting CASTLE_PASS2=1 once crab-llvm builds again. + if [ "${CASTLE_PASS2:-0}" = "1" ] && [ "$verdict" = "UNKNOWN" ] && [ "$mode_flags" != "--check-asserts" ]; then +``` + +- [ ] **Step 6: Confirm no case still reports using invariants** + +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_dev \ + -e RESULTS_DIR=/workspace/tests/castle/results_probe_inv \ + map2check-dev bash tests/castle/run_castle_evaluation.sh + +awk -F, 'NR>1 && $7=="yes"' tests/castle/results_probe_inv/castle_results.csv | wc -l +``` +Expected: `0`. In v5 it was 12. + +- [ ] **Step 7: Commit and update issue #54** + +```bash +git add modules/frontend/map2check.cpp tests/castle/run_castle_evaluation.sh \ + tests/integration/test_add_invariants_warns.sh +git commit -m "fix(cli): warn when --add-invariants is ignored for bitcode input + +The fallback added for issue #54 sat behind 'if (!is_llvmir_in)', so it never +fired for pre-compiled bitcode -- which is how both evaluation harnesses invoke +the tool. --add-invariants was accepted and dropped in silence for every run in +the v5 baseline. + +The CASTLE pass-2 fallback is disabled behind CASTLE_PASS2 while #54 is open: +with crab-llvm unbuilt the second pass is identical to the first, and it cost +481s across 12 cases in v5 without changing a single verdict. + +Refs #54" +``` + +Then comment on issue #54 with the reproduction above and the 481 s measurement, so the issue records that the landed workaround does not cover the project's own usage pattern. + +--- + +### Task 1: Symbolic stdin through KLEE's POSIX runtime + +The largest single group: 242 of 345 Juliet timeouts come from `fscanf` families. Juliet's own header for these files says *"BadSource: fscanf Read data from the console using fscanf()"* — the input is stdin. Map2Check currently invokes KLEE with `--external-calls=all --libc=uclibc` and no POSIX runtime, so `fscanf` is executed for real against the actual stdin and the analysis explores one concrete path. + +KLEE ships `--posix-runtime`, which models file descriptors and stdin as symbolic objects. Modelling an unknown input as nondeterministic rather than concretizing it is the sound over-approximation and is standard SV-COMP treatment — the same reasoning already documented in `test-comp2026/simulation/juliet_stubs.c` for `rand()`. + +**Files:** +- Modify: `modules/frontend/caller.cpp` (KLEE branch, the `kleeCommand` construction beginning at the `case (NonDetGenerator::Klee)` label) +- Modify: `modules/frontend/utils/tools.hpp` (add the symbolic-stdin size constant next to `killGracePeriod`) +- Test: `tests/integration/test_symbolic_stdin.sh` (create) + +**Interfaces:** +- Consumes: `Map2Check::killGracePeriod` (already present in `tools.hpp`) +- Produces: `Map2Check::symbolicStdinBytes` (`constexpr int`), consumed by nothing else; the KLEE command string gains `--posix-runtime -sym-stdin ` + +- [ ] **Step 1: Write the failing test** + +Create `tests/integration/test_symbolic_stdin.sh`: + +```bash +#!/bin/bash +# test_symbolic_stdin.sh — a program whose only bug is reachable through stdin +# must be detected. Before the POSIX runtime was linked, KLEE executed fscanf +# for real, saw one concrete value, and reported the program safe. +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +MAP2CHECK="${MAP2CHECK_PATH:-/workspace/install_dev}/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +cat > "$WORK/stdin_overflow.c" <<'EOF' +#include +#include +int main(void) { + int data = 0; + /* Only INT_MAX overflows; a single concrete draw will never hit it. */ + if (fscanf(stdin, "%d", &data) != 1) { return 0; } + int result = data + 1; + printf("%d\n", result); + return 0; +} +EOF + +"$CLANG" -c -emit-llvm -g -O0 "$WORK/stdin_overflow.c" -o "$WORK/t.bc" || { + echo "FAIL: compile"; exit 1; } + +cd "$WORK" +out=$(timeout -k 30 300 "$MAP2CHECK" --check-overflow --timeout 60 "$WORK/t.bc" 2>&1) + +if echo "$out" | grep -q "FALSE-OVERFLOW"; then + echo "PASS stdin-sourced overflow is detected" + exit 0 +fi +echo "FAIL expected FALSE-OVERFLOW, got: $(echo "$out" | grep -aoE 'VERIFICATION [A-Z]+|FALSE-[A-Z]+' | tail -1)" +exit 1 +``` + +- [ ] **Step 2: Run the test to verify it fails** + +Run: +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_symbolic_stdin.sh +``` +Expected: `FAIL expected FALSE-OVERFLOW, got: VERIFICATION SUCCEEDED` — the current binary proves the program safe because `fscanf` returned one concrete value. + +- [ ] **Step 3: Add the constant** + +In `modules/frontend/utils/tools.hpp`, directly below `killGracePeriod`: + +```cpp +/** Bytes of symbolic stdin handed to KLEE's POSIX runtime. + * Juliet's fscanf sources read a single number from the console, so a small + * buffer covers them; making it large costs solver time on every run. */ +constexpr int symbolicStdinBytes = 32; +``` + +- [ ] **Step 4: Link the POSIX runtime** + +In `modules/frontend/caller.cpp`, in the KLEE branch, immediately after the existing `--external-calls=all` append: + +```cpp + // Model stdin as symbolic instead of reading the real one. Without this + // KLEE executes fscanf/fgets for real, gets a single concrete value, and + // reports VERIFICATION SUCCEEDED for programs whose bug is only + // reachable through input -- an unsound TRUE, not an UNKNOWN. 242 of the + // 345 timeouts and a large share of the false negatives in the v5 + // baseline came from this. Treating an unknown input as nondeterministic + // is the sound over-approximation and is what SV-COMP expects. + kleeCommand << " --posix-runtime"; + kleeCommand << " -sym-stdin " << Map2Check::symbolicStdinBytes; +``` + +- [ ] **Step 5: Rebuild** + +```bash +docker run --rm -u 0 -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash -c 'cd build_dev && ninja && ninja install' +``` + +- [ ] **Step 6: Run the test to verify it passes** + +Run: +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_symbolic_stdin.sh +``` +Expected: `PASS stdin-sourced overflow is detected` + +- [ ] **Step 7: Verify precision did not regress** + +The whole existing integration suite must still pass — `--posix-runtime` changes the environment every analysis runs in, so a regression here would show up as previously-safe programs now reporting bugs. + +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev bash -c ' + bash tests/integration/test_verdict_classifier.sh && + bash tests/integration/test_juliet_sampling.sh && + bash tests/integration/test_modes.sh' +``` +Expected: all pass; `test_modes.sh` reports `16 passed, 0 failed`. + +- [ ] **Step 8: Measure the fscanf slice** + +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_dev -e JULIET_CWES="190" -e PER_FAMILY=3 \ + -e RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/probe_stdin \ + map2check-dev bash test-comp2026/simulation/run_juliet_evaluation.sh + +awk -F, '$2 ~ /fscanf/ {print $8}' \ + test-comp2026/simulation/resultados_de_testes/probe_stdin/juliet_scope_c_results.csv \ + | sort | uniq -c +``` +v5 baseline for this slice, for comparison: CWE-190 had 144 TIMEOUT and 37 ERROR, both dominated by `fscanf` families. Success is TIMEOUT falling sharply with TP rising and **FP staying at zero**. + +- [ ] **Step 9: Commit** + +```bash +git add modules/frontend/caller.cpp modules/frontend/utils/tools.hpp tests/integration/test_symbolic_stdin.sh +git commit -m "fix(klee): model stdin symbolically instead of reading the real one + +Juliet's fscanf sources read from the console. Without --posix-runtime KLEE +executed fscanf for real, took one concrete value, and reported programs safe +whose bug was only reachable through input. That is an unsound TRUE, not an +UNKNOWN, and it accounted for 242 of the 345 timeouts in the v5 baseline. + +Before/after on the CWE-190 fscanf slice: " +``` + +--- + +### Task 2: Nondeterministic socket sources + +96 of the remaining timeouts come from `listen_socket` and `connect_socket` families. These call real `socket`/`bind`/`listen`/`accept`/`recv`, which KLEE cannot resolve; the analysis stalls until the budget expires. The POSIX runtime from Task 1 models files, not sockets, so this needs its own treatment. + +The convention to follow is the one already established in this repository for `rand()`: intercept at the lowest unresolved boundary and return a nondeterministic value constrained to what the real function could produce. Here that boundary is `recv`, which returns a byte count in `[-1, requested_len]`. + +**Files:** +- Modify: `test-comp2026/simulation/juliet_stubs.c` +- Test: `tests/integration/test_socket_source.sh` (create) + +**Interfaces:** +- Consumes: `__VERIFIER_nondet_int` (already used in this file for `globalReturnsTrueOrFalse` and `rand`) +- Produces: definitions of `socket`, `bind`, `listen`, `accept`, `recv`, `connect`, `closesocket` in the linked bitcode + +- [ ] **Step 1: Write the failing test** + +Create `tests/integration/test_socket_source.sh`: + +```bash +#!/bin/bash +# test_socket_source.sh — a Juliet socket-sourced overflow must be decided +# rather than run out its budget. In the v5 baseline every listen_socket and +# connect_socket family timed out. +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +REPO="$(cd "$SCRIPT_DIR/../.." && pwd)" +MAP2CHECK="${MAP2CHECK_PATH:-/workspace/install_dev}/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +LLVM_LINK="${LLVM_LINK:-/usr/bin/llvm-link-16}" +SUP="$REPO/test-comp2026/juliet/testcasesupport" +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +SRC=$(find "$REPO/test-comp2026/juliet/testcases/CWE190_Integer_Overflow" \ + -name '*int_listen_socket_add_01.c' | head -1) +[ -n "$SRC" ] || { echo "SKIP juliet submodule not checked out"; exit 0; } + +"$CLANG" -c -emit-llvm -g -O0 -I "$SUP" \ + "$REPO/test-comp2026/simulation/juliet_stubs.c" -o "$WORK/stubs.bc" || { + echo "FAIL: stubs compile"; exit 1; } +"$CLANG" -c -emit-llvm -g -O0 -DINCLUDEMAIN -DOMITGOOD -I "$SUP" \ + "$SRC" -o "$WORK/t.bc" || { echo "FAIL: testcase compile"; exit 1; } +"$LLVM_LINK" "$WORK/t.bc" "$WORK/stubs.bc" -o "$WORK/c.bc" || { + echo "FAIL: link"; exit 1; } + +cd "$WORK" +start=$(date +%s) +out=$(timeout -k 30 300 "$MAP2CHECK" --check-overflow --timeout 60 "$WORK/c.bc" 2>&1) +elapsed=$(( $(date +%s) - start )) + +verdict=$(echo "$out" | grep -aoE 'FALSE-[A-Z]+|VERIFICATION [A-Z]+' | tail -1) +if [ "$elapsed" -ge 54 ]; then + echo "FAIL still exhausts the budget (${elapsed}s), verdict=$verdict" + exit 1 +fi +echo "PASS socket source decided in ${elapsed}s: $verdict" +exit 0 +``` + +- [ ] **Step 2: Run the test to verify it fails** + +Run: +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_socket_source.sh +``` +Expected: `FAIL still exhausts the budget (5Xs)` — the case burns its whole 60 s slice. + +- [ ] **Step 3: Add the socket stubs** + +In `test-comp2026/simulation/juliet_stubs.c`, directly after the `srand` definition: + +```c +/* + * Socket sources — same reasoning as rand() above, applied at the boundary + * that actually delivers data. + * + * Juliet's listen_socket/connect_socket families call the real + * socket/bind/listen/accept/recv. KLEE cannot resolve them, so the analysis + * stalls until its budget expires: 96 of the 345 timeouts in the v5 baseline. + * + * Only recv carries input, so only recv is nondeterministic; the rest return + * a fixed success so the setup sequence stays feasible. recv's contract is a + * byte count in [-1, len] (-1 being error), and the constraint matters for + * the same reason RAND_MAX did: an unconstrained return would let the solver + * invent a length the real call cannot produce, and manufacture a false + * positive in the caller's buffer arithmetic. + */ +#define M2C_FAKE_FD 3 + +int socket(int domain, int type, int protocol) { + NODISCARD(domain); NODISCARD(type); NODISCARD(protocol); + return M2C_FAKE_FD; +} +int bind(int fd, const void *addr, unsigned len) { + NODISCARD(fd); NODISCARD(addr); NODISCARD(len); + return 0; +} +int listen(int fd, int backlog) { NODISCARD(fd); NODISCARD(backlog); return 0; } +int accept(int fd, void *addr, void *len) { + NODISCARD(fd); NODISCARD(addr); NODISCARD(len); + return M2C_FAKE_FD; +} +int connect(int fd, const void *addr, unsigned len) { + NODISCARD(fd); NODISCARD(addr); NODISCARD(len); + return 0; +} +int closesocket(int fd) { NODISCARD(fd); return 0; } + +long recv(int fd, void *buf, unsigned long len, int flags) { + extern int __VERIFIER_nondet_int(void); + extern void __VERIFIER_assume(int); + unsigned char *b = (unsigned char *)buf; + unsigned long i; + int n = __VERIFIER_nondet_int(); + NODISCARD(fd); NODISCARD(flags); + /* recv returns -1 on error, otherwise at most the requested length. */ + __VERIFIER_assume(n >= -1 && (unsigned long)(n > 0 ? n : 0) <= len); + if (n > 0) { + for (i = 0; i < (unsigned long)n; i++) { + b[i] = (unsigned char)__VERIFIER_nondet_int(); + } + } + return (long)n; +} +``` + +- [ ] **Step 4: Verify the stubs compile and define the symbols** + +```bash +docker run --rm -u 0 -v "$(pwd)":/workspace map2check-dev sh -c ' +/usr/bin/clang-16 -c -emit-llvm -g -O0 \ + -I /workspace/test-comp2026/juliet/testcasesupport \ + /workspace/test-comp2026/simulation/juliet_stubs.c -o /tmp/stub.bc && +/usr/bin/llvm-nm-16 /tmp/stub.bc | grep -E " T (socket|recv|accept|listen|bind|connect)$"' +``` +Expected: all six symbols listed as `T` (defined). + +- [ ] **Step 5: Run the test to verify it passes** + +Run: +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_socket_source.sh +``` +Expected: `PASS socket source decided in <54s` + +- [ ] **Step 6: Check whether the floating-point false positives moved** + +v5 produced exactly 3 genuine false positives, all `int64_t_rand_square` good variants, caused by KLEE silently concretizing the `imaxabs(data) <= sqrtl(LLONG_MAX)` guard. Nothing in Tasks 1–2 addresses floating point, so the expectation is that they persist — this step exists to confirm they neither spread nor multiply. + +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_dev -e JULIET_CWES="190" -e PER_FAMILY=3 \ + -e RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/probe_socket \ + map2check-dev bash test-comp2026/simulation/run_juliet_evaluation.sh + +awk -F, '$8=="FP"{print $2}' \ + test-comp2026/simulation/resultados_de_testes/probe_socket/juliet_scope_c_results.csv +``` +Expected: at most the three `int64_t_rand_square` good variants. **Any new family appearing here is a regression and blocks the commit** — it would mean a stub is admitting behaviour the real function cannot produce. + +- [ ] **Step 7: Commit** + +```bash +git add test-comp2026/simulation/juliet_stubs.c tests/integration/test_socket_source.sh +git commit -m "feat(juliet): model socket sources nondeterministically + +listen_socket/connect_socket families called the real socket API, which KLEE +cannot resolve; the analysis stalled until its budget expired -- 96 of the 345 +timeouts in the v5 baseline. recv now returns a nondeterministic byte count +constrained to [-1, len] and fills the buffer with nondeterministic bytes; the +rest of the setup sequence returns fixed success. + +The range constraint is deliberate: an unconstrained return would let the +solver invent a length the real call cannot produce and manufacture a false +positive downstream, the same trap RAND_MAX guards against for rand(). + +Before/after on the socket slice: " +``` + +--- + +### Task 3: Score use-after-free by the use-after-free property + +21 of the 36 Juliet false positives are CWE-416 good variants, and all of them report `FALSE-MEMTRACK` — a *leak* verdict. Map2Check is right: `goodG2B()` mallocs 100 ints and never frees them, and the Juliet source says so itself (`/* POTENTIAL INCIDENTAL - Possible memory leak here if data was not freed */`). `good()` calls `goodG2B()` then `goodB2G()`, so every CWE-416 good program leaks by construction. + +The harness maps CWE-416 to `--memtrack`, which checks leaks as well as use-after-free, so it asks the wrong question and then scores the right answer as a false positive. The consequence is worse than 21 bad rows: **TN is unreachable for CWE-416**, because no safe program can pass a leak check it was built to fail. + +The fix belongs in the harness, not the tool. Map2Check's verdicts are already fine-grained (`FALSE-FREE`, `FALSE-DEREF`, `FALSE-MEMTRACK`); the harness is what collapses them. + +**Files:** +- Modify: `test-comp2026/simulation/run_juliet_evaluation.sh` (the `classify_verdict` function) +- Test: `tests/integration/test_juliet_sampling.sh` (extend — it already owns harness-level assertions) + +**Interfaces:** +- Consumes: `classify_map2check_verdict` from `tests/lib/verdict_classifier.sh` (unchanged) +- Produces: `classify_verdict ` — gains a fifth positional argument + +- [ ] **Step 1: Write the failing test** + +Append to `tests/integration/test_juliet_sampling.sh`, before the results summary: + +```bash +# --- CWE-416 must be scored on use-after-free, not on leaks ---------------- +# Juliet's CWE-416 good variants leak by construction (goodG2B mallocs and +# never frees, and says so in a comment). Scoring them under --memtrack made +# every one a false positive and made TN unreachable for the whole CWE. +. "$SCRIPT_DIR/../../test-comp2026/simulation/juliet_classify_lib.sh" + +got=$(classify_verdict "Violated property: + FALSE-MEMTRACK +VERIFICATION FAILED" 0 2 60 416) +[ "$got" = "TRUE" ] && ok "CWE-416: an incidental leak is not a use-after-free" \ + || fail "CWE-416 leak" "expected TRUE, got $got" + +got=$(classify_verdict "Violated property: + FALSE-FREE +VERIFICATION FAILED" 0 2 60 416) +[ "$got" = "FALSE" ] && ok "CWE-416: FALSE-FREE is still a detection" \ + || fail "CWE-416 use-after-free" "expected FALSE, got $got" + +got=$(classify_verdict "Violated property: + FALSE-MEMTRACK +VERIFICATION FAILED" 0 2 60 401) +[ "$got" = "FALSE" ] && ok "CWE-401: FALSE-MEMTRACK is still a detection" \ + || fail "CWE-401 leak" "expected FALSE, got $got" +``` + +- [ ] **Step 2: Run the test to verify it fails** + +Run: `bash tests/integration/test_juliet_sampling.sh` +Expected: FAIL on the source line — `juliet_classify_lib.sh` does not exist yet. + +- [ ] **Step 3: Extract the classifier into a sourceable library** + +Create `test-comp2026/simulation/juliet_classify_lib.sh`: + +```bash +# shellcheck shell=bash +# Juliet-specific verdict collapsing, split out of run_juliet_evaluation.sh so +# it can be tested without executing the runner (the runner is a script, not a +# library: sourcing it starts compiling and analysing). + +SCRIPT_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +# shellcheck source=../../tests/lib/verdict_classifier.sh +. "$SCRIPT_LIB_DIR/../../tests/lib/verdict_classifier.sh" + +# classify_verdict +# +# Juliet only needs the coarse FALSE/TRUE distinction, so the fine-grained +# FALSE-* verdicts collapse here -- with one exception. +# +# CWE-416 is use-after-free, but the runner analyses it under --memtrack, which +# also reports leaks. Juliet's CWE-416 good variants leak on purpose: +# goodG2B() mallocs and never frees, and the source comment says so. Collapsing +# FALSE-MEMTRACK into FALSE there scores a correct leak report as a false +# positive on the use-after-free property, and makes TN unreachable for the +# whole CWE -- 21 of the 36 false positives in the v5 baseline. Only the +# verdicts that ARE use-after-free count as a detection for 416. +classify_verdict() { + local verdict cwe="${5:-}" + verdict=$(classify_map2check_verdict "$1" "${2:-0}" "${3:-0}" "${4:-0}") + if [ "$cwe" = "416" ] && [ "$verdict" = "FALSE-MEMTRACK" ]; then + echo "TRUE"; return + fi + case "$verdict" in + FALSE-*) echo "FALSE" ;; + *) echo "$verdict" ;; + esac +} +``` + +- [ ] **Step 4: Point the runner at the library** + +In `test-comp2026/simulation/run_juliet_evaluation.sh`, delete the inline `classify_verdict` definition and its preceding comment block, and replace them with: + +```bash +# shellcheck source=juliet_classify_lib.sh +. "$SCRIPT_DIR/juliet_classify_lib.sh" +``` + +Then update the single call site to pass the CWE: + +```bash + verdict=$(classify_verdict "$output" "$rc" "$elapsed" "$INNER_TIMEOUT" "$cwe") +``` + +- [ ] **Step 5: Run the test to verify it passes** + +Run: `bash tests/integration/test_juliet_sampling.sh` +Expected: `Results: 21 passed, 0 failed` + +- [ ] **Step 6: Re-score CWE-416 from retained raw output** + +The raw output of every v5 run was kept precisely so a scoring change does not require re-running. Confirm the 21 false positives become true negatives: + +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_dev -e JULIET_CWES="416" -e PER_FAMILY=3 \ + -e RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/probe_416 \ + map2check-dev bash test-comp2026/simulation/run_juliet_evaluation.sh + +cut -d, -f8 test-comp2026/simulation/resultados_de_testes/probe_416/juliet_scope_c_results.csv \ + | tail -n +2 | sort | uniq -c +``` +v5 for this slice was `FP=21 FN=12 TP=9 TN=0`. Success is `FP=0` and `TN=21`; TP must stay at 9. + +- [ ] **Step 7: Commit** + +```bash +git add test-comp2026/simulation/juliet_classify_lib.sh \ + test-comp2026/simulation/run_juliet_evaluation.sh \ + tests/integration/test_juliet_sampling.sh +git commit -m "fix(juliet): score CWE-416 on use-after-free, not on leaks + +CWE-416 is analysed under --memtrack, which reports leaks too. Juliet's 416 +good variants leak by construction -- goodG2B() mallocs and never frees, and +the source says so -- so a correct FALSE-MEMTRACK was scored as a false +positive and TN was unreachable for the entire CWE. 21 of the 36 false +positives in the v5 baseline were this. + +Before/after on CWE-416: FP=21 TN=0 -> FP=0 TN=21, TP unchanged at 9." +``` + +--- + +### Task 4: Diagnose the undecided cluster in CWE-121/122 + +252 cases — 10% of the suite, the second-largest bucket of lost work — end in UNKNOWN, and **the cause is not known**. This task produces a diagnosis, not a fix; the fix gets planned once there is something to fix. + +Do not assume the cause is unresolved externals. That hypothesis was tested and did not survive: 252 of 252 UNKNOWN cases log `undefined reference to function`, but so do 132 of 152 sampled decided cases (87% base rate). The correlation is confounded by KLEE's ordinary libc warnings. + +**Files:** +- Create: `docs/reports/2026-08-16-unknown-cluster-diagnosis.md` + +**Interfaces:** +- Consumes: retained raw output under `test-comp2026/simulation/resultados_de_testes/juliet_v5_{a,d}/raw/` +- Produces: a diagnosis document; if it identifies a fixable cause, a follow-up plan + +- [ ] **Step 1: Establish what distinguishes UNKNOWN from decided** + +For each candidate signal, compute its rate in UNKNOWN cases and in decided cases from the same CWE. A signal only matters if the two rates differ. + +```bash +cd test-comp2026/simulation/resultados_de_testes +for sig in 'halting execution' 'max-memory' 'silently concretizing' \ + 'unable to solve' 'query timed out' 'Exited klee with [1-9]' \ + 'partially completed paths' 'ASSERTION FAIL'; do + for cls in UNKNOWN TP TN; do + n=0; hit=0 + while IFS=, read -r cwe name variant vuln mode verdict el c; do + [ "$c" = "$cls" ] || continue + b=$(echo "$name" | sed 's#.*/##; s#\.c$##') + r=$(ls juliet_v5_a/raw/*"$b"*."$variant".txt 2>/dev/null | head -1) + [ -n "$r" ] || continue + n=$((n+1)); [ "$n" -gt 120 ] && break + grep -aqE "$sig" "$r" && hit=$((hit+1)) + done < <(tail -n +2 juliet_v5_a/juliet_scope_c_results.csv) + printf '%-28s %-8s %3d/%3d\n' "$sig" "$cls" "$hit" "$n" + done +done +``` +Record every signal whose UNKNOWN rate exceeds its TP/TN rate by more than 20 points. Signals that do not clear that bar are confounds and must be written down as such — the base-rate trap above is exactly what this step exists to prevent repeating. + +- [ ] **Step 2: Read three UNKNOWN cases end to end** + +```bash +cd test-comp2026/simulation/resultados_de_testes +for b in CWE131_memcpy_01 CWE131_loop_01 CWE193_char_alloca_cpy_01; do + f=$(ls juliet_v5_a/raw/*"$b"*bad* 2>/dev/null | head -1) + [ -n "$f" ] && { echo "=================== $b"; cat "$f"; } +done +``` +Read the whole file, not a grep of it. The `--memtrack` mode instruments allocation and deallocation; the question to answer is whether KLEE finished and could not decide, or stopped early. + +- [ ] **Step 3: Determine whether the analysis completed** + +For the same three cases, extract KLEE's own completion statistics: + +```bash +cd test-comp2026/simulation/resultados_de_testes +for b in CWE131_memcpy_01 CWE131_loop_01 CWE193_char_alloca_cpy_01; do + f=$(ls juliet_v5_a/raw/*"$b"*bad* 2>/dev/null | head -1) + echo "--- $b" + grep -aE 'KLEE: done|completed paths|generated tests|halting' "$f" +done +``` +`completed paths` far below `generated tests`, or a `halting execution` line, means the search was cut short and the property was never exercised — a different problem from the analysis genuinely not being able to decide. + +- [ ] **Step 4: Write the diagnosis** + +Create `docs/reports/2026-08-16-unknown-cluster-diagnosis.md` containing: the signal table from Step 1 with both rates side by side, which signals cleared the 20-point bar and which were confounds, the three raw outputs' interpretation, and one of two conclusions — either a named root cause with the evidence for it, or an explicit statement that the cause is still unknown and what would be needed to find it. Do not write a conclusion the evidence does not support. + +- [ ] **Step 5: Commit** + +```bash +git add docs/reports/2026-08-16-unknown-cluster-diagnosis.md +git commit -m "docs: diagnose the CWE-121/122 undecided cluster + +252 of 2,525 v5 cases end UNKNOWN with no diagnosed cause. Records what +distinguishes them from decided cases in the same CWEs, and separates real +signals from base-rate confounds -- the unresolved-externals hypothesis was +tested here and rejected (100% in UNKNOWN vs 87% in decided)." +``` + +--- + +### Task 5: Point the witness at the line that violated the property + +`CASTLE-822-3.c` is a vulnerable program, Map2Check reports `FALSE-DEREF` on it, and the harness scores it a false positive solely because the reported line does not match the expected one. It is the only thing standing between the tool and 100% reported precision on CASTLE. + +**Files:** +- Modify: `modules/frontend/witness/` (the generator that emits `map2check_property line N`) +- Test: `tests/integration/test_castle_regression.sh` (extend) + +**Interfaces:** +- Consumes: nothing new +- Produces: no signature change; the emitted line number changes + +- [ ] **Step 1: Reproduce and capture the wrong line** + +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /tmp map2check-dev bash -c ' +/usr/bin/clang-16 -c -emit-llvm -g -O0 -Wno-everything \ + /workspace/tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-3.c -o /tmp/t.bc +cd /tmp && /workspace/install_dev/map2check --memtrack --timeout 300 /tmp/t.bc 2>&1 \ + | grep -aE "map2check_property line|FALSE-"' + +python3 -c " +import json +d=json.load(open('tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json')) +print([t['lines'] for t in d['tests'] if t['name']=='CASTLE-822-3.c'])" +``` +Record both numbers. The gap between them is the defect. + +- [ ] **Step 2: Write the failing test** + +Append to `tests/integration/test_castle_regression.sh`: + +```bash +# --- The witness must name the line that violated the property ------------- +# CASTLE-822-3 is detected correctly but the witness points elsewhere, which +# scores a true positive as a false positive. Precision on CASTLE is 100% with +# this fixed and 98.2% without. +/usr/bin/clang-16 -c -emit-llvm -g -O0 -Wno-everything \ + "$REPO/tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-3.c" \ + -o "$WORK/822-3.bc" 2>/dev/null +cd "$WORK" +out=$("$MAP2CHECK" --memtrack --timeout 300 "$WORK/822-3.bc" 2>&1) +line=$(echo "$out" | grep -aoP 'map2check_property line \K\d+' | head -1) +want=$(python3 -c " +import json +d=json.load(open('$REPO/tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json')) +print(','.join(str(x) for t in d['tests'] if t['name']=='CASTLE-822-3.c' for x in t['lines']))") +if echo ",$want," | grep -q ",$line,"; then + echo " PASS witness line $line is one of the expected [$want]" +else + echo " FAIL witness reported line $line, expected one of [$want]" + FAILED=$((FAILED+1)) +fi +``` + +- [ ] **Step 3: Run the test to verify it fails** + +Run: +```bash +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_castle_regression.sh +``` +Expected: `FAIL witness reported line , expected one of []` + +- [ ] **Step 4: Fix the line attribution** + +Locate where the violating instruction's debug location is read in `modules/frontend/witness/`, and confirm it takes the location of the instruction that failed the check rather than of the instrumentation call or the enclosing block. Correct it to use the former. + +- [ ] **Step 5: Rebuild and run the test to verify it passes** + +```bash +docker run --rm -u 0 -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash -c 'cd build_dev && ninja && ninja install' +docker run --rm -u 0 --memory=4g -v "$(pwd)":/workspace -w /workspace map2check-dev \ + bash tests/integration/test_castle_regression.sh +``` +Expected: `PASS witness line is one of the expected [...]` and every pre-existing assertion in the file still passing. + +- [ ] **Step 6: Commit** + +```bash +git add modules/frontend/witness tests/integration/test_castle_regression.sh +git commit -m "fix(witness): report the line that violated the property + +CASTLE-822-3 was detected correctly but the witness named the wrong line, +scoring a true positive as a false positive. It was the only false positive on +CASTLE; reported precision goes from 98.2% to 100%." +``` + +--- + +### Task 6: Re-run the full baseline as v6 and compare + +Nothing in Tasks 1–5 counts until it is measured on the same scope that measured the problem. + +**Files:** +- Create: `docs/reports/2026-XX-XX-baseline-v6.html` (date it on the day it is run) + +- [ ] **Step 1: Launch, with the guards that made v5 survive** + +The memory cap and the restart policy are not optional. Without `--memory=4g`, KLEE ballooned to 12.7 GB, crashed ten times in eight minutes, and each crash wrote a full memory dump that together filled 74 GB of the Windows disk. Without `--restart=on-failure`, a host restart leaves the containers dead instead of resuming. + +```bash +OPTS="-u 0 --restart=on-failure:100 --memory=4g --memory-swap=6g \ + --log-opt max-size=20m --log-opt max-file=2" +docker run -d --name m2c-castle-v6 $OPTS -v "$(pwd)":/workspace -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_dev \ + -e RESULTS_DIR=/workspace/tests/castle/results_v6 \ + map2check-dev bash tests/castle/run_castle_evaluation.sh + +for spec in "a:121" "b:190 476 415" "c:191 401 416" "d:122 369 761"; do + sh=${spec%%:*}; cwes=${spec#*:} + docker run -d --name "m2c-juliet-v6$sh" $OPTS -v "$(pwd)":/workspace -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_dev \ + -e JULIET_CWES="$cwes" -e PER_FAMILY=3 \ + -e RESULTS_DIR="/workspace/test-comp2026/simulation/resultados_de_testes/juliet_v6_$sh" \ + map2check-dev bash test-comp2026/simulation/run_juliet_evaluation.sh +done + +BASELINE_TAG=v6 nohup bash tests/lib/baseline_watchdog.sh \ + "$(pwd)/tests/baseline-logs/watchdog_v6.log" 40 300 \ + m2c-castle-v6 m2c-juliet-v6a m2c-juliet-v6b m2c-juliet-v6c m2c-juliet-v6d & +``` + +- [ ] **Step 2: Compute the metrics from the CSVs** + +Do not use the summary the runner prints — it counts only rows produced in its own session and under-reports every resumed run. It reported 28.6% recall for a CASTLE run whose real recall was 74.0%. + +```bash +python3 - <<'EOF' +import glob, collections +rows=[] +for f in sorted(glob.glob('test-comp2026/simulation/resultados_de_testes/juliet_v6_*/juliet_scope_c_results.csv')): + for line in open(f, encoding='utf-8', errors='replace'): + line=line.strip() + if not line or line.startswith('cwe,'): continue + p=line.split(',') + if len(p)==8 and '\x00' not in line: rows.append(p) +c=collections.Counter(r[7] for r in rows) +TP,FP,FN=c['TP'],c['FP'],c['FN'] +bad=sum(1 for r in rows if r[3]=='True') +print(f"n={len(rows)} " + " ".join(f"{k}={v}" for k,v in c.most_common())) +print(f"precisao={TP/(TP+FP)*100:.1f}% recall(decididos)={TP/(TP+FN)*100:.1f}% recall(todos os bugs)={TP/bad*100:.1f}%") +EOF +``` + +- [ ] **Step 3: Report both recall figures** + +v5 reported only `TP/(TP+FN)` = 46.8%, which counts únicamente the cases where the tool committed to an answer. Over every vulnerable program it was 28.2%. Both belong in the report: the gap between them *is* the size of the undecided problem, and quoting only the generous one hides exactly what this plan set out to fix. + +- [ ] **Step 4: Write the v6 report and commit** + +Mirror `docs/reports/2026-08-16-baseline-v5.html`, adding a v5→v6 delta column per CWE. State plainly any metric that moved the wrong way. + +--- + +## Self-review + +**Spec coverage.** Every defect quantified in the v5 report has a task: the silently-ignored `--add-invariants` (0, extending issue #54), externals (1, 2), CWE-416 mis-scoring (3), the undecided cluster (4), witness lines (5), re-measurement (6). Two are deliberately excluded, with reasons: the 3 floating-point false positives are a KLEE limitation with no cheap fix, so Task 2 Step 6 only guards against them spreading; `decodeHexChars` is dropped entirely because the scope sample contains **zero** such cases, making the earlier backlog item moot. + +**Not covered, and deliberately so.** The CASTLE reachability failures — type confusion (5 FN), wrong-argument calls (3 FN), unbounded allocation (8 TIMEOUT), infinite loops (6 TIMEOUT) — need new analysis capability rather than a fix, and belong in their own plan after brainstorming. They are approximated today with `--target-function main`, which is not a check of those properties. + +**Type consistency.** `classify_verdict` gains a fifth positional argument in Task 3 and is called with it at the single call site in the same task. `Map2Check::symbolicStdinBytes` is defined in Task 1 and used only there. `run_isolated` and `classify_map2check_verdict` are untouched. + +**Risk to watch.** Tasks 1 and 2 both widen the input space, and widening input is what produced the 3 existing false positives. Task 1 Step 7 and Task 2 Step 6 are the gates; a new false-positive family blocks the commit. diff --git a/docs/superpowers/plans/2026-08-16-testcomp-testsuite-emitter.md b/docs/superpowers/plans/2026-08-16-testcomp-testsuite-emitter.md new file mode 100644 index 000000000..6db3084ae --- /dev/null +++ b/docs/superpowers/plans/2026-08-16-testcomp-testsuite-emitter.md @@ -0,0 +1,1413 @@ +# Test-Comp Test-Suite Emitter Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Make Map2Check emit a Test-Comp test suite (`metadata.xml` + one `*.xml` +per test case) reproducing the violation it found, so that a Cover-Error run produces +the artifact the competition actually scores. + +**Architecture:** The runtime already records every nondeterministic value in +consumption order and flushes it to `klee_log.csv` (`NonDetLog.c:17`), for both the +KLEE and the LibFuzzer generator. Nothing new is instrumented. A new frontend module +reads that CSV and serializes it as Test-Comp XML, because only the frontend knows the +source path, the property, the architecture and the producer version. The suite is +written as a directory (what the competition consumes); zipping is the validator +harness's job, not the tool's. + +**Tech Stack:** C++17, CMake + Ninja, GTest, Boost.ProgramOptions (existing stack; no +new third-party dependency). + +**Spec:** [Test-Comp exchange format](https://gitlab.com/sosy-lab/software/test-format) +— `test-metadata.dtd`, `testcase.dtd`, `doc/Format.md`. Verbatim copies of both DTDs +are reproduced in the Global Constraints below so the implementer needs no network. + +## Global Constraints + +- **`test-metadata.dtd` (verbatim, upstream):** + ``` + + ``` + The element order above is **mandatory** — it is a DTD sequence, not a choice. + `inputtestsuitefile` / `inputtestsuitehash` are optional and Map2Check does not emit + them (they exist for tools that consume an existing suite). +- **`testcase.dtd` (verbatim, upstream):** + ``` + + + + + ``` +- **DOCTYPE lines (exact strings, from the upstream examples):** + - metadata: `` + - testcase: `` +- **`` is SHA-256** of the program file. Map2Check currently has only + SHA-1 (`gen_crypto_hash.hpp`, Boost); Task 1 adds SHA-256. +- **Input ordering is the whole contract.** The *n*-th `` is the value returned + by the *n*-th `__VERIFIER_nondet_*` call at runtime. `klee_log.csv` is already + written in exactly that order, one row per call. +- **No `variable` attribute, and no `type` attribute, in this plan.** `doc/Format.md` + states that if a `variable` is specified and the input sequence does not fit it, + "the interpretation is undefined". Bare `value` is the form used by + upstream `examples/testcase-2.xml` and carries no such risk. +- **Directory, not zip.** The tool writes `test-suite/`. TestCov's `--test-suite` + takes a zip; the harness in the companion plan zips it. +- **Suite location must survive cleanup.** `Caller` chdirs into + `.map2check/` (`caller.cpp:75-76`) and `cleanGarbage()` deletes it + (`caller.cpp:96-99`). The suite must be written under the *original* working + directory. +- **Do not touch `--generate-testcase`.** That existing flag writes an annotated C + program and is documented as experimental. The new flag is `--generate-test-suite`. +- C++ code follows Google style (`.clang-format`); run `./check_code_style.py -p`. + +--- + +### Task 1: SHA-256 for the program hash + +**Files:** +- Create: `modules/frontend/utils/sha256.hpp` +- Create: `modules/frontend/utils/sha256.cpp` +- Modify: `modules/frontend/utils/CMakeLists.txt` +- Create: `tests/unit/frontend/CMakeLists.txt` +- Modify: `tests/unit/CMakeLists.txt:5` (add `add_subdirectory(frontend)`) +- Test: `tests/unit/frontend/Sha256Test.cpp` + +**Interfaces:** +- Consumes: nothing. +- Produces: `std::string Map2Check::sha256File(const std::string& path)` returning 64 + lowercase hex characters, and `std::string Map2Check::sha256Hex(const std::string&)` + for the in-memory case. Task 2 uses `sha256File`. + +Rationale for a self-contained implementation rather than a dependency: OpenSSL is not +currently linked, and shelling out to `sha256sum` would make a metadata field depend on +an external binary being present. SHA-256 is ~120 lines and is exactly testable +against published vectors. + +- [ ] **Step 1: Write the failing test** + +```cpp +// tests/unit/frontend/Sha256Test.cpp +#include + +#include +#include +#include + +#include "../../../modules/frontend/utils/sha256.hpp" + +// Vectors from FIPS 180-4 / RFC 6234. +TEST(Sha256Test, EmptyString) { + EXPECT_EQ(Map2Check::sha256Hex(""), + "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"); +} + +TEST(Sha256Test, Abc) { + EXPECT_EQ(Map2Check::sha256Hex("abc"), + "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"); +} + +// 448 bits: forces a two-block message with the length spilling past the +// first padding block, which is where naive implementations break. +TEST(Sha256Test, TwoBlockMessage) { + EXPECT_EQ(Map2Check::sha256Hex( + "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"), + "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1"); +} + +TEST(Sha256Test, OneMillionA) { + EXPECT_EQ(Map2Check::sha256Hex(std::string(1000000, 'a')), + "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0"); +} + +TEST(Sha256Test, HashesFileContentsNotPath) { + std::string path = "sha256_fixture.txt"; + { + std::ofstream out(path, std::ios::binary); + out << "abc"; + } + EXPECT_EQ(Map2Check::sha256File(path), + "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"); + std::remove(path.c_str()); +} + +TEST(Sha256Test, MissingFileReturnsEmptyString) { + EXPECT_EQ(Map2Check::sha256File("no_such_file_here.bin"), ""); +} +``` + +- [ ] **Step 2: Run it and confirm it fails to compile** + +```bash +cd build && cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON && ninja Sha256Test +``` +Expected: FAIL — `sha256.hpp: No such file or directory`. + +- [ ] **Step 3: Write the header** + +```cpp +// modules/frontend/utils/sha256.hpp +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_SHA256_HPP_ +#define MODULES_FRONTEND_UTILS_SHA256_HPP_ + +#include + +namespace Map2Check { + +/** SHA-256 of an in-memory buffer, as 64 lowercase hex characters. */ +std::string sha256Hex(const std::string& data); + +/** SHA-256 of a file's contents. Returns "" if the file cannot be read. + * The Test-Comp field is defined over the program file, so this + * hashes contents and never the path. */ +std::string sha256File(const std::string& path); + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_SHA256_HPP_ +``` + +- [ ] **Step 4: Write the implementation** + +```cpp +// modules/frontend/utils/sha256.cpp +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "sha256.hpp" + +#include +#include +#include +#include +#include + +namespace Map2Check { +namespace { + +constexpr std::array kRoundConstants = { + 0x428a2f98u, 0x71374491u, 0xb5c0fbcfu, 0xe9b5dba5u, 0x3956c25bu, + 0x59f111f1u, 0x923f82a4u, 0xab1c5ed5u, 0xd807aa98u, 0x12835b01u, + 0x243185beu, 0x550c7dc3u, 0x72be5d74u, 0x80deb1feu, 0x9bdc06a7u, + 0xc19bf174u, 0xe49b69c1u, 0xefbe4786u, 0x0fc19dc6u, 0x240ca1ccu, + 0x2de92c6fu, 0x4a7484aau, 0x5cb0a9dcu, 0x76f988dau, 0x983e5152u, + 0xa831c66du, 0xb00327c8u, 0xbf597fc7u, 0xc6e00bf3u, 0xd5a79147u, + 0x06ca6351u, 0x14292967u, 0x27b70a85u, 0x2e1b2138u, 0x4d2c6dfcu, + 0x53380d13u, 0x650a7354u, 0x766a0abbu, 0x81c2c92eu, 0x92722c85u, + 0xa2bfe8a1u, 0xa81a664bu, 0xc24b8b70u, 0xc76c51a3u, 0xd192e819u, + 0xd6990624u, 0xf40e3585u, 0x106aa070u, 0x19a4c116u, 0x1e376c08u, + 0x2748774cu, 0x34b0bcb5u, 0x391c0cb3u, 0x4ed8aa4au, 0x5b9cca4fu, + 0x682e6ff3u, 0x748f82eeu, 0x78a5636fu, 0x84c87814u, 0x8cc70208u, + 0x90befffau, 0xa4506cebu, 0xbef9a3f7u, 0xc67178f2u}; + +inline uint32_t rotr(uint32_t x, unsigned n) { + return (x >> n) | (x << (32u - n)); +} + +void compress(std::array* state, const uint8_t block[64]) { + std::array w{}; + for (unsigned i = 0; i < 16; i++) { + w[i] = (static_cast(block[i * 4]) << 24) | + (static_cast(block[i * 4 + 1]) << 16) | + (static_cast(block[i * 4 + 2]) << 8) | + static_cast(block[i * 4 + 3]); + } + for (unsigned i = 16; i < 64; i++) { + uint32_t s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3); + uint32_t s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10); + w[i] = w[i - 16] + s0 + w[i - 7] + s1; + } + + std::array v = *state; + for (unsigned i = 0; i < 64; i++) { + uint32_t s1 = rotr(v[4], 6) ^ rotr(v[4], 11) ^ rotr(v[4], 25); + uint32_t ch = (v[4] & v[5]) ^ (~v[4] & v[6]); + uint32_t t1 = v[7] + s1 + ch + kRoundConstants[i] + w[i]; + uint32_t s0 = rotr(v[0], 2) ^ rotr(v[0], 13) ^ rotr(v[0], 22); + uint32_t maj = (v[0] & v[1]) ^ (v[0] & v[2]) ^ (v[1] & v[2]); + uint32_t t2 = s0 + maj; + + v[7] = v[6]; v[6] = v[5]; v[5] = v[4]; v[4] = v[3] + t1; + v[3] = v[2]; v[2] = v[1]; v[1] = v[0]; v[0] = t1 + t2; + } + for (unsigned i = 0; i < 8; i++) (*state)[i] += v[i]; +} + +} // namespace + +std::string sha256Hex(const std::string& data) { + std::array state = {0x6a09e667u, 0xbb67ae85u, 0x3c6ef372u, + 0xa54ff53au, 0x510e527fu, 0x9b05688cu, + 0x1f83d9abu, 0x5be0cd19u}; + + const uint8_t* bytes = reinterpret_cast(data.data()); + size_t len = data.size(); + size_t full = len / 64; + for (size_t i = 0; i < full; i++) compress(&state, bytes + i * 64); + + // Tail: remaining bytes, 0x80, zero padding, then the 64-bit bit length. + // Two blocks are needed when the remainder leaves no room for the length. + std::vector tail(bytes + full * 64, bytes + len); + tail.push_back(0x80); + while (tail.size() % 64 != 56) tail.push_back(0x00); + uint64_t bitLength = static_cast(len) * 8u; + for (int i = 7; i >= 0; i--) { + tail.push_back(static_cast((bitLength >> (i * 8)) & 0xffu)); + } + for (size_t i = 0; i < tail.size(); i += 64) compress(&state, tail.data() + i); + + std::ostringstream out; + for (uint32_t word : state) { + for (int i = 3; i >= 0; i--) { + unsigned byte = (word >> (i * 8)) & 0xffu; + out << "0123456789abcdef"[byte >> 4] << "0123456789abcdef"[byte & 0xf]; + } + } + return out.str(); +} + +std::string sha256File(const std::string& path) { + std::ifstream in(path, std::ios::binary); + if (!in.is_open()) return ""; + std::ostringstream buffer; + buffer << in.rdbuf(); + return sha256Hex(buffer.str()); +} + +} // namespace Map2Check +``` + +- [ ] **Step 5: Wire it into CMake** + +Append to `modules/frontend/utils/CMakeLists.txt`: + +```cmake +add_library(Sha256 OBJECT sha256.cpp) +set_target_properties(Sha256 PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) +``` + +Create `tests/unit/frontend/CMakeLists.txt`: + +```cmake +add_executable(Sha256Test + Sha256Test.cpp + $ +) +map2check_test(Sha256Test) +``` + +Add to `tests/unit/CMakeLists.txt`, after `add_subdirectory(backend-library)`: + +```cmake +add_subdirectory(frontend) +``` + +- [ ] **Step 6: Run the tests and verify they pass** + +```bash +cd build && ninja Sha256Test && ./tests/unit/frontend/Sha256Test +``` +Expected: 6 tests, all PASS. + +- [ ] **Step 7: Commit** + +```bash +git add modules/frontend/utils/sha256.hpp modules/frontend/utils/sha256.cpp \ + modules/frontend/utils/CMakeLists.txt tests/unit/CMakeLists.txt \ + tests/unit/frontend/CMakeLists.txt tests/unit/frontend/Sha256Test.cpp +git commit -m "feat(utils): add SHA-256 for the Test-Comp programhash field" +``` + +--- + +### Task 2: The test-suite module + +**Files:** +- Create: `modules/frontend/test_suite/test_suite.hpp` +- Create: `modules/frontend/test_suite/test_suite.cpp` +- Create: `modules/frontend/test_suite/CMakeLists.txt` +- Modify: `modules/frontend/CMakeLists.txt:4` (add `add_subdirectory(test_suite)`) +- Modify: `tests/unit/frontend/CMakeLists.txt` +- Test: `tests/unit/frontend/TestSuiteTest.cpp` + +**Interfaces:** +- Consumes: `Map2Check::sha256File` from Task 1 (used by the caller, not here). +- Produces: + - `struct Map2Check::TestSuiteMetadata` with fields `producer, specification, + programFile, programHash, entryFunction, architecture, creationTime` + (all `std::string`). + - `std::vector Map2Check::readNonDetLog(const std::string& csvPath)` + - `class Map2Check::TestSuiteWriter` with + `explicit TestSuiteWriter(std::string directory)`, + `bool writeMetadata(const TestSuiteMetadata&)`, + `bool writeTestCase(const std::vector& inputs, bool coversError)`, + `std::string isoUtcNow()` as a free function. + - Task 3 calls all of these. + +- [ ] **Step 1: Write the failing test** + +```cpp +// tests/unit/frontend/TestSuiteTest.cpp +#include + +#include +#include +#include +#include +#include + +#include "../../../modules/frontend/test_suite/test_suite.hpp" + +namespace fs = std::filesystem; + +namespace { + +std::string slurp(const fs::path& p) { + std::ifstream in(p); + std::ostringstream buf; + buf << in.rdbuf(); + return buf.str(); +} + +// Every test gets its own directory so nothing leaks between cases. +fs::path freshDir(const std::string& name) { + fs::path d = fs::temp_directory_path() / ("m2c_ts_" + name); + fs::remove_all(d); + return d; +} + +Map2Check::TestSuiteMetadata sampleMetadata() { + Map2Check::TestSuiteMetadata md; + md.producer = "Map2Check v7.3.1"; + md.specification = "COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )"; + md.programFile = "./digits.c"; + md.programHash = "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"; + md.entryFunction = "main"; + md.architecture = "64bit"; + md.creationTime = "2026-08-16T12:00:00Z"; + return md; +} + +} // namespace + +// --- metadata.xml ----------------------------------------------------------- + +TEST(TestSuiteWriter, MetadataHasDeclarationAndDoctypeFirst) { + fs::path d = freshDir("meta_head"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(sampleMetadata())); + + std::string xml = slurp(d / "metadata.xml"); + EXPECT_EQ(xml.find(""), 0u); + EXPECT_NE(xml.find(""), + std::string::npos); + fs::remove_all(d); +} + +// The DTD declares a sequence, so a validator rejects reordered elements. +TEST(TestSuiteWriter, MetadataElementsFollowTheDtdOrder) { + fs::path d = freshDir("meta_order"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(sampleMetadata())); + + std::string xml = slurp(d / "metadata.xml"); + const std::vector order = { + "", "", "", + "", "", "", + "", ""}; + size_t previous = 0; + for (const std::string& tag : order) { + size_t at = xml.find(tag); + ASSERT_NE(at, std::string::npos) << "missing " << tag; + EXPECT_GT(at, previous) << tag << " is out of order"; + previous = at; + } + fs::remove_all(d); +} + +TEST(TestSuiteWriter, MetadataCarriesTheSuppliedValues) { + fs::path d = freshDir("meta_values"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(sampleMetadata())); + + std::string xml = slurp(d / "metadata.xml"); + EXPECT_NE(xml.find("C"), std::string::npos); + EXPECT_NE(xml.find("Map2Check v7.3.1"), std::string::npos); + EXPECT_NE(xml.find("./digits.c"), std::string::npos); + EXPECT_NE(xml.find("64bit"), std::string::npos); + EXPECT_NE(xml.find("2026-08-16T12:00:00Z"), + std::string::npos); + fs::remove_all(d); +} + +// The specification string is FQL and contains no XML metacharacters today, +// but '&' and '<' in any field must never produce malformed XML. +TEST(TestSuiteWriter, MetadataEscapesXmlMetacharacters) { + fs::path d = freshDir("meta_escape"); + Map2Check::TestSuiteMetadata md = sampleMetadata(); + md.programFile = "./a&b.c"; + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(md)); + + std::string xml = slurp(d / "metadata.xml"); + EXPECT_NE(xml.find("./a&b<c>.c"), + std::string::npos); + fs::remove_all(d); +} + +// --- testcase files --------------------------------------------------------- + +TEST(TestSuiteWriter, TestCaseHasDoctypeAndInputsInOrder) { + fs::path d = freshDir("tc_order"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1023", "-7", "254"}, true)); + + std::string xml = slurp(d / "testcase-1.xml"); + EXPECT_EQ(xml.find(""), 0u); + EXPECT_NE(xml.find(""), + std::string::npos); + + size_t first = xml.find("1023"); + size_t second = xml.find("-7"); + size_t third = xml.find("254"); + ASSERT_NE(first, std::string::npos); + ASSERT_NE(second, std::string::npos); + ASSERT_NE(third, std::string::npos); + EXPECT_LT(first, second); + EXPECT_LT(second, third); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, CoversErrorAttributeReflectsTheArgument) { + fs::path d = freshDir("tc_covers"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1"}, true)); + ASSERT_TRUE(w.writeTestCase({"2"}, false)); + + EXPECT_NE(slurp(d / "testcase-1.xml").find(""), + std::string::npos); + EXPECT_NE(slurp(d / "testcase-2.xml").find(""), std::string::npos); + EXPECT_EQ(slurp(d / "testcase-2.xml").find("coversError"), std::string::npos); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, TestCasesAreNumberedFromOne) { + fs::path d = freshDir("tc_numbering"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1"}, false)); + ASSERT_TRUE(w.writeTestCase({"2"}, false)); + ASSERT_TRUE(w.writeTestCase({"3"}, false)); + + EXPECT_TRUE(fs::exists(d / "testcase-1.xml")); + EXPECT_TRUE(fs::exists(d / "testcase-2.xml")); + EXPECT_TRUE(fs::exists(d / "testcase-3.xml")); + EXPECT_FALSE(fs::exists(d / "testcase-0.xml")); + fs::remove_all(d); +} + +// A program that consumes no nondeterministic input still produces a valid, +// empty test case -- dropping it would leave a suite with no test at all. +TEST(TestSuiteWriter, EmptyInputVectorStillWritesAValidTestCase) { + fs::path d = freshDir("tc_empty"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({}, true)); + + std::string xml = slurp(d / "testcase-1.xml"); + EXPECT_NE(xml.find(""), std::string::npos); + EXPECT_NE(xml.find(""), std::string::npos); + EXPECT_EQ(xml.find(""), std::string::npos); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, CreatesTheDirectoryIfItIsAbsent) { + fs::path d = freshDir("tc_mkdir") / "nested" / "test-suite"; + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1"}, false)); + EXPECT_TRUE(fs::exists(d / "testcase-1.xml")); + fs::remove_all(freshDir("tc_mkdir")); +} + +// --- reading klee_log.csv --------------------------------------------------- + +TEST(ReadNonDetLog, ReturnsValuesInConsumptionOrder) { + fs::path d = freshDir("log_order"); + fs::create_directories(d); + fs::path csv = d / "klee_log.csv"; + { + // id;line;scope;function;step;value;type -- as written by NonDetLog.c + std::ofstream out(csv); + out << "0;12;0;main;1;1023;0\n"; + out << "1;13;0;main;2;-7;0\n"; + out << "2;14;0;main;3;254;5\n"; + } + std::vector values = Map2Check::readNonDetLog(csv.string()); + ASSERT_EQ(values.size(), 3u); + EXPECT_EQ(values[0], "1023"); + EXPECT_EQ(values[1], "-7"); + EXPECT_EQ(values[2], "254"); + fs::remove_all(d); +} + +TEST(ReadNonDetLog, SkipsMalformedRowsRatherThanThrowing) { + fs::path d = freshDir("log_malformed"); + fs::create_directories(d); + fs::path csv = d / "klee_log.csv"; + { + std::ofstream out(csv); + out << "0;12;0;main;1;1023;0\n"; + out << "garbage\n"; + out << "\n"; + out << "1;13;0;main;2;42;0\n"; + } + std::vector values = Map2Check::readNonDetLog(csv.string()); + ASSERT_EQ(values.size(), 2u); + EXPECT_EQ(values[0], "1023"); + EXPECT_EQ(values[1], "42"); + fs::remove_all(d); +} + +TEST(ReadNonDetLog, MissingFileYieldsAnEmptyVector) { + EXPECT_TRUE(Map2Check::readNonDetLog("no_such_log.csv").empty()); +} + +// --- timestamp -------------------------------------------------------------- + +TEST(IsoUtcNow, MatchesTheFormatTheDtdConsumersExpect) { + std::string now = Map2Check::isoUtcNow(); + ASSERT_EQ(now.size(), 20u); // 2026-08-16T12:00:00Z + EXPECT_EQ(now[4], '-'); + EXPECT_EQ(now[7], '-'); + EXPECT_EQ(now[10], 'T'); + EXPECT_EQ(now[13], ':'); + EXPECT_EQ(now[16], ':'); + EXPECT_EQ(now[19], 'Z'); +} +``` + +- [ ] **Step 2: Run it and confirm it fails to compile** + +```bash +cd build && ninja TestSuiteTest +``` +Expected: FAIL — `test_suite/test_suite.hpp: No such file or directory`. + +- [ ] **Step 3: Write the header** + +```cpp +// modules/frontend/test_suite/test_suite.hpp +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +/********************************************************************** + * Emission of Test-Comp test suites. + * + * The format is defined by https://gitlab.com/sosy-lab/software/test-format. + * A suite is a directory holding one metadata.xml plus one *.xml per test + * case. Each test case is a sequence of elements whose order is the + * order in which the program consumed nondeterministic values. + * + * Map2Check already has that sequence: the runtime appends every + * __VERIFIER_nondet_* call to an ordered log (NonDetLog.c) and flushes it to + * klee_log.csv on exit, under both the KLEE and the LibFuzzer generator. This + * module only serializes it -- nothing new is instrumented. + ***********************************************************************/ + +#ifndef MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ +#define MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ + +#include +#include + +namespace Map2Check { + +/** Fields of metadata.xml. The DTD declares them as a sequence, so the writer + * emits them in exactly this order. */ +struct TestSuiteMetadata { + std::string producer; + std::string specification; + std::string programFile; + std::string programHash; + std::string entryFunction; + std::string architecture; + std::string creationTime; +}; + +/** Current UTC time as "YYYY-MM-DDThh:mm:ssZ". */ +std::string isoUtcNow(); + +/** Reads the runtime's nondet log and returns the recorded values in + * consumption order. Malformed rows are skipped: a partially written log + * still yields a usable prefix, which is better than no test case at all. + * Returns an empty vector if the file is absent. */ +std::vector readNonDetLog(const std::string& csvPath); + +/** Writes a Test-Comp test suite into a directory, creating it if needed. */ +class TestSuiteWriter { + public: + explicit TestSuiteWriter(std::string directory); + + /** Writes metadata.xml. Returns false if the file could not be written. */ + bool writeMetadata(const TestSuiteMetadata& metadata); + + /** Writes testcase-.xml, numbering from 1 in call order. */ + bool writeTestCase(const std::vector& inputs, bool coversError); + + private: + std::string directory; + unsigned counter; +}; + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ +``` + +- [ ] **Step 4: Write the implementation** + +```cpp +// modules/frontend/test_suite/test_suite.cpp +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "test_suite.hpp" + +#include +#include +#include +#include +#include + +namespace Map2Check { +namespace { + +const char kXmlDeclaration[] = + ""; + +const char kMetadataDoctype[] = + ""; + +const char kTestCaseDoctype[] = + ""; + +/** Program paths and FQL specifications are attacker-free here, but a stray + * '&' in a filename would still produce a document no validator accepts. */ +std::string escapeXml(const std::string& raw) { + std::string out; + out.reserve(raw.size()); + for (char c : raw) { + switch (c) { + case '&': out += "&"; break; + case '<': out += "<"; break; + case '>': out += ">"; break; + case '"': out += """; break; + case '\'': out += "'"; break; + default: out += c; + } + } + return out; +} + +} // namespace + +std::string isoUtcNow() { + std::time_t now = std::time(nullptr); + std::tm utc{}; +#ifdef _WIN32 + gmtime_s(&utc, &now); +#else + gmtime_r(&now, &utc); +#endif + char buffer[21]; + std::strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%SZ", &utc); + return std::string(buffer); +} + +std::vector readNonDetLog(const std::string& csvPath) { + std::vector values; + std::ifstream in(csvPath); + if (!in.is_open()) return values; + + // Row layout written by NonDetLog.c: + // id;line;scope;function_name;step;value;type + // The value is field 5 (zero-based). + std::string line; + while (std::getline(in, line)) { + if (line.empty()) continue; + std::vector fields; + std::string field; + std::istringstream row(line); + while (std::getline(row, field, ';')) fields.push_back(field); + if (fields.size() < 7) continue; + values.push_back(fields[5]); + } + return values; +} + +TestSuiteWriter::TestSuiteWriter(std::string directory) + : directory(std::move(directory)), counter(0) {} + +bool TestSuiteWriter::writeMetadata(const TestSuiteMetadata& metadata) { + std::error_code ec; + std::filesystem::create_directories(this->directory, ec); + + std::ofstream out(std::filesystem::path(this->directory) / "metadata.xml"); + if (!out.is_open()) return false; + + out << kXmlDeclaration << "\n" + << kMetadataDoctype << "\n" + << "\n" + << " C\n" + << " " << escapeXml(metadata.producer) << "\n" + << " " << escapeXml(metadata.specification) + << "\n" + << " " << escapeXml(metadata.programFile) + << "\n" + << " " << escapeXml(metadata.programHash) + << "\n" + << " " << escapeXml(metadata.entryFunction) + << "\n" + << " " << escapeXml(metadata.architecture) + << "\n" + << " " << escapeXml(metadata.creationTime) + << "\n" + << "\n"; + return out.good(); +} + +bool TestSuiteWriter::writeTestCase(const std::vector& inputs, + bool coversError) { + std::error_code ec; + std::filesystem::create_directories(this->directory, ec); + + this->counter++; + std::string name = "testcase-" + std::to_string(this->counter) + ".xml"; + std::ofstream out(std::filesystem::path(this->directory) / name); + if (!out.is_open()) return false; + + out << kXmlDeclaration << "\n" << kTestCaseDoctype << "\n"; + // coversError defaults to "false" in the DTD, so it is only emitted when true. + out << (coversError ? "\n" : "\n"); + for (const std::string& value : inputs) { + out << " " << escapeXml(value) << "\n"; + } + out << "\n"; + return out.good(); +} + +} // namespace Map2Check +``` + +- [ ] **Step 5: Wire it into CMake** + +Create `modules/frontend/test_suite/CMakeLists.txt`: + +```cmake +add_library(TestSuite OBJECT test_suite.cpp) +set_target_properties(TestSuite PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) +``` + +Add to `modules/frontend/CMakeLists.txt`, after `add_subdirectory(witness)`: + +```cmake +add_subdirectory(test_suite) +``` + +Append to `tests/unit/frontend/CMakeLists.txt`: + +```cmake +add_executable(TestSuiteTest + TestSuiteTest.cpp + $ +) +map2check_test(TestSuiteTest) +``` + +- [ ] **Step 6: Run the tests and verify they pass** + +```bash +cd build && ninja TestSuiteTest && ./tests/unit/frontend/TestSuiteTest +``` +Expected: 13 tests, all PASS. + +- [ ] **Step 7: Commit** + +```bash +git add modules/frontend/test_suite modules/frontend/CMakeLists.txt \ + tests/unit/frontend/CMakeLists.txt tests/unit/frontend/TestSuiteTest.cpp +git commit -m "feat(test-suite): serialize the nondet log as Test-Comp XML" +``` + +--- + +### Task 3: Wire the emitter into the pipeline + +**Files:** +- Modify: `modules/frontend/caller.hpp:63` (add a public accessor) +- Modify: `modules/frontend/map2check.cpp` (arg struct, CLI options, emission site) +- Modify: `modules/frontend/CMakeLists.txt` (link the new objects into `map2check`) +- Test: `tests/integration/test_test_suite_emission.sh` +- Modify: `.github/workflows/ci.yml` (run the new integration test) + +**Interfaces:** +- Consumes: `Map2Check::sha256File` (Task 1); `TestSuiteWriter`, `readNonDetLog`, + `isoUtcNow`, `TestSuiteMetadata` (Task 2); `Map2Check::kleeLogCSV` + (`utils/tools.hpp:55`). +- Produces: the CLI flags `--generate-test-suite`, `--test-suite-dir `, + `--property-file `, `--architecture <32bit|64bit>`; and + `std::string Caller::getOriginalPath()`. + +Two facts constrain where the call goes. `Caller` chdirs into `.map2check/` +(`caller.cpp:75-76`), so `klee_log.csv` is only reachable from inside that directory; +and `cleanGarbage()` deletes it (`caller.cpp:96-99`). Emission therefore happens at +the violation branch in `map2check.cpp` — after `executeAnalysis`, before +`cleanGarbage` — writing to a path under the original working directory. + +- [ ] **Step 1: Write the failing integration test** + +```bash +#!/bin/bash +# test_test_suite_emission.sh -- --generate-test-suite must produce a suite that +# matches the Test-Comp exchange format. +# +# This asserts structure, not coverage: whether the suite actually reproduces +# the bug is TestCov's question, and it is asked by the companion CI gate. What +# is checked here is the part that no other test covers -- that the files exist, +# are well-formed, carry the right DOCTYPEs, and that the input sequence is the +# sequence the program consumed. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +# Two nondet reads, then an error reachable only when both match. The values in +# the suite must therefore be 42 and 7, in that order. +cat > "$WORK/target.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a == 42 && b == 7) { + reach_error(); + } + return 0; +} +EOF + +echo "============================================================" +echo "Test-Comp test-suite emission" +echo "============================================================" + +( cd "$WORK" && timeout -k 10 300 "$MAP2CHECK" --target-function \ + --target-function-name reach_error --generate-test-suite \ + --nondet-generator symex --timeout 120 target.c > run.log 2>&1 ) + +SUITE="$WORK/test-suite" + +if [ -d "$SUITE" ]; then + ok "test-suite/ directory created" +else + fail "suite directory" "not created; see $WORK/run.log" + echo "Results: $PASSED passed, $FAILED failed"; exit 1 +fi + +[ -f "$SUITE/metadata.xml" ] && ok "metadata.xml written" \ + || fail "metadata.xml" "absent" + +n_tc=$(find "$SUITE" -name 'testcase-*.xml' | wc -l) +[ "$n_tc" -ge 1 ] && ok "at least one testcase file ($n_tc)" \ + || fail "testcase files" "none written" + +# Well-formedness, checked by a real parser rather than by grepping. +if command -v xmllint >/dev/null 2>&1; then + bad=0 + for f in "$SUITE"/*.xml; do + xmllint --noout --nonet "$f" 2>/dev/null || { bad=1; echo " bad: $f"; } + done + [ "$bad" -eq 0 ] && ok "every emitted file is well-formed XML" \ + || fail "well-formedness" "xmllint rejected a file" +else + fail "well-formedness" "xmllint not installed" +fi + +grep -q 'DTD test-format test-metadata 1.1//EN' "$SUITE/metadata.xml" \ + && ok "metadata carries the 1.1 public identifier" \ + || fail "metadata doctype" "public identifier missing or wrong" + +grep -q 'C' "$SUITE/metadata.xml" \ + && ok "sourcecodelang is C" || fail "sourcecodelang" "wrong or missing" + +grep -qE '[0-9a-f]{64}' "$SUITE/metadata.xml" \ + && ok "programhash is 64 hex characters (SHA-256)" \ + || fail "programhash" "not a SHA-256 digest" + +# The hash must be of the program, so it has to match sha256sum exactly. +want=$(sha256sum "$WORK/target.c" | cut -d' ' -f1) +got=$(sed -n 's:.*\(.*\).*:\1:p' "$SUITE/metadata.xml") +[ "$want" = "$got" ] && ok "programhash matches sha256sum of the program" \ + || fail "programhash value" "want $want, got $got" + +first_tc=$(find "$SUITE" -name 'testcase-*.xml' | sort | head -1) + +grep -q 'DTD test-format testcase 1.1//EN' "$first_tc" \ + && ok "testcase carries the 1.1 public identifier" \ + || fail "testcase doctype" "public identifier missing or wrong" + +grep -q 'coversError="true"' "$first_tc" \ + && ok "the violating test case is marked coversError" \ + || fail "coversError" "not set on a run that found the error" + +# The ordered input vector is the whole point of the format. +mapfile -t inputs < <(sed -n 's:.*\(.*\).*:\1:p' "$first_tc") +if [ "${#inputs[@]}" -eq 2 ] && [ "${inputs[0]}" = "42" ] && [ "${inputs[1]}" = "7" ]; then + ok "inputs are 42 then 7, in consumption order" +else + fail "input vector" "expected [42, 7], got [${inputs[*]}]" +fi + +# The suite must outlive cleanGarbage(), which removes the scratch directory. +[ -z "$(find "$WORK" -maxdepth 1 -name '*.map2check' -print -quit)" ] \ + && ok "scratch directory cleaned and suite survived" \ + || fail "cleanup" "scratch directory left behind" + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 +``` + +- [ ] **Step 2: Run it and verify it fails** + +```bash +bash tests/integration/test_test_suite_emission.sh +``` +Expected: FAIL at "test-suite/ directory created" — `--generate-test-suite` is not a +recognised option yet, so the run aborts. + +- [ ] **Step 3: Expose the original working directory on Caller** + +In `modules/frontend/caller.hpp`, in the `public:` section (after line 106): + +```cpp + /** Directory map2check was invoked from. The pipeline chdirs into a scratch + * directory that cleanGarbage() later deletes, so anything meant to outlive + * the run -- the Test-Comp suite, in particular -- must be written here. */ + std::string getOriginalPath() { return currentPath; } +``` + +- [ ] **Step 4: Add the CLI options** + +In `modules/frontend/map2check.cpp`, add to the arguments struct next to +`bool invCrabLlvm = false;` (line 152): + +```cpp + bool generateTestSuite = false; + std::string testSuiteDir = "test-suite"; + std::string propertyFile; + std::string architecture = "64bit"; +``` + +Add to `desc.add_options()` after the `generate-witness` line (line 357): + +```cpp + ("generate-test-suite", + "\temits a Test-Comp test suite for the violation found") + ("test-suite-dir", po::value()->default_value("test-suite"), + "\tdirectory to write the test suite into") + ("property-file", po::value(), + "\tproperty file whose contents go verbatim into ") + ("architecture", po::value()->default_value("64bit"), + "\tmachine model recorded in the test-suite metadata") +``` + +And the parsing, next to the other `vm.count` blocks (after line 453): + +```cpp + if (vm.count("generate-test-suite")) { + args.generateTestSuite = true; + } + if (vm.count("test-suite-dir")) { + args.testSuiteDir = vm["test-suite-dir"].as(); + } + if (vm.count("property-file")) { + args.propertyFile = vm["property-file"].as(); + } + if (vm.count("architecture")) { + args.architecture = vm["architecture"].as(); + } +``` + +- [ ] **Step 5: Emit the suite at the violation branch** + +Add the includes to `modules/frontend/map2check.cpp`. `` is already there +(line 24) but `` is not, and `resolveSpecification` needs it: + +```cpp +#include +``` + +and, with the other project headers (after line 31): + +```cpp +#include "test_suite/test_suite.hpp" +#include "utils/sha256.hpp" +``` + +Add the two helpers to the **existing** anonymous namespace that opens at line 42 — +do not open a second one: + +```cpp +/** The field. BenchExec always passes a property file, and + * copying it verbatim is what keeps the metadata correct when the competition + * revises a property string. The fallbacks exist so that a manual run without + * --property-file still produces a valid suite. */ +std::string resolveSpecification(const std::string& propertyFile, + Map2Check::Map2CheckMode mode) { + if (!propertyFile.empty()) { + std::ifstream in(propertyFile); + if (in.is_open()) { + std::ostringstream buffer; + buffer << in.rdbuf(); + std::string text = buffer.str(); + // Property files carry a trailing newline that does not belong in an + // XML element. + while (!text.empty() && (text.back() == '\n' || text.back() == '\r')) { + text.pop_back(); + } + if (!text.empty()) return text; + } + Map2Check::Log::Warning("could not read property file: " + propertyFile); + } + if (mode == Map2Check::Map2CheckMode::REACHABILITY_MODE) { + return "COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )"; + } + return "COVER( init(main()), FQL(COVER EDGES(@DECISIONEDGE)) )"; +} + +void emitTestSuite(const std::string& outputDir, const std::string& programFile, + const std::string& entryFunction, + const std::string& architecture, + const std::string& specification, bool coversError) { + std::vector inputs = + Map2Check::readNonDetLog(Map2Check::kleeLogCSV); + + Map2Check::TestSuiteMetadata metadata; + metadata.producer = std::string("Map2Check ") + Map2CheckVersion; + metadata.specification = specification; + metadata.programFile = programFile; + metadata.programHash = Map2Check::sha256File(programFile); + metadata.entryFunction = entryFunction; + metadata.architecture = architecture; + metadata.creationTime = Map2Check::isoUtcNow(); + + Map2Check::TestSuiteWriter writer(outputDir); + if (!writer.writeMetadata(metadata)) { + Map2Check::Log::Warning("could not write test-suite metadata to " + outputDir); + return; + } + if (!writer.writeTestCase(inputs, coversError)) { + Map2Check::Log::Warning("could not write test case to " + outputDir); + return; + } + Map2Check::Log::Info("Test suite written to " + outputDir + " (" + + std::to_string(inputs.size()) + " inputs)"); +} +``` + +In the violation branch (the final `else` around line 308), immediately after +`if (args.generateWitness) generate_witness(...);`: + +```cpp + if (args.generateTestSuite) { + // Runs before cleanGarbage(): klee_log.csv lives in the scratch directory + // that cleanGarbage() removes, and the suite must not. + std::string outputDir = args.testSuiteDir; + if (!std::filesystem::path(outputDir).is_absolute()) { + outputDir = caller->getOriginalPath() + "/" + outputDir; + } + emitTestSuite(outputDir, caller->c_program_fullpath, args.entryFunction, + args.architecture, + resolveSpecification(args.propertyFile, args.mode), true); + } +``` + +- [ ] **Step 6: Link the new objects into the binary** + +In `modules/frontend/CMakeLists.txt`, add to the `add_executable(map2check ...)` +list, after `$`: + +```cmake + $ + $ +``` + +- [ ] **Step 7: Build and run the integration test** + +```bash +cd build && ninja && ninja install +cd .. && MAP2CHECK_PATH=$PWD/release bash tests/integration/test_test_suite_emission.sh +``` +Expected: PASS on all 12 assertions. + +- [ ] **Step 8: Add it to CI** + +In `.github/workflows/ci.yml`, in the job that already runs +`tests/integration/test_juliet_sampling.sh`, add the line after it: + +```yaml + bash tests/integration/test_test_suite_emission.sh +``` + +- [ ] **Step 9: Check style and commit** + +```bash +./check_code_style.py -p +git add modules/frontend/caller.hpp modules/frontend/map2check.cpp \ + modules/frontend/CMakeLists.txt \ + tests/integration/test_test_suite_emission.sh .github/workflows/ci.yml +git commit -m "feat(frontend): emit a Test-Comp test suite with --generate-test-suite" +``` + +--- + +### Task 4: Prove the suite reproduces the bug, locally + +**Files:** +- Create: `tests/testcomp/README.md` +- Create: `tests/testcomp/cover-error-call.prp` +- Create: `tests/testcomp/programs/two_guards.c` +- Create: `tests/testcomp/run_testcov.sh` + +**Interfaces:** +- Consumes: `--generate-test-suite` and `--property-file` from Task 3. +- Produces: `tests/testcomp/run_testcov.sh`, taking ` `, + exiting 0 when TestCov confirms the suite covers the error. The companion CI-gate + plan calls this script; nothing else depends on it. + +Structural correctness is not reproduction. This task closes the loop with the actual +validator, which is the only authority on whether the suite is worth points. It is +kept local (not CI) because the CI gate, its corpus, and its failure taxonomy are the +companion plan's subject. + +- [ ] **Step 1: Write the property file and the program** + +`tests/testcomp/cover-error-call.prp`: + +``` +COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) ) +``` + +`tests/testcomp/programs/two_guards.c`: + +```c +// Two independent nondeterministic reads guard one error call. A suite that +// gets the values right but the order wrong fails to reach reach_error, so +// this program tests ordering and not only value recovery. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a == 42) { + if (b == 7) { + reach_error(); + } + } + return 0; +} +``` + +- [ ] **Step 2: Write the runner** + +`tests/testcomp/run_testcov.sh`: + +```bash +#!/bin/bash +# run_testcov.sh +# +# Generates a test suite with Map2Check and hands it to TestCov, the official +# Test-Comp validator. Exit 0 only if TestCov confirms the suite covers the +# error -- structural validity is asserted elsewhere; this asks whether the +# suite actually reproduces the bug. +# +# TestCov takes a zip, while the competition consumes a directory, so the zip +# is built here rather than by the tool. +# +# --no-isolation is required in containers without cgroup access (GitHub +# Actions). It disables resource limits, which is acceptable because the outer +# `timeout` bounds the run. + +set -u + +PROGRAM="$1" +PROPERTY="$2" +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +TESTCOV="${TESTCOV:-testcov}" +BUDGET="${BUDGET:-300}" + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +cp "$PROGRAM" "$WORK/" +cp "$PROPERTY" "$WORK/" +name=$(basename "$PROGRAM") +prop=$(basename "$PROPERTY") + +( cd "$WORK" && timeout -k 10 "$BUDGET" "$MAP2CHECK" \ + --target-function --target-function-name reach_error \ + --generate-test-suite --property-file "$prop" --architecture 64bit \ + --nondet-generator symex --timeout "$((BUDGET / 2))" "$name" ) \ + > "$WORK/map2check.log" 2>&1 + +if [ ! -d "$WORK/test-suite" ]; then + echo "FAIL $name: no test suite produced" + sed -n '$p' "$WORK/map2check.log" + exit 1 +fi + +( cd "$WORK/test-suite" && zip -q -r ../suite.zip . ) + +( cd "$WORK" && "$TESTCOV" --test-suite suite.zip --no-isolation -64 \ + --goal "$prop" "$name" ) > "$WORK/testcov.log" 2>&1 +rc=$? + +if grep -qi "Cover-Error.*true\|Error covered" "$WORK/testcov.log"; then + echo "PASS $name: TestCov reproduced the error" + exit 0 +fi + +echo "FAIL $name: TestCov did not reproduce the error (testcov rc=$rc)" +tail -20 "$WORK/testcov.log" +exit 1 +``` + +Make it executable: `chmod +x tests/testcomp/run_testcov.sh`. + +- [ ] **Step 3: Install TestCov and run it** + +```bash +python3 -m venv /tmp/tcvenv && /tmp/tcvenv/bin/pip install testcov +MAP2CHECK_PATH=$PWD/release TESTCOV=/tmp/tcvenv/bin/testcov \ + bash tests/testcomp/run_testcov.sh \ + tests/testcomp/programs/two_guards.c tests/testcomp/cover-error-call.prp +``` +Expected: `PASS two_guards.c: TestCov reproduced the error`. + +If TestCov reports the suite as valid but not covering, the cause is almost certainly +the input-to-nondet mapping, not the XML. Diagnose by comparing the `` sequence +against `klee_log.csv` from the same run before changing anything in the writer. + +- [ ] **Step 4: Write the README** + +`tests/testcomp/README.md`: + +```markdown +# Test-Comp conformance corpus + +Programs and property files used to check that Map2Check emits a test suite the +official validator accepts. + +- `cover-error-call.prp` — the Cover-Error property, as the competition states it. +- `programs/` — small programs with a known reachable `reach_error`. +- `run_testcov.sh` — generates a suite with Map2Check, zips it, and asks TestCov + whether it reproduces the error. Exit 0 means reproduced. + +TestCov comes from PyPI (`pip install testcov`, 3.7 at the time of writing) and is +the same tool the competition uses. It needs `zip` and, for coverage measurement, +`gcov`/`lcov`. + +Structural validity of the emitted XML is asserted separately, by +`tests/integration/test_test_suite_emission.sh`. This directory answers the other +question: whether the suite is worth points. +``` + +- [ ] **Step 5: Commit** + +```bash +git add tests/testcomp +git commit -m "test(testcomp): validate emitted suites against TestCov locally" +``` + +--- + +## Self-review + +**Spec coverage.** Every DTD element of `test-metadata` is emitted, in sequence order +(Task 2, `MetadataElementsFollowTheDtdOrder`). Both optional `inputtestsuite*` elements +are deliberately omitted and the reason is recorded in Global Constraints. `testcase` +covers `input*` and `coversError`; `type` and `variable` are deliberately not emitted, +with the `Format.md` "interpretation is undefined" clause as the reason. The directory +layout from `Format.md` ("one `metadata.xml`, one `*.xml` per test case, all in the +same directory") is what `TestSuiteWriter` produces. + +**Gaps this plan does not close, by design.** +- *One test case per run.* `map2check_exit()` guards on a static `alreadyReleased` + (`Map2CheckFunctions.c:82-88`), so the log is flushed once, for the violating + execution. Cover-Error needs exactly that. **Cover-Branches needs many test cases + and is out of scope**; it requires per-input logs and is the next plan. +- *No suite on a TRUE or UNKNOWN verdict.* Emission is on the violation branch only. + Test-Comp expects a suite always, which is gap G4 and belongs with the + Cover-Branches work. +- *KLEE only, in the tests.* The emitter is generator-agnostic because + `NonDetGeneratorLibFuzzy.c:47` flushes the same log, but the integration test pins + KLEE for determinism. A LibFuzzer assertion belongs in the CI-gate plan, where + flakiness can be handled deliberately. + +**Placeholder scan.** No TBDs. Every code step carries the code; every run step carries +the command and the expected result. + +**Type consistency.** `sha256File` (Task 1) is called in Task 3 with a `std::string` +and returns `std::string`. `readNonDetLog` returns `std::vector`, which is +what `writeTestCase` takes. `TestSuiteMetadata`'s seven fields are set in Task 3 in the +same names Task 2 declares. `getOriginalPath()` returns `std::string`, concatenated +with `+` in Task 3. `Map2CheckVersion` is a macro from the generated +`map2check_version.hpp`, already included by `map2check.cpp:38`. + +**One risk worth naming.** The integration test asserts the recovered inputs are +exactly `42` and `7`. That holds if KLEE solves both guards and the log records the +solved values. If KLEE instead reports the violation without those exact concretes, the +assertion fails loudly — which is the correct outcome, because a suite with the wrong +values is worth nothing, and finding that out in Task 3 is far cheaper than finding it +out from TestCov in Task 4. diff --git a/docs/superpowers/plans/2026-08-16-testcov-ci-gate.md b/docs/superpowers/plans/2026-08-16-testcov-ci-gate.md new file mode 100644 index 000000000..73a00b84f --- /dev/null +++ b/docs/superpowers/plans/2026-08-16-testcov-ci-gate.md @@ -0,0 +1,699 @@ +# TestCov CI Gate Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Make the official Test-Comp validator a blocking CI check, so that a test +suite Map2Check emits is proven to reproduce the bug on every push — not merely proven +to be well-formed XML. + +**Architecture:** A corpus of small C programs with known outcomes lives in +`tests/testcomp/`. A driver generates a suite for each one with Map2Check, zips it, +hands it to TestCov, and compares the verdict against a checked-in manifest of expected +results. The manifest is what makes the gate meaningful in both directions: a program +that regresses turns the job red, and a program that starts passing unexpectedly also +turns it red, forcing the manifest to be updated deliberately. A new CI job runs the +driver inside the same `map2check-dev` container the CASTLE Regression job already uses. + +**Tech Stack:** GitHub Actions, Docker (`ghcr.io/hbgit/map2check-dev`), TestCov 3.7 +from PyPI, bash. + +**Spec:** [docs/superpowers/plans/2026-08-16-testcomp-testsuite-emitter.md](2026-08-16-testcomp-testsuite-emitter.md) +— this plan validates what that one emits. It also closes gap **H1.5 / G8** of +`.opencode/Plano de desenvolvimento_Testcomp.md` ("Pipeline que roda TestCov sobre +suites geradas", criterion: "Job verde no CI"). + +## Global Constraints + +- **Prerequisite:** Task 3 of the emitter plan must be merged. Without + `--generate-test-suite` there is nothing to validate. Task 4 of that plan + (`tests/testcomp/run_testcov.sh`, `cover-error-call.prp`, + `programs/two_guards.c`) is the seed this plan grows. +- **TestCov 3.7**, `pip install testcov`, from + `https://gitlab.com/sosy-lab/software/test-suite-validator`. It is the same + validator the competition uses. +- **`--no-isolation` is mandatory in CI.** TestCov defaults to BenchExec's `runexec`, + which needs cgroup access that GitHub Actions runners do not grant. `--no-isolation` + drops resource limits; the outer `timeout` provides the bound instead. +- **`--test-suite` takes a zip**, while the competition consumes a directory. The + driver zips; the tool must not. +- **`-64`.** TestCov defaults to `-m32`. Map2Check compiles without an explicit machine + model, so it inherits the host's 64-bit model. A mismatch produces confusing + reproduction failures rather than an error. +- **The job must be able to fail.** The corpus includes a program whose error is + unreachable; if the driver reports it as covered, the harness is lying and the job + goes red. A gate that cannot fail is not a gate. +- **Budget:** `timeout-minutes: 20` for the job, `BUDGET=120` seconds per program, to + stay inside the CASTLE Regression job's established envelope. + +--- + +### Task 1: Pin down TestCov's result contract + +**Files:** +- Modify: `tests/testcomp/run_testcov.sh` +- Create: `tests/testcomp/NOTES-testcov-output.md` + +**Interfaces:** +- Consumes: `tests/testcomp/run_testcov.sh` and `programs/two_guards.c` from the + emitter plan's Task 4. +- Produces: a `testcov_verdict()` bash function in `run_testcov.sh` that echoes exactly + one of `COVERED`, `NOT_COVERED`, or `ERROR`, given TestCov's stdout in a file. Task 2 + builds on it. + +The emitter plan's runner greps for `Cover-Error.*true\|Error covered`. That string was +inferred, not observed. Everything downstream depends on reading TestCov's verdict +correctly, and a grep that silently never matches would make every program report +`FAIL` — or worse, a grep that always matches would make the gate vacuous. Observe the +real output before building on it. + +- [ ] **Step 1: Produce one suite that covers and one that does not** + +```bash +python3 -m venv /tmp/tcvenv && /tmp/tcvenv/bin/pip install testcov +export MAP2CHECK_PATH=$PWD/release TESTCOV=/tmp/tcvenv/bin/testcov + +# Covered: the emitter plan's program, whose error is reachable. +bash tests/testcomp/run_testcov.sh \ + tests/testcomp/programs/two_guards.c tests/testcomp/cover-error-call.prp +``` + +Then hand-build a suite that is valid but wrong, to see the other verdict: + +```bash +WORK=$(mktemp -d) && cp tests/testcomp/programs/two_guards.c "$WORK/" +mkdir -p "$WORK/test-suite" +cat > "$WORK/test-suite/metadata.xml" < + + + C + manual + COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) ) + two_guards.c + $(sha256sum "$WORK/two_guards.c" | cut -d' ' -f1) + main + 64bit + 2026-08-16T12:00:00Z + +EOF +cat > "$WORK/test-suite/testcase-1.xml" <<'EOF' + + + + 1 + 2 + +EOF +cp tests/testcomp/cover-error-call.prp "$WORK/" +( cd "$WORK/test-suite" && zip -q -r ../suite.zip . ) +( cd "$WORK" && /tmp/tcvenv/bin/testcov --test-suite suite.zip --no-isolation -64 \ + --goal cover-error-call.prp two_guards.c ) | tee /tmp/testcov-notcovered.log +echo "exit=$?" +``` + +- [ ] **Step 2: Record what was observed** + +Write `tests/testcomp/NOTES-testcov-output.md` with the verbatim final lines of both +runs and both exit codes. This is a lab note, not prose — the point is that the next +person can see why the parser is written the way it is: + +```markdown +# TestCov 3.7 output contract, as observed + +Recorded on , TestCov 3.7 from PyPI, `--no-isolation -64`. + +## Suite that covers the error +Exit code: +Final lines: +``` + +``` + +## Valid suite that does not cover the error +Exit code: +Final lines: +``` + +``` + +## Consequence +`testcov_verdict()` in run_testcov.sh keys off . Exit code alone sufficient, because +. +``` + +- [ ] **Step 3: Replace the inferred grep with the observed parser** + +In `tests/testcomp/run_testcov.sh`, replace the `if grep -qi "Cover-Error.*true\|Error +covered"` block with a function whose matching is justified by the notes: + +```bash +# Verdict extraction. The patterns below are not guesses: they are what +# TestCov 3.7 printed on a covering and a non-covering suite, recorded in +# NOTES-testcov-output.md. If a TestCov upgrade changes the wording, this +# function returns ERROR rather than silently reporting NOT_COVERED, so the +# gate fails loudly instead of turning vacuous. +testcov_verdict() { + local log="$1" + if grep -qE '^Result: TRUE[[:space:]]*$' "$log"; then + echo COVERED + elif grep -qE '^Result: UNKNOWN[[:space:]]*$' "$log"; then + echo NOT_COVERED + else + echo ERROR + fi +} +``` + +**Resolved 2026-08-16.** The patterns above are the observed ones. The decisive +finding is that TestCov exits **0 in both cases** -- a gate keyed off `$?` would pass +unconditionally. Full transcripts in `tests/testcomp/NOTES-testcov-output.md`. + +- [ ] **Step 4: Verify both verdicts are distinguishable** + +```bash +bash -c '. tests/testcomp/run_testcov.sh 2>/dev/null; true' # syntax check +bash -n tests/testcomp/run_testcov.sh +``` +Then re-run both scenarios from Step 1 and confirm the function returns `COVERED` for +the first and `NOT_COVERED` for the second. If both return the same value, the parser +is wrong and the gate would be worthless. + +- [ ] **Step 5: Commit** + +```bash +git add tests/testcomp/run_testcov.sh tests/testcomp/NOTES-testcov-output.md +git commit -m "test(testcomp): key the TestCov verdict off observed output" +``` + +--- + +### Task 2: The corpus and its expected-results manifest + +**Files:** +- Create: `tests/testcomp/programs/single_int.c` +- Create: `tests/testcomp/programs/no_input.c` +- Create: `tests/testcomp/programs/char_input.c` +- Create: `tests/testcomp/programs/loop_reads.c` +- Create: `tests/testcomp/programs/unreachable.c` +- Create: `tests/testcomp/expected.txt` +- Create: `tests/testcomp/run_testcov_suite.sh` +- Modify: `tests/testcomp/README.md` + +**Interfaces:** +- Consumes: `testcov_verdict()` and the single-program flow from Task 1. +- Produces: `tests/testcomp/run_testcov_suite.sh`, which reads `expected.txt`, runs + every listed program, and exits non-zero on any mismatch. Task 3 calls it with no + arguments. + +The manifest format is ` `, one per line, `#` for comments. +Three verdicts are legal: `COVERED`, `NOT_COVERED`, `ERROR`. + +- [ ] **Step 1: Write the corpus** + +Each program isolates one thing the emitter could get wrong. + +`tests/testcomp/programs/single_int.c` — the minimal case; a failure here means the +whole mechanism is broken, not an edge case: + +```c +// One nondeterministic read, one guard. The simplest suite that can exist. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x == 99) { + reach_error(); + } + return 0; +} +``` + +`tests/testcomp/programs/no_input.c` — the empty test vector, which the writer handles +explicitly and which a naive implementation drops: + +```c +// No nondeterministic input at all. The suite must still contain one test case +// with zero elements; emitting no test case would make the suite +// unscoreable even though the error is trivially reachable. +extern void reach_error(void); + +int main(void) { + reach_error(); + return 0; +} +``` + +`tests/testcomp/programs/char_input.c` — a non-`int` nondet type, since `NonDetLog.c` +formats values per type and only the integer path is covered by the other programs: + +```c +// A char-typed nondeterministic read. NonDetLog.c formats the logged value +// according to the nondet type, so a type other than int exercises a distinct +// branch of the serializer. +extern char __VERIFIER_nondet_char(void); +extern void reach_error(void); + +int main(void) { + char c = __VERIFIER_nondet_char(); + if (c == 'A') { + reach_error(); + } + return 0; +} +``` + +`tests/testcomp/programs/loop_reads.c` — many reads, so an off-by-one in ordering or +counting shows up: + +```c +// Four reads inside a loop. A suite that recovers the values but loses one, or +// reorders them, cannot reach the error -- so this checks the ordering contract +// at a length where an off-by-one is visible. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int sum = 0; + for (int i = 0; i < 4; i++) { + sum += __VERIFIER_nondet_int(); + } + if (sum == 10) { + reach_error(); + } + return 0; +} +``` + +`tests/testcomp/programs/unreachable.c` — the negative control: + +```c +// reach_error() is unreachable: the guard is unsatisfiable. No suite can cover +// it. This is the negative control -- if the harness ever reports this one as +// COVERED, the harness is broken and every other PASS in this corpus is +// meaningless. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 0 && x < 0) { + reach_error(); + } + return 0; +} +``` + +- [ ] **Step 2: Write the manifest** + +`tests/testcomp/expected.txt`: + +``` +# Expected TestCov verdict per program. Format: +# +# Legal verdicts: COVERED, NOT_COVERED, ERROR. +# +# This file makes the gate bidirectional. A program that stops being COVERED is +# a regression. A program that starts being COVERED when this file says +# otherwise is also a failure -- it means the tool improved and nobody updated +# the record, and an unrecorded improvement is indistinguishable from a broken +# harness. Change a line here deliberately, in the commit that causes it. + +single_int.c COVERED +two_guards.c COVERED +no_input.c COVERED +char_input.c COVERED +loop_reads.c COVERED +unreachable.c NOT_COVERED +``` + +If a program turns out not to be COVERED on first run, do **not** relax the assertion +silently: change the line to the observed verdict and write, in the same commit +message, why the tool cannot cover it yet. An honest `NOT_COVERED` with a reason is +data; a deleted test is a blind spot. + +- [ ] **Step 3: Write the driver** + +`tests/testcomp/run_testcov_suite.sh`: + +```bash +#!/bin/bash +# run_testcov_suite.sh -- runs every program in expected.txt through Map2Check +# and TestCov, and compares the verdict against the manifest. +# +# Exit 0 only if every program's observed verdict equals its expected verdict. +# Both directions are failures: a regression, and an unrecorded improvement. +# +# Per-program budget is deliberately small. This is a conformance gate, not a +# benchmark; a program that needs more than two minutes to have its error +# covered does not belong in the corpus. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +MANIFEST="$SCRIPT_DIR/expected.txt" +PROPERTY="$SCRIPT_DIR/cover-error-call.prp" +export BUDGET="${BUDGET:-120}" + +PASSED=0 +FAILED=0 + +echo "============================================================" +echo "Test-Comp validation via TestCov" +echo "============================================================" + +if ! command -v "${TESTCOV:-testcov}" >/dev/null 2>&1; then + echo "FATAL: testcov not found. Install it with: pip install testcov" >&2 + exit 2 +fi + +while read -r program expected; do + case "$program" in ''|\#*) continue ;; esac + + path="$SCRIPT_DIR/programs/$program" + if [ ! -f "$path" ]; then + echo " FAIL $program: listed in expected.txt but the file is missing" + FAILED=$((FAILED+1)) + continue + fi + + observed=$(bash "$SCRIPT_DIR/run_testcov.sh" "$path" "$PROPERTY" --verdict-only) + + if [ "$observed" = "$expected" ]; then + echo " PASS $program: $observed" + PASSED=$((PASSED+1)) + else + echo " FAIL $program: expected $expected, observed $observed" + FAILED=$((FAILED+1)) + fi +done < "$MANIFEST" + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 +``` + +- [ ] **Step 4: Teach run_testcov.sh the `--verdict-only` mode** + +In `tests/testcomp/run_testcov.sh`, accept an optional third argument. When it is +`--verdict-only`, print just the verdict word and nothing else, so the driver can +capture it. Add near the top, after `PROPERTY="$2"`: + +```bash +VERDICT_ONLY="" +[ "${3:-}" = "--verdict-only" ] && VERDICT_ONLY=1 +``` + +And replace the final reporting block with: + +```bash +verdict=$(testcov_verdict "$WORK/testcov.log") + +if [ -n "$VERDICT_ONLY" ]; then + echo "$verdict" + [ "$verdict" = "ERROR" ] && exit 1 + exit 0 +fi + +if [ "$verdict" = "COVERED" ]; then + echo "PASS $name: TestCov reproduced the error" + exit 0 +fi +echo "FAIL $name: TestCov verdict is $verdict" +tail -20 "$WORK/testcov.log" +exit 1 +``` + +Also handle the "no suite produced" case in verdict-only mode: a program whose error is +unreachable produces no violation, so Map2Check writes no suite. That must map to +`NOT_COVERED`, not to a hard failure. Replace the existing `if [ ! -d +"$WORK/test-suite" ]` block with: + +```bash +if [ ! -d "$WORK/test-suite" ]; then + # No violation found means no suite, which for validation purposes is exactly + # "the error was not covered". Distinguishing "found nothing" from "found the + # wrong thing" is the tool's job, not the validator's. + if [ -n "$VERDICT_ONLY" ]; then + echo NOT_COVERED + exit 0 + fi + echo "FAIL $name: no test suite produced" + sed -n '$p' "$WORK/map2check.log" + exit 1 +fi +``` + +- [ ] **Step 5: Run the whole corpus locally** + +```bash +chmod +x tests/testcomp/run_testcov_suite.sh +MAP2CHECK_PATH=$PWD/release TESTCOV=/tmp/tcvenv/bin/testcov \ + bash tests/testcomp/run_testcov_suite.sh +``` +Expected: `Results: 6 passed, 0 failed`. Any mismatch is resolved by fixing the tool or +by amending `expected.txt` with a written reason — never by deleting the line. + +- [ ] **Step 6: Prove the gate can fail** + +A gate is only worth adding if a real defect turns it red. Break the emitter on +purpose and confirm the driver notices: + +```bash +# Reverse the input order, which produces a structurally perfect but useless suite. +sed -i 's|for (const std::string& value : inputs) {|for (auto it = inputs.rbegin(); it != inputs.rend(); ++it) { const std::string\& value = *it;|' \ + modules/frontend/test_suite/test_suite.cpp +cd build && ninja && ninja install && cd .. +MAP2CHECK_PATH=$PWD/release TESTCOV=/tmp/tcvenv/bin/testcov \ + bash tests/testcomp/run_testcov_suite.sh +``` +Expected: `two_guards.c` and `loop_reads.c` FAIL with `expected COVERED, observed +NOT_COVERED`; `single_int.c` still passes (one input cannot be reordered). Then revert: + +```bash +git checkout modules/frontend/test_suite/test_suite.cpp +cd build && ninja && ninja install && cd .. +``` + +Record the outcome of this step in the commit message. If the corpus does not go red +under a reversed input order, the corpus is too weak and needs a program that depends +on ordering. + +- [ ] **Step 7: Update the README and commit** + +Append to `tests/testcomp/README.md`: + +```markdown +## Running the whole corpus + + pip install testcov + MAP2CHECK_PATH= bash tests/testcomp/run_testcov_suite.sh + +`expected.txt` records the expected verdict per program. The gate fails on any +mismatch in either direction: a regression, and an improvement nobody recorded. +`unreachable.c` is the negative control — if it ever reports COVERED, the harness +is broken and no other result in this directory can be trusted. +``` + +```bash +git add tests/testcomp +git commit -m "test(testcomp): validate a corpus of suites against TestCov" +``` + +--- + +### Task 3: The CI job + +**Files:** +- Modify: `.github/workflows/ci.yml` +- Modify: `CLAUDE.md` + +**Interfaces:** +- Consumes: `tests/testcomp/run_testcov_suite.sh` from Task 2. +- Produces: a required CI check named `Test-Comp Validation (TestCov)`. + +The job mirrors `castle-regression` (`ci.yml:298-354`), which already establishes the +working pattern: pull `map2check-dev`, build into a job-specific prefix, symlink the +KLEE runtime and clang headers, then run inside the container as root. Deviating from +that pattern is how the earlier permission failures happened — the image's default user +cannot execute the installed clang. + +- [ ] **Step 1: Add the job** + +Insert into `.github/workflows/ci.yml` after the `castle-regression` job ends +(before the `valgrind-memcheck` comment block at line 362): + +```yaml + # =========================================================== + # Job: Test-Comp conformance — the official validator + # =========================================================== + # Asserts that an emitted test suite REPRODUCES the bug, which is what the + # competition scores. Structural validity of the XML is asserted separately + # by tests/integration/test_test_suite_emission.sh in the CASTLE job. + testcov-gate: + name: Test-Comp Validation (TestCov) + runs-on: ubuntu-22.04 + timeout-minutes: 20 + needs: [build-and-test] + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: recursive + + - name: Free disk space + run: | + sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc + sudo docker image prune -a -f || true + + - name: Pull map2check-dev image + run: docker pull ghcr.io/hbgit/map2check-dev:latest + + - name: Build + install Map2Check in container + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e CC=/usr/bin/clang-16 \ + -e CXX=/usr/bin/clang++-16 \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + rm -rf build_testcov_ci install_testcov_ci + mkdir -p build_testcov_ci && cd build_testcov_ci + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/install_testcov_ci + ninja + ninja install + mkdir -p /workspace/install_testcov_ci/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/install_testcov_ci/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/install_testcov_ci/lib/clang + ' + + - name: Run TestCov over the conformance corpus + run: | + docker run --rm \ + -u root \ + -v "${{ github.workspace }}:/workspace" \ + -w /workspace \ + -e MAP2CHECK_PATH=/workspace/install_testcov_ci \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + # TestCov needs zip for the suite archive, and gcc/lcov to + # measure coverage of the compiled program. + apt-get update -qq + apt-get install -y -qq python3-pip zip gcc lcov + pip3 install --quiet testcov + bash tests/testcomp/run_testcov_suite.sh + ' + + - name: Upload TestCov logs on failure + if: failure() + uses: actions/upload-artifact@v4 + with: + name: testcov-logs + path: | + tests/testcomp/*.log + if-no-files-found: ignore +``` + +- [ ] **Step 2: Keep the logs when the job fails** + +The driver's temp directories are removed by their `trap`, which makes a red CI job +undebuggable. In `tests/testcomp/run_testcov.sh`, make retention conditional: + +```bash +# Keep the working directory when the caller asks, so a red CI job leaves +# something to read. The trap is the default because local runs would otherwise +# litter /tmp with one directory per program per invocation. +if [ -n "${KEEP_WORK:-}" ]; then + trap 'echo " (work kept at $WORK)"' EXIT +else + trap 'rm -rf "$WORK"' EXIT +fi +``` + +And in the CI step, set `-e KEEP_WORK=1` on the `docker run` so a failure leaves the +logs behind. + +- [ ] **Step 3: Add the gitignore entries** + +Append to `.gitignore`, in the existing evaluation-artifacts block: + +``` +build_testcov_ci/ +install_testcov_ci/ +tests/testcomp/*.log +``` + +- [ ] **Step 4: Verify the workflow parses** + +```bash +python3 -c "import yaml,sys; yaml.safe_load(open('.github/workflows/ci.yml')); print('ok')" +``` +Expected: `ok`. + +- [ ] **Step 5: Document the job** + +In `CLAUDE.md`, in the CI section, extend the sentence listing the jobs so the new one +is named alongside the others, and add one line under it: + +```markdown +`Test-Comp Validation (TestCov)` generates a test suite for each program in +`tests/testcomp/` and asks the official validator whether it reproduces the bug. +Expected verdicts live in `tests/testcomp/expected.txt`; a mismatch in either +direction fails the job. +``` + +- [ ] **Step 6: Commit and confirm the job is green** + +```bash +git add .github/workflows/ci.yml .gitignore CLAUDE.md tests/testcomp/run_testcov.sh +git commit -m "ci: gate on TestCov reproducing the emitted test suites" +git push -u origin feat/testcomp-conformance +gh pr checks --watch +``` +Expected: `Test-Comp Validation (TestCov)` passes, and no previously green check turns +red. + +--- + +## Self-review + +**Spec coverage.** H1.5's completion criterion is "Job verde no CI" for a "pipeline que +roda TestCov sobre suites geradas". Task 3 delivers exactly that. G8's broader ask +("suite E2E incluindo validação por TestCov local") is covered by Task 2's local +driver, which runs identically outside CI. + +**Where this plan deliberately stops.** +- *Cover-Branches is not validated.* The corpus is Cover-Error only, because the + emitter produces one test case per run. Branch coverage needs a suite of many test + cases and is gap G4, in a later plan. Adding a branch-coverage program now would + encode a permanent expected failure with no path to green. +- *The corpus is small and synthetic.* Six programs, none from SV-Benchmarks. This is a + conformance gate on a 20-minute budget, not a benchmark. Coverage rate on real tasks + is the baseline harness's job. +- *LibFuzzer is not exercised.* The driver pins `--nondet-generator symex` for + determinism. The emitter is generator-agnostic by construction, but a fuzzer-driven + gate would be flaky, and a flaky required check gets ignored, which is worse than an + absent one. + +**Placeholder scan.** One intentional placeholder exists and is flagged as such: the +two grep patterns in Task 1 Step 3, which cannot be written before TestCov's output is +observed in Step 1. The step states explicitly that leaving them unsubstituted is a +plan failure. Everything else is concrete. + +**Type consistency.** `testcov_verdict()` echoes one of three literals, and those same +three literals are the legal values in `expected.txt` and the ones compared in +`run_testcov_suite.sh`. The `--verdict-only` third argument is added in Task 2 Step 4 +and used in Task 2 Step 3. `BUDGET` is exported by the driver and read by +`run_testcov.sh`, which already defaults it. + +**The assumption most likely to be wrong.** That `no_input.c` yields `COVERED`. A +program with no nondeterministic input produces an empty test vector, and TestCov may +treat a zero-input test case as degenerate. If it does, the manifest changes to +`NOT_COVERED` with the reason recorded — and that fact matters well beyond this gate, +because Test-Comp tasks with no input exist and would score zero. diff --git a/docs/superpowers/plans/2026-09-25-tacasv1-aflpp-migration.md b/docs/superpowers/plans/2026-09-25-tacasv1-aflpp-migration.md new file mode 100644 index 000000000..18511155b --- /dev/null +++ b/docs/superpowers/plans/2026-09-25-tacasv1-aflpp-migration.md @@ -0,0 +1,724 @@ +# tacasv1 — LibFuzzer → AFL++ Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Replace LibFuzzer with AFL++ 4.40c (persistent mode, PCGUARD) as Map2Check's fuzzing engine, with a full rename, preserving the hybrid loop and smart seeding byte-for-byte. + +**Architecture:** The fuzzer is compiled at run time inside `Caller` from the already-linked `-result.bc` (mirroring the current `clang -fsanitize=fuzzer` flow). The `NonDetGeneratorLibFuzzy.c` driver is rewritten as `NonDetGeneratorAFL.c` using AFL++'s persistent-mode trampoline (`__AFL_FUZZ_INIT` + `__AFL_LOOP`); `caller.cpp` swaps the two compile commands to `afl-clang-fast` and the exec command to `afl-fuzz`. The coordinator stays inside `Caller` C++. + +**Tech Stack:** C++17, LLVM 16, AFL++ 4.40c (`AFL_LLVM_INSTRUMENT=PCGUARD`), KLEE 3.1, CMake/Ninja, Ubuntu 22.04 Docker. + +## Global Constraints + +- LLVM 16 toolchain only (`clang-16`, `llvm-16`, `llvm-config-16` via apt.llvm.org). +- AFL++ version **4.40c** (git tag `v4.40c`); instrumentation mode **PCGUARD** (`AFL_LLVM_INSTRUMENT=PCGUARD`). +- **Full rename**: no `LibFuzzer` / `libFuzzer` / `LibFuzzy` identifiers remain in the production path; the CLI value `fuzzer` becomes `afl`; `SKIP_LIB_FUZZER` becomes `SKIP_AFL_PLUS_PLUS`. No transitional aliases. +- Do NOT change smart seeding (`--seed-exchange`, single pass, one fuzzer→KLEE vector), slicing, or KLEE budget logic. +- The hybrid loop in `main()` (fuzzer → KLEE → optional seed-exchange) stays structurally unchanged. +- AFL++ binaries resolve through `Map2Check::aflClangFastBinary()` / `Map2Check::aflFuzzBinary()` (env-overridable, default `/usr/local/bin`). +- Preserve the nondet width contract: `get_bytes_from_afl` consumes `sizeof(type)` bytes, matching `NonDetGeneratorKlee.c`. +- Commits use the repo's conventional style: `feat(tacasv1): ...`, `fix(...)`, `chore(...)`, `docs(...)`. + +--- + +### Task 1: Install AFL++ 4.40c in Dockerfile.dev + +**Files:** +- Modify: `Dockerfile.dev:129-132` + +**Interfaces:** +- Produces: `/usr/local/bin/afl-clang-fast` (symlink to `afl-cc`), `/usr/local/bin/afl-fuzz`, `/usr/local/bin/afl-showmap`, runtime at `/usr/local/lib/afl`; env `AFL_PATH`, `AFL_LLVM_INSTRUMENT=PCGUARD`, and headless `AFL_*` flags. Later tasks (Task 2, Task 7) depend on these. + +- [ ] **Step 1: Replace the LibFuzzer note (section 7) with the AFL++ build** + +The current section 7 is three lines (a comment saying "No extra install needed"). Replace it with: + +```dockerfile +# ============================================================ +# 7. AFL++ 4.40c (LLVM 16, PCGUARD) +# ============================================================ +# Tag-pinned like KLEE above: AFL++ has versioned releases, so -b v4.40c is +# the reproducible pin (the SHA pins in 7b/7c are for projects with none). +# PCGUARD needs no custom LLVM pass: afl-clang-fast adds clang-16's own +# -fsanitize-coverage=trace-pc-guard and the bundled runtime supplies the +# callbacks, so the build is lighter and more robust than classic/LTO modes. +RUN git clone --depth 1 -b v4.40c https://github.com/AFLplusplus/AFLplusplus.git /tmp/afl++ && \ + cd /tmp/afl++ && \ + make -j"$(nproc)" && \ + make install && \ + rm -rf /tmp/afl++ + +ENV PATH="/usr/local/bin:${PATH}" +# afl-cc locates its runtime relative to its own install; AFL_PATH is a safety +# net for the non-LLVM modes. +ENV AFL_PATH=/usr/local/lib/afl +# Headless, container-safe defaults: afl-fuzz aborts under CI/containers on the +# UI, CPU-affinity, cpufreq-governor and core-pattern checks. PCGUARD is the +# instrumentation mode afl-clang-fast must use everywhere. +ENV AFL_NO_UI=1 \ + AFL_NO_AFFINITY=1 \ + AFL_SKIP_CPUFREQ=1 \ + AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1 \ + AFL_LLVM_INSTRUMENT=PCGUARD + +# Fail the image build if AFL++ cannot actually instrument — the same failure +# mode section 7c guards against for sbt-slicer. afl-showmap exits non-zero on +# an uninstrumented binary, and the map is empty, so both checks must pass. +RUN printf 'int main(void){return 0;}\n' > /tmp/aflcheck.c && \ + /usr/local/bin/afl-clang-fast -o /tmp/aflcheck /tmp/aflcheck.c && \ + /usr/local/bin/afl-showmap -q -o /tmp/aflmap -- /tmp/aflcheck && \ + test -s /tmp/aflmap && \ + echo "AFL++ instruments: OK" && rm -f /tmp/aflcheck.c /tmp/aflcheck /tmp/aflmap +``` + +- [ ] **Step 2: Verify the section is well-formed** + +Run: `docker build --target -t map2check-dev .` (or the project's image build). The AFL++ smoke `RUN` must print `AFL++ instruments: OK`; if `afl-showmap` fails, the build fails. + +- [ ] **Step 3: Commit** + +```bash +git add Dockerfile.dev +git commit -m "feat(tacasv1): install AFL++ 4.40c (PCGUARD) in the dev image" +``` + +--- + +### Task 2: Resolve AFL++ binaries in tools.hpp + +**Files:** +- Modify: `modules/frontend/utils/tools.hpp` (after the `kleeBinary` constant, line 61) + +**Interfaces:** +- Produces: `Map2Check::aflClangFastBinary()` → `std::string`, `Map2Check::aflFuzzBinary()` → `std::string`. Consumed by `caller.cpp` in Task 5. + +- [ ] **Step 1: Add the two resolvers** + +Insert after `constexpr char const* kleeBinary = "${MAP2CHECK_PATH}/bin/klee";`: + +```cpp +/** Default root of the AFL++ install (Dockerfile.dev section 7). */ +constexpr char const* aflDefaultRoot = "/usr/local"; +/** Path to the afl-clang-fast wrapper (symlink to afl-cc), overridable. + * + * Resolved like the slicer and the invariant generator: an environment + * override first, a documented default second. AFL++ is a subprocess tool, + * invoked by caller.cpp at run time, so it is not copied into MAP2CHECK_PATH + * the way clang and klee are. */ +inline std::string aflClangFastBinary() { + const char* override_path = getenv("AFL_CC"); + if (override_path != nullptr) return std::string(override_path); + return std::string(aflDefaultRoot) + "/bin/afl-clang-fast"; +} +/** Path to the afl-fuzz binary, overridable. */ +inline std::string aflFuzzBinary() { + const char* override_path = getenv("AFL_FUZZ"); + if (override_path != nullptr) return std::string(override_path); + return std::string(aflDefaultRoot) + "/bin/afl-fuzz"; +} +``` + +- [ ] **Step 2: Verify it compiles** + +Run: `cmake --build --target map2check 2>&1 | tail -5` +Expected: no errors (the functions are `inline`, so no link issues; they are not yet referenced). + +- [ ] **Step 3: Commit** + +```bash +git add modules/frontend/utils/tools.hpp +git commit -m "feat(tacasv1): resolve afl-clang-fast/afl-fuzz paths" +``` + +--- + +### Task 3: Swap the CMake module and option + +**Files:** +- Create: `cmake/FindAFLPlusPlus.cmake` +- Delete: `cmake/FindLibFuzzer.cmake` +- Modify: `CMakeLists.txt:5`, `CMakeLists.txt:63-65` + +**Interfaces:** +- Produces: `AFL_PLUS_PLUS_FOUND` (CMake var). Consumed by nothing functional (availability reporting only), matching `FindLibFuzzer`'s former role. + +- [ ] **Step 1: Write `cmake/FindAFLPlusPlus.cmake`** + +```cmake +# FindAFLPlusPlus.cmake — Locate the AFL++ fuzzers (4.40c, LLVM 16) +# +# AFL++ is a standalone toolchain invoked at run time by caller.cpp through +# system(): afl-clang-fast compiles the fuzzer binary (PCGUARD) and afl-fuzz +# drives it. It is installed into the image by Dockerfile.dev section 7 and +# resolved at run time by Map2Check::aflClangFastBinary() / +# Map2Check::aflFuzzBinary() (tools.hpp), which honour an env override and fall +# back to /usr/local/bin. +# +# This module only records availability so the build can say so — the role +# FindLibFuzzer.cmake played before the AFL++ migration. +# +# Sets: +# AFL_PLUS_PLUS_FOUND — TRUE if both binaries are present + +find_program(AFL_CLANG_FAST afl-clang-fast PATHS /usr/local/bin /opt/afl++/bin) +find_program(AFL_FUZZ afl-fuzz PATHS /usr/local/bin /opt/afl++/bin) + +if(AFL_CLANG_FAST AND AFL_FUZZ) + set(AFL_PLUS_PLUS_FOUND TRUE) + message(STATUS "Found AFL++: ${AFL_CLANG_FAST} / ${AFL_FUZZ}") +else() + set(AFL_PLUS_PLUS_FOUND FALSE) + message(WARNING "AFL++ not found (afl-clang-fast/afl-fuzz). " + "Fuzzing will be unavailable; build the dev image (Dockerfile.dev section 7) " + "or set AFL_CC/AFL_FUZZ.") +endif() +``` + +- [ ] **Step 2: Delete `cmake/FindLibFuzzer.cmake`** + +Run: `git rm cmake/FindLibFuzzer.cmake` + +- [ ] **Step 3: Swap the option and include in `CMakeLists.txt`** + +Change line 5 from: +```cmake +option(SKIP_LIB_FUZZER "Don't use libFuzzer" OFF) +``` +to: +```cmake +option(SKIP_AFL_PLUS_PLUS "Don't use AFL++" OFF) +``` + +Change lines 63-65 from: +```cmake +if(NOT SKIP_LIB_FUZZER) + include(cmake/FindLibFuzzer.cmake) +endif() +``` +to: +```cmake +if(NOT SKIP_AFL_PLUS_PLUS) + include(cmake/FindAFLPlusPlus.cmake) +endif() +``` + +- [ ] **Step 4: Verify configure** + +Run: `cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR 2>&1 | grep -i afl` +Expected: `Found AFL++: /usr/local/bin/afl-clang-fast / /usr/local/bin/afl-fuzz` (or the `AFL++ not found` warning when building outside the image — either is non-fatal). + +- [ ] **Step 5: Commit** + +```bash +git add cmake/FindAFLPlusPlus.cmake CMakeLists.txt +git rm cmake/FindLibFuzzer.cmake +git commit -m "feat(tacasv1): replace FindLibFuzzer with FindAFLPlusPlus" +``` + +--- + +### Task 4: Rewrite the nondet generator for AFL++ + +**Files:** +- Create: `modules/backend/library/lib/NonDetGeneratorAFL.c` +- Delete: `modules/backend/library/lib/NonDetGeneratorLibFuzzy.c` +- Modify: `modules/backend/library/lib/CMakeLists.txt:19` + +**Interfaces:** +- Produces: `NonDetGeneratorAFL.bc` (linked by `caller.cpp` in Task 5), defining the same public symbols `NonDetGeneratorLibFuzzy.c` did: `nondet_init`, `nondet_destroy`, `nondet_cancel`, `nondet_generate_aux_witness_files`, `nondet_assume`, all `map2check_non_det_*` generators, and a `main` trampoline (LibFuzzer's `main` came from the runtime; AFL++'s comes from this file). + +- [ ] **Step 1: Write `modules/backend/library/lib/NonDetGeneratorAFL.c`** + +```c +/** + * Copyright (C) 2014 - 2020 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "../header/NonDetGenerator.h" +#include "../header/NonDetLog.h" + +#include +#include +#include + +/* Logic used for cases generation: + 1 - main function of original program is changed to _map2check_main + 2 - AFL++ persistent mode feeds one test case per __AFL_LOOP iteration + */ + +extern int __map2check_main__(int argc, char **argv); + +#include "../header/Map2CheckFunctions.h" + +void nondet_init() { nondet_log_init(); } + +void nondet_destroy() { nondet_log_destroy(); } + +static jmp_buf map2check_reject_env; + +void nondet_cancel() { longjmp(map2check_reject_env, 1); } + +void nondet_assume(int expr) { + if (!expr) { + nondet_cancel(); + } +} + +void nondet_generate_aux_witness_files() { + nondet_log_to_file(map2check_nondet_get_log()); +} + +const uint8_t *map2check_afl_data; + +size_t map2check_afl_size; + +uint8_t get_next_input_from_afl() { + static int i = 0; + if (i < map2check_afl_size) { + return map2check_afl_data[i++]; + } + + i = 0; + return map2check_afl_data[i]; +} + +/* Fills `out` with `size` bytes from the AFL buffer, in target order. + * + * Same width contract as NonDetGeneratorKlee.c: sizeof(type) bytes per value, + * so a vector means the same thing to both engines and seeding stays sound. */ +static void get_bytes_from_afl(void *out, size_t size) { + unsigned char *destination = (unsigned char *)out; + size_t i = 0; + for (; i < size; i++) { + destination[i] = get_next_input_from_afl(); + } +} + +#define MAP2CHECK_NON_DET_GENERATOR(type) \ + type map2check_non_det_##type() { \ + type value; \ + get_bytes_from_afl(&value, sizeof(value)); \ + return value; \ + } + +MAP2CHECK_NON_DET_GENERATOR(char) +MAP2CHECK_NON_DET_GENERATOR(pointer) +MAP2CHECK_NON_DET_GENERATOR(ushort) +MAP2CHECK_NON_DET_GENERATOR(short) +MAP2CHECK_NON_DET_GENERATOR(long) +MAP2CHECK_NON_DET_GENERATOR(ulong) +MAP2CHECK_NON_DET_GENERATOR(bool) +MAP2CHECK_NON_DET_GENERATOR(uchar) +MAP2CHECK_NON_DET_GENERATOR(size_t) +#ifndef __INTELLISENSE__ +MAP2CHECK_NON_DET_GENERATOR(loff_t) +#endif +MAP2CHECK_NON_DET_GENERATOR(sector_t) +MAP2CHECK_NON_DET_GENERATOR(double) +MAP2CHECK_NON_DET_GENERATOR(int) +MAP2CHECK_NON_DET_GENERATOR(uint) +MAP2CHECK_NON_DET_GENERATOR(unsigned) + +#define MAP2CHECK_MAX_FUZZED_STRING 4096 + +char *map2check_non_det_pchar() { + unsigned length = map2check_non_det_unsigned(); + if (length == 0) + return NULL; + if (length > MAP2CHECK_MAX_FUZZED_STRING) + length = MAP2CHECK_MAX_FUZZED_STRING; + char *string = malloc(length); + if (string == NULL) + return NULL; + unsigned i = 0; + for (i = 0; i < (length - 1); i++) { + string[i] = map2check_non_det_char(); + } + string[i] = '\0'; + return string; +} + +/* AFL++ persistent-mode trampoline. + * + * __AFL_FUZZ_INIT registers the shared-memory test case. __AFL_LOOP runs the + * body once per input under afl-fuzz; run standalone (replaying a saved crash + * file as argv[1]) it runs exactly once with that file as input. + * + * A failed nondet_assume longjmps back here and skips the input — the + * persistent-mode equivalent of the pthread_exit the LibFuzzer generator used + * (a rejected input, not a crash). */ +__AFL_FUZZ_INIT(); + +int main(int argc, char **argv) { + (void)argc; + (void)argv; + while (__AFL_LOOP(10000)) { + if (setjmp(map2check_reject_env) == 0) { + map2check_afl_data = __AFL_FUZZ_TESTCASE_BUF; + map2check_afl_size = __AFL_FUZZ_TESTCASE_LEN; + __map2check_main__(0, NULL); + } + /* else: input rejected by nondet_assume; continue to the next iteration */ + } + return 0; +} +``` + +- [ ] **Step 2: Delete `NonDetGeneratorLibFuzzy.c` and update the library list** + +Run: `git rm modules/backend/library/lib/NonDetGeneratorLibFuzzy.c` + +Change `modules/backend/library/lib/CMakeLists.txt:19` from: +```cmake +list(APPEND MAP2CHECK_C_LIB "NonDetGeneratorLibFuzzy") +``` +to: +```cmake +list(APPEND MAP2CHECK_C_LIB "NonDetGeneratorAFL") +``` + +- [ ] **Step 3: Verify the bytecode builds** + +Run: `cmake --build --target NonDetGeneratorAFL 2>&1 | tail -5` +Expected: `Compiling NonDetGeneratorAFL to bytecode` and `modules/backend/library/lib/NonDetGeneratorAFL.bc` exists. (The `.bc` is emitted via `clang -c -emit-llvm`, which does NOT need `afl-clang-fast`; instrumentation happens at the final native compile in Task 5.) + +- [ ] **Step 4: Commit** + +```bash +git add modules/backend/library/lib/NonDetGeneratorAFL.c modules/backend/library/lib/CMakeLists.txt +git rm modules/backend/library/lib/NonDetGeneratorLibFuzzy.c +git commit -m "feat(tacasv1): AFL++ persistent nondet generator" +``` + +--- + +### Task 5: Rewire the Caller (enum, link, compile, execute) + +**Files:** +- Modify: `modules/frontend/caller.hpp:42-46` (enum), comment-only updates at 40-41, 84, 142, 151, 162, 165 +- Modify: `modules/frontend/caller.cpp:315-368` (`applyNonDetGenerator`), `546-548` (`linkLLVM`), `782-839` (`executeAnalysis`) + +**Interfaces:** +- Consumes: `Map2Check::aflClangFastBinary()`, `Map2Check::aflFuzzBinary()` (Task 2); `NonDetGeneratorAFL.bc` (Task 4). +- Produces: `NonDetGenerator::AFLPlusPlus` enum value, consumed by `map2check.cpp` (Task 6). + +- [ ] **Step 1: Rename the enum in `caller.hpp`** + +Change: +```cpp +enum class NonDetGenerator { + None, /**< Do not generate any input */ + LibFuzzer, /**< LibFuzzer from LLVM */ + Klee, /**< Use klee for symbolic analysis */ +}; +``` +to: +```cpp +enum class NonDetGenerator { + None, /**< Do not generate any input */ + AFLPlusPlus, /**< AFL++ (persistent mode, PCGUARD) */ + Klee, /**< Use klee for symbolic analysis */ +}; +``` + +- [ ] **Step 2: Swap the link target in `caller.cpp linkLLVM()` (lines 546-548)** + +Change: +```cpp + case (NonDetGenerator::LibFuzzer): { + linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorLibFuzzy.bc"; + break; + } +``` +to: +```cpp + case (NonDetGenerator::AFLPlusPlus): { + linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorAFL.bc"; + break; + } +``` + +- [ ] **Step 3: Swap the compile commands in `applyNonDetGenerator()` (lines 315-368)** + +Change the `case (NonDetGenerator::LibFuzzer):` label to `case (NonDetGenerator::AFLPlusPlus):`, the log line to `"Instrumenting with AFL++"`, and the two commands: + +From: +```cpp + command + << bound << Map2Check::clangBinary + << " -g -fsanitize=fuzzer -fsanitize-coverage=inline-8bit-counters " + << Caller::postOptimizationFlags() + << " -o " + programHash + "-fuzzed.out" + << " " + programHash + "-result.bc"; +``` +to: +```cpp + command + << bound << Map2Check::aflClangFastBinary() + << " -g " << Caller::postOptimizationFlags() + << " -o " + programHash + "-fuzzed.out" + << " " + programHash + "-result.bc"; +``` + +From: +```cpp + commandWitness << bound << Map2Check::clangBinary + << " -g -fsanitize=fuzzer " + << " -o " + programHash + "-witness-fuzzed.out" + << " " + programHash + "-witness-result.bc"; +``` +to: +```cpp + commandWitness << bound << Map2Check::aflClangFastBinary() + << " -g " + << " -o " + programHash + "-witness-fuzzed.out" + << " " + programHash + "-witness-result.bc"; +``` + +And the build-failure warning text (lines 361-366): replace `"the LibFuzzer binary did not build within "` with `"the AFL++ binary did not build within "`. + +- [ ] **Step 4: Swap the exec in `executeAnalysis()` (lines 782-839)** + +Change the `case (NonDetGenerator::LibFuzzer):` label to `case (NonDetGenerator::AFLPlusPlus):`, and the messages `"Executing LibFuzzer with map2check"` / `"the LibFuzzer binary is unavailable"` to `"Executing AFL++ with map2check"` / `"the AFL++ binary is unavailable"`. + +Replace the exec block (from `Map2Check::Log::Info("Executing ...")` through the `commandWitness` replay) with: + +```cpp + Map2Check::Log::Info("Executing AFL++ with map2check"); + std::ostringstream command; + command.str(""); + // Against what is LEFT, not against the nominal budget — see + // Caller::remainingSeconds. + const double fuzzerBudget = + std::min(0.2 * this->timeout, + static_cast(this->remainingSeconds())); + // afl-fuzz needs a non-empty -i dir (LibFuzzer started from empty), and + // a -o dir that does not already exist (the hybrid may run the fuzzer + // phase twice). One minimal seed, and a clean output dir each time. + std::error_code seedErr; + std::filesystem::create_directories(Caller::seedDirectory, seedErr); + std::string seedFile = std::string(Caller::seedDirectory) + "/seed"; + if (!std::filesystem::exists(seedFile, seedErr)) { + std::ofstream seed(seedFile); + seed << "A"; + } + std::filesystem::remove_all("afl-out", seedErr); + command << "timeout -k " << Map2Check::killGracePeriod << " " + << static_cast(fuzzerBudget) << " "; + command << Map2Check::aflFuzzBinary() + << " -i " << Caller::seedDirectory + << " -o afl-out" + << " -V " << std::max(1u, static_cast(fuzzerBudget)) + << " -- ./" << programHash << "-fuzzed.out" + << " > fuzzer.output 2>&1"; + + int result = system(command.str().c_str()); + Map2Check::Log::Warning("Exited fuzzer with " + std::to_string(result)); + if (result == 31744) // Timeout + gotTimeout = true; + + // Replay any crash with the witness binary to confirm a real violation. + // __AFL_FUZZ_INIT reads argv[1] as the input file when run standalone. + std::error_code crashErr; + if (std::filesystem::exists("afl-out/crashes", crashErr)) { + for (const auto &entry : + std::filesystem::directory_iterator("afl-out/crashes")) { + std::ostringstream commandWitness; + commandWitness.str(""); + commandWitness << "./" << programHash << "-witness-fuzzed.out " + << entry.path().string(); + system(commandWitness.str().c_str()); + } + } + Map2Check::Log::Debug("Finished fuzzer"); + + if (isWitnessFileCreated()) { + witnessVerified = true; + } + + break; +``` + +(Keep the surrounding `hasFuzzer` availability check and the final `isWitnessFileCreated()` after the switch exactly as they are.) + +- [ ] **Step 5: Verify it compiles** + +Run: `cmake --build --target map2check 2>&1 | tail -20` +Expected: build succeeds with no `NonDetGenerator::LibFuzzer` references remaining. If any remain, the compiler will error on the removed enum value. + +- [ ] **Step 6: Commit** + +```bash +git add modules/frontend/caller.hpp modules/frontend/caller.cpp +git commit -m "feat(tacasv1): drive AFL++ from the Caller" +``` + +--- + +### Task 6: Rename the CLI value and hybrid loop + +**Files:** +- Modify: `modules/frontend/map2check.cpp:725-727` (help), `901` (valid values), `913` (capture), `950` & `976` (hybrid loop), `571` & `583` (evidence guard) + +**Interfaces:** +- Consumes: `NonDetGenerator::AFLPlusPlus` (Task 5). +- Produces: CLI value `afl` for `--nondet-generator`. + +- [ ] **Step 1: Help text (lines 725-727)** + +Change: +```cpp + ("nondet-generator", po::value(), + R"(specifies the nondet-generator, valid values are fuzzer (libFuzzer), +symex (Klee))") +``` +to: +```cpp + ("nondet-generator", po::value(), + R"(specifies the nondet-generator, valid values are afl (AFL++), +symex (Klee))") +``` + +- [ ] **Step 2: Valid values and capture (lines 901, 913)** + +Change `{"fuzzer", "symex"}` to `{"afl", "symex"}`, and: +```cpp + if(generatorname == available_generators[0]) + args.generator = Map2Check::NonDetGenerator::LibFuzzer; +``` +to: +```cpp + if(generatorname == available_generators[0]) + args.generator = Map2Check::NonDetGenerator::AFLPlusPlus; +``` + +- [ ] **Step 3: Hybrid loop (lines 950, 976)** + +Change both `args.generator = Map2Check::NonDetGenerator::LibFuzzer;` to `args.generator = Map2Check::NonDetGenerator::AFLPlusPlus;`. + +- [ ] **Step 4: Evidence guard (lines 571, 583)** + +Change `Map2Check::NonDetGenerator::LibFuzzer` to `Map2Check::NonDetGenerator::AFLPlusPlus` in both the `evidenceIsTrustworthy` condition and the `!caller->isVerified()` condition. + +- [ ] **Step 5: Verify** + +Run: `cmake --build --target map2check 2>&1 | tail -20` +Then: `./release/bin/map2check --help 2>&1 | grep -A1 nondet-generator` +Expected: the help shows `valid values are afl (AFL++), symex (Klee)`. + +- [ ] **Step 6: Commit** + +```bash +git add modules/frontend/map2check.cpp +git commit -m "feat(tacasv1): --nondet-generator afl replaces fuzzer" +``` + +--- + +### Task 7: End-to-end smoke test + +**Files:** +- Test (throwaway): a temporary C file, removed after the test. + +**Interfaces:** +- Consumes: the full build from Tasks 1-6. + +- [ ] **Step 1: Write the smoke program** + +```c +extern int __VERIFIER_nondet_int(void); +void reach_error(void) { __builtin_trap(); } +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x != 0) { + reach_error(); + } + return 0; +} +``` + +Save as `/tmp/tacas-smoke.c`. The `x != 0` guard is trivially satisfied, so AFL++ finds the crash on its first inputs — the point is to exercise instrumentation + crash replay + verdict, not fuzzing efficacy. + +- [ ] **Step 2: Run map2check against it** + +Run (inside the dev image, with `release/bin` on PATH): +```bash +map2check --target-function --target-function-name reach_error \ + --nondet-generator afl --timeout 30 /tmp/tacas-smoke.c +``` +Expected: the run reports a violation (verdict `FALSE` / `TARGET_REACHED`, not `UNKNOWN`), and the fuzzer log shows `Executing AFL++ with map2check`. + +- [ ] **Step 3: Confirm the AFL++ specifics** + +Run: `grep -i "no instrumentation" fuzzer.output; echo $?` inside the scratch dir. +Expected: `1` (no "no instrumentation" line — AFL++ instrumented the binary). If `0`, the PCGUARD instrumentation did not apply to the pre-linked `.bc`; see the fallback in the spec §8 (instrument `compileCFile()` with `afl-clang-fast` instead). + +- [ ] **Step 4: Confirm the hybrid default still works** + +Run: +```bash +map2check --target-function --target-function-name reach_error --timeout 30 /tmp/tacas-smoke.c +``` +Expected: fuzzer (AFL++) → KLEE sequence runs and reaches a verdict (no `fuzzer` string left in `--help`, no `LibFuzzer` in the log). + +- [ ] **Step 5: Clean up and commit the spec reference** + +```bash +rm -f /tmp/tacas-smoke.c +``` + +No repo change; if the smoke exposed a gap, fix it in the owning task before proceeding. + +--- + +### Task 8: CI/release scripts and docs + +**Files:** +- Modify: `.github/workflows/ci.yml`, `.github/workflows/release.yml`, `scripts/make-release.sh`, `scripts/prepare-release.sh`, `make-unit-test.sh` (all `-DSKIP_LIB_FUZZER=ON` → `-DSKIP_AFL_PLUS_PLUS=ON`) +- Modify: `README.md`, `CLAUDE.md`, `CHANGELOG.md`, `TODO.md`, `docs/map2check_migration_plan.md` + +**Interfaces:** +- None (documentation/config parity with the rename). + +- [ ] **Step 1: Scripts and CI flag rename** + +Run across the five files: +```bash +grep -rl 'SKIP_LIB_FUZZER' .github scripts make-unit-test.sh | xargs sed -i 's/SKIP_LIB_FUZZER/SKIP_AFL_PLUS_PLUS/g' +``` +Then inspect each diff (`git diff`) to confirm only the flag name changed, and that no `libFuzzer`/`LibFuzzer` references remain in those files (update the surrounding comments where they mention LibFuzzer, e.g. `release.yml`'s header comment and `make-release.sh`'s `cp libFuzzer.a` line — replace that copy with AFL++ availability, since AFL++ is not copied into the release dir). + +- [ ] **Step 2: Docs** + +- `README.md` line 15 and `CLAUDE.md` line 7: replace "LibFuzzer" with "AFL++" in the stack description. +- `README.md`/`CLAUDE.md` build instructions: `-DSKIP_LIB_FUZZER=ON` → `-DSKIP_AFL_PLUS_PLUS=ON`. +- `CHANGELOG.md`: add a `tacasv1` entry — "Replaced LibFuzzer with AFL++ 4.40c (persistent, PCGUARD) as the fuzzing engine." +- `TODO.md`: update the `dynamic_analysis_unsafe` note (the embedded fuzzer is now AFL++, not LibFuzzer). +- `docs/map2check_migration_plan.md` §3.1 (mark `FindAFLPlusPlus.cmake`/PCGUARD/wrapper done) and §3.2 (note the coordinator **stays in Caller C++**, not `modules/coordinator/` Python/pybind11). + +- [ ] **Step 3: Verify no stragglers** + +Run: +```bash +grep -rniE 'libfuzzer|libfuzzy' --include='*.cpp' --include='*.hpp' --include='*.c' --include='*.h' --include='*.cmake' --include='CMakeLists.txt' --include='*.yml' --include='*.sh' modules/ cmake/ .github/ scripts/ make-unit-test.sh +``` +Expected: only historical mentions in `docs/` (which are intentionally left for the record), nothing in `modules/`, `cmake/`, `.github/`, `scripts/`. + +- [ ] **Step 4: Commit** + +```bash +git add .github scripts make-unit-test.sh README.md CLAUDE.md CHANGELOG.md TODO.md docs/map2check_migration_plan.md +git commit -m "chore(tacasv1): rename SKIP_LIB_FUZZER→SKIP_AFL_PLUS_PLUS and update docs" +``` + +--- + +## Self-Review + +- **Spec coverage:** every spec section maps to a task — §5 build (Tasks 1, 3), §6 runtime (Tasks 2, 4, 5, 6), §9 smoke (Task 7), §10 docs (Task 8). The parallel `-M/-S` and smart-seed work are explicitly out of scope, matching the spec §4. +- **Placeholders:** none — every code step has the full code, every command has an expected result. +- **Type consistency:** `NonDetGenerator::AFLPlusPlus` is defined in Task 5 and referenced identically in Task 6; `aflClangFastBinary()`/`aflFuzzBinary()` defined in Task 2, used in Task 5; `NonDetGeneratorAFL.bc` produced in Task 4, linked in Task 5. diff --git a/docs/superpowers/plans/2026-09-26-tacasv2a-slicing-reach-assert.md b/docs/superpowers/plans/2026-09-26-tacasv2a-slicing-reach-assert.md new file mode 100644 index 000000000..d184904bc --- /dev/null +++ b/docs/superpowers/plans/2026-09-26-tacasv2a-slicing-reach-assert.md @@ -0,0 +1,752 @@ +# tacasv2a — Slicing for reach/assert that keeps the suite valid: Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Make `--slice` stop crashing KLEE and stop producing test suites that are invalid on the original program. Also extend `--slice` to assert mode. + +**Architecture:** Slicing stays where it is: in `Caller::sliceWithRespectToTarget`, before instrumentation. The pure pieces are: +- the criteria list, built from the target plus every `__VERIFIER_nondet_*` function; +- the weak-stub source; +- the parser for the slicer's `--statistics` output. + +They move into a new header-only unit `modules/frontend/utils/slicer.hpp`, so they can be unit-tested without a build of the whole tool. The Caller then passes `-cutoff-diverging=false --statistics` and logs the counts. `map2check.cpp` enables the assert-mode criterion. + +**Tech Stack:** C++17, LLVM 16, sbt-slicer (dg) pinned in `Dockerfile.dev`, GTest, bash integration tests. Build and run everything inside the dev image (`map2check-dev:aflpp`, built from `Dockerfile.dev`); the host has no clang, cmake or ninja. + +**Spec:** `docs/superpowers/specs/2026-09-26-tacasv2a-slicing-reach-assert-design.md` + +## Global Constraints + +- Branch `tacas/slicing` (created from `tacas/aflpp`); the baseline is tacasv1. Never target LibFuzzer. +- Cutoff: `-cutoff-diverging=false`. +- Reachability criterion: `` plus every known `__VERIFIER_nondet_*` function. +- Assert criterion: `__VERIFIER_assert,__assert_fail` plus the same nondet functions (AssertPass instruments both). +- Slice before instrumentation (unchanged). Keep the weak stub for the criterion function. +- Other slicer flags (`--pta`, `--cda`, `--undefined-funs`) stay at their defaults in this stage. +- Pass `--statistics` to the slicer, and log globals/functions/blocks/instructions before → after, plus bytes. +- C++: Google style (`.clang-format`), `` (never boost). Commit messages end with `Co-Authored-By: Claude Opus 5.5 (1M context) `. + +## Review Focus + +- **A program that declares no nondet function at all** (`no_input.c`-like). The criteria must still be the target alone plus names that do not exist, and the slicer accepts those silently (verified). Pinned in Task 1. +- **`--slice` in assert mode on a program that only declares `__VERIFIER_assert`.** The weak stub must have the `(int)` signature or `llvm-link` rejects the type. Pinned in Task 3. +- **A slicer build whose `--statistics` prints nothing, or a different format.** The log must fall back to bytes only and never print zeros as if measured. Pinned in Task 1 (parser returns `found=false`). +- **A program with a nondet read that is irrelevant to the target and consumed before the relevant one.** The suite must carry both values, in the original order. Pinned in Task 2. +- **A program whose non-target branch returns early** (the path the cutoff used to rewrite). KLEE must run and report FAILED, not abort on a broken module. Pinned in Task 2. + +--- + +## File Structure + +- Create `modules/frontend/utils/slicer.hpp`, header-only and pure (no I/O). It holds `nondetFunctionNames()`, `slicingCriteria()`, `targetStubSource()`, `SlicerStatistics`, `parseSlicerStatistics()` and `describeSlice()`. +- Create `tests/unit/frontend/SlicerTest.cpp` with the GTest unit tests for `slicer.hpp`. +- Modify `tests/unit/frontend/CMakeLists.txt` to register `SlicerTest`. +- Modify `modules/frontend/caller.cpp` so that `sliceWithRespectToTarget` uses `slicer.hpp` and passes the new flags. +- Modify `modules/frontend/caller.hpp` to update the doc comment of `sliceWithRespectToTarget`; the signature stays the same. +- Modify `modules/frontend/map2check.cpp` for the `--slice` gating (reach + assert) and the help text. +- Modify `tests/integration/test_testcomp_regressions.sh`: new slicing sections, and the refusal-message check updated. +- Modify `CHANGELOG.md` to add a tacasv2a entry. + +--- + +### Task 1: Pure slicing helpers (`slicer.hpp`) with unit tests + +**Files:** +- Create: `modules/frontend/utils/slicer.hpp` +- Create: `tests/unit/frontend/SlicerTest.cpp` +- Modify: `tests/unit/frontend/CMakeLists.txt` (append) + +**Interfaces:** +- Produces (namespace `Map2Check`): + - `const std::vector& nondetFunctionNames();` + - `std::string slicingCriteria(const std::vector& primary);` returns the comma-joined `primary` followed by every nondet name. + - `std::string targetStubSource(const std::string& function);` returns a one-line C weak definition with the right signature. + - `struct SlicerCounts { unsigned globals = 0, functions = 0, blocks = 0, instructions = 0; };` + - `struct SlicerStatistics { bool found = false; SlicerCounts before, after; };` + - `SlicerStatistics parseSlicerStatistics(const std::string& slicerOutput);` + - `std::string describeSlice(const std::string& criterion, const SlicerStatistics& stats, uintmax_t bytesBefore, uintmax_t bytesAfter);` + +- [ ] **Step 1: Write the failing unit tests** + +Create `tests/unit/frontend/SlicerTest.cpp`: + +```cpp +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include + +#include +#include +#include + +#include "../../../modules/frontend/utils/slicer.hpp" + +// The suite is generated on the slice and run by TestCov on the ORIGINAL +// program, so every nondet read the original performs must survive slicing. +TEST(SlicingCriteria, AppendsEveryNondetFunctionAfterThePrimary) { + const std::string criteria = Map2Check::slicingCriteria({"reach_error"}); + EXPECT_EQ(criteria.rfind("reach_error,", 0), 0u); + for (const std::string& name : Map2Check::nondetFunctionNames()) { + EXPECT_NE(criteria.find("," + name), std::string::npos) << name; + } +} + +TEST(SlicingCriteria, KeepsSeveralPrimariesInOrder) { + const std::string criteria = + Map2Check::slicingCriteria({"__VERIFIER_assert", "__assert_fail"}); + EXPECT_EQ(criteria.rfind("__VERIFIER_assert,__assert_fail,", 0), 0u); +} + +TEST(NondetFunctionNames, CoversWhatNonDetPassInstruments) { + const auto& names = Map2Check::nondetFunctionNames(); + for (const char* type : {"bool", "char", "uchar", "short", "ushort", "int", + "uint", "unsigned", "long", "ulong", "size_t", + "loff_t", "sector_t", "pointer", "pchar", "double"}) { + const std::string name = std::string("__VERIFIER_nondet_") + type; + EXPECT_NE(std::find(names.begin(), names.end(), name), names.end()) << name; + } +} + +TEST(TargetStubSource, VoidTargetGetsAVoidStub) { + EXPECT_EQ(Map2Check::targetStubSource("reach_error"), + "void __attribute__((weak)) reach_error(void) {}\n"); +} + +// __VERIFIER_assert takes the condition; a (void) stub would not link against +// the program's own declaration. +TEST(TargetStubSource, AssertStubTakesTheCondition) { + EXPECT_EQ(Map2Check::targetStubSource("__VERIFIER_assert"), + "void __attribute__((weak)) __VERIFIER_assert(int cond) {}\n"); +} + +TEST(ParseSlicerStatistics, ReadsBeforeAndAfter) { + const std::string output = + "Statistics before Globals/Functions/Blocks/Instr.: 37 97 2215 10764\n" + "[llvm-slicer] Sliced away 1454 from 4227 nodes in DG\n" + "Statistics after Globals/Functions/Blocks/Instr.: 37 38 444 2989\n"; + const Map2Check::SlicerStatistics stats = + Map2Check::parseSlicerStatistics(output); + ASSERT_TRUE(stats.found); + EXPECT_EQ(stats.before.functions, 97u); + EXPECT_EQ(stats.before.blocks, 2215u); + EXPECT_EQ(stats.before.instructions, 10764u); + EXPECT_EQ(stats.after.globals, 37u); + EXPECT_EQ(stats.after.functions, 38u); + EXPECT_EQ(stats.after.instructions, 2989u); +} + +// A slicer that prints no statistics must not be reported as having sliced +// everything away. +TEST(ParseSlicerStatistics, MissingLinesAreNotFound) { + EXPECT_FALSE(Map2Check::parseSlicerStatistics("").found); + EXPECT_FALSE(Map2Check::parseSlicerStatistics( + "Statistics before Globals/Functions/Blocks/Instr.: 1 2 3 4\n") + .found); +} + +TEST(DescribeSlice, ReportsCountsWhenFound) { + Map2Check::SlicerStatistics stats; + stats.found = true; + stats.before = {37, 97, 2215, 10764}; + stats.after = {37, 38, 444, 2989}; + EXPECT_EQ(Map2Check::describeSlice("reach_error", stats, 184164, 171708), + "Sliced with respect to reach_error: 97/2215/10764 -> 38/444/2989 " + "functions/blocks/instructions (184164 -> 171708 bytes of " + "bitcode)"); +} + +TEST(DescribeSlice, FallsBackToBytesWithoutStatistics) { + EXPECT_EQ(Map2Check::describeSlice("reach_error", {}, 10, 8), + "Sliced with respect to reach_error: 10 -> 8 bytes of bitcode"); +} +``` + +Append to `tests/unit/frontend/CMakeLists.txt`: + +```cmake + +add_executable(SlicerTest + SlicerTest.cpp +) +map2check_test(SlicerTest) +``` + +- [ ] **Step 2: Run the tests and confirm they fail to compile** + +Run inside the dev image: +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c \ + 'mkdir -p /workspace/build_ut && cd /workspace/build_ut && cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm -DENABLE_TEST=ON >/dev/null && ninja SlicerTest 2>&1 | tail -5' +``` +Expected: FAIL with `fatal error: '../../../modules/frontend/utils/slicer.hpp' file not found`. + +- [ ] **Step 3: Implement `slicer.hpp`** + +Create `modules/frontend/utils/slicer.hpp`: + +```cpp +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_SLICER_HPP_ +#define MODULES_FRONTEND_UTILS_SLICER_HPP_ + +#include +#include +#include +#include +#include + +namespace Map2Check { + +/** Every __VERIFIER_nondet_* function the slice must keep. + * + * The suite is generated on the slice, but TestCov runs it on the ORIGINAL + * program. A nondet call the slicer drops -- its value does not reach the + * criterion -- is still consumed by the original, so the vector shifts and + * the suite stops covering (measured: ntdrivers/floppy.i.cil-1.c, 29 reads in + * the program and 10 in the slice; FAILED, NOT_COVERED). Keeping these calls + * as criteria keeps the consumption order. + * + * The first sixteen are what NonDetPass instruments; the rest are SV-COMP + * names it does not model yet, kept so their order is not lost either. The + * slicer accepts names the program does not use. */ +inline const std::vector& nondetFunctionNames() { + static const std::vector names = { + "__VERIFIER_nondet_bool", "__VERIFIER_nondet_char", + "__VERIFIER_nondet_uchar", "__VERIFIER_nondet_short", + "__VERIFIER_nondet_ushort", "__VERIFIER_nondet_int", + "__VERIFIER_nondet_uint", "__VERIFIER_nondet_unsigned", + "__VERIFIER_nondet_long", "__VERIFIER_nondet_ulong", + "__VERIFIER_nondet_size_t", "__VERIFIER_nondet_loff_t", + "__VERIFIER_nondet_sector_t", "__VERIFIER_nondet_pointer", + "__VERIFIER_nondet_pchar", "__VERIFIER_nondet_double", + "__VERIFIER_nondet_float", "__VERIFIER_nondet_longlong", + "__VERIFIER_nondet_ulonglong", "__VERIFIER_nondet__Bool", + "__VERIFIER_nondet_u8", "__VERIFIER_nondet_u16", + "__VERIFIER_nondet_u32", "__VERIFIER_nondet_charp"}; + return names; +} + +/** The -c argument: the primary criteria, then every nondet function. */ +inline std::string slicingCriteria(const std::vector& primary) { + std::ostringstream criteria; + bool first = true; + for (const std::string& name : primary) { + criteria << (first ? "" : ",") << name; + first = false; + } + for (const std::string& name : nondetFunctionNames()) { + criteria << (first ? "" : ",") << name; + first = false; + } + return criteria.str(); +} + +/** A weak definition of the criterion function, restoring the body the + * slicer removes without displacing a real one. The signature must match + * the program's declaration, or llvm-link rejects the module. */ +inline std::string targetStubSource(const std::string& function) { + if (function == "__VERIFIER_assert") { + return "void __attribute__((weak)) __VERIFIER_assert(int cond) {}\n"; + } + return "void __attribute__((weak)) " + function + "(void) {}\n"; +} + +struct SlicerCounts { + unsigned globals = 0; + unsigned functions = 0; + unsigned blocks = 0; + unsigned instructions = 0; +}; + +struct SlicerStatistics { + bool found = false; // both the "before" and the "after" line were read + SlicerCounts before; + SlicerCounts after; +}; + +/** Reads sbt-slicer's --statistics lines: + * Statistics before Globals/Functions/Blocks/Instr.: 37 97 2215 10764 + * Statistics after Globals/Functions/Blocks/Instr.: 37 38 444 2989 */ +inline SlicerStatistics parseSlicerStatistics(const std::string& slicerOutput) { + static const std::regex line( + R"(Statistics (before|after) Globals/Functions/Blocks/Instr\.:\s+)" + R"((\d+)\s+(\d+)\s+(\d+)\s+(\d+))"); + SlicerStatistics stats; + bool sawBefore = false; + bool sawAfter = false; + for (std::sregex_iterator it(slicerOutput.begin(), slicerOutput.end(), line), + end; + it != end; ++it) { + const std::smatch& m = *it; + SlicerCounts counts; + counts.globals = static_cast(std::stoul(m[2])); + counts.functions = static_cast(std::stoul(m[3])); + counts.blocks = static_cast(std::stoul(m[4])); + counts.instructions = static_cast(std::stoul(m[5])); + if (m[1] == "before") { + stats.before = counts; + sawBefore = true; + } else { + stats.after = counts; + sawAfter = true; + } + } + stats.found = sawBefore && sawAfter; + return stats; +} + +/** The one log line a slice produces. Counts when the slicer reported them, + * bytes always -- a slice narrows the question being answered, and this line + * is the only visible sign of how much was dropped. */ +inline std::string describeSlice(const std::string& criterion, + const SlicerStatistics& stats, + uintmax_t bytesBefore, uintmax_t bytesAfter) { + std::ostringstream text; + text << "Sliced with respect to " << criterion << ": "; + if (stats.found) { + text << stats.before.functions << "/" << stats.before.blocks << "/" + << stats.before.instructions << " -> " << stats.after.functions << "/" + << stats.after.blocks << "/" << stats.after.instructions + << " functions/blocks/instructions (" << bytesBefore << " -> " + << bytesAfter << " bytes of bitcode)"; + } else { + text << bytesBefore << " -> " << bytesAfter << " bytes of bitcode"; + } + return text.str(); +} + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_SLICER_HPP_ +``` + +- [ ] **Step 4: Run the tests and confirm they pass** + +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c \ + 'cd /workspace/build_ut && ninja SlicerTest >/dev/null && ./tests/unit/frontend/SlicerTest 2>&1 | tail -3' +``` +Expected: `[ PASSED ] 9 tests.` (If the binary is elsewhere, find it with `find /workspace/build_ut -name SlicerTest -type f`.) + +- [ ] **Step 5: Commit** + +```bash +git add modules/frontend/utils/slicer.hpp tests/unit/frontend/SlicerTest.cpp tests/unit/frontend/CMakeLists.txt +git commit -m "feat(tacasv2a): pure slicing helpers -- criteria, stub, statistics + +Co-Authored-By: Claude Opus 5.5 (1M context) " +``` + +--- + +### Task 2: Slice without cutoff, keep the nondets, log the statistics + +**Files:** +- Modify: `modules/frontend/caller.cpp`, in `Caller::sliceWithRespectToTarget` (starts around line 179: the command construction around lines 218-222, the success log around lines 243-245, and the stub around lines 262-268) +- Modify: `modules/frontend/caller.hpp:133-136` (doc comment only) +- Test: `tests/integration/test_testcomp_regressions.sh`, new section 13 inserted **before** the final `echo " ---"` summary lines + +**Interfaces:** +- Consumes: `Map2Check::slicingCriteria`, `Map2Check::targetStubSource`, `Map2Check::parseSlicerStatistics`, `Map2Check::describeSlice` from Task 1. +- Produces: the log line `Sliced with respect to : …` (the integration tests grep the `Sliced with respect to` prefix). `sliceWithRespectToTarget` gains a second parameter, `const std::vector& criteria`, the primary criteria; the first stays `targetFunction`, used for the stub and the log. Task 3 calls it with `{"__VERIFIER_assert", "__assert_fail"}`. + +- [ ] **Step 1: Write the failing integration tests** + +In `tests/integration/test_testcomp_regressions.sh`, insert this block immediately before the lines `echo " ---"` / `echo " Results: ..."` at the end: + +```bash +# --- 13. a slice must leave KLEE something it can run ------------------------- +# sbt-slicer's --cutoff-diverging (default on) rewrites every path that cannot +# reach the criterion into a `diverge:` block calling exit(0) -- with no debug +# location. The program is compiled with -g; once KLEE links uClibc, exit has a +# body, and the verifier rejects the module ("inlinable function call in a +# function with debug info must have a !dbg location"). KLEE aborted before +# executing anything, on every sliced task with a cut path: the slice arm of +# the v15 campaign ran without its symbolic engine. +mkdir -p "$WORK/cut" +cat > "$WORK/cut/cut.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x == 3) { return 1; } + if (x == 7) { reach_error(); } + return 0; +} +EOF +( cd "$WORK/cut" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --slice \ + --nondet-generator symex --timeout 45 cut.c ) > "$WORK/cut/run.log" 2>&1 +if grep -q "Broken module" "$WORK/cut/run.log"; then + fail "slice + KLEE" "KLEE rejected the sliced module (cutoff exit without !dbg)" +elif grep -q "VERIFICATION FAILED" "$WORK/cut/run.log"; then + ok "KLEE runs on the slice and reaches the target" +else + fail "slice + KLEE" "no FAILED verdict on a trivially reachable target" + grep -E "Sliced|Exited klee|VERIFICATION" "$WORK/cut/run.log" | sed 's/^/ /' +fi + +# --- 14. a suite found on the slice must hold on the original ---------------- +# TestCov runs the suite on the ORIGINAL program. A nondet read the slicer +# dropped -- its value does not reach the target -- is still consumed there, +# so the vector shifts: measured on ntdrivers/floppy.i.cil-1.c, FAILED and +# NOT_COVERED. The slice keeps every nondet call, so both values appear, in +# the original order. +mkdir -p "$WORK/order" +cp "$WORK/one/reach.prp" "$WORK/order/" +cat > "$WORK/order/order.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (b == 42) { reach_error(); } + return a; +} +EOF +( cd "$WORK/order" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --slice \ + --nondet-generator symex --generate-test-suite --property-file reach.prp \ + --timeout 60 order.c ) > "$WORK/order/run.log" 2>&1 +order_inputs=$(sed -n 's:.*\(.*\).*:\1:p' \ + "$WORK/order/test-suite/testcase-1.xml" 2>/dev/null | tr '\n' ' ') +if [ "$(echo $order_inputs | wc -w)" -eq 2 ] && \ + [ "$(echo $order_inputs | awk '{print $2}')" = "42" ]; then + ok "the sliced suite keeps the original read order [$order_inputs]" +else + fail "slice read order" "expected 2 inputs ending in 42, got [$order_inputs]" +fi +``` + +- [ ] **Step 2: Build the current code and confirm the new tests fail** + +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c ' + mkdir -p /workspace/build_aflpp && cd /workspace/build_aflpp && + cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm -DCMAKE_INSTALL_PREFIX=/workspace/build_aflpp/install >/dev/null && + ninja >/dev/null && ninja install >/dev/null && + mkdir -p install/lib/klee && ln -sfn /opt/klee/lib/klee/runtime install/lib/klee/runtime && + ln -sfn /usr/lib/llvm-16/lib/clang install/lib/clang && + cd /workspace && MAP2CHECK_PATH=/workspace/build_aflpp/install bash tests/integration/test_testcomp_regressions.sh 2>&1 | grep -E "FAIL|PASS KLEE runs|read order|Results"' +``` +Expected: both `FAIL slice + KLEE: KLEE rejected the sliced module …` and `FAIL slice read order: …`. + +- [ ] **Step 3: Implement the Caller change** + +In `modules/frontend/caller.cpp`, add `#include "utils/slicer.hpp"` next to the other `utils/` includes. + +Change the signature (definition and declaration) to: + +```cpp +bool Caller::sliceWithRespectToTarget(const std::string &targetFunction, + const std::vector &criteria) +``` + +and in `caller.hpp` replace the declaration and its comment with: + +```cpp + /** Runs sbt-slicer over the compiled (not yet instrumented) bitcode. + * + * `criteria` are the primary slicing criteria (the target function, or the + * assert functions); every __VERIFIER_nondet_* function is added to them so + * the suite found on the slice stays valid on the original program. The + * cutoff of diverging paths is off: its exit(0) carries no debug location + * and KLEE rejects the module. `targetFunction` gets its body back through a + * weak stub. Returns false if the slicer is unavailable or produced nothing + * usable, leaving the original bitcode in place. */ + bool sliceWithRespectToTarget(const std::string& targetFunction, + const std::vector& criteria); +``` + +Replace the command construction: + +```cpp + command << "timeout -k " << Map2Check::killGracePeriod << " " << static_cast(sliceBudget) + << " " << slicer << " -c " << targetFunction + << " --entry=main -o " << output << " " + << input << " > slicer.output 2>&1"; +``` + +with: + +```cpp + // -cutoff-diverging=false: the cutoff rewrites every path that cannot reach + // the criterion into exit(0) with no debug location, and once KLEE links + // uClibc the verifier rejects the module ("Broken module found") -- KLEE + // never ran on a sliced task with a cut path (tacasv2a spec, defect 1). + // + // The nondet functions ride along as criteria so that every read the + // original program performs survives; the suite is generated on the slice + // and replayed on the original (defect 2). + // + // --statistics: counts before and after, logged below. + command << "timeout -k " << Map2Check::killGracePeriod << " " + << static_cast(sliceBudget) << " " << slicer << " -c " + << Map2Check::slicingCriteria(criteria) + << " --entry=main -cutoff-diverging=false --statistics -o " << output + << " " << input << " > slicer.output 2>&1"; +``` + +Replace the success log: + +```cpp + Map2Check::Log::Info("Sliced with respect to " + targetFunction + ": " + + std::to_string(before) + " -> " + + std::to_string(after) + " bytes of bitcode"); +``` + +with: + +```cpp + std::ifstream slicerLog("slicer.output"); + std::stringstream slicerText; + slicerText << slicerLog.rdbuf(); + std::string criterionLabel; + for (const std::string &name : criteria) { + criterionLabel += (criterionLabel.empty() ? "" : ",") + name; + } + Map2Check::Log::Info(Map2Check::describeSlice( + criterionLabel, Map2Check::parseSlicerStatistics(slicerText.str()), + before, after)); +``` + +Replace the stub text: + +```cpp + stub << "void __attribute__((weak)) " << targetFunction << "(void) {}\n"; +``` + +with: + +```cpp + stub << Map2Check::targetStubSource(targetFunction); +``` + +In `modules/frontend/map2check.cpp`, change the one existing call so it still compiles and keeps today's behaviour for reachability: + +```cpp + caller->sliceWithRespectToTarget(args.function, {args.function}); +``` + +Make sure `caller.cpp` includes `` and `` (it already uses `std::ostringstream` and `std::ifstream`; add whichever is missing). + +- [ ] **Step 4: Rebuild and run the integration tests plus the unit tests** + +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c ' + cd /workspace/build_aflpp && ninja >/dev/null && ninja install >/dev/null && + cd /workspace && MAP2CHECK_PATH=/workspace/build_aflpp/install bash tests/integration/test_testcomp_regressions.sh 2>&1 | grep -E "FAIL|KLEE runs|read order|sliced with respect|Results"' +``` +Expected: `PASS KLEE runs on the slice and reaches the target`, `PASS the sliced suite keeps the original read order [ 42 ]`, `PASS the program was sliced with respect to the target`, and `Results: 21 passed, 0 failed`. + +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c 'cd /workspace/build_ut && ninja >/dev/null && ctest 2>&1 | tail -3' +``` +Expected: `100% tests passed`. + +- [ ] **Step 5: Commit** + +```bash +git add modules/frontend/caller.cpp modules/frontend/caller.hpp modules/frontend/map2check.cpp tests/integration/test_testcomp_regressions.sh +git commit -m "fix(tacasv2a): slice without cutoff and keep every nondet read + +The cutoff's exit(0) carries no !dbg and KLEE rejected every sliced +module with a cut path; nondet reads the slicer dropped shifted the +suite on the original program. Both are integration-tested now, and the +slice is logged in functions/blocks/instructions, not only bytes. + +Co-Authored-By: Claude Opus 5.5 (1M context) " +``` + +--- + +### Task 3: `--slice` in assert mode + +**Files:** +- Modify: `modules/frontend/map2check.cpp`, the `if (args.sliceProgram)` block (around lines 519-528) and the `("slice", …)` help text (around lines 748-750) +- Test: `tests/integration/test_testcomp_regressions.sh`, section 12's refusal check, plus a new section 15 before the summary +- Modify: `CHANGELOG.md` (top entry) + +**Interfaces:** +- Consumes: `Caller::sliceWithRespectToTarget(const std::string&, const std::vector&)` from Task 2. +- Produces: in assert mode the log line is `Sliced with respect to __VERIFIER_assert,__assert_fail: …`, and the refusal message becomes `--slice applies to reachability and assert only`. + +- [ ] **Step 1: Write the failing tests** + +In section 12 of `tests/integration/test_testcomp_regressions.sh`, change the refusal check's grep from `"applies to reachability only"` to `"applies to reachability and assert only"`. + +Insert before the summary lines (after section 14): + +```bash +# --- 15. assert mode slices towards the assertions ---------------------------- +# AssertPass instruments __VERIFIER_assert and __assert_fail, so those are the +# criteria. The program only DECLARES __VERIFIER_assert: the weak stub must +# take the condition, or llvm-link rejects the (void) definition. +mkdir -p "$WORK/assert" +cat > "$WORK/assert/assert.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void __VERIFIER_assert(int cond); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 0) { a = a - 1; } + __VERIFIER_assert(b != 77); + return a; +} +EOF +( cd "$WORK/assert" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --check-asserts --slice --nondet-generator symex --timeout 45 assert.c ) \ + > "$WORK/assert/run.log" 2>&1 +if grep -q "Sliced with respect to __VERIFIER_assert,__assert_fail" "$WORK/assert/run.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/assert/run.log"; then + ok "assert mode slices towards the assertions and still finds the violation" +else + fail "assert slice" "no assert-criterion slice, or the violation was lost" + grep -E "Sliced|slice|VERIFICATION" "$WORK/assert/run.log" | sed 's/^/ /' +fi +``` + +- [ ] **Step 2: Run them and confirm they fail** + +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c ' + cd /workspace && MAP2CHECK_PATH=/workspace/build_aflpp/install bash tests/integration/test_testcomp_regressions.sh 2>&1 | grep -E "FAIL|Results"' +``` +Expected: `FAIL slice mode guard: …` (old message) and `FAIL assert slice: …`. + +- [ ] **Step 3: Implement the gating** + +Replace the block: + +```cpp + if (args.sliceProgram) { + if (args.mode == Map2Check::Map2CheckMode::REACHABILITY_MODE) { + caller->sliceWithRespectToTarget(args.function, {args.function}); + } else { + Map2Check::Log::Warning( + "--slice applies to reachability only: there is no criterion to " + "slice towards when the goal is coverage or a memory property. " + "Analysing the whole program."); + } + } +``` + +with: + +```cpp + // Reachability slices towards the target; assert towards the two functions + // AssertPass instruments. Memory properties and overflow need their own + // criteria (tacasv2b/2c); coverage has none -- every branch is the goal. + if (args.sliceProgram) { + if (args.mode == Map2Check::Map2CheckMode::REACHABILITY_MODE) { + caller->sliceWithRespectToTarget(args.function, {args.function}); + } else if (args.mode == Map2Check::Map2CheckMode::ASSERT_MODE) { + caller->sliceWithRespectToTarget("__VERIFIER_assert", + {"__VERIFIER_assert", "__assert_fail"}); + } else { + Map2Check::Log::Warning( + "--slice applies to reachability and assert only: there is no " + "criterion to slice towards when the goal is coverage or a memory " + "or overflow property. Analysing the whole program."); + } + } +``` + +Replace the help text: + +```cpp + ("slice", + "\tslice the program with respect to the target before analysing it " + "(reachability only; needs sbt-slicer)") +``` + +with: + +```cpp + ("slice", + "\tslice the program with respect to the target (reachability) or " + "the assertions (--check-asserts) before analysing it; needs " + "sbt-slicer") +``` + +Update the comment block right above `if (args.sliceProgram)` that ends with "Reachability only. Slicing needs a criterion, and Cover-Branches has none -- every branch is the goal. Asking elsewhere is refused, not ignored." so that its last paragraph reads: "Reachability and assert. Slicing needs a criterion, and Cover-Branches has none -- every branch is the goal. Asking elsewhere is refused, not ignored." + +- [ ] **Step 4: Rebuild and run everything** + +```bash +docker run --rm -v $(pwd):/workspace map2check-dev:aflpp bash -c ' + cd /workspace/build_aflpp && ninja >/dev/null && ninja install >/dev/null && + cd /workspace && MAP2CHECK_PATH=/workspace/build_aflpp/install bash tests/integration/test_testcomp_regressions.sh 2>&1 | grep -E "FAIL|assert mode|refused|Results"' +``` +Expected: `PASS assert mode slices towards the assertions and still finds the violation`, `PASS --slice is refused where there is no criterion to slice towards`, and `Results: 22 passed, 0 failed`. + +- [ ] **Step 5: CHANGELOG** + +Add at the top of the unreleased section of `CHANGELOG.md`, following its existing format: + +```markdown +- tacasv2a: `--slice` no longer crashes KLEE and its test suites stay valid + on the original program. The slicer runs with `-cutoff-diverging=false` + (the cutoff's `exit(0)` had no debug location and KLEE rejected the + module), and every `__VERIFIER_nondet_*` function is a slicing criterion, + so the read order is preserved. `--slice` now also works with + `--check-asserts`. The slice is logged in functions/blocks/instructions. +``` + +- [ ] **Step 6: Commit** + +```bash +git add modules/frontend/map2check.cpp tests/integration/test_testcomp_regressions.sh CHANGELOG.md +git commit -m "feat(tacasv2a): --slice in assert mode + +Co-Authored-By: Claude Opus 5.5 (1M context) " +``` + +--- + +### Task 4: Validation on the diagnostic sample and the CI gates + +**Files:** none changed (verification only). If a check fails, fix it in the task that owns the code and re-run. + +**Interfaces:** +- Consumes: the full build from Tasks 1-3. + +- [ ] **Step 1: Re-run the 12-task diagnostic sample on the finished build** + +The manifest is the one from the spec's §2 (the 12 programs listed there, TSV columns `category program data_model expected_unreach`). Run both arms with the same build, `BUDGET=300 TESTCOV_S=300`, with `tests/testcomp/run_testcomp_evaluation.sh` (`PROPERTY=cover-error`, `EXTRA_FLAGS=""` for control and `EXTRA_FLAGS="--slice"` for the slice arm, `RESULTS_DIR` outside the repository). The container needs `python3-pip zip gcc gcc-multilib lcov` and `pip3 install testcov`. +Expected: the slice arm covers at least 10/12, and `ntdrivers/floppy.i.cil-1.c` is `FAILED,COVERED`. + +- [ ] **Step 2: Run the CI's TestCov step in the dev image** + +```bash +docker run --rm -u root -v $(pwd):/workspace -w /workspace -e MAP2CHECK_PATH=/workspace/build_aflpp/install map2check-dev:aflpp bash -c ' + apt-get update -qq && apt-get install -y -qq python3-pip zip gcc lcov >/dev/null && pip3 install --quiet testcov && + python3 tests/integration/test_benchexec_toolinfo.py 2>&1 | grep Results && + bash tests/integration/test_cover_branches.sh 2>&1 | grep Results && + bash tests/testcomp/run_testcov_suite.sh 2>&1 | grep -E "FAIL|Results"' +``` +Expected: `16 passed`, `5 passed`, `6 passed, 0 failed`. + +- [ ] **Step 3: Record the result** + +Append the sample table to the spec's §2 as "after implementation", then commit: + +```bash +git add docs/superpowers/specs/2026-09-26-tacasv2a-slicing-reach-assert-design.md +git commit -m "docs(tacasv2a): diagnostic sample re-run on the implementation + +Co-Authored-By: Claude Opus 5.5 (1M context) " +``` diff --git a/docs/superpowers/plans/2026-09-27-tacasv2b-slicing-memsafety.md b/docs/superpowers/plans/2026-09-27-tacasv2b-slicing-memsafety.md new file mode 100644 index 000000000..01002cf3d --- /dev/null +++ b/docs/superpowers/plans/2026-09-27-tacasv2b-slicing-memsafety.md @@ -0,0 +1,377 @@ +# tacasv2b — Slicing for memtrack/memcleanup: Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** make `--slice` work with `--memtrack` and `--memcleanup-property`, by slicing the instrumented module with every runtime call as a criterion. Also add an SV-COMP MemSafety evaluation harness, and let the CASTLE and Juliet runners take extra flags. + +**Architecture:** +- **Shared slicer helper.** The slicer invocation is factored out of `sliceWithRespectToTarget` into a private `Caller::runSlicer` helper. It handles disassembly, criteria, budget, statistics and fallback. +- **New `Caller::sliceInstrumented()`.** It uses the helper on `-output.bc`, between `callPass` and `linkLLVM`. The criteria are every `@map2check_*` symbol plus every nondet function, and the entry is `__map2check_main__`. +- **Harness.** It reuses `build_corpus.py`, with directory-based categories for memory, plus a new runner and a tested classifier. + +**Tech Stack:** C++17, LLVM 16, sbt-slicer, GTest, bash, python3. Build and run everything in `map2check-dev:aflpp`. Build dirs: +- `build_aflpp`, install prefix pinned to `/workspace/build_aflpp/install`; +- `build_aflpp_ut`, with `ENABLE_TEST=ON`. + +**Spec:** `docs/superpowers/specs/2026-09-27-tacasv2b-slicing-memsafety-design.md` + +## Global Constraints + +- Branch `feat/tacas-slicing-mem` (from `feat/tacas-slicing`). Baseline tacasv1; nothing targets LibFuzzer. +- Memory criteria: every `@map2check_*` symbol in the instrumented IR, plus the fixed nondet list, plus the nondet names found in the IR. +- Slicer flags: `--entry=__map2check_main__ -cutoff-diverging=false --statistics`. +- Slicing order: for reach/assert, before `callPass` (unchanged); for memtrack/memcleanup, after `callPass` and before `linkLLVM`. Overflow and cover-branches are still refused. +- Refusal message: `--slice applies to reachability, assert and memory properties only`. +- On any slicer failure, fall back to the unsliced module with a warning. Never abort the run. +- Every mini-round is appended to `docs/reports/tacas-experiment-log.md` and compared with the previous one (standing rule). +- Commits end with `Co-Authored-By: Claude Opus 5.5 (1M context) `. + +## Review Focus + +- **Instrumented modules that call a runtime function only through a declaration never called.** The criterion is harmless (verified in 2a); nothing to pin beyond the unit test. +- **A VLA/`llvm.stacksave` program.** The slicer errors, the run must fall back and keep the unsliced verdict. Pinned in Task 2 (integration test 20). +- **A safe program must never become FALSE because of slicing** (a spurious violation). Pinned in Task 2 (test 19). +- **A FALSE with the wrong subproperty** (e.g. FALSE-FREE on a valid-deref task) must count as `wrong-false`, not correct. Pinned in Task 3 (classifier tests). +- **Rerunning an evaluation with an existing CSV must resume, not duplicate rows.** Pinned in Task 3 (the runner copies the resumable pattern; checked in its smoke step). + +--- + +## File Structure + +- Modify `modules/frontend/utils/slicer.hpp`: add `runtimeNamesInIR()`. +- Modify `tests/unit/frontend/SlicerTest.cpp`: add tests for it. +- Modify `modules/frontend/caller.hpp` / `caller.cpp`: add `runSlicer` (private) and `sliceInstrumented` (public), and refactor `sliceWithRespectToTarget` onto `runSlicer`. +- Modify `modules/frontend/map2check.cpp`: gating, and the post-`callPass` hook. +- Modify `tests/integration/test_testcomp_regressions.sh`: sections 17–21, plus the section-12 refusal moved to overflow. +- Modify `tests/testcomp/build_corpus.py`: add the `memsafety` and `memcleanup` properties, directory categories, and expected verdict/subproperty. +- Create `tests/lib/memsafety_classifier.sh` with `classify_memsafety_result`. +- Create `tests/integration/test_memsafety_classifier.sh` with the classifier table tests. +- Create `tests/memsafety/run_memsafety_evaluation.sh`, the new runner. +- Modify `tests/castle/run_castle_evaluation.sh` and `tests/juliet/run_juliet_evaluation.sh` to accept `EXTRA_FLAGS`. + +--- + +### Task 1: `runtimeNamesInIR` + +**Files:** Modify `modules/frontend/utils/slicer.hpp`, `tests/unit/frontend/SlicerTest.cpp` + +**Interfaces:** Produces `std::vector Map2Check::runtimeNamesInIR(const std::string& ir);`, which returns every `@map2check_[A-Za-z0-9_]+`, in first-appearance order, without duplicates. + +- [ ] **Step 1: Failing test.** Append to `SlicerTest.cpp`: + +```cpp +// After instrumentation the memory property lives in the runtime calls +// MemoryTrackPass inserted; every one of them is a criterion, so nothing that +// records memory is sliced away. +TEST(RuntimeNamesInIR, FindsEveryMap2checkSymbolOnce) { + const std::string ir = + "declare void @map2check_malloc(ptr, i64)\n" + " call void @map2check_check_deref(ptr %3, i64 4), !dbg !7\n" + " call void @map2check_malloc(ptr %1, i64 8)\n" + " call i32 @__VERIFIER_nondet_int()\n"; + const std::vector names = Map2Check::runtimeNamesInIR(ir); + ASSERT_EQ(names.size(), 2u); + EXPECT_EQ(names[0], "map2check_malloc"); + EXPECT_EQ(names[1], "map2check_check_deref"); +} +``` + +- [ ] **Step 2: Run it and confirm it fails** (`ninja SlicerTest` in `build_aflpp_ut`). Expected: `no member named 'runtimeNamesInIR'`. +- [ ] **Step 3: Implement** it in `slicer.hpp`, next to `nondetNamesInIR`: + +```cpp +/** Every map2check_* runtime symbol in a module's textual IR, in order of + * first appearance. Used as the slicing criteria for the memory properties: + * the property is decided by these calls, so none of them may be removed. */ +inline std::vector runtimeNamesInIR(const std::string& ir) { + static const std::regex symbol(R"(@(map2check_[A-Za-z0-9_]+))"); + std::vector names; + for (std::sregex_iterator it(ir.begin(), ir.end(), symbol), end; it != end; + ++it) { + const std::string name = (*it)[1]; + if (std::find(names.begin(), names.end(), name) == names.end()) { + names.push_back(name); + } + } + return names; +} +``` + +- [ ] **Step 4: Run SlicerTest.** Expected: `[ PASSED ] 12 tests.` +- [ ] **Step 5: Commit** `feat(tacasv2b): runtime names as slicing criteria`. + +--- + +### Task 2: Slice the instrumented module in the memory modes + +**Files:** Modify `caller.hpp`, `caller.cpp`, `map2check.cpp`, `tests/integration/test_testcomp_regressions.sh` + +**Interfaces:** +- Consumes: `runtimeNamesInIR`, `nondetNamesInIR`, `slicingCriteria`, `parseSlicerStatistics` and `describeSlice`. +- Produces: + - `bool Caller::sliceInstrumented();` (public); + - `bool Caller::runSlicer(const std::string& input, const std::string& output, std::vector primary, bool addRuntimeNames, const std::string& entry, const std::string& label);` (private). + - Log prefix `Sliced with respect to map2check runtime`. + +- [ ] **Step 1: Failing integration tests.** + - In section 12, change the refusal run from `--memtrack` to `--check-overflow`, and the grep to `"applies to reachability, assert and memory properties only"`. + - Insert before the summary lines the sections below. Each program is written with a `cat > … <<'EOF'` heredoc, as in the existing sections. + +```bash +# --- 17. memtrack slices the instrumented module and keeps the violation ----- +# Memory has no criterion in the user's program: the property is decided by the +# runtime calls MemoryTrackPass inserts, so the slice is taken AFTER +# instrumentation with every map2check_* call as a criterion. +mkdir -p "$WORK/mem" +cat > "$WORK/mem/dfree.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int unrelated = 0; + for (int i = 0; i < 4; i++) { unrelated += i; } + int *p = malloc(sizeof(int)); + free(p); + if (n == 11) { free(p); } + return unrelated; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 dfree.c ) > "$WORK/mem/plain.log" 2>&1 +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 dfree.c ) > "$WORK/mem/slice.log" 2>&1 +plain_v=$(grep -oE "FALSE-[A-Z]+" "$WORK/mem/plain.log" | tail -1) +slice_v=$(grep -oE "FALSE-[A-Z]+" "$WORK/mem/slice.log" | tail -1) +if grep -q "Sliced with respect to map2check runtime" "$WORK/mem/slice.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/mem/slice.log" && [ -n "$slice_v" ] && \ + [ "$slice_v" = "$plain_v" ]; then + ok "memtrack slices after instrumentation and keeps the violation ($slice_v)" +else + fail "memtrack slice" "plain=[$plain_v] slice=[$slice_v]" + grep -E "Sliced|slice|VERIFICATION" "$WORK/mem/slice.log" | sed 's/^/ /' +fi + +# --- 18. memcleanup slices too and still sees the leak ---------------------- +cat > "$WORK/mem/leak.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int *p = malloc(sizeof(int)); + if (n == 5) { return 0; } + free(p); + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memcleanup-property --slice --nondet-generator symex --timeout 45 leak.c ) \ + > "$WORK/mem/leak.log" 2>&1 +if grep -q "Sliced with respect to map2check runtime" "$WORK/mem/leak.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/mem/leak.log"; then + ok "memcleanup slices and still finds the leak" +else + fail "memcleanup slice" "no slice, or the leak was lost" + grep -E "Sliced|slice|VERIFICATION" "$WORK/mem/leak.log" | sed 's/^/ /' +fi + +# --- 19. slicing must not invent a memory violation -------------------------- +cat > "$WORK/mem/safe.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int *p = malloc(sizeof(int)); + if (p == 0) { return 0; } + *p = n; + if (n == 11) { *p = 0; } + free(p); + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 safe.c ) > "$WORK/mem/safe.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/mem/safe.log"; then + fail "slice soundness" "a safe program was reported FALSE after slicing" +else + ok "slicing does not invent a memory violation" +fi + +# --- 20. a construct the slicer rejects falls back, loudly ------------------- +# sbt-slicer errors on llvm.stacksave (variable-length arrays). The run must +# fall back to the unsliced module and reach the same verdict. +cat > "$WORK/mem/vla.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + if (n > 0 && n < 10) { + int a[n]; + a[n] = 1; + return a[0]; + } + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 vla.c ) > "$WORK/mem/vla-plain.log" 2>&1 +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 vla.c ) > "$WORK/mem/vla.log" 2>&1 +vla_plain=$(grep -oE "VERIFICATION [A-Z]+" "$WORK/mem/vla-plain.log" | tail -1) +vla_slice=$(grep -oE "VERIFICATION [A-Z]+" "$WORK/mem/vla.log" | tail -1) +if { grep -q "Sliced with respect to map2check runtime" "$WORK/mem/vla.log" || \ + grep -q "analysing the unsliced program" "$WORK/mem/vla.log"; } && \ + [ -n "$vla_slice" ] && [ "$vla_slice" = "$vla_plain" ]; then + ok "a slicer failure falls back and keeps the verdict ($vla_slice)" +else + fail "slice fallback" "plain=[$vla_plain] slice=[$vla_slice]" +fi +``` + + Run the suite. Expected FAILs: `slice mode guard` (old message), and `memtrack slice` and `memcleanup slice` (no slice). Test 19 passes before the fix, trivially (the slice is refused); it is a regression guard, not a RED test. Test 20 passes before the fix too (no slice: same verdict), for the same reason. Ledger both. + +- [ ] **Step 2: Implement.** + - **Extract `runSlicer`** from `sliceWithRespectToTarget`. It covers the lines from the `slicer` existence check to the `describeSlice` log, parameterized by `input`, `output`, `primary`, `addRuntimeNames`, `entry` and `label`. It returns `false` on a missing slicer or on no usable output (keeping the existing warnings), and `true` after logging. When `addRuntimeNames` is set, the runtime names are appended to `primary` before `slicingCriteria(primary, programNondets)`. The IR file becomes `input + ".ll"`, so the two call sites do not collide. + - **`sliceWithRespectToTarget`** becomes: `if (!runSlicer(programHash + "-compiled.bc", programHash + "-sliced.bc", criteria, false, "main", joined(criteria))) return false;` followed by the existing stub-and-rename code. + - **`sliceInstrumented()`:** + +```cpp +bool Caller::sliceInstrumented() { + // Memory properties have no criterion in the user's program: the property + // is decided by the runtime calls MemoryTrackPass inserted, so the slice is + // taken after instrumentation with every map2check_* call as a criterion + // (none can be dropped), and __map2check_main__ -- the renamed user main -- + // as the entry. tacasv2b spec, section 2. + const std::string input = programHash + "-output.bc"; + const std::string output = programHash + "-sliced-instrumented.bc"; + if (!std::filesystem::exists(input)) return false; + if (!runSlicer(input, output, {}, true, "__map2check_main__", + "map2check runtime")) { + return false; + } + std::error_code error; + std::filesystem::rename(output, input, error); + return !error; +} +``` + + - **In `map2check.cpp`:** + - In the pre-`callPass` block, the memory modes fall through without a warning. + - The warning text changes to `"--slice applies to reachability, assert and memory properties only: there is no criterion to slice towards when the goal is coverage or overflow. Analysing the whole program."`. + - After `caller->callPass(args.function);` insert: + +```cpp + // Memory properties slice the INSTRUMENTED module (see sliceInstrumented). + if (args.sliceProgram && + (args.mode == Map2Check::Map2CheckMode::MEMTRACK_MODE || + args.mode == Map2Check::Map2CheckMode::MEMCLEANUP_MODE)) { + caller->sliceInstrumented(); + } +``` + + - Update the `--slice` help text to mention `--memtrack` and `--memcleanup-property`. +- [ ] **Step 3: Rebuild and run the integration suite and ctest.** Expected: `Results: 27 passed, 0 failed`, ctest 100%. +- [ ] **Step 4: Commit** `feat(tacasv2b): --slice for memtrack and memcleanup, after instrumentation`. + +--- + +### Task 3: SV-COMP MemSafety harness + +**Files:** +- Modify `tests/testcomp/build_corpus.py`. +- Create `tests/lib/memsafety_classifier.sh`, `tests/integration/test_memsafety_classifier.sh` and `tests/memsafety/run_memsafety_evaluation.sh`. + +**Interfaces:** +- Produces `classify_memsafety_result `, which prints one of `correct-true correct-false wrong-true wrong-false unknown error`. `` is the output of `classify_map2check_verdict`. +- Produces manifests with the columns `category program data_model expected subproperty`. + +- [ ] **Step 1: Failing classifier test.** Create `tests/integration/test_memsafety_classifier.sh`: + +```bash +#!/bin/bash +# Table test for classify_memsafety_result: a FALSE only counts when its kind +# matches the task's subproperty; a TRUE on a false task is the dangerous error. +set -u +. "$(dirname "$0")/../lib/memsafety_classifier.sh" +PASSED=0; FAILED=0 +check() { # expected subproperty verdict want + got=$(classify_memsafety_result "$1" "$2" "$3") + if [ "$got" = "$4" ]; then PASSED=$((PASSED+1)); else FAILED=$((FAILED+1)); echo " FAIL $1/$2/$3: want $4 got $got"; fi +} +check true "" TRUE correct-true +check true "" FALSE-DEREF wrong-false +check false valid-deref FALSE-DEREF correct-false +check false valid-free FALSE-FREE correct-false +check false valid-memtrack FALSE-MEMTRACK correct-false +check false valid-memcleanup FALSE-MEMCLEANUP correct-false +check false valid-deref FALSE-FREE wrong-false +check false valid-deref TRUE wrong-true +check false valid-deref UNKNOWN unknown +check false valid-deref TIMEOUT unknown +check true "" ERROR error +echo " Results: $PASSED passed, $FAILED failed" +[ "$FAILED" -eq 0 ] +``` + + Run `bash tests/integration/test_memsafety_classifier.sh`. Expected: fails, because `memsafety_classifier.sh` does not exist. +- [ ] **Step 2: Implement** `tests/lib/memsafety_classifier.sh`: + +```bash +# shellcheck shell=bash +# classify_memsafety_result +# is classify_map2check_verdict's output. A FALSE counts as correct +# only when its kind matches the subproperty the task declares; FALSE of the +# wrong kind is a wrong answer, not a lucky one. +classify_memsafety_result() { + local expected="$1" sub="$2" verdict="$3" want="" + case "$sub" in + valid-deref) want="FALSE-DEREF" ;; + valid-free) want="FALSE-FREE" ;; + valid-memtrack) want="FALSE-MEMTRACK" ;; + valid-memcleanup) want="FALSE-MEMCLEANUP" ;; + esac + case "$verdict" in + TRUE) [ "$expected" = "true" ] && echo correct-true || echo wrong-true ;; + FALSE*) if [ "$expected" = "false" ] && [ "$verdict" = "$want" ]; then + echo correct-false; else echo wrong-false; fi ;; + ERROR) echo error ;; + *) echo unknown ;; + esac +} +``` + + Run the test. Expected: `Results: 11 passed, 0 failed`. +- [ ] **Step 3: `build_corpus.py`.** + - Add `"memsafety": "valid-memsafety.prp"` and `"memcleanup": "valid-memcleanup.prp"` to `PROPERTY_FILE`. + - Add `MEMORY_CATEGORIES`, a dict from category to directory list. For `memsafety`: Arrays, Heap, LinkedLists, Other and Juliet, exactly as spec §3.4. For `memcleanup`: one category, `MemCleanup`, covering every directory. The `memcleanup` expansion globs `*/*.yml` and filters by property. + - In `main`, when the property is `memsafety` or `memcleanup`, expand categories with `glob(BENCH//*.yml)` instead of `expand_set`. + - Generalize `task_info` so that, for the wanted property, it captures `expected_verdict` and `subproperty` (the lines after the matching `- property_file:`), and returns them as a 4th value. + - For memory properties, write the header `# category\tprogram\tdata_model\texpected\tsubproperty` and 5 columns. The cover-* outputs stay unchanged. + - Smoke: `python3 tests/testcomp/build_corpus.py --property memsafety --per-category 3 --out /tmp/ms.tsv`. Expected: a summary listing Arrays/Heap/LinkedLists/Other/Juliet with non-zero "applicable", and 15 rows. +- [ ] **Step 4: `tests/memsafety/run_memsafety_evaluation.sh`.** + - Copy the structure of `tests/testcomp/run_testcomp_evaluation.sh`: the env vars `MANIFEST PROPERTY RESULTS_DIR SHARD SHARDS BUDGET DEADLINE_S EXTRA_FLAGS MAP2CHECK_PATH`, the resumable CSV, fd 3, and a private work dir per task. + - Differences: + - The mode flag is `--memtrack` for `memsafety` and `--memcleanup-property` for `memcleanup`. There is no TestCov. + - The raw verdict comes from `classify_map2check_verdict "$output" "$rc" "$elapsed" "$BUDGET"` (source `tests/lib/verdict_classifier.sh`). + - The class comes from `classify_memsafety_result "$expected" "$subproperty" "$verdict"` (source `tests/lib/memsafety_classifier.sh`). + - The slice statistics come from the log (`grep -o "Sliced with respect to.*"`). + - The CSV header is `category,program,data_model,expected,subproperty,verdict,class,elapsed_s,slice`. + - Smoke: run it on `/tmp/ms.tsv` with `BUDGET=30`, twice. Expected: 15 rows after the first run, still 15 after the second (resume). +- [ ] **Step 5: Commit** `test(tacasv2b): SV-COMP MemSafety evaluation harness`. + +--- + +### Task 4: `EXTRA_FLAGS` in the CASTLE and Juliet runners + +**Files:** Modify `tests/castle/run_castle_evaluation.sh`, `tests/juliet/run_juliet_evaluation.sh` + +- [ ] **Step 1:** In each runner, next to the other env defaults, add `EXTRA_FLAGS="${EXTRA_FLAGS:-}"`, with a comment that it holds opt-in flags such as `--slice` appended to every run. Append `$EXTRA_FLAGS` to the map2check invocation, right after the mode flags. In CASTLE that is both invocations (lines ~174 and ~199); in Juliet, the equivalent call. +- [ ] **Step 2:** `bash -n` both files. Then run a 2-task CASTLE smoke with `EXTRA_FLAGS=--slice` and `RESULTS_DIR` in the scratchpad (use whatever the runner offers to limit tasks; if nothing, a temporary copy of the dataset list with 2 entries). Expected: the raw logs show `Sliced with respect to`. +- [ ] **Step 3: Commit** `test(tacasv2b): opt-in flags for the CASTLE and Juliet runners`. + +--- + +### Task 5: Mini-rounds R7–R9 and the log + +- [ ] **R7, CASTLE:** the full 250, `EXTRA_FLAGS=""` and `EXTRA_FLAGS=--slice`, same build, separate `RESULTS_DIR` in the scratchpad. Tally TP/TN/FP/FN/UNKNOWN/TIMEOUT per arm, and compare with v15 (`tests/castle/results_v15`: TP 54, FN 14, FP 1). +- [ ] **R8, SV-COMP MemSafety:** 10 per category (`--per-category 10`), both arms, `BUDGET=120`. Tally the classes per arm and per category; report the median time and the slice reduction. +- [ ] **R9, Juliet scope C:** a small per-CWE sample (use the runner's sampling options; if none, 5 per CWE), both arms. +- [ ] **Append R7, R8 and R9** to `docs/reports/tacas-experiment-log.md`. For each: data, comparison with the previous round and with the other arm, and the reading, with **wrong-true and wrong-false called out explicitly**. Commit `docs(tacas): R7-R9 -- memory slicing mini-rounds`. diff --git a/docs/superpowers/plans/2026-09-27-tacasv2c-slicing-overflow.md b/docs/superpowers/plans/2026-09-27-tacasv2c-slicing-overflow.md new file mode 100644 index 000000000..510d5397a --- /dev/null +++ b/docs/superpowers/plans/2026-09-27-tacasv2c-slicing-overflow.md @@ -0,0 +1,120 @@ +# tacasv2c — Slicing for overflow: Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** make `--slice` work with `--check-overflow` by reusing `Caller::sliceInstrumented()` from 2b. Also extend the MemSafety harness to SV-COMP NoOverflows. + +**Architecture:** +- Overflow checks are `map2check_binop_*` runtime calls, so the post-instrumentation slice from 2b already covers them. +- This plan changes only three things: + - the gating in `map2check.cpp`; + - the harness (the corpus property and the runner mode); + - the classifier row. + +**Tech Stack:** C++17, bash, python3, sbt-slicer. Work in the worktree `../Map2Check-2c`, branch `feat/tacas-slicing-overflow`. Build in `build_2c`, installing to `build_2c/install`. `build_aflpp` must not be touched while R8–R10 run from the main checkout. + +**Spec:** `docs/superpowers/specs/2026-09-27-tacasv2c-slicing-overflow-design.md` + +## Global Constraints + +- Criteria: every `@map2check_*` plus the nondets, `--entry=__map2check_main__`, `-cutoff-diverging=false` (unchanged from 2b). +- `--slice` covers reach, assert, memtrack, memcleanup and overflow. Only cover-branches is refused. +- Refusal message: `--slice applies to reachability, assert, memory and overflow properties only`. +- Every mini-round is logged in `docs/reports/tacas-experiment-log.md`. + +## Review Focus + +- **A signed overflow whose operands come through unsigned or pointer arithmetic.** The data dependences of the check call's operands must keep them. Covered by the dg semantics; the R11–R13 wrong-* counts are the measure. +- **A safe program must not become FALSE-OVERFLOW after slicing.** Pinned by integration test 22. +- **NoOverflows tasks with `expected_verdict: false`.** The classifier must require FALSE-OVERFLOW; any other FALSE is wrong. Pinned by the classifier rows. + +--- + +### Task 1: Gating plus integration tests + +**Files:** `modules/frontend/map2check.cpp`, `tests/integration/test_testcomp_regressions.sh` + +- [ ] **Step 1: Failing tests.** + - In section 12, change the refusal run from `--check-overflow` to `--cover-branches`, and the grep to `"applies to reachability, assert, memory and overflow properties only"`. + - Add, before the summary lines: + +```bash +# --- 21. overflow slices the instrumented module and keeps the violation ----- +# Overflow checks are map2check_binop_* runtime calls, so the same +# post-instrumentation slice as the memory properties applies. +mkdir -p "$WORK/ovf" +cat > "$WORK/ovf/ovf.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + int unrelated = 0; + for (int i = 0; i < 4; i++) { unrelated += i; } + if (x > 2147483000) { x = x + 1000; } + return x + unrelated; +} +EOF +( cd "$WORK/ovf" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --check-overflow --slice --nondet-generator symex --timeout 45 ovf.c ) > "$WORK/ovf/run.log" 2>&1 +if grep -q "Sliced with respect to map2check runtime" "$WORK/ovf/run.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/ovf/run.log"; then + ok "overflow slices after instrumentation and keeps the violation" +else + fail "overflow slice" "no slice, or the overflow was lost" + grep -E "Sliced|slice|VERIFICATION" "$WORK/ovf/run.log" | sed 's/^/ /' +fi + +# --- 22. slicing must not invent an overflow --------------------------------- +cat > "$WORK/ovf/safe.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 0 && x < 1000) { x = x + 1000; } + return x; +} +EOF +( cd "$WORK/ovf" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --check-overflow --slice --nondet-generator symex --timeout 45 safe.c ) > "$WORK/ovf/safe.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/ovf/safe.log"; then + fail "overflow slice soundness" "a safe program was reported FALSE after slicing" +else + ok "slicing does not invent an overflow" +fi +``` + + Expected before the fix: `slice mode guard` and `overflow slice` FAIL. Test 22 passes trivially today; ledger it as a regression guard. +- [ ] **Step 2: Implement.** + - In `map2check.cpp`, the pre-`callPass` warning condition also excludes `OVERFLOW_MODE`, and its text becomes `"--slice applies to reachability, assert, memory and overflow properties only: there is no criterion to slice towards when the goal is branch coverage. Analysing the whole program."`. + - The post-`callPass` hook condition adds `|| args.mode == Map2Check::Map2CheckMode::OVERFLOW_MODE`, and its comment names overflow. + - The `--slice` help text mentions `--check-overflow`. +- [ ] **Step 3:** Build `build_2c` (fresh: `cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm -DCMAKE_INSTALL_PREFIX=/workspace/build_2c/install`; symlink `install/lib/klee/runtime` and `install/lib/clang` as the CI does). Run the integration suite against `build_2c/install`. Expected: `Results: 29 passed, 0 failed`. +- [ ] **Step 4: Commit** `feat(tacasv2c): --slice for overflow`. + +### Task 2: NoOverflows harness + +**Files:** `tests/testcomp/build_corpus.py`, `tests/memsafety/run_memsafety_evaluation.sh`, `tests/lib/memsafety_classifier.sh`, `tests/integration/test_memsafety_classifier.sh` + +- [ ] **Step 1: Failing classifier rows.** Append to the test: +```bash +check false no-overflow FALSE-OVERFLOW correct-false +check false no-overflow FALSE-DEREF wrong-false +check true "" FALSE-OVERFLOW wrong-false +``` + Run it. Expected: the first row FAILs (`want correct-false got wrong-false`). +- [ ] **Step 2:** In the classifier, add `no-overflow) want="FALSE-OVERFLOW" ;;`. Run it. Expected: `14 passed`. +- [ ] **Step 3:** In `build_corpus.py`: + - add `"overflow": "no-overflow.prp"` to `PROPERTY_FILE`; + - add `MEMORY_CATEGORIES["overflow"] = {"Main": ["bitvector", "nla-digbench-scaling", "recursive-simple", "loop-zilu", "signedintegeroverflow-regression", "goblint-regression"], "BusyBox": ["busybox-1.22.0"], "Juliet": ["Juliet_Test"]}`; + - when an overflow task is false and has no subproperty, the subproperty is `no-overflow` (same rule as memcleanup). + + Smoke: `--property overflow --per-category 3`. Expected: 9 rows; the false rows carry `no-overflow`. +- [ ] **Step 4:** In the runner, add `overflow) MODE_FLAGS="--check-overflow" ;;` to the PROPERTY case, and update its header comment. Run `bash -n`. +- [ ] **Step 5: Commit** `test(tacasv2c): NoOverflows harness`. + +### Task 3: Mini-rounds R11–R13 and the log + +Run each round in the `build_2c` install, both arms (`EXTRA_FLAGS=""` and `--slice`). + +- [ ] **R11, CASTLE CWE-190:** the full CASTLE runner. Report the `--check-overflow` rows only, and compare with v15 (overflow TP 10, FN 2). +- [ ] **R12, Juliet CWE-190/191:** `JULIET_CWES="190 191"`, `PER_FAMILY=1`. +- [ ] **R13, SV-COMP NoOverflows:** `--per-category 10`, `BUDGET=120`. +- [ ] **Append R11–R13 to the log**, with data, a comparison against R7 and the 2b rounds, and wrong-* called out. Commit. diff --git a/docs/superpowers/plans/2026-09-28-tacasv3a-smart-seeds-plumbing.md b/docs/superpowers/plans/2026-09-28-tacasv3a-smart-seeds-plumbing.md new file mode 100644 index 000000000..f3b801e2d --- /dev/null +++ b/docs/superpowers/plans/2026-09-28-tacasv3a-smart-seeds-plumbing.md @@ -0,0 +1,145 @@ +# tacasv3a — Smart seeds plumbing: Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** make `--seed-exchange` actually move seeds between AFL++ and KLEE, across the hybrid's three phases. + +**Architecture:** +- **Seed store.** A persistent directory `/.seeds/` next to the scratch directory, with `afl/`, `ktest/` and `replay/` subdirectories. +- **KLEE → AFL++.** KLEE vectors go to `afl/`, and the AFL++ phase uses `afl/` as its `-i`. +- **AFL++ → KLEE.** The AFL++ queue is replayed through the witness binary inside `replay/`, and the typed nondet log becomes one `.ktest` per entry in `ktest/`. KLEE then runs with `--seed-dir`. +- **Budget.** 0.2 / 0.6 / 0.2 when the exchange is on. +- **Cleanup.** The store is removed after the last phase unless `--debug`. +- **Where the code lives.** Pure selection logic goes into `modules/frontend/utils/seed_store.hpp`; the rest goes in `Caller` and `map2check.cpp`. + +**Tech Stack:** C++17, GTest, bash integration tests, Docker dev image `map2check-dev:aflpp`. Use build dir `build_aflpp` (prefix pinned to `/workspace/build_aflpp/install`) and `build_aflpp_ut` (ENABLE_TEST). Rebuild `build_aflpp` only after R15 has finished, because it is using that install. + +**Spec:** `docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md` + +## Global Constraints + +- **Store path:** `/.seeds`, absolute, with subdirectories `afl/`, `ktest/` and `replay/`. It exists only with `--seed-exchange`. +- **Queue replay:** at most 64 entries, in queue id order, each with a 2 s cap, run inside `replay/`. Empty or duplicate vectors are skipped. +- **KLEE seeding flags:** `--seed-dir=/ktest --allow-seed-extension --allow-seed-truncation --seed-time=s`, added only when `ktest/` has a file. +- **Budget with the exchange:** KLEE `min(0.6T, remaining−5)`. Without the exchange nothing changes (0.8T). +- **Log lines:** `Seeded KLEE with N vectors from AFL++` and `Seeded the fuzzer corpus with M vectors from KLEE`. +- **Default behaviour is unchanged** without `--seed-exchange`. +- Every mini-round is logged in `docs/reports/tacas-experiment-log.md`. + +## Review Focus + +- **A crash found by AFL++ must survive the queue replays.** Replays run in `replay/`, never in the phase directory. Pinned by integration test (2). +- **A run without `--debug` leaves no `*.seeds/` directory**, including when a phase errors out. Pinned by (3). +- **A queue entry whose replay hangs** is capped at 2 s. The `timeout` is covered by the code path; no dedicated test. +- **KLEE given seeds whose object sizes differ from its own** must not abort. The extension and truncation flags cover this, and it is exercised by (1). + +--- + +### Task 1: `seed_store.hpp` (pure) + unit tests + +**Files:** +- Create: `modules/frontend/utils/seed_store.hpp` and `tests/unit/frontend/SeedStoreTest.cpp`. +- Modify: `tests/unit/frontend/CMakeLists.txt`. + +**Produces:** +- `std::string Map2Check::seedStorePath(const std::string& cwd, const std::string& programHash)` returns `cwd + "/" + programHash + ".seeds"`. +- `std::vector Map2Check::selectQueueEntries(std::vector names, size_t cap)` keeps only names starting with `id:`, sorts them lexicographically (which is id order, because AFL++ zero-pads), and truncates to `cap`. +- `bool Map2Check::isNewVector(const std::vector& bytes, std::set>* seen)` returns false for an empty vector or one already in `seen`; otherwise it inserts the vector and returns true. + +- [ ] **Step 1:** Write the tests below in `SeedStoreTest.cpp`, and register it in CMake the same way as `SlicerTest` (`add_executable(SeedStoreTest SeedStoreTest.cpp)` + `map2check_test(SeedStoreTest)`). + +```cpp +#include + +#include +#include +#include + +#include "../../../modules/frontend/utils/seed_store.hpp" + +// Next to the scratch directory, not inside it: every hybrid phase recreates +// the scratch directory, and a store inside it never reached the next phase. +TEST(SeedStorePath, SitsBesideTheScratchDirectory) { + EXPECT_EQ(Map2Check::seedStorePath("/work", "abc.map2check"), + "/work/abc.map2check.seeds"); +} + +TEST(SelectQueueEntries, KeepsOnlyQueueEntriesInIdOrderUpToTheCap) { + const std::vector names = { + "id:000002,src:000000,time:9", ".state", "README.txt", + "id:000000,time:0,execs:0,orig:seed", "id:000001,src:000000,time:5"}; + const std::vector chosen = + Map2Check::selectQueueEntries(names, 2); + ASSERT_EQ(chosen.size(), 2u); + EXPECT_EQ(chosen[0], "id:000000,time:0,execs:0,orig:seed"); + EXPECT_EQ(chosen[1], "id:000001,src:000000,time:5"); +} + +TEST(IsNewVector, RejectsEmptyAndDuplicateVectors) { + std::set> seen; + EXPECT_FALSE(Map2Check::isNewVector({}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_FALSE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 3}, &seen)); +} +``` + +- [ ] **Step 2:** Run `ninja SeedStoreTest` in `build_aflpp_ut`. Expected: FAIL, header not found. +- [ ] **Step 3:** Implement the header: `#include `, namespace `Map2Check`, the three inline functions exactly as specified, and a doc comment on each. +- [ ] **Step 4:** Run the test binary. Expected: `[ PASSED ] 3 tests.`, and ctest 100%. +- [ ] **Step 5: Commit** `feat(tacasv3a): pure seed-store helpers`. + +### Task 2: Store, KLEE → AFL++, budget and cleanup + +**Files:** `modules/frontend/caller.hpp`, `modules/frontend/caller.cpp`, `modules/frontend/map2check.cpp`, `tests/integration/test_testcomp_regressions.sh` (section 11). + +**Produces:** +- The member `std::string seedStore;` (absolute), set in the `Caller` constructor from `seedStorePath(currentPath, programHash)`. +- The accessor `const std::string& seedStorePath() const`. + +- [ ] **Step 1: Failing tests.** In section 11 of the integration script: + - Replace the `n_off` check with: after the run without the flag, `ls -d "$WORK/seed"/*.seeds 2>/dev/null | wc -l` must be 0. + - Replace the `n_on` count with: after the `--seed-exchange --debug` run, count files in `"$WORK"/seed/*.seeds/afl/` whose names start with `klee-`. It must be > 0, and the log must contain `Seeded the fuzzer corpus with`. + - Add a run of the same program with `--seed-exchange` **without** `--debug`. Afterwards `ls -d "$WORK/seed"/*.seeds` must be empty (`ok "no seed store is left behind without --debug"`). + + Run the suite. Expected: the `*.seeds` checks FAIL, because the store does not exist yet. +- [ ] **Step 2: Implement.** + - Set `seedStore` in the constructor, right after `currentPath` is set. + - `exportKleeVectorsAsSeeds` writes to `seedStore + "/afl"` (`create_directories`). + - In the AFL++ branch, `inputDir` is `seedStore + "/afl"` when `seedExchange`, otherwise `"afl-in"`. The queue copy-back writes to `seedStore + "/afl/afl-" + name`. + - KLEE budget: `const double kleeShare = this->seedExchange ? 0.6 : 0.8;` replaces the literal `0.8`. + - Remove `exportFuzzerVectorAsKtest` and its `--seed-file` use. Task 3 replaces it. + - In `map2check.cpp`, keep the store path from the last `map2check_execution`: a file-scope `std::string lastSeedStore` assigned from `caller->seedStorePath()`. After the hybrid phase sequence in `main`, when `args.seedExchange && !args.debugMode`, call `std::filesystem::remove_all(lastSeedStore, ec)`. + - Remove `Caller::seedDirectory` if nothing else uses it. +- [ ] **Step 3:** Rebuild (after R15) and run the suite plus ctest. Expected: section 11 passes, and everything else is unchanged. +- [ ] **Step 4: Commit** `feat(tacasv3a): a seed store that survives the hybrid's phases`. + +### Task 3: AFL++ → KLEE by replay, and KLEE `--seed-dir` + +**Files:** `modules/frontend/caller.hpp`, `modules/frontend/caller.cpp`, `tests/integration/test_testcomp_regressions.sh`. + +**Produces:** `unsigned Caller::exportFuzzerCorpusAsKtests();` (private). It returns the number of `.ktest` files written. + +- [ ] **Step 1: Failing tests.** Add section 26, "seeds reach KLEE", and section 27, "a crash survives the replays": + - **26:** `seed.c` from section 11, run with `--seed-exchange --debug`. The log must contain `Seeded KLEE with N vectors from AFL++` with N > 0 (grep the number), and the KLEE command line (debug) must contain `--seed-dir=`. + - **27:** the program `int x = nondet(); if (x > 1000 && x < 1100) reach_error();` (AFL++ finds it quickly thanks to CmpLog/interesting values), run with `--seed-exchange --target-function --target-function-name reach_error --timeout 30`. It must report `VERIFICATION FAILED`. + + Run them. Expected: 26 FAILS (no such line); 27 passes (a regression guard; ledger it). +- [ ] **Step 2: Implement** `exportFuzzerCorpusAsKtests()`, called at the end of the AFL++ branch when `seedExchange && !isWitnessFileCreated()`: + - List `afl-out/default/queue`, then `selectQueueEntries(names, 64)`. + - For each entry: + - clear `replay/` (`remove_all` + `create_directories`); + - run `cd && timeout -k 1 2 /-witness-fuzzed.out < '' > /dev/null 2>&1`; + - read `readNonDetLogAsObjects(/klee_log.csv)`; + - skip it if the objects are empty or if `ktestToFuzzerBytes(objects)` is not new according to `isNewVector`; + - otherwise `writeKtestFile(/ktest/afl-.ktest, objects)`. + - Log `Seeded KLEE with N vectors from AFL++` when N > 0. +- [ ] **Step 3: KLEE flags.** In the KLEE branch, when `seedExchange` and `/ktest` holds any regular file, append ` --seed-dir=/ktest --allow-seed-extension --allow-seed-truncation --seed-time=s` where `seedFlag` used to go (both command variants). +- [ ] **Step 4:** Rebuild and run the suite plus ctest. Expected: 26 and 27 pass, and everything else is unchanged. +- [ ] **Step 5: Commit** `feat(tacasv3a): the fuzzer corpus reaches KLEE as typed seeds`. + +### Task 4: Mini-rounds + +- [ ] **R16, Test-Comp:** the R15 manifests (`r15-ce.tsv`, `r15-cb.tsv`), 300 s, `EXTRA_FLAGS=--seed-exchange` (GENERATOR hybrid). Compare against the R15 control arm (same tasks, same code without the exchange). Report coverage, N and M per task (grep the `Seeded` lines from raw logs, or run a sample with `--debug`), and the median time. +- [ ] **R17, SV-COMP:** MemSafety and NoOverflows from the R14 manifests, plus a ReachSafety sample (`build_corpus.py` has no reachsafety property; use `--property cover-error`'s task list with `--target-function` via `run_testcomp_evaluation.sh`'s verdict column, or skip ReachSafety and note it). 120 s, with and without `--seed-exchange`. Report correct and wrong answers per arm. +- [ ] **Log R16–R17** with comparisons, and commit. diff --git a/docs/superpowers/specs/2026-07-16-castle-benchmark-design.md b/docs/superpowers/specs/2026-07-16-castle-benchmark-design.md new file mode 100644 index 000000000..084fe4148 --- /dev/null +++ b/docs/superpowers/specs/2026-07-16-castle-benchmark-design.md @@ -0,0 +1,129 @@ +# CASTLE-Benchmark Integration for Map2Check + +**Design spec** | 2026-07-16 | Reference: TODO #8 (SBSeg 2026) + +## Goals + +- Run all 250 CASTLE C250 micro-benchmarks through Map2Check +- Report per-CWE detection results (TP/FP/TN/FN) for the paper +- Add 5 regression tests to CI to prevent future regressions + +## Non-goals + +- CASTLE Score calculation (done by CASTLE-Source separately) +- Tool wrappers for automated CASTLE scoring (out of scope) +- BenchExec XML (not needed for paper evaluation) + +--- + +## File Layout + +``` +tests/castle/ + CASTLE-Benchmark/ ← git submodule (pinned main) + run_castle_evaluation.sh ← standalone: compile → run → score → report + results/ + castle_results.csv ← per-test verdicts + castle_summary.txt ← paper-ready table + +tests/integration/ + test_castle_regression.sh ← 5 must-pass tests (CI) + +.github/workflows/ci.yml ← new job: castle-regression +``` + +### Dependencies + +- `clang-16` (LLVM bitcode compilation) +- `map2check` binary (in PATH or `MAP2CHECK_PATH`) +- KLEE runtime libraries (for symbolic execution) +- `python3` (JSON parsing, already available) +- Git submodule: `CASTLE-Benchmark/main` + +--- + +## Evaluation Script: `run_castle_evaluation.sh` + +### Phases + +1. **Setup**: Verify dependencies, ensure submodule is checked out +2. **Compile**: Each `CASTLE_C250/*.c` → `.bc` via `clang-16 -c -emit-llvm -g -O0` +3. **Verify**: Two-pass strategy per test: + - Pass 1: `map2check --timeout 60 <.bc>` → verdict + - Pass 2 (if UNKNOWN): retry with `--add-invariants` +4. **Score**: Compare verdict against `CASTLE-C250.min.json` ground truth +5. **Report**: Write `castle_results.csv` + `castle_summary.txt` + +### Mode Selection + +| CWE Group | CWEs | Map2Check Flags | +|-----------|------|----------------| +| Memory safety | 125, 415, 416, 476, 761, 787, 822, 843 | `--memtrack` | +| Overflow | 190 | `--check-overflow` | +| Memcleanup | 401 | `--memcleanup-property` | +| Assert | 134, 617 | `--check-asserts` | +| Reachability (other) | 253, 362, 369, 628, 674, 770, 835 | `--target-function --target-function-name main` | +| Out of scope | 22, 78, 89, 327, 522, 798 | `--target-function --target-function-name main` (marked N/A) | + +All modes use `--add-invariants` as UNKNOWN fallback in pass 2. + +### Classification + +| Verdict Substring | Ground Truth `vulnerable` | Line Match | Result | +|-------------------|--------------------------|------------|--------| +| `FALSE-DEREF`, `FALSE-FREE`, `FALSE-MEMTRACK`, `FALSE-OVERFLOW`, `FALSE-MEMCLEANUP` | `true` | Yes | **TP** | +| `FALSE-*` | `true` | No | **FP** (wrong line) | +| `FALSE-*` | `false` | -- | **FP** | +| `SUCCESSFUL` | `false` | -- | **TN** | +| `SUCCESSFUL` | `true` | -- | **FN** | +| `UNKNOWN`, timeout | any | -- | **UNKNOWN** | +| Out-of-scope CWE | any | -- | **N/A** | + +### Output + +**castle_results.csv:** +``` +id,cwe,name,vulnerable,mode,verdict,invariants,expected,result,time_sec +``` + +**castle_summary.txt:** Aggregate table per CWE + overall totals for paper. + +--- + +## Regression Tests: `test_castle_regression.sh` + +5 CASTLE tests compiled to LLVM bitcode, verified with `--memtrack`: + +| Test | CWE | Expected | +|------|-----|----------| +| CASTLE-476-5 | NULL deref (always-null return) | `VERIFICATION FAILED` | +| CASTLE-415-2 | Double free | `VERIFICATION FAILED` | +| CASTLE-476-8 | Safe NULL check | `VERIFICATION SUCCEEDED` | +| CASTLE-416-1 | Use-after-free | `VERIFICATION FAILED` | +| CASTLE-787-6 | Out-of-bounds array write | `VERIFICATION FAILED` | + +> Note: the original `CASTLE-476-1` (NULL deref via `malloc` failure) and +> `CASTLE-787-3` (`strcpy` stack overflow) were replaced because `--memtrack` +> cannot reach them: KLEE does not model `malloc` returning NULL, and the pass +> does not instrument libc `strcpy` internals. The replacements exercise the +> same CWEs (476 NULL deref, 787 out-of-bounds write) via code paths that the +> instrumentation actually covers. + +### CI Job: `castle-regression` + +- **Trigger**: push to `develop`, `feat-*`; PRs +- **Runtime**: ~5 min +- **Runs**: `tests/integration/test_castle_regression.sh` +- **Depends on**: `build-and-test` (needs compiled map2check binary) +- **Environment**: ubuntu-22.04, clang-16, no Docker needed + +--- + +## Implementation Order + +1. Add CASTLE-Benchmark git submodule +2. Write `tests/integration/test_castle_regression.sh` (5 tests) +3. Add `castle-regression` CI job +4. Verify CI passes +5. Write `tests/castle/run_castle_evaluation.sh` (full 250) +6. Run evaluation, collect results for paper diff --git a/docs/superpowers/specs/2026-08-12-castle-juliet-baseline.md b/docs/superpowers/specs/2026-08-12-castle-juliet-baseline.md new file mode 100644 index 000000000..d6578d6af --- /dev/null +++ b/docs/superpowers/specs/2026-08-12-castle-juliet-baseline.md @@ -0,0 +1,162 @@ +# Baseline CASTLE + Juliet — especificação de execução e análise + +**Data:** 2026-08-12 +**Branch:** `feat/castle-juliet-baseline` (a partir de `develop`) +**Status:** ⏳ Em progresso (harness validado, runs ainda não iniciados) + +--- + +## 1. Objetivo + +Estabelecer um **baseline empírico** do Map2Check sobre dois benchmarks completos — +**CASTLE C250** (250 micro-benchmarks rotulados, 25 CWEs) e **Juliet** (escopo C) — +para **identificar padrões de implementação** que possam ser melhorados de forma +incremental, **sem** os swaps estruturais previstos no plano de migração +(`docs/map2check_migration_plan.md`): AFL++, slicing (DG), KLEE 3.2. + +O entregável é um relatório `docs/baseline-castle-juliet-2026.md` com métricas +(TP/FP/TN/FN/UNKNOWN/TIMEOUT por CWE/modo) + um **backlog priorizado de fixes +incrementais** nos passes/runtime existentes. + +> Referência de contexto: `.opencode/Plano de desenvolvimento_Testcomp.md` (gaps +> G5–G7 de eficácia) e `docs/map2check_migration_plan.md` (Fases 2–3, adiadas). + +--- + +## 2. Decisões fechadas + +| Decisão | Valor | +|---|---| +| Branch | `feat/castle-juliet-baseline` (from `develop`) | +| Juliet escopo | **C**: CWEs 121, 122, 415, 416, 476, 761 (`--memtrack`), 190 (`--check-overflow`), 401 (`--memcleanup-property`) — **completo** (~17k arquivos `.c`) | +| Execução | **single-container sequencial** (map2check não é reentrante: escreve arquivos no CWD) | +| Paralelização | experimental (sharding + CWD separados), com fallback sequencial | +| `--add-invariants` | **não usar** (depende de `crabllvm`, não buildado) | +| Ground truth CASTLE | `CASTLE-C250.json` (`vulnerable`/`cwe`/`lines`) | +| Ground truth Juliet | variantes `bad` (espera FALSE) / `good` (espera TRUE) via `-DOMITGOOD`/`-DOMITBAD` | +| Timeouts | Juliet: outer 300s, inner `--timeout 60`; CASTLE: 360s/300s (script existente) | +| Resumibilidade | obrigatória (runs multi-dia, interrompíveis) | + +--- + +## 3. Achados técnicos (causas-raiz descobertas nesta sessão) + +Estes determinam o formato do harness. São também **candidatos de melhoria** por si só. + +### 3.1 Map2Check escreve artefatos no CWD (não é paralelizável sem isolamento) +`caller.cpp` + backend library escrevem, no diretório de trabalho: +`allocation_log.csv`, `heap_log.csv`, `list_log.csv`, `map2check_property`, +`map2check_checked_error`, `ExecutionOutput.log`, `clang.out`, +`{hash}-result.bc`, `{hash}-output.bc`, `{hash}-witness-result.bc`, +`{hash}-preprocessed.c`, `klee-out-*`/`klee-last`, e `../witness.graphml` +(só com `--generate-witness`). → Todo run em CWD isolado (`mktemp -d`). + +### 3.2 `main(int argc, char *argv[])` quebrava o wrapper KLEE ← BUG CORRIGIDO +`NonDetGeneratorKlee.c` declarava `int main() { return __map2check_main__(); }` +— chamava o `main` renomeado **sem argumentos**. Programas com `main(argc, argv)` +(Juliet inteiro, TestComp) disparavam `KLEE: ERROR: calling function with too few +arguments` → `completed paths = 0` → `VERIFICATION UNKNOWN` para todo programa +**seguro**. **Corrigido nesta branch** (`NonDetGeneratorKlee.c` + +`NonDetGeneratorLibFuzzy.c` passam `(argc, argv)`; `--add-invariants` sem efeito). +Cobertura: `tests/integration/test_main_argv.sh` (bad ⇒ FALSE, safe ⇒ TRUE), +executado no job `castle-regression` do CI. Sem workaround no harness (removido o `sed`). + +### 3.3 I/O do `testcasesupport/io.c` impede exaustão do KLEE ← LIMITAÇÃO +`printLine`/`printIntLine` (via `printf`), `srand(time(NULL))` e `rand() % 2` +viram chamadas externas → `partially completed paths = 1` → safe ⇒ `UNKNOWN` +em vez de `TRUE`. Workaround no harness: `juliet_stubs.c` (no-op nos `print*Line`, +`globalReturnsTrueOrFalse()` via `__VERIFIER_nondet_int()` para explorar ambos os +ramos). Validado: good ⇒ `VERIFICATION SUCCEEDED`, bad ⇒ `VERIFICATION FAILED`. + +### 3.4 Juliet é NIST cru, não sv-benchmarks +`test-comp2026/juliet/` é um clone local (gitignored, **não** versionado; o +submodule `sv-benchmarks` NÃO traz as tasks `Juliet_Test/`). O harness precisa +tratar `-DINCLUDEMAIN -DOMITBAD/-DOMITGOOD` e os variantes de arquivo. + +### 3.5 Modos têm motores distintos +`--memtrack` usa KLEE; `--memcleanup-property` usa **LibFuzzer**; `--check-overflow` +e `--check-asserts`/`--target-function` precisam de validação por CWE. Isso afeta a +interpretação por modo. + +### 3.7 `--add-invariants`/crabllvm não buildado ← tratado +Crab-LLVM (`cmake/FindCrabLlvm.cmake`, `seahorn/crab-llvm`) nunca foi ligado ao +CMakeLists moderno (dependência SeaHorn legada, incompatível com LLVM 16). O flag +`--add-invariants` chamava `bin/crabllvm/bin/crabllvm.py` inexistente e quebrava o +pipeline. **Tratado:** `map2check.cpp` agora detecta a ausência do binário e faz +fallback para compilação normal (warning), em vez de falhar. + +### 3.6 (já conhecido, de sessões anteriores) FNs/FPs de memtrack +- FN: NULL-deref via falha de `malloc` (KLEE não modela `malloc`→NULL). +- FN: `strcpy`/`memcpy` da libc não instrumentados (só `llvm.memcpy`). +- FP: `415-7`/`416-7` (swap-trick seguro → falso positivo de double-free/UAF). +- Bug latente: off-by-one em `is_valid_allocation_address`; TODO "static array" no `map2check_load`. +- FN: `scanf`/`getenv`/`argv` não simbólicos. + +--- + +## 4. Harness (arquivos versionados nesta branch) + +| Arquivo | Status | Papel | +|---|---|---| +| `tests/castle/run_castle_evaluation.sh` | ✅ existente (committed) | 250 CASTLE, 2-pass, score vs JSON | +| `test-comp2026/simulation/run_juliet_evaluation.sh` | ✅ **novo** (esta sessão) | Juliet escopo C, sequencial, resumível, CWD-isolado, linka stubs | +| `test-comp2026/simulation/juliet_stubs.c` | ✅ **novo** (esta sessão) | stubs de I/O + `globalReturnsTrueOrFalse` simbólico | +| `tests/integration/test_main_argv.sh` | ✅ **novo** (esta sessão) | regressão do fix `main(argc,argv)` | +| `test-comp2026/juliet` (submodule) | ✅ **novo** (esta sessão) | `arichardson/juliet-test-suite-c` pin `f88433e34` | +| `docs/baseline-castle-juliet-2026.md` | ⏳ a criar | relatório final + backlog | +| `analyze_results.py` | ⏳ a criar | consome CSVs → tabelas por CWE/modo + TP/FP/TN/FN | + +Build/install (gitignored): `build_castle_ci/`, `install_castle_ci/` +(`install_castle_ci/map2check` + symlinks KLEE runtime/clang). + +--- + +## 5. Validação (smoke test, confirmado) + +- CASTLE memtrack: `476-5` (NULL deref direto) ⇒ FALSE; `476-8` (safe) ⇒ TRUE. +- CASTLE memcleanup `401-1` ⇒ `FALSE-MEMCLEANUP` / `VERIFICATION FAILED`. +- Juliet `CWE476...int_01`: bad ⇒ `VERIFICATION FAILED`; good ⇒ `VERIFICATION SUCCEEDED` + (com stubs + normalização de `main`). +- Runner Juliet com `LIMIT=2`: CSV correto (good ⇒ `TRUE`/TN; bad CWE121-memcpy ⇒ + `UNKNOWN`, esperado — é a descoberta). + +--- + +## 6. Plano de execução + +- [x] 1. Branch `feat/castle-juliet-baseline` + submodule init. +- [x] 2. Build Map2Check + KLEE no Docker (`install_castle_ci`). +- [x] 3. Runner Juliet + stubs (validado). +- [ ] 4. Kick-off **CASTLE full** (250) — `run_castle_evaluation.sh`, background, resumível. +- [ ] 5. Kick-off **Juliet escopo C** (~17k → ~34k variantes) — background, resumível. +- [ ] 6. Experimento de paralelização (sharding + CWDs separados; fallback sequencial). +- [ ] 7. `analyze_results.py` + `docs/baseline-castle-juliet-2026.md` (relatório + backlog). + +--- + +## 7. Backlog preliminar de melhorias (incremental, sem trocar engine) + +1. ~~Wrapper KLEE `main(argc,argv)`~~ ✅ **corrigido** (`NonDetGeneratorKlee.c`/`NonDetGeneratorLibFuzzy.c`). +2. **Instrumentar funções de string libc** (`strcpy`/`memcpy`/`strcat`/`sprintf`) no `MemoryTrackPass`. +3. **Modelar `malloc`→NULL** (branch simbólico de falha) para CWE-476 via malloc. +4. **Corrigir FP swap-trick** (`415-7`/`416-7`) no tracking de aliasing de ponteiros. +5. **Fix off-by-one** em `is_valid_allocation_address`/`is_valid_heap_address`. +6. **Resolver TODO "static array"** no `map2check_load` (alloca de tamanho estático). +7. **Entradas não-simbólicas**: `scanf`/`getenv`/`argv` como fontes simbólicas. +8. (após medir) **modo reachability enxuto** (G5) — desligar memtrack/overflow em Cover-Error. + +Ordem real a definir **após** os dados (§6) — o relatório deve quantificar cada +padrão (quantos FN/FP/UNK cada causa responde) antes de priorizar. + +--- + +## 8. Estado multi-sessão + +- [x] Branch criada; build persistente em `install_castle_ci/` (gitignored). +- [x] Runner + stubs escritos e validados (ainda não commitados nesta sessão). +- [ ] Commits pendentes: `.gitignore`, runner, stubs, esta spec. +- [ ] Runs ainda NÃO iniciados (CASTLE e Juliet). + +**Para retomar:** `git checkout feat/castle-juliet-baseline`; confirmar +`install_castle_ci/map2check`; disparar runners em background com `nohup` + +`RESULTS_DIR` apontando para os diretórios gitignored; monitorar `run.log`. diff --git a/docs/superpowers/specs/2026-09-25-tacasv1-aflpp-migration-design.md b/docs/superpowers/specs/2026-09-25-tacasv1-aflpp-migration-design.md new file mode 100644 index 000000000..9714d883f --- /dev/null +++ b/docs/superpowers/specs/2026-09-25-tacasv1-aflpp-migration-design.md @@ -0,0 +1,261 @@ +# tacasv1 — Troca do LibFuzzer pelo AFL++ (modo persistente) + +**Data:** 2026-09-25 +**Branch:** `tacas/aflpp` (a partir de `develop`) +**Status:** ✅ Design aprovado — aguardando plano de implementação + +--- + +## 1. Objetivo + +Substituir **completamente** o LibFuzzer pelo **AFL++ 4.40c** como motor de fuzzing do +Map2Check, preservando o restante do pipeline (KLEE, smart seeding, slicing) byte a byte. +A medição da tacasv1 isola **apenas** a contribuição do motor de fuzzing, comparando +`tacas/aflpp` contra a baseline `v15` (= `develop`). + +O entregável é uma versão em que o `--nondet-generator afl` e o loop híbrido default +(fuzzer → KLEE → seed-exchange opcional) rodam AFL++ em modo persistente, com paridade de +semântica nondet e de veredito com a v15. + +> Linha de desenvolvimento: `decisions/tacas-afl-slicing-roadmap.md` (memória do projeto). +> Referências: `docs/map2check_migration_plan.md` (Fase 3), `docs/migration-schedule.md`. + +--- + +## 2. Decisões fechadas + +| Decisão | Valor | +|---|---| +| Branches das frentes | `tacas/aflpp`, `tacas/slicing`, `tacas/combined` (todas a partir de `develop`) | +| Numeração `tacasvN` | **global** (rodada de avaliação), não por braço | +| Ordem de construção | AFL++ (tacasv1) → slicing (tacasv2) → combined (tacasv3) | +| Escopo tacasv1 | **só a troca do fuzzer** — smart seeding fica exatamente como está | +| Versão AFL++ | **4.40c** (última da linha 4.x; ver §3) | +| Instrumentação | `afl-clang-fast` + `AFL_LLVM_INSTRUMENT=PCGUARD` (LLVM 16) + binário companheiro **CmpLog** (`AFL_LLVM_CMPLOG=1`, passado com `-c`) — ver §2.1 | +| Modo de execução | **persistente** (`__AFL_FUZZ_INIT` + `__AFL_LOOP`) | +| Paralelismo | **1 instância** `afl-fuzz` na tacasv1; `-M/-S` em PR subjacente posterior | +| Coordenador | **permanece no Caller C++** (não vira módulo Python/pybind11) | +| Política de nomes | **rename completo** — sem alias de transição | + +### 2.1 Adendo (2026-09-26): CmpLog na tacasv1 + +Decidido depois do smoke comparativo v15 × tacasv1 (11 programas mínimos, mesma +imagem). No modo só-fuzzer, o AFL++ só com PCGUARD achou 3 de 9 bugs, contra 7 de 9 +do LibFuzzer da v15, que roda com `-use_value_profile=1` (resolve comparações do tipo +`x == 123456`). Medir o AFL++ sem o equivalente dele distorceria a conclusão sobre o +motor. O CmpLog (input-to-state / RedQueen) é esse equivalente padrão no AFL++. + +- Terceiro binário `-cmplog.out`, compilado do mesmo `-result.bc` com + `AFL_LLVM_CMPLOG=1`, dentro do mesmo orçamento de compilação. +- Opcional: se não compilar, o fuzzer roda sem `-c` e o Caller avisa. +- O paralelismo continua em 1 instância; a diferença para os `-jobs=8` da v15 fica + registrada como limitação da comparação. + +**Consequência: o índice de leitura do gerador passa a ser zerado a cada iteração.** +Isso reverte a decisão de preservar o índice estático de `get_next_input_from_afl` +(que não voltava a zero entre iterações do `__AFL_LOOP`). Com ele, a mesma entrada é +lida de posições diferentes a cada execução persistente, e o input-to-state do CmpLog +não consegue mapear bytes → operandos. Medido no mesmo smoke (3 rodadas × 8 bugs, +modo só-fuzzer): + +| configuração | bugs achados | +|---|---| +| v15 LibFuzzer (value profile, 8 jobs) | 20/24 | +| AFL++ + CmpLog, índice preservado | 8/24 | +| AFL++ + CmpLog, índice zerado por iteração | 17/24 | + +(Rodada final, depois de remover o `-V` do `afl-fuzz` — ver abaixo. No modo híbrido +default, os vereditos ficaram idênticos à v15 nos 11 programas, todos corretos.) +O AFL++ ainda perde sistematicamente os bugs guardados por **faixa** estreita +(`5000 < x < 5100`, índice 51..59): o input-to-state do CmpLog propõe os operandos +exatos (os limites da faixa, que ficam fora dela). Ajustar o nível/transformações do +CmpLog (`-l`) fica como calibração para uma rodada posterior. + +**Orçamento sem `-V`.** O `afl-fuzz -V` compara leituras de `gettimeofday`. Um relógio +que volta (medido: 1,1 s em 20 s no WSL2) faz a diferença dar underflow e o AFL++ +encerra depois de poucas centenas de execuções. O fuzzer passa a ser limitado só pelo +`timeout` (temporizador relativo), como o LibFuzzer na v15. + +Sem o reset, o CmpLog não tem efeito. A correção fica restrita ao driver do AFL++ +(`NonDetGeneratorAFL.c`). O motor da v15 não é alterado, e o resto do smart seeding +continua fora do escopo (tacasv2/v3). + +--- + +## 3. Verificação da versão do AFL++ + +- `v4.40c` é real: publicada em **2026-03-13**, última release da linha 4.x (madura). + Existe `v5.03c` (2026-09-02), linha 5.x recém-saída — **não** adotada por + reprodutibilidade do paper e consistência com o mapeamento da literatura (FuSeBMC, + MEUZZ, Symbiotic usam 4.x). +- **Compatibilidade LLVM 16**: o `Dockerfile.dev` fixa `clang-16`/`llvm-16` + (apt.llvm.org). O `afl-clang-fast` da 4.40c compila o pass `afl-llvm-pass.so` contra o + LLVM presente no build; o modo **PCGUARD** (`-fsanitize-coverage=trace-pc-guard`) exige + LLVM ≥ 14 — satisfeito pelo LLVM 16. + +--- + +## 4. Escopo + +### Dentro (tacasv1) +- `cmake/FindAFLPlusPlus.cmake` novo; remoção de `cmake/FindLibFuzzer.cmake`. +- `NonDetGeneratorLibFuzzy.c` → `NonDetGeneratorAFL.c` (driver persistente). +- `Caller` (`caller.cpp`/`caller.hpp`): compilação (`applyNonDetGenerator`), execução + (`executeAnalysis`), link (`linkLLVM`) e enum. +- CLI: valor `--nondet-generator fuzzer` → `afl`. +- CMake root: `SKIP_LIB_FUZZER` → `SKIP_AFL_PLUS_PLUS`. +- `Dockerfile.dev`: seção de build do AFL++ 4.40c (pin de SHA). +- CI/release: `.github/workflows/{ci,release}.yml`, `scripts/{make-release,prepare-release}.sh`. +- Docs: `README.md`, `CLAUDE.md`, `CHANGELOG.md`, `TODO.md`, plano de migração (§3.2). + +### Fora (adiado) +- Revamp de smart seeding (laço alternado, ranking SDG, múltiplos `--seed-file`) — tacasv2/v3. +- Calibração do slicing (`--cutoff-diverging` etc.) — tacasv2. +- Paralelismo `-M/-S` do `afl-fuzz` — PR subjacente posterior. +- Coordenador como processo/módulo separado — descartado (fica no Caller C++). + +--- + +## 5. Build system + +- **`cmake/FindAFLPlusPlus.cmake`** novo, análogo ao `FindKlee.cmake`: localiza/instala + `afl-clang-fast`, `afl-fuzz`, `afl-cc` e expõe os caminhos. **Deleta** + `cmake/FindLibFuzzer.cmake`. +- **`CMakeLists.txt`** (root): `option(SKIP_LIB_FUZZER ...)` → + `option(SKIP_AFL_PLUS_PLUS ...)`; troca o `include(cmake/FindLibFuzzer.cmake)` pelo novo. +- **`modules/backend/library/lib/CMakeLists.txt`**: `NonDetGeneratorLibFuzzy` → + `NonDetGeneratorAFL` (continua compilado a `.bc` via `clang -c -emit-llvm`). +- **`Dockerfile.dev`**: nova seção (após KLEE, no padrão das seções KLEE/DG) que clona e + compila AFL++ **4.40c** com o toolchain LLVM 16, `ARG AFL_PLUS_PLUS_SHA` pinado, e + `ENV AFL_PATH`/`PATH` apontando para o install. Remove a nota "LibFuzzer sem install + extra" (§7 atual). +- **CI/release**: substituir `-DSKIP_LIB_FUZZER=ON` por `-DSKIP_AFL_PLUS_PLUS=ON` em + `.github/workflows/ci.yml`, `.github/workflows/release.yml`, `scripts/make-release.sh`, + `scripts/prepare-release.sh`, `make-unit-test.sh`. + +--- + +## 6. Runtime — nondet generator e Caller + +### 6.1 `NonDetGeneratorAFL.c` (substitui `NonDetGeneratorLibFuzzy.c`) +- Trampoline: + ```c + __AFL_FUZZ_INIT(); + int main(void) { + while (__AFL_LOOP(10000)) { + unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF; + int len = __AFL_FUZZ_TESTCASE_LEN; + set_global_input(buf, len); + __map2check_main__(0, NULL); + } + } + ``` +- `get_next_input_from_fuzzer()` / `get_bytes_from_fuzzer()` leem do buffer global + (preenchido por `__AFL_FUZZ_TESTCASE_BUF`), preservando o contrato de largura + `sizeof(type)` (o fix documentado em `NonDetGeneratorLibFuzzy.c`). +- `nondet_assume()`/`nondet_cancel()` → `longjmp` de volta ao trampoline (soft-reject: + descarta o input e passa para a próxima iteração, o equivalente persistente do + `pthread_exit` do LibFuzzer — **não** um crash). +- `NonDetLog.c` (gravação de `klee_log.csv`) fica **intocado** — a semântica do veredito + `cover-error` depende dele. + +### 6.2 `caller.cpp` — `applyNonDetGenerator()` (caso fuzzer) +Substituir as duas compilações: +``` +clang -g -fsanitize=fuzzer -fsanitize-coverage=inline-8bit-counters -O2 -o -fuzzed.out -result.bc +clang -g -fsanitize=fuzzer -o -witness-fuzzed.out -witness-result.bc +``` +por: +``` +afl-clang-fast -O2 -o -fuzzed.out -result.bc +afl-clang-fast -O2 -o -witness-fuzzed.out -witness-result.bc +``` +com `AFL_LLVM_INSTRUMENT=PCGUARD` exportado no ambiente (via `ENV` no `Dockerfile.dev`, +não inline no comando). Mantém o `timeout -k ` existente (o +orçamento de compilação continua valendo — é ele que evita estourar o budget em +programas grandes). + +### 6.3 `caller.cpp` — `executeAnalysis()` (caso fuzzer) +Substituir a execução +``` +./-fuzzed.out -jobs=8 -use_value_profile=1 [corpus] > fuzzer.output +``` +por: +``` +afl-fuzz -i seeds -o afl-out -V -- ./-fuzzed.out +``` +- O AFL++ **exige** diretório de entrada não vazio (diferente do LibFuzzer, que parte do + vazio). O Caller garante ao menos 1 seed: se `seeds/` estiver vazio, grava um arquivo + mínimo (1 byte) antes de invocar o `afl-fuzz`. +- `` deriva de `remainingSeconds()` (análogo ao `kleeBudget`: + `max(1, remainingSeconds() - 5)`), não de um literal. +- Crash-replay: varrer `afl-out/crashes/id:*` e re-executar cada um com + `./-witness-fuzzed.out ` (o `__AFL_FUZZ_INIT` em modo standalone lê + `argv[1]` como arquivo de entrada), substituindo o replay de `crash-*` do LibFuzzer. + +### 6.4 `caller.cpp` — `linkLLVM()` e enum +- `NonDetGeneratorLibFuzzy.bc` → `NonDetGeneratorAFL.bc`. +- Enum `NonDetGenerator::LibFuzzer` → `NonDetGenerator::AFLPlusPlus` + (`caller.hpp:21-46`, `caller.cpp` casos, `map2check.cpp` captura do + `--nondet-generator`). + +### 6.5 `map2check.cpp` — CLI e loop híbrido +- Valor `fuzzer` do `--nondet-generator` → `afl`. +- Loop híbrido em `main()` (`map2check.cpp:949-982`) **inalterado estruturalmente**: + fuzzer → KLEE → seed-exchange opcional. Só o passo fuzzer passa a rodar AFL++. + +--- + +## 7. Semântica de execução + +- **Budget**: `compileBudget` (compilação) inalterado; execução do `afl-fuzz` limitada + por `-V ` (AFL++ "run N seconds"), com o `timeout -k ` do + Caller como backstop. +- **Paralelismo**: 1 instância `afl-fuzz` na tacasv1. `-M master + -S slave` fica para + PR subjacente posterior (mapeia o `-jobs=8` antigo). +- **Contrato a preservar**: `klee_log.csv` continua gravando por iteração; o fluxo + fuzzer→KLEE de **1 vetor** (`readNonDetLogAsObjects` → `seeds/from-fuzzer.ktest` → + `--seed-file`) permanece exatamente como está. O swap não pode quebrar o veredito + `cover-error`. + +--- + +## 8. Riscos e mitigação + +| Risco | Mitigação | +|---|---| +| `afl-clang-fast` sobre o `-result.bc` **pré-linkado** pode não injetar cobertura (o pass do AFL roda no IR de entrada, mas o `.bc` é IR "pronto") | Smoke test (§9) confere se `afl-fuzz` **não** aborta com "no instrumentation". Fallback documentado: instrumentar na primeira compilação C→`.bc` com `afl-clang-fast` (`compileCFile()`), preservando o mesmo `.bc` para o KLEE. | +| `abort()` do slicing vs tratamento de crash do AFL | O `reach_error` instrumentado continua abortando (crash real, que o AFL registra); `nondet_assume` usa `longjmp` (soft-reject), não `abort`, então não polui `crashes/`. O replay com `-witness-fuzzed.out` confirma violação real antes do veredito. | +| `__AFL_LOOP` (persistente) acumular entradas em `klee_log.csv` ao longo das iterações | Comportamento já existente no LibFuzzer; `readNonDetLogAsObjects` usa o último vetor. Nenhuma mudança em tacasv1. | +| Atraso na primeira compilação do AFL++ no Docker (rebuild de imagem) | Build com cache por camada; SHA pinado para reprodutibilidade. | + +--- + +## 9. Teste e avaliação + +### Smoke test (bloqueante) +1. Compilar a imagem com AFL++ 4.40c; `map2check --nondet-generator afl ` em um + programa `reach_error` conhecido. +2. Confirmar: `afl-fuzz` instrumenta sem "no instrumentation"; acha o bug; emite veredito; + crash-replay com `-witness-fuzzed.out` confirma; `--seed-exchange` injeta o vetor no KLEE. + +### Unit / regressão +- `--nondet-generator afl` e o caminho híbrido default. +- `make-unit-test.sh` com `-DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON` (paridade com o antigo + `-DSKIP_LIB_FUZZER`). + +### Harness tacasv1 (pareado com v15) +- `cover-error` (1087 tarefas), `cover-branches`, Juliet, CASTLE; teste de McNemar para a + diferença de proporção de cobertas. + +--- + +## 10. Documentação + +- `README.md`, `CLAUDE.md`: trocar "LibFuzzer" por "AFL++" e `SKIP_LIB_FUZZER` por + `SKIP_AFL_PLUS_PLUS`. +- `CHANGELOG.md`: entrada da tacasv1. +- `TODO.md`: remover nota do `SKIP_LIB_FUZZER` self-fuzzing e marcar o fuzzing embarcado + como AFL++. +- `docs/map2check_migration_plan.md` §3.2: marcar que o Coordenador **permanece no Caller + C++** (não vira `modules/coordinator/` Python/pybind11); §3.1 concluído. diff --git a/docs/superpowers/specs/2026-09-26-tacasv2a-slicing-reach-assert-design.md b/docs/superpowers/specs/2026-09-26-tacasv2a-slicing-reach-assert-design.md new file mode 100644 index 000000000..73e66b7f0 --- /dev/null +++ b/docs/superpowers/specs/2026-09-26-tacasv2a-slicing-reach-assert-design.md @@ -0,0 +1,173 @@ +# tacasv2a — Slicing para reachability e assert que preserva a suíte de testes + +**Data:** 2026-09-26 +**Branch:** `tacas/slicing` (a partir de `tacas/aflpp`) +**Baseline:** tacasv1 (AFL++ 4.40c + CmpLog), mesmo motor com e sem `--slice` +**Status:** rascunho — aguardando revisão + +--- + +## 1. Objetivo + +Fazer o `--slice` deixar de **prejudicar** o Cover-Error e, se possível, ajudar. Na v15, o +braço com slice cobriu 412 tarefas contra 470 do controle (McNemar χ² = 36,10), com 57 +das 58 perdas em ECA. Esta etapa corrige a causa dessas perdas e estende o slicing ao +modo assert. É o primeiro sub-projeto da tacasv2 ("slicing por propriedade"); memória e +overflow ficam para 2b e 2c. + +> Linha de desenvolvimento: `decisions/tacas-afl-slicing-roadmap.md` (ai-memory). +> A tacasv2 parte da tacasv1 porque o AFL++ é a evolução decidida: nada é calibrado +> contra o LibFuzzer. + +--- + +## 2. Diagnóstico (medido em 2026-09-26) + +Amostra: 12 tarefas que a v15 cobria sem slice e perdia com slice (9 ECA, 3 de outras +famílias). Build tacasv1, orçamento de 300 s, TestCov 300 s, uma execução por braço. + +| braço | cobertas | +|---|---| +| controle (sem slice) | 11/12 | +| slice como está hoje | 6/12 | +| slice com `-cutoff-diverging=false` | 10/12 | +| slice sem cutoff + nondets como critério | 10/12 (e o único que cobre `floppy.i.cil-1`) | + +As duas tarefas que a última variante não cobriu terminaram perto do orçamento (~258 s). +Com uma execução por braço, não dá para separar isso de variação. + +**Depois da implementação** (2026-09-27, build final da `tacas/slicing`, mesma amostra e +orçamento, uma execução por braço): controle **12/12**, slice **12/12**. `floppy.i.cil-1` +dá FAILED + COVERED com slice. O slice terminou antes do controle em 5 das 9 tarefas ECA +(por exemplo, `Problem17_label55`: FAILED em 51 s, contra UNKNOWN em 137 s no controle). +São 12 tarefas: é validação de que os defeitos sumiram, não avaliação (§7). + +### Defeito 1 — o KLEE aborta em toda fatia com caminho cortado + +- O `--cutoff-diverging` (default `true` no dg/sbt-slicer) insere um bloco `diverge:` + com `call exit(0)` + `unreachable`. O `--help` diz "abort()", mas o código + (`dg/tools/llvm-slicer-preprocess.cpp`) chama `exit(0)`. +- Essas chamadas não têm localização de debug (`!dbg`), e o programa é compilado com `-g`. +- Quando o KLEE linka a uClibc, `exit` passa a ter corpo e o verificador rejeita o módulo: + `inlinable function call in a function with debug info must have a !dbg location` → + `LLVM ERROR: Broken module found`. O KLEE aborta (status 134) antes de executar. +- Em `eca-rers2012/Problem15_label09.c`, a fatia tem 60 blocos `diverge`. +- **Consequência:** no braço com slice da v15, o KLEE não rodou em nenhuma tarefa com + caminho cortado. Com o LibFuzzer, o `exit(0)` também encerrava a sessão de fuzzing. +- Com `-cutoff-diverging=false`, o KLEE da mesma tarefa roda até o fim (saída 0). + +### Defeito 2 — o vetor da fatia não vale no programa original + +- O slicer remove chamadas `__VERIFIER_nondet_*` cujo valor não afeta o critério. Em + `ntdrivers/floppy.i.cil-1.c`: 29 chamadas no programa, 10 na fatia. +- O vetor de entradas é gerado na fatia, mas o TestCov executa o **programa original**, + que consome mais valores e em outra ordem. O veredito sai FAILED e a suíte não cobre. +- Passar as funções nondet como critério **primário**, junto com o alvo, preserva as + chamadas alcançáveis: `floppy` passa a FAILED + COVERED. + +--- + +## 3. Decisões + +| Decisão | Valor | +|---|---| +| Cutoff | `-cutoff-diverging=false` | +| Critério em reachability | `` + todas as funções `__VERIFIER_nondet_*` conhecidas | +| Critério em assert | `__VERIFIER_assert` + as mesmas funções nondet | +| Onde fatiar | continua **antes** da instrumentação (`sliceWithRespectToTarget`, antes de `callPass`) | +| Stub da função alvo | mantém o stub `weak` atual | +| Visibilidade | `--statistics` no slicer; o Caller registra funções/blocos/instruções antes → depois | +| Outras flags (`--pta`, `--cda`, `--undefined-funs`) | defaults nesta etapa; calibrar só com medição própria | +| Cutoff "consertado" (manter o corte, corrigir `!dbg`, trocar `exit` por poda silenciosa) | fora; experimento condicional se a medição mostrar falta de eficiência de busca | + +A lista de funções nondet é fixa: as 16 que o `NonDetPass` instrumenta (`bool`, `char`, +`uchar`, `short`, `ushort`, `int`, `uint`, `unsigned`, `long`, `ulong`, `size_t`, +`loff_t`, `sector_t`, `pointer`, `pchar`, `double`) mais as do SV-COMP que ele ainda não +cobre (`float`, `longlong`, `ulonglong`, `_Bool`, `u8`, `u16`, `u32`, `charp`). O slicer +aceita nomes que não existem no programa. Isso foi verificado: não dá erro e não muda a +saída. Uma lista fixa dispensa desmontar o bitcode. + +--- + +## 4. Referência comparada: o que o Symbiotic faz + +Levantado no código do Symbiotic (master `4474bb9`), do sbt-slicer (`e350116`, o mesmo +SHA que o nosso Dockerfile fixa) e do dg. + +| Aspecto | Symbiotic | tacasv2a | Por quê | +|---|---|---|---| +| Fatia em Test-Comp (coverage-error/branches) | **Não** no pipeline principal | Sim, em Cover-Error | É onde o Map2Check usa o slicing; exige resolver o Defeito 2, que ele nunca enfrenta | +| `--cutoff-diverging` | Mantém (default) | Desliga | O KLEE dele reconhece violação por `-error-fn` e o módulo dele não quebra; o nosso quebra (Defeito 1) | +| Ponto do pipeline | Depois da instrumentação, com marcadores como critério | Antes da instrumentação | Para reach/assert o critério já existe no programa; os marcadores entram no 2b/2c | +| Contraexemplo | Reexecutado no programa sem slice (`-replay-nondets`) | Nondets preservados na fatia | Replay exigiria nomear cada nondet por call site; preservar é mais simples e resolve para Test-Comp | +| Flags extras | `-pta fi`, `-2c __VERIFIER_assume,klee_assume` (implícito) | Iguais por default | — | + +**O que é contribuição nossa:** slicing que **preserva a ordem de consumo das entradas**, de +modo que a suíte gerada na fatia continua válida no programa original. O Symbiotic não +precisa disso porque não gera suíte a partir da fatia. + +--- + +## 5. Mudanças + +### 5.1 `Caller::sliceWithRespectToTarget` (`modules/frontend/caller.cpp`) +- Recebe a lista de critérios em vez de só o nome da função alvo, e monta + `-c ,`. +- Acrescenta `-cutoff-diverging=false` e `--statistics`. +- Extrai do `slicer.output` as linhas `Statistics before/after` e registra + `Sliced with respect to X: F/B/I functions/blocks/instructions → F'/B'/I'`, mantendo + também os bytes. +- O restante (orçamento, fallback para o programa inteiro, stub `weak`) não muda. + +### 5.2 Gating em `map2check.cpp` +- `--slice` passa a valer também em `ASSERT_MODE`, com o critério `__VERIFIER_assert`. + Os demais modos continuam recusados com aviso, até o 2b e o 2c. + +### 5.3 Funções puras do slicing +- `modules/frontend/utils/slicer.hpp` (header-only, testável sem build completo): + `nondetFunctionNames()`, `slicingCriteria()`, `targetStubSource()` (o stub de + `__VERIFIER_assert` recebe `int cond`), `parseSlicerStatistics()` e `describeSlice()`. +- Em assert o critério primário é `__VERIFIER_assert,__assert_fail`: o `AssertPass` + instrumenta as duas. + +--- + +## 6. Testes + +Integração (`tests/integration/test_testcomp_regressions.sh`, seção de slicing): +1. **O KLEE sobrevive à fatia.** Um programa com ramos que não alcançam o alvo, rodado com + `--slice --nondet-generator symex`: sem `Broken module`, com FAILED. +2. **O vetor vale no original.** Um programa com um nondet irrelevante antes do relevante + (`int a = nondet(); int b = nondet(); if (b == 42) reach_error();`), rodado com + `--slice --generate-test-suite`: a suíte tem 2 entradas, na ordem do original. +3. **Assert fatia.** `--check-asserts --slice` registra `Sliced with respect to + __VERIFIER_assert` e mantém o veredito. +4. Os testes existentes de slicing ("degrade loudly", recusa em cover-branches) continuam. + +Unitário: se a extração das estatísticas virar função própria, um teste de parser sobre um +`slicer.output` fixo. + +--- + +## 7. Avaliação (tacasv2a) + +- **Quando:** depois do merge do PR #66 e desta branch, na execução sequencial combinada + com o usuário. +- **Como:** corpus de Cover-Error (1087 tarefas pareadas, `cover-error-q400.tsv`), dois + braços com o **mesmo build**: controle (sem slice) e `--slice`. Orçamento de 300 s, + 3 shards, como na v15. +- **Critério de sucesso:** o braço com slice **não perde** para o controle (McNemar sem + diferença significativa contra, ou a favor) e as perdas em ECA desaparecem. +- **Relato:** cobertas por família, perdas/ganhos pareados e estatísticas de redução + (instruções antes/depois). + +--- + +## 8. Riscos + +| Risco | Mitigação | +|---|---| +| Sem o cutoff, a fatia fica maior e o ganho de busca diminui | É o preço da correção. O cutoff "consertado" fica como experimento condicional (§3) | +| Preservar nondets puxa código que a fatia removeria | Medido no `floppy`: 8933 → 9155 linhas de IR (+2,5%). Acompanhar a redução na avaliação | +| Alguma função nondet fora da lista | A lista inclui as do SV-COMP; uma função ausente só reproduz o Defeito 2 naquela tarefa, e o teste 2 detecta o caso comum | +| Amostra de 12 tarefas | É diagnóstico, não avaliação; a conclusão vem da §7 | diff --git a/docs/superpowers/specs/2026-09-27-tacasv2b-slicing-memsafety-design.md b/docs/superpowers/specs/2026-09-27-tacasv2b-slicing-memsafety-design.md new file mode 100644 index 000000000..54640567a --- /dev/null +++ b/docs/superpowers/specs/2026-09-27-tacasv2b-slicing-memsafety-design.md @@ -0,0 +1,150 @@ +# tacasv2b — Slicing para memtrack e memcleanup + +**Data:** 2026-09-27 +**Branch:** `feat/tacas-slicing-mem` (a partir de `feat/tacas-slicing`, PR #68) +**Baseline:** tacasv1 (AFL++ 4.40c + CmpLog), mesmo build com e sem `--slice` +**Status:** rascunho — aguardando revisão +**Registro de rodadas:** `docs/reports/tacas-experiment-log.md` (R6 = sondagem deste design) + +--- + +## 1. Objetivo + +Estender o `--slice` para `--memtrack` e `--memcleanup-property` e medir o efeito em três +corpora: **MemSafety do SV-COMP** (programas grandes, onde o slicing tem o que cortar), +**CASTLE** e **Juliet** (os corpora já medidos na v15, programas pequenos). O critério de +sucesso é o slicing **não introduzir veredito errado** (FALSE espúrio ou TRUE errado) e, +onde houver o que cortar, reduzir o tempo ou aumentar os acertos. + +--- + +## 2. Abordagem escolhida: fatiar depois da instrumentação + +Na tacasv2a, o slicing roda antes da instrumentação porque o critério (`reach_error`, +`__VERIFIER_assert`) existe no programa do usuário. Para memória não há chamada no +programa que sirva de critério: o critério são os próprios acessos à memória, que só +ganham forma de chamada depois do `MemoryTrackPass`. + +Então, em `MEMTRACK_MODE` e `MEMCLEANUP_MODE`: +1. `callPass` instrumenta normalmente, gerando `-output.bc`. +2. **Novo:** o slicer roda sobre `-output.bc` com + - critério = **toda função `map2check_*`** chamada no módulo (as que o runtime do + memtrack recebe: `map2check_malloc`, `map2check_free`, `map2check_check_deref`, + `map2check_alloca`, `map2check_load`, `map2check_add_store_pointer`, …) **mais** as + `__VERIFIER_nondet_*` (lista fixa + IR, como na 2a); + - `--entry=__map2check_main__` (a instrumentação renomeia o `main` do usuário; o `main` + real vem do gerador nondet no link); + - `-cutoff-diverging=false --statistics` (os mesmos motivos da 2a). +3. `linkLLVM` segue igual, sobre o `-output.bc` fatiado. + +**Por que é seguro:** o problema registrado no código (fatiar depois da instrumentação +remove a instrumentação) acontecia com o critério `reach_error`: as chamadas que +**registram** a violação não influenciam o alcance do alvo e eram cortadas. Aqui toda +chamada do runtime é critério, então nenhuma é removida; o que sai é computação que não +alimenta nenhum acesso à memória, alocação ou leitura de entrada. + +**Sondagem (R6):** busybox `basename-2.i` 2985 → 2373 instruções (−20%); +memsafety-cve `admesh.i` −1,5%; o slicer falha em `llvm.stacksave` (VLA) e aí o Caller +já volta ao programa inteiro. + +**Rejeitadas:** marcadores no estilo Symbiotic antes da instrumentação (mais código, ganho +não medido) e A/B das duas (dobra o custo). Ficam como alternativa se a medição mostrar +fatias grandes demais. + +--- + +## 3. Mudanças + +### 3.1 `slicer.hpp` +- `runtimeNamesInIR(ir)`: todo símbolo `@map2check_[A-Za-z0-9_]+` no IR textual, na ordem + da primeira ocorrência, sem repetição (mesma forma de `nondetNamesInIR`). + +### 3.2 `Caller` +- `sliceInstrumented()`: fatia `-output.bc` no lugar. Desmonta com `opt -S`, + junta `runtimeNamesInIR` + `nondetNamesInIR` como critério, roda o slicer com + `--entry=__map2check_main__`, e em sucesso renomeia a fatia por cima do `-output.bc`. + Mesmo orçamento, mesmo fallback (programa inteiro com aviso) e mesma linha de log + (`describeSlice`, rótulo `map2check runtime`) da 2a. +- Sem stub `weak`: nenhuma função do programa é critério. +- Refatoração: o trecho comum com `sliceWithRespectToTarget` (desmontar, ler estatísticas, + orçamento, fallback) vira um helper privado, para as duas usarem o mesmo caminho. + +### 3.3 `map2check.cpp` +- `--slice` em `MEMTRACK_MODE`/`MEMCLEANUP_MODE` chama `sliceInstrumented()` **depois** de + `callPass` e **antes** de `linkLLVM`. Overflow continua recusado (2c); a mensagem passa a + "reachability, assert and memory properties". + +### 3.4 Harness de MemSafety do SV-COMP (novo) +- `build_corpus.py` ganha as propriedades `memsafety` (`valid-memsafety.prp`) e + `memcleanup` (`valid-memcleanup.prp`). Para essas, o manifesto carrega o **veredito + esperado e a subpropriedade** (`valid-deref`/`valid-free`/`valid-memtrack`), lidos do + `.yml`. +- Categorias por diretório, espelhando os `.set` do SV-COMP (os `.set` não vêm no + benchmark local): + +| categoria | diretórios | +|---|---| +| Arrays | `array-memsafety`, `array-memsafety-realloc` | +| Heap | `memsafety`, `memsafety-ext*`, `memsafety-broom`, `ldv-memsafety*`, `forester-heap`, `heap-manipulation` | +| LinkedLists | `list-simple`, `list-ext-properties`, `list-properties`, `ddv-machzwd` | +| Other | `busybox-1.22.0`, `coreutils-v8.31`, `coreutils-v9.5-units`, `memsafety-cve`, `uthash-2.0.2`, `goblint-regression`, `goblint-coreutils` | +| Juliet | `Juliet_Test` | +| MemCleanup | tarefas com `valid-memcleanup.prp` | + + Excluídos: `pthread*`, `weaver`, `termination-*` (o Map2Check não suporta threads nem + terminação; mediria zeros sem significado). +- `run_memsafety_evaluation.sh` (novo, no molde do `run_testcomp_evaluation.sh`: retomável, + por shard, `EXTRA_FLAGS`, `BUDGET`): roda `--memtrack` (ou `--memcleanup-property`) e + classifica cada tarefa em `correct-true`, `correct-false` (FALSE **com a subpropriedade + certa**), `wrong-true`, `wrong-false`, `unknown`, `error`. FALSE com subpropriedade + diferente conta como `wrong-false`. + +### 3.5 CASTLE e Juliet +- `run_castle_evaluation.sh` e `tests/juliet/run_juliet_evaluation.sh` passam a aceitar + `EXTRA_FLAGS` (acrescentado a `mode_flags`) e `RESULTS_DIR` já existente, para o braço + com `--slice`. + +--- + +## 4. Testes + +Integração (`test_testcomp_regressions.sh`): +1. **Memtrack com slice mantém a detecção:** programa com uso depois de `free` e código + irrelevante; `--memtrack --slice --nondet-generator symex` → `Sliced with respect to + map2check runtime` e FALSE-FREE/FALSE-DEREF como sem slice. +2. **Memcleanup com slice mantém o leak:** leak alcançado por leitura nondet → + FALSE-MEMCLEANUP com slice. +3. **Programa seguro não vira FALSE com slice** (mesma forma do 1, sem o bug). +4. **VLA:** programa com array de tamanho variável → aviso de fallback, veredito igual ao + sem slice. +5. A recusa em overflow continua (mensagem nova). + +Unitário: `runtimeNamesInIR` acha todo símbolo `@map2check_*` e deduplica. Não precisa +distinguir função de variável global: um nome sem call site é critério inofensivo (a 2a +verificou isso no código do dg). + +Harness: teste do classificador de veredito (tabela esperado × obtido × subpropriedade → +classe), no estilo de `tests/lib/verdict_classifier.sh`. + +--- + +## 5. Avaliação (mini-rodadas, cada uma registrada no log) + +- **R7:** CASTLE completo (250), tacasv1 com e sem `--slice`, 300 s. +- **R8:** amostra de MemSafety do SV-COMP (por categoria, cota pequena — p.ex. 10 por + categoria), com e sem `--slice`. +- **R9:** Juliet escopo C, amostra por CWE, com e sem `--slice`. +- Em cada uma: acertos, **erros (wrong-true/wrong-false)**, unknown, tempo mediano e + redução de instruções. Comparação explícita com a rodada anterior. +- A avaliação completa fica para a execução sequencial depois do merge. + +--- + +## 6. Riscos + +| Risco | Mitigação | +|---|---| +| Fatia remove algo que o runtime precisava → FALSE espúrio ou violação perdida | Todo `map2check_*` é critério; testes 1–3; wrong-* medido em R7–R9 | +| Slicer não suporta construções (VLA/`stacksave`, threads, `longjmp`) | Fallback já existente para o programa inteiro, com aviso; teste 4 | +| Redução pequena (R6: 1,5%–20%) → efeito nulo | Aceitável: o critério é não piorar; o ganho é medido, não presumido | +| Categorias por diretório divergem dos `.set` oficiais | Mapeamento documentado na §3.4; é amostra de diagnóstico | diff --git a/docs/superpowers/specs/2026-09-27-tacasv2c-slicing-overflow-design.md b/docs/superpowers/specs/2026-09-27-tacasv2c-slicing-overflow-design.md new file mode 100644 index 000000000..d731b99e3 --- /dev/null +++ b/docs/superpowers/specs/2026-09-27-tacasv2c-slicing-overflow-design.md @@ -0,0 +1,65 @@ +# tacasv2c — Slicing para overflow + +**Data:** 2026-09-27 +**Branch prevista:** `feat/tacas-slicing-overflow` (a partir de `feat/tacas-slicing-mem`) +**Baseline:** tacasv1, mesmo build com e sem `--slice` +**Status:** rascunho de estudo — aguardando revisão +**Registro:** `docs/reports/tacas-experiment-log.md` (R7 = sondagem deste design) + +--- + +## 1. Objetivo + +Estender o `--slice` para `--check-overflow`, fechando o slicing por propriedade da +tacasv2 (2a: reach/assert; 2b: memória; 2c: overflow). + +## 2. Estudo + +- **Como o overflow é instrumentado.** O `OverflowPass` troca cada operação aritmética + com sinal (add, sub, mul, sdiv, srem, shl…) por uma chamada de runtime + `map2check_binop_*` (`modules/backend/pass/OperationsFunctions.hpp`). Essas chamadas + recebem os operandos e registram a violação. +- **Consequência:** o critério de overflow é o mesmo do 2b, ou seja, toda chamada + `map2check_*` do módulo instrumentado mais as nondets. `Caller::sliceInstrumented()` + já faz exatamente isso. Nenhuma lógica de slicing nova é necessária. +- **O que o Symbiotic faz** (levantado na 2a): instrumenta as checagens de overflow e + fatia em relação à chamada de erro (`__VERIFIER_error`). O nosso critério é mais + conservador: fatiar em relação às próprias checagens mantém todas elas, e não só as + que já levam a erro. +- **Sondagem (R7):** busybox `chgrp-incomplete-2.i` 927 → 487 instruções (−47%); + bitvector −2%; nla-digbench −14%. Nos programas grandes, a redução é maior que a de + memória (R6: −20%). + +## 3. Mudanças + +1. **Gating** (`map2check.cpp`): `OVERFLOW_MODE` entra no gancho pós-`callPass` junto com + memtrack/memcleanup. A mensagem de recusa passa a citar só coverage. +2. **Harness:** `build_corpus.py` ganha `--property overflow` (`no-overflow.prp`), com + categorias por diretório espelhando o NoOverflows do SV-COMP: + - Main: `bitvector`, `nla-digbench-scaling`, `recursive-simple`, `loop-zilu`, + `signedintegeroverflow-regression`, `goblint-regression`; + - BusyBox: `busybox-1.22.0`; + - Juliet: `Juliet_Test`. + + Ficam excluídos `pthread*`, `weaver` e `termination-*`. + `run_memsafety_evaluation.sh` aceita `PROPERTY=overflow` (modo `--check-overflow`), + e o classificador mapeia a subpropriedade `no-overflow` para `FALSE-OVERFLOW`. +3. **Testes:** + - overflow com slice mantém o FALSE-OVERFLOW; + - programa sem overflow não vira FALSE; + - a recusa em cover-branches continua; + - linhas novas na tabela do classificador (`no-overflow`). + +## 4. Avaliação (mini-rodadas, registradas no log) + +- CASTLE CWE-190 (os 12 casos de overflow) e Juliet CWE-190, com e sem `--slice`. Os + runners já aceitam `EXTRA_FLAGS`. +- NoOverflows do SV-COMP: 10 por categoria, com e sem `--slice`. +- Métricas: acertos, **wrong-true e wrong-false** e redução de instruções. + +## 5. Riscos + +| Risco | Mitigação | +|---|---| +| Operação sem instrumentação (sem sinal, por exemplo) sai da fatia e deixa de alimentar uma checagem | O critério é a checagem; o dg mantém as dependências de dados de cada operando | +| Redução nula em programas pequenos (CASTLE/Juliet) | Critério de sucesso = não piorar; o ganho aparece no SV-COMP (R7) | diff --git a/docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md b/docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md new file mode 100644 index 000000000..7ef0a0c66 --- /dev/null +++ b/docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md @@ -0,0 +1,137 @@ +# tacasv3a — Smart seeds, parte 1: o encanamento da troca AFL++ ↔ KLEE + +**Data:** 2026-09-28 +**Branch:** `feat/tacas-smart-seeds` (a partir de `develop`, que já tem a tacasv2) +**Baseline:** tacasv2 com `--seed-exchange` desligado (o híbrido default) +**Status:** rascunho — aguardando revisão +**Linha:** `decisions/tacas-afl-slicing-roadmap.md` (ai-memory); Fase 3.3 do +`docs/migration-schedule.md`. Registro de rodadas: `docs/reports/tacas-experiment-log.md`. + +--- + +## 1. Objetivo + +Fazer a troca de sementes entre os motores **acontecer de verdade** e medir o efeito. A +v15 mediu "sem ganho" com o `--seed-exchange`, mas, como a seção 2 mostra, as sementes +praticamente nunca chegavam ao outro motor. Esta etapa conserta o encanamento; o laço +alternado com detecção de estagnação (3b) e a priorização das sementes (3c) vêm depois, +cada uma com spec e medição próprios. + +**Métrica de sucesso** (decidida com o usuário): Test-Comp — tarefas cobertas no +Cover-Error e cobertura média no Cover-Branches — **e** vereditos de propriedades do +SV-COMP (MemSafety, NoOverflows, ReachSafety), sempre contra a tacasv2 sem a troca, no +mesmo corpus e no mesmo build. + +--- + +## 2. Diagnóstico do `--seed-exchange` atual + +| # | Defeito | Onde | +|---|---|---| +| 1 | As sementes não atravessam fases: cada fase cria um `Caller` que apaga o diretório de trabalho, e `seeds/` mora dentro dele | `Caller::Caller` (`rm -rf `), `Caller::seedDirectory` | +| 2 | Fuzzer → KLEE lê o `klee_log.csv` do diretório **atual**, que acabou de ser recriado vazio; e mandaria um vetor só | `exportFuzzerVectorAsKtest` | +| 3 | O corpus do AFL++ nunca chega ao KLEE, embora o KLEE aceite um diretório de sementes | idem | +| 4 | A terceira fase (KLEE → AFL++) quase não roda: o KLEE usa até 0,8× o orçamento e sobram segundos | `map2check.cpp` (fase 3) e orçamentos em `executeAnalysis` | + +--- + +## 3. Design + +### 3.1 Armazém de sementes persistente + +- Diretório `/.seeds/`, **ao lado** do diretório de trabalho (não dentro + dele), criado na primeira fase e reaproveitado pelas seguintes: + - `afl/` — entradas para o `-i` do AFL++ (vetores do KLEE convertidos em bytes, mais o + corpus que o próprio AFL++ descobriu); + - `ktest/` — sementes para o `--seed-dir` do KLEE; + - `replay/` — diretório isolado onde as entradas do AFL++ são reexecutadas. +- Removido pelo `main` depois da última fase, salvo em `--debug`. +- Só existe com `--seed-exchange`. Sem a flag, nada muda em relação à tacasv2. + +### 3.2 Fuzzer → KLEE: conversão por replay + +Ao fim da fase AFL++ (sem violação encontrada): + +1. Para cada entrada de `afl-out/default/queue/` (em ordem de id, até **64**): + - roda o binário de witness **dentro de `replay/`**, com a entrada no stdin e teto de + 2 s. Em `replay/` os arquivos que o runtime grava (`map2check_property`, + `klee_log.csv`, …) não tocam o diretório da fase — um replay não pode sobrescrever + uma violação já registrada; + - lê o `replay/klee_log.csv` com `readNonDetLogAsObjects` e grava + `ktest/afl-.ktest` com `writeKtestFile`; apaga o log antes da próxima entrada; + - descarta vetores vazios e duplicados (mesmos bytes). +2. Registra `Seeded KLEE with N vectors from AFL++`. + +Na fase KLEE, com `ktest/` não vazio: +`--seed-dir=/ktest --allow-seed-extension --allow-seed-truncation --seed-time=<¼ do orçamento do KLEE>`. +O `--seed-time` impede que reproduzir sementes consuma a fase inteira. + +### 3.3 KLEE → fuzzer + +- `exportKleeVectorsAsSeeds` passa a gravar em `/afl/` (hoje grava em `seeds/`, + que é apagado). A fase AFL++ usa `/afl/` como `-i`. +- A cópia do corpus do AFL++ de volta ao armazém (hoje em `seeds/`) passa a gravar em + `/afl/`. + +### 3.4 Orçamento com a troca ligada + +- AFL++ **0,2**, KLEE **0,6**, AFL++ **0,2** do orçamento (hoje 0,2 / até 0,8 / o que sobrar). +- Sem `--seed-exchange`: inalterado (0,2 / 0,8), para a tacasv2 continuar medindo o mesmo. + +### 3.5 O que fica igual + +- O default continua **sem** troca. Promover a troca a default é decisão para depois da + medição. +- Nenhuma mudança nos motores, na instrumentação ou no slicing. + +--- + +## 4. Referência comparada + +| Aspecto | FuSeBMC v4 | tacasv3a | Por quê | +|---|---|---|---| +| Direção | fuzzer ↔ BMC, alternado | AFL++ → KLEE → AFL++ | O laço alternado é o 3b | +| Formato | seeds do fuzzer usados pelo BMC via "smart seeds" | replay no binário de witness para obter o vetor tipado | O KLEE precisa de um objeto por leitura nondet; o runtime já registra os tipos | +| Priorização | por cobertura | ordem de id, teto 64 | Ranking é o 3c | + +--- + +## 5. Testes + +Integração (`test_testcomp_regressions.sh`, seção de seed exchange): + +1. **As sementes atravessam fases.** Programa em que o AFL++ acha caminhos e o KLEE + resolve uma guarda (a mesma `seed.c` da seção 11): com `--seed-exchange --debug`, o log + tem `Seeded KLEE with N vectors from AFL++` com N > 0 **e** + `Seeded the fuzzer corpus with M vectors from KLEE` com M > 0, e o armazém `.seeds/` + existe ao lado do diretório de trabalho. +2. **O replay não sobrescreve uma violação.** Programa em que o próprio AFL++ acha o bug: + com `--seed-exchange`, o veredito continua FAILED. +3. **Sem `--debug`, nada fica para trás.** Depois do run, não existe `*.seeds/` no diretório. +4. **Sem a flag, nada muda.** Nenhum `*.seeds/` e nenhuma linha `Seeded` (atualiza a + seção 11, que hoje olha `seeds/` dentro do diretório de trabalho). + +Unitário: a lógica pura — seleção das entradas da fila (ordem, teto, deduplicação por +bytes) e o nome do armazém — em funções testáveis sem os motores. + +--- + +## 6. Avaliação (mini-rodadas, registradas no log) + +- **Test-Comp:** o manifesto da R15 (Cover-Error 213, Cover-Branches 120), 300 s, braço + `--seed-exchange` contra o controle da R15 (mesmo build, sem a troca). +- **SV-COMP:** amostras de MemSafety e NoOverflows da R14 (e uma de ReachSafety, com o + mesmo `build_corpus.py`), com e sem `--seed-exchange`, 120 s. +- Métricas: tarefas cobertas e cobertura de ramos; corretos, **wrong-true/wrong-false**; + N e M (sementes trocadas por tarefa) para confirmar que a troca aconteceu. + +--- + +## 7. Riscos + +| Risco | Mitigação | +|---|---| +| Replay de 64 entradas custa tempo | Teto de 2 s por entrada; binário já compilado; medir o custo por tarefa | +| Semente do AFL++ com vetor que não corresponde aos objetos do KLEE (tamanho/ordem) | `--allow-seed-extension/--allow-seed-truncation`; o vetor vem do mesmo runtime que o KLEE usa | +| KLEE gasta a fase reproduzindo sementes | `--seed-time` = ¼ do orçamento do KLEE | +| Mudar o orçamento (0,2/0,6/0,2) muda o efeito junto com a troca | Só com `--seed-exchange`; a medição compara contra o controle 0,2/0,8, e o efeito é o do pacote | diff --git a/docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md b/docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md new file mode 100644 index 000000000..67fa73dbe --- /dev/null +++ b/docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md @@ -0,0 +1,103 @@ +# tacas 2d — otimizações do slicing (design) + +**Data:** 2026-09-29 · **Branch:** `feat/tacas-2d-slicing` (a partir de `feat/tacas-smart-seeds`) +**Aprovação:** o usuário delegou as decisões ("você tem permissão para fazer as decisões +que quiser") e pediu as abordagens recomendadas no brainstorming de 2026-09-29. + +## Objetivo + +Hoje o `--slice` só empata com o controle: 126 × 129 cobertas na R15 Cover-Error. Além +disso, ele tem 4 ERROR próprios (ECA). O objetivo é que ele passe a ganhar, sem nenhum +TRUE errado. + +## Evidência que orienta o desenho + +- **Os 4 ERROR de ECA** (`Problem08_label51`, `Problem102_label34`, `Problem102_label02`, + `Problem103_label44`) seguem o mesmo roteiro: + - o `sbt-slicer` estoura seu limite (0,2T = 60 s) na fase 1; + - a fase 2 recria o `Caller` e **tenta fatiar de novo**, perdendo mais 60 s; + - o processo passa do orçamento e o harness o mata aos 330 s, sem suíte. +- **Cada fase refatia do zero.** Numa tarefa em que o slicer funciona, isso custa o tempo + do slicer uma vez por fase (2× no híbrido, 3× com `--seed-exchange`). +- **O dg deixa blocos vazios e funções mortas no `.bc` fatiado.** Nenhuma limpeza roda + depois da fatia. + +## Desenho + +### 1. Fatiar uma vez por execução (cache do slice) + +- **Onde fica:** um diretório `/.slice/` ao lado do scratch, no mesmo + esquema do store de sementes, porque o scratch é recriado a cada fase. +- **Chave:** um hash (FNV-1a 64 bits, em hex) do **conteúdo do `.bc` de entrada**, somado + ao rótulo dos critérios, à função de entrada e às flags extras do slicer. Chavear pelo + conteúdo, e não pelo número da fase, garante que só se reaproveita a fatia de uma + entrada idêntica. +- **O que se guarda:** + - `.bc`: a fatia pronta, depois da limpeza (item 2); + - `.failed`: marca que o slicer falhou ou estourou o tempo. Com ela, as fases + seguintes vão direto para o programa inteiro, sem gastar o slicer de novo. +- **Consulta:** acontece em `Caller::runSlicer`. + - Um acerto copia a fatia e registra "reusing the slice from an earlier phase". + - Uma falha registrada devolve `false` com o aviso de sempre, acrescido de "(cached)". +- **Ciclo de vida:** o mesmo do store. + - O diretório é apagado no início da execução (fase ≤ 1). + - O guarda de escopo de `main` o remove no fim, exceto com `--debug`. + - O guarda passa a cuidar dos dois diretórios, o de sementes e o de slice. + - Só existe com `--slice`. + +### 2. Limpeza depois da fatia (experimental) + +- **Knob de ambiente:** `MAP2CHECK_SLICE_CLEANUP`, com os valores: + - `none` (padrão até a medição); + - `light`: `opt -passes='function(simplifycfg,dce),globaldce'`; + - `o2`: `opt -O2`. +- **Onde roda:** dentro de `runSlicer`, depois de uma fatia bem-sucedida e antes de ela + entrar no cache. +- **Se o `opt` falhar,** a fatia fica sem limpeza e a execução avisa. +- **Risco do `o2`:** ele explora comportamento indefinido e pode apagar laços sem efeito + colateral. Isso muda a alcançabilidade. Por isso é só um braço de experimento, e o + gate de TRUE errado = 0 decide. +- **Depois da medição,** o vencedor vira o padrão (commit separado). + +### 3. Parâmetros do dg (experimental) + +- **Knob de ambiente:** `MAP2CHECK_SLICER_FLAGS`, anexado sem alteração à linha do + `sbt-slicer`. Os braços medidos são `--cda=ntscd` e `--pta=fs`. +- **Entra na chave do cache.** +- **Depois da medição,** o vencedor vira o padrão (commit separado). + +### Fora do escopo + +- **Cutoff-diverging consertado:** risco alto (é a causa do "Broken module"). Só entra + se 1–3 não fecharem a diferença. +- **Cache dos demais artefatos** (binário do AFL++, `.bc` do KLEE): compilar e instrumentar + custa segundos. Fica para o 3b, se as rodadas extras mostrarem esse custo. + +## Testes + +- **Unitários** (`SlicerTest.cpp`), sobre `sliceCacheKey`: + - é determinística; + - muda com o conteúdo, com o rótulo, com a entrada e com as flags. +- **Integração, seção nova:** + - o programa VLA da seção 20, rodado no híbrido com `--slice`, mostra o aviso de falha + do slicer uma vez por "slicer run" (debug) e depois "(cached)"; + - um programa fatiável roda o `sbt-slicer` uma vez só e as fases seguintes registram + "reusing the slice". +- **Suíte existente:** 40/40, e ctest. + +## Medição: rodada R19, amostra `r15-ce.tsv`, 300 s + +A mesma rodada R19 mede também o 3b; ver o spec do 3b. + +| braço | build | flags / env | +|---|---|---| +| controle | final | — | +| slice | final | `--slice` | +| slice-light | final | `--slice`, `MAP2CHECK_SLICE_CLEANUP=light` | +| slice-o2 | final | `--slice`, `MAP2CHECK_SLICE_CLEANUP=o2` | +| slice-ntscd | final | `--slice`, `MAP2CHECK_SLICER_FLAGS=--cda=ntscd` | +| slice-ptafs | final | `--slice`, `MAP2CHECK_SLICER_FLAGS=--pta=fs` | + +- **Gate:** TRUE errado = 0 em todo braço promovido. +- **Critério de promoção:** mais cobertas que o `slice` puro, com pares discordantes a + favor. diff --git a/docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md b/docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md new file mode 100644 index 000000000..bfaae49e2 --- /dev/null +++ b/docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md @@ -0,0 +1,150 @@ +# tacas 3b — alternância de engines com detecção de estagnação (design) + +**Data:** 2026-09-29 +**Branch:** `feat/tacas-3b-alternation`, a partir de `feat/tacas-2d-slicing` +**Aprovação:** o usuário delegou as decisões e pediu a abordagem recomendada no +brainstorming de 2026-09-29, a opção A: sinais nativos de estagnação com polling. + +## Objetivo + +Hoje o híbrido com `--seed-exchange` reparte o orçamento de forma fixa: +- AFL++ com 0,2T; +- KLEE com 0,6T; +- AFL++ com 0,2T. + +Isso tem dois custos: +- uma engine estagnada segura o orçamento até o fim da sua cota; +- uma engine que ainda progride é cortada no meio. + +O 3b troca de engine **quando a atual estagna**, em rodadas, até: +- achar a violação; +- provar a propriedade; +- acabar o tempo. + +## Desenho + +### Laço de rodadas (em `main`) + +A flag nova é `--alternate-engines`. Ela implica `--seed-exchange` e só vale no híbrido. +O laço alterna AFL++ e KLEE, começando pelo AFL++, com `args.phase = 1, 2, 3, …`: + +``` +janela(engine, rodada r) = min(restante, base(engine) * 2^(r-1)) + base(AFL++) = 0,1T base(KLEE) = 0,3T +para cada fase: + roda a engine com teto = janela e parada por estagnação (abaixo) + pára o laço se: violação | provedSafe | restante < max(10 s, 0,05T) +``` + +**Por que as janelas dobram:** a mesma engine volta com mais tempo quando a alternância +não resolveu. Uma engine que estagna cedo devolve o tempo que sobrou na hora. + +**Quem alimenta o KLEE:** toda fase AFL++ seguida de uma fase KLEE alimenta o KLEE +(`feedsKleePhase`). O corte é que, se o que resta não comporta outra fase, ela não +alimenta. + +**O que o KLEE recebe de semente:** +- o corpus do AFL++, como hoje; +- os `.ktest` da rodada KLEE anterior. Assim o KLEE reconstrói depressa a fronteira + que já tinha alcançado, em vez de redescobri-la. + +**O que o AFL++ recebe:** o `store/afl` já acumula a fila do AFL++ e os vetores do KLEE, +então nada muda. + +**Seleção das entradas da fila (`selectQueueEntries`):** passa a **pular as sementes com +que o fuzzer começou** (entradas `,orig:`): são vetores do KLEE ou de rodadas anteriores, +que o KLEE já tem. O `store/ktest` é limpo a cada exportação, porque os `.ktest` da rodada +KLEE anterior (`kleeprev/`) carregam o que ela já explorou. (A primeira versão deste spec +previa um `store/exported.txt`; o efeito é o mesmo com menos estado.) + +**Sem limite na troca KLEE → AFL++:** todos os vetores do KLEE vão para o fuzzer. +Completados com zeros depois do fim, alguns caminhos parciais do KLEE chegam ao erro no +dry run do AFL++, e é assim que o híbrido fixo cobre tarefas eca-* que o próprio KLEE deixa +UNKNOWN. Uma primeira versão limitava a exportação aos 64 vetores mais recentes (e o corpus +a 256). Isso custou 5 tarefas eca-* na R19 e foi removido. A calibração ficou barata depois +que o gerador do AFL++ passou a devolver zeros no fim da entrada. + +**Binários do AFL++ compilados uma vez por execução** (cache `.build/`, chaveado +pelo conteúdo dos módulos): em eca-* cada fase do fuzzer gastava ~24 s recompilando. + +**Paciência do AFL++ também dobra por rodada:** com o corte fixo de 15 s, os turnos do +fuzzer em eca-* acabavam em ~17 s, onde o híbrido fixo dava 60 s. + +### Estagnação + +- **AFL++:** `AFL_EXIT_ON_TIME=S`. O próprio fuzzer sai com 0 quando passa S segundos sem + cobertura nova. O `timeout` externo continua sendo o teto da janela. +- **KLEE:** o frontend lança o KLEE em uma thread (`system`, como hoje, com o PID do + `timeout` gravado em `klee.pid`) e faz polling do `klee-out-0/run.stats` a cada 2 s, + lendo `CoveredInstructions` da última linha pela API do SQLite, em modo somente leitura. + - Se o valor fica S segundos sem subir, o frontend manda SIGINT ao `timeout`, que o + repassa ao KLEE. + - O KLEE para de forma limpa: grava os testes dos estados que já terminaram. + - A fase é marcada como **incompleta** (`gotTimeout`). A execução nunca vira TRUE + por isso. +- **Valor de S:** `max(10 s, 0,05T)`, que dá 15 s em T = 300, para o AFL++. Para o KLEE, + S dobra a cada rodada dele: a cobertura de instruções para de subir bem antes de o KLEE + terminar os caminhos que formam uma prova, e um corte fixo nunca o deixaria chegar lá. +- **Sem SQLite:** o SQLite é uma dependência opcional, via `find_package(SQLite3)`. Sem + ele, a estagnação do KLEE fica desligada e vale só o teto da janela. O CI, que não + instala `libsqlite3-dev`, continua compilando. + +### Correção necessária: numeração da suíte + +`TestSuiteWriter` numera os casos a partir de 1 em cada fase (`testcase-1.xml`, …). Com +mais de uma fase KLEE em Cover-Branches, **uma rodada sobrescreveria a anterior**. O +contador passa a começar depois do maior `testcase-N.xml` que já existir no diretório. + +### Revisão (2026-09-29), incorporada + +- **Orçamento:** cada fase mede o próprio tempo de preparação (compilar, instrumentar, + linkar), que nenhuma janela conta. Uma fase só começa se sobrar `S + preparação`, e a + janela desconta a preparação. O AFL++ guarda 5 s de reserva, como o KLEE. +- **SIGINT:** vai direto ao PID do KLEE, filho do `timeout`. Mandado ao `timeout`, ele + repassava ao filho e ao grupo, o KLEE recebia dois sinais e perdia o despejo dos estados + vivos. +- **Suíte de Cover-Branches:** o limite de 50 casos vale para a suíte, não para cada fase, + e vetores repetidos entre fases são pulados. A suíte começa vazia a cada execução, o que + evita somar casos de uma execução anterior no mesmo diretório. +- **Flag:** sem `--timeout`, ou com `--nondet-generator`, `--alternate-engines` avisa e + não se aplica. + +## Fora do escopo + +- **Transformar o corpus do AFL++ em casos de teste de Cover-Branches.** Hoje a suíte de + CB sai só dos `.ktest` do KLEE. É um bom candidato, porque o replay tipado já existe, + mas é uma mudança de outra natureza e fica para depois. +- **Priorização das sementes (3c).** + +## Testes + +- **Unitários:** + - `SeedStoreTest`: a seleção pula nomes já exportados; + - `alternationWindow(engine, rodada, T, restante)`: janelas dobram e respeitam o + restante; + - `stagnationSeconds(T)`; + - `TestSuiteWriter`: o contador continua a partir de um diretório existente. +- **Integração, seções novas:** + - **Várias fases numa execução só:** um programa em que o AFL++ estagna (guarda de + igualdade de 32 bits que o CmpLog não resolve), rodado com `--alternate-engines`, + registra mais de uma fase e termina dentro do orçamento, sem TRUE. + - **Numeração da suíte:** um diretório com `testcase-1.xml` recebe o próximo caso como + `testcase-2.xml`. + - **Estagnação do KLEE:** um programa com laço infinito de estados, a 60 s, mostra o + aviso "KLEE stagnated" antes do teto e o veredito não é TRUE. + +## Medição (R19, a mesma rodada do 2d) + +Braços a comparar, todos com o build final: + +| braço | flags | +|---|---| +| controle | — | +| seeds | `--seed-exchange` | +| alternate | `--alternate-engines` | + +- **Amostras:** Cover-Error em `r15-ce.tsv`; Cover-Branches em `r15-cb.tsv` (seeds e + alternate). +- **Gate:** TRUE errado = 0. +- **Critério de promoção:** mais tarefas cobertas que seeds em Cover-Error e cobertura + média de CB não pior. diff --git a/docs/superpowers/specs/2026-09-29-tacas-3c-seed-ranking-design.md b/docs/superpowers/specs/2026-09-29-tacas-3c-seed-ranking-design.md new file mode 100644 index 000000000..f7741590b --- /dev/null +++ b/docs/superpowers/specs/2026-09-29-tacas-3c-seed-ranking-design.md @@ -0,0 +1,34 @@ +# tacas 3c — priorização de sementes, v1 (design) + +**Data:** 2026-09-29 +**Branch:** `feat/tacas-3c-seed-ranking`, a partir de `feat/tacas-memtrack-intrinsics` +**Aprovação:** decisões delegadas pelo usuário em 2026-09-29. + +## Problema + +O KLEE recebe no máximo 64 entradas da fila do AFL++ (`kMaxSeedsFromFuzzer`), escolhidas +pelas mais antigas por id. Quando a fila passa de 64, o que era novo no fim do fuzzing fica +de fora, e esse é justamente o caso dos programas maiores. + +## v1 (esta branch) + +- O AFL++ 4.40c marca com `,+cov` as entradas que alcançaram **arestas novas**. As demais só + mudaram as contagens de execução de arestas já vistas. Medido: 2 de 18 entradas numa fila + de 20 s. Não existe `.state/redundant_edges` nesta versão. +- `selectQueueEntries` põe as `+cov` primeiro, em ordem de id, depois as outras, também em + ordem de id, e então corta no limite. +- Teste unitário: `SelectQueueEntries.PutsNewCoverageFirst`. + +## Próximos passos (v2, fora desta branch) + +- **Distância ao alvo** (Cover-Error): priorizar sementes cujo replay passa por blocos mais + próximos de `reach_error` no CFG/SDG. O dg do slicing já tem o grafo. Exige um traço de + blocos no replay, que o `TrackBasicBlockPass` pode fornecer. +- **KLEE → AFL++:** hoje seguem os 64 `.ktest` mais recentes. O KLEE não marca quais estados + cobriram código novo; `--only-output-states-covering-new` mudaria a suíte de CB e não + entra. + +## Medição + +É preciso uma rodada `seeds` e `alternate` com este build contra a R19 (os mesmos braços +sem ranking). Só tem efeito em tarefas cuja fila passa de 64 entradas. diff --git a/docs/test-suite-format.md b/docs/test-suite-format.md new file mode 100644 index 000000000..4549da808 --- /dev/null +++ b/docs/test-suite-format.md @@ -0,0 +1,95 @@ +# Test suites written by Map2Check + +With `--generate-test-suite`, Map2Check writes a Test-Comp test suite to +`./test-suite/` in the working directory, in the exchange format of + (DTDs version 1.1). The +writer is `modules/frontend/test_suite/test_suite.cpp`; the decision of what +goes in is `emitTestSuite` in `modules/frontend/map2check.cpp`. + +## Files + +``` +test-suite/ + metadata.xml + testcase-1.xml + testcase-2.xml + ... +``` + +`metadata.xml` carries, in the order the DTD's sequence requires: +`sourcecodelang` (C), `producer` (`Map2Check `), `specification` +(the property file's text), `programfile`, `programhash` (SHA-256), +`entryfunction`, `architecture` (`32bit`/`64bit`) and `creationtime` (UTC). + +## A test case + +```xml + + + + 42 + -7 + +``` + +- The order is the whole contract: the n-th `` is the value returned by + the n-th `__VERIFIER_nondet_*` call of the execution. +- `coversError="true"` appears only on the case of a run that reached the + error (Cover-Error); the DTD's default is false. +- Values are decimal integers; a `float` is printed with `%.9g` (nine + significant digits read back to the same float), a `double` with `%lf`. + `__VERIFIER_nondet_memory(p, n)` gives `n` inputs, one per byte, as the + validators' harness reads it. +- Cases are numbered after the ones already in the directory, because the + phases of one run (AFL++ and KLEE take turns) write into the same suite. A + case whose inputs the suite already has is not written again. + +## The assumption-pruned marker + +```xml + + + + 3 + +``` + +A path that a failed assumption ended (`__VERIFIER_assume`, +`assume_abort_if_not`, or a program's own `abort()`, which NonDetPass turns +into pruning) still produces a test: KLEE ends it with `_exit(0)` and writes +its `.ktest`, carrying a one-byte `map2check_pruned` object that the reader +strips. Its vector covers the branches up to the assumption, so it belongs in +a Cover-Branches suite, but a deeper path is worth more. + +The case is therefore written with the XML comment above. A comment is outside +the test format: TestCov and TestCoCa ignore it, and the case is validated +like any other. Map2Check reads it back when a later phase opens the same +suite (`TestSuiteWriter` constructor) and, once the suite is full, removes a +pruned case to make room for an unpruned one (`evictPrunedCase`). Without +that, on xcsp/AllInterval the first KLEE phase filled the suite with pruned +paths and the deep paths of the next phase found no room: coverage fell from +95% to 9%. + +## How many cases + +- Cover-Error: one, the violating execution. +- Cover-Branches: at most `kMaxBranchTestCases` (50). First the fuzzer's + corpus, up to half the suite (on by default; `MAP2CHECK_FUZZER_SUITE=0` + turns it off), then one case per KLEE path (`.ktest`), unpruned paths first. + Pruned cases count toward neither share and give way when the suite is full. + 50 because larger suites (median 500 among the 116 that failed validation) + were too large for TestCov to finish validating. + +## Where the vectors come from + +1. The runtime's nondet log `klee_log.csv`, one row per nondet call: + `id;line;scope;function;step;value;type`, where `type` is the number of + `enum NONDET_TYPE` (`modules/backend/library/header/Map2CheckTypes.h`: + 0 int, 1 char, 2 pointer, 3 ushort, 4 long, 5 unsigned, 6 ulong, 7 bool, + 8 uchar, 9 pchar, 10 size_t, 11 loff_t, 12 sector_t, 13 uint, 14 short, + 15 double, 16 float, 17 longlong, 18 ulonglong, 19 u8, 20 u16, 21 u32, + 22 one byte of nondet_memory). +2. When that log is missing -- an aborted KLEE state runs no exit handler, and + past 1024 reads the KLEE runtime does not write it (issue #75) -- the + violating state's `.ktest`, decoded by object name (`non_det_`) in + `modules/frontend/test_suite/ktest_reader.cpp`. diff --git a/examples/use-after-free/README.md b/examples/use-after-free/README.md new file mode 100644 index 000000000..16ff19b65 --- /dev/null +++ b/examples/use-after-free/README.md @@ -0,0 +1,21 @@ +# Use-After-Free Example (CVE-2024-9680 inspired) + +This example illustrates a simplified use-after-free vulnerability inspired by +the Animation timelines bug in Firefox v131.0.2 +([CVE-2024-9680](https://nvd.nist.gov/vuln/detail/CVE-2024-9680)). + +The program allocates memory with `malloc`, stores a value, frees the pointer, +and then dereferences it — a classic temporal memory safety violation +(CWE-416). + +## Running with Map2Check + +```bash +$ ./map2check --memtrack sample_use_after_free.c +``` + +Expected output: `VERIFICATION FAILED` with `FALSE-DEREF: Reference to pointer was lost`, +which corresponds to CWE-416 (Use-After-Free). + +This example is discussed in the Map2Check SBSeg 2026 paper as Listing 1 +(*Motivating Example* section). diff --git a/examples/use-after-free/sample_use_after_free.c b/examples/use-after-free/sample_use_after_free.c new file mode 100644 index 000000000..f10c5bd65 --- /dev/null +++ b/examples/use-after-free/sample_use_after_free.c @@ -0,0 +1,13 @@ +#include +#include + +int main() { + int *ptr = (int *)malloc(sizeof(int)); + *ptr = 42; + free(ptr); // Free the memory + + // Use the pointer after freeing the memory (use-after-free) + // Undefined behavior, potential crash or exploit + printf("%d\n", *ptr); + return 0; +} diff --git a/make-unit-test.sh b/make-unit-test.sh index ca7064484..ea97ab323 100755 --- a/make-unit-test.sh +++ b/make-unit-test.sh @@ -16,6 +16,6 @@ cd build export LLVM_DIR=$LLVM_DIR_BASE/lib/cmake/llvm export CXX=$LLVM_DIR_BASE/bin/clang++ export CC=$LLVM_DIR_BASE/bin/clang -cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON +cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON -DENABLE_TEST=ON ninja && ninja install && ctest diff --git a/modules/backend/library/header/Map2CheckTypes.h b/modules/backend/library/header/Map2CheckTypes.h index 4df613f7a..85a8f9b45 100755 --- a/modules/backend/library/header/Map2CheckTypes.h +++ b/modules/backend/library/header/Map2CheckTypes.h @@ -54,7 +54,19 @@ enum NONDET_TYPE { SECTOR_T = 12, UINT = 13, SHORT = 14, - DOUBLE = 15 + DOUBLE = 15, + /* Issue #74: SV-COMP names NonDetPass did not model. Each was an external + * call KLEE could not resolve, which killed every path through it. */ + FLOAT = 16, + LONGLONG = 17, + ULONGLONG = 18, + U8 = 19, + U16 = 20, + U32 = 21, + /* One byte of a __VERIFIER_nondet_memory(p, n) call, logged by the runtime: + * the validators read that call as n uchar inputs. Its own type, not UCHAR, + * so the seed converter can tell that n rows are one KLEE object. */ + MEMORY_BYTE = 22 }; enum Container_Type { @@ -74,7 +86,8 @@ enum ViolatedProperty { TARGET_REACHED = 5, FALSE_OVERFLOW = 6, ASSERT = 7, - FALSE_MEMCLEANUP = 8 + FALSE_MEMCLEANUP = 8, + FALSE_DIVBYZERO = 9 }; typedef @@ -134,10 +147,26 @@ typedef unsigned step_on_execution; /** Current scope number (llvm ir uses numbered scopes) */ unsigned scope; - // TODO(rafa.sa.xp@gmail.com) Should update to work with a union - /** Pointer where the generated value is stored */ - //long value; - void *value; + /** The generated value, stored INLINE. + * + * This was a `void *value` holding the address of the caller's `value` + * parameter -- a stack slot already dead by the time the log is flushed at + * exit. Reading it was a use-after-scope: natively it usually printed + * something plausible, and under KLEE it terminated the state with a pointer + * error, which is why klee_log.csv came out EMPTY on every symbolic run and + * no counterexample ever carried nondet values. + * + * A pointer cannot be made to work here even by pointing into the row: the + * containers memcpy rows into a reallocated array, so any self-referential + * pointer is stale after the first append. The value has to live inline. + * (The TODO asking for exactly this union has been here since 2020.) */ + union { + int as_int; + unsigned as_unsigned; + double as_double; + long long as_longlong; + unsigned long long as_ulonglong; + } value; /** Name of the function where operation took place */ char function_name[FUNCTION_MAX_LENGTH_NAME]; } NONDET_CALL; diff --git a/modules/backend/library/header/NonDetGenerator.h b/modules/backend/library/header/NonDetGenerator.h index fb5dec3dd..b9fdfe3bd 100644 --- a/modules/backend/library/header/NonDetGenerator.h +++ b/modules/backend/library/header/NonDetGenerator.h @@ -129,4 +129,32 @@ uint map2check_non_det_uint(); */ double map2check_non_det_double(); +/* Issue #74: the SV-COMP names NonDetPass did not model. The typedefs give the + * generator macros one identifier per type, which also names the KLEE object + * ("non_det_ulonglong"), the only place a .ktest keeps the type. */ +float map2check_non_det_float(); + +typedef long long longlong; +longlong map2check_non_det_longlong(); + +typedef unsigned long long ulonglong; +ulonglong map2check_non_det_ulonglong(); + +typedef unsigned char u8; +u8 map2check_non_det_u8(); + +typedef unsigned short u16; +u16 map2check_non_det_u16(); + +typedef unsigned int u32; +u32 map2check_non_det_u32(); + +/** + * @brief Fills `size` bytes at `destination` with nondeterministic values + * + * The validators' harness reads it as `size` uchar inputs, one per byte, so + * the runtime logs it that way (MEMORY_BYTE rows). + */ +void map2check_non_det_memory(void *destination, size_t size); + #endif diff --git a/modules/backend/library/header/NonDetLog.h b/modules/backend/library/header/NonDetLog.h index 444baa4f9..bc86869a9 100644 --- a/modules/backend/library/header/NonDetLog.h +++ b/modules/backend/library/header/NonDetLog.h @@ -86,5 +86,29 @@ void map2check_nondet_short(unsigned line, unsigned scope, int value, void map2check_nondet_double(unsigned line, unsigned scope, double value, const char *function_name); +void map2check_nondet_float(unsigned line, unsigned scope, double value, + const char *function_name); + +void map2check_nondet_longlong(unsigned line, unsigned scope, long long value, + const char *function_name); + +void map2check_nondet_ulonglong(unsigned line, unsigned scope, + unsigned long long value, + const char *function_name); + +void map2check_nondet_u8(unsigned line, unsigned scope, int value, + const char *function_name); + +void map2check_nondet_u16(unsigned line, unsigned scope, int value, + const char *function_name); + +void map2check_nondet_u32(unsigned line, unsigned scope, int value, + const char *function_name); + +/** Logs one byte of a __VERIFIER_nondet_memory call. Called by the runtime's + * map2check_non_det_memory, not by NonDetPass: the bytes are read inside it. */ +void map2check_nondet_memory_byte(unsigned line, unsigned scope, int value, + const char *function_name); + #endif diff --git a/modules/backend/library/header/WitnessGeneration.h b/modules/backend/library/header/WitnessGeneration.h index 0b4f3e289..d71dfe3f4 100644 --- a/modules/backend/library/header/WitnessGeneration.h +++ b/modules/backend/library/header/WitnessGeneration.h @@ -12,10 +12,16 @@ #include "Map2CheckTypes.h" /** * Generate files containing info to generate witness on frontend - * @param non_det_log Container with non deterministic log * @param trackbb_log Container with trackbb_log + * @param violation TRUE when this execution violated the property. + * + * The nondet log is only flushed for a violating execution. Under KLEE every + * forked state runs this on exit and they all write the same file, so the last + * one to finish wins -- and it is usually not the violating one, which aborts + * early. Guarding the flush is what keeps the violating execution's input + * vector from being overwritten by a state that took another branch. */ -void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log); +void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log, Bool violation); /** * Generate a error file to confirm that map2check really crashed with input diff --git a/modules/backend/library/lib/AllocationLog.c b/modules/backend/library/lib/AllocationLog.c index 2c1d6361b..6f413a8e6 100644 --- a/modules/backend/library/lib/AllocationLog.c +++ b/modules/backend/library/lib/AllocationLog.c @@ -104,12 +104,12 @@ MEMORY_ALLOCATIONS_ROW * find_row_with_address(MAP2CHECK_CONTAINER *allocation_log, void *ptr) { int i = allocation_log->size - 1; - unsigned addressToCheck = (unsigned)ptr; + unsigned long addressToCheck = (unsigned long)ptr; for (; i >= 0; i--) { MEMORY_ALLOCATIONS_ROW *iRow = (MEMORY_ALLOCATIONS_ROW *)get_element_at(i, *allocation_log); - unsigned addr = (unsigned)iRow->addr; + unsigned long addr = (unsigned long)iRow->addr; if (addressToCheck == addr) { return iRow; } diff --git a/modules/backend/library/lib/AnalysisModeMemcleanup.c b/modules/backend/library/lib/AnalysisModeMemcleanup.c index d66439869..3c506b206 100644 --- a/modules/backend/library/lib/AnalysisModeMemcleanup.c +++ b/modules/backend/library/lib/AnalysisModeMemcleanup.c @@ -156,6 +156,7 @@ void analysis_generate_aux_witness_files() { // TODO: FIX THIS, not working for static array #include void map2check_load(void *ptr, int size) {} +void map2check_check_cstring(const char *string) {} void map2check_free_resolved_address(void *ptr, unsigned line, const char *function_name, diff --git a/modules/backend/library/lib/AnalysisModeMemtrack.c b/modules/backend/library/lib/AnalysisModeMemtrack.c index 87e79ad1f..a06f363c3 100644 --- a/modules/backend/library/lib/AnalysisModeMemtrack.c +++ b/modules/backend/library/lib/AnalysisModeMemtrack.c @@ -153,6 +153,18 @@ void analysis_generate_aux_witness_files() { // TODO: FIX THIS, not working for static array #include +/* Every byte a %s or puts will read, up to the terminator: each must lie in + * a live allocation. Stops at the first invalid byte (ERROR_DEREF is set and + * the caller's map2check_check_deref reports it), before reading it. */ +void map2check_check_cstring(const char *string) { + if (string == NULL) return; + for (unsigned long i = 0;; ++i) { + map2check_load((void *)(string + i), 1); + if (ERROR_DEREF) return; + if (string[i] == '\0') return; + } +} + void map2check_load(void *ptr, int size) { if (!is_valid_heap_address(&heap_log, ptr, size)) { if (!is_valid_allocation_address(&allocation_log, ptr, size)) { diff --git a/modules/backend/library/lib/AnalysisModeOverflow.c b/modules/backend/library/lib/AnalysisModeOverflow.c index 386d3d6e6..507b18a46 100644 --- a/modules/backend/library/lib/AnalysisModeOverflow.c +++ b/modules/backend/library/lib/AnalysisModeOverflow.c @@ -13,225 +13,266 @@ #include "../header/Map2CheckFunctions.h" #include "../header/PropertyGenerator.h" // TODO(rafa.sa.xp@gmail.com) Check if overflow of unsigned exists at all +// +// All signed binop checkers share one ABI, mirroring how UBSan's +// __ubsan_handle_*_overflow handlers take the operand type as a parameter: +// +// (long long lhs, long long rhs, unsigned width, ...) +// +// OverflowPass sign-extends both operands to 64 bits (lossless) and passes +// `width`, the bit width of the *result type of the operation*. SV-COMP's +// no-overflow property is defined over exactly that type — "the resulting type +// of an operation is a signed-integer type but the resulting value is not in +// the range of values that are representable by that type" — so the check has +// to range-check the exact result against `width`, not against a fixed width. +// Checking only at 64 bits would mask every int overflow; checking only at 32 +// bits would miss every long long one (Juliet CWE190/CWE191 has both). + /** * @brief Checks ADD (on two integers) operations and adds cases where operation * would fail. - * @param param1 First operand - * @param param2 Second operand + * @param param1 First operand, sign-extended to 64 bits + * @param param2 Second operand, sign-extended to 64 bits + * @param width Bit width of the operation's result type * @param line Line where operation occurred * @param scope Scope where operation occurred * @param function_name Name of the function which operation occurred */ -void map2check_binop_add(int param1, int param2, unsigned line, unsigned scope, - char *function_name); +void map2check_binop_add(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name); -void map2check_binop_add_uint(unsigned param1, unsigned param2, unsigned line, - unsigned scope, char *function_name); +void map2check_binop_add_uint(unsigned long long param1, + unsigned long long param2, unsigned width, + unsigned line, unsigned scope, + char *function_name); /** * @brief Checks SUB (on two integers) operations and adds cases where operation * would fail. - * @param param1 First operand - * @param param2 Second operand + * @param param1 First operand, sign-extended to 64 bits + * @param param2 Second operand, sign-extended to 64 bits + * @param width Bit width of the operation's result type * @param line Line where operation occurred * @param scope Scope where operation occurred * @param function_name Name of the function which operation occurred * */ -void map2check_binop_sub(int param1, int param2, unsigned line, unsigned scope, - char *function_name); +void map2check_binop_sub(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name); -void map2check_binop_sub_uint(unsigned param1, unsigned param2, unsigned line, - unsigned scope, char *function_name); +void map2check_binop_sub_uint(unsigned long long param1, + unsigned long long param2, unsigned width, + unsigned line, unsigned scope, + char *function_name); /** * @brief Checks MUL (on two integers) operations and adds cases where operation * would fail. - * @param param1 First operand - * @param param2 Second operand + * @param param1 First operand, sign-extended to 64 bits + * @param param2 Second operand, sign-extended to 64 bits + * @param width Bit width of the operation's result type * @param line Line where operation occurred * @param scope Scope where operation occurred * @param function_name Name of the function which operation occurred * */ -void map2check_binop_mul(int param1, int param2, unsigned line, unsigned scope, - char *function_name); +void map2check_binop_mul(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name); -void map2check_binop_mul_uint(unsigned param1, unsigned param2, unsigned line, - unsigned scope, char *function_name); +void map2check_binop_mul_uint(unsigned long long param1, + unsigned long long param2, unsigned width, + unsigned line, unsigned scope, + char *function_name); /** * @brief Checks DIV (on two integers) operations and adds cases where operation * would fail. - * @param param1 First operand - * @param param2 Second operand + * @param param1 Dividend, sign-extended to 64 bits + * @param param2 Divisor, sign-extended to 64 bits + * @param width Bit width of the operation's result type + * @param line Line where operation occurred + * @param scope Scope where operation occurred + * @param function_name Name of the function which operation occurred + * */ +void map2check_binop_sdiv(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name); + +/** + * @brief Checks REM (on two integers) operations. Same failure modes as SDIV: + * a zero divisor, and MIN % -1 which is undefined in C. + * @param param1 Dividend, sign-extended to 64 bits + * @param param2 Divisor, sign-extended to 64 bits + * @param width Bit width of the operation's result type * @param line Line where operation occurred * @param scope Scope where operation occurred * @param function_name Name of the function which operation occurred * */ -void map2check_binop_sdiv(int param1, int param2, unsigned line, unsigned scope, - char *function_name); +void map2check_binop_srem(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name); -int absInteger(int a) { - if (a < 0) { - return (-a); +/* Lowest value representable by a signed integer type of `width` bits. */ +static long long signed_min_for_width(unsigned width) { + if (width == 0 || width >= 64) { + return LLONG_MIN; } - return a; + return -(1LL << (width - 1)); } -void overflowError(unsigned line, const char *function_name) { - write_property(FALSE_OVERFLOW, line, function_name); - map2check_error(); +/* Highest value representable by a signed integer type of `width` bits. */ +static long long signed_max_for_width(unsigned width) { + if (width == 0 || width >= 64) { + return LLONG_MAX; + } + return (1LL << (width - 1)) - 1; } -void unknown_not_supported() { write_property_unknown(); } - -void divisionByZeroError() { - // TODO: implement method +static Bool fits_in_width(long long value, unsigned width) { + if (value < signed_min_for_width(width)) { + return FALSE; + } + if (value > signed_max_for_width(width)) { + return FALSE; + } + return TRUE; } -void map2check_binop_add(int param1, int param2, unsigned line, unsigned scope, - char *function_name) { - if ((param1 == 0) || (param2 == 0)) { - return; +/* + * 64-bit overflow predicates. These are written as range comparisons rather + * than by computing the result first, because computing it would itself be the + * undefined behaviour we are trying to report. + */ +static Bool add_overflows_64(long long a, long long b) { + if (b > 0 && a > LLONG_MAX - b) { + return TRUE; } + if (b < 0 && a < LLONG_MIN - b) { + return TRUE; + } + return FALSE; +} - Bool param1Pos = (param1 > 0); - Bool param2Pos = (param2 > 0); +static Bool sub_overflows_64(long long a, long long b) { + if (b < 0 && a > LLONG_MAX + b) { + return TRUE; + } + if (b > 0 && a < LLONG_MIN + b) { + return TRUE; + } + return FALSE; +} - // Both are positive - if (param1Pos && param2Pos) { - // If param2 is greater thant the difference between max int and param1, - // then we have an overflow - if ((INT_MAX - param1) < param2) { - overflowError(line, function_name); - } +static Bool mul_overflows_64(long long a, long long b) { + if (a == 0 || b == 0) { + return FALSE; } - // Both are negative - else if (!param1Pos && !param2Pos) { - // Same principle of first IF - if ((INT_MIN - param1) > param2) { - overflowError(line, function_name); - // overflowError(param1, function_name); + /* Handled first so the divisions below never evaluate LLONG_MIN / -1. */ + if (a == -1) { + return (b == LLONG_MIN) ? TRUE : FALSE; + } + if (b == -1) { + return (a == LLONG_MIN) ? TRUE : FALSE; + } + if (a > 0) { + if (b > 0) { + return (a > LLONG_MAX / b) ? TRUE : FALSE; } - } else { - return; + return (b < LLONG_MIN / a) ? TRUE : FALSE; } + if (b > 0) { + return (a < LLONG_MIN / b) ? TRUE : FALSE; + } + /* Both negative: the product is positive. */ + return (a < LLONG_MAX / b) ? TRUE : FALSE; } -void map2check_binop_sub(int param1, int param2, unsigned line, unsigned scope, - char *function_name) { - map2check_binop_add(param1, -param2, line, scope, function_name); +void overflowError(unsigned line, const char *function_name) { + write_property(FALSE_OVERFLOW, line, function_name); + map2check_error(); } -void map2check_binop_add_uint(unsigned param1, unsigned param2, unsigned line, - unsigned scope, char *function_name) { - /* - //unknown_not_supported(); - if( !((param1 + param2) <= UINT_MAX && (param1 + param2) >= 0) ) { - overflowError(line, function_name); - } - else { - return; - }; - */ -} +void unknown_not_supported() { write_property_unknown(); } -void map2check_binop_sub_uint(unsigned param1, unsigned param2, unsigned line, - unsigned scope, char *function_name) { - // unknown_not_supported(); - - // Same principle of first IF - /*if( !((param1 - param2) >= 0) ) { - overflowError(line, function_name); - }else { - return; - } - */ +void divisionByZeroError(unsigned line, const char *function_name) { + write_property(FALSE_DIVBYZERO, line, function_name); + map2check_error(); } -void map2check_binop_mul(int param1, int param2, unsigned line, unsigned scope, - char *function_name) { - // If one of params is 0, the result will be 0 - if ((param1 == 0) || (param2 == 0)) { +void map2check_binop_add(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name) { + if (add_overflows_64(param1, param2)) { + overflowError(line, function_name); return; } + if (!fits_in_width(param1 + param2, width)) { + overflowError(line, function_name); + } +} - // If a parameter is 1, the result will not be an overflow - if ((param1 == 1) || (param2 == 1)) { +void map2check_binop_sub(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name) { + if (sub_overflows_64(param1, param2)) { + overflowError(line, function_name); return; } - - Bool isParam1Positive = (param1 >= 0); - Bool isParam2Positive = (param2 >= 0); - - if ((isParam1Positive && isParam2Positive) || - (!isParam1Positive && !isParam2Positive)) { - int limitPositiveResult = INT_MAX / param1; - - switch (isParam1Positive) { - case TRUE: - if (limitPositiveResult < param2) { - overflowError(line, function_name); - } - break; - case FALSE: - if (param2 < limitPositiveResult) { - overflowError(line, function_name); - } - break; - } - + if (!fits_in_width(param1 - param2, width)) { + overflowError(line, function_name); } +} - else { - int limitNegativeResult = INT_MIN / param1; - switch (isParam1Positive) { - case TRUE: - if (limitNegativeResult > param2) { - overflowError(line, function_name); - } - break; - case FALSE: - if (param2 > absInteger(limitNegativeResult)) { - overflowError(line, function_name); - } - break; - } +/* + * Unsigned wraparound is well-defined in C and is not an overflow under + * SV-COMP's no-overflow property, so these remain deliberate no-ops. They are + * kept only so the pass has a symbol to reference. + */ +void map2check_binop_add_uint(unsigned long long param1, + unsigned long long param2, unsigned width, + unsigned line, unsigned scope, + char *function_name) {} + +void map2check_binop_sub_uint(unsigned long long param1, + unsigned long long param2, unsigned width, + unsigned line, unsigned scope, + char *function_name) {} + +void map2check_binop_mul(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name) { + if (mul_overflows_64(param1, param2)) { + overflowError(line, function_name); + return; + } + if (!fits_in_width(param1 * param2, width)) { + overflowError(line, function_name); } } -void map2check_binop_mul_uint(unsigned param1, unsigned param2, unsigned line, - unsigned scope, char *function_name) { - /* - //unknown_not_supported(); +void map2check_binop_mul_uint(unsigned long long param1, + unsigned long long param2, unsigned width, + unsigned line, unsigned scope, + char *function_name) {} - // If one of params is 0, the result will be 0 - if((param1 == 0) || (param2 == 0)) { - return; - } - // If a parameter is 1, the result will not be an overflow - if((param1 == 1) || (param2 == 1)) { - return; - } +void map2check_binop_sdiv(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name) { + if (param2 == 0) { + divisionByZeroError(line, function_name); + return; + } - if( !((param1 * param2) <= UINT_MAX && (param1 * param2) >= 0) ) { - overflowError(line, function_name); - }else{ - return; - } - */ + /* MIN / -1 is the only signed division that overflows: the magnitude of the + * quotient is one past the representable maximum. */ + if (param1 == signed_min_for_width(width) && param2 == -1) { + overflowError(line, function_name); + } } -void map2check_binop_sdiv(int param1, int param2, unsigned line, unsigned scope, - char *function_name) { +void map2check_binop_srem(long long param1, long long param2, unsigned width, + unsigned line, unsigned scope, char *function_name) { if (param2 == 0) { - divisionByZeroError(); + divisionByZeroError(line, function_name); + return; } - if ((param1 == INT_MIN) || (param2 == INT_MIN)) { - if ((param1 == (-1)) || (param2 == (-1))) { - overflowError(line, function_name); - } + /* MIN % -1 is mathematically 0, but C leaves it undefined because it is + * specified in terms of the corresponding division. */ + if (param1 == signed_min_for_width(width) && param2 == -1) { + overflowError(line, function_name); } - return; } // Overflow mode does not use any additional data diff --git a/modules/backend/library/lib/CMakeLists.txt b/modules/backend/library/lib/CMakeLists.txt index 6bc4a14ee..9b532e8d0 100755 --- a/modules/backend/library/lib/CMakeLists.txt +++ b/modules/backend/library/lib/CMakeLists.txt @@ -16,7 +16,7 @@ list(APPEND MAP2CHECK_C_LIB "ListLog") list(APPEND MAP2CHECK_C_LIB "Map2CheckFunctions") list(APPEND MAP2CHECK_C_LIB "NonDetGeneratorNone") list(APPEND MAP2CHECK_C_LIB "NonDetGeneratorKlee") -list(APPEND MAP2CHECK_C_LIB "NonDetGeneratorLibFuzzy") +list(APPEND MAP2CHECK_C_LIB "NonDetGeneratorAFL") list(APPEND MAP2CHECK_C_LIB "NonDetLog") list(APPEND MAP2CHECK_C_LIB "PropertyGenerator") list(APPEND MAP2CHECK_C_LIB "TrackBBLog") diff --git a/modules/backend/library/lib/ContainerRealloc.c b/modules/backend/library/lib/ContainerRealloc.c index 6fe712943..72d246106 100644 --- a/modules/backend/library/lib/ContainerRealloc.c +++ b/modules/backend/library/lib/ContainerRealloc.c @@ -42,25 +42,55 @@ Bool free_container(MAP2CHECK_CONTAINER *container) { } Bool append_element(MAP2CHECK_CONTAINER *container, void *row) { + /* Grow geometrically: the capacity is the power of two at or above the + * size, so the buffer is reallocated only when the size reaches one. It + * grew by one row per append, and every append copied the whole log: N + * nondet reads cost O(N^2) row copies, and under KLEE each realloc is a new + * memory object whose (symbolic) bytes are copied too -- with 10,000 reads + * the single path ran out of time before reaching the target (issue #75). */ + unsigned old_size = container->size; container->size += 1; + if (old_size != 0 && (old_size & (old_size - 1)) != 0) { + switch (container->type) { + case LIST_LOG_CONTAINER: + ((LIST_LOG_ROW *)container->values)[old_size] = *((LIST_LOG_ROW *)row); + break; + case ALLOCATION_LOG_CONTAINER: + ((MEMORY_ALLOCATIONS_ROW *)container->values)[old_size] = + *((MEMORY_ALLOCATIONS_ROW *)row); + break; + case NONDET_LOG_CONTAINER: + ((NONDET_CALL *)container->values)[old_size] = *((NONDET_CALL *)row); + break; + case HEAP_LOG_CONTAINER: + ((MEMORY_HEAP_ROW *)container->values)[old_size] = + *((MEMORY_HEAP_ROW *)row); + break; + case TRACKBB_LOG_CONTAINER: + ((TRACK_BB_ROW *)container->values)[old_size] = *((TRACK_BB_ROW *)row); + break; + } + return TRUE; + } + unsigned capacity = old_size == 0 ? 1 : 2 * old_size; - int new_allocation_size; + size_t new_allocation_size; switch (container->type) { case LIST_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(LIST_LOG_ROW); + new_allocation_size = capacity * sizeof(LIST_LOG_ROW); break; case ALLOCATION_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(MEMORY_ALLOCATIONS_ROW); + new_allocation_size = capacity * sizeof(MEMORY_ALLOCATIONS_ROW); break; case NONDET_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(NONDET_CALL); + new_allocation_size = capacity * sizeof(NONDET_CALL); break; case HEAP_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(MEMORY_HEAP_ROW); + new_allocation_size = capacity * sizeof(MEMORY_HEAP_ROW); break; case TRACKBB_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(TRACK_BB_ROW); + new_allocation_size = capacity * sizeof(TRACK_BB_ROW); break; } // printf("new allocation size: %d\n", new_allocation_size); diff --git a/modules/backend/library/lib/Map2CheckFunctions.c b/modules/backend/library/lib/Map2CheckFunctions.c index ba0df013d..4813efd56 100644 --- a/modules/backend/library/lib/Map2CheckFunctions.c +++ b/modules/backend/library/lib/Map2CheckFunctions.c @@ -91,7 +91,7 @@ void map2check_exit() { gotError = !analysis_is_program_correct(); } - generate_aux_files(&trackbb_log); + generate_aux_files(&trackbb_log, gotError); /* gotError = TRUE; */ map2check_destroy(); if (gotError == TRUE) { diff --git a/modules/backend/library/lib/NonDetGeneratorAFL.c b/modules/backend/library/lib/NonDetGeneratorAFL.c new file mode 100644 index 000000000..541c32aea --- /dev/null +++ b/modules/backend/library/lib/NonDetGeneratorAFL.c @@ -0,0 +1,205 @@ +/** + * Copyright (C) 2014 - 2020 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "../header/NonDetGenerator.h" +#include "../header/NonDetLog.h" + +#include +#include +#include + +/* Logic used for cases generation: + 1 - main function of original program is changed to _map2check_main + 2 - AFL++ persistent mode feeds one test case per __AFL_LOOP iteration + */ + +extern int __map2check_main__(int argc, char **argv); + +#include "../header/Map2CheckFunctions.h" + +void nondet_init() { nondet_log_init(); } + +void nondet_destroy() { nondet_log_destroy(); } + +static jmp_buf map2check_reject_env; + +void nondet_cancel() { longjmp(map2check_reject_env, 1); } + +void nondet_assume(int expr) { + if (!expr) { + nondet_cancel(); + } +} + +void nondet_generate_aux_witness_files() { + nondet_log_to_file(map2check_nondet_get_log()); +} + +const uint8_t *map2check_afl_data; + +size_t map2check_afl_size; + +/* Read position in the current test case. File scope, not function-static, + * so main() can rewind it for every __AFL_LOOP iteration: persistent mode + * runs many inputs in one process, and a position carried over from the + * previous input makes the same input read different values on every run. + * That nondeterminism is what defeats CmpLog's input-to-state matching and + * drags afl-fuzz's stability down. */ +static size_t map2check_afl_index = 0; + +/* Past the end of the test case every read is zero. It used to start over + * from the first byte, so `while (__VERIFIER_nondet_int())` fed by the + * placeholder seed "A" never ended: afl-fuzz's dry run timed out on it and the + * fuzzer aborted before its first execution. Zero ends such a loop, and it is + * what the witness replay logs, so the suite built from that log stays exact. + * (It also read data[0] of an empty test case.) */ +uint8_t get_next_input_from_afl() { + if (map2check_afl_index < map2check_afl_size) { + return map2check_afl_data[map2check_afl_index++]; + } + return 0; +} + +/* Fills `out` with `size` bytes from the AFL buffer, in target order. + * + * Same width contract as NonDetGeneratorKlee.c: sizeof(type) bytes per value, + * so a vector means the same thing to both engines and seeding stays sound. */ +static void get_bytes_from_afl(void *out, size_t size) { + unsigned char *destination = (unsigned char *)out; + size_t i = 0; + for (; i < size; i++) { + destination[i] = get_next_input_from_afl(); + } +} + +#define MAP2CHECK_NON_DET_GENERATOR(type) \ + type map2check_non_det_##type() { \ + type value; \ + get_bytes_from_afl(&value, sizeof(value)); \ + return value; \ + } + +MAP2CHECK_NON_DET_GENERATOR(char) +MAP2CHECK_NON_DET_GENERATOR(pointer) +MAP2CHECK_NON_DET_GENERATOR(ushort) +MAP2CHECK_NON_DET_GENERATOR(short) +MAP2CHECK_NON_DET_GENERATOR(long) +MAP2CHECK_NON_DET_GENERATOR(ulong) +MAP2CHECK_NON_DET_GENERATOR(bool) +MAP2CHECK_NON_DET_GENERATOR(uchar) +MAP2CHECK_NON_DET_GENERATOR(size_t) +#ifndef __INTELLISENSE__ +MAP2CHECK_NON_DET_GENERATOR(loff_t) +#endif +MAP2CHECK_NON_DET_GENERATOR(sector_t) +MAP2CHECK_NON_DET_GENERATOR(double) +MAP2CHECK_NON_DET_GENERATOR(int) +MAP2CHECK_NON_DET_GENERATOR(uint) +MAP2CHECK_NON_DET_GENERATOR(unsigned) +MAP2CHECK_NON_DET_GENERATOR(float) +MAP2CHECK_NON_DET_GENERATOR(longlong) +MAP2CHECK_NON_DET_GENERATOR(ulonglong) +MAP2CHECK_NON_DET_GENERATOR(u8) +MAP2CHECK_NON_DET_GENERATOR(u16) +MAP2CHECK_NON_DET_GENERATOR(u32) + +/* `size` bytes straight from the test case, as KLEE's one object of `size` + * bytes; logged a byte at a time, as the validators' harness reads it. */ +void map2check_non_det_memory(void *destination, size_t size) { + unsigned char *bytes = (unsigned char *)destination; + get_bytes_from_afl(bytes, size); + size_t i = 0; + for (; i < size; i++) { + map2check_nondet_memory_byte(0, 0, bytes[i], "__VERIFIER_nondet_memory"); + } +} + +#define MAP2CHECK_MAX_FUZZED_STRING 4096 + +char *map2check_non_det_pchar() { + unsigned length = map2check_non_det_unsigned(); + if (length == 0) + return NULL; + if (length > MAP2CHECK_MAX_FUZZED_STRING) + length = MAP2CHECK_MAX_FUZZED_STRING; + char *string = malloc(length); + if (string == NULL) + return NULL; + unsigned i = 0; + for (i = 0; i < (length - 1); i++) { + string[i] = map2check_non_det_char(); + } + string[i] = '\0'; + return string; +} + +/* The persistent-mode macros, as afl-cc 4.40c defines them (src/afl-cc.c). + * + * afl-cc injects these with -D only when IT compiles C source. This file is + * compiled to bitcode by plain clang (the library build must not depend on + * AFL++, and a KLEE-only build never sees afl-cc), and afl-clang-fast later + * receives the linked -result.bc, which is never preprocessed again. So the + * expansions have to be in the bitcode already -- including the + * ##SIG_AFL_PERSISTENT## marker afl-fuzz looks for in the binary to switch to + * persistent mode. The __afl_* symbols resolve from afl-compiler-rt at that + * final afl-clang-fast link. Keep in sync with the pinned AFL++ tag. */ +#ifndef __AFL_FUZZ_TESTCASE_LEN +#include + +#define __AFL_FUZZ_INIT() \ + int __afl_sharedmem_fuzzing = 1; \ + extern __attribute__((visibility("default"))) unsigned int *__afl_fuzz_len; \ + extern __attribute__((visibility("default"))) unsigned char *__afl_fuzz_ptr; \ + unsigned char __afl_fuzz_alt[1048576]; \ + unsigned char *__afl_fuzz_alt_ptr = __afl_fuzz_alt + +#define __AFL_FUZZ_TESTCASE_BUF (__afl_fuzz_ptr ? __afl_fuzz_ptr : __afl_fuzz_alt_ptr) + +#define __AFL_FUZZ_TESTCASE_LEN \ + (__afl_fuzz_ptr ? *__afl_fuzz_len \ + : (*__afl_fuzz_len = read(0, __afl_fuzz_alt_ptr, 1048576)) == 0xffffffff \ + ? 0 \ + : *__afl_fuzz_len) + +#define __AFL_LOOP(_A) \ + ({ \ + static volatile const char *_B __attribute__((used, unused)); \ + _B = (const char *)"##SIG_AFL_PERSISTENT##"; \ + extern __attribute__((visibility("default"))) int __afl_connected; \ + __attribute__((visibility("default"))) int _L(unsigned int) __asm__( \ + "__afl_persistent_loop"); \ + _L(__afl_connected ? _A : 1); \ + }) +#endif + +/* AFL++ persistent-mode trampoline. + * + * __AFL_FUZZ_INIT registers the shared-memory test case. __AFL_LOOP runs the + * body once per input under afl-fuzz; run standalone (replaying a saved crash + * file) it runs exactly once and reads that input from STDIN -- argv is + * ignored, so the replay must redirect the file in, not pass it as argument. + * + * A failed nondet_assume longjmps back here and skips the input — the + * persistent-mode equivalent of the pthread_exit the previous fuzzer generator + * used (a rejected input, not a crash). */ +__AFL_FUZZ_INIT(); + +int main(int argc, char **argv) { + (void)argc; + (void)argv; + while (__AFL_LOOP(10000)) { + if (setjmp(map2check_reject_env) == 0) { + map2check_afl_data = __AFL_FUZZ_TESTCASE_BUF; + map2check_afl_size = __AFL_FUZZ_TESTCASE_LEN; + map2check_afl_index = 0; + __map2check_main__(0, NULL); + } + /* else: input rejected by nondet_assume; continue to the next iteration */ + } + return 0; +} diff --git a/modules/backend/library/lib/NonDetGeneratorKlee.c b/modules/backend/library/lib/NonDetGeneratorKlee.c index 9ed3ae371..8eb5876ee 100644 --- a/modules/backend/library/lib/NonDetGeneratorKlee.c +++ b/modules/backend/library/lib/NonDetGeneratorKlee.c @@ -10,27 +10,96 @@ #include "../header/NonDetGenerator.h" #include "../header/NonDetLog.h" #include +#include +#include -extern int __map2check_main__(); +extern int __map2check_main__(int argc, char **argv); -int main() { return __map2check_main__(); } +int main(int argc, char **argv) { return __map2check_main__(argc, argv); } void nondet_init() { nondet_log_init(); } void nondet_destroy() { nondet_log_destroy(); } -void nondet_generate_aux_witness_files() { - nondet_log_to_file(map2check_nondet_get_log()); +extern long long klee_get_value_i64(long long expr); +extern void klee_assume(int); + +/* Pin every logged value to one concrete model before printing it. The values + * are still symbolic when the path ends, and uClibc's vfprintf branches on + * each digit it converts: every row multiplied the states, so a program with + * ten nondet reads reached its target and never finished writing the log + * (issue #75). The assume makes each value consistent with the path and with + * the values pinned before it, so the row is one input vector, not a set of + * independent guesses. The 64-bit view covers every member of the union; the + * narrower ones were zero-extended by new_nondet_call's memset. */ +static void concretize_nondet_log(MAP2CHECK_CONTAINER log) { + unsigned i; + for (i = 0; i < log.size; i++) { + NONDET_CALL *call = (NONDET_CALL *)get_element_at(i, log); + if (call == NULL) + return; + long long symbolic; + memcpy(&symbolic, &call->value, sizeof(symbolic)); + long long concrete = klee_get_value_i64(symbolic); + klee_assume(symbolic == concrete); + memcpy(&call->value, &concrete, sizeof(concrete)); + } } -extern void klee_assume(int); +/* Pinning costs a solver query per row, and the equalities pile up: with + * 1,000 rows the violating path took 6 s, with 10,000 it never reached its + * abort -- the target found, KLEE's timer expiring mid-log. Past this size the + * log is not written: the violating state's .ktest, which KLEE solves in one + * query when the state ends, carries the same vector in the same order, and + * the frontend reads it whenever klee_log.csv is missing. */ +#define MAP2CHECK_KLEE_LOG_MAX_ROWS 1024U + +void nondet_generate_aux_witness_files() { + MAP2CHECK_CONTAINER log = map2check_nondet_get_log(); + if (log.size > MAP2CHECK_KLEE_LOG_MAX_ROWS) + return; + concretize_nondet_log(log); + nondet_log_to_file(log); +} -void nondet_assume(int expr) { klee_assume(expr); } +/* A failed assumption ends the path as a normal exit. klee_assume(0) on a + * path where the condition is already false is a KLEE error ("invalid + * klee_assume call (provably false)", a user.err), and the frontend must read + * every KLEE error as a dropped path -- which made every program with an + * assume_abort_if_not unprovable. + * + * klee_silent_exit avoided the error but wrote no test either, so a program + * whose every path meets a failed assumption (most of XCSP) got an empty + * Cover-Branches suite. _exit ends the path normally, so KLEE writes its + * .ktest, and it skips the exit handlers: a path the program declared + * infeasible reports no leak. */ extern void klee_make_symbolic(void *addr, size_t nbytes, const char *name); +/* The path's test still goes after every unpruned one in a Cover-Branches + * suite (readKtestVectors), so the one-byte "map2check_pruned" object marks + * it. The reader strips the marker; it is never an input. */ +void nondet_assume(int expr) { + if (!expr) { + char pruned; + klee_make_symbolic(&pruned, sizeof(pruned), "map2check_pruned"); + _exit(0); + } +} + +/* "non_det_" #type, not "non_det_#type". The stringify operator only applies + * to a macro parameter written OUTSIDE a string literal; inside one, # and t + * are just two characters. Every symbolic object was therefore named the + * literal text "non_det_#type" -- the same for an int, a double and a char. + * + * Nothing read that name, which is how it survived: the nondet log carries its + * own type column. It matters now because KLEE writes one .ktest per explored + * path, holding exactly the input vectors a Cover-Branches suite needs, and a + * .ktest records each object's name and size but not its type. With the name + * fixed the type travels with the object; without it, four bytes could be an + * int, a float or half of a long, and nothing tells them apart. */ #define MAP2CHECK_NON_DET_GENERATOR(type) \ type map2check_non_det_##type() { \ type non_det; \ - klee_make_symbolic(&non_det, sizeof(non_det), "non_det_#type"); \ + klee_make_symbolic(&non_det, sizeof(non_det), "non_det_" #type); \ return non_det; \ } @@ -69,3 +138,30 @@ MAP2CHECK_NON_DET_GENERATOR(loff_t) MAP2CHECK_NON_DET_GENERATOR(sector_t) MAP2CHECK_NON_DET_GENERATOR(uint) MAP2CHECK_NON_DET_GENERATOR(double) +MAP2CHECK_NON_DET_GENERATOR(float) +MAP2CHECK_NON_DET_GENERATOR(longlong) +MAP2CHECK_NON_DET_GENERATOR(ulonglong) +MAP2CHECK_NON_DET_GENERATOR(u8) +MAP2CHECK_NON_DET_GENERATOR(u16) +MAP2CHECK_NON_DET_GENERATOR(u32) + +/* A fresh object, copied in, rather than klee_make_symbolic(destination): + * KLEE accepts only the exact start and size of an allocation, and the + * benchmarks pass a field or a struct inside a larger one + * (`__VERIFIER_nondet_memory(dest, sizeof(tdr_t))`). One object of `size` + * bytes, not `size` objects of one: the reader expands it into one uchar + * input per byte (decodeKtestInputs), as the validators' harness reads it. */ +void map2check_non_det_memory(void *destination, size_t size) { + if (size == 0) + return; + unsigned char *bytes = malloc(size); + if (bytes == NULL) + return; + klee_make_symbolic(bytes, size, "non_det_memory"); + memcpy(destination, bytes, size); + size_t i = 0; + for (; i < size; i++) { + map2check_nondet_memory_byte(0, 0, bytes[i], "__VERIFIER_nondet_memory"); + } + free(bytes); +} diff --git a/modules/backend/library/lib/NonDetGeneratorLibFuzzy.c b/modules/backend/library/lib/NonDetGeneratorLibFuzzy.c deleted file mode 100644 index 519717d94..000000000 --- a/modules/backend/library/lib/NonDetGeneratorLibFuzzy.c +++ /dev/null @@ -1,131 +0,0 @@ -/** - * Copyright (C) 2014 - 2020 Map2Check tool - * This file is part of the Map2Check tool, and is made available under - * the terms of the GNU General Public License version 2. - * - * SPDX-License-Identifier: (GPL-2.0) - **/ - -#include "../header/NonDetGenerator.h" -#include "../header/NonDetLog.h" - -#include -#include -#include -#include - -/* Logic used for cases generation: - 1 - main function of original program is changed to _map2check_main - 2 - Fuzzer is used as a circular list - */ - -extern int __map2check_main__(); - -#include "../header/Map2CheckFunctions.h" - -void *fuzzer_execution_function(void *args) { - __map2check_main__(); - return NULL; -} - -pthread_t fuzzer_execution; - -void nondet_init() { nondet_log_init(); } - -void nondet_destroy() { nondet_log_destroy(); } - -void nondet_cancel() { pthread_exit(NULL); } - -void nondet_assume(int expr) { - if (!expr) { - nondet_cancel(); - } -} - -void nondet_generate_aux_witness_files() { - nondet_log_to_file(map2check_nondet_get_log()); -} - -const uint8_t *map2check_fuzzer_data; - -size_t map2check_fuzzer_size; - -uint8_t get_next_input_from_fuzzer() { - static int i = 0; - if (i < map2check_fuzzer_size) { - return map2check_fuzzer_data[i++]; - } - - i = 0; - return map2check_fuzzer_data[i]; -} - -int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { - map2check_fuzzer_data = Data; - map2check_fuzzer_size = Size; - int prevType; - // int currentProccess = getpid(); - // printf("Creating %d\n", currentProccess); - pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, &prevType); - pthread_cleanup_push(map2check_destroy, NULL); - pthread_create(&fuzzer_execution, NULL, fuzzer_execution_function, NULL); - pthread_join(fuzzer_execution, NULL); - pthread_cleanup_pop(0); - // map2check_destroy(); - return 0; -} - -#define MAP2CHECK_NON_DET_GENERATOR(type) \ - type map2check_non_det_##type() { return (type)get_next_input_from_fuzzer(); } - -MAP2CHECK_NON_DET_GENERATOR(char) -MAP2CHECK_NON_DET_GENERATOR(pointer) -MAP2CHECK_NON_DET_GENERATOR(ushort) -MAP2CHECK_NON_DET_GENERATOR(short) -MAP2CHECK_NON_DET_GENERATOR(long) -// MAP2CHECK_NON_DET_GENERATOR(unsigned) -MAP2CHECK_NON_DET_GENERATOR(ulong) -MAP2CHECK_NON_DET_GENERATOR(bool) -MAP2CHECK_NON_DET_GENERATOR(uchar) -MAP2CHECK_NON_DET_GENERATOR(size_t) -#ifndef __INTELLISENSE__ -MAP2CHECK_NON_DET_GENERATOR(loff_t) -#endif -MAP2CHECK_NON_DET_GENERATOR(sector_t) -MAP2CHECK_NON_DET_GENERATOR(double) -// MAP2CHECK_NON_DET_GENERATOR(uint) - -// Considering an int on a x64, then a 64 bit integer is 8 times a 8 bit integer -int map2check_non_det_int() { - uint64_t result = 0; - int i = 0; - for (; i < 8; i++) - /* cast before the shift: uint8_t promotes to int, and shifting an int - * by up to 56 bits is undefined behavior */ - result |= (uint64_t)get_next_input_from_fuzzer() << (8 * i); - - return (int)result; -} - -uint map2check_non_det_uint() { return (uint)map2check_non_det_int(); } - -unsigned map2check_non_det_unsigned() { - return (unsigned)map2check_non_det_int(); -} - -char *map2check_non_det_pchar() { - unsigned length = map2check_non_det_unsigned(); - if (length == 0) - return NULL; - /* heap allocation: returning a local VLA would leave the caller with a - * dangling pointer (cppcheck returnDanglingLifetime) */ - char *string = malloc(length); - if (string == NULL) - return NULL; - unsigned i = 0; - for (i = 0; i < (length - 1); i++) { - string[i] = map2check_non_det_char(); - } - string[i] = '\0'; - return string; -} diff --git a/modules/backend/library/lib/NonDetGeneratorNone.c b/modules/backend/library/lib/NonDetGeneratorNone.c index 95200b506..7135795c6 100644 --- a/modules/backend/library/lib/NonDetGeneratorNone.c +++ b/modules/backend/library/lib/NonDetGeneratorNone.c @@ -11,6 +11,7 @@ /* This mode returns consts */ #include +#include extern int __map2check_main__(); int main() { @@ -36,6 +37,22 @@ void *map2check_non_det_pointer() { } long map2check_non_det_long() { return 0; } + +float map2check_non_det_float() { return 0; } + +long long map2check_non_det_longlong() { return 0; } + +unsigned long long map2check_non_det_ulonglong() { return 0; } + +unsigned char map2check_non_det_u8() { return 0; } + +unsigned short map2check_non_det_u16() { return 0; } + +unsigned int map2check_non_det_u32() { return 0; } + +void map2check_non_det_memory(void *destination, size_t size) { + memset(destination, 0, size); +} void nondet_assume(int expr) {} void nondet_init() {} void nondet_destroy() {} diff --git a/modules/backend/library/lib/NonDetLog.c b/modules/backend/library/lib/NonDetLog.c index aac198d56..18a0781d2 100644 --- a/modules/backend/library/lib/NonDetLog.c +++ b/modules/backend/library/lib/NonDetLog.c @@ -14,47 +14,107 @@ const char *klee_log_file = "klee_log.csv"; +/* Decimal conversion by hand, not through printf. Under KLEE, uClibc's + * vfprintf is interpreted instruction by instruction -- about 7,000 per call, + * seven calls per row -- and the log of a run with 1,000 nondet reads cost + * 44 M instructions, 93% of the whole path (issue #75). Each helper appends + * to `buffer` and returns the new end. */ +static char *put_ulonglong(char *buffer, unsigned long long value) { + char digits[20]; + int n = 0; + do { + digits[n++] = (char)('0' + value % 10); + value /= 10; + } while (value != 0); + while (n > 0) + *buffer++ = digits[--n]; + return buffer; +} + +static char *put_longlong(char *buffer, long long value) { + if (value < 0) { + *buffer++ = '-'; + /* negate in unsigned: -LLONG_MIN overflows */ + return put_ulonglong(buffer, 0ULL - (unsigned long long)value); + } + return put_ulonglong(buffer, (unsigned long long)value); +} + +static char *put_string(char *buffer, const char *text, size_t max) { + size_t i; + for (i = 0; i < max && text[i] != '\0'; i++) + *buffer++ = text[i]; + return buffer; +} + Bool nondet_log_to_file(MAP2CHECK_CONTAINER klee_container) { if (klee_container.type != NONDET_LOG_CONTAINER) { return FALSE; } FILE *output = fopen(klee_log_file, "w"); + if (output == NULL) { + return FALSE; + } - int i = 0; + /* id;line;scope;function;step;value;type -- five numbers of at most 20 + * characters, the name, a double of at most ~320 (%lf of DBL_MAX) */ + char row[512]; + unsigned i = 0; unsigned size = klee_container.size; for (; i < size; i++) { NONDET_CALL *call = (NONDET_CALL *)get_element_at(i, klee_container); if (call == NULL) { + fclose(output); return FALSE; } - fprintf(output, "%d;", i); - fprintf(output, "%u;", call->line); - fprintf(output, "%u;", call->scope); - fprintf(output, "%s;", call->function_name); - fprintf(output, "%u;", call->step_on_execution); - - // The value generated from nondet function - if (((int)call->type) == UNSIGNED) { - unsigned *tmp_uvalue = call->value; - fprintf(output, "%u;", *tmp_uvalue); - } - if (((int)call->type) == DOUBLE) { - double *tmp_dvalue = call->value; - fprintf(output, "%lf;", *tmp_dvalue); - } - else { - int *tmp_ivalue = call->value; - fprintf(output, "%d;", *tmp_ivalue); + char *end = row; + end = put_longlong(end, (int)i); + *end++ = ';'; + end = put_ulonglong(end, call->line); + *end++ = ';'; + end = put_ulonglong(end, call->scope); + *end++ = ';'; + end = put_string(end, call->function_name, FUNCTION_MAX_LENGTH_NAME); + *end++ = ';'; + end = put_ulonglong(end, call->step_on_execution); + *end++ = ';'; + + // The value generated from nondet function. Read inline: it is stored in + // the row, not behind a pointer into a stack frame that no longer exists. + /* else-if, not two independent ifs. The UNSIGNED arm used to be an `if` + * with no `else`, so an unsigned row fell through into the `%d` arm as + * well and printed its value TWICE: `0;3;17;main;0;5;5;5`, eight fields + * where the format has seven. The value column still parsed by accident, + * being first, but the type column moved to index 7 and anything reading + * it got a copy of the value instead. */ + if (((int)call->type) == UNSIGNED || ((int)call->type) == U32) { + end = put_ulonglong(end, call->value.as_unsigned); + } else if (((int)call->type) == DOUBLE) { + end += snprintf(end, row + sizeof(row) - end - 16, "%lf", + call->value.as_double); + } else if (((int)call->type) == FLOAT) { + /* %.9g, not %lf: nine significant digits round-trip any float, while + * six fixed decimals print 1e-30 as 0 -- a different input. */ + end += snprintf(end, row + sizeof(row) - end - 16, "%.9g", + (float)call->value.as_double); + } else if (((int)call->type) == LONGLONG) { + end = put_longlong(end, call->value.as_longlong); + } else if (((int)call->type) == ULONGLONG) { + end = put_ulonglong(end, call->value.as_ulonglong); + } else { + end = put_longlong(end, call->value.as_int); } + *end++ = ';'; // Type of the nondet function - fprintf(output, "%d\n", ((int)call->type)); + end = put_longlong(end, (int)call->type); + *end++ = '\n'; + fwrite(row, 1, (size_t)(end - row), output); } fclose(output); return TRUE; - } NONDET_CALL new_nondet_call(enum NONDET_TYPE type, unsigned line, @@ -67,7 +127,19 @@ NONDET_CALL new_nondet_call(enum NONDET_TYPE type, unsigned line, result.type = type; strncpy(result.function_name, function_name, FUNCTION_MAX_LENGTH_NAME); result.line = line; - result.value = value; + /* Copy the value in NOW, while the caller's storage is still alive. Keeping + * the pointer instead is what made every symbolic run lose its nondet log: + * `value` points at a parameter of the map2check_nondet_* wrapper, and that + * frame is gone long before the log is flushed at exit. */ + if (value != NULL) { + if (type == DOUBLE || type == FLOAT) { + result.value.as_double = *(double *)value; + } else if (type == LONGLONG || type == ULONGLONG) { + result.value.as_longlong = *(long long *)value; + } else { + result.value.as_int = *(int *)value; + } + } result.scope = scope; result.step_on_execution = step; return result; @@ -84,10 +156,9 @@ MAP2CHECK_CONTAINER map2check_nondet_get_log() { return nondet_log; } void helper_map2check_nondet_append_element(NONDET_CALL nondetCall) { map2check_next_current_step(); - NONDET_CALL *row = (NONDET_CALL *)malloc(sizeof(NONDET_CALL)); - *row = nondetCall; - - append_element(&nondet_log, row); + /* append_element copies the row: a heap copy here leaked one row per + * nondet read (and was one more memory object per read under KLEE). */ + append_element(&nondet_log, &nondetCall); } #define MAP2CHECK_NONDET_GENERATOR(type, nondet_type) \ @@ -114,6 +185,10 @@ MAP2CHECK_NONDET_GENERATOR(size_t, SIZE_T) MAP2CHECK_NONDET_GENERATOR(loff_t, LOFF_T) MAP2CHECK_NONDET_GENERATOR(sector_t, SECTOR_T) MAP2CHECK_NONDET_GENERATOR(uint, UINT) +MAP2CHECK_NONDET_GENERATOR(u8, U8) +MAP2CHECK_NONDET_GENERATOR(u16, U16) +MAP2CHECK_NONDET_GENERATOR(u32, U32) +MAP2CHECK_NONDET_GENERATOR(memory_byte, MEMORY_BYTE) // FIX: MAP2CHECK_NONDET_GENERATOR(unsigned, UNSIGNED) void map2check_nondet_unsigned(unsigned line, unsigned scope, unsigned value, @@ -128,10 +203,40 @@ void map2check_nondet_unsigned(unsigned line, unsigned scope, unsigned value, void map2check_nondet_double(unsigned line, unsigned scope, double value, const char *function_name) { - // TODO: save unsigned into ptr void - void *tmp_void_double = &value; + /* DOUBLE, not UNSIGNED. Tagging a double as unsigned made the writer read + * the first four bytes of the mantissa and print them with %u, so every + * logged floating-point input was nonsense. */ + NONDET_CALL nondetCall = + new_nondet_call(DOUBLE, line, scope, &value, function_name, + map2check_get_current_step()); + helper_map2check_nondet_append_element(nondetCall); +} + +/* A float arrives widened to double (NonDetPass emits an fpext), so the row + * keeps one floating-point member; FLOAT says how to print it. */ +void map2check_nondet_float(unsigned line, unsigned scope, double value, + const char *function_name) { + NONDET_CALL nondetCall = + new_nondet_call(FLOAT, line, scope, &value, function_name, + map2check_get_current_step()); + helper_map2check_nondet_append_element(nondetCall); +} + +/* 64-bit, not through the int-valued macro above: that one truncates to 32 + * bits, and an Intel-TDX register value cut in half is a different input. */ +void map2check_nondet_longlong(unsigned line, unsigned scope, long long value, + const char *function_name) { + NONDET_CALL nondetCall = + new_nondet_call(LONGLONG, line, scope, &value, function_name, + map2check_get_current_step()); + helper_map2check_nondet_append_element(nondetCall); +} + +void map2check_nondet_ulonglong(unsigned line, unsigned scope, + unsigned long long value, + const char *function_name) { NONDET_CALL nondetCall = - new_nondet_call(UNSIGNED, line, scope, tmp_void_double, function_name, + new_nondet_call(ULONGLONG, line, scope, &value, function_name, map2check_get_current_step()); helper_map2check_nondet_append_element(nondetCall); } diff --git a/modules/backend/library/lib/PropertyGenerator.c b/modules/backend/library/lib/PropertyGenerator.c index cef1ab983..ba431a943 100644 --- a/modules/backend/library/lib/PropertyGenerator.c +++ b/modules/backend/library/lib/PropertyGenerator.c @@ -95,6 +95,11 @@ void write_property(enum ViolatedProperty violated, int line, fprintf(output, "Line: %d\n", line); fprintf(output, "Function: %s\n", function_name); break; + case FALSE_DIVBYZERO: + fprintf(output, "FALSE-DIVBYZERO\n"); + fprintf(output, "Line: %d\n", line); + fprintf(output, "Function: %s\n", function_name); + break; } fclose(output); diff --git a/modules/backend/library/lib/WitnessGeneration.c b/modules/backend/library/lib/WitnessGeneration.c index 89c6cf75d..330f3876b 100644 --- a/modules/backend/library/lib/WitnessGeneration.c +++ b/modules/backend/library/lib/WitnessGeneration.c @@ -6,15 +6,26 @@ * SPDX-License-Identifier: (GPL-2.0) **/ +#include #include "../header/WitnessGeneration.h" #include "../header/AnalysisMode.h" #include "../header/NonDetGenerator.h" #include "../header/TrackBBLog.h" -void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log) { +void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log, Bool violation) { trackbb_log_to_file(trackbb_log); analysis_generate_aux_witness_files(); - nondet_generate_aux_witness_files(); + /* Only a violating execution has an input vector worth recording, and under + * KLEE every forked state reaches this point. They all write the same file, + * so without the guard a state that took a different branch clobbers the + * violating one's log -- which is exactly what produced a test case with the + * right first input and a wrong second one. */ + /* The seed exchange replays the fuzzer's NON-violating queue entries to + * learn their typed vectors, so it asks for the log explicitly. Only that + * replay sets the variable; KLEE's forked states never do. */ + if (violation || getenv("MAP2CHECK_SEED_REPLAY") != NULL) { + nondet_generate_aux_witness_files(); + } } #include diff --git a/modules/backend/library/lib/WitnessGenerationNone.c b/modules/backend/library/lib/WitnessGenerationNone.c index 1596c160d..8cd5714d7 100644 --- a/modules/backend/library/lib/WitnessGenerationNone.c +++ b/modules/backend/library/lib/WitnessGenerationNone.c @@ -8,7 +8,8 @@ #include "../header/WitnessGeneration.h" -void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log) { +void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log, + Bool violation) { // DO NOTHING } diff --git a/modules/backend/pass/AssertPass.cpp b/modules/backend/pass/AssertPass.cpp index f3fa1e83b..209280b36 100755 --- a/modules/backend/pass/AssertPass.cpp +++ b/modules/backend/pass/AssertPass.cpp @@ -55,6 +55,21 @@ void AssertPass::instrumentAssert(CallInst* assertInst, LLVMContext* Ctx) { builder.CreateCall(this->map2check_assert, args); } +void AssertPass::instrumentAssertFail(CallInst* assertInst, LLVMContext* Ctx) { + IRBuilder<> builder(assertInst); + // A call to __assert_fail is only reached when the assertion already failed, + // so emit a constant-false condition. glibc signature: + // __assert_fail(const char *assertion, const char *file, + // unsigned int line, const char *function) + Value* condition = ConstantInt::get(Type::getInt32Ty(*Ctx), 0); + Value* line = assertInst->getArgOperand(2); + Value* function_llvm = assertInst->getArgOperand(3); + + Value* args[] = {condition, line, function_llvm}; + + builder.CreateCall(this->map2check_assert, args); +} + void AssertPass::runOnCallInstruction(CallInst* callInst, LLVMContext* Ctx) { Function* calleeFunction = callInst->getCalledFunction(); @@ -68,6 +83,8 @@ void AssertPass::runOnCallInstruction(CallInst* callInst, LLVMContext* Ctx) { } if (calleeFunction->getName() == "__VERIFIER_assert") { this->instrumentAssert(callInst, Ctx); + } else if (calleeFunction->getName() == "__assert_fail") { + this->instrumentAssertFail(callInst, Ctx); } } diff --git a/modules/backend/pass/AssertPass.hpp b/modules/backend/pass/AssertPass.hpp index 7d95ffee5..e9c36ea4b 100755 --- a/modules/backend/pass/AssertPass.hpp +++ b/modules/backend/pass/AssertPass.hpp @@ -47,6 +47,7 @@ struct AssertPass : public llvm::PassInfoMixin { protected: void instrumentAssert(CallInst* assertInst, LLVMContext* Ctx); + void instrumentAssertFail(CallInst* assertInst, LLVMContext* Ctx); void runOnCallInstruction(CallInst* callInst, LLVMContext* Ctx); Value* getFunctionNameValue() { return this->functionName; } diff --git a/modules/backend/pass/MemoryTrackPass.cpp b/modules/backend/pass/MemoryTrackPass.cpp index cde1dfc1b..67dad001a 100644 --- a/modules/backend/pass/MemoryTrackPass.cpp +++ b/modules/backend/pass/MemoryTrackPass.cpp @@ -10,8 +10,12 @@ #include "MemoryTrackPass.hpp" +#include +#include #include +#include +#include #include #include #include @@ -98,6 +102,35 @@ void MemoryTrackPass::instrumentPointer() { builder.CreateCall(this->map2check_pointer, args); } +/** Widens or narrows a size operand to the type the runtime call declares. + * + * The allocation size is taken straight from the program's own call, and its + * type is whatever that program declared. The runtime helpers are registered + * with an i64 size, so any program allocating with a narrower integer produced + * a call whose argument type did not match its signature -- and LLVM rejects + * the module outright: + * + * Call parameter type does not match function signature! + * LLVM ERROR: Broken module found, compilation aborted! + * + * Not a corner case. On the Test-Comp corpus this killed all 110 ProductLines + * tasks, two seconds into a sixty-second budget, plus a share of ECA -- the + * CIL-processed sources there allocate with i32. It went unseen because the + * Juliet and CASTLE programs allocate with i64, so every benchmark this tool + * is regularly run against happened to match. */ +static Value *coerceToParamType(IRBuilder<> &builder, Value *value, + FunctionCallee callee, unsigned argIndex) { + Type *wanted = callee.getFunctionType()->getParamType(argIndex); + if (value->getType() == wanted) return value; + if (value->getType()->isIntegerTy() && wanted->isIntegerTy()) { + // Signed: an allocation size is non-negative in practice, but a program is + // free to compute one in a signed type, and truncating a sign-extended + // value back is what preserves it either way. + return builder.CreateSExtOrTrunc(value, wanted); + } + return value; +} + void MemoryTrackPass::instrumentPosixMemAllign() { CallInst *callInst = dyn_cast(&*this->currentInstruction); @@ -116,7 +149,8 @@ void MemoryTrackPass::instrumentPosixMemAllign() { Value *varPointerCast = CastInst::CreatePointerCast( pointer, PointerType::get(*this->Ctx, 0), bitcast, BBIteratorToInst(j)); - Value *args[] = {varPointerCast, size}; + Value *args[] = {varPointerCast, + coerceToParamType(builder, size, map2check_posix, 1)}; builder.CreateCall(map2check_posix, args); } @@ -132,7 +166,8 @@ void MemoryTrackPass::instrumentMalloc() { Twine bitcast("bitcast"); // if (size == NULL) { // } - Value *args[] = {callInst, size}; + Value *args[] = {callInst, + coerceToParamType(builder, size, map2check_malloc, 1)}; builder.CreateCall(map2check_malloc, args); } @@ -155,7 +190,8 @@ void MemoryTrackPass::instrumentRealloc() { // Adds map2check_malloc with allocated address and size IRBuilder<> builder(BBIteratorToInst(j)); auto size = callInst->getArgOperand(1); - Value *args[] = {callInst, size}; + Value *args[] = {callInst, + coerceToParamType(builder, size, map2check_malloc, 1)}; builder.CreateCall(map2check_malloc, args); } @@ -177,8 +213,10 @@ void MemoryTrackPass::instrumentMemset() { IRBuilder<> builder(BBIteratorToInst(j)); Value *function_llvm = builder.CreateGlobalStringPtr(function_name); - // Value *args[] = {varPointerCast, size}; - Value *args[] = {pointer, size}; + // map2check_load takes an i64 size; the intrinsic's may be i32. + Value *sizeCast = CastInst::CreateIntegerCast( + size, Type::getInt64Ty(*this->Ctx), false, bitcast, BBIteratorToInst(j)); + Value *args[] = {varPointerCast, sizeCast}; builder.CreateCall(map2check_load, args); Value *args2[] = {this->line_value, function_llvm}; @@ -223,6 +261,109 @@ void MemoryTrackPass::instrumentMemcpy() { builder.CreateCall(map2check_check_deref, args3); } +namespace { +/** Behind MAP2CHECK_CHECK_CSTRINGS=1 until measured on more of Juliet. The + * check fixes a wrong TRUE (CWE193 "cpy" bad: the buffer is full, the read + * always overruns it) and makes a wrong FALSE on the matching good tasks, whose + * terminator is a byte never initialized -- which SV-COMP counts as a + * terminator and a native or KLEE run does not (R21: one of each in 50). */ +bool cstringChecksEnabled() { + const char *knob = std::getenv("MAP2CHECK_CHECK_CSTRINGS"); + return knob != nullptr && std::string(knob) == "1"; +} + +/** The argument positions a constant printf format reads as strings: each + * %s without a precision (a %.Ns may legitimately point at an unterminated + * buffer). `first` is the position of the first variadic argument. Returns + * nothing for a format it cannot follow (%n$ positional arguments). */ +std::vector stringArgumentsOf(llvm::StringRef format, + unsigned first) { + std::vector positions; + unsigned argument = first; + for (size_t i = 0; i < format.size(); ++i) { + if (format[i] != '%') continue; + ++i; + if (i < format.size() && format[i] == '%') continue; + // flags + while (i < format.size() && llvm::StringRef("-+ #0'").contains(format[i])) + ++i; + // width + if (i < format.size() && format[i] == '*') { + ++argument; + ++i; + } + while (i < format.size() && isdigit(static_cast(format[i]))) + ++i; + if (i < format.size() && format[i] == '$') return {}; + // precision + bool precision = false; + if (i < format.size() && format[i] == '.') { + precision = true; + ++i; + if (i < format.size() && format[i] == '*') { + ++argument; + ++i; + } + while (i < format.size() && + isdigit(static_cast(format[i]))) + ++i; + } + // length modifiers + bool wide = false; + while (i < format.size() && llvm::StringRef("hlLqjzt").contains(format[i])) { + if (format[i] == 'l') wide = true; + ++i; + } + if (i >= format.size()) break; + // GNU %m prints strerror(errno) and consumes no argument; the * of its + // width or precision, counted above, still does. + if (format[i] == 'm') continue; + if (format[i] == 's' && !precision && !wide) positions.push_back(argument); + ++argument; + } + return positions; +} +} // namespace + +/* KLEE's uClibc declares printf without defining it, so KLEE runs it as a + * native external call: whatever it reads is read outside every check. An + * unterminated buffer printed with %s -- Juliet's CWE121 CWE193 "cpy" tasks -- + * came back TRUE. The strings the call will read are checked here, before it: + * the format's %s arguments when the format is a constant, the first argument + * of puts/fputs. */ +void MemoryTrackPass::instrumentCStringArguments() { + CallInst *callInst = dyn_cast(&*this->currentInstruction); + llvm::StringRef name = this->calleeFunction->getName(); + + std::vector strings; + if (name == "puts" || name == "fputs") { + strings.push_back(0); + } else { + const unsigned formatIndex = + name == "printf" ? 0 : (name == "snprintf" ? 2 : 1); + if (callInst->arg_size() <= formatIndex) return; + llvm::StringRef format; + if (!llvm::getConstantStringInfo(callInst->getArgOperand(formatIndex), + format)) { + return; + } + strings = stringArgumentsOf(format, formatIndex + 1); + } + if (strings.empty()) return; + + IRBuilder<> builder(&*this->currentInstruction); + Value *function_llvm = + builder.CreateGlobalStringPtr(this->currentFunction->getName()); + for (unsigned position : strings) { + if (position >= callInst->arg_size()) continue; + Value *argument = callInst->getArgOperand(position); + if (!argument->getType()->isPointerTy()) continue; + builder.CreateCall(map2check_check_cstring, {argument}); + } + Value *args[] = {this->line_value, function_llvm}; + builder.CreateCall(map2check_check_deref, args); +} + void MemoryTrackPass::instrumentAlloca() { CallInst *callInst = dyn_cast(&*this->currentInstruction); auto j = this->currentInstruction; @@ -470,16 +611,22 @@ void MemoryTrackPass::switchCallInstruction() { this->instrumentFree(); } else if (this->calleeFunction->getName() == "posix_memalign") { this->instrumentPosixMemAllign(); - } else if (this->calleeFunction->getName() == "memset") { - this->instrumentMemset(); - } else if (this->calleeFunction->getName() == "llvm.memset.p0i8.i64") { + } else if (llvm::isa(&*this->currentInstruction) || + calleeName == "memset") { + // By the intrinsic's kind, not its name. The names carried the pointer + // types -- llvm.memset.p0i8.i64 -- and with opaque pointers LLVM 16 names + // them llvm.memset.p0.i64: matched by name, no memset, memcpy or memmove + // clang emitted was checked at all (memset(p, 0, 16) on 8 malloc'd bytes + // came back UNKNOWN, found only by KLEE's own bounds check). this->instrumentMemset(); - } else if (this->calleeFunction->getName() == "llvm.memset.p0i8.i32") { - this->instrumentMemset(); - } else if (this->calleeFunction->getName() == "llvm.memcpy.p0i8.p0i8.i64") { - this->instrumentMemcpy(); - } else if (this->calleeFunction->getName() == "llvm.memcpy.p0i8.p0i8.i32") { + } else if (llvm::isa(&*this->currentInstruction) || + calleeName == "memcpy" || calleeName == "memmove") { this->instrumentMemcpy(); + } else if ((calleeName == "printf" || calleeName == "fprintf" || + calleeName == "sprintf" || calleeName == "snprintf" || + calleeName == "puts" || calleeName == "fputs") && + cstringChecksEnabled()) { + this->instrumentCStringArguments(); } else if (this->calleeFunction->getName() == "malloc") { this->instrumentMalloc(); } else if (this->calleeFunction->getName() == "valloc") { @@ -750,6 +897,10 @@ void MemoryTrackPass::prepareMap2CheckInstructions() { Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0)); + this->map2check_check_cstring = F.getParent()->getOrInsertFunction( + "map2check_check_cstring", Type::getVoidTy(*this->Ctx), + PointerType::get(*this->Ctx, 0)); + this->map2check_check_deref = F.getParent()->getOrInsertFunction( "map2check_check_deref", Type::getVoidTy(*this->Ctx), Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0)); diff --git a/modules/backend/pass/MemoryTrackPass.hpp b/modules/backend/pass/MemoryTrackPass.hpp index 2d404a9d2..b80148a21 100644 --- a/modules/backend/pass/MemoryTrackPass.hpp +++ b/modules/backend/pass/MemoryTrackPass.hpp @@ -49,6 +49,9 @@ struct MemoryTrackPass : public llvm::PassInfoMixin { void instrumentRealloc(); void instrumentMemset(); void instrumentMemcpy(); + /** Checks, before a printf-family call or puts/fputs, every string the call + * will read to its terminator (see the definition). */ + void instrumentCStringArguments(); void instrumentPosixMemAllign(); void instrumentFree(); void instrumentInit(); @@ -92,6 +95,7 @@ struct MemoryTrackPass : public llvm::PassInfoMixin { FunctionCallee map2check_non_static_alloca; FunctionCallee map2check_posix; FunctionCallee map2check_load; + FunctionCallee map2check_check_cstring; FunctionCallee map2check_check_deref; FunctionCallee map2check_function; FunctionCallee map2check_free_resolved_address; diff --git a/modules/backend/pass/NonDetFunctions.hpp b/modules/backend/pass/NonDetFunctions.hpp index d22bb6745..7acfef727 100644 --- a/modules/backend/pass/NonDetFunctions.hpp +++ b/modules/backend/pass/NonDetFunctions.hpp @@ -53,6 +53,12 @@ using llvm::Type; Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getDoubleTy(*Ctx), \ PointerType::get(*Ctx, 0)); +#define NON_DET_FUNCTIONS_HELPER_I64(type, c_type) \ + this->NonDet##type = F->getParent()->getOrInsertFunction( \ + "map2check_nondet_" #c_type, Type::getVoidTy(*Ctx), \ + Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt64Ty(*Ctx), \ + PointerType::get(*Ctx, 0)); + class NonDetFunctions { CONSTANT_GENERATOR(Integer) CONSTANT_GENERATOR(Unsigned) @@ -70,6 +76,12 @@ class NonDetFunctions { CONSTANT_GENERATOR(Sector_t) CONSTANT_GENERATOR(Uint) CONSTANT_GENERATOR(Double) + CONSTANT_GENERATOR(Float) + CONSTANT_GENERATOR(Longlong) + CONSTANT_GENERATOR(Ulonglong) + CONSTANT_GENERATOR(U8) + CONSTANT_GENERATOR(U16) + CONSTANT_GENERATOR(U32) // Constant* NonDetAssume = NULL; public: @@ -90,6 +102,13 @@ class NonDetFunctions { NON_DET_FUNCTIONS_HELPER(Sector_t, sector_t) NON_DET_FUNCTIONS_HELPER(Uint, uint) NON_DET_FUNCTIONS_HELPER_DOUBLE(Double, double) + // A float is logged widened to double (instrumentNonDetFloat). + NON_DET_FUNCTIONS_HELPER_DOUBLE(Float, float) + NON_DET_FUNCTIONS_HELPER_I64(Longlong, longlong) + NON_DET_FUNCTIONS_HELPER_I64(Ulonglong, ulonglong) + NON_DET_FUNCTIONS_HELPER(U8, u8) + NON_DET_FUNCTIONS_HELPER(U16, u16) + NON_DET_FUNCTIONS_HELPER(U32, u32) } }; diff --git a/modules/backend/pass/NonDetPass.cpp b/modules/backend/pass/NonDetPass.cpp index 9ef33a54b..5025ea3b7 100644 --- a/modules/backend/pass/NonDetPass.cpp +++ b/modules/backend/pass/NonDetPass.cpp @@ -28,8 +28,142 @@ inline Instruction *BBIteratorToInst(BasicBlock::iterator i) { } } // namespace +namespace { + +/** Names the benchmarks use for "prune this path", implemented as an abort. + * + * `__VERIFIER_assume` is usually only declared, and the call-site rewriting + * below handles that. These are DEFINED in the program -- the SV-COMP sources + * carry their own body: + * + * void assume_abort_if_not(int cond) { if (!cond) abort(); } + * + * so renaming them would collide with the runtime's own definition. The body + * is replaced instead, which reaches every call site at once. */ +const char *const kAssumeByAbort[] = {"assume_abort_if_not", + "assume_abort_if_not_", + "__VERIFIER_assume", + // The XCSP family spells it this way, + // and spelling was the whole difference: + // 59 of 59 XCSP tasks answered + // "program correct" in two seconds + // because the first failing assumption + // aborted the run, and every one of + // those programs has a reachable bug. + // Same defect as the name above, missed + // for being one word shorter. + "assume"}; + +/** Rewrites such a function to a real assume. Returns true if it rewrote. + * + * Aborting on a failed assumption is not merely slow, it is wrong twice over. + * KLEE runs here with --exit-on-error-type=Abort, so the FIRST path that + * violates an assumption halts the whole search -- discarding every path not + * yet explored. And the abort leaves an abort.err behind that looks exactly + * like a real violation, which is how a path the competition considers out of + * scope came back as a test case: one measured suite carried 25 inputs and + * covered 0.0%. + * + * Measured over the 818-task Cover-Error corpus, the categories saturated with + * this idiom are the ones with no recall at all -- Sequentialized 86% of tasks + * and 0 confirmed, Floats 82% and 0, Arrays 71% and 1. */ +bool rewriteAssumeToPrune(Function &F) { + if (F.isDeclaration()) return false; + bool named = false; + for (const char *candidate : kAssumeByAbort) { + if (F.getName() == candidate) { + named = true; + break; + } + } + if (!named) return false; + // The signature check carries more weight now that a name as generic as + // "assume" is on the list: void(int) is the assumption idiom's shape, and a + // function called assume with any other shape is something else and is left + // alone. + if (F.arg_size() != 1 || !F.getArg(0)->getType()->isIntegerTy()) return false; + if (!F.getReturnType()->isVoidTy()) return false; + + LLVMContext &ctx = F.getContext(); + llvm::Type *int32 = llvm::Type::getInt32Ty(ctx); + llvm::Value *condition = F.getArg(0); + + F.deleteBody(); + BasicBlock *entry = BasicBlock::Create(ctx, "entry", &F); + IRBuilder<> builder(entry); + llvm::FunctionCallee assume = F.getParent()->getOrInsertFunction( + "map2check_assume", llvm::Type::getVoidTy(ctx), int32); + builder.CreateCall(assume, {builder.CreateSExtOrTrunc(condition, int32)}); + builder.CreateRetVoid(); + llvm::errs() << "[map2check] rewrote " << F.getName() + << " to prune the path instead of aborting\n"; + return true; +} + +/** Rewrites the program's own calls to abort() into path pruning. Returns how + * many it rewrote. + * + * In SV-COMP, abort() is not an error -- reach_error is the only one -- it is + * how a program discards a path, and the benchmarks write that assumption + * inline as well as through assume_abort_if_not: + * + * i2 = init(); + * if(!(i2)) {abort();} + * + * KLEE runs with --exit-on-error-type=Abort, so the first path violating such + * an assumption ended the whole search, with exit status 0, and the run + * answered TRUE for a program whose bug lay further on. Measured: every wrong + * TRUE of the tacasv2 control arm in the R15 Cover-Error sample (the + * seq-mthreaded/pals_* family and float-benchs/sin_interpolated_index-1). + * + * This runs on the user's module before the runtime is linked, so every abort + * here is the program's; the runtime's own abort (the one that signals a + * recorded violation) is never touched. A violation is still reported the same + * way: TargetPass instruments reach_error itself, so a `{reach_error(); + * abort();}` records the violation before the rewritten abort is reached. */ +unsigned rewriteAbortCallsToPrune(Function &F) { + std::vector aborts; + for (BasicBlock &block : F) { + for (Instruction &instruction : block) { + if (CallInst *call = dyn_cast(&instruction)) { + Function *callee = call->getCalledFunction(); + if (callee != nullptr && callee->getName() == "abort" && + call->arg_size() == 0) { + aborts.push_back(call); + } + } + } + } + if (aborts.empty()) return 0; + + LLVMContext &ctx = F.getContext(); + llvm::Type *int32 = llvm::Type::getInt32Ty(ctx); + llvm::FunctionCallee assume = F.getParent()->getOrInsertFunction( + "map2check_assume", llvm::Type::getVoidTy(ctx), int32); + for (CallInst *call : aborts) { + IRBuilder<> builder(call); + llvm::CallInst *pruned = + builder.CreateCall(assume, {llvm::ConstantInt::get(int32, 0)}); + pruned->setDebugLoc(call->getDebugLoc()); + call->eraseFromParent(); + } + llvm::errs() << "[map2check] rewrote " << aborts.size() << " abort() call(s)" + << " in " << F.getName() << " to prune the path\n"; + return aborts.size(); +} + +} // namespace + PreservedAnalyses NonDetPass::run(Function &F, llvm::FunctionAnalysisManager &AM) { + // Before anything else: this replaces the whole body, so instrumenting the + // old one first would be work thrown away. + if (rewriteAssumeToPrune(F)) { + return PreservedAnalyses::none(); + } + + rewriteAbortCallsToPrune(F); + this->nonDetFunctions = make_unique(&F, &F.getContext()); bool initializedFunctionName = false; for (Function::iterator bb = F.begin(), e = F.end(); bb != e; ++bb) { @@ -89,6 +223,22 @@ void NonDetPass::runOnCallInstruction(CallInst *callInst, LLVMContext *Ctx) { CALL_IF_HELPER(Sector_t, SECTOR_T, sector_t) CALL_IF_HELPER(Uint, UINT, uint) CALL_IF_HELPER(Double, DOUBLE, double) + // Issue #74. Unmodeled, each of these stayed an external call KLEE could + // not resolve ("failed external call: __VERIFIER_nondet_ulonglong"), which + // killed every path through it: all of Intel-TDX and most of Floats came + // back UNKNOWN with zero completed paths. + CALL_IF_HELPER(Float, FLOAT, float) + CALL_IF_HELPER(Longlong, LONGLONG, longlong) + CALL_IF_HELPER(Ulonglong, ULONGLONG, ulonglong) + CALL_IF_HELPER(U8, U8, u8) + CALL_IF_HELPER(U16, U16, u16) + CALL_IF_HELPER(U32, U32, u32) + + // Renamed only: it returns nothing to log at the call site, so the runtime + // logs the bytes it writes (map2check_non_det_memory). + if (calleeFunction->getName() == "__VERIFIER_nondet_memory") { + this->instrumentNonDet(NonDetType::MEMORY, calleeFunction); + } if ((calleeFunction->getName() == "__VERIFIER_assume")) { this->instrumentNonDet(NonDetType::ASSUME, calleeFunction); @@ -101,11 +251,27 @@ void NonDetPass::runOnCallInstruction(CallInst *callInst, LLVMContext *Ctx) { } namespace { -#define INSTRUMENT_CASE_HELPER(nondet_type, c_type) \ - case (NonDetType::nondet_type): { \ - Twine non_det("map2check_non_det_" #c_type); \ - calleeFunction->setName(non_det); \ - break; \ +/** Gives `callee` the runtime's name `name`. When the module already has a + * function by that name of the same type, the calls are redirected to it + * instead: renaming onto an occupied name makes LLVM suffix it + * (map2check_assume.1), a symbol the runtime does not define. That happens + * when rewriteAbortCallsToPrune has declared map2check_assume before the + * program's own __VERIFIER_assume is reached: the native builds failed to link + * and the run answered UNKNOWN (review of #73). */ +void adoptRuntimeName(Function *callee, const std::string &name) { + Function *existing = callee->getParent()->getFunction(name); + if (existing != nullptr && existing != callee && + existing->getFunctionType() == callee->getFunctionType()) { + callee->replaceAllUsesWith(existing); + return; + } + callee->setName(name); +} + +#define INSTRUMENT_CASE_HELPER(nondet_type, c_type) \ + case (NonDetType::nondet_type): { \ + adoptRuntimeName(calleeFunction, "map2check_non_det_" #c_type); \ + break; \ } } // namespace void NonDetPass::instrumentNonDet(NonDetType nonDetType, @@ -127,14 +293,19 @@ void NonDetPass::instrumentNonDet(NonDetType nonDetType, INSTRUMENT_CASE_HELPER(SECTOR_T, sector_t) INSTRUMENT_CASE_HELPER(UINT, uint) INSTRUMENT_CASE_HELPER(DOUBLE, double) + INSTRUMENT_CASE_HELPER(FLOAT, float) + INSTRUMENT_CASE_HELPER(LONGLONG, longlong) + INSTRUMENT_CASE_HELPER(ULONGLONG, ulonglong) + INSTRUMENT_CASE_HELPER(U8, u8) + INSTRUMENT_CASE_HELPER(U16, u16) + INSTRUMENT_CASE_HELPER(U32, u32) + INSTRUMENT_CASE_HELPER(MEMORY, memory) case (NonDetType::ASSUME): { - Twine assume("map2check_assume"); - calleeFunction->setName(assume); + adoptRuntimeName(calleeFunction, "map2check_assume"); break; } case (NonDetType::CRAB_ASSUME): { - Twine assume("map2check_crab_assume"); - calleeFunction->setName(assume); + adoptRuntimeName(calleeFunction, "map2check_crab_assume"); break; } } @@ -192,12 +363,36 @@ namespace { this->nonDetFunctions->getNonDet##type##Function(); \ builder.CreateCall(NonDetFunction, args); \ } +/* Widened to double: the log keeps one floating-point member. */ +#define NONDET_IMPL_HELPER_FLOAT(type) \ + void NonDetPass::instrumentNonDet##type(CallInst *callInst, \ + LLVMContext *Ctx) { \ + auto j = this->currentInstruction; \ + j++; \ + IRBuilder<> builder(BBIteratorToInst(j)); \ + Value *function_llvm = this->getFunctionNameValue(); \ + Value *widened = \ + builder.CreateFPExt(callInst, Type::getDoubleTy(*Ctx)); \ + DebugInfo debugInfo(Ctx, callInst); \ + Value *args[] = {debugInfo.getLineNumberValue(), \ + debugInfo.getScopeNumberValue(), widened, \ + function_llvm}; \ + FunctionCallee NonDetFunction = \ + this->nonDetFunctions->getNonDet##type##Function(); \ + builder.CreateCall(NonDetFunction, args); \ + } } // namespace NONDET_IMPL_HELPER(Integer) NONDET_IMPL_HELPER(Unsigned) NONDET_IMPL_HELPER(Uint) NONDET_IMPL_HELPER(Double) +NONDET_IMPL_HELPER_FLOAT(Float) +NONDET_IMPL_HELPER(Longlong) +NONDET_IMPL_HELPER(Ulonglong) +NONDET_IMPL_HELPER(U32) +NONDET_IMPL_HELPER_CAST(U8) +NONDET_IMPL_HELPER_CAST(U16) NONDET_IMPL_HELPER_CAST(Char) NONDET_IMPL_HELPER_CAST(Ushort) NONDET_IMPL_HELPER_CAST(Short) diff --git a/modules/backend/pass/NonDetPass.hpp b/modules/backend/pass/NonDetPass.hpp index bbe5bd86a..88b0113f7 100644 --- a/modules/backend/pass/NonDetPass.hpp +++ b/modules/backend/pass/NonDetPass.hpp @@ -57,7 +57,14 @@ enum class NonDetType { SECTOR_T, UINT, CRAB_ASSUME, - DOUBLE + DOUBLE, + FLOAT, + LONGLONG, + ULONGLONG, + U8, + U16, + U32, + MEMORY }; namespace InstrumentNonDetS { @@ -95,6 +102,12 @@ struct NonDetPass : public llvm::PassInfoMixin { INSTRUMENT_HEADER_HELPER(Sector_t) INSTRUMENT_HEADER_HELPER(Uint) INSTRUMENT_HEADER_HELPER(Double) + INSTRUMENT_HEADER_HELPER(Float) + INSTRUMENT_HEADER_HELPER(Longlong) + INSTRUMENT_HEADER_HELPER(Ulonglong) + INSTRUMENT_HEADER_HELPER(U8) + INSTRUMENT_HEADER_HELPER(U16) + INSTRUMENT_HEADER_HELPER(U32) void instrumentCrabAssume(CallInst *callInst, LLVMContext *Ctx); std::unique_ptr nonDetFunctions; Value *functionName = NULL; diff --git a/modules/backend/pass/OperationsFunctions.hpp b/modules/backend/pass/OperationsFunctions.hpp index ab02b77b3..1e12bece1 100644 --- a/modules/backend/pass/OperationsFunctions.hpp +++ b/modules/backend/pass/OperationsFunctions.hpp @@ -41,6 +41,7 @@ class OperationsFunctions { FunctionCallee OverflowMul; FunctionCallee OverflowMulUint; FunctionCallee OverflowSDiv; + FunctionCallee OverflowSRem; FunctionCallee OverflowError; public: @@ -51,50 +52,51 @@ class OperationsFunctions { FunctionCallee getOverflowMul() { return this->OverflowMul; } FunctionCallee getOverflowMulUint() { return this->OverflowMulUint; } FunctionCallee getOverflowSDiv() { return this->OverflowSDiv; } + FunctionCallee getOverflowSRem() { return this->OverflowSRem; } FunctionCallee getOverflowError() { return this->OverflowError; } + // Signed binop checkers share one ABI: + // (i64 lhs, i64 rhs, i32 width, i32 line, i32 scope, ptr functionName) + // + // The operands are sign-extended to i64 by the pass (lossless), and `width` + // carries the bit width of the *result type of the operation*. That is the + // quantity SV-COMP's no-overflow property is defined over, so the runtime + // must range-check against it rather than against a fixed width. Keeping a + // single 64-bit ABI (instead of one symbol per width) mirrors how UBSan's + // __ubsan_handle_*_overflow handlers take the type as a parameter. OperationsFunctions(Function *F, LLVMContext *Ctx) { // LLVM 16: opaque pointers — use PointerType::get(*Ctx, 0) instead of PointerType::get(, 0) auto *PtrTy = PointerType::get(*Ctx, 0); + auto *I64 = Type::getInt64Ty(*Ctx); + auto *I32 = Type::getInt32Ty(*Ctx); + auto *VoidTy = Type::getVoidTy(*Ctx); this->OverflowAdd = F->getParent()->getOrInsertFunction( - "map2check_binop_add", Type::getVoidTy(*Ctx), Type::getInt64Ty(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - PtrTy); + "map2check_binop_add", VoidTy, I64, I64, I32, I32, I32, PtrTy); this->OverflowAddUint = F->getParent()->getOrInsertFunction( - "map2check_binop_add_uint", Type::getVoidTy(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - Type::getInt64Ty(*Ctx), PtrTy); + "map2check_binop_add_uint", VoidTy, I64, I64, I32, I32, I32, PtrTy); this->OverflowSub = F->getParent()->getOrInsertFunction( - "map2check_binop_sub", Type::getVoidTy(*Ctx), Type::getInt64Ty(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - PtrTy); + "map2check_binop_sub", VoidTy, I64, I64, I32, I32, I32, PtrTy); this->OverflowSubUint = F->getParent()->getOrInsertFunction( - "map2check_binop_sub_uint", Type::getVoidTy(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - Type::getInt64Ty(*Ctx), PtrTy); + "map2check_binop_sub_uint", VoidTy, I64, I64, I32, I32, I32, PtrTy); this->OverflowMul = F->getParent()->getOrInsertFunction( - "map2check_binop_mul", Type::getVoidTy(*Ctx), Type::getInt64Ty(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - PtrTy); + "map2check_binop_mul", VoidTy, I64, I64, I32, I32, I32, PtrTy); this->OverflowMulUint = F->getParent()->getOrInsertFunction( - "map2check_binop_mul_uint", Type::getVoidTy(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - Type::getInt64Ty(*Ctx), PtrTy); + "map2check_binop_mul_uint", VoidTy, I64, I64, I32, I32, I32, PtrTy); this->OverflowSDiv = F->getParent()->getOrInsertFunction( - "map2check_binop_sdiv", Type::getVoidTy(*Ctx), Type::getInt64Ty(*Ctx), - Type::getInt64Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), - PtrTy); + "map2check_binop_sdiv", VoidTy, I64, I64, I32, I32, I32, PtrTy); - this->OverflowError = F->getParent()->getOrInsertFunction( - "overflowError", Type::getVoidTy(*Ctx), Type::getInt32Ty(*Ctx), - PtrTy); + this->OverflowSRem = F->getParent()->getOrInsertFunction( + "map2check_binop_srem", VoidTy, I64, I64, I32, I32, I32, PtrTy); + + this->OverflowError = + F->getParent()->getOrInsertFunction("overflowError", VoidTy, I32, PtrTy); } }; diff --git a/modules/backend/pass/OverflowPass.cpp b/modules/backend/pass/OverflowPass.cpp index 62d1f50ce..86f37bf39 100644 --- a/modules/backend/pass/OverflowPass.cpp +++ b/modules/backend/pass/OverflowPass.cpp @@ -20,10 +20,12 @@ using llvm::CallInst; using llvm::cast; using llvm::CastInst; +using llvm::ConstantInt; using llvm::DbgDeclareInst; using llvm::DIBasicType; using llvm::DILocalVariable; using llvm::dyn_cast; +using llvm::IntegerType; using llvm::IRBuilder; using llvm::isa; using llvm::LoadInst; @@ -250,8 +252,6 @@ PreservedAnalyses OverflowPass::run(Function &F, } if (BinaryOperator *binOp = dyn_cast(&*i)) { - BasicBlock::iterator currentInstruction = i; - Twine bitcast("map2check_pointer_cast"); DebugInfo debugInfo(&F.getContext(), binOp); @@ -259,8 +259,10 @@ PreservedAnalyses OverflowPass::run(Function &F, Value *firstOperand = binOp->getOperand(0); Value *secondOperand = binOp->getOperand(1); - currentInstruction++; - IRBuilder<> builder(BBIteratorToInst(currentInstruction)); + // Insert the runtime check BEFORE the arithmetic operation: for + // division by zero the operation itself traps (SIGFPE), so a check + // inserted after it would never run. + IRBuilder<> builder(BBIteratorToInst(i)); // errs() << debugInfo.getLineNumberInt() << "=============\n"; // get only variable names @@ -385,7 +387,7 @@ PreservedAnalyses OverflowPass::run(Function &F, break; case (Instruction::SRem): - + instrumentedFunction = this->operationsFunctions->getOverflowSRem(); break; case (Instruction::FRem): @@ -413,28 +415,31 @@ PreservedAnalyses OverflowPass::run(Function &F, break; } - if (instrumentedFunction) { - Value *firstOperand64Ty; - if (firstOperand->getType() == Type::getInt32Ty(*Ctx)) { - firstOperand64Ty = CastInst::CreateIntegerCast( - firstOperand, Type::getInt64Ty(*Ctx), false, "cast", - BBIteratorToInst(i)); - } else { - firstOperand64Ty = firstOperand; - } - - Value *secondOperand64Ty; - if (secondOperand->getType() == Type::getInt32Ty(*Ctx)) { - secondOperand64Ty = CastInst::CreateIntegerCast( - secondOperand, Type::getInt64Ty(*Ctx), false, "cast", - BBIteratorToInst(i)); - } else { - secondOperand64Ty = secondOperand; - } - - Value *args[] = {firstOperand64Ty, secondOperand64Ty, + // SV-COMP defines no-overflow over "the resulting type of an + // operation", so the check has to know that type's width: an i32 add + // that wraps must be reported even though the same values never wrap + // once widened. We therefore sign-extend both operands to the common + // i64 ABI (lossless) and pass the operation's own width alongside, and + // let the runtime range-check against it. Instrumenting only i32 would + // silently miss every long/long long case (Juliet CWE190/CWE191). + auto *opType = dyn_cast(binOp->getType()); + if (instrumentedFunction && opType && opType->getBitWidth() <= 64 && + firstOperand->getType() == opType && + secondOperand->getType() == opType) { + auto *I64 = Type::getInt64Ty(*Ctx); + Value *firstOperand64Ty = + builder.CreateSExtOrBitCast(firstOperand, I64, "m2c.sext"); + Value *secondOperand64Ty = + builder.CreateSExtOrBitCast(secondOperand, I64, "m2c.sext"); + Value *width = ConstantInt::get(Type::getInt32Ty(*Ctx), + opType->getBitWidth()); + + Value *args[] = {firstOperand64Ty, + secondOperand64Ty, + width, debugInfo.getLineNumberValue(), - debugInfo.getScopeNumberValue(), functionName}; + debugInfo.getScopeNumberValue(), + functionName}; builder.CreateCall(instrumentedFunction, args); } else { diff --git a/modules/backend/pass/TargetPass.cpp b/modules/backend/pass/TargetPass.cpp index 5ba7d30fe..de403a9b4 100644 --- a/modules/backend/pass/TargetPass.cpp +++ b/modules/backend/pass/TargetPass.cpp @@ -10,12 +10,81 @@ #include "TargetPass.hpp" +#include + #include #include +namespace { + +/// Counts the call sites TargetPass will match, across the whole module. +unsigned countTargetCallSites(const llvm::Module& M, llvm::StringRef Name) { + unsigned sites = 0; + for (const Function& Fn : M) { + for (const BasicBlock& BB : Fn) { + for (const llvm::Instruction& I : BB) { + const CallInst* callInst = dyn_cast(&I); + if (callInst == nullptr) continue; + const Function* callee = callInst->getCalledFunction(); + if (callee == nullptr) { + callee = dyn_cast( + callInst->getCalledOperand()->stripPointerCasts()); + } + if (callee != nullptr && callee->getName() == Name) ++sites; + } + } + } + return sites; +} + +} // namespace + PreservedAnalyses TargetPass::run(Function& F, llvm::FunctionAnalysisManager& AM) { - llvm::errs() << "Running TargetPass with: " << this->targetFunctionName; + // Was an unconditional per-FUNCTION write to errs(), which is unbuffered: + // one syscall for every function in the module, every time the pass runs, + // and under the hybrid the pass runs once per engine. On the large ECA and + // Recursive programs it also buried the actual output -- the log of a run + // that produced no verdict was tens of thousands of copies of this line. + // Kept behind the environment switch the other passes use, so it is still + // reachable when debugging the pass itself. + if (getenv("MAP2CHECK_DEBUG_PASSES") != nullptr) { + llvm::errs() << "Running TargetPass with: " << this->targetFunctionName + << "\n"; + } + + // Reported once per module, not once per function. This is a function pass, + // so there is no module-entry hook to hang it on; opt runs once per + // invocation, which makes a local static the honest way to say "first + // function we see". + // + // A target that is never called is NOT an error. If a program genuinely + // never calls reach_error, then "the error is unreachable" is the correct + // answer and TRUE is right. What is wrong is that such a TRUE looks exactly + // like a TRUE earned by exploring the program, and nothing in the output + // tells them apart. + // + // That indistinguishability is the whole of finding B. The CASTLE harness + // mapped seven CWEs onto `--target-function-name main`; TargetPass looks for + // calls TO main, a program does not call its own entry point, so zero sites + // were instrumented. Measured on the v6 baseline: 98 of 217 runs went through + // that mode and produced TRUE, TIMEOUT or ERROR -- not one FALSE among them, + // on 59 programs known to be vulnerable. Twelve of those runs were scored as + // true negatives, credit for answers an oracle that can only say "correct" + // could not have failed to give. + static bool announcedTargetCoverage = false; + if (!announcedTargetCoverage) { + announcedTargetCoverage = true; + if (countTargetCallSites(*F.getParent(), this->targetFunctionName) == 0) { + llvm::errs() << "\n[map2check] WARNING: target function '" + << this->targetFunctionName + << "' is never called in this module. TargetPass" + " instruments call sites, so nothing was instrumented" + " and the reachability property holds trivially: a TRUE" + " verdict here means the target is absent, not that the" + " program is safe.\n"; + } + } this->targetFunctionMap2Check = F.getParent()->getOrInsertFunction( "map2check_target_function", Type::getVoidTy(F.getContext()), diff --git a/modules/frontend/CMakeLists.txt b/modules/frontend/CMakeLists.txt index b40e4df10..edc9e75d1 100644 --- a/modules/frontend/CMakeLists.txt +++ b/modules/frontend/CMakeLists.txt @@ -2,6 +2,7 @@ add_subdirectory(utils) add_subdirectory(counter_example) add_subdirectory(witness) +add_subdirectory(test_suite) # Version string embedded in the binary (--version / help banner). # The release pipeline overrides it with -DMAP2CHECK_VERSION=; # regular builds fall back to the project() version. @@ -28,11 +29,28 @@ add_executable(map2check map2check.cpp $ $ $ - $) + $ + $ + $) target_include_directories(map2check PRIVATE "${CMAKE_CURRENT_BINARY_DIR}") #set_target_properties(map2check PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) #-lrt -ldl -ltinfo -lpthread -lz -lm target_link_libraries(map2check ${Boost_LIBRARIES}) + +# --alternate-engines watches KLEE's progress in its SQLite stats database +# (tacas 3b). Optional: without SQLite -- the CI images do not install it -- +# KLEE runs to its window and only the fuzzer stops on stagnation. +find_package(Threads REQUIRED) +target_link_libraries(map2check Threads::Threads) +find_package(SQLite3) +if(SQLite3_FOUND) + target_compile_definitions(Caller PRIVATE MAP2CHECK_HAVE_SQLITE) + target_include_directories(Caller PRIVATE ${SQLite3_INCLUDE_DIRS}) + target_link_libraries(map2check ${SQLite3_LIBRARIES} ${CMAKE_DL_LIBS}) + message(STATUS "SQLite3 found: KLEE stagnation detection enabled") +else() + message(STATUS "SQLite3 not found: KLEE stagnation detection disabled") +endif() install (TARGETS map2check DESTINATION .) diff --git a/modules/frontend/caller.cpp b/modules/frontend/caller.cpp index 7335c1955..bc2bd7d3c 100644 --- a/modules/frontend/caller.cpp +++ b/modules/frontend/caller.cpp @@ -17,17 +17,34 @@ #include // CPP Libs #include +#include #include #include #include #include +#include +#include +#include #include #include +#include #include #include +#include +#include + +#ifdef MAP2CHECK_HAVE_SQLITE +#include +#endif + +#include "test_suite/ktest_reader.hpp" +#include "test_suite/test_suite.hpp" #include "utils/gen_crypto_hash.hpp" +#include "utils/alternation.hpp" #include "utils/log.hpp" +#include "utils/seed_store.hpp" +#include "utils/slicer.hpp" #include "utils/tools.hpp" // namespace fs = boost::filesystem; // } // namespace @@ -59,12 +76,22 @@ Caller::Caller(std::string bc_program_path, Map2CheckMode mode, this->nonDetGenerator = generator; GenHash hash; hash.setFilePath(bc_program_path); - hash.generate_sha1_hash_for_file(); + if (hash.generate_sha1_hash_for_file() != 0) { + throw std::runtime_error("cannot read the input program " + + bc_program_path); + } this->programHash = hash.getOutputSha1HashFile() + ".map2check"; + // The scratch directory is named after the SHA-1 of the input bitcode, so it + // is content-derived and not run-derived: analysing the same input twice + // resolves to the same name. A plain mkdir over an existing directory fails + // silently and leaves whatever a previous, possibly aborted, run left behind + // -- including map2check_property. Now that a recorded violation survives a + // budget expiry, a stale property file would be read as a real result and + // fabricate a FALSE. Start from an empty directory. std::ostringstream createTempDir; createTempDir.str(""); - createTempDir << "mkdir " << programHash; + createTempDir << "rm -rf " << programHash << " && mkdir " << programHash; system(createTempDir.str().c_str()); std::ostringstream moveProgram; @@ -73,11 +100,62 @@ Caller::Caller(std::string bc_program_path, Map2CheckMode mode, Map2Check::Log::Debug("Changing current dir"); currentPath = std::filesystem::current_path().string(); + seedStore = Map2Check::seedStorePath(currentPath, programHash); + sliceCache = Map2Check::sliceCachePath(currentPath, programHash); + buildCache = currentPath + "/" + programHash + ".build"; std::filesystem::current_path(currentPath + "/" + programHash); Map2Check::Log::Debug("Current path: " + std::filesystem::current_path().string()); } +namespace { +/** Wall-clock start of the PROCESS, not of this Caller. + * + * The hybrid rebuilds the Caller once per engine, so a per-object start time + * would reset the clock at every phase and defeat the whole point. Function + * static: initialised on the first call, which happens before any engine runs. + */ +std::chrono::steady_clock::time_point processStart() { + static const std::chrono::steady_clock::time_point start = + std::chrono::steady_clock::now(); + return start; +} +} // namespace + +unsigned Caller::remainingOf(unsigned timeout) { + const auto elapsed = std::chrono::duration_cast( + std::chrono::steady_clock::now() - processStart()) + .count(); + const long long left = static_cast(timeout) - elapsed; + return left < 1 ? 1u : static_cast(left); +} + +unsigned Caller::remainingSeconds() const { + const auto elapsed = std::chrono::duration_cast( + std::chrono::steady_clock::now() - processStart()) + .count(); + if (elapsed < 0) return this->timeout; + const long long left = static_cast(this->timeout) - elapsed; + // Never zero. A phase given no time at all is a phase that cannot even + // report that it had none, and the caller has no way to tell that apart + // from a crash. + return left < 1 ? 1u : static_cast(left); +} + +bool Caller::ssaPreoptimization() const { + // Reachability and assert only. The memory modes track locals through the + // allocas mem2reg removes (a pointer kept in a local, promoted, made a + // legitimate free() look invalid: FALSE-FREE on safe programs), the overflow + // mode lost detections, and simplifycfg turns branches into selects, which + // is fewer paths and fewer Cover-Branches test cases. + if (map2checkMode != Map2CheckMode::REACHABILITY_MODE && + map2checkMode != Map2CheckMode::ASSERT_MODE) { + return false; + } + const char *knob = std::getenv("MAP2CHECK_PREOPT"); + return knob != nullptr && std::string(knob) == "ssa"; +} + std::string Caller::preOptimizationFlags() { std::ostringstream flags; flags.str(""); @@ -92,6 +170,689 @@ std::string Caller::postOptimizationFlags() { return flags.str(); } +namespace { +/** KLEE's covered-instruction count, from the last row of the SQLite stats + * database it rewrites every second; -1 when it cannot be read (not created + * yet, busy, or a build without SQLite). */ +long long kleeCoveredInstructions(const std::string &statsPath) { +#ifdef MAP2CHECK_HAVE_SQLITE + sqlite3 *db = nullptr; + long long covered = -1; + if (sqlite3_open_v2(statsPath.c_str(), &db, SQLITE_OPEN_READONLY, nullptr) == + SQLITE_OK) { + sqlite3_busy_timeout(db, 200); + sqlite3_stmt *statement = nullptr; + if (sqlite3_prepare_v2(db, + "SELECT CoveredInstructions FROM stats ORDER BY " + "rowid DESC LIMIT 1", + -1, &statement, nullptr) == SQLITE_OK && + sqlite3_step(statement) == SQLITE_ROW) { + covered = sqlite3_column_int64(statement, 0); + } + sqlite3_finalize(statement); + } + sqlite3_close(db); + return covered; +#else + (void)statsPath; + return -1; +#endif +} + +/** One field of afl-fuzz's fuzzer_stats ("name : value" lines), which it + * rewrites while fuzzing and once more on exit; -1 when the file or the field + * is missing, as when afl-fuzz exited before fuzzing anything. */ +long long aflFuzzerStat(const std::string &statsPath, const std::string &name) { + std::ifstream stats(statsPath); + std::string line; + while (std::getline(stats, line)) { + const size_t colon = line.find(':'); + if (colon == std::string::npos) continue; + std::string field = line.substr(0, colon); + field.erase(field.find_last_not_of(' ') + 1); + if (field != name) continue; + try { + return std::stoll(line.substr(colon + 1)); + } catch (const std::exception &) { + return -1; + } + } + return -1; +} + +/** The .ktest files KLEE wrote, one per path it terminated. */ +size_t kleeTestCount(const std::string &outputDir) { + size_t count = 0; + std::error_code error; + for (const auto &entry : + std::filesystem::directory_iterator(outputDir, error)) { + if (entry.path().extension() == ".ktest") ++count; + } + return count; +} + +/** The last `count` lines of a file. For the log: the scratch directory that + * holds an engine's own output is removed at the end of the run. */ +std::string lastLines(const std::string &path, size_t count) { + std::ifstream file(path); + std::vector lines; + std::string line; + while (std::getline(file, line)) { + lines.push_back(line); + if (lines.size() > count) lines.erase(lines.begin()); + } + std::string tail; + for (const std::string &kept : lines) tail += " " + kept + "\n"; + return tail.empty() ? " (no output)\n" : tail; +} +} // namespace + +int Caller::runKleeWatched(const std::string &command) { + this->stoppedOnStagnation = false; +#ifndef MAP2CHECK_HAVE_SQLITE + return system(command.c_str()); +#else + if (this->stagnationLimit == 0) return system(command.c_str()); + + // The shell's pid becomes the pid of `timeout` through exec, and `timeout` + // forwards a SIGINT to KLEE -- whose handler halts the search cleanly and + // writes the tests of the states it finished. + std::error_code error; + std::filesystem::remove("klee.pid", error); + const std::string wrapped = "echo $$ > klee.pid; exec " + command; + std::atomic done{false}; + int result = 0; + std::thread runner([&wrapped, &done, &result] { + result = system(wrapped.c_str()); + done = true; + }); + + Map2Check::CoverageWatch watch(this->stagnationLimit); + const auto started = std::chrono::steady_clock::now(); + const std::string stats = std::string(Map2Check::kleeOutputDir) + "/run.stats"; + while (!done) { + for (int tick = 0; tick < 4 && !done; ++tick) { + std::this_thread::sleep_for(std::chrono::milliseconds(500)); + } + if (done) break; + const double now = std::chrono::duration( + std::chrono::steady_clock::now() - started) + .count(); + if (!watch.stagnated(kleeCoveredInstructions(stats), now)) continue; + + // To KLEE itself, the child of `timeout`: signalled, `timeout` forwards + // to the child AND its process group, KLEE gets two SIGINTs, and the + // second one exits before the halt dump of the live states is written. + pid_t pid = 0; + std::ifstream("klee.pid") >> pid; + pid_t klee = 0; + if (pid > 0) { + std::ifstream children("/proc/" + std::to_string(pid) + "/task/" + + std::to_string(pid) + "/children"); + children >> klee; + } + if (klee > 0) { + kill(klee, SIGINT); + } else if (pid > 0) { + kill(pid, SIGINT); + } + this->stoppedOnStagnation = true; + Map2Check::Log::Warning("KLEE stagnated: no new coverage for " + + std::to_string(this->stagnationLimit) + + " s -- stopping it"); + // A KLEE blocked inside a native external call (Juliet's fscanf variants: + // __isoc99_fscanf handed a uClibc FILE*) never looks at the interrupt + // flag -- nor at its own --max-time -- and used to hold the rest of its + // window until timeout's SIGKILL. Not stopped within the grace, it is + // killed now and the time goes to the next phase. Nothing is lost: a run + // that stagnated is already counted incomplete. + constexpr int kInterruptGraceSeconds = 10; + for (int tick = 0; tick < 2 * kInterruptGraceSeconds && !done; ++tick) { + std::this_thread::sleep_for(std::chrono::milliseconds(500)); + } + if (!done) { + if (klee > 0) { + kill(klee, SIGKILL); + } else if (pid > 0) { + kill(pid, SIGKILL); + } + Map2Check::Log::Warning( + "KLEE did not stop within " + + std::to_string(kInterruptGraceSeconds) + + " s of the interrupt (blocked in an external call?) -- killed it"); + } + break; + } + runner.join(); + return result; +#endif +} + +bool Caller::replayKleeVectorsForViolation() { + // KLEE's partial paths -- the states it dumped at a halt -- stop where the + // search stopped. Run natively, completed with zeros past their end (the + // AFL++ generator's rule), some of them go on to the error: that is how the + // fixed hybrid covered eca-* tasks KLEE left UNKNOWN, by accident, in its + // last fuzzer phase's dry run. Done on purpose here, right after KLEE, and + // without needing --seed-exchange. + std::error_code error; + std::string witness; + for (const auto &entry : + std::filesystem::directory_iterator(buildCache, error)) { + const std::string candidate = + entry.path().string() + "/" + programHash + "-witness-fuzzed.out"; + if (std::filesystem::exists(candidate, error)) witness = candidate; + } + if (witness.empty()) return false; + + std::vector tests; + for (const auto &entry : std::filesystem::directory_iterator( + Map2Check::kleeOutputDir, error)) { + if (entry.path().extension() == ".ktest") { + tests.push_back(entry.path().string()); + } + } + std::sort(tests.begin(), tests.end()); + + const std::string replay = + std::filesystem::absolute("vector-replay", error).string(); + const auto started = std::chrono::steady_clock::now(); + const double allowedSeconds = std::min( + 0.1 * static_cast(this->timeout), + static_cast(this->remainingSeconds()) - 5.0); + if (allowedSeconds < 1.0) return false; + const auto allowed = std::chrono::duration(allowedSeconds); + std::set> seen; + unsigned replayed = 0; + for (const std::string &test : tests) { + if (std::chrono::steady_clock::now() - started >= allowed) break; + const std::vector bytes = + Map2Check::ktestToFuzzerBytes(Map2Check::readKtestFile(test)); + if (!seen.insert(bytes).second) continue; + std::filesystem::remove_all(replay, error); + std::filesystem::create_directories(replay, error); + { + std::ofstream input(replay + "/input", std::ios::binary); + input.write(reinterpret_cast(bytes.data()), + static_cast(bytes.size())); + } + std::ostringstream command; + command << "cd '" << replay << "' && timeout -k 1 2 '" << witness + << "' < input > /dev/null 2>&1"; + system(command.str().c_str()); + ++replayed; + if (!std::filesystem::exists(replay + "/map2check_checked_error", error)) { + continue; + } + // A violation: its files (property, nondet log, trace) become this + // phase's, as a confirmed fuzzer crash's do. + for (const auto &entry : + std::filesystem::directory_iterator(replay, error)) { + if (!entry.is_regular_file(error)) continue; + if (entry.path().filename() == "input") continue; + std::filesystem::copy_file( + entry.path(), entry.path().filename(), + std::filesystem::copy_options::overwrite_existing, error); + } + std::filesystem::remove_all(replay, error); + Map2Check::Log::Info("A KLEE vector completed with zeros reaches the " + "violation (" + std::to_string(replayed) + + " replayed)"); + return true; + } + std::filesystem::remove_all(replay, error); + return false; +} + +void Caller::keepKleeTestsAsSeeds() { + // The latest tests, not the first: KLEE numbers them as states finish, and + // the later ones are the deeper paths the next turn should start from. + std::error_code error; + const std::string kept = seedStore + "/kleeprev"; + std::filesystem::remove_all(kept, error); + std::vector tests; + for (const auto &entry : std::filesystem::directory_iterator( + Map2Check::kleeOutputDir, error)) { + if (entry.path().extension() == ".ktest") { + tests.push_back(entry.path().string()); + } + } + if (tests.empty()) return; + std::sort(tests.begin(), tests.end()); + if (tests.size() > kMaxSeedsFromFuzzer) { + tests.erase(tests.begin(), tests.end() - kMaxSeedsFromFuzzer); + } + std::filesystem::create_directories(kept, error); + for (const std::string &test : tests) { + std::filesystem::copy_file( + test, kept + "/" + std::filesystem::path(test).filename().string(), + std::filesystem::copy_options::overwrite_existing, error); + } +} + +unsigned Caller::exportKleeVectorsAsSeeds() { + std::error_code error; + const std::string aflSeeds = seedStore + "/afl"; + std::filesystem::create_directories(aflSeeds, error); + + std::vector tests; + for (const auto &entry : std::filesystem::directory_iterator( + Map2Check::kleeOutputDir, error)) { + if (entry.path().extension() == ".ktest") { + tests.push_back(entry.path().string()); + } + } + // All of them, not a sample: completed with zeros past their end, some of + // KLEE's partial paths reach the error when the fuzzer runs them -- the + // dry run records them as crashes (sig 06), and that is how the fixed + // hybrid covered eca-* tasks KLEE itself left UNKNOWN. A cap of the 64 + // latest dropped exactly those (R19: 5 eca-* losses of --alternate-engines). + // Calibrating thousands is cheap now that a nondet loop ends on zeros. + std::sort(tests.begin(), tests.end()); + unsigned written = 0; + unsigned index = 0; + for (const std::string &test : tests) { + std::vector objects = + Map2Check::readKtestFile(test); + if (objects.empty()) continue; + + std::vector bytes = Map2Check::ktestToFuzzerBytes(objects); + if (bytes.empty()) continue; + + // Named by index rather than by content hash: AFL++ renames what it + // keeps to its own hash anyway, so a second one here buys nothing. + std::ostringstream name; + name << aflSeeds << "/klee-" << index++; + std::ofstream out(name.str(), std::ios::binary); + if (!out.is_open()) continue; + out.write(reinterpret_cast(bytes.data()), + static_cast(bytes.size())); + if (out.good()) ++written; + } + if (written > 0) { + Map2Check::Log::Info("Seeded the fuzzer corpus with " + + std::to_string(written) + " vectors from KLEE"); + } + return written; +} + +unsigned Caller::exportFuzzerCorpusAsKtests() { + // Each queue entry is replayed through the witness binary, whose runtime + // logs every nondet read with its type (klee_log.csv) -- which is what a + // .ktest needs and what the fuzzer's raw bytes lack. The replay runs in the + // store's replay/, not here: the witness writes map2check_property and + // friends into its working directory, and a replay must never overwrite a + // violation this phase already recorded. + std::error_code error; + const std::string queue = "afl-out/default/queue"; + const std::string replay = seedStore + "/replay"; + const std::string ktests = seedStore + "/ktest"; + const std::string witness = + std::filesystem::absolute(programHash + "-witness-fuzzed.out", error) + .string(); + if (!std::filesystem::exists(witness, error)) return 0; + + std::vector names; + for (const auto &entry : + std::filesystem::directory_iterator(queue, error)) { + if (entry.is_regular_file(error)) { + names.push_back(entry.path().filename().string()); + } + } + // This round's discoveries replace the last round's: KLEE already ran on + // those, and its own tests from that turn (kleeprev/) carry them forward. + std::filesystem::remove_all(ktests, error); + std::filesystem::create_directories(ktests, error); + + // Bounded as a whole, not only per entry: the replays come out of the KLEE + // phase's budget, so they stop at 5% of the run's budget (at least 2 s). + const auto started = std::chrono::steady_clock::now(); + const auto allowed = std::chrono::duration( + std::max(2.0, 0.05 * static_cast(this->timeout))); + std::set> seen; + unsigned written = 0; + for (const std::string &name : + Map2Check::selectQueueEntries(names, kMaxSeedsFromFuzzer)) { + if (std::chrono::steady_clock::now() - started >= allowed) break; + std::filesystem::remove_all(replay, error); + std::filesystem::create_directories(replay, error); + const std::string input = + std::filesystem::absolute(queue + "/" + name, error).string(); + std::ostringstream command; + command << "cd '" << replay << "' && MAP2CHECK_SEED_REPLAY=1 timeout -k 1 2 '" << witness + << "' < '" << input << "' > /dev/null 2>&1"; + system(command.str().c_str()); + + const std::vector objects = + Map2Check::readNonDetLogAsObjects(replay + "/" + + Map2Check::kleeLogCSV); + if (objects.empty()) continue; + if (!Map2Check::isNewVector(Map2Check::ktestToFuzzerBytes(objects), + &seen)) { + continue; + } + if (Map2Check::writeKtestFile( + ktests + "/afl-" + std::to_string(written) + ".ktest", objects)) { + ++written; + } + } + std::filesystem::remove_all(replay, error); + if (written > 0) { + Map2Check::Log::Info("Seeded KLEE with " + std::to_string(written) + + " vectors from AFL++"); + } + return written; +} + +namespace { +/** MAP2CHECK_SLICER_FLAGS / MAP2CHECK_SLICE_CLEANUP: experiment knobs (tacas + * 2d spec), read from the environment so a campaign arm can set them without + * a CLI option nobody else should use. */ +std::string environmentKnob(const char *name) { + const char *value = std::getenv(name); + return value == nullptr ? std::string() : std::string(value); +} +} // namespace + +std::vector> Caller::fuzzerCorpusVectors( + size_t cap) { + std::vector> vectors; + std::error_code error; + const std::string queue = "afl-out/default/queue"; + const std::string replay = + std::filesystem::absolute("suite-replay", error).string(); + const std::string witness = + std::filesystem::absolute(programHash + "-witness-fuzzed.out", error) + .string(); + if (!std::filesystem::exists(witness, error)) return vectors; + + std::vector names; + for (const auto &entry : std::filesystem::directory_iterator(queue, error)) { + if (entry.is_regular_file(error)) { + names.push_back(entry.path().filename().string()); + } + } + const auto started = std::chrono::steady_clock::now(); + const auto allowed = std::chrono::duration( + std::max(2.0, 0.05 * static_cast(this->timeout))); + std::set> seen; + for (const std::string &name : Map2Check::selectQueueEntries(names, cap)) { + if (std::chrono::steady_clock::now() - started >= allowed) break; + std::filesystem::remove_all(replay, error); + std::filesystem::create_directories(replay, error); + const std::string input = + std::filesystem::absolute(queue + "/" + name, error).string(); + std::ostringstream command; + command << "cd '" << replay + << "' && MAP2CHECK_SEED_REPLAY=1 timeout -k 1 2 '" << witness + << "' < '" << input << "' > /dev/null 2>&1"; + system(command.str().c_str()); + std::vector values = + Map2Check::readNonDetLog(replay + "/" + Map2Check::kleeLogCSV); + if (values.empty() || !seen.insert(values).second) continue; + vectors.push_back(values); + } + std::filesystem::remove_all(replay, error); + return vectors; +} + +bool Caller::runSlicer(const std::string &input, const std::string &output, + std::vector primary, bool addRuntimeNames, + const std::string &entry, const std::string &label) { + // Sliced once per run, not once per phase: see Map2Check::sliceCachePath. + std::error_code error; + std::string key; + { + std::ifstream in(input, std::ios::binary); + if (in.is_open()) { + std::stringstream content; + content << in.rdbuf(); + key = Map2Check::sliceCacheKey( + content.str(), label, entry, + environmentKnob("MAP2CHECK_SLICER_FLAGS") + "|" + + environmentKnob("MAP2CHECK_SLICE_CLEANUP")); + } + } + const std::string cached = sliceCache + "/" + key + ".bc"; + const std::string failed = sliceCache + "/" + key + ".failed"; + if (!key.empty() && std::filesystem::exists(failed, error)) { + Map2Check::Log::Warning( + "sbt-slicer produced no usable output (cached from an earlier phase) " + "-- analysing the unsliced program"); + return false; + } + if (!key.empty() && std::filesystem::exists(cached, error) && + std::filesystem::copy_file( + cached, output, std::filesystem::copy_options::overwrite_existing, + error)) { + Map2Check::Log::Info("Slice of " + label + + ": reusing the slice from an earlier phase"); + return true; + } + + const bool sliced = + runSlicerUncached(input, output, primary, addRuntimeNames, entry, label); + if (sliced) cleanUpSlice(output); + if (!key.empty() && std::filesystem::exists(Map2Check::slicerBinary())) { + std::filesystem::create_directories(sliceCache, error); + if (sliced) { + std::filesystem::copy_file( + output, cached, std::filesystem::copy_options::overwrite_existing, + error); + } else { + std::ofstream(failed) << label << "\n"; + } + } + return sliced; +} + +void Caller::cleanUpSlice(const std::string &slice) { + const std::string passes = Map2Check::sliceCleanupPasses( + environmentKnob("MAP2CHECK_SLICE_CLEANUP")); + if (passes.empty()) return; + const std::string cleaned = slice + ".clean.bc"; + std::ostringstream command; + // Bounded like the slicer: a pass pipeline over a large module is not + // free, and it runs outside any engine's window. + const unsigned cleanupBudget = static_cast(std::max( + 2.0, std::min(0.05 * this->timeout, + static_cast(remainingSeconds()) - 5.0))); + command << "timeout -k " << Map2Check::killGracePeriod << " " + << cleanupBudget << " " << Map2Check::optBinary << " " << passes + << " " << slice << " -o " << cleaned << " >> slicer.output 2>&1"; + Map2Check::Log::Debug(command.str()); + std::error_code error; + if (system(command.str().c_str()) == 0 && + std::filesystem::exists(cleaned, error) && + std::filesystem::file_size(cleaned, error) > 0) { + std::filesystem::rename(cleaned, slice, error); + if (!error) return; + } + Map2Check::Log::Warning("could not clean up the slice (" + passes + + ") -- keeping it as sliced"); +} + +bool Caller::runSlicerUncached(const std::string &input, + const std::string &output, + std::vector primary, + bool addRuntimeNames, const std::string &entry, + const std::string &label) { + const std::string slicer = Map2Check::slicerBinary(); + if (!std::filesystem::exists(slicer)) { + // Announced, not silently skipped. A slicer that is asked for and absent + // must not leave the run quietly analysing the whole program: that is how + // --add-invariants stayed dead through a full baseline (issue #54). + Map2Check::Log::Warning( + "slicing was requested but sbt-slicer is not installed at " + slicer + + " -- analysing the unsliced program"); + return false; + } + if (!std::filesystem::exists(input)) return false; + + // Bounded, for the reason every other external step here is bounded: the + // slicer builds a system dependence graph over the whole module, and on the + // large programs that is not fast. A slice that does not finish is not a + // loss -- the caller falls back to the whole program; overrunning the budget + // loses the verdict instead. + const double sliceBudget = std::max( + 1.0, + std::min(0.2 * this->timeout, + std::max(1.0, static_cast(remainingSeconds()) - 5.0))); + + // The program's own names join the criteria: the nondet functions (no fixed + // list knows every name a benchmark declares, and a missing one silently + // shifts the suite), and for the memory properties every map2check_* call + // the instrumentation inserted. Read from the textual IR -- the bitcode + // string table packs names with no separator. If the disassembly fails, the + // fixed nondet list stands. + const std::string inputIR = input + ".ll"; + std::ostringstream disassemble; + disassemble << Map2Check::optBinary << " -S " << input << " -o " << inputIR + << " > /dev/null 2>&1"; + std::vector programNondets; + std::string irText; + if (system(disassemble.str().c_str()) == 0) { + std::ifstream irFile(inputIR); + std::stringstream irStream; + irStream << irFile.rdbuf(); + irText = irStream.str(); + programNondets = Map2Check::nondetNamesInIR(irText); + } + if (addRuntimeNames) { + // The runtime checks decide the property and external calls can commit + // the error themselves: both are criteria. Without the IR there are no + // checks to keep, and a slice would remove them all -- refuse instead of + // falling back to the nondet list, which is only sound for reach/assert. + std::vector runtimeCriteria; + if (!Map2Check::instrumentedSliceCriteria(irText, &runtimeCriteria)) { + Map2Check::Log::Warning( + "could not read the instrumented module's runtime calls -- " + "analysing the unsliced program"); + return false; + } + for (const std::string &name : runtimeCriteria) primary.push_back(name); + } + + // -cutoff-diverging=false: the cutoff rewrites every path that cannot reach + // the criterion into exit(0) with no debug location, and once KLEE links + // uClibc the verifier rejects the module ("Broken module found") -- KLEE + // never ran on a sliced task with a cut path (tacasv2a spec, defect 1). + // --statistics: counts before and after, logged below. + std::ostringstream command; + command << "timeout -k " << Map2Check::killGracePeriod << " " + << static_cast(sliceBudget) << " " << slicer << " -c " + << Map2Check::slicingCriteria(primary, programNondets) + << " --entry=" << entry + << " -cutoff-diverging=false --statistics " + << environmentKnob("MAP2CHECK_SLICER_FLAGS") << " -o " << output << " " + << input << " > slicer.output 2>&1"; + Map2Check::Log::Debug(command.str()); + const int result = system(command.str().c_str()); + + std::error_code error; + const bool produced = std::filesystem::exists(output, error) && + std::filesystem::file_size(output, error) > 0; + if (result != 0 || !produced) { + Map2Check::Log::Warning( + "sbt-slicer produced no usable output -- analysing the unsliced " + "program"); + return false; + } + + // Reported, because a slice is not a neutral speed-up: it narrows the + // question being answered, and this line is the only visible sign of how + // much was dropped. + const auto before = std::filesystem::file_size(input, error); + const auto after = std::filesystem::file_size(output, error); + std::ifstream slicerLog("slicer.output"); + std::stringstream slicerText; + slicerText << slicerLog.rdbuf(); + Map2Check::Log::Info(Map2Check::describeSlice( + label, Map2Check::parseSlicerStatistics(slicerText.str()), before, + after)); + return true; +} + +bool Caller::sliceWithRespectToTarget(const std::string &targetFunction, + const std::vector &criteria) { + // The COMPILED bitcode, not the instrumented one: this runs before callPass + // so that the instrumentation is applied to the slice rather than removed by + // it. Entry is still plain main at this point, for the same reason. + const std::string input = programHash + "-compiled.bc"; + const std::string output = programHash + "-sliced.bc"; + std::string label; + for (const std::string &name : criteria) { + label += (label.empty() ? "" : ",") + name; + } + if (!runSlicer(input, output, criteria, false, "main", label)) return false; + std::error_code error; + + // sbt-slicer removes the body of the criterion function itself. reach_error + // is where the slice ENDS -- nothing it does can influence whether it is + // reached -- so the slicer keeps the call site and drops the definition. + // + // KLEE tolerates the resulting declaration. The native AFL++ link does + // not: it fails with "undefined reference to reach_error", no *-fuzzed.out + // is produced, and the fuzzer stage then does nothing at all. + // + // A WEAK definition restores the link without displacing a real one: where + // the slice did keep the body, the strong definition still wins. + const std::string stubSource = programHash + "-target-stub.c"; + const std::string stubBitcode = programHash + "-target-stub.bc"; + const std::string linked = programHash + "-sliced-linked.bc"; + { + std::ofstream stub(stubSource); + if (stub.is_open()) { + stub << Map2Check::targetStubSource(targetFunction); + } + } + std::ostringstream compileStub; + compileStub << Map2Check::clangBinary << " -Wno-everything -c -emit-llvm -g" + << " " << Caller::preOptimizationFlags() << " -o " << stubBitcode + << " " << stubSource << " >> slicer.output 2>&1"; + std::ostringstream linkStub; + linkStub << Map2Check::llvmLinkBinary << " " << output << " " << stubBitcode + << " -o " << linked << " >> slicer.output 2>&1"; + if (system(compileStub.str().c_str()) == 0 && + system(linkStub.str().c_str()) == 0 && + std::filesystem::exists(linked, error) && + std::filesystem::file_size(linked, error) > 0) { + std::filesystem::rename(linked, output, error); + } else { + // Not fatal: without the stub the fuzzer stage is lost, but KLEE still + // runs on the slice. Say so rather than returning a half-configured run. + Map2Check::Log::Warning( + "could not restore a definition of " + targetFunction + + " after slicing -- the AFL++ stage will not link"); + } + + std::filesystem::rename(output, input, error); + return !error; +} + +bool Caller::sliceInstrumented() { + // Memory properties have no criterion in the user's program: the property + // is decided by the runtime calls MemoryTrackPass inserted, so the slice is + // taken after instrumentation with every map2check_* call as a criterion + // (none can be dropped), and __map2check_main__ -- the renamed user main -- + // as the entry. tacasv2b spec, section 2. + const std::string input = programHash + "-output.bc"; + const std::string output = programHash + "-sliced-instrumented.bc"; + if (!std::filesystem::exists(input)) return false; + if (!runSlicer(input, output, {}, true, "__map2check_main__", + "map2check runtime")) { + return false; + } + std::error_code error; + std::filesystem::rename(output, input, error); + return !error; +} + +void Caller::restoreWorkingDirectory() { + std::error_code error; + std::filesystem::current_path(currentPath, error); +} + void Caller::cleanGarbage() { std::filesystem::current_path(currentPath); std::ostringstream removeCommand; @@ -112,27 +873,160 @@ void Caller::applyNonDetGenerator() { Map2Check::Log::Info("Applying optimizations for klee"); break; } - case (NonDetGenerator::LibFuzzer): { - Map2Check::Log::Info("Instrumenting with LLVM LibFuzzer"); + case (NonDetGenerator::AFLPlusPlus): { + Map2Check::Log::Info("Instrumenting with AFL++"); + // Built once per run: every fuzzer phase recompiles the same modules, + // and on the eca-* programs the three builds take ~24 s -- per phase, + // which under --alternate-engines was most of each fuzzer turn. Keyed by + // the two modules' content, like the slice cache. + const std::vector aflBinaries = { + programHash + "-fuzzed.out", programHash + "-witness-fuzzed.out", + programHash + "-cmplog.out"}; + std::string buildKey; + { + std::ifstream result(programHash + "-result.bc", std::ios::binary); + std::ifstream witness(programHash + "-witness-result.bc", + std::ios::binary); + std::stringstream content; + content << result.rdbuf() << "|" << witness.rdbuf(); + buildKey = Map2Check::sliceCacheKey(content.str(), "afl++", "", ""); + } + const std::string builtDir = buildCache + "/" + buildKey; + { + std::error_code cacheErr; + if (std::filesystem::exists(builtDir + "/" + aflBinaries[0], + cacheErr)) { + for (const std::string &binary : aflBinaries) { + if (std::filesystem::exists(builtDir + "/" + binary, cacheErr)) { + std::filesystem::copy_file( + builtDir + "/" + binary, binary, + std::filesystem::copy_options::overwrite_existing, cacheErr); + } + } + Map2Check::Log::Info( + "AFL++ binaries: reusing the build of an earlier phase"); + break; + } + } std::ostringstream command; command.str(""); + // Bounded, because it was not, and that is where the budget went. + // + // Both invocations run clang at -O2 over the whole instrumented module. + // On the large ECA and Recursive programs that takes longer than the + // entire budget, and nothing was stopping it: the run was still linking + // its fuzzer binary when the harness's outer timeout killed it, so it + // produced no verdict and scored ERROR. Measured on the v12 corpus: + // 20 such tasks, every one at 87 to 89 seconds against a 60 second + // budget, all of them dying at this exact step. + // + // Losing the fuzzer binary is a real cost, but a bounded one: KLEE still + // gets its phase and the run still reaches a verdict. Spending the whole + // budget here costs the verdict itself. + const double compileBudget = std::max( + 1.0, std::min(0.25 * this->timeout, + std::max(1.0, static_cast(remainingSeconds()) - + 5.0))); + // One budget for the three builds, not one each: sequential, each + // bounded by 0.25T, they could take 0.75T -- on eca-* that ran the + // process past its deadline with no verdict (R19). Each build gets what + // is left of the shared deadline. + const auto buildDeadline = + std::chrono::steady_clock::now() + + std::chrono::duration(compileBudget); + auto bound = [&buildDeadline]() { + const double left = std::chrono::duration( + buildDeadline - std::chrono::steady_clock::now()) + .count(); + return "timeout -k " + std::to_string(Map2Check::killGracePeriod) + + " " + std::to_string(std::max(1, static_cast(left))) + " "; + }; + command - << Map2Check::clangBinary - << " -g -fsanitize=fuzzer -fsanitize-coverage=inline-8bit-counters " - << Caller::postOptimizationFlags() + << bound() << Map2Check::aflClangFastBinary() + << " -g " << Caller::postOptimizationFlags() << " -o " + programHash + "-fuzzed.out" - << " " + programHash + "-result.bc"; + << " " + programHash + "-result.bc" + // libm: a program calling sqrt/pow failed to link ("undefined + // reference to `sqrt'") and lost its fuzzer phase (Juliet CWE190/191, + // 9.0 campaign). KLEE gets libm through uClibc; the native links + // did not. + << " -lm > afl-build.log 2>&1"; - system(command.str().c_str()); + const int built = system(command.str().c_str()); std::ostringstream commandWitness; commandWitness.str(""); - commandWitness << Map2Check::clangBinary << " -g -fsanitize=fuzzer " + commandWitness << bound() << Map2Check::aflClangFastBinary() + << " -g " << " -o " + programHash + "-witness-fuzzed.out" - << " " + programHash + "-witness-result.bc"; + << " " + programHash + "-witness-result.bc -lm"; system(commandWitness.str().c_str()); + + // The CmpLog companion binary: the same program instrumented to log + // the operands of comparisons, which afl-fuzz (-c) uses to solve + // magic-value guards such as `x == 123456` by input-to-state + // substitution. It is AFL++'s counterpart of the value profile the + // previous fuzzer ran with (-use_value_profile=1); without it the + // tacasv1 comparison would pit an unarmed AFL++ against an armed + // LibFuzzer. Optional: if it does not build, the fuzzer runs without. + std::ostringstream commandCmplog; + commandCmplog << "AFL_LLVM_CMPLOG=1 " << bound() + << Map2Check::aflClangFastBinary() << " -g " + << Caller::postOptimizationFlags() + << " -o " + programHash + "-cmplog.out" + << " " + programHash + "-result.bc -lm"; + system(commandCmplog.str().c_str()); + + { + std::error_code cacheErr; + if (std::filesystem::exists(aflBinaries[0], cacheErr)) { + std::filesystem::create_directories(builtDir, cacheErr); + for (const std::string &binary : aflBinaries) { + if (std::filesystem::exists(binary, cacheErr)) { + std::filesystem::copy_file( + binary, builtDir + "/" + binary, + std::filesystem::copy_options::overwrite_existing, cacheErr); + } + } + } + } + + // Announced rather than discovered later as a silent no-op -- the same + // failure mode the sliced arm spent a whole campaign in. And for what it + // is: a link error (an undefined reach_error) used to be reported as a + // build that ran out of time. + std::error_code fuzzErr; + if (!std::filesystem::exists(programHash + "-fuzzed.out", fuzzErr)) { + std::string why; + if (built == 31744) { // timeout's 124 + why = "did not build within " + + std::to_string(static_cast(compileBudget)) + "s"; + } else { + std::ifstream buildLog("afl-build.log"); + // The first complaint names the cause (an undefined reference); + // the last is only clang's "linker command failed". + std::string line, firstError; + while (firstError.empty() && std::getline(buildLog, line)) { + if (line.find("error") != std::string::npos || + line.find("undefined reference") != std::string::npos) { + firstError = line; + } + } + why = "failed to build (status " + std::to_string(built) + ")" + + (firstError.empty() ? "" : ": " + firstError); + } + Map2Check::Log::Warning( + "the AFL++ binary " + why + + " -- skipping the fuzzer phase and leaving the budget to KLEE"); + } else if (!std::filesystem::exists(programHash + "-cmplog.out", + fuzzErr)) { + Map2Check::Log::Warning( + "the AFL++ CmpLog binary did not build -- fuzzing without " + "comparison solving"); + } break; } } @@ -154,12 +1048,14 @@ int Caller::callPass(std::string target_function, bool sv_comp) { std::ostringstream passesArg; passesArg << "nondet-pass"; + bool loadsMemoryTrackPass = false; switch (map2checkMode) { case Map2CheckMode::MEMTRACK_MODE: { Map2Check::Log::Info("Adding memtrack pass"); std::string memPlugin = "${MAP2CHECK_PATH}/lib/libMemoryTrackPass"; transformCommand << " -load-pass-plugin=" << memPlugin << getLibSuffix(); passesArg << ",memory-track"; + loadsMemoryTrackPass = true; break; } case Map2CheckMode::MEMCLEANUP_MODE: { @@ -167,6 +1063,7 @@ int Caller::callPass(std::string target_function, bool sv_comp) { std::string memPlugin = "${MAP2CHECK_PATH}/lib/libMemoryTrackPass"; transformCommand << " -load-pass-plugin=" << memPlugin << getLibSuffix(); passesArg << ",memory-track"; + loadsMemoryTrackPass = true; break; } case Map2CheckMode::OVERFLOW_MODE: { @@ -176,6 +1073,15 @@ int Caller::callPass(std::string target_function, bool sv_comp) { passesArg << ",overflow-pass"; break; } + case Map2CheckMode::COVER_BRANCHES_MODE: { + // Nothing beyond nondet-pass. The inputs have to be recorded, so that + // pass stays; there is no property to instrument for, so nothing else + // does. This is also the leanest pipeline the tool has, which is the + // point: fewer instrumented calls means KLEE explores more paths in the + // same budget, and paths are what a branch suite is made of. + Map2Check::Log::Info("Running cover-branches mode (no property check)"); + break; + } case Map2CheckMode::REACHABILITY_MODE: { Map2Check::Log::Info("Running reachability mode"); Map2Check::Log::Debug("Target function: " + target_function); @@ -205,7 +1111,9 @@ int Caller::callPass(std::string target_function, bool sv_comp) { passesArg << ",map2check-library"; transformCommand << " -entry-function=" << this->entryFunction; - transformCommand << " -m2c-entry-function=" << this->entryFunction; + if (loadsMemoryTrackPass) { + transformCommand << " -m2c-entry-function=" << this->entryFunction; + } if (this->wasmMode) { transformCommand << " -wasm-mode"; } @@ -280,6 +1188,11 @@ void Caller::linkLLVM() { linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeNone.bc"; break; } + case Map2CheckMode::COVER_BRANCHES_MODE: { + // No property, so no analysis -- the run exists to explore and record. + linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeNone.bc"; + break; + } } switch (nonDetGenerator) { @@ -291,8 +1204,8 @@ void Caller::linkLLVM() { linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorKlee.bc"; break; } - case (NonDetGenerator::LibFuzzer): { - linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorLibFuzzy.bc"; + case (NonDetGenerator::AFLPlusPlus): { + linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorAFL.bc"; break; } } @@ -382,9 +1295,150 @@ void Caller::executeAnalysis(std::string solvername) { Map2Check::Log::Info("Executing Klee with map2check"); std::ostringstream kleeCommand; kleeCommand.str(""); - kleeCommand << "timeout " << (0.8 * this->timeout) << " "; + // -k: KLEE installs a SIGTERM handler that tries to shut down gracefully, + // but that handler never runs while the solver is wedged. Plain `timeout` + // then waits forever for a child that will not die, and map2check hangs + // past its own budget. The grace period escalates to SIGKILL so the + // budget is actually enforced. + // Reserve a few seconds for what happens AFTER the engine: reading the + // property file, recovering the input vector, writing the suite. KLEE + // holding the budget to its last second is what turned a decided run + // into an ERROR. + constexpr double kPostEngineReserve = 5.0; + // With the exchange on, the fuzzer gets a real third phase: 0.2 / 0.6 / + // 0.2. Without it the hybrid keeps the 0.2 / 0.8 it was measured with. + // Alternating (--alternate-engines), main hands each phase its window. + const double kleeShare = this->seedExchange ? 0.6 : 0.8; + const double kleeCap = + this->engineWindow > 0 ? this->engineWindow : kleeShare * this->timeout; + const double kleeBudget = std::max( + 1.0, std::min(kleeCap, this->remainingSeconds() - kPostEngineReserve)); + kleeCommand << "timeout -k " << Map2Check::killGracePeriod << " " + << static_cast(kleeBudget) << " "; kleeCommand << Map2Check::kleeBinary; + // KLEE's own deadline, set BELOW the external one so it is KLEE that + // stops, not the kill. + // + // Without it every path explored up to the budget is thrown away. + // Measured: a program with twelve nondeterministic reads explored 3982 + // paths and produced ZERO .ktest files, because `timeout` killed KLEE + // before it wrote any -- and those files are where a Cover-Branches + // suite comes from, and where a Cover-Error suite now recovers its + // input vector. Reaching the budget is the NORMAL case in a competition + // run, so this was not an edge: it was the common path discarding all + // of its work. + // + // The external timeout above stays as the backstop for the case its + // comment describes, a solver wedged so deep that KLEE's own deadline + // never gets a turn. + // INTEGER seconds. KLEE parses --max-time with a duration parser that + // rejects a fractional value outright: + // + // KLEE: ERROR: Illegal number format: 36.75s + // + // and exits 256 without running a single instruction. The old expression + // 0.7*timeout happened to be whole for every budget in use, so this + // never showed; 0.875*kleeBudget is whole only when kleeBudget is a + // multiple of 8, and kleeBudget now derives from the time REMAINING, + // which is whatever the clock says. + // + // The cost of getting this wrong is total and silent: no KLEE phase at + // all, so nothing can be proved safe. It collapsed 464 Juliet TN + // verdicts to 1. + kleeCommand << " --max-time=" + << std::max(1u, static_cast(0.875 * kleeBudget)) + << "s"; + + // KLEE's own default cap is 2,000 MB, well under what a Test-Comp run + // gets; past it KLEE kills states and stops forking, and the run can no + // longer be TRUE. MAP2CHECK_KLEE_MAX_MEMORY (MB) raises it. + if (const char *maxMemory = std::getenv("MAP2CHECK_KLEE_MAX_MEMORY")) { + const std::string megabytes(maxMemory); + if (!megabytes.empty() && + megabytes.find_first_not_of("0123456789") == std::string::npos) { + kleeCommand << " --max-memory=" << megabytes; + } + } + + + // Halting on the first error is right when there is a property to + // decide -- the answer is known, and more exploration is waste. It is + // wrong for Cover-Branches, where there is no property and the paths ARE + // the product: stopping at the first error throws away every path not + // yet explored, and with it the test cases they would have produced. + // + // Measured before this: the same twelve-branch program produced 1020 + // .ktest files on one run and zero on the next, the difference being + // whether an error happened to be hit early. A suite that depends on + // that is not a suite. + // A starting point from whatever ran before, when there is one. KLEE + // replays the seed and then explores around it, instead of rediscovering + // from nothing a path the fuzzer already walked -- which under a fixed + // budget is not merely faster, it is depth the run would not otherwise + // have reached. + // KLEE starts from the fuzzer's corpus when there is one, replaying + // each seed and exploring around it instead of rediscovering from + // nothing the paths the fuzzer already walked. --seed-time caps the + // replay at a quarter of the phase, so seeding cannot eat the search. + std::string seedFlag; + if (this->seedExchange) { + std::error_code seedError; + bool haveSeeds = false; + for (const auto &entry : std::filesystem::directory_iterator( + seedStore + "/ktest", seedError)) { + if (entry.is_regular_file(seedError)) { + haveSeeds = true; + break; + } + } + // KLEE's own tests from its previous turn, when the engines alternate: + // replaying them rebuilds the frontier it had reached instead of + // rediscovering it. + bool haveOwnSeeds = false; + for (const auto &entry : std::filesystem::directory_iterator( + seedStore + "/kleeprev", seedError)) { + if (entry.is_regular_file(seedError)) { + haveOwnSeeds = true; + break; + } + } + if (haveSeeds || haveOwnSeeds) { + seedFlag = std::string(haveSeeds ? " --seed-dir='" + seedStore + + "/ktest'" + : "") + + (haveOwnSeeds ? " --seed-dir='" + seedStore + "/kleeprev'" + : "") + + " --allow-seed-extension --allow-seed-truncation" + " --seed-time=" + + std::to_string(std::max( + 1u, static_cast(kleeBudget / 4))) + + "s"; + } + } + + // Depth-first for Cover-Branches, and the reason is about what survives + // the deadline rather than about search quality. + // + // KLEE's default search keeps thousands of states alive at once. Each + // writes its .ktest only when it terminates, and the ones still live + // when the budget expires are dumped at halt -- where writing them + // fails wholesale: "unable to write output test case, losing it", 3982 + // times in one measured run, for a total of zero test cases from 3982 + // explored paths. Depth-first finishes states one after another, so + // each one's test is on disk long before the deadline matters. + // + // For the property modes the default search stays: there the goal is to + // find one violating path quickly, not to harvest many. + std::string searchPolicy = + (map2checkMode == Map2CheckMode::COVER_BRANCHES_MODE) + ? " --search=dfs" + : ""; + + std::string stopPolicy = + (map2checkMode == Map2CheckMode::COVER_BRANCHES_MODE) + ? "" + : " --exit-on-error-type=Abort"; std::vector kleebackendsolver = {"z3", "stp"}; std::vector kleemetasolver = {"btor", "yices2"}; @@ -398,7 +1452,7 @@ void Caller::executeAnalysis(std::string solvername) { // --allow-external-sym-calls // -use-cache kleeCommand << " --external-calls=all" - << " --exit-on-error-type=Abort" + << stopPolicy << searchPolicy << seedFlag << " --optimize" << " --use-cex-cache" << " --solver-backend=" + solvername + " " @@ -411,7 +1465,7 @@ void Caller::executeAnalysis(std::string solvername) { Map2Check::Log::Info("Solver metaSMT caller: " + solvername); kleeCommand << " --external-calls=all" - << " --exit-on-error-type=Abort" + << stopPolicy << searchPolicy << seedFlag << " --optimize" << " --use-cex-cache" << " --solver-backend=metasmt " @@ -422,31 +1476,235 @@ void Caller::executeAnalysis(std::string solvername) { } Map2Check::Log::Debug(kleeCommand.str()); - int result = system(kleeCommand.str().c_str()); + const auto engineStarted = std::chrono::steady_clock::now(); + int result = runKleeWatched(kleeCommand.str()); + if (this->engineSeconds != nullptr) { + *this->engineSeconds = std::chrono::duration( + std::chrono::steady_clock::now() - + engineStarted) + .count(); + } + if (this->seedExchange) { + if (this->stagnationLimit > 0) keepKleeTestsAsSeeds(); + // Written after KLEE rather than before the next phase, because the + // .ktest files are in the scratch directory that cleanGarbage() will + // remove -- and because a later alternation, or a resumed run, should + // find them already there. + exportKleeVectorsAsSeeds(); + } Map2Check::Log::Warning("Exited klee with " + std::to_string(result)); + // "Executing Klee" is printed before KLEE starts, so it does not say + // that KLEE ran. The tests it wrote do, and this line is what the + // archive's smoke test requires. + const size_t kleeTests = kleeTestCount(Map2Check::kleeOutputDir); + if (kleeTests > 0) { + Map2Check::Log::Info("KLEE ran: " + std::to_string(kleeTests) + + " tests generated"); + } else { + Map2Check::Log::Warning("KLEE generated no tests"); + } + // KLEE found nothing: its vectors, run on natively. Not for + // Cover-Branches, whose goal is no violation. + if (map2checkMode != Map2CheckMode::COVER_BRANCHES_MODE && + !isWitnessFileCreated() && + !Map2Check::hasViolatingKtest(Map2Check::kleeOutputDir)) { + replayKleeVectorsForViolation(); + } if (result == 31744) // Timeout gotTimeout = true; + // Stopped by us for want of progress: states were left, nothing proved. + if (this->stoppedOnStagnation) gotTimeout = true; + // KLEE exits 0 when its queue empties, like a run that explored every + // path -- also after its timer, a concretized input or states it killed + // itself. None of those proves anything. Treated as the timeout it is: a + // violation already recorded is kept, anything else is UNKNOWN -- never + // the TRUE a short path's NONE in the property file would otherwise make + // it (a reachable null dereference, a float bug, came back TRUE). + const std::string dropped = + Map2Check::kleeDroppedPaths(Map2Check::kleeOutputDir); + if (!dropped.empty()) { + Map2Check::Log::Warning("KLEE " + dropped + + " -- not a complete exploration"); + gotTimeout = true; + } break; } - case (NonDetGenerator::LibFuzzer): { - Map2Check::Log::Info("Executing LibFuzzer with map2check"); + case (NonDetGenerator::AFLPlusPlus): { + std::error_code fuzzErr; + const bool hasFuzzer = + std::filesystem::exists(programHash + "-fuzzed.out", fuzzErr); + if (fuzzErr) { + Map2Check::Log::Warning( + "could not check whether the AFL++ binary is available: " + + fuzzErr.message()); + break; + } + if (!hasFuzzer) { + Map2Check::Log::Warning( + "the AFL++ binary is unavailable -- skipping the fuzzer phase"); + break; + } + Map2Check::Log::Info("Executing AFL++ with map2check"); std::ostringstream command; command.str(""); - command << "timeout " << (0.2 * this->timeout) << " "; - command << "./" + programHash + - "-fuzzed.out -jobs=8 -use_value_profile=1 " - << " > fuzzer.output"; - + // Against what is LEFT, not against the nominal budget -- see + // Caller::remainingSeconds. + // Alternating, the last window can be everything left: keep the same + // reserve KLEE keeps for replaying crashes and writing the suite. + const double fuzzerBudget = + this->engineWindow > 0 + ? std::max(1.0, + std::min(this->engineWindow, + static_cast(this->remainingSeconds()) - + 5.0)) + : std::min(0.2 * this->timeout, + static_cast(this->remainingSeconds())); + // afl-fuzz needs a non-empty -i dir and a -o dir that does not already + // exist (the hybrid may run the fuzzer phase twice). + // + // The input dir is the shared seed corpus only under --seed-exchange, + // as it was for the previous fuzzer; otherwise a private one, so a run + // without the exchange leaves no seeds/ behind. Either way it gets one + // placeholder input when empty, because afl-fuzz refuses to start + // without one (the previous fuzzer could start from nothing). + std::error_code seedErr; + const std::string inputDir = + this->seedExchange ? seedStore + "/afl" : std::string("afl-in"); + std::filesystem::create_directories(inputDir, seedErr); + if (std::filesystem::is_empty(inputDir, seedErr)) { + std::ofstream seed(inputDir + "/seed"); + seed << "A"; + if (!seed.good()) + Map2Check::Log::Warning("could not write the AFL++ placeholder seed"); + } + if (seedErr) + Map2Check::Log::Warning("could not prepare the AFL++ input dir " + + inputDir + ": " + seedErr.message()); + std::filesystem::remove_all("afl-out", seedErr); + // The AFL_* settings go on the command line, not only into the dev + // image's ENV, so that a release install or a benchmark host outside + // the image does not trip afl-fuzz's UI, CPU-affinity, cpufreq and + // core_pattern checks and exit before fuzzing anything. + // AFL_CRASHING_SEEDS_AS_NEW_CRASH: a seed that already reaches the + // violation is recorded as a crash instead of being skipped -- the + // previous fuzzer reported that case too. + // AFL_BENCH_UNTIL_CRASH: stop at the first crash, as the previous + // fuzzer did, and hand the rest of the budget back. + command << "AFL_NO_UI=1 AFL_NO_AFFINITY=1 AFL_SKIP_CPUFREQ=1" + << " AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1" + << " AFL_CRASHING_SEEDS_AS_NEW_CRASH=1" + << " AFL_BENCH_UNTIL_CRASH=1 "; + // Alternating: the fuzzer hands the rest of its window back as soon as + // it stops finding coverage, and exits 0 doing so -- not a timeout. + if (this->stagnationLimit > 0) { + command << "AFL_EXIT_ON_TIME=" << this->stagnationLimit << " "; + } + // Bounded by `timeout` alone, as the previous fuzzer was. Not also by + // afl-fuzz -V: that one compares wall-clock (gettimeofday) readings, + // and a clock stepped backwards -- measured at over a second under + // WSL2 -- underflows the difference and ends the run after a few + // hundred executions. `timeout` uses a relative timer. At least 1s, + // since `timeout 0` would mean no limit at all. + command << "timeout -k " << Map2Check::killGracePeriod << " " + << std::max(1u, static_cast(fuzzerBudget)) << " "; + std::error_code cmplogErr; + const bool hasCmplog = + std::filesystem::exists(programHash + "-cmplog.out", cmplogErr); + command << Map2Check::aflFuzzBinary() + << " -i '" << inputDir << "'" + << " -o afl-out"; + if (hasCmplog) command << " -c ./" << programHash << "-cmplog.out"; + command << " -- ./" << programHash << "-fuzzed.out" + << " > fuzzer.output 2>&1"; + + const auto engineStarted = std::chrono::steady_clock::now(); int result = system(command.str().c_str()); + if (this->engineSeconds != nullptr) { + *this->engineSeconds = std::chrono::duration( + std::chrono::steady_clock::now() - + engineStarted) + .count(); + } Map2Check::Log::Warning("Exited fuzzer with " + std::to_string(result)); if (result == 31744) // Timeout gotTimeout = true; - std::ostringstream commandWitness; - commandWitness.str(""); - commandWitness << "./" + programHash + "-witness-fuzzed.out crash-*"; - system(commandWitness.str().c_str()); + // A single instance without -M/-S is named "default" by afl-fuzz, and + // its findings live under afl-out/default/, not afl-out/. + const std::string aflFindings = "afl-out/default"; + + // As for KLEE, "Executing AFL++" precedes the launch. The execution + // count afl-fuzz recorded is the evidence that it fuzzed, and this line + // is what the archive's smoke test requires. When there is none, what + // afl-fuzz said goes to the log: fuzzer.output is removed with the + // scratch directory. + const long long aflExecs = + aflFuzzerStat(aflFindings + "/fuzzer_stats", "execs_done"); + if (aflExecs > 0) { + const long long corpus = + aflFuzzerStat(aflFindings + "/fuzzer_stats", "corpus_count"); + Map2Check::Log::Info("AFL++ ran: " + std::to_string(aflExecs) + + " executions, " + + std::to_string(std::max(0LL, corpus)) + + " inputs in the corpus"); + } else { + Map2Check::Log::Warning( + "AFL++ recorded no executions; its output ended with:\n" + + lastLines("fuzzer.output", 15)); + } + + // Replay crashes with the witness binary to confirm a real violation. + // Standalone, the persistent binary reads its input from stdin (see + // NonDetGeneratorAFL.c), so the crash file is redirected in; the names + // AFL++ gives them contain ':' and ',', hence the quoting. Stop at the + // first confirmed one: every replay rewrites the recorded property, and + // a later one that does not reproduce would overwrite the violation. + // Each replay is capped: a crash that does not reproduce from a fresh + // process may loop instead, and must not eat what is left for KLEE. + // Files are selected by what they are, not by AFL++'s "id:" naming, + // which AFL_SHA1_FILENAMES or a SIMPLE_FILES build would change. + const unsigned replayBudget = std::min( + this->remainingSeconds(), + std::max(5u, static_cast(0.1 * this->timeout))); + std::error_code crashErr; + for (const auto &entry : std::filesystem::directory_iterator( + aflFindings + "/crashes", crashErr)) { + if (!entry.is_regular_file(crashErr)) continue; + if (entry.path().filename() == "README.txt") continue; + std::ostringstream commandWitness; + commandWitness << "timeout -k " << Map2Check::killGracePeriod << " " + << replayBudget << " ./" << programHash + << "-witness-fuzzed.out < '" << entry.path().string() + << "'"; + system(commandWitness.str().c_str()); + if (isWitnessFileCreated()) break; + } + + // afl-fuzz never writes back into -i, so under --seed-exchange its + // discoveries are copied into seeds/ -- the previous fuzzer grew that + // directory in place. Inputs tagged ",orig:" are the seeds it started + // from, already there. The store is beside the scratch directory, so + // the next fuzzer phase starts from this corpus plus KLEE's vectors. + if (this->seedExchange) { + std::error_code queueErr; + for (const auto &entry : std::filesystem::directory_iterator( + aflFindings + "/queue", queueErr)) { + const std::string name = entry.path().filename().string(); + if (!entry.is_regular_file(queueErr)) continue; + if (name.find(",orig:") != std::string::npos) continue; + std::filesystem::copy_file( + entry.path(), + seedStore + "/afl/afl-" + name, + std::filesystem::copy_options::skip_existing, queueErr); + } + } + // The fuzzer's corpus for the KLEE phase, unless this phase already + // decided the property. + if (this->seedExchange && this->feedsKleePhase && + !isWitnessFileCreated()) { + exportFuzzerCorpusAsKtests(); + } Map2Check::Log::Debug("Finished fuzzer"); if (isWitnessFileCreated()) { @@ -538,12 +1796,41 @@ void Caller::compileCFile(bool is_llvm_bc) { << " -Wno-everything " << " -Winteger-overflow " << " -c -emit-llvm -g" - << " " << Caller::preOptimizationFlags() << " -o " << compiledFile + << " " << Caller::preOptimizationFlags() + << (ssaPreoptimization() ? " -Xclang -disable-O0-optnone" : "") + << " -o " << compiledFile << " " << programHash << "-preprocessed.c " << " > " << programHash << "-clang.out 2>&1"; system(command.str().c_str()); + // MAP2CHECK_PREOPT=ssa: the module in SSA form, as Clam's preprocessing + // leaves it. At -O0 clang marks every function optnone and every local + // lives in memory; KLEE then pays a memory object and a solver array per + // variable. A first probe of --add-invariants found that compiling through + // Clam with NO invariant inserted decided a loop program the plain + // pipeline left UNKNOWN (both the safe and the buggy variant) -- the gain + // was the preprocessing, not the invariants. mem2reg only promotes locals + // whose address is never taken; simplifycfg keeps common code unsunk, as + // Clam does. Neither reorders a call, so the nondet order is unchanged. + if (ssaPreoptimization()) { + std::ostringstream ssa; + ssa << Map2Check::optBinary + << " -passes='function(mem2reg,simplifycfg)'" + << " --simplifycfg-sink-common=false " << compiledFile << " -o " + << compiledFile << ".ssa.bc >> " << programHash << "-clang.out 2>&1"; + std::error_code ssaError; + if (system(ssa.str().c_str()) == 0 && + std::filesystem::exists(compiledFile + ".ssa.bc", ssaError)) { + std::filesystem::rename(compiledFile + ".ssa.bc", compiledFile, + ssaError); + } else { + Map2Check::Log::Warning( + "could not bring the module into SSA form -- analysing it as " + "compiled"); + } + } + this->pathprogram = compiledFile; } else { std::string compiledFile = programHash + "-compiled.bc"; @@ -557,8 +1844,8 @@ void Caller::compileCFile(bool is_llvm_bc) { // TODO(hbgit): (3) Check for overflow errors on compilation } -void Caller::compileToCrabLlvm() { - Map2Check::Log::Info("Compiling using crab-llvm in " + this->pathprogram); +void Caller::compileWithClam() { + Map2Check::Log::Info("Compiling with Clam (invariants) in " + this->pathprogram); // (1) Remove unsupported functions and clean the C code // TODO(hbgit): improve regex to the next line @@ -606,25 +1893,22 @@ void Caller::compileToCrabLlvm() { std::copy(tmp_gpcc.c_str(), tmp_gpcc.c_str() + tmp_gpcc.length() + 1, c_gpcc); putenv(c_gpcc); - // Export libCrab.so from CrabLLVM - std::ostringstream getPathLibCrabCommand; - getPathLibCrabCommand.str(""); - - std::ostringstream tmp_ld_p; - tmp_ld_p << getenv("LD_LIBRARY_PATH"); - - - getPathLibCrabCommand << "LD_LIBRARY_PATH=" - << tmp_ld_p.str().c_str() - << ":" - << getMapPath.str().c_str() - << "/bin/crabllvm/lib"; - - // std::ostringstream tmp_ld; - // tmp_ld << getenv("LD_LIBRARY_PATH"); - // std::cout << tmp_ld.str().c_str(); - - std::string tmp_gplibcc = getPathLibCrabCommand.str().c_str(); + // Clam's shared libraries live under its own installation root, not under + // the Map2Check prefix: it is an independent tool with its own LLVM-versioned + // build. The old path pointed at ${MAP2CHECK_PATH}/bin/crabllvm/lib, which + // has not existed since the LLVM 6 era. + const char* clamDirEnv = getenv("CLAM_DIR"); + std::string clamRoot = + clamDirEnv != nullptr ? std::string(clamDirEnv) + : std::string(Map2Check::clamDefaultRoot); + + const char* ldPathEnv = getenv("LD_LIBRARY_PATH"); + std::ostringstream getPathLibClamCommand; + getPathLibClamCommand << "LD_LIBRARY_PATH=" + << (ldPathEnv != nullptr ? ldPathEnv : "") << ":" + << clamRoot << "/lib"; + + std::string tmp_gplibcc = getPathLibClamCommand.str(); char* c_gplibcc = new char[tmp_gplibcc.length() + 1]; std::copy(tmp_gplibcc.c_str(), tmp_gplibcc.c_str() + tmp_gplibcc.length() + 1, c_gplibcc); @@ -633,15 +1917,94 @@ void Caller::compileToCrabLlvm() { std::string compiledFile = programHash + "-compiled.bc"; std::ostringstream command; command.str(""); - command << Map2Check::crabBinary << " -o " << compiledFile - << " -m 64 -g --crab-disable-warnings --disable-lower-gv " - "--llvm-pp-loops --crab-promote-assume --crab-inter " - "--crab-track=num --crab-add-invariants=block-entry " - << " " << programHash << "-preprocessed.c "; - //<< " -m 64 --crab-dom=oct --crab-track=num --crab-add-invariants=all " + // This flag list is measured, not translated. Clam renamed one option + // crab-llvm: --crab-add-invariants=block-entry + // Clam: --crab-opt=add-invariants --crab-opt-invariants-loc=block-entry + // but two others in the legacy call actively defeat the purpose, and were + // dropped after counting verifier.assume calls in the emitted bitcode on a + // loop program (5 injected by the baseline flags below): + // + // --llvm-pp-loops 5 -> 0. Its loop preprocessing runs after the + // invariants would be placed, and nothing survives. + // --crab-promote-assume 5 -> 1. It rewrites verifier.assume into the + // llvm.assume intrinsic (lib/Transforms/PromoteAssume.cc), + // which is precisely the symbol NonDetPass.cpp:95 + // matches on -- promoting makes the invariants + // invisible to Map2Check. + // + // So the legacy invocation would have injected nothing even if crab-llvm had + // still built: the capability was dead twice over. --crab-inter and -m 64 -g + // were verified harmless (still 5). --crab-disable-warnings and + // --disable-lower-gv no longer exist in Clam's option set. + // + // The emitted verifier.assume is rewritten by NonDetPass into + // map2check_crab_assume, which the runtime forwards to klee_assume -- so + // nothing downstream needs to change. + // See docs/reports/2026-08-16-crabllvm-review.md. + // MAP2CHECK_CLAM_PROFILE=memory: the configuration --add-invariants had + // until 2018-10-19, when it last reached KLEE -- memory contents tracked + // (crab-llvm's --crab-track=arr, Clam's mem) and an invariant after every + // load. From v7.3 on it ran --crab-promote-assume, which emits llvm.assume, + // which NonDetPass does not map and both KLEE 2.1 and 3.1 ignore: the + // invariants of the SV-COMP 2019/2020 builds reached nothing. Measured side + // by side against the default (num, block-entry) before choosing. + // MAP2CHECK_CLAM_PROFILE=none: Clam's pipeline without inserting anything, + // to tell the effect of compiling through Clam from that of the invariants + // (a first probe found the two pulling in opposite directions). + const char *profileEnv = std::getenv("MAP2CHECK_CLAM_PROFILE"); + const std::string profile = profileEnv != nullptr ? profileEnv : "default"; + const bool memoryProfile = profile == "memory"; + const bool noInvariants = profile == "none"; + // Bounded like the slicer: on the eca-* and product-lines programs Clam's + // analysis ran past the whole budget and the run was killed with no verdict + // (R25: 4-7 ERROR per arm). Past the bound, the fallback below compiles the + // program without invariants. + const unsigned clamBudget = static_cast(std::max( + 1.0, std::min(0.2 * this->timeout, + static_cast(remainingSeconds()) - 5.0))); + command << "timeout -k " << Map2Check::killGracePeriod << " " << clamBudget + << " " << Map2Check::clamBinary() << " -o " << compiledFile + << " -m 64 -g" + << " --crab-inter" + << (memoryProfile ? " --crab-track=mem" : " --crab-track=num") + << (noInvariants ? " --crab-opt=none" : " --crab-opt=add-invariants") + << (noInvariants ? "" + : memoryProfile ? " --crab-opt-invariants-loc=after-load" + : " --crab-opt-invariants-loc=block-entry") + << " " << programHash << "-preprocessed.c > clam.output 2>&1"; + + Map2Check::Log::Debug(command.str()); + const int clamResult = system(command.str().c_str()); + + std::error_code error; + if (clamResult != 0 || !std::filesystem::exists(compiledFile, error) || + std::filesystem::file_size(compiledFile, error) == 0) { + // Not the silence of the old path (issue #54): said, and the run goes on + // with the program as it is. + Map2Check::Log::Warning( + "Clam failed (status " + std::to_string(clamResult) + + ") -- analysing the program without invariants"); + compileCFile(false); + return; + } - system(command.str().c_str()); + // How many invariants went in: the measure of what --add-invariants does. + std::ostringstream disassemble; + disassemble << Map2Check::optBinary << " -S " << compiledFile + << " -o clam-invariants.ll > /dev/null 2>&1"; + unsigned invariants = 0; + if (system(disassemble.str().c_str()) == 0) { + std::ifstream ir("clam-invariants.ll"); + std::string line; + while (std::getline(ir, line)) { + if (line.find("call void @verifier.assume") != std::string::npos) { + ++invariants; + } + } + } + Map2Check::Log::Info("Clam inserted " + std::to_string(invariants) + + " invariant(s) (" + profile + " profile)"); this->pathprogram = compiledFile; } diff --git a/modules/frontend/caller.hpp b/modules/frontend/caller.hpp old mode 100755 new mode 100644 index d26152a2a..49a2530f0 --- a/modules/frontend/caller.hpp +++ b/modules/frontend/caller.hpp @@ -23,16 +23,25 @@ enum class Map2CheckMode { REACHABILITY_MODE, /**< Check if a target function can be executed */ OVERFLOW_MODE, /**< Check for signed integer overflows */ ASSERT_MODE, /**< Check for asserts (__VERIFIER_assert) */ - MEMCLEANUP_MODE /**< Check for memcleanup errors */ + MEMCLEANUP_MODE, /**< Check for memcleanup errors */ + /** Explore paths and record their inputs; check no property. + * + * Test-Comp Cover-Branches asks for a suite that exercises branches, not for + * a verdict, so every property check is overhead here -- and worse than + * overhead. With no mode flag this used to fall through to MEMTRACK_MODE and + * run the memory-tracking pass: on the Test-Comp corpus that meant 110 of + * 110 ProductLines tasks producing an empty suite in two seconds, because + * that pass emits a broken module on them. The same tasks work under + * Cover-Error, which never loads it. */ + COVER_BRANCHES_MODE }; /** NonDet generators */ -// TODO(hbgit): Add suport to other nondet like: klee, afl, afl+klee, -// LibFuzzer+afl +// TODO(hbgit): Add suport to other nondet like: klee, afl++, afl+klee enum class NonDetGenerator { - None, /**< Do not generate any input */ - LibFuzzer, /**< LibFuzzer from LLVM */ - Klee, /**< Use klee for symbolic analysis */ + None, /**< Do not generate any input */ + AFLPlusPlus, /**< AFL++ (persistent mode, PCGUARD) */ + Klee, /**< Use klee for symbolic analysis */ }; /** Data Structure */ @@ -68,11 +77,35 @@ class Caller { std::string c_program_fullpath; //!< Path for the original c program */ void setTimeout(unsigned timeout) { this->timeout = timeout; } + + /** Seconds of the run's budget that have not been spent yet. + * + * The engines used to size themselves from the NOMINAL budget: AFL++ + * took 0.2x and KLEE 0.8x, which adds to exactly the whole of it and leaves + * nothing for the two compile-instrument-link passes between them. Under the + * hybrid default the Caller is rebuilt per phase, so that overhead is paid + * twice. Measured on the v12 Test-Comp corpus: every ERROR verdict -- 20 of + * them, concentrated in ECA and Recursive -- landed at 87 to 89 seconds + * against a 60 second budget and a 90 second outer timeout. The tool was not + * failing; it was being killed mid-sentence and printing no verdict at all, + * which every harness here reads as a crash. + * + * Sizing each phase against what is LEFT keeps the sum inside the budget + * however many phases there turn out to be. */ + unsigned remainingSeconds() const; + /** remainingSeconds for a budget of `timeout`, without a Caller: what main + * sizes the alternating phases with. */ + static unsigned remainingOf(unsigned timeout); /** @brief Function to compile original C file removing external memory * operations calls */ void compileCFile(bool is_llvm_bc); + /** MAP2CHECK_PREOPT=ssa: compile into SSA form (see compileCFile). */ + bool ssaPreoptimization() const; - void compileToCrabLlvm(); + /** Compiles the input through Clam so the emitted bitcode carries + * verifier.assume(invariant) calls. Requires Clam dev16 installed; callers + * must have checked availability first (main() refuses the run otherwise). */ + void compileWithClam(); /** @brief Function to call pass for current verification mode * (for REACHABILITY mode) @@ -91,7 +124,104 @@ class Caller { /** Remove generated files for verification */ void cleanGarbage(); + /** Back to the directory map2check was started in, without deleting the + * scratch directory: under --debug the scratch is kept, but the next hybrid + * phase must still start from the same place (the seed store is computed + * from it). */ + void restoreWorkingDirectory(); + + /** Slice the program with respect to the target before analysing it. + * + * Off by default. Slicing changes WHAT IS ANALYSED, not merely how fast: a + * slice taken with respect to one error site can legitimately remove + * another, so a run with this on answers a narrower question than a run + * without it. That is right for a competition task with one property and + * wrong for a baseline scoring precision per CWE, which is why it is a + * decision the caller makes rather than a default. */ + bool sliceProgram = false; + + /** Runs sbt-slicer over the compiled (not yet instrumented) bitcode. + * + * `criteria` are the primary slicing criteria (the target function, or the + * assert functions); every __VERIFIER_nondet_* function is added to them so + * the suite found on the slice stays valid on the original program. The + * cutoff of diverging paths is off: its exit(0) carries no debug location + * and KLEE rejects the module. `targetFunction` gets its body back through a + * weak stub. Returns false if the slicer is unavailable or produced nothing + * usable, leaving the original bitcode in place. */ + bool sliceWithRespectToTarget(const std::string& targetFunction, + const std::vector& criteria); + + /** Slices the INSTRUMENTED module (-output.bc) in place, for the + * memory properties: every map2check_* runtime call and every nondet read + * is a criterion, and the entry is __map2check_main__. Runs after callPass + * and before linkLLVM. Returns false, leaving the module untouched, if the + * slicer is unavailable or produced nothing usable. */ + bool sliceInstrumented(); + + /** Turns on the exchange of input vectors between the two engines. + * + * Off by default so the hybrid keeps behaving exactly as it was measured + * (symex 27%, fuzzer 32%, hybrid 45% over the same 372 tasks); promoting it + * is a separate decision that has to be earned by its own measurement. */ + bool seedExchange = false; + + /** The seed store, beside the scratch directory: /.seeds with + * afl/ (fuzzer inputs), ktest/ (KLEE seeds) and replay/ (where queue entries + * are replayed). Beside, not inside: every hybrid phase recreates the scratch + * directory, and a store inside it never reached the next phase. Used only + * under --seed-exchange. */ + std::string seedStore; + /** Set by main on the hybrid's first phase: the fuzzer corpus is converted + * into KLEE seeds only when a KLEE phase follows. After the last phase the + * replays would be pure cost against a spent budget. */ + bool feedsKleePhase = false; + const std::string& seedStorePath() const { return seedStore; } + + /** Slices kept across the phases of one run (/.slice); see + * Map2Check::sliceCachePath. Removed by main with the seed store. */ + std::string sliceCache; + const std::string& sliceCachePath() const { return sliceCache; } + /** AFL++ binaries kept across the phases of one run (/.build), + * keyed by the content of the modules they are built from. */ + std::string buildCache; + const std::string& buildCachePath() const { return buildCache; } + /** Writes KLEE's per-path vectors into the seed corpus. + * + * Sound only because the engines agree on widths now: concatenating a + * .ktest's objects yields exactly the byte buffer that would drive the + * fuzzer down the same path. Returns how many seeds were written. */ + unsigned exportKleeVectorsAsSeeds(); + + /** Set by main under --alternate-engines (tacas 3b): the most this phase's + * engine may run, in seconds, instead of its fixed share of the budget (0: + * the fixed shares). */ + double engineWindow = 0; + /** Seconds without new coverage after which the engine is stopped (0: never). + * AFL++ gets it as AFL_EXIT_ON_TIME; KLEE is watched through run.stats. */ + unsigned stagnationLimit = 0; + /** Whether this phase's KLEE was stopped for stagnating: incomplete. */ + bool stoppedOnStagnation = false; + /** Where to report how long this phase's engine ran (main sizes the next + * alternating phase with it); null: not reported. */ + double* engineSeconds = nullptr; + + /** At most this many fuzzer queue entries are converted into KLEE seeds. */ + static constexpr size_t kMaxSeedsFromFuzzer = 64; + + /** Converts the AFL++ queue into typed .ktest seeds for the KLEE phase, by + * replaying each entry through the witness binary inside the seed store's + * replay/ directory. Returns how many seeds were written. */ + unsigned exportFuzzerCorpusAsKtests(); + + /** The fuzzer's corpus as test-case vectors (Cover-Branches): at most `cap` + * queue entries, ranked as for KLEE, each replayed through the witness + * binary for the values it actually reads, duplicates dropped. Bounded like + * the KLEE export (5% of the budget). Empty when no fuzzer ran. */ + std::vector> fuzzerCorpusVectors(size_t cap); + + /** Instrument and execute nondeterministic generator */ void applyNonDetGenerator(); @@ -104,6 +234,43 @@ class Caller { bool isTimeout() { return gotTimeout; } bool isVerified() { return witnessVerified; } + + /** Directory map2check was invoked from. The pipeline chdirs into a scratch + * directory that cleanGarbage() deletes, so anything meant to outlive the + * run must be written here. */ + std::string getOriginalPath() { return currentPath; } + + /** Absolute path of this run's scratch directory, where every intermediate + * artefact lives. Named after the SHA-1 of the input bitcode, so two runs on + * the same input share it. */ + std::string getScratchDir() { return currentPath + "/" + programHash; } + private: + /** Shared by both slicing entry points: disassembles `input`, adds the + * program's nondet names (and, with addRuntimeNames, its map2check_* calls) + * to `primary`, runs sbt-slicer bounded, and logs the slice under `label`. + * Returns false, with a warning, when there is no usable output. */ + bool runSlicer(const std::string& input, const std::string& output, + std::vector primary, bool addRuntimeNames, + const std::string& entry, const std::string& label); + /** runSlicer without the slice cache: what actually calls sbt-slicer. */ + bool runSlicerUncached(const std::string& input, const std::string& output, + std::vector primary, + bool addRuntimeNames, const std::string& entry, + const std::string& label); + /** Applies MAP2CHECK_SLICE_CLEANUP to a fresh slice, in place; on failure + * the slice is kept as the slicer wrote it. */ + void cleanUpSlice(const std::string& slice); + /** Runs the KLEE command, stopping it (SIGINT) once it stagnates for + * stagnationLimit seconds; plain system() when the limit is 0 or the build + * has no SQLite to read KLEE's stats with. Returns system()'s status. */ + int runKleeWatched(const std::string& command); + /** Runs KLEE's vectors natively through the fuzzer's witness binary (from + * the build cache), each completed with zeros past its end; true when one + * reached a violation, whose files are then in the scratch directory. */ + bool replayKleeVectorsForViolation(); + /** Keeps KLEE's latest tests (at most kMaxSeedsFromFuzzer) in the seed + * store's kleeprev/, to seed its next turn. */ + void keepKleeTestsAsSeeds(); }; } // namespace Map2Check diff --git a/modules/frontend/counter_example/counter_example.cpp b/modules/frontend/counter_example/counter_example.cpp index ec16223b0..f1cc0b684 100644 --- a/modules/frontend/counter_example/counter_example.cpp +++ b/modules/frontend/counter_example/counter_example.cpp @@ -9,6 +9,8 @@ #include "counter_example.hpp" +#include "../test_suite/ktest_reader.hpp" + #include #include #include @@ -93,6 +95,10 @@ std::string CounterExample::getViolatedProperty() { if (this->property == Tools::PropertyViolated::FALSE_OVERFLOW) { return "OVERFLOW"; } + + if (this->property == Tools::PropertyViolated::FALSE_DIVBYZERO) { + return "FALSE-DIVBYZERO"; + } // FIXME: Throw exception return ""; } @@ -157,15 +163,35 @@ void CounterExample::generateTestCase() { sourceFile << "\n" << "unsigned map2check_counter = 0;"; + // The runtime's nondet log first, as it always was. Past 1024 reads the KLEE + // runtime writes no log (issue #75), and an aborted KLEE state writes none + // either; the violating .ktest carries the same vector in the same order, + // as for the Test-Comp suite (emitTestSuite). Without it the array came out + // empty -- not even valid C -- and the testcase replayed nothing (review of + // #73). + std::vector values; + for (const Tools::KleeLogRow &row : this->kleeLogRows) { + values.push_back(row.value); + } + if (values.empty()) { + values = Map2Check::readViolatingKtest(Map2Check::kleeOutputDir); + if (!values.empty()) { + Log::Info("nondet log was empty; the testcase takes the violating input " + "vector from KLEE's test output (" + + std::to_string(values.size()) + " inputs)"); + } + } + sourceFile << "\n" << "long map2check_input_array[] = {"; - - for (int i = 0; i < (this->kleeLogRows.size()); i++) { - sourceFile << this->kleeLogRows[i].value; - if (i != (this->kleeLogRows.size() - 1)) { + for (size_t i = 0; i < values.size(); i++) { + sourceFile << values[i]; + if (i + 1 != values.size()) { sourceFile << ","; } } + // C has no empty initializer list. + if (values.empty()) sourceFile << "0"; sourceFile << "};\n"; diff --git a/modules/frontend/counter_example/counter_example.hpp b/modules/frontend/counter_example/counter_example.hpp index 45b4810ad..aad37b8f7 100755 --- a/modules/frontend/counter_example/counter_example.hpp +++ b/modules/frontend/counter_example/counter_example.hpp @@ -149,6 +149,14 @@ class CounterExampleProperty : public CounterExampleRow { cnvt << "\tOVERFLOW\n\n"; cnvt << "VERIFICATION FAILED"; break; + case (Tools::PropertyViolated::FALSE_DIVBYZERO): + cnvt << "Violated property:\n"; + cnvt << "\tfile " << this->fileName << " "; + cnvt << "line " << this->lineNumber << " "; + cnvt << "function " << this->functionName << "\n"; + cnvt << "\tFALSE-DIVBYZERO\n\n"; + cnvt << "VERIFICATION FAILED"; + break; case (Tools::PropertyViolated::FALSE_MEMTRACK): // TODO(hbgit): Add message for target reached cnvt << "Violated property:\n"; diff --git a/modules/frontend/map2check.cpp b/modules/frontend/map2check.cpp index 3352532e8..bbb990c1f 100644 --- a/modules/frontend/map2check.cpp +++ b/modules/frontend/map2check.cpp @@ -16,7 +16,9 @@ #include "map2check.hpp" #include +#include #include +#include #include #include #include @@ -28,8 +30,12 @@ #include "caller.hpp" #include "counter_example/counter_example.hpp" +#include "test_suite/ktest_reader.hpp" +#include "test_suite/test_suite.hpp" #include "utils/gen_crypto_hash.hpp" +#include "utils/alternation.hpp" #include "utils/log.hpp" +#include "utils/sha256.hpp" #include "witness/witness_include.hpp" #include "wasm_lifter.hpp" @@ -43,6 +49,19 @@ namespace { const size_t SUCCESS = 0; const size_t ERROR_IN_COMMAND_LINE = 1; +/** A syntactically valid option asked for a capability this build does not + * have. Distinct from ERROR_IN_COMMAND_LINE so callers can tell "you typed it + * wrong" from "this binary cannot do that", and act differently. */ +const size_t ERROR_UNAVAILABLE_CAPABILITY = 3; +/** --expected-result recorded a verdict different from the one asked for. + * + * This used to be signalled with abort(), i.e. SIGABRT (exit 134). A signal + * tells BenchExec "the tool crashed", which is the opposite of the truth: the + * tool ran to a definitive verdict and that verdict disagreed with the + * harness's expectation. A distinct exit code lets the harness distinguish + * "wrong answer" from "broken run". Kept at 4 so it never collides with the + * command-line (1) and capability (3) codes, and never looks like success. */ +const size_t ERROR_EXPECTED_RESULT = 4; // A helper function to simplify the main part. template std::ostream &operator<<(std::ostream &os, const std::vector &v) { @@ -50,6 +69,264 @@ std::ostream &operator<<(std::ostream &os, const std::vector &v) { return os; } +/** Whether an invariant generator is installed alongside this build. + * + * Clam (formerly crab-llvm) is an external tool invoked as a subprocess, so + * this is a filesystem question rather than a compile-time one: a binary built + * with -DENABLE_CLAM=ON still has to find the installed driver at run time. + * Both conditions are checked, because neither implies the other. */ +bool invariantGeneratorAvailable() { +#ifndef MAP2CHECK_ENABLE_CLAM + return false; +#else + // Same resolver the invocation uses, so the check and the command can never + // disagree about where Clam is. + return fs::exists(Map2Check::clamBinary()); +#endif +} + +/** The field of the test-suite metadata. + * + * BenchExec always hands the tool a property file, and copying it verbatim is + * what keeps the metadata correct when the competition revises a property + * string -- guessing it here would silently drift. The fallbacks exist only so + * a manual run without --property-file still produces a valid suite. + * + * `invocationDir` is not optional decoration. This runs AFTER the pipeline has + * chdir'd into the scratch directory, so a relative --property-file -- which is + * what BenchExec and every harness here pass -- resolved against the wrong + * directory and silently fell through to the guess below. Measured on the + * Test-Comp corpus: "could not read property file: prop.prp" on every task. + * + * It went unnoticed because the guess HAPPENS to match the real property text + * for both categories today, so no output differed and no test could see it. + * The drift the comment above warns about was therefore already in place. */ +std::string resolveSpecification(const std::string &propertyFile, + const std::string &invocationDir, + Map2Check::Map2CheckMode mode) { + if (!propertyFile.empty()) { + std::string path = propertyFile; + if (!fs::path(path).is_absolute() && !invocationDir.empty()) { + path = invocationDir + "/" + path; + } + std::ifstream in(path); + if (in.is_open()) { + std::ostringstream buffer; + buffer << in.rdbuf(); + std::string text = buffer.str(); + // Property files end with a newline that does not belong in an element. + while (!text.empty() && (text.back() == '\n' || text.back() == '\r')) { + text.pop_back(); + } + if (!text.empty()) return text; + } + Map2Check::Log::Warning("could not read property file: " + path); + } + if (mode == Map2Check::Map2CheckMode::REACHABILITY_MODE) { + return "COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )"; + } + return "COVER( init(main()), FQL(COVER EDGES(@DECISIONEDGE)) )"; +} + +/** Serializes the violating execution's nondet log as a Test-Comp test suite. + * + * Must run before Caller::cleanGarbage(): klee_log.csv lives in the scratch + * directory that cleanGarbage() deletes, and the suite must not. */ +/** Upper bound on a Cover-Branches suite. + * + * KLEE can terminate tens of thousands of paths, and every test case costs the + * validator a compile-and-run. The competition scores coverage, not volume, so + * past a few dozen vectors the marginal branch is rare and the validation cost + * is not. The bound is here rather than in the runtime because this is the + * side that knows what the suite is for. + * + * Lowered from 500 after measuring what 500 does: of 116 tasks whose + * validation failed outright on the Test-Comp corpus, 115 had at least 100 + * test cases and the median was exactly 500 -- suites so large that TestCov + * could not finish validating them, so the extra vectors scored nothing and + * cost everything. Generating them was work spent to make the result + * unmeasurable. */ +constexpr size_t kMaxBranchTestCases = 50; + +void emitTestSuite(const std::string &outputDir, const std::string &programFile, + const std::string &entryFunction, + const std::string &architecture, + const std::string &specification, bool foundViolation, + bool coverBranches, Map2Check::Map2CheckMode mode, + const std::vector> &fuzzerVectors) { + Map2Check::TestSuiteMetadata metadata; + metadata.producer = std::string("Map2Check ") + Map2CheckVersion; + metadata.specification = specification; + metadata.programFile = programFile; + metadata.programHash = Map2Check::sha256File(programFile); + metadata.entryFunction = entryFunction; + metadata.architecture = architecture; + metadata.creationTime = Map2Check::isoUtcNow(); + + Map2Check::TestSuiteWriter writer(outputDir); + if (!writer.writeMetadata(metadata)) { + Map2Check::Log::Warning("could not write test-suite metadata to " + + outputDir); + return; + } + // Cover-Branches: one test case per path KLEE explored, taken from its own + // .ktest output. Nothing is asked of the instrumented program -- measured, + // when it was: making it write a log per state turned a 1-second run that + // answered FALSE into a 100-second run that exhausted its budget and + // answered TRUE, because each write is an external call KLEE executes + // concretely. Reading afterwards costs the finished search nothing. + // + // coversError is false throughout: these vectors are paths, not violations. + // The violating one, when there is one, is still in klee_log.csv and still + // goes out under Cover-Error. + // + // The cap is on the SUITE, not on this phase: with the engines alternating, + // every KLEE phase adds cases, and later phases replay the vectors earlier + // ones already wrote (seeds) -- those are skipped. + if (coverBranches) { + // The fuzzer's share first, at most half the suite, so KLEE's paths still + // find room: its corpus is ranked by new edges, the cases a coverage + // metric rewards by construction (on by default; MAP2CHECK_FUZZER_SUITE=0). + // Cases from assumption-pruned paths (see evictPrunedCase) hold no claim + // on the suite: they count toward neither share and give way when full. + size_t fromFuzzer = 0; + for (const std::vector &inputs : fuzzerVectors) { + if (writer.caseCount() - writer.prunedCount() >= + kMaxBranchTestCases / 2) { + break; + } + if (writer.hasTestCase(inputs)) continue; + if (writer.caseCount() >= kMaxBranchTestCases && + !writer.evictPrunedCase()) { + break; + } + if (!writer.writeTestCase(inputs, false)) { + Map2Check::Log::Warning("could not write test case to " + outputDir); + return; + } + ++fromFuzzer; + } + if (!fuzzerVectors.empty()) { + Map2Check::Log::Info("Test suite: " + std::to_string(fromFuzzer) + + " test cases from the fuzzer's corpus"); + } + constexpr size_t kMaxKtestsRead = 5000; + std::vector pruned; + std::vector> vectors = Map2Check::readKtestVectors( + Map2Check::kleeOutputDir, kMaxKtestsRead, &pruned); + size_t written = 0; + for (size_t i = 0; i < vectors.size(); ++i) { + const std::vector &inputs = vectors[i]; + if (writer.hasTestCase(inputs)) continue; + // Pruned vectors come last, so once one finds the suite full, all do. + if (writer.caseCount() >= kMaxBranchTestCases && + (pruned[i] || !writer.evictPrunedCase())) { + break; + } + if (!writer.writeTestCase(inputs, false, pruned[i])) { + Map2Check::Log::Warning("could not write test case to " + outputDir); + return; + } + ++written; + } + Map2Check::Log::Info("Test suite written to " + outputDir + " (" + + std::to_string(written) + + " test cases from KLEE paths, " + + std::to_string(writer.caseCount()) + " in the suite)"); + return; + } + + // Last chance to find a vector before declaring the suite empty. + // + // A run can reach the target and still not record it: the state that reaches + // it aborts, an aborted KLEE state runs no exit handler, and + // map2check_property is written by that handler. So foundViolation being + // false does not mean nothing was found -- it means nothing was WRITTEN + // DOWN. Measured: twelve tasks whose suites covered the error came back with + // no verdict at all. + // + // Safe to consult now, and only now, because NonDetPass rewrites the + // abort-based assumptions into path pruning: an abort.err can no longer be + // an assumption failure, so its presence in reachability mode is evidence + // the target really was hit. + if (!foundViolation && mode == Map2Check::Map2CheckMode::REACHABILITY_MODE) { + std::vector recovered = + Map2Check::readViolatingKtest(Map2Check::kleeOutputDir); + if (!recovered.empty()) { + Map2Check::Log::Warning( + "the runtime recorded no violation, but KLEE reported an aborting " + "path -- emitting its input vector (" + + std::to_string(recovered.size()) + " inputs)"); + if (writer.writeTestCase(recovered, true)) { + Map2Check::Log::Info("Test suite written to " + outputDir + " (" + + std::to_string(recovered.size()) + " inputs)"); + return; + } + } + } + + // No violation means no test case, but the suite still has to exist. A + // missing test-suite/ directory reads to the competition harness as a tool + // that crashed; a suite carrying metadata and zero test cases says the tool + // ran and found nothing, which is a legitimate and scoreable outcome. + if (!foundViolation) { + Map2Check::Log::Info("Test suite written to " + outputDir + + " (no violation found -- 0 test cases)"); + return; + } + + std::vector inputs = + Map2Check::readNonDetLog(Map2Check::kleeLogCSV); + + // Fall back to KLEE's record of the failing path when the runtime's log is + // empty, which is the common case rather than the exception. The state that + // reaches the target aborts; an aborted state runs no exit handler; the + // flush that writes klee_log.csv never happens. Measured on the Test-Comp + // corpus: 290 of 376 runs that reported FAILED emitted a test case with zero + // elements, and TestCov scored every one of them as covering + // nothing -- the tool had found the bug and could not prove it. + // + // The log stays the first choice where it exists: it records values in the + // order the program consumed them, straight from the instrumented run, while + // the .ktest is KLEE's view of the same path. + // + // Deliberately NOT gated on the runtime having recorded the violation, and + // that took two measurements to get right. + // + // The danger this fallback had was picking up an assumption failure: the + // sv-benchmarks idiom is `void assume_abort_if_not(int c){ if(!c) abort(); }` + // and an aborting assumption leaves an abort.err indistinguishable from a + // real one. A suite built from it carried 25 inputs and covered 0.0%. + // + // The first attempt at a defence was to require foundViolation. It cost + // more than it saved: measured pairwise against the previous run, twelve + // tasks that HAD been covered stopped being covered, every one of them a + // case where the target really was reached and the runtime simply never + // recorded it -- the state that reaches the target aborts, and an aborted + // state runs no exit handler, so map2check_property stays empty exactly + // when it matters most. + // + // The real defence is upstream: NonDetPass now rewrites the abort-based + // assumptions into path pruning, so an abort.err can no longer come from + // one. With the source of false aborts removed, requiring foundViolation + // only blocks legitimate recoveries. + if (inputs.empty()) { + inputs = Map2Check::readViolatingKtest(Map2Check::kleeOutputDir); + if (!inputs.empty()) { + Map2Check::Log::Info( + "nondet log was empty; recovered the violating input vector from " + "KLEE's test output (" + std::to_string(inputs.size()) + " inputs)"); + } + } + + if (!writer.writeTestCase(inputs, true)) { + Map2Check::Log::Warning("could not write test case to " + outputDir); + return; + } + Map2Check::Log::Info("Test suite written to " + outputDir + " (" + + std::to_string(inputs.size()) + " inputs)"); +} + inline void help_msg() { std::cout << std::endl; std::cout << "> > > \t " << Map2CheckVersion << " \t < < <" << std::endl; @@ -97,7 +374,26 @@ inline void fixPath(char *map2check_bin_string) { klee_env_var += "/lib/klee/runtime"; setenv("KLEE_RUNTIME_LIBRARY_PATH", klee_env_var.c_str(), 1); - std::string ld_env_var("$LD_LIBRARY_PATH:"); + // The previous value has to be read, not spelled. This was + // + // std::string ld_env_var("$LD_LIBRARY_PATH:"); + // + // and setenv does no shell expansion, so the environment ended up with the + // literal seven-plus characters "$LD_LIBRARY_PATH" as its first component -- + // a path that does not exist. Everything the image had put there was gone + // for every child process map2check spawns. + // + // It went unnoticed because the install prefix appended below carries the + // libraries the tool itself needs, so nothing map2check owns ever missed + // them. It surfaced the moment an external tool was added: sbt-slicer links + // dg's shared libraries from /opt/dg/lib, which the image puts on the path, + // and every invocation died with "libdganalysis.so: cannot open shared + // object file". + std::string ld_env_var; + const char *previous_ld_path = getenv("LD_LIBRARY_PATH"); + if (previous_ld_path != nullptr && previous_ld_path[0] != '\0') { + ld_env_var = std::string(previous_ld_path) + ":"; + } ld_env_var += pBuf; ld_env_var += "/lib/"; setenv("LD_LIBRARY_PATH", ld_env_var.c_str(), 1); @@ -150,11 +446,100 @@ struct map2check_args { bool printCounterExample = false; bool btree = false; bool invCrabLlvm = false; + bool generateTestSuite = false; + bool coverBranches = false; + bool seedExchange = false; + // 1..3 on the hybrid path (fuzzer, KLEE, fuzzer), 0 for a single engine. + int phase = 0; + // --alternate-engines (tacas 3b): the engines take turns, each phase bounded + // by its window and stopped when it stagnates. 0 keeps the fixed shares. + bool alternateEngines = false; + double engineWindow = 0; + unsigned stagnationLimit = 0; + // Whether this phase's fuzzer corpus is converted into seeds for a KLEE + // phase that follows; -1: the fixed hybrid's rule (the first phase only). + int feedsKlee = -1; + bool sliceProgram = false; + std::string testSuiteDir = "test-suite"; + std::string propertyFile; + std::string architecture = "64bit"; Map2Check::NonDetGenerator generator; std::string spectTrue = "safetyMemory"; }; bool foundViolation = false; +// Set when a phase proved the property (TRUE). Like a violation, a proof is +// the run's answer: no later phase may run and print a verdict after it. +bool provedSafe = false; +// The seed store of the last phase, removed by main once every phase ran. +static std::string lastSeedStore; +// The slice cache of the last phase, removed by main with the seed store. +static std::string lastSliceCache; +// The AFL++ build cache of the last phase, removed by main likewise. +static std::string lastBuildCache; +// How long the last phase's engine ran; the rest of the phase is setup +// (compile, instrument, link) that no engine window accounts for. +static double lastEngineSeconds = 0; + +int map2check_execution(map2check_args args); + +/** The hybrid under --alternate-engines (tacas 3b spec): the fuzzer and KLEE + * take turns, fuzzer first, until a violation, a proof, or too little time + * for another phase. Each phase is bounded by its window -- doubled every + * round of that engine -- and ends earlier when its engine stagnates, handing + * the rest back. The fixed 0.2/0.6/0.2 split held an engine that had stopped + * progressing to the end of its share, and cut one that still was. */ +int alternateEngines(map2check_args args) { + const double budget = args.timeout; + const unsigned quiet = Map2Check::stagnationSeconds(budget); + unsigned rounds[2] = {0, 0}; + // The setup each engine's phase needed last time (compile, instrument, + // link -- time no window covers): a phase starts only if what is left + // covers its setup plus a stagnation period of engine time, and its window + // leaves the setup out. Per engine and latest, not the maximum: the first + // fuzzer phase builds the AFL++ binaries, the later ones reuse them. + double setup[2] = {0, 0}; + for (int phase = 1;; ++phase) { + const bool klee = (phase % 2 == 0); + const int self = klee ? 1 : 0; + const double left = Map2Check::Caller::remainingOf(args.timeout); + if (phase > 1 && left < quiet + setup[self]) break; + const Map2Check::Engine engine = + klee ? Map2Check::Engine::Klee : Map2Check::Engine::Fuzzer; + const unsigned round = ++rounds[self]; + args.generator = klee ? Map2Check::NonDetGenerator::Klee + : Map2Check::NonDetGenerator::AFLPlusPlus; + args.phase = phase; + args.engineWindow = Map2Check::alternationWindow( + engine, round, budget, std::max(1.0, left - setup[self])); + // Both engines' patience grows with their rounds. KLEE: coverage stops + // rising well before it finishes the paths of a proof. The fuzzer: on the + // eca-* state machines it finds new paths in bursts, and a fixed 15 s cut + // ended its turns at ~17 s where the fixed split gave it 60. + args.stagnationLimit = Map2Check::stagnationSeconds(budget, round); + // Replaying the corpus for a KLEE phase that will not get to run is + // pure cost. + args.feedsKlee = (!klee && left - setup[self] - args.engineWindow >= + quiet + setup[1]) + ? 1 + : 0; + Map2Check::Log::Info("Alternation phase " + std::to_string(phase) + ": " + + (klee ? "KLEE" : "AFL++") + ", window " + + std::to_string(static_cast( + args.engineWindow)) + " s"); + const auto started = std::chrono::steady_clock::now(); + lastEngineSeconds = 0; + const int result = map2check_execution(args); + if (result != SUCCESS) return result; + const double took = std::chrono::duration( + std::chrono::steady_clock::now() - started) + .count(); + setup[self] = std::max(0.0, took - lastEngineSeconds); + if (foundViolation || provedSafe) break; + } + return SUCCESS; +} + int map2check_execution(map2check_args args) { Map2Check::Log::Info("Started Map2Check"); // TODO(rafa.sa.xp@gmail.com): Check current mode @@ -219,17 +604,58 @@ int map2check_execution(map2check_args args) { caller = std::make_unique(args.inputFile, args.mode, generator); caller->c_program_fullpath = args.inputFile; + caller->seedExchange = args.seedExchange; + // The store is named after the program's content, so one left by an earlier + // run (kept by --debug, or leaked by a kill) would feed that run's seeds into + // this one: every run starts from an empty store. + if (args.seedExchange && args.phase <= 1) { + std::error_code storeError; + std::filesystem::remove_all(caller->seedStorePath(), storeError); + } + // The slice cache likewise: a slice left by an earlier run is keyed by + // content and would be correct, but a ".failed" mark from a run with a + // shorter budget would refuse this one a slice it could afford. + if (args.sliceProgram && args.phase <= 1) { + std::error_code cacheError; + std::filesystem::remove_all(caller->sliceCachePath(), cacheError); + } + if (args.phase <= 1) { + std::error_code cacheError; + std::filesystem::remove_all(caller->buildCachePath(), cacheError); + } + // A run starts from an empty suite. Its phases then add to it (see + // TestSuiteWriter), and a suite left in this directory by an earlier run -- + // possibly of another program -- must not be added to. + if (args.generateTestSuite && args.phase <= 1) { + std::string suiteDir = args.testSuiteDir; + if (!fs::path(suiteDir).is_absolute()) { + suiteDir = caller->getOriginalPath() + "/" + suiteDir; + } + Map2Check::TestSuiteWriter::removeTestCases(suiteDir); + } + // Recorded now, not at the end: an exception in this phase must not leak + // the store or the slice cache past the cleanup in main. + lastSeedStore = caller->seedStorePath(); + lastSliceCache = caller->sliceCachePath(); + lastBuildCache = caller->buildCachePath(); + caller->engineSeconds = &lastEngineSeconds; + caller->feedsKleePhase = + args.feedsKlee >= 0 ? (args.feedsKlee == 1) : (args.phase == 1); + caller->engineWindow = args.engineWindow; + caller->stagnationLimit = args.stagnationLimit; + caller->sliceProgram = args.sliceProgram; caller->setTimeout(args.timeout); caller->entryFunction = args.entryFunction; caller->wasmMode = args.wasmMode; - if (!is_llvmir_in) { - if (args.invCrabLlvm) { - // cout << "crab \n"; - caller->compileToCrabLlvm(); - } else { - caller->compileCFile(is_llvmir_in); - } + // Availability was settled in main(), which refuses the run outright when + // the generator is missing. Reaching here with invCrabLlvm set means the + // generator is installed. The old code branched on !is_llvmir_in and so + // never even looked at the flag for bitcode input -- how the baselines, the + // CASTLE harness and the BenchExec wrappers all invoke the tool -- which is + // why it was ignored without a trace (issue #54). + if (!is_llvmir_in && args.invCrabLlvm) { + caller->compileWithClam(); } else { caller->compileCFile(is_llvmir_in); } @@ -239,7 +665,54 @@ int map2check_execution(map2check_args args) { } // (2) Instrument functions for current mode + // BEFORE instrumentation, and the order was learned the hard way. + // + // Slicing after callPass fatally removes the instrumentation: the slicer + // keeps what the target depends on, and the runtime calls that RECORD the + // violation do not influence whether the target is reachable, so they are + // exactly what gets dropped. Measured -- two tasks went from FAILED to + // UNKNOWN while the bitcode shrank by 70% and 38%: the analysis still + // reached the bug and no longer had the machinery to say so. + // + // Slicing the user's program first and instrumenting the slice keeps both + // properties: the search space is smaller and the instrumentation is added + // to what survives. + // + // Slicing needs a criterion, and Cover-Branches has none -- every branch is + // the goal. Asking there is refused, not ignored. Reachability slices towards + // the target and assert towards the two functions AssertPass instruments, + // both here, before instrumentation; memory and overflow slice after it + // (below), towards the runtime calls the instrumentation inserted. + if (args.sliceProgram) { + if (args.mode == Map2Check::Map2CheckMode::REACHABILITY_MODE) { + caller->sliceWithRespectToTarget(args.function, {args.function}); + } else if (args.mode == Map2Check::Map2CheckMode::ASSERT_MODE) { + caller->sliceWithRespectToTarget("__VERIFIER_assert", + {"__VERIFIER_assert", "__assert_fail"}); + } else { + if (args.mode != Map2Check::Map2CheckMode::MEMTRACK_MODE && + args.mode != Map2Check::Map2CheckMode::MEMCLEANUP_MODE && + args.mode != Map2Check::Map2CheckMode::OVERFLOW_MODE) { + Map2Check::Log::Warning( + "--slice applies to reachability, assert, memory and overflow " + "properties only: there is no criterion to slice towards when the " + "goal is branch coverage. Analysing the whole program."); + } + } + } + caller->callPass(args.function); + + // Memory and overflow slice the INSTRUMENTED module (see + // sliceInstrumented): their criterion is the runtime calls the + // instrumentation inserted -- map2check_malloc/check_deref/... for memory, + // map2check_binop_* for overflow. + if (args.sliceProgram && + (args.mode == Map2Check::Map2CheckMode::MEMTRACK_MODE || + args.mode == Map2Check::Map2CheckMode::MEMCLEANUP_MODE || + args.mode == Map2Check::Map2CheckMode::OVERFLOW_MODE)) { + caller->sliceInstrumented(); + } caller->linkLLVM(); // (3) Apply nondeterministic mode and execute analysis @@ -254,16 +727,92 @@ int map2check_execution(map2check_args args) { Map2Check::PropertyViolated propertyViolated; - // HACK: Fix this!!! - if (caller->isTimeout()) { + // What the analysis actually recorded on disk, in map2check_property. + Map2Check::PropertyViolated recorded = counterExample->getProperty(); + bool recordedAViolation = + (recorded != Map2Check::PropertyViolated::NONE) && + (recorded != Map2Check::PropertyViolated::UNKNOWN); + + // A violation that was found and written down survives the budget expiring. + // + // KLEE keeps exploring other states after recording an error, so it is + // routinely killed by `timeout` on a run that already succeeded. The timeout + // check used to come first and overwrite the verdict, discarding a FALSE + // whose counterexample was sitting in map2check_property. The budget running + // out AFTER the tool did its job is not "unable to decide" -- it is a + // decision plus a slow shutdown. See finding K in + // docs/reports/2026-08-12-castle-juliet-findings.md. + // + // Scope is deliberately narrow, and the narrowing has to be spelled out in + // the CONDITION and not merely in a comment: the timeout branch runs before + // the AFL++ arm, so without this guard an AFL++ run whose crash could + // not be replayed would have its property file trusted anyway -- the exact + // evidence that should not be trusted. That is not hypothetical: under the + // hybrid default every case runs AFL++ first with 0.2x the budget, and + // "Forcing timeout" appears in 2031 of the 2526 raw logs of the v5 Juliet + // baseline. + bool evidenceIsTrustworthy = + recordedAViolation && + (generator != Map2Check::NonDetGenerator::AFLPlusPlus || + caller->isVerified()); + + if (evidenceIsTrustworthy && caller->isTimeout()) { + Map2Check::Log::Warning( + "Note: budget expired after a violation was already found -- keeping " + "the violation"); + propertyViolated = recorded; + } else if (caller->isTimeout()) { Map2Check::Log::Warning("Note: Forcing timeout"); propertyViolated = Map2Check::PropertyViolated::UNKNOWN; } else if (!caller->isVerified() && - (generator == Map2Check::NonDetGenerator::LibFuzzer)) { + (generator == Map2Check::NonDetGenerator::AFLPlusPlus)) { Map2Check::Log::Warning("Note: Could not replicate error"); propertyViolated = Map2Check::PropertyViolated::UNKNOWN; } else { - propertyViolated = counterExample->getProperty(); + propertyViolated = recorded; + } + + // A violation nobody can demonstrate is not a violation worth reporting. + // + // KLEE can burn its whole budget, halt on the timer, and still leave + // TARGET-REACHED in map2check_property: some state wrote the file through an + // external call and was then terminated by --dump-states-on-halt without + // ever running to the abort. The verdict logic above trusts that file, so + // the run answers FAILED while emitting a suite with zero elements. + // + // Measured on reducercommutativity/rangesum05.i with --nondet-generator + // symex: 1446 paths explored, HaltTimer, zero .err files, klee_log.csv + // empty, verdict FAILED, suite empty, TestCov UNKNOWN. This is where the + // FAILED-but-NOT_COVERED cases come from -- 21% of the control arm's FAILED + // verdicts in the v11 factorial. + // + // Downgrading costs nothing that was ever scored. Test-Comp scores the + // SUITE, not the verdict, and a suite with no inputs covers nothing whether + // the tool called it FAILED or UNKNOWN. What it buys is a precision number + // that means something. + // + // Gated on generating a suite at all, and on the two sources emitTestSuite + // itself consults -- so the check can never disagree with what gets written. + // + // "Recovered" includes the EMPTY vector of an aborting path: a program that + // reads no input reaches its error with zero elements, and that + // test case covers it (tests/testcomp/programs/no_input.c). Counting only + // non-empty vectors downgraded exactly that case to UNKNOWN. + if (args.generateTestSuite && !args.coverBranches && + args.mode == Map2Check::Map2CheckMode::REACHABILITY_MODE && + generator == Map2Check::NonDetGenerator::Klee && + propertyViolated != Map2Check::PropertyViolated::NONE && + propertyViolated != Map2Check::PropertyViolated::UNKNOWN) { + const bool haveVector = + !Map2Check::readNonDetLog(Map2Check::kleeLogCSV).empty() || + Map2Check::hasViolatingKtest(Map2Check::kleeOutputDir); + if (!haveVector) { + Map2Check::Log::Warning( + "the property file records a violation but no input vector could be " + "recovered -- reporting UNKNOWN rather than a FAILED nothing can " + "reproduce"); + propertyViolated = Map2Check::PropertyViolated::UNKNOWN; + } } if (propertyViolated == @@ -280,16 +829,26 @@ int map2check_execution(map2check_args args) { } else { Map2Check::Log::Info(""); Map2Check::Log::Info("VERIFICATION SUCCEEDED"); + provedSafe = true; if (args.generateWitness) generate_witness(args.inputFile, propertyViolated, args.spectTrue); } } } else if (propertyViolated == Map2Check::PropertyViolated::UNKNOWN) { - if (generator == Map2Check::NonDetGenerator::Klee) { - Map2Check::Log::Info("Unable to prove or falsify the program."); - Map2Check::Log::Info("VERIFICATION UNKNOWN"); - if (args.debugMode) counterExample->generateTestCase(); + // Printed for every generator, not just KLEE. Guarded on Klee, an + // undecided AFL++ run ended with NO verdict line at all, and a caller + // that parses stdout for one -- every harness here, and the BenchExec + // tool-info -- reads that silence as the tool having crashed. It is the + // same defect as the discarded exit code (finding G), one layer up: the + // analysis reached a conclusion and did not say so. + // + // Visible in the numbers: the fuzzer arm of the engine comparison recorded + // ERROR for whole categories that had simply come back undecided. + Map2Check::Log::Info("Unable to prove or falsify the program."); + Map2Check::Log::Info("VERIFICATION UNKNOWN"); + if (args.debugMode && generator == Map2Check::NonDetGenerator::Klee) { + counterExample->generateTestCase(); } } else { Map2Check::Log::Info("Started counter example generation"); @@ -300,14 +859,59 @@ int map2check_execution(map2check_args args) { generate_witness(args.inputFile, propertyViolated, args.spectTrue); } + // Emitted for every outcome, not only for a violation. Test-Comp scores the + // suite, and a run that decides nothing still has to hand one over: the + // competition harness reads an absent test-suite/ as a crashed tool rather + // than as an empty result. The `foundViolation` flag decides whether the + // suite carries a test case, not whether the suite exists. + if (args.generateTestSuite) { + // Relative paths resolve against the directory map2check was invoked + // from, not the scratch directory the pipeline chdir'd into -- the suite + // has to outlive cleanGarbage(). + std::string outputDir = args.testSuiteDir; + if (!fs::path(outputDir).is_absolute()) { + outputDir = caller->getOriginalPath() + "/" + outputDir; + } + // Cover-Branches used only KLEE's paths: the fuzzer's corpus, the inputs + // that reached new edges, was thrown away with the scratch directory. + // On by default since 9.0 (R22: 49.7% against 44.7% on the fixed hybrid; + // R26: 53.5% with the alternation); MAP2CHECK_FUZZER_SUITE=0 turns it off. + std::vector> fuzzerVectors; + const char *fuzzerSuite = std::getenv("MAP2CHECK_FUZZER_SUITE"); + if (args.coverBranches && + !(fuzzerSuite != nullptr && std::string(fuzzerSuite) == "0") && + generator == Map2Check::NonDetGenerator::AFLPlusPlus) { + fuzzerVectors = caller->fuzzerCorpusVectors(kMaxBranchTestCases); + } + emitTestSuite(outputDir, caller->c_program_fullpath, args.entryFunction, + args.architecture, + resolveSpecification(args.propertyFile, + caller->getOriginalPath(), args.mode), + foundViolation, args.coverBranches, args.mode, + fuzzerVectors); + } + // (6) Clean map2check execution (folders and temp files) - Map2Check::Log::Debug("Removing temp files"); - caller->cleanGarbage(); + // Kept under --debug: every intermediate artefact of a run lives in that + // scratch directory -- the compiled bitcode, the instrumented bitcode, the + // nondet log -- and deleting it unconditionally makes the pipeline + // impossible to inspect after the fact. Debug runs are already opting into + // verbosity and disk use. + lastSeedStore = caller->seedStorePath(); + lastSliceCache = caller->sliceCachePath(); + if (args.debugMode) { + Map2Check::Log::Info("Debug mode: keeping temp files in " + + caller->getScratchDir()); + caller->restoreWorkingDirectory(); + } else { + Map2Check::Log::Debug("Removing temp files"); + caller->cleanGarbage(); + } if (args.expectedResult != "") { if (args.expectedResult != counterExample->getViolatedProperty()) { Map2Check::Log::Fatal("Expected result failed"); - abort(); + return ERROR_EXPECTED_RESULT; } } @@ -325,7 +929,7 @@ int main(int argc, char **argv) { ("input-file", po::value>(), "\tspecifies the files") ("nondet-generator", po::value(), - R"(specifies the nondet-generator, valid values are fuzzer (libFuzzer), + R"(specifies the nondet-generator, valid values are afl (AFL++), symex (Klee))") ("smt-solver", po::value()->default_value("z3"), R"(specifies the smt-solver, valid values are stp (STP), @@ -343,6 +947,33 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") ("check-asserts", "\tanalyze program and verify assert failures") ("add-invariants", "\tadding program invariants adopting Crab-LLVM") ("generate-witness", "\tgenerates witness file") + ("generate-test-suite", + "\temits a Test-Comp test suite reproducing the violation found") + ("test-suite-dir", po::value()->default_value("test-suite"), + "\tdirectory to write the test suite into") + ("slice", + "\tslice the program with respect to the target (reachability), " + "the assertions (--check-asserts) or the runtime checks (--memtrack, " + "--memcleanup-property, --check-overflow) before analysing it; needs " + "sbt-slicer") + ("alternate-engines", + "\tthe default hybrid (needs --timeout): the fuzzer and KLEE take " + "turns, each stopped once it stops finding coverage, with windows " + "that double every round, handing each other seeds") + ("fixed-hybrid", + "\tthe 8.x hybrid instead: the fuzzer for 0.2 of the budget, then " + "KLEE (with --seed-exchange: 0.2 / 0.6 / 0.2 and a last fuzzer phase)") + ("seed-exchange", + "\tlet the two engines hand each other input vectors through a shared " + "seed corpus (implied by the default hybrid; with --fixed-hybrid, off " + "unless given)") + ("cover-branches", + "\temit one test case per path KLEE explored, from its .ktest output, " + "instead of the single violating vector (Test-Comp Cover-Branches)") + ("property-file", po::value(), + "\tproperty file whose contents go verbatim into ") + ("architecture", po::value()->default_value("64bit"), + "\tmachine model recorded in the test-suite metadata") ("expected-result", po::value(), "\tspecifies type of violation expected") ("btree", "\tuses btree structure to hold information (experimental, use this " "if you are having memory problems)") @@ -439,6 +1070,62 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") if (vm.count("generate-witness")) { args.generateWitness = true; } + if (vm.count("generate-test-suite")) { + args.generateTestSuite = true; + } + if (vm.count("test-suite-dir")) { + args.testSuiteDir = vm["test-suite-dir"].as(); + } + if (vm.count("slice")) { + args.sliceProgram = true; + } + if (vm.count("seed-exchange")) { + args.seedExchange = true; + } + // The hybrid is the alternation by default since 9.0: measured on the + // 213-task Cover-Error sample it ties the seed-exchange hybrid (157 each, + // against 128 for the 8.x fixed hybrid) and leads Cover-Branches (53.5% + // against 46.5%, R26). --fixed-hybrid keeps the 8.x schedule. + const bool hybrid = !vm.count("nondet-generator"); + const bool budgeted = + vm.count("timeout") && vm["timeout"].as() > 0; + if (vm.count("fixed-hybrid")) { + if (vm.count("alternate-engines")) { + Map2Check::Log::Warning( + "--fixed-hybrid and --alternate-engines both given -- using the " + "fixed hybrid"); + } + } else if (hybrid && budgeted) { + args.alternateEngines = true; + args.seedExchange = true; + } else if (vm.count("alternate-engines")) { + // Windows and stagnation are fractions of the budget, and turns only + // exist on the hybrid path: without either, say so instead of running + // something else under the flag's name. + Map2Check::Log::Warning( + !budgeted ? "--alternate-engines needs --timeout: its windows are " + "fractions of the budget -- running the fixed hybrid " + "instead" + : "--alternate-engines applies to the hybrid only -- " + "ignored with --nondet-generator"); + } + if (vm.count("cover-branches")) { + args.coverBranches = true; + // The mode has to change too, not just the emitter. Without this the run + // falls through to the MEMTRACK default and instruments memory tracking + // for a task that checks no property -- which on the Test-Comp corpus + // produced a broken module and an empty suite on all 110 ProductLines + // tasks. Set here rather than beside the other mode flags because + // --cover-branches is a goal, and the other flags are properties; this + // is the one goal that implies the absence of a property. + args.mode = Map2Check::Map2CheckMode::COVER_BRANCHES_MODE; + } + if (vm.count("property-file")) { + args.propertyFile = vm["property-file"].as(); + } + if (vm.count("architecture")) { + args.architecture = vm["architecture"].as(); + } if (vm.count("generate-testcase")) { args.generateTestCase = true; } @@ -454,7 +1141,7 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") generatorname.begin(), [](unsigned char c){ return std::tolower(c); }); - std::vector available_generators = {"fuzzer", "symex"}; + std::vector available_generators = {"afl", "symex"}; if ( !std::count(available_generators.begin(), available_generators.end(), generatorname) ) { std::cout << "Selected generator don't exist, available: "; @@ -466,13 +1153,32 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") } else { std::cout << "Adopting " + generatorname + " nondet-generator... \n"; if(generatorname == available_generators[0]) - args.generator = Map2Check::NonDetGenerator::LibFuzzer; + args.generator = Map2Check::NonDetGenerator::AFLPlusPlus; if(generatorname == available_generators[1]) args.generator = Map2Check::NonDetGenerator::Klee; } } else { args.generator = Map2Check::NonDetGenerator::None; } + // Validated here, next to the other option checks, rather than inside + // map2check_execution: main() is the only place whose return value becomes + // the process exit code, and asking for a capability the build does not + // have is an argument problem, not an analysis outcome. Doing it once here + // also avoids repeating it per generator on the hybrid path below. + // + // The exit code matters more than the message. A warning on stderr is what + // this used to be, and on a BenchExec cluster it disappears into the run + // log -- which is how --add-invariants stayed dead and unnoticed through + // an entire baseline (issue #54). + if (args.invCrabLlvm && !invariantGeneratorAvailable()) { + Map2Check::Log::Error( + "--add-invariants was requested but no invariant generator is " + "installed. Crab-LLVM was renamed to Clam and this build does not " + "ship it; rebuild with -DENABLE_CLAM=ON, or drop the flag. Refusing " + "to continue rather than silently analysing without invariants."); + return ERROR_UNAVAILABLE_CAPABILITY; + } + if (vm.count("input-file")) { std::string pathfile; pathfile = accumulate( @@ -483,16 +1189,71 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") // std::cout << pathfile << std::endl; fs::path absolute_path = fs::absolute(pathfile); args.inputFile = absolute_path.string(); + // The store outlives the phases, not the run: removed on every way out + // of this block (returns and exceptions alike), unless --debug keeps it. + struct SeedStoreCleanup { + const map2check_args &args; + ~SeedStoreCleanup() { + if (args.seedExchange && !args.debugMode && !lastSeedStore.empty()) { + std::error_code storeError; + std::filesystem::remove_all(lastSeedStore, storeError); + } + if (args.sliceProgram && !args.debugMode && !lastSliceCache.empty()) { + std::error_code cacheError; + std::filesystem::remove_all(lastSliceCache, cacheError); + } + if (!args.debugMode && !lastBuildCache.empty()) { + std::error_code cacheError; + std::filesystem::remove_all(lastBuildCache, cacheError); + } + } + } seedStoreCleanup{args}; + if (args.generator == Map2Check::NonDetGenerator::None && + args.alternateEngines) { + return alternateEngines(args); + } if(args.generator == Map2Check::NonDetGenerator::None) { - args.generator = Map2Check::NonDetGenerator::LibFuzzer; - map2check_execution(args); + args.generator = Map2Check::NonDetGenerator::AFLPlusPlus; + args.phase = 1; + int result = map2check_execution(args); + if (result != SUCCESS) { + return result; + } if (!foundViolation) { args.generator = Map2Check::NonDetGenerator::Klee; - map2check_execution(args); + args.phase = 2; + result = map2check_execution(args); + if (result != SUCCESS) { + return result; + } + } + // A third phase, and it is what closes the exchange loop. + // + // The order is fuzzer then KLEE, so KLEE's vectors -- written into the + // seed corpus at the end of its phase -- have no consumer inside the + // same run. Without this the exchange only ever paid off on a LATER + // run. Handing them straight back to the fuzzer is what turns two + // engines running in sequence into two engines that cooperate: KLEE + // solves the guard the fuzzer could not reach by mutation, and the + // fuzzer mutates outward from there far faster than KLEE can fork. + // + // Behind the flag: the hybrid was measured at 45% covered over 372 + // tasks in its current shape, and that number should keep meaning what + // it means until this one is measured beside it. + if (args.seedExchange && !foundViolation && !provedSafe) { + args.generator = Map2Check::NonDetGenerator::AFLPlusPlus; + args.phase = 3; + result = map2check_execution(args); + if (result != SUCCESS) { + return result; + } } } else { - map2check_execution(args); + int result = map2check_execution(args); + if (result != SUCCESS) { + return result; + } } } } catch (std::exception &e) { diff --git a/modules/frontend/test_suite/CMakeLists.txt b/modules/frontend/test_suite/CMakeLists.txt new file mode 100644 index 000000000..8e71ed715 --- /dev/null +++ b/modules/frontend/test_suite/CMakeLists.txt @@ -0,0 +1,5 @@ +# One object library for both sources: they are two halves of the same job -- +# serialising a Test-Comp suite -- and the frontend links the pair together in +# every configuration. +add_library(TestSuite OBJECT test_suite.cpp ktest_reader.cpp) +set_target_properties(TestSuite PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) diff --git a/modules/frontend/test_suite/ktest_reader.cpp b/modules/frontend/test_suite/ktest_reader.cpp new file mode 100644 index 000000000..32ae30b00 --- /dev/null +++ b/modules/frontend/test_suite/ktest_reader.cpp @@ -0,0 +1,537 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "ktest_reader.hpp" + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +namespace Map2Check { + +namespace { + +// Layout, from KLEE's own ktest-tool: a five-byte magic, then big-endian +// 32-bit counts throughout. Version 2 and later carry two extra symbolic-argv +// fields between the arguments and the objects. +constexpr char kMagicKtest[] = "KTEST"; +constexpr char kMagicBout[] = "BOUT\n"; +constexpr size_t kMagicSize = 5; + +// A sanity bound on any length read from the file. A truncated or foreign file +// yields huge counts, and resizing a vector to them is how a parser turns a +// bad input into an out-of-memory kill rather than a skipped file. +constexpr uint32_t kMaxReasonableLength = 1u << 24; // 16 MiB + +bool readBigEndian32(std::ifstream& in, uint32_t* out) { + unsigned char raw[4]; + in.read(reinterpret_cast(raw), 4); + if (in.gcount() != 4) return false; + *out = (static_cast(raw[0]) << 24) | + (static_cast(raw[1]) << 16) | + (static_cast(raw[2]) << 8) | static_cast(raw[3]); + return true; +} + +void putBigEndian32(std::ofstream& out, uint32_t value) { + const unsigned char raw[4] = { + static_cast((value >> 24) & 0xff), + static_cast((value >> 16) & 0xff), + static_cast((value >> 8) & 0xff), + static_cast(value & 0xff)}; + out.write(reinterpret_cast(raw), 4); +} + +/** The name and width KLEE uses for a NONDET_TYPE enumerator. + * + * Both halves have to agree with the runtime or a seed means nothing: the name + * is what klee_make_symbolic was called with (NonDetGeneratorKlee.c), and the + * width is what the fuzzer consumes per read (NonDetGeneratorAFL.c). + * Enumerator values come from enum NONDET_TYPE in Map2CheckTypes.h. */ +struct NonDetTypeInfo { + const char* name; + size_t width; + bool isFloating; + bool isUnsigned; +}; + +NonDetTypeInfo nonDetTypeInfo(int type) { + switch (type) { + case 0: return {"non_det_int", sizeof(int), false, false}; + case 1: return {"non_det_char", sizeof(char), false, false}; + case 2: return {"non_det_pointer", sizeof(void*), false, true}; + case 3: return {"non_det_ushort", sizeof(unsigned short), false, true}; + case 4: return {"non_det_long", sizeof(int64_t), false, false}; + case 5: return {"non_det_unsigned", sizeof(unsigned), false, true}; + case 6: return {"non_det_ulong", sizeof(uint64_t), false, true}; + case 7: return {"non_det_bool", sizeof(int), false, false}; + case 8: return {"non_det_uchar", sizeof(unsigned char), false, true}; + case 10: return {"non_det_size_t", sizeof(size_t), false, true}; + case 13: return {"non_det_uint", sizeof(unsigned), false, true}; + case 14: return {"non_det_short", sizeof(short), false, false}; + case 15: return {"non_det_double", sizeof(double), true, false}; + case 16: return {"non_det_float", sizeof(float), true, false}; + case 17: return {"non_det_longlong", sizeof(int64_t), false, false}; + case 18: return {"non_det_ulonglong", sizeof(uint64_t), false, true}; + case 19: return {"non_det_u8", sizeof(uint8_t), false, true}; + case 20: return {"non_det_u16", sizeof(uint16_t), false, true}; + case 21: return {"non_det_u32", sizeof(uint32_t), false, true}; + // 22 (MEMORY_BYTE) is deliberately absent: the runtime logs a + // __VERIFIER_nondet_memory call as one row per byte, KLEE holds it as ONE + // object, and the log does not say where one call's bytes end. The seed + // stops there, as it does at a pchar. + default: return {nullptr, 0, false, false}; + } +} + +/** Encodes a logged decimal value into the object's little-endian bytes. */ +void encodeValue(const std::string& text, const NonDetTypeInfo& info, + std::vector* out) { + if (info.isFloating && info.width == sizeof(float)) { + float value = 0.0f; + try { + value = std::stof(text); + } catch (const std::exception&) { + value = 0.0f; + } + std::memcpy(out->data(), &value, std::min(out->size(), sizeof(float))); + return; + } + if (info.isFloating) { + double value = 0.0; + try { + value = std::stod(text); + } catch (const std::exception&) { + value = 0.0; + } + std::memcpy(out->data(), &value, + std::min(out->size(), sizeof(double))); + return; + } + uint64_t raw = 0; + try { + // Parsed as signed first so a logged "-1" round-trips; the bit pattern is + // the same either way, and the width below is what actually matters. + raw = static_cast(std::stoll(text)); + } catch (const std::exception&) { + try { + raw = std::stoull(text); + } catch (const std::exception&) { + raw = 0; + } + } + for (size_t i = 0; i < out->size() && i < 8; ++i) { + (*out)[i] = static_cast((raw >> (8 * i)) & 0xff); + } +} + +bool skipBlock(std::ifstream& in) { + uint32_t size = 0; + if (!readBigEndian32(in, &size)) return false; + if (size > kMaxReasonableLength) return false; + in.seekg(size, std::ios::cur); + return in.good(); +} + +/** Reads `size` bytes of little-endian integer into a 64-bit value. + * + * x86-64 is the only architecture this tool targets, and KLEE writes object + * bytes in the target's own order. */ +uint64_t leBytesToUnsigned(const std::vector& bytes) { + uint64_t value = 0; + const size_t width = std::min(bytes.size(), 8); + for (size_t i = 0; i < width; ++i) { + value |= static_cast(bytes[i]) << (8 * i); + } + return value; +} + +int64_t signExtend(uint64_t value, size_t byteWidth) { + if (byteWidth == 0 || byteWidth >= 8) return static_cast(value); + const uint64_t signBit = 1ull << (byteWidth * 8 - 1); + if (value & signBit) { + value |= ~((1ull << (byteWidth * 8)) - 1); + } + return static_cast(value); +} + +bool isUnsignedName(const std::string& name) { + static const char* kUnsigned[] = { + "non_det_unsigned", "non_det_uint", "non_det_ulong", + "non_det_ushort", "non_det_uchar", "non_det_size_t", + "non_det_bool", "non_det_pointer", "non_det_ulonglong", + "non_det_u8", "non_det_u16", "non_det_u32"}; + for (const char* candidate : kUnsigned) { + if (name == candidate) return true; + } + return false; +} + +} // namespace + +std::vector readKtestFile(const std::string& path, bool* pruned) { + std::vector objects; + if (pruned != nullptr) *pruned = false; + std::ifstream in(path, std::ios::binary); + if (!in.is_open()) return objects; + + char magic[kMagicSize + 1] = {0}; + in.read(magic, kMagicSize); + if (in.gcount() != static_cast(kMagicSize)) return objects; + if (std::memcmp(magic, kMagicKtest, kMagicSize) != 0 && + std::memcmp(magic, kMagicBout, kMagicSize) != 0) { + return objects; + } + + uint32_t version = 0; + if (!readBigEndian32(in, &version)) return objects; + + uint32_t numArgs = 0; + if (!readBigEndian32(in, &numArgs)) return objects; + if (numArgs > kMaxReasonableLength) return objects; + for (uint32_t i = 0; i < numArgs; ++i) { + if (!skipBlock(in)) return objects; + } + + if (version >= 2) { + uint32_t symArgvs = 0; + uint32_t symArgvLen = 0; + if (!readBigEndian32(in, &symArgvs)) return objects; + if (!readBigEndian32(in, &symArgvLen)) return objects; + } + + uint32_t numObjects = 0; + if (!readBigEndian32(in, &numObjects)) return objects; + if (numObjects > kMaxReasonableLength) return objects; + + for (uint32_t i = 0; i < numObjects; ++i) { + uint32_t nameSize = 0; + if (!readBigEndian32(in, &nameSize)) break; + if (nameSize > kMaxReasonableLength) break; + std::string name(nameSize, '\0'); + in.read(name.data(), nameSize); + if (in.gcount() != static_cast(nameSize)) break; + + uint32_t dataSize = 0; + if (!readBigEndian32(in, &dataSize)) break; + if (dataSize > kMaxReasonableLength) break; + std::vector bytes(dataSize); + if (dataSize > 0) { + in.read(reinterpret_cast(bytes.data()), dataSize); + if (in.gcount() != static_cast(dataSize)) break; + } + + // A partial object is dropped, but the ones already read are kept: a + // .ktest truncated by a kill still describes a usable prefix of the path, + // and the same forgiving rule governs the CSV log. + if (name == kPrunedPathMarker) { + if (pruned != nullptr) *pruned = true; + continue; + } + objects.push_back(KtestObject{name, std::move(bytes)}); + } + + return objects; +} + +std::string decodeKtestObject(const KtestObject& object) { + if (object.bytes.empty()) return "0"; + + if (object.name == "non_det_double") { + double value = 0.0; + const size_t width = std::min(object.bytes.size(), sizeof(double)); + std::memcpy(&value, object.bytes.data(), width); + // %f-style, matching what the CSV log emits for a double, so a suite reads + // the same whichever source produced it. + std::string text = std::to_string(value); + return text; + } + + if (object.name == "non_det_float") { + float value = 0.0f; + const size_t width = std::min(object.bytes.size(), sizeof(float)); + std::memcpy(&value, object.bytes.data(), width); + // %.9g round-trips any float, as the CSV log prints it; the validators + // parse it with %f. + char text[32]; + std::snprintf(text, sizeof(text), "%.9g", static_cast(value)); + return text; + } + + const uint64_t raw = leBytesToUnsigned(object.bytes); + if (isUnsignedName(object.name)) { + return std::to_string(raw); + } + // Signed by default, including for an unrecognised name. Getting the + // signedness wrong turns -1 into 4294967295, which a validator rejects as + // out of range far more visibly than it would a wrong-but-plausible value. + return std::to_string(signExtend(raw, object.bytes.size())); +} + +std::vector decodeKtestInputs(const KtestObject& object) { + if (object.name != kMemoryObject) return {decodeKtestObject(object)}; + std::vector inputs; + inputs.reserve(object.bytes.size()); + for (uint8_t byte : object.bytes) inputs.push_back(std::to_string(byte)); + return inputs; +} + +std::vector readViolatingKtest(const std::string& kleeOutDir) { + std::error_code error; + if (!std::filesystem::is_directory(kleeOutDir, error)) return {}; + + // KLEE names the report for a failing path testNNNNNN..err beside + // testNNNNNN.ktest -- .abort.err for an abort, .ptr.err for a bad + // dereference, and so on. The stem up to the first dot is the path number, + // which is the whole link between the two files. + // + // Only .abort.err. KLEE writes .ptr.err, .free.err, .div.err and others for + // failures that are not this tool's target, and taking any of them would + // return the vector of an unrelated path. Even .abort.err is not proof on + // its own -- the sv-benchmarks assumption idiom aborts too -- which is why + // the caller gates this on the runtime having recorded a violation. + std::vector candidates; + const std::string kAbortSuffix = ".abort.err"; + for (const auto& entry : + std::filesystem::directory_iterator(kleeOutDir, error)) { + const std::string name = entry.path().filename().string(); + if (name.size() <= kAbortSuffix.size()) continue; + if (name.compare(name.size() - kAbortSuffix.size(), kAbortSuffix.size(), + kAbortSuffix) != 0) { + continue; + } + candidates.push_back(name.substr(0, name.size() - kAbortSuffix.size())); + } + // Sorted so that a run with several failing paths always yields the same + // one. Arbitrary, but arbitrary-and-stable beats arbitrary-and-not: a suite + // that changes between identical runs cannot be diffed. + std::sort(candidates.begin(), candidates.end()); + + for (const std::string& stem : candidates) { + std::vector objects = + readKtestFile((std::filesystem::path(kleeOutDir) / (stem + ".ktest")) + .string()); + if (objects.empty()) continue; + std::vector inputs; + inputs.reserve(objects.size()); + for (const KtestObject& object : objects) { + const std::vector decoded = decodeKtestInputs(object); + inputs.insert(inputs.end(), decoded.begin(), decoded.end()); + } + return inputs; + } + return {}; +} + +bool hasViolatingKtest(const std::string& kleeOutDir) { + std::error_code error; + if (!std::filesystem::is_directory(kleeOutDir, error)) return false; + const std::string kAbortSuffix = ".abort.err"; + for (const auto& entry : + std::filesystem::directory_iterator(kleeOutDir, error)) { + const std::string name = entry.path().filename().string(); + if (name.size() <= kAbortSuffix.size()) continue; + if (name.compare(name.size() - kAbortSuffix.size(), kAbortSuffix.size(), + kAbortSuffix) != 0) { + continue; + } + const std::string stem = name.substr(0, name.size() - kAbortSuffix.size()); + if (std::filesystem::exists( + std::filesystem::path(kleeOutDir) / (stem + ".ktest"), error)) { + return true; + } + } + return false; +} + +bool kleeHaltedOnTimer(const std::string& kleeOutDir) { + std::ifstream messages( + (std::filesystem::path(kleeOutDir) / "messages.txt").string()); + std::string line; + while (std::getline(messages, line)) { + if (line.find("HaltTimer invoked") != std::string::npos) return true; + } + return false; +} + +std::string kleeDroppedPaths(const std::string& kleeOutDir) { + if (kleeHaltedOnTimer(kleeOutDir)) return "halted on its timer"; + + const std::filesystem::path dir(kleeOutDir); + std::string line; + std::ifstream warnings((dir / "warnings.txt").string()); + while (std::getline(warnings, line)) { + if (line.find("silently concretizing") != std::string::npos) { + return "concretized a symbolic value"; + } + // Near --max-memory KLEE stops forking and follows one side of each + // branch at random, or kills states outright; either way it can still + // empty its queue and exit 0. + if (line.find("skipping fork") != std::string::npos || + line.find("over memory cap") != std::string::npos) { + return "hit its memory cap"; + } + } + + // KLEE that died (a solver crash, an LLVM assertion, the OOM killer) writes + // none of the marks below and no "done" lines -- while the paths it did + // finish may have written NONE to the property file. + bool finished = false; + std::ifstream info((dir / "info").string()); + while (std::getline(info, line)) { + if (line.find("KLEE: done: completed paths") != std::string::npos) { + finished = true; + break; + } + } + if (!finished) return "did not finish its run"; + + // A state KLEE killed leaves a test with the reason: ..err for + // an error (a model limit, a memory error, an abort that halted the search), + // .early for an early termination (memory cap, depth, ...). Not + // "partially completed paths" in info: that counts the paths an assumption + // pruned too, and read that way no program with an assume_abort_if_not + // could ever be proved. + std::error_code error; + for (const auto& entry : std::filesystem::directory_iterator(dir, error)) { + const std::string name = entry.path().filename().string(); + auto endsWith = [&name](const std::string& suffix) { + return name.size() > suffix.size() && + name.compare(name.size() - suffix.size(), suffix.size(), + suffix) == 0; + }; + if (endsWith(".err") || endsWith(".early")) { + return "terminated states early (" + name + ")"; + } + } + return ""; +} + +std::vector> readKtestVectors( + const std::string& kleeOutDir, size_t limit, std::vector* pruned) { + std::vector> vectors; + if (pruned != nullptr) pruned->clear(); + std::error_code error; + if (!std::filesystem::is_directory(kleeOutDir, error)) return vectors; + + // Collected and sorted rather than taken in directory order: readdir order + // is filesystem-dependent, and KLEE's testNNNNNN numbering is the only + // stable ordering available. A suite numbered differently on each machine + // cannot be diffed or reproduced. + std::vector paths; + for (const auto& entry : + std::filesystem::directory_iterator(kleeOutDir, error)) { + if (entry.path().extension() != ".ktest") continue; + paths.push_back(entry.path().string()); + } + std::sort(paths.begin(), paths.end()); + + std::vector> prunedVectors; + for (const std::string& path : paths) { + if (vectors.size() >= limit) break; + bool isPruned = false; + std::vector objects = readKtestFile(path, &isPruned); + if (objects.empty()) continue; + if (isPruned && prunedVectors.size() >= limit) continue; + + std::vector inputs; + inputs.reserve(objects.size()); + for (const KtestObject& object : objects) { + const std::vector decoded = decodeKtestInputs(object); + inputs.insert(inputs.end(), decoded.begin(), decoded.end()); + } + (isPruned ? prunedVectors : vectors).push_back(std::move(inputs)); + } + if (pruned != nullptr) pruned->assign(vectors.size(), false); + for (std::vector& inputs : prunedVectors) { + if (vectors.size() >= limit) break; + vectors.push_back(std::move(inputs)); + if (pruned != nullptr) pruned->push_back(true); + } + return vectors; +} + +std::vector ktestToFuzzerBytes( + const std::vector& objects) { + std::vector bytes; + for (const KtestObject& object : objects) { + bytes.insert(bytes.end(), object.bytes.begin(), object.bytes.end()); + } + return bytes; +} + +bool writeKtestFile(const std::string& path, + const std::vector& objects) { + std::ofstream out(path, std::ios::binary); + if (!out.is_open()) return false; + + out.write(kMagicKtest, kMagicSize); + putBigEndian32(out, 3); // version + putBigEndian32(out, 1); // one argument, mirroring what KLEE records + const std::string argument = "map2check"; + putBigEndian32(out, static_cast(argument.size())); + out.write(argument.data(), static_cast(argument.size())); + putBigEndian32(out, 0); // symArgvs + putBigEndian32(out, 0); // symArgvLen + putBigEndian32(out, static_cast(objects.size())); + for (const KtestObject& object : objects) { + putBigEndian32(out, static_cast(object.name.size())); + out.write(object.name.data(), + static_cast(object.name.size())); + putBigEndian32(out, static_cast(object.bytes.size())); + if (!object.bytes.empty()) { + out.write(reinterpret_cast(object.bytes.data()), + static_cast(object.bytes.size())); + } + } + return out.good(); +} + +std::vector readNonDetLogAsObjects(const std::string& csvPath) { + std::vector objects; + std::ifstream in(csvPath); + if (!in.is_open()) return objects; + + std::string line; + while (std::getline(in, line)) { + if (line.empty()) continue; + std::vector fields; + std::string field; + std::istringstream row(line); + while (std::getline(row, field, ';')) fields.push_back(field); + if (fields.size() < 7) continue; + + const std::string& value = fields[5]; + // KLEE matches a seed's objects to its inputs by POSITION: a read this + // cannot express (pchar, loff_t, sector_t, or a malformed row) ends the + // seed here. Skipping it shifted every later value onto the wrong input. + int type = 0; + try { + type = std::stoi(fields[6]); + } catch (const std::exception&) { + break; + } + const NonDetTypeInfo info = nonDetTypeInfo(type); + if (info.name == nullptr) break; + + KtestObject object; + object.name = info.name; + object.bytes.assign(info.width, 0); + encodeValue(value, info, &object.bytes); + objects.push_back(std::move(object)); + } + return objects; +} + +} // namespace Map2Check diff --git a/modules/frontend/test_suite/ktest_reader.hpp b/modules/frontend/test_suite/ktest_reader.hpp new file mode 100644 index 000000000..86d7d76ec --- /dev/null +++ b/modules/frontend/test_suite/ktest_reader.hpp @@ -0,0 +1,169 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +/********************************************************************** + * Reading KLEE's own per-path test vectors. + * + * Cover-Error needs one test case, the violating one, and klee_log.csv holds + * it. Cover-Branches needs many, one per explored path -- and KLEE already + * computes exactly that: it writes klee-last/testNNNNNN.ktest per terminating + * path, recording each symbolic object in the order the program consumed it. + * + * Taking them from KLEE rather than having the runtime write its own logs is + * not a stylistic choice, it was measured. Making the instrumented program + * write one file per state turned a 1-second run that answered FAILED into a + * 100-second run that exhausted its budget and answered SUCCEEDED: every write + * is an external call KLEE executes concretely, and enough of them corrupt the + * result rather than merely slowing it. Reading .ktest files afterwards costs + * the search nothing, because the search is already over. + * + * The format is read directly rather than by shelling out to ktest-tool: the + * layout is nine lines of parsing, and a subprocess would put a Python + * interpreter on the path between a verification run and its test suite. + ***********************************************************************/ + +#ifndef MODULES_FRONTEND_TEST_SUITE_KTEST_READER_HPP_ +#define MODULES_FRONTEND_TEST_SUITE_KTEST_READER_HPP_ + +#include +#include +#include + +namespace Map2Check { + +/** One symbolic object: the name klee_make_symbolic was given, and its bytes. + * + * The name is where the type lives. A .ktest records name, size and bytes but + * no type, so a four-byte object could be an int, a float or half of a long; + * NonDetGeneratorKlee.c names them non_det_ precisely so this side can + * tell. That naming was broken until recently -- every object was called + * "non_det_#type", the macro's stringify operator having been written inside + * the string literal -- which is why decoding by name is worth asserting. */ +struct KtestObject { + std::string name; + std::vector bytes; +}; + +/** The object NonDetGeneratorKlee.c makes just before a failed assumption + * ends the path. It carries no input: it only marks the .ktest as a path the + * program itself declared infeasible. */ +constexpr const char* kPrunedPathMarker = "map2check_pruned"; + +/** Parses one .ktest file. Empty on a file that is absent or not a ktest. + * + * The pruned-path marker is never returned as an object; `pruned`, when given, + * says whether the file carried it. */ +std::vector readKtestFile(const std::string& path, + bool* pruned = nullptr); + +/** Renders one object as the decimal string a element carries. + * + * Decoding is driven by the object's NAME, falling back to its size when the + * name is unknown -- an unrecognised name is a new nondet type, not a reason + * to drop a test case. */ +std::string decodeKtestObject(const KtestObject& object); + +/** The object NonDetGeneratorKlee.c makes for __VERIFIER_nondet_memory(p, n): + * n bytes in one object. */ +constexpr const char* kMemoryObject = "non_det_memory"; + +/** Renders one object as the elements it stands for: one, except for a + * memory object, which is one uchar input per byte -- how the validators' + * harness reads __VERIFIER_nondet_memory. */ +std::vector decodeKtestInputs(const KtestObject& object); + +/** The input vector of the path KLEE flagged as an error, if there is one. + * + * For Cover-Error, where the suite needs the ONE vector that reaches the bug. + * The runtime's own klee_log.csv is supposed to hold it, and usually does not: + * the state that reaches the target aborts, an aborted state runs no exit + * handler, and the flush never happens. Measured on the Test-Comp corpus -- + * 290 of 376 runs that reported FAILED emitted a test case with zero + * elements, and TestCov scored every one of them as covering nothing. + * + * KLEE marks the offending path by writing testNNNNNN..err beside its + * .ktest, so the vector is identifiable without any cooperation from the + * runtime. Returns an empty vector when no path errored. */ +std::vector readViolatingKtest(const std::string& kleeOutDir); + +/** Whether KLEE flagged an aborting path whose .ktest is on disk at all. + * + * Unlike readViolatingKtest this also counts a path with ZERO objects: a + * program that reads no nondeterministic input reaches its error with the + * empty vector, and that empty vector is a complete, reproducible witness -- + * not the "nothing recovered" readViolatingKtest's empty result means. */ +bool hasViolatingKtest(const std::string& kleeOutDir); + +/** Whether KLEE stopped on its own --max-time rather than running out of + * paths ("HaltTimer invoked" in messages.txt). Such a run exits 0, exactly + * like a finished one, but it proves nothing: a short path having written + * NONE to the property file made a reachable null dereference read as TRUE. */ +bool kleeHaltedOnTimer(const std::string& kleeOutDir); + +/** Why KLEE's exploration was not exhaustive, or empty if it was. + * + * KLEE exits 0 whenever its state queue empties, and that is a proof only if + * no path was dropped on the way. Three ways to drop them, all exit 0: + * - the HaltTimer (see kleeHaltedOnTimer); + * - a symbolic input concretized ("silently concretizing" in warnings.txt): + * a nondet double pinned to 0 left one path and answered TRUE + * (float-benchs/sin_interpolated_index-1); + * - states KLEE killed with its own errors or early exits (a *.err or + * *.early test): a VLA of symbolic size did that in + * loops/insertion_sort-1-2, also answered TRUE. + * Also: KLEE hitting its memory cap ("skipping fork", "over memory cap"), and + * a KLEE that never finished (no "done: completed paths" in info -- a crash). + * A path pruned by an assumption is none of these: it ends in _exit, a + * normal exit, and leaves an ordinary .ktest. */ +std::string kleeDroppedPaths(const std::string& kleeOutDir); + +/** Every input vector KLEE recorded under `kleeOutDir`, one per .ktest. + * + * Ordered by file name, which is KLEE's own path numbering: stable across + * runs, so two runs over the same output number their test cases alike. + * `limit` bounds the suite. Vectors with no objects are dropped -- a path that + * read no input is not a test case. + * + * Paths a failed assumption pruned come after every other path. They still + * cover branches -- on a program whose every path meets a failed assumption + * they are the whole suite -- but they are usually shallow, and taken in KLEE's + * order they filled the suite's cap ahead of the deep paths: xcsp/AllInterval + * fell from 95% to 9% coverage. `pruned`, when given, flags each returned + * vector that came from such a path. */ +std::vector> readKtestVectors( + const std::string& kleeOutDir, size_t limit, + std::vector* pruned = nullptr); + +/** Serialises objects into the byte stream a fuzzer would consume. + * + * Sound only because both engines now agree on widths: NonDetGeneratorKlee.c + * passes sizeof(type) to klee_make_symbolic, and NonDetGeneratorAFL.c + * takes sizeof(type) bytes per read. Concatenating a .ktest's objects in order + * therefore produces exactly the buffer that would drive the fuzzer down the + * same path. Before the width fix this was impossible -- the fuzzer read one + * byte per value whatever the type, so most vectors had nowhere to go. */ +std::vector ktestToFuzzerBytes(const std::vector& objects); + +/** Writes objects as a .ktest, for handing KLEE a starting point. + * + * The counterpart of readKtestFile, used to turn what one engine learned into + * something the other can start from. False if the file could not be written. */ +bool writeKtestFile(const std::string& path, + const std::vector& objects); + +/** Reads the runtime's nondet log as typed objects. + * + * The log is the only place a fuzzer run records what it actually consumed -- + * value AND type, in consumption order -- so it is the bridge from a fuzzer + * result back into KLEE's format. Field 6 carries the NONDET_TYPE enumerator; + * see modules/backend/library/header/Map2CheckTypes.h. */ +std::vector readNonDetLogAsObjects(const std::string& csvPath); + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_TEST_SUITE_KTEST_READER_HPP_ diff --git a/modules/frontend/test_suite/test_suite.cpp b/modules/frontend/test_suite/test_suite.cpp new file mode 100644 index 000000000..dfbfbcc53 --- /dev/null +++ b/modules/frontend/test_suite/test_suite.cpp @@ -0,0 +1,247 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "test_suite.hpp" + +#include +#include +#include +#include +#include +#include + +namespace Map2Check { +namespace { + +const char kXmlDeclaration[] = + ""; + +const char kMetadataDoctype[] = + ""; + +const char kTestCaseDoctype[] = + ""; + +/** Marks a case as an assumption-pruned path (see evictPrunedCase). A comment + * is outside the test format, so validators and TestCov ignore it. Written + * right before ; documented in docs/test-suite-format.md. */ +const char kPrunedComment[] = ""; + +/** Field index of the value in a nondet log row. + * NonDetLog.c writes: id;line;scope;function_name;step;value;type */ +constexpr size_t kValueField = 5; +constexpr size_t kExpectedFields = 7; + +/** Nothing here is attacker-controlled, but a stray '&' in a program path + * would still produce a document no validator accepts -- and the failure would + * surface as a rejected suite rather than as an error from this code. */ +std::string escapeXml(const std::string& raw) { + std::string out; + out.reserve(raw.size()); + for (char c : raw) { + switch (c) { + case '&': + out += "&"; + break; + case '<': + out += "<"; + break; + case '>': + out += ">"; + break; + case '"': + out += """; + break; + case '\'': + out += "'"; + break; + default: + out += c; + } + } + return out; +} + +} // namespace + +std::string isoUtcNow() { + std::time_t now = std::time(nullptr); + std::tm utc{}; + gmtime_r(&now, &utc); + char buffer[21]; + std::strftime(buffer, sizeof(buffer), "%Y-%m-%dT%H:%M:%SZ", &utc); + return std::string(buffer); +} + +std::vector readNonDetLog(const std::string& csvPath) { + std::vector values; + std::ifstream in(csvPath); + if (!in.is_open()) return values; + + std::string line; + while (std::getline(in, line)) { + if (line.empty()) continue; + std::vector fields; + std::string field; + std::istringstream row(line); + while (std::getline(row, field, ';')) fields.push_back(field); + if (fields.size() < kExpectedFields) continue; + values.push_back(fields[kValueField]); + } + return values; +} + +TestSuiteWriter::TestSuiteWriter(std::string directory) + : directory(std::move(directory)), counter(0) { + // After the cases already there: with the engines alternating, more than one + // phase writes into the same suite, and counting from 1 again overwrote the + // earlier phase's cases (tacas 3b spec). + std::error_code ec; + for (const auto& entry : + std::filesystem::directory_iterator(this->directory, ec)) { + const std::string name = entry.path().filename().string(); + static const std::string kPrefix = "testcase-"; + static const std::string kSuffix = ".xml"; + if (name.size() <= kPrefix.size() + kSuffix.size() || + name.compare(0, kPrefix.size(), kPrefix) != 0 || + name.compare(name.size() - kSuffix.size(), kSuffix.size(), kSuffix) != + 0) { + continue; + } + const std::string digits = name.substr( + kPrefix.size(), name.size() - kPrefix.size() - kSuffix.size()); + if (digits.empty() || digits.size() > 9 || + digits.find_first_not_of("0123456789") != std::string::npos) { + continue; + } + this->counter = std::max( + this->counter, static_cast(std::stoul(digits))); + // Its inputs, as written (escaped), so a later phase can skip a vector + // the suite already has. + std::ifstream in(entry.path()); + std::stringstream text; + text << in.rdbuf(); + const std::string xml = text.str(); + std::vector inputs; + static const std::string kOpen = "", kClose = ""; + for (size_t at = xml.find(kOpen); at != std::string::npos; + at = xml.find(kOpen, at)) { + const size_t end = xml.find(kClose, at + kOpen.size()); + if (end == std::string::npos) break; + inputs.push_back(xml.substr(at + kOpen.size(), end - at - kOpen.size())); + at = end + kClose.size(); + } + this->cases.insert(inputs); + if (xml.find(kPrunedComment) != std::string::npos) { + this->prunedCases[inputs] = entry.path(); + } + } +} + +bool TestSuiteWriter::evictPrunedCase() { + if (this->prunedCases.empty()) return false; + auto victim = this->prunedCases.begin(); + std::error_code ec; + std::filesystem::remove(victim->second, ec); + this->cases.erase(victim->first); + this->prunedCases.erase(victim); + return true; +} + +namespace { +std::vector escapedInputs(const std::vector& raw) { + std::vector escaped; + escaped.reserve(raw.size()); + for (const std::string& value : raw) escaped.push_back(escapeXml(value)); + return escaped; +} +} // namespace + +bool TestSuiteWriter::hasTestCase( + const std::vector& inputs) const { + return this->cases.count(escapedInputs(inputs)) > 0; +} + +void TestSuiteWriter::removeTestCases(const std::string& directory) { + std::error_code ec; + std::vector doomed; + for (const auto& entry : std::filesystem::directory_iterator(directory, ec)) { + const std::string name = entry.path().filename().string(); + if (name.rfind("testcase-", 0) == 0 && name.size() > 13 && + name.compare(name.size() - 4, 4, ".xml") == 0) { + doomed.push_back(entry.path()); + } + } + for (const auto& path : doomed) std::filesystem::remove(path, ec); +} + +bool TestSuiteWriter::writeMetadata(const TestSuiteMetadata& metadata) { + std::error_code ec; + std::filesystem::create_directories(this->directory, ec); + + std::ofstream out(std::filesystem::path(this->directory) / "metadata.xml"); + if (!out.is_open()) return false; + + // Element order is mandatory: the DTD declares test-metadata as a sequence. + out << kXmlDeclaration << "\n" + << kMetadataDoctype << "\n" + << "\n" + << " C\n" + << " " << escapeXml(metadata.producer) << "\n" + << " " << escapeXml(metadata.specification) + << "\n" + << " " << escapeXml(metadata.programFile) + << "\n" + << " " << escapeXml(metadata.programHash) + << "\n" + << " " << escapeXml(metadata.entryFunction) + << "\n" + << " " << escapeXml(metadata.architecture) + << "\n" + << " " << escapeXml(metadata.creationTime) + << "\n" + << "\n"; + out.close(); + return out.good(); +} + +bool TestSuiteWriter::writeTestCase(const std::vector& inputs, + bool coversError, bool pruned) { + std::error_code ec; + std::filesystem::create_directories(this->directory, ec); + + this->counter++; + std::string name = "testcase-" + std::to_string(this->counter) + ".xml"; + std::ofstream out(std::filesystem::path(this->directory) / name); + if (!out.is_open()) return false; + + out << kXmlDeclaration << "\n" << kTestCaseDoctype << "\n"; + if (pruned) out << kPrunedComment << "\n"; + // coversError defaults to "false" in the DTD, so it is only spelled out when + // the run actually reached the error. + out << (coversError ? "\n" : "\n"); + // Order is the entire contract: the n-th is the value returned by + // the n-th nondet call. + for (const std::string& value : inputs) { + out << " " << escapeXml(value) << "\n"; + } + out << "\n"; + this->cases.insert(escapedInputs(inputs)); + if (pruned) { + this->prunedCases[escapedInputs(inputs)] = + std::filesystem::path(this->directory) / name; + } + out.close(); + return out.good(); +} + +} // namespace Map2Check diff --git a/modules/frontend/test_suite/test_suite.hpp b/modules/frontend/test_suite/test_suite.hpp new file mode 100644 index 000000000..ff28a7c3a --- /dev/null +++ b/modules/frontend/test_suite/test_suite.hpp @@ -0,0 +1,109 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +/********************************************************************** + * Emission of Test-Comp test suites. + * + * The format is defined by https://gitlab.com/sosy-lab/software/test-format: + * a directory holding one metadata.xml plus one *.xml per test case. Each test + * case is a sequence of elements whose order is the order in which the + * program consumed nondeterministic values. + * + * Map2Check already produces that sequence. The runtime appends every + * __VERIFIER_nondet_* call to an ordered log (NonDetLog.c) and flushes it to + * klee_log.csv on exit, under both the KLEE and the AFL++ generator. This + * module only serializes it -- no new instrumentation is involved, and the + * emitter is therefore engine-agnostic by construction. + * + * Cover-Error writes the one violating execution; Cover-Branches writes one + * case per KLEE path plus the fuzzer's corpus, under a cap. The format as + * Map2Check writes it -- metadata, input encoding, the assumption-pruned + * marker, the sources of the vectors -- is documented in + * docs/test-suite-format.md. + ***********************************************************************/ + +#ifndef MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ +#define MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ + +#include +#include +#include +#include +#include + +namespace Map2Check { + +/** Fields of metadata.xml. The DTD declares them as a sequence, not a choice, + * so the writer emits them in exactly this order. */ +struct TestSuiteMetadata { + std::string producer; + std::string specification; + std::string programFile; + std::string programHash; + std::string entryFunction; + std::string architecture; + std::string creationTime; +}; + +/** Current UTC time as "YYYY-MM-DDThh:mm:ssZ". */ +std::string isoUtcNow(); + +/** Reads the runtime's nondet log and returns the recorded values in + * consumption order. + * + * Malformed rows are skipped rather than fatal: a log truncated by a crash or + * a budget kill still yields a usable prefix, and a partial test case is worth + * more than none. Returns an empty vector when the file is absent. */ +std::vector readNonDetLog(const std::string& csvPath); + +/** Writes a Test-Comp test suite into a directory, creating it if needed. */ +class TestSuiteWriter { + public: + explicit TestSuiteWriter(std::string directory); + + /** Writes metadata.xml. False if the file could not be written. */ + bool writeMetadata(const TestSuiteMetadata& metadata); + + /** Writes testcase-.xml, numbering after the cases already in the + * directory (an earlier phase of the same run may have written some). + * + * `pruned` marks the case as a path a failed assumption ended (an XML + * comment, which TestCov ignores), so a later phase can evict it. */ + bool writeTestCase(const std::vector& inputs, bool coversError, + bool pruned = false); + + /** How many test cases the directory holds, written earlier or by this. */ + size_t caseCount() const { return cases.size(); } + /** How many of them are assumption-pruned paths. */ + size_t prunedCount() const { return prunedCases.size(); } + /** Removes one assumption-pruned case to make room for a deeper one. + * + * The suite is written phase by phase under a cap. On xcsp/AllInterval the + * first KLEE phase found only pruned paths and filled the cap with them, and + * the deep paths of the next phase found no room: 95% coverage fell to 9%. + * False when there is no pruned case to remove. */ + bool evictPrunedCase(); + /** Whether a test case with exactly these inputs is already there. */ + bool hasTestCase(const std::vector& inputs) const; + + /** Removes every testcase-.xml from `directory` -- run once, at the start + * of a run, so a suite never mixes cases from an earlier run. */ + static void removeTestCases(const std::string& directory); + + private: + std::string directory; + unsigned counter; + /** The inputs of every case in the directory, XML-escaped as written. */ + std::set> cases; + /** The pruned cases among them, with the file each one lives in. */ + std::map, std::filesystem::path> prunedCases; +}; + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ diff --git a/modules/frontend/utils/CMakeLists.txt b/modules/frontend/utils/CMakeLists.txt index 7e8f1e00f..97c0c9197 100644 --- a/modules/frontend/utils/CMakeLists.txt +++ b/modules/frontend/utils/CMakeLists.txt @@ -6,3 +6,6 @@ set_target_properties(Tools PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) add_library(GenCryptoHash OBJECT gen_crypto_hash.cpp) set_target_properties(GenCryptoHash PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) + +add_library(Sha256 OBJECT sha256.cpp) +set_target_properties(Sha256 PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) diff --git a/modules/frontend/utils/alternation.hpp b/modules/frontend/utils/alternation.hpp new file mode 100644 index 000000000..e9a41663b --- /dev/null +++ b/modules/frontend/utils/alternation.hpp @@ -0,0 +1,75 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_ALTERNATION_HPP_ +#define MODULES_FRONTEND_UTILS_ALTERNATION_HPP_ + +#include +#include + +namespace Map2Check { + +/** The two engines --alternate-engines takes turns with (tacas 3b spec). */ +enum class Engine { Fuzzer, Klee }; + +/** The most a phase of `engine` may take in its `round`-th turn (1-based): + * 0.1T for the fuzzer and 0.3T for KLEE, doubled every round, never more than + * what is left. The doubling is what lets an engine the alternation did not + * help come back with more time; an engine that stagnates earlier hands the + * rest back at once. */ +inline double alternationWindow(Engine engine, unsigned round, double budget, + double remaining) { + const double base = (engine == Engine::Fuzzer ? 0.1 : 0.3) * budget; + const double window = base * std::pow(2.0, round > 0 ? round - 1 : 0); + return std::min(window, remaining); +} + +/** How long an engine may go without new coverage before it is stagnant: + * 5% of the budget, at least 10 s (15 s at the Test-Comp 300 s). Also the + * least a phase must have left to be worth starting. */ +inline unsigned stagnationSeconds(double budget) { + return static_cast(std::max(10.0, 0.05 * budget)); +} + +/** KLEE's stagnation period in its `round`-th turn: doubled every round, like + * its window. Instruction coverage stops rising well before KLEE finishes the + * paths that make a proof, and a fixed cut would never let it get there. */ +inline unsigned stagnationSeconds(double budget, unsigned round) { + return stagnationSeconds(budget) * + (1u << std::min(round > 0 ? round - 1 : 0, 8u)); +} + +/** Decides from successive coverage samples whether an engine stagnated: no + * increase for `quietSeconds` since the last one. A sample of -1 means the + * reading failed (KLEE's stats database busy or not written yet) and is no + * evidence either way; the clock starts at the first real sample. */ +class CoverageWatch { + public: + explicit CoverageWatch(double quietSeconds) : quiet(quietSeconds) {} + + bool stagnated(long long covered, double now) { + if (covered < 0) return false; + if (!seen || covered > last) { + seen = true; + last = covered; + since = now; + return false; + } + return now - since >= quiet; + } + + private: + double quiet; + bool seen = false; + long long last = 0; + double since = 0; +}; + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_ALTERNATION_HPP_ diff --git a/modules/frontend/utils/gen_crypto_hash.cpp b/modules/frontend/utils/gen_crypto_hash.cpp index 1a26c5d1f..b1683c97d 100644 --- a/modules/frontend/utils/gen_crypto_hash.cpp +++ b/modules/frontend/utils/gen_crypto_hash.cpp @@ -38,6 +38,9 @@ int GenHash::generate_sha1_hash_for_file() { std::stringstream ss; std::ifstream file(this->filepath.c_str(), std::ios::binary | std::ios::ate); std::streamsize size = file.tellg(); + // An unreadable file reads as size -1, which std::vector rejected with a + // bare "cannot create std::vector larger than max_size()". + if (!file.is_open() || size < 0) return -1; file.seekg(0, std::ios::beg); std::vector buffer(size); diff --git a/modules/frontend/utils/log.cpp b/modules/frontend/utils/log.cpp index 2ca252503..5830daf80 100644 --- a/modules/frontend/utils/log.cpp +++ b/modules/frontend/utils/log.cpp @@ -10,26 +10,41 @@ #include #include +/* Every message is flushed, and that is the whole point of this file. + * + * stdout is block-buffered whenever it is not a terminal, and every harness + * here redirects it to a file. A run killed by the outer `timeout` -- which is + * the normal end of a run that overruns its budget -- therefore lost its + * ENTIRE log, verdict included, because nothing had reached the file yet. + * + * Measured on the v12 Test-Comp corpus: 20 tasks recorded ERROR, every one of + * them at 87 to 89 seconds against a 90 second outer timeout, and their logs + * were zero bytes. The harness reads a missing VERIFICATION line as a crashed + * tool. Some of those runs had already decided. + * + * These messages are a few dozen per run, so flushing each one costs nothing + * worth measuring. */ + namespace Map2Check { void Log::Error(std::string msg) { - std::cout << "\033[0;31m" << msg << "\033[0m\n"; + std::cout << "\033[0;31m" << msg << "\033[0m\n" << std::flush; } void Log::Warning(std::string msg) { - std::cout << "\033[1;33m" << msg << "\033[0m\n"; + std::cout << "\033[1;33m" << msg << "\033[0m\n" << std::flush; } void Log::Debug(std::string msg) { - if (isDebugMode) std::cout << "\033[0;33m" << msg << "\033[0m\n"; + if (isDebugMode) std::cout << "\033[0;33m" << msg << "\033[0m\n" << std::flush; } void Log::Info(std::string msg) { - std::cout << "\033[0;32m" << msg << "\033[0m\n"; + std::cout << "\033[0;32m" << msg << "\033[0m\n" << std::flush; } void Log::Fatal(std::string msg) { - std::cout << "\033[0;31m" << msg << "\033[0m\n"; + std::cout << "\033[0;31m" << msg << "\033[0m\n" << std::flush; } bool Log::isDebugMode = false; diff --git a/modules/frontend/utils/seed_store.hpp b/modules/frontend/utils/seed_store.hpp new file mode 100644 index 000000000..23efb5219 --- /dev/null +++ b/modules/frontend/utils/seed_store.hpp @@ -0,0 +1,66 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_SEED_STORE_HPP_ +#define MODULES_FRONTEND_UTILS_SEED_STORE_HPP_ + +#include +#include +#include +#include +#include + +namespace Map2Check { + +/** Where the engines leave seeds for each other under --seed-exchange. + * + * BESIDE the scratch directory, not inside it: every phase of the hybrid + * builds a new Caller, which recreates the scratch directory empty, and a + * store inside it never reached the next phase (tacasv3a spec, defect 1). */ +inline std::string seedStorePath(const std::string& cwd, + const std::string& programHash) { + return cwd + "/" + programHash + ".seeds"; +} + +/** The AFL++ queue entries to hand to KLEE: only real entries ("id:..."), + * those that reached new edges ("+cov") first, each group in queue order -- + * AFL++ zero-pads the id, so lexicographic order is id order, oldest + * (simplest) first -- and at most `cap` of them, so replaying them cannot eat + * the phase (tacas 3c). Not the seeds the fuzzer started from (",orig:"): + * those are KLEE's own vectors or an earlier round's entries, which KLEE + * already has. */ +inline std::vector selectQueueEntries( + std::vector names, size_t cap) { + names.erase(std::remove_if(names.begin(), names.end(), + [](const std::string& name) { + return name.rfind("id:", 0) != 0 || + name.find(",orig:") != std::string::npos; + }), + names.end()); + std::sort(names.begin(), names.end()); + // Ranked: the entries that reached new edges ("+cov" in AFL++'s name) before + // the ones that only changed hit counts, id order kept inside each group. + std::stable_partition(names.begin(), names.end(), [](const std::string& name) { + return name.find(",+cov") != std::string::npos; + }); + if (names.size() > cap) names.resize(cap); + return names; +} + +/** Whether a converted vector is worth a seed: not empty, and not one already + * written -- many queue entries differ only in bytes the program never reads, + * and they replay to the same typed vector. */ +inline bool isNewVector(const std::vector& bytes, + std::set>* seen) { + if (bytes.empty()) return false; + return seen->insert(bytes).second; +} + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_SEED_STORE_HPP_ diff --git a/modules/frontend/utils/sha256.cpp b/modules/frontend/utils/sha256.cpp new file mode 100644 index 000000000..293325684 --- /dev/null +++ b/modules/frontend/utils/sha256.cpp @@ -0,0 +1,126 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include "sha256.hpp" + +#include +#include +#include +#include +#include + +namespace Map2Check { +namespace { + +/** First 32 bits of the fractional parts of the cube roots of the first 64 + * primes (FIPS 180-4, section 4.2.2). */ +constexpr std::array kRoundConstants = { + 0x428a2f98u, 0x71374491u, 0xb5c0fbcfu, 0xe9b5dba5u, 0x3956c25bu, + 0x59f111f1u, 0x923f82a4u, 0xab1c5ed5u, 0xd807aa98u, 0x12835b01u, + 0x243185beu, 0x550c7dc3u, 0x72be5d74u, 0x80deb1feu, 0x9bdc06a7u, + 0xc19bf174u, 0xe49b69c1u, 0xefbe4786u, 0x0fc19dc6u, 0x240ca1ccu, + 0x2de92c6fu, 0x4a7484aau, 0x5cb0a9dcu, 0x76f988dau, 0x983e5152u, + 0xa831c66du, 0xb00327c8u, 0xbf597fc7u, 0xc6e00bf3u, 0xd5a79147u, + 0x06ca6351u, 0x14292967u, 0x27b70a85u, 0x2e1b2138u, 0x4d2c6dfcu, + 0x53380d13u, 0x650a7354u, 0x766a0abbu, 0x81c2c92eu, 0x92722c85u, + 0xa2bfe8a1u, 0xa81a664bu, 0xc24b8b70u, 0xc76c51a3u, 0xd192e819u, + 0xd6990624u, 0xf40e3585u, 0x106aa070u, 0x19a4c116u, 0x1e376c08u, + 0x2748774cu, 0x34b0bcb5u, 0x391c0cb3u, 0x4ed8aa4au, 0x5b9cca4fu, + 0x682e6ff3u, 0x748f82eeu, 0x78a5636fu, 0x84c87814u, 0x8cc70208u, + 0x90befffau, 0xa4506cebu, 0xbef9a3f7u, 0xc67178f2u}; + +inline uint32_t rotr(uint32_t x, unsigned n) { + return (x >> n) | (x << (32u - n)); +} + +/** One 64-byte block, mixed into the running state (FIPS 180-4, 6.2.2). */ +void compress(std::array* state, const uint8_t block[64]) { + std::array w{}; + for (unsigned i = 0; i < 16; i++) { + w[i] = (static_cast(block[i * 4]) << 24) | + (static_cast(block[i * 4 + 1]) << 16) | + (static_cast(block[i * 4 + 2]) << 8) | + static_cast(block[i * 4 + 3]); + } + for (unsigned i = 16; i < 64; i++) { + uint32_t s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >> 3); + uint32_t s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >> 10); + w[i] = w[i - 16] + s0 + w[i - 7] + s1; + } + + std::array v = *state; + for (unsigned i = 0; i < 64; i++) { + uint32_t s1 = rotr(v[4], 6) ^ rotr(v[4], 11) ^ rotr(v[4], 25); + uint32_t ch = (v[4] & v[5]) ^ (~v[4] & v[6]); + uint32_t t1 = v[7] + s1 + ch + kRoundConstants[i] + w[i]; + uint32_t s0 = rotr(v[0], 2) ^ rotr(v[0], 13) ^ rotr(v[0], 22); + uint32_t maj = (v[0] & v[1]) ^ (v[0] & v[2]) ^ (v[1] & v[2]); + uint32_t t2 = s0 + maj; + + v[7] = v[6]; + v[6] = v[5]; + v[5] = v[4]; + v[4] = v[3] + t1; + v[3] = v[2]; + v[2] = v[1]; + v[1] = v[0]; + v[0] = t1 + t2; + } + for (unsigned i = 0; i < 8; i++) (*state)[i] += v[i]; +} + +} // namespace + +std::string sha256Hex(const std::string& data) { + /** First 32 bits of the fractional parts of the square roots of the first 8 + * primes (FIPS 180-4, section 5.3.3). */ + std::array state = {0x6a09e667u, 0xbb67ae85u, 0x3c6ef372u, + 0xa54ff53au, 0x510e527fu, 0x9b05688cu, + 0x1f83d9abu, 0x5be0cd19u}; + + const uint8_t* bytes = reinterpret_cast(data.data()); + size_t length = data.size(); + size_t wholeBlocks = length / 64; + for (size_t i = 0; i < wholeBlocks; i++) compress(&state, bytes + i * 64); + + // Tail: the leftover bytes, a 0x80 terminator, zero padding, then the + // message length in bits as a big-endian 64-bit value. When the leftover + // leaves no room for that length field this spills into a second block, + // which is why the loop below is over tail.size() and not a single block. + std::vector tail(bytes + wholeBlocks * 64, bytes + length); + tail.push_back(0x80); + while (tail.size() % 64 != 56) tail.push_back(0x00); + uint64_t bitLength = static_cast(length) * 8u; + for (int i = 7; i >= 0; i--) { + tail.push_back(static_cast((bitLength >> (i * 8)) & 0xffu)); + } + for (size_t i = 0; i < tail.size(); i += 64) + compress(&state, tail.data() + i); + + static const char kHex[] = "0123456789abcdef"; + std::string digest; + digest.reserve(64); + for (uint32_t word : state) { + for (int i = 3; i >= 0; i--) { + unsigned byte = (word >> (i * 8)) & 0xffu; + digest += kHex[byte >> 4]; + digest += kHex[byte & 0xf]; + } + } + return digest; +} + +std::string sha256File(const std::string& path) { + std::ifstream in(path, std::ios::binary); + if (!in.is_open()) return ""; + std::ostringstream buffer; + buffer << in.rdbuf(); + return sha256Hex(buffer.str()); +} + +} // namespace Map2Check diff --git a/modules/frontend/utils/sha256.hpp b/modules/frontend/utils/sha256.hpp new file mode 100644 index 000000000..8d1c020a1 --- /dev/null +++ b/modules/frontend/utils/sha256.hpp @@ -0,0 +1,41 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +/********************************************************************** + * SHA-256, for the Test-Comp test-suite field. + * + * Map2Check already had SHA-1 (gen_crypto_hash.hpp, via Boost), which the + * pipeline uses to name scratch directories. The exchange format defines + * programhash as SHA-256, so the two coexist rather than one replacing the + * other. + * + * Implemented here rather than pulled in: OpenSSL is not currently linked, and + * shelling out to sha256sum would make a metadata field depend on an external + * binary being on PATH inside whatever container the tool runs in. + ***********************************************************************/ + +#ifndef MODULES_FRONTEND_UTILS_SHA256_HPP_ +#define MODULES_FRONTEND_UTILS_SHA256_HPP_ + +#include + +namespace Map2Check { + +/** SHA-256 of an in-memory buffer, as 64 lowercase hex characters. + * Binary-safe: embedded NUL bytes are hashed like any other byte. */ +std::string sha256Hex(const std::string& data); + +/** SHA-256 of a file's contents. Returns "" if the file cannot be read. + * Hashes contents, never the path: identifies the program, and + * a hash of the filename would silently agree across different programs that + * happen to share a name. */ +std::string sha256File(const std::string& path); + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_SHA256_HPP_ diff --git a/modules/frontend/utils/slicer.hpp b/modules/frontend/utils/slicer.hpp new file mode 100644 index 000000000..4104db9db --- /dev/null +++ b/modules/frontend/utils/slicer.hpp @@ -0,0 +1,302 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_SLICER_HPP_ +#define MODULES_FRONTEND_UTILS_SLICER_HPP_ + +#include +#include +#include +#include +#include +#include +#include + +namespace Map2Check { + +/** Every __VERIFIER_nondet_* function the slice must keep. + * + * The suite is generated on the slice, but TestCov runs it on the ORIGINAL + * program. A nondet call the slicer drops -- its value does not reach the + * criterion -- is still consumed by the original, so the vector shifts and + * the suite stops covering (measured: ntdrivers/floppy.i.cil-1.c, 29 reads in + * the program and 10 in the slice; FAILED, NOT_COVERED). Keeping these calls + * as criteria keeps the consumption order. + * + * All but _Bool and charp are what NonDetPass instruments (the last seven + * since issue #74); those two are SV-COMP names it does not model yet, kept so + * their order is not lost either. The slicer accepts names the program does + * not use. */ +inline const std::vector& nondetFunctionNames() { + static const std::vector names = { + "__VERIFIER_nondet_bool", "__VERIFIER_nondet_char", + "__VERIFIER_nondet_uchar", "__VERIFIER_nondet_short", + "__VERIFIER_nondet_ushort", "__VERIFIER_nondet_int", + "__VERIFIER_nondet_uint", "__VERIFIER_nondet_unsigned", + "__VERIFIER_nondet_long", "__VERIFIER_nondet_ulong", + "__VERIFIER_nondet_size_t", "__VERIFIER_nondet_loff_t", + "__VERIFIER_nondet_sector_t", "__VERIFIER_nondet_pointer", + "__VERIFIER_nondet_pchar", "__VERIFIER_nondet_double", + "__VERIFIER_nondet_float", "__VERIFIER_nondet_longlong", + "__VERIFIER_nondet_ulonglong", "__VERIFIER_nondet__Bool", + "__VERIFIER_nondet_u8", "__VERIFIER_nondet_u16", + "__VERIFIER_nondet_u32", "__VERIFIER_nondet_charp", + "__VERIFIER_nondet_memory"}; + return names; +} + +/** Every symbol `@...` in a module's textual IR, without the '@', in + * order of first appearance. A plain scan, not std::regex: on the eca-* modules + * (megabytes of IR) the regexes took ~45 s, outside every budget, and pushed + * the run past its deadline with no verdict (R19, 4 ERROR of the slice arm). */ +inline std::vector symbolsWithPrefixInIR(const std::string& ir, + const std::string& prefix) { + auto isNameChar = [](char c) { + return std::isalnum(static_cast(c)) || c == '_'; + }; + std::vector names; + const std::string needle = "@" + prefix; + for (size_t at = ir.find(needle); at != std::string::npos; + at = ir.find(needle, at + 1)) { + size_t end = at + 1; + while (end < ir.size() && isNameChar(ir[end])) ++end; + const std::string name = ir.substr(at + 1, end - at - 1); + if (name.size() > prefix.size() && + std::find(names.begin(), names.end(), name) == names.end()) { + names.push_back(name); + } + } + return names; +} + +/** Every __VERIFIER_nondet_* symbol in a module's textual IR (`opt -S`), + * in order of first appearance. The fixed list above cannot know every name a + * benchmark declares (int128, uint128, ...), and a name missing from the + * criteria silently brings the shifted suite back. */ +inline std::vector nondetNamesInIR(const std::string& ir) { + return symbolsWithPrefixInIR(ir, "__VERIFIER_nondet_"); +} + +/** Every map2check_* runtime symbol in a module's textual IR, in order of + * first appearance. Used as the slicing criteria for the memory properties: + * the property is decided by these calls, so none of them may be removed. */ +inline std::vector runtimeNamesInIR(const std::string& ir) { + return symbolsWithPrefixInIR(ir, "map2check_"); +} + +/** Every function a module DECLARES without defining (`declare ... @f(`), in + * order of first appearance, LLVM intrinsics excluded. In the modes that slice + * the instrumented module these are criteria too: a memory error can happen + * inside an external function (strcpy overflowing a stack buffer), and nothing + * the runtime checks depends on such a call, so without it as a criterion the + * slicer drops the call and the bug with it (CASTLE-787-2: a wrong TRUE). */ +inline std::vector externalNamesInIR(const std::string& ir) { + auto isNameChar = [](char c) { + return std::isalnum(static_cast(c)) || c == '_' || + c == '.' || c == '$'; + }; + std::vector names; + size_t line = 0; + while (line < ir.size()) { + size_t next = ir.find('\n', line); + if (next == std::string::npos) next = ir.size(); + if (ir.compare(line, 8, "declare ") == 0) { + const size_t at = ir.find('@', line); + if (at != std::string::npos && at < next) { + size_t end = at + 1; + while (end < next && isNameChar(ir[end])) ++end; + if (end < next && ir[end] == '(') { + const std::string name = ir.substr(at + 1, end - at - 1); + // Intrinsics are not calls into code the slicer could keep -- except + // the memory ones: clang lowers memcpy/memset/memmove (and struct + // copies) to them, and an overflowing copy into a buffer nothing + // reads again feeds no criterion, so it has to be one. + const bool intrinsic = name.rfind("llvm.", 0) == 0 && + name.rfind("llvm.memcpy.", 0) != 0 && + name.rfind("llvm.memmove.", 0) != 0 && + name.rfind("llvm.memset.", 0) != 0; + if (!intrinsic && + std::find(names.begin(), names.end(), name) == names.end()) { + names.push_back(name); + } + } + } + } + line = next + 1; + } + return names; +} + +/** The primary criteria for slicing the INSTRUMENTED module: every runtime + * check, then every external function (see externalNamesInIR). Returns false + * when the IR holds no runtime call at all -- a failed disassembly, an empty + * file -- because a slice without the checks as criteria removes them all and + * the property silently reads as holding. */ +inline bool instrumentedSliceCriteria(const std::string& ir, + std::vector* criteria) { + criteria->clear(); + for (const std::string& name : runtimeNamesInIR(ir)) { + criteria->push_back(name); + } + if (criteria->empty()) return false; + for (const std::string& name : externalNamesInIR(ir)) { + if (std::find(criteria->begin(), criteria->end(), name) == + criteria->end()) { + criteria->push_back(name); + } + } + return true; +} + +/** The -c argument: the primary criteria, then every nondet function -- the + * fixed list plus `fromProgram` (nondetNamesInIR), each name once. */ +inline std::string slicingCriteria( + const std::vector& primary, + const std::vector& fromProgram = {}) { + std::vector all(primary); + auto add = [&all](const std::string& name) { + if (std::find(all.begin(), all.end(), name) == all.end()) { + all.push_back(name); + } + }; + for (const std::string& name : nondetFunctionNames()) add(name); + for (const std::string& name : fromProgram) add(name); + std::ostringstream criteria; + for (size_t i = 0; i < all.size(); ++i) { + criteria << (i == 0 ? "" : ",") << all[i]; + } + return criteria.str(); +} + +/** A weak definition of the criterion function, restoring the body the + * slicer removes without displacing a real one. The signature must match + * the program's declaration, or llvm-link rejects the module. */ +inline std::string targetStubSource(const std::string& function) { + if (function == "__VERIFIER_assert") { + return "void __attribute__((weak)) __VERIFIER_assert(int cond) {}\n"; + } + return "void __attribute__((weak)) " + function + "(void) {}\n"; +} + +struct SlicerCounts { + unsigned globals = 0; + unsigned functions = 0; + unsigned blocks = 0; + unsigned instructions = 0; +}; + +struct SlicerStatistics { + bool found = false; // both the "before" and the "after" line were read + SlicerCounts before; + SlicerCounts after; +}; + +/** Reads sbt-slicer's --statistics lines: + * Statistics before Globals/Functions/Blocks/Instr.: 37 97 2215 10764 + * Statistics after Globals/Functions/Blocks/Instr.: 37 38 444 2989 */ +inline SlicerStatistics parseSlicerStatistics(const std::string& slicerOutput) { + static const std::regex line( + R"(Statistics (before|after) Globals/Functions/Blocks/Instr\.:\s+)" + R"((\d+)\s+(\d+)\s+(\d+)\s+(\d+))"); + SlicerStatistics stats; + bool sawBefore = false; + bool sawAfter = false; + for (std::sregex_iterator it(slicerOutput.begin(), slicerOutput.end(), line), + end; + it != end; ++it) { + const std::smatch& m = *it; + SlicerCounts counts; + counts.globals = static_cast(std::stoul(m[2])); + counts.functions = static_cast(std::stoul(m[3])); + counts.blocks = static_cast(std::stoul(m[4])); + counts.instructions = static_cast(std::stoul(m[5])); + if (m[1] == "before") { + stats.before = counts; + sawBefore = true; + } else { + stats.after = counts; + sawAfter = true; + } + } + stats.found = sawBefore && sawAfter; + return stats; +} + +/** The one log line a slice produces. Counts when the slicer reported them, + * bytes always -- a slice narrows the question being answered, and this line + * is the only visible sign of how much was dropped. */ +inline std::string describeSlice(const std::string& criterion, + const SlicerStatistics& stats, + uintmax_t bytesBefore, uintmax_t bytesAfter) { + std::ostringstream text; + text << "Sliced with respect to " << criterion << ": "; + if (stats.found) { + text << stats.before.functions << "/" << stats.before.blocks << "/" + << stats.before.instructions << " -> " << stats.after.functions << "/" + << stats.after.blocks << "/" << stats.after.instructions + << " functions/blocks/instructions (" << bytesBefore << " -> " + << bytesAfter << " bytes of bitcode)"; + } else { + text << bytesBefore << " -> " << bytesAfter << " bytes of bitcode"; + } + return text.str(); +} + +/** Where the slice of each phase is kept for the next ones: /.slice, + * beside the scratch directory for the reason the seed store is (every phase + * recreates the scratch). Holds .bc for a slice, .failed for a slicer + * that failed or timed out -- which the next phase must not pay for again: on + * eca-* the slicer spent 0.2T in phase 1 AND in phase 2, and the run was + * killed past its budget with no suite (R15, 4 ERROR). */ +inline std::string sliceCachePath(const std::string& cwd, + const std::string& programHash) { + return cwd + "/" + programHash + ".slice"; +} + +/** The cache key: FNV-1a (64-bit, hex) over the input bitcode's CONTENT and + * every setting that shapes the slice, so a slice is reused only for the very + * same question. Fields are separated by a byte no name contains. */ +inline std::string sliceCacheKey(const std::string& inputContent, + const std::string& criteriaLabel, + const std::string& entry, + const std::string& slicerFlags) { + uint64_t hash = 14695981039346656037ull; + auto mix = [&hash](const std::string& field) { + for (unsigned char c : field) { + hash ^= c; + hash *= 1099511628211ull; + } + hash ^= 0xff; + hash *= 1099511628211ull; + }; + mix(inputContent); + mix(criteriaLabel); + mix(entry); + mix(slicerFlags); + static const char* digits = "0123456789abcdef"; + std::string key(16, '0'); + for (int i = 15; i >= 0; --i) { + key[i] = digits[hash & 0xf]; + hash >>= 4; + } + return key; +} + +/** The opt arguments for MAP2CHECK_SLICE_CLEANUP (an experiment knob): the dg + * slicer leaves empty blocks and dead functions behind. "light" folds them + * away; "o2" is the full pipeline, which may exploit undefined behaviour and + * is measured, not trusted. Anything else means no cleanup. */ +inline std::string sliceCleanupPasses(const std::string& knob) { + if (knob == "light") return "-passes='function(simplifycfg,dce),globaldce'"; + if (knob == "o2") return "-O2"; + return ""; +} + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_SLICER_HPP_ diff --git a/modules/frontend/utils/tools.cpp b/modules/frontend/utils/tools.cpp old mode 100755 new mode 100644 index b6b0bdaac..3e9e57cee --- a/modules/frontend/utils/tools.cpp +++ b/modules/frontend/utils/tools.cpp @@ -228,6 +228,9 @@ Tools::CheckViolatedProperty::CheckViolatedProperty(string path) { } else if (line == "OVERFLOW") { Map2Check::Log::Debug("OVERFLOW found"); this->propertyViolated = Tools::PropertyViolated::FALSE_OVERFLOW; + } else if (line == "FALSE-DIVBYZERO") { + Map2Check::Log::Debug("FALSE-DIVBYZERO found"); + this->propertyViolated = Tools::PropertyViolated::FALSE_DIVBYZERO; } else if (line == "UNKNOWN") { Map2Check::Log::Debug("UNKNOWN found"); this->propertyViolated = Tools::PropertyViolated::UNKNOWN; @@ -238,7 +241,15 @@ Tools::CheckViolatedProperty::CheckViolatedProperty(string path) { Map2Check::Log::Debug("ASSERT found"); this->propertyViolated = Tools::PropertyViolated::ASSERT; } else { - // throw Tools::CheckViolatedPropertyException("Invalid Property"); + // Unrecognised, including the empty-file case where this loop never + // runs at all. Left silent for years while the field was + // uninitialised, so the verdict came from the stack. Saying so is + // cheap and the difference between a bug that is found and one that + // is not. + Map2Check::Log::Debug( + "map2check_property holds no verdict this parser recognises " + "(\"" + line + "\") -- treating the run as undecided"); + this->propertyViolated = Tools::PropertyViolated::UNKNOWN; } break; case 1: @@ -269,6 +280,13 @@ Tools::CheckViolatedProperty::CheckViolatedProperty(string path) { // int Tools::CheckViolatedProperty::getListLogFromCSV(string path) { +Tools::KleeLogType Tools::kleeLogTypeFromId(int id) { + if (id < 0 || id >= static_cast(KleeLogType::UNKNOWN)) { + return KleeLogType::UNKNOWN; + } + return static_cast(id); +} + std::vector Tools::KleeLogHelper::getListLogFromCSV( string path) { std::vector listLog; @@ -303,26 +321,15 @@ std::vector Tools::KleeLogHelper::getListLogFromCSV( string value = tokens[5]; string type = tokens[6]; Log::Debug(tokens[6]); - switch (stoi(type)) { - case 0: - row.type = KleeLogType::INTEGER; - break; - case 1: - row.type = KleeLogType::CHAR; - break; - case 2: - row.type = KleeLogType::POINTER; - break; - case 3: - row.type = KleeLogType::USHORT; - break; - case 4: - row.type = KleeLogType::LONG; - break; - case 5: - row.type = KleeLogType::UNSIGNED; - break; + // Every row whose type column is not a number of enum NONDET_TYPE + // used to keep an uninitialized type, which the witness then read. + int typeId = -1; + try { + typeId = stoi(type); + } catch (const std::exception &) { + typeId = -1; } + row.type = kleeLogTypeFromId(typeId); row.id = id; row.line = lineNumber; row.scope = scope; diff --git a/modules/frontend/utils/tools.hpp b/modules/frontend/utils/tools.hpp old mode 100755 new mode 100644 index 1068a299b..59d1ccbb6 --- a/modules/frontend/utils/tools.hpp +++ b/modules/frontend/utils/tools.hpp @@ -12,6 +12,7 @@ #define MODULES_FRONTEND_UTILS_TOOLS_HPP_ #include // copy +#include // getenv #include // fstream #include // cout, endl #include // ostream_operator @@ -33,9 +34,24 @@ namespace Map2Check { constexpr char const* ktestBinary = "${MAP2CHECK_PATH}/bin/ktest-tool"; /** Path to clang binary (from llvm) */ constexpr char const* clangBinary = "${MAP2CHECK_PATH}/bin/clang"; -/** Path to crab-llvm path binary (from crab-llvm) */ -constexpr char const* crabBinary = - "${MAP2CHECK_PATH}/bin/crabllvm/bin/crabllvm.py"; +/** Default Clam installation root, used when CLAM_DIR is not set. */ +constexpr char const* clamDefaultRoot = "/opt/clam"; + +/** Absolute path to the Clam driver, the abstract-interpretation invariant + * generator. Clam is the current name of crab-llvm: the project was renamed, + * not abandoned. It installs outside the Map2Check prefix because it is an + * independent tool with its own LLVM-versioned build, so it keys off CLAM_DIR + * rather than MAP2CHECK_PATH. + * + * Resolved in C++ rather than left as a "${CLAM_DIR}" string for the shell to + * expand, so that the availability check and the command that gets run cannot + * disagree about where Clam is -- with shell expansion an unset CLAM_DIR + * silently becomes "/bin/clam.py" while the check looks at the default root. */ +inline std::string clamBinary() { + const char* dir = getenv("CLAM_DIR"); + return (dir != nullptr ? std::string(dir) : std::string(clamDefaultRoot)) + + "/bin/clam.py"; +} /** Path to clang include folder (usually * $(PATH_TO_CLANG)/lib/clang/$(LLVM_VERSION)/include) */ constexpr char const* clangIncludeFolder = "${MAP2CHECK_PATH}/include/"; @@ -43,8 +59,57 @@ constexpr char const* clangIncludeFolder = "${MAP2CHECK_PATH}/include/"; constexpr char const* listLogCSV = "list_log.csv"; /** Path to klee binary */ constexpr char const* kleeBinary = "${MAP2CHECK_PATH}/bin/klee"; +/** Default root of the AFL++ install (Dockerfile.dev section 7). */ +constexpr char const* aflDefaultRoot = "/usr/local"; +/** Path to the afl-clang-fast wrapper (symlink to afl-cc), overridable. + * + * Resolved like the slicer and the invariant generator: an environment + * override first, a documented default second. AFL++ is a subprocess tool, + * invoked by caller.cpp at run time, so it is not copied into MAP2CHECK_PATH + * the way clang and klee are. + * + * MAP2CHECK_AFL_CC, not AFL_CC: AFL_CC is AFL++'s own variable for the real + * compiler afl-cc wraps, so reusing it would either recurse afl-clang-fast into + * itself or silently build the fuzzer uninstrumented. */ +inline std::string aflClangFastBinary() { + const char* override_path = getenv("MAP2CHECK_AFL_CC"); + if (override_path != nullptr) return std::string(override_path); + return std::string(aflDefaultRoot) + "/bin/afl-clang-fast"; +} +/** Path to the afl-fuzz binary, overridable with MAP2CHECK_AFL_FUZZ. */ +inline std::string aflFuzzBinary() { + const char* override_path = getenv("MAP2CHECK_AFL_FUZZ"); + if (override_path != nullptr) return std::string(override_path); + return std::string(aflDefaultRoot) + "/bin/afl-fuzz"; +} +/** Default root of the sbt-slicer install (Dockerfile.dev section 7c). */ +constexpr char const* slicerDefaultRoot = "/opt/sbt-slicer"; +/** Path to the sbt-slicer binary, overridable with SBT_SLICER. + * + * Resolved like the invariant generator: an environment override first, a + * documented default second, and the caller checks the file exists before + * relying on it -- a missing slicer must refuse the run, not silently analyse + * the unsliced program (issue #54's failure mode). */ +inline std::string slicerBinary() { + const char* override_path = getenv("SBT_SLICER"); + if (override_path != nullptr) return std::string(override_path); + return std::string(slicerDefaultRoot) + "/bin/sbt-slicer"; +} +/** Seconds granted between SIGTERM and SIGKILL when a backend overruns its + * slice (`timeout -k`). Both KLEE and AFL++ catch SIGTERM to shut down + * gracefully, and both can miss it while wedged -- KLEE inside the solver, + * AFL++ inside a hung target. Without the escalation `timeout` waits + * forever on a child that will not die and the whole run hangs past its + * budget. Long enough for a real graceful exit, short enough not to distort + * the budget. */ +constexpr int killGracePeriod = 10; /** Path to generated klee log file (check MemoryUtils implementation) */ constexpr char const* kleeLogCSV = "klee_log.csv"; +/** KLEE's own output directory, relative to the scratch directory the run + * executes in. It is a symlink KLEE maintains to the latest klee-out-N, and it + * holds one testNNNNNN.ktest per explored path -- the input vectors a + * Cover-Branches suite is built from. */ +constexpr char const* kleeOutputDir = "klee-last"; /** Path to generated Correctness log file (check MemoryUtils implementation) */ constexpr char const* stateTrueLogCSV = "automata_list_log.st"; /** Path to generated Correctness log file (check MemoryUtils implementation) */ @@ -62,6 +127,7 @@ constexpr char const* llvmLinkBinary = "${MAP2CHECK_PATH}/bin/llvm-link"; /** Represents what kind of property was violated */ enum class PropertyViolated { FALSE_OVERFLOW, + FALSE_DIVBYZERO, TARGET_REACHED, FALSE_FREE, FALSE_DEREF, @@ -74,10 +140,25 @@ enum class PropertyViolated { /** Class used to check violated property */ struct CheckViolatedProperty { - /** Current violated property */ - PropertyViolated propertyViolated; + /** Current violated property. + * + * Defaulted, and the default matters more than it looks. The constructor + * assigns this on several paths but NOT when map2check_property exists and + * is empty, nor when it holds a line the parser does not recognise -- the + * `else` that would have caught that is commented out. Both cases used to + * leave the field holding whatever was on the stack, and that value decided + * the tool's verdict. + * + * It is reachable: a KLEE state that aborts early creates the file without + * writing a verdict into it. Observed as the same program answering FAILED, + * SUCCEEDED and nothing across three runs, and as the ERROR/UNKNOWN churn + * that shows up in every baseline comparison. + * + * UNKNOWN is the honest default: no readable verdict means the tool did not + * decide, which is exactly what the missing-file path already reports. */ + PropertyViolated propertyViolated = PropertyViolated::UNKNOWN; /** Line where property was violated */ - unsigned line; + unsigned line = 0; /** Name of the function where the property was violated */ string function_name; string path_name; @@ -149,11 +230,42 @@ class SourceCodeHelper { std::vector cFileLines; }; -enum class KleeLogType { INTEGER, CHAR, POINTER, USHORT, LONG, UNSIGNED }; +/** The type column of klee_log.csv: enum NONDET_TYPE of the runtime + * (Map2CheckTypes.h), in the same order, so a row's number casts to it. + * UNKNOWN is any other number. */ +enum class KleeLogType { + INTEGER, + CHAR, + POINTER, + USHORT, + LONG, + UNSIGNED, + ULONG, + BOOL, + UCHAR, + PCHAR, + SIZE_T, + LOFF_T, + SECTOR_T, + UINT, + SHORT, + DOUBLE, + FLOAT, + LONGLONG, + ULONGLONG, + U8, + U16, + U32, + MEMORY_BYTE, + UNKNOWN +}; + +/** The KleeLogType of a type number of klee_log.csv. */ +KleeLogType kleeLogTypeFromId(int id); struct KleeLogRow { string id; - KleeLogType type; + KleeLogType type = KleeLogType::UNKNOWN; string line; string scope; @@ -173,37 +285,10 @@ struct KleeLogRow { operator std::string() const { std::ostringstream cnvt; cnvt.str(""); - switch (type) { - case KleeLogType::INTEGER: - cnvt << " Call Function : " - << "__VERIFIER_nondet_int()" - << "\n"; - break; - case KleeLogType::CHAR: - cnvt << " Call Function : " - << "__VERIFIER_nondet_char()" - << "\n"; - break; - case KleeLogType::POINTER: - cnvt << " Call Function : " - << "__VERIFIER_nondet_pointer()" - << "\n"; - break; - case KleeLogType::USHORT: - cnvt << " Call Function : " - << "__VERIFIER_nondet_ushort()" - << "\n"; - break; - case KleeLogType::LONG: - cnvt << " Call Function : " - << "__VERIFIER_nondet_long()" - << "\n"; - break; - case KleeLogType::UNSIGNED: - cnvt << " Call Function : " - << "__VERIFIER_nondet_uint()" - << "\n"; - break; + const std::string function = generateWitnessFunctionName(); + if (!function.empty()) { + cnvt << " Call Function : " << function << "()" + << "\n"; } cnvt << " Value : " << this->value << "\n"; cnvt << " Line Number : " << this->line << "\n"; @@ -212,7 +297,9 @@ struct KleeLogRow { return cnvt.str(); } - std::string generateWitnessFunctionName() { + /** The __VERIFIER_nondet_* function that produced the value, or "" for an + * UNKNOWN type. The unsigned family keeps the name it always had. */ + std::string generateWitnessFunctionName() const { switch (type) { case KleeLogType::INTEGER: return "__VERIFIER_nondet_int"; @@ -225,8 +312,44 @@ struct KleeLogRow { case KleeLogType::LONG: return "__VERIFIER_nondet_long"; case KleeLogType::UNSIGNED: + case KleeLogType::UINT: return "__VERIFIER_nondet_uint"; + case KleeLogType::ULONG: + return "__VERIFIER_nondet_ulong"; + case KleeLogType::BOOL: + return "__VERIFIER_nondet_bool"; + case KleeLogType::UCHAR: + return "__VERIFIER_nondet_uchar"; + case KleeLogType::PCHAR: + return "__VERIFIER_nondet_pchar"; + case KleeLogType::SIZE_T: + return "__VERIFIER_nondet_size_t"; + case KleeLogType::LOFF_T: + return "__VERIFIER_nondet_loff_t"; + case KleeLogType::SECTOR_T: + return "__VERIFIER_nondet_sector_t"; + case KleeLogType::SHORT: + return "__VERIFIER_nondet_short"; + case KleeLogType::DOUBLE: + return "__VERIFIER_nondet_double"; + case KleeLogType::FLOAT: + return "__VERIFIER_nondet_float"; + case KleeLogType::LONGLONG: + return "__VERIFIER_nondet_longlong"; + case KleeLogType::ULONGLONG: + return "__VERIFIER_nondet_ulonglong"; + case KleeLogType::U8: + return "__VERIFIER_nondet_u8"; + case KleeLogType::U16: + return "__VERIFIER_nondet_u16"; + case KleeLogType::U32: + return "__VERIFIER_nondet_u32"; + case KleeLogType::MEMORY_BYTE: + return "__VERIFIER_nondet_memory"; + case KleeLogType::UNKNOWN: + break; } + return ""; } }; diff --git a/sbseg_plan.md b/sbseg_plan.md deleted file mode 100644 index aa87d8cc4..000000000 --- a/sbseg_plan.md +++ /dev/null @@ -1,60 +0,0 @@ -**Plano de Trabalho — Submissão ao Salão de Ferramentas (SF) do SBSeg 2026![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.001.png)** - -**Ferramenta:** Map2Check — Finding Software Vulnerabilities using Symbolic Execution and Fuzzing **Modalidade sugerida:** Código Aberto (repositório público + vídeo técnico → elegível a prêmio e à avaliação de artefatos pelo CTA) **Coordenação técnica:** PD&I / Engenharia de Sistemas Computacionais - -Antes do plano em si, deixo registradas três restrições do edital que moldam todo o trabalho, porque é nelas que submissões ao SF costumam tropeçar. - -**Restrições do edital que precisam ser respeitadas desde já![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.002.png)** - -O **limite é de 10 páginas: 8 de corpo (incluindo figuras e tabelas) + até 2 de referências e apêndices** — O modelo obrigatório é o template SBC, o que exige reformatação do material histórico. - -O artigo deve conter obrigatoriamente, segundo o edital: descrição e motivação do problema; arquitetura e principais funcionalidades; descrição da demonstração planejada (com equipamentos necessários); e URL de vídeo de instalação/uso. A premiação depende de avaliação de artefato (disponibilidade, funcionalidade, reprodutibilidade, sustentabilidade) — e os commits recentes de CI/CD, Dockerfile e hardening são exatamente o que sustenta uma boa nota de artefato. - -**Datas:** submissão **20/jul/2026** - -Considerando hoje (17/jun/2026), há **~33 dias** até a submissão. - -**Posicionamento e narrativa do artigo![ref1]** - -A oportunidade aqui é tratar este artigo como o **marco de "renascimento" do Map2Check**. As publicações anteriores (TACAS 2016, 2018, 2020) eram *competition contributions* de 4–5 páginas, focadas em SV-COMP. Desde 2020 a ferramenta ficou essencialmente estagnada (LLVM 6.0, último release de nov/2019). Os commits de maio–junho/2026 mostram um esforço sistemático de modernização: migração para **LLVM 16 / Ubuntu 22.04**, conversão completa para o **New Pass Manager**, modernização para **C++17**, introdução de **CI/CD via GitHub Actions**, **análise estática (clang-tidy, cppcheck)**, **sanitizers**, busca pelo **OpenSSF Best Practices badge** e um framework de checkpoint para **TestComp 2026**. - -A tese central que sugiro para o artigo: *o Map2Check evoluiu de um verificador de C orientado a competição para uma plataforma de detecção de vulnerabilidades de memória, modernizada em engenharia e estendida para alvos emergentes (WebAssembly), com foco renovado em memory safety (memory leak, use-after-free, invalid-free/deref).* - -Sobre as features que vamos destacar: - -- As features de **memory safety/overflow** já são histórico consolidado e funcional da ferramenta — --memtrack , e as propriedades valid-free , valid-deref , valid-memtrack , ![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.004.png)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.005.png)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.006.png)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.007.png)valid-memcleanup do SV-COMP. Aqui o trabalho é de *fortalecimento e reposicionamento* sob a ótica de cibersegurança (mapear para CWEs: CWE-401 memory leak, CWE-416 use-after-free, CWE-415 double-free, CWE-119/787 buffer overflow). É terreno seguro. -- A feature de **WebAssembly (WASM)** é a novidade de maior impacto para um público de cibersegurança, mas **não aparece iniciamos nos commits**. Para isso temos duas saídas honestas: (a) implementar um pipeline mínimo viável de WASM antes de 20/jul (escopo abaixo), ou (b) posicionar WASM como *roadmap / trabalho em andamento* numa seção de perspectivas. Recomendo tentar (a) com escopo enxuto e ter (b) como plano de contingência. - -**Estrutura proposta do artigo (8 páginas de corpo)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.008.png)** - -A distribuição abaixo equilibra história, arquitetura e novidade, dando peso às features que você quer destacar sem inflar o que ainda não existe. - -A introdução e motivação (~1 pág) abrem com o problema de vulnerabilidades de memória em C/C++ como classe persistente e crítica de falhas de segurança, ancorando em CWEs e citando que memory-safety bugs seguem entre as principais causas de CVEs exploráveis. Posiciona o Map2Check nesse contexto e enuncia as contribuições da versão 2026. - -A história e evolução (~1 a 1,5 pág) traça a linha 2016→2018→2020→2026: de *Hunting Memory Bugs* (TACAS 2016, BMC), para LLVM+KLEE (TACAS 2018), para a combinação fuzzing + execução simbólica + invariantes indutivos com LibFuzzer/KLEE/Crab-LLVM (TACAS 2020), até a modernização atual. Aqui entra uma figura de timeline. - -A arquitetura e funcionalidades (~2 a 2,5 pág) é o núcleo técnico: instrumentação de código- fonte sobre LLVM, monitoramento de ponteiros e atribuições, geração de casos de teste por execução simbólica (KLEE) e fuzzing (LibFuzzer), invariantes indutivos (Crab-LLVM), e a abordagem de *iterative deepening*. Documenta a modernização de engenharia (LLVM 16, New Pass Manager, C++17, CI/CD, análise estática, sanitizers) como pilar de **sustentabilidade e qualidade de artefato** — que pontua diretamente no CTA. Figura de arquitetura/pipeline aqui. As novas features de cibersegurança (~1,5 pág) detalham a detecção de memory leak e violações de memory safety mapeadas para CWEs, com a integração ao TestComp 2026 (geração/validação de testes, execução de heap + verificação de veredito) como evidência de capacidade atual. É a seção que conecta a ferramenta ao escopo "cibersegurança" do SBSeg. - -WebAssembly (~1 pág) apresenta o suporte a análise de binários/módulos WASM — seja como feature entregue (MVP) ou como direção arquitetural via o pipeline LLVM existente, discutindo o vetor de ataque de memory safety em runtimes WASM. - -A demonstração planejada e o vídeo (~~0,5 pág) descrevem o que será mostrado ao vivo e os equipamentos (item obrigatório do edital). Encerra com avaliação preliminar, perspectivas e conclusão (~~0,5 pág). Referências e apêndice de reprodutibilidade vão nas 2 páginas extras. - -**Cronograma de execução (17/jun → 20/jul)![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.009.png)** - -Trabalhando para a submissão de 20 de julho, proponho quatro sprints. - -**Sprint 0 — Fundação e decisão de escopo (17–22/jun, ~5 dias).** Baixar o template SBC e montar o esqueleto anonimizado; auditar o repositório para garantir que o estado de master ![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.010.png)compila e roda os exemplos do README ( --memtrack ); definir o conjunto de benchmarks para a avaliação preliminar (subset SV-COMP MemSafety + casos próprios mapeados a CWEs). Entregável: outline aprovado + ambiente de build reprodutível (imagem Docker LLVM 16).![](Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.011.png) - -**Sprint 1 — Núcleo técnico e história (23/jun–02/jul, ~10 dias).** Redigir história, arquitetura e funcionalidades; produzir as figuras de timeline e de pipeline; consolidar a narrativa de modernização (mapeando os commits de maio–junho para a seção de sustentabilidade). Em paralelo, executar os experimentos de memory safety e tabular resultados. Entregável: seções 1–4 em rascunho + tabela de resultados. - -**Sprint 2 — Cibersegurança + WASM + demo (03–13/jul, ~10 dias).** Finalizar a seção de memory leak/CWE; implementar (ou documentar como roadmap) o caminho WASM; gravar e editar o **vídeo técnico** de instalação e uso (obrigatório); escrever a seção de demonstração com lista de equipamentos. Entregável: artigo completo em rascunho + vídeo publicado (link anonimizado) + checklist de artefato (disponibilidade/funcionalidade/reprodutibilidade/sustentabilidade). - -**Sprint 3 — Revisão, anonimização e submissão (14–20/jul, ~7 dias).** Revisão técnica e de escrita; verificação rigorosa de anonimato (sem nomes, instituições, URLs identificáveis, metadados do PDF); checagem do limite de 8 páginas de corpo; revisão à luz do código de conduta da SBC sobre IA generativa; geração do PDF final e submissão no **JEMS**. Entregável: PDF submetido + pacote de artefato preparado para o eventual camera-ready/CTA. - -**Riscos e recomendações![ref1]** - -O maior risco é o **WASM não ficar funcional a tempo**; a mitigação é ter a versão "roadmap" pronta como contingência — não vale comprometer a nota de artefato apresentando algo irreprodutível. O segundo risco é **falha de anonimização**, que pode levar a *desk reject* num processo double-blind; por isso a verificação é uma etapa formal no Sprint 3, incluindo metadados do PDF. O terceiro é o **build não reprodutível** para o CTA — os commits recentes de Docker/CI ajudam, mas o ambiente precisa ser validado do zero por alguém que não seja o autor. - -Uma nota sobre IA generativa: o edital remete explicitamente ao novo Código de Conduta da SBC quanto ao uso de IA generativa. Convém revisar essas regras antes de redigir e, se aplicável, declarar o uso conforme exigido. - -[ref1]: Aspose.Words.20da6e99-f690-4638-80d8-9465634d56d0.003.png diff --git a/scripts/make-release.sh b/scripts/make-release.sh index 32f9ba138..f8938dc6e 100755 --- a/scripts/make-release.sh +++ b/scripts/make-release.sh @@ -21,7 +21,7 @@ cd build export LLVM_DIR=$LLVM_DIR_BASE/lib/cmake/llvm export CXX=$LLVM_DIR_BASE/bin/clang++ export CC=$LLVM_DIR_BASE/bin/clang -cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_LIB_FUZZER=ON -DSKIP_KLEE=ON -DCMAKE_INSTALL_PREFIX=../release/ +cmake .. -G Ninja -DLLVM_DIR=$LLVM_DIR -DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON -DCMAKE_INSTALL_PREFIX=../release/ ninja ninja install @@ -60,8 +60,7 @@ cp /usr/lib/x86_64-linux-gnu/libgomp.so.1 ./lib/ echo "" echo "Copying external tools" -# LibFuzzer -cp /deps/install/fuzzer/libFuzzer.a ./lib +# AFL++ is provided by the image (standalone at /usr/local/bin), not copied here. # Z3 if [ ! -d "./z3" ]; then diff --git a/scripts/package-release.sh b/scripts/package-release.sh index a4bedec0a..6e5098f8a 100755 --- a/scripts/package-release.sh +++ b/scripts/package-release.sh @@ -13,7 +13,12 @@ cd "$REPO_ROOT" exit 1 } -# Composição do artefato: wrapper SV-COMP + licença + documentação +# Composição do artefato: wrapper (SV-COMP e Test-Comp) + licença + documentação. +# +# O wrapper entra aqui porque o módulo tool-info +# (utils/moduleBenchExec/map2check.py) o declara em REQUIRED_PATHS: o +# BenchExec copia exatamente esses caminhos para o nó de execução, então um +# arquivo ausente do zip vira um erro na infraestrutura da competição, não aqui. cp utils/map2check-wrapper.py release/ cp LICENSE README.md release/ diff --git a/scripts/prepare-release.sh b/scripts/prepare-release.sh index f55e09f08..19258ca3b 100755 --- a/scripts/prepare-release.sh +++ b/scripts/prepare-release.sh @@ -1,6 +1,6 @@ #!/usr/bin/env bash # Fase "prepare" do semantic-release: builda o Map2Check completo (KLEE 3.1 + -# LibFuzzer) dentro da imagem map2check-dev, injetando a versão calculada no +# AFL++) dentro da imagem map2check-dev, injetando a versão calculada no # binário via -DMAP2CHECK_VERSION, e empacota release/ em .zip. # Chamado pelo @semantic-release/exec: scripts/prepare-release.sh 8.1.0 set -euo pipefail diff --git a/test-comp2026/.gitignore b/test-comp2026/.gitignore deleted file mode 100644 index a277a6fb7..000000000 --- a/test-comp2026/.gitignore +++ /dev/null @@ -1,19 +0,0 @@ -# Ignore cloned repositories (too large for git) -sv-benchmarks/ -juliet/ -testcov/ -bench-defs/ - -# Ignore test results (generated) -resultados_de_testes/ - -# Ignore release binaries and includes (built/copied from Docker) -simulation/release/map2check -simulation/release/lib/ -simulation/release/bin/ -simulation/release/include/ -simulation/release - -# Keep wrapper and scripts -!release/map2check-wrapper.py -!release/data_extractor.py diff --git a/test-comp2026/README.md b/test-comp2026/README.md deleted file mode 100644 index 2e88e2a87..000000000 --- a/test-comp2026/README.md +++ /dev/null @@ -1,197 +0,0 @@ -# TestComp 2026 Checkpoint — Manual de Reprodução - -Este documento explica como reproduzir os testes do checkpoint do Map2Check v8 -contra os benchmarks do TestComp 2026. - -## Pré-requisitos - -- Docker instalado e funcionando -- Imagem `map2check-dev` já construída (via `docker build`) -- Repositório Map2Check clonado e compilado dentro do container - -## Passo 1: Build da imagem Docker (se ainda não existir) - -```bash -cd /home/guilherme/github/Map2Check -docker build -t map2check-dev -f docker/Dockerfile . -``` - -## Passo 2: Compilar o Map2Check v8 - -```bash -docker run --rm -v $(pwd):/workspace map2check-dev bash -c " - cd /workspace/build && cmake .. && make -j\$(nproc) -" -``` - -Verificar que os testes unitários passam: - -```bash -docker run --rm -v $(pwd):/workspace map2check-dev bash -c " - cd /workspace/build && ctest --output-on-failure -" -``` - -## Passo 3: Clonar os sv-benchmarks (se ainda não existir) - -```bash -cd test-comp2026/simulation - -# Clone com sparse checkout (apenas as categorias necessárias) -git clone --no-checkout --filter=blob:none \ - https://gitlab.com/sosy-lab/benchmarking/sv-benchmarks.git -cd sv-benchmarks -git checkout testcomp26 - -# Sparse checkout — apenas as categorias de interesse -git sparse-checkout init --cone -git sparse-checkout set c/loops c/loop-acceleration c/loop-crafted \ - c/loop-invgen c/loop-lit c/loop-new c/loop-industry-pattern \ - c/loops-crafted-1 c/loop-invariants c/loop-invariants64 \ - c/loop-simple c/loop-zilu c/nla-digbench c/nla-digbench-scaling \ - c/array-examples c/array-industry-pattern c/array-cav19 \ - c/array-crafted c/array-fpi c/array-lossy c/array-memsafety \ - c/array-multidimensional c/array-patterns c/array-programs \ - c/array-tiling c/array-unsafe \ - c/eca-rers2018 c/psyco c/ntdrivers c/ntdrivers-simplified \ - c/ssh-simplified c/locks c/systemc c/product-lines c/eca-rers2012 - -cd ../.. -``` - -> **Nota**: Os `.set` files (ex: `Loops.set`, `Arrays.set`, `ControlFlow.set`) -> e os `.prp` property files já estão no root dos benchmarks. - -## Passo 4: Preparar o diretório release - -O release directory contém todos os binários e bibliotecas necessárias para o -Map2Check executar de forma autocontida: - -```bash -docker run --rm -v $(pwd):/workspace map2check-dev bash -c ' - MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release - - # 1. Copiar o binário compilado - cp /workspace/build/modules/frontend/map2check $MAP2CHECK_PATH/map2check - - # 2. Copiar os plugins dos passes (.so) - cp /workspace/build/modules/backend/pass/lib*.so $MAP2CHECK_PATH/lib/ - - # 3. Copiar as bibliotecas KLEE runtime (.bca) - mkdir -p $MAP2CHECK_PATH/lib/klee/runtime - cp /opt/klee/lib/klee/runtime/*.bca $MAP2CHECK_PATH/lib/klee/runtime/ - - # 4. Verificar - echo "=== Estrutura do release ===" - echo "Binário: $(file $MAP2CHECK_PATH/map2check | cut -d: -f2)" - echo "Passes: $(ls $MAP2CHECK_PATH/lib/*.so | wc -l) plugins" - echo "BC libs: $(ls $MAP2CHECK_PATH/lib/*.bc | wc -l) bitcode files" - echo "KLEE runtime: $(ls $MAP2CHECK_PATH/lib/klee/runtime/*.bca | wc -l) .bca files" -' -``` - -## Passo 5: Testar um benchmark individual - -Para rodar **um único teste** manualmente: - -```bash -docker run --rm -v $(pwd):/workspace \ - -e KLEE_RUNTIME_LIBRARY_PATH=/workspace/test-comp2026/simulation/release/lib/klee/runtime \ - map2check-dev bash -c ' - cd /tmp && mkdir -p test && cd test - /workspace/test-comp2026/simulation/release/map2check \ - --timeout 290 \ - --smt-solver z3 \ - --target-function \ - --target-function-name reach_error \ - /workspace/test-comp2026/simulation/sv-benchmarks/c/loops/array-2.c - ' -``` - -Resultado esperado: `VERIFICATION FAILED` (com counter-example). - -## Passo 6: Rodar o Smoke Test (5 testes por categoria) - -```bash -docker run --rm -v $(pwd):/workspace \ - -e SMOKE_TEST=true \ - map2check-dev bash /workspace/test-comp2026/simulation/run_all_inside.sh -``` - -Resultado: CSV em `test-comp2026/simulation/resultados_de_testes/summary_report_v8.csv`. - -## Passo 7: Rodar o Suite Completo - -> ⚠️ **Atenção**: O suite completo pode levar **várias horas** dependendo do -> número de benchmarks. Recomenda-se usar `nohup` ou `tmux`. - -### Opção A: tmux (recomendado) - -```bash -tmux new -s testcomp - -docker run --rm -v $(pwd):/workspace \ - map2check-dev bash /workspace/test-comp2026/simulation/run_all_inside.sh - -# Ctrl+B, D para detach -# tmux attach -t testcomp para reconectar -``` - -### Opção B: nohup - -```bash -nohup docker run --rm -v $(pwd):/workspace \ - map2check-dev bash /workspace/test-comp2026/simulation/run_all_inside.sh \ - > testcomp_output.log 2>&1 & - -# Monitorar -tail -f testcomp_output.log -``` - -## Estrutura dos resultados - -Após a execução, os resultados ficam em: - -``` -test-comp2026/simulation/resultados_de_testes/ -├── summary_report_v8.csv # CSV com todos os resultados -├── Loops/ -│ └── tempos.txt # Tempos por task -├── Arrays/ -│ └── tempos.txt -└── ControlFlow/ - └── tempos.txt -``` - -### Formato do CSV - -```csv -category,file,time_s,result,expected -Loops,array-1.c,60,TRUE,TRUE -Loops,array-2.c,1,FALSE,FALSE -Arrays,data_structures_set_multi_proc_ground-1.i,2,FALSE,FALSE -``` - -## Variáveis de ambiente - -| Variável | Descrição | Padrão | -|:---------|:----------|:-------| -| `SMOKE_TEST` | Se `true`, limita a 5 testes por categoria | `false` | -| `KLEE_RUNTIME_LIBRARY_PATH` | Path para klee-uclibc.bca | auto-detectado | -| `MAP2CHECK_PATH` | Path do release dir | auto-detectado pelo binário | - -## Troubleshooting - -### `klee: Loading file klee-uclibc.bca failed` -Certifique-se de que `KLEE_RUNTIME_LIBRARY_PATH` está setado ou que os `.bca` -foram copiados para `release/lib/klee/runtime/`. - -### `Skipping pass ... due to optnone attribute` -O binário não foi recompilado com o fix `isRequired()`. Recompile com o último -código da branch `feat-update`. - -### `symbol multiply defined: main` -Mesmo caso acima — os passes não estão instrumentando (faltando `isRequired()`). - -### `Unknown command line argument '-suppress-external-warnings'` -KLEE flags obsoletas. Use o binário compilado com o commit `284aef1ac` ou posterior. diff --git a/test-comp2026/simulation/compile_juliet_wasm.sh b/test-comp2026/simulation/compile_juliet_wasm.sh deleted file mode 100755 index a7db8964b..000000000 --- a/test-comp2026/simulation/compile_juliet_wasm.sh +++ /dev/null @@ -1,103 +0,0 @@ -#!/bin/bash -set -e - -JULIET_BASE="/workspace/test-comp2026/juliet/testcases" -SUPPORT="/workspace/test-comp2026/juliet/testcasesupport" -WASI_CLANG="/opt/wasi-sdk-33.0-x86_64-linux/bin/clang" -WASI_FLAGS="--target=wasm32-wasip1 -I${SUPPORT} -DINCLUDEMAIN" -OUTPUT="/workspace/test-comp2026/juliet/wasm_output" - -mkdir -p "$OUTPUT" - -echo "=== Compilando subset Juliet C -> WASM ===" - -while IFS='|' read -r cwe_dir sub_dir base_name; do - [[ -z "$cwe_dir" || "$cwe_dir" == \#* ]] && continue - src="${JULIET_BASE}/${cwe_dir}/${sub_dir}/${base_name}.c" - out="${OUTPUT}/${base_name}.wasm" - - if [ ! -f "$src" ]; then - echo "SKIP $base_name (nao encontrado)" - continue - fi - - echo -n "Compilando: $base_name ... " - ${WASI_CLANG} ${WASI_FLAGS} "$src" -o "$out" 2>/tmp/compile_err.txt - EXIT=$? - - if [ $EXIT -eq 0 ] && [ -f "$out" ]; then - echo "OK ($(ls -lh "$out" | awk '{print $5}'))" - else - echo "FAIL" - head -2 /tmp/compile_err.txt 2>/dev/null - fi -done << 'EOF' -CWE121_Stack_Based_Buffer_Overflow|s01|CWE121_Stack_Based_Buffer_Overflow__CWE129_fgets_01 -CWE121_Stack_Based_Buffer_Overflow|s01|CWE121_Stack_Based_Buffer_Overflow__CWE129_large_01 -CWE121_Stack_Based_Buffer_Overflow|s02|CWE121_Stack_Based_Buffer_Overflow__CWE193_char_alloca_memcpy_01 -CWE122_Heap_Based_Buffer_Overflow|s05|CWE122_Heap_Based_Buffer_Overflow__CWE131_memcpy_01 -CWE122_Heap_Based_Buffer_Overflow|s06|CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01 -CWE122_Heap_Based_Buffer_Overflow|s06|CWE122_Heap_Based_Buffer_Overflow__c_CWE129_large_01 -CWE122_Heap_Based_Buffer_Overflow|s01|CWE122_Heap_Based_Buffer_Overflow__char_type_overrun_memcpy_01 -CWE124_Buffer_Underwrite|s01|CWE124_Buffer_Underwrite__CWE839_fgets_01 -CWE124_Buffer_Underwrite|s02|CWE124_Buffer_Underwrite__CWE839_negative_01 -CWE124_Buffer_Underwrite|s01|CWE124_Buffer_Underwrite__char_alloca_cpy_01 -CWE126_Buffer_Overread|s01|CWE126_Buffer_Overread__CWE129_fgets_01 -CWE126_Buffer_Overread|s01|CWE126_Buffer_Overread__CWE129_large_01 -CWE126_Buffer_Overread|s02|CWE126_Buffer_Overread__malloc_char_memcpy_01 -CWE127_Buffer_Underread|s01|CWE127_Buffer_Underread__CWE839_fgets_01 -CWE127_Buffer_Underread|s02|CWE127_Buffer_Underread__CWE839_negative_01 -EOF - -echo "" -echo "=== Criando casos manuais de buffer overflow ===" - -# Caso 1: strcpy overflow -cat > /tmp/m2c_buf_strcpy.c << 'CEOF' -#include -#include -int main() { - char buf[10]; - strcpy(buf, "This string is way too long!"); - return 0; -} -CEOF - -# Caso 2: memcpy overflow -cat > /tmp/m2c_buf_memcpy.c << 'CEOF' -#include -#include -int main() { - char dst[10]; - char src[100]; - memset(src, 'A', 100); - memcpy(dst, src, 50); - return 0; -} -CEOF - -# Caso 3: array out-of-bounds -cat > /tmp/m2c_buf_oob.c << 'CEOF' -int main() { - int arr[10]; - for (int i = 0; i <= 15; i++) { - arr[i] = i; - } - return 0; -} -CEOF - -for src in /tmp/m2c_buf_strcpy.c /tmp/m2c_buf_memcpy.c /tmp/m2c_buf_oob.c; do - base=$(basename "$src" .c) - out="${OUTPUT}/${base}.wasm" - echo -n "Compilando: $base ... " - ${WASI_CLANG} --target=wasm32-wasip1 "$src" -o "$out" 2>&1 - if [ -f "$out" ]; then - echo "OK ($(ls -lh "$out" | awk '{print $5}'))" - else - echo "FAIL" - fi -done - -echo "" -echo "Total: $(ls ${OUTPUT}/*.wasm 2>/dev/null | wc -l) módulos WASM" diff --git a/test-comp2026/simulation/map2check-v8-heap.xml b/test-comp2026/simulation/map2check-v8-heap.xml deleted file mode 100644 index 346d076d6..000000000 --- a/test-comp2026/simulation/map2check-v8-heap.xml +++ /dev/null @@ -1,18 +0,0 @@ - - - - - **/test-suite - - - - coverage-error-call.prp - - - - ./sv-benchmarks/c/Heap.set - - - ./sv-benchmarks/c/LinkedLists.set - - diff --git a/test-comp2026/simulation/map2check-v8.xml b/test-comp2026/simulation/map2check-v8.xml deleted file mode 100644 index 8f7a3b61c..000000000 --- a/test-comp2026/simulation/map2check-v8.xml +++ /dev/null @@ -1,36 +0,0 @@ - - - - - **/test-suite - - - - coverage-error-call.prp - - - - ./sv-benchmarks/c/Loops.set - - - ./sv-benchmarks/c/Arrays.set - - - ./sv-benchmarks/c/ControlFlow.set - - - - - coverage-branches.prp - - - - ./sv-benchmarks/c/Loops.set - - - ./sv-benchmarks/c/Arrays.set - - - ./sv-benchmarks/c/ControlFlow.set - - diff --git a/test-comp2026/simulation/release/data_extractor.py b/test-comp2026/simulation/release/data_extractor.py deleted file mode 100644 index 3fc1d3f5b..000000000 --- a/test-comp2026/simulation/release/data_extractor.py +++ /dev/null @@ -1,116 +0,0 @@ -import os -import re -import xml.etree.ElementTree as ET -from datetime import datetime -import zipfile - - -def extrair_informacoes(arquivo_xml, tags): - tree = ET.parse(arquivo_xml) - root = tree.getroot() - - # Define the namespace - ns = {'ns': 'http://graphml.graphdrawing.org/xmlns'} - - data = {} - - for tag in tags: - # Include the namespace in the tag - elementos = root.findall('.//ns:data[@key="{}"]'.format(tag), ns) - for elemento in elementos: - texto = elemento.text - if texto: - if tag == 'assumption.scope': - # Directly set entryfunction with the assumption.scope value - data['entryfunction'] = texto - else: - data[tag] = texto - - return data - - -def create_metadata_file(data, filename): - metadata = ET.Element('test-metadata') - - for key, value in data.items(): - if key != 'assumption': - ET.SubElement(metadata, key).text = value - - # Add creationtime tag - creationtime = datetime.now().isoformat() - ET.SubElement(metadata, 'creationtime').text = creationtime - - tree = ET.ElementTree(metadata) - tree.write(filename, encoding='utf-8', xml_declaration=True) - - -def create_testcase_file(assumptions, filename): - testcase = ET.Element('testcase') - testcase.set('coversError', 'true') - - # Add DOCTYPE declaration - doctype = '\n' - - # Add XML declaration - xml_declaration = '\n' - - # Use a set to track unique assumption values - unique_assumptions = set() - - for assumption in assumptions: - value = assumption.strip() - number_match = re.search(r'== (\d+)', value) - if number_match: - number = number_match.group(1) - # Check if the assumption value has already been processed - if number not in unique_assumptions: - ET.SubElement(testcase, 'input').text = number - unique_assumptions.add(number) # Add the assumption value to the set - - # Write to the file - with open(filename, 'w') as file: - file.write(xml_declaration) - file.write(doctype) - file.write(ET.tostring(testcase, encoding='unicode')) - - -def create_zip_file(metadata_filename, testcase_filename): - with zipfile.ZipFile('test-suite.zip', 'w') as zipf: - zipf.write(metadata_filename, arcname='metadata.xml') - zipf.write(testcase_filename, arcname='testcase.xml') - - -tags = [ - 'sourcecodelang', - 'producer', - 'specification', - 'programfile', - 'programhash', - 'architecture', - 'assumption', -] - -arquivo_xml = 'witness.graphml' -assumptions = [] - -# Extract assumptions separately -for edge in ET.parse(arquivo_xml).getroot().iter('{http://graphml.graphdrawing.org/xmlns}edge'): - assumption_element = edge.find('{http://graphml.graphdrawing.org/xmlns}data[@key="assumption"]') - if assumption_element is not None: # Check if the element exists - assumption_data = assumption_element.text - if assumption_data: - assumptions.append(assumption_data) - -# Create the directory if it doesn't exist -if not os.path.exists('testsuite'): - os.makedirs('testsuite') - -data = extrair_informacoes(arquivo_xml, tags) - -# Ensure entryfunction is set to "main" if not already present -if 'entryfunction' not in data: - data['entryfunction'] = 'main' - -create_metadata_file(data, os.path.join('testsuite', 'metadata.xml')) -create_testcase_file(assumptions, os.path.join('testsuite', 'testcase.xml')) -create_zip_file(os.path.join('testsuite', 'metadata.xml'), os.path.join('testsuite', 'testcase.xml')) \ No newline at end of file diff --git a/test-comp2026/simulation/release/map2check-wrapper.py b/test-comp2026/simulation/release/map2check-wrapper.py deleted file mode 100644 index af5ed1a7d..000000000 --- a/test-comp2026/simulation/release/map2check-wrapper.py +++ /dev/null @@ -1,154 +0,0 @@ -#!/usr/bin/env python3 -""" -Map2Check v8 wrapper for TestComp 2026. -Translates TestComp properties into Map2Check CLI flags. - -Changes from v7.3.1 wrapper: - - SMT solver: z3 (was yices2) - - Target function: --target-function-name reach_error (direct, no translation) - - Timeout: 295s (was 895s) - - Coverage-branches: returns UNKNOWN (not supported) -""" - -import os -import argparse -import shlex -import subprocess - -tool_path = "./map2check " -extra_tool = "timeout 295s " -command_line = extra_tool + tool_path -timemapsplit = "290" - -# Options -parser = argparse.ArgumentParser() -parser.add_argument("-v", "--version", help="Prints Map2check's version", action='store_true') -parser.add_argument("-p", "--propertyfile", help="Path to the property file") -parser.add_argument("benchmark", nargs='?', help="Path to the benchmark") - -args = parser.parse_args() - -version = args.version -property_file = args.propertyfile -benchmark = args.benchmark - -if version: - os.system(tool_path + "--version") - exit(0) - -if property_file is None: - print("Please, specify a property file") - exit(1) - -if benchmark is None: - print("Please, specify a benchmark to verify") - exit(1) - -is_memsafety = False -is_reachability = False -is_overflow = False -is_memcleanup = False -is_coverage_branches = False - -f = open(property_file, 'r') -property_file_content = f.read() -f.close() - -if "CHECK( init(main()), LTL(G valid-free) )" in property_file_content: - is_memsafety = True -elif "CHECK( init(main()), LTL(G valid-deref) )" in property_file_content: - is_memsafety = True -elif "CHECK( init(main()), LTL(G valid-memtrack) )" in property_file_content: - is_memsafety = True -elif "CHECK( init(main()), LTL(G valid-memcleanup) )" in property_file_content: - is_memcleanup = True -elif "CHECK( init(main()), LTL(G ! overflow) )" in property_file_content: - is_overflow = True -elif "COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )" in property_file_content: - is_reachability = True -elif "COVER( init(main()), FQL(COVER EDGES(@DECISIONEDGE)) )" in property_file_content: - is_coverage_branches = True -else: - print("Unsupported Property") - exit(1) - -# Coverage-branches is not supported by Map2Check -if is_coverage_branches: - print("UNKNOWN") - print("Coverage-branches property not supported") - exit(0) - -# Set options -command_line_bkp = "" -if is_memsafety: - command_line += " --timeout " + timemapsplit + " --memtrack --smt-solver z3 --generate-witness " -elif is_memcleanup: - command_line += " --timeout " + timemapsplit + " --memcleanup-property --smt-solver z3 --generate-witness " -elif is_reachability: - # v8: use reach_error directly as target function name (PR #44) - command_line += (" --timeout " + timemapsplit - + " --smt-solver z3" - + " --target-function" - + " --target-function-name reach_error" - + " --generate-witness ") -elif is_overflow: - command_line += " --timeout " + timemapsplit + " --check-overflow --smt-solver z3 --generate-witness " - -print("Verifying with MAP2CHECK v8 (LLVM 16)") - -# Set KLEE runtime library path (needed for klee-uclibc.bca) -script_dir = os.path.dirname(os.path.abspath(__file__)) -klee_runtime = os.path.join(script_dir, "lib", "klee", "runtime") -os.environ["KLEE_RUNTIME_LIBRARY_PATH"] = klee_runtime - -# Call MAP2CHECK -command_line += benchmark -print("Command: " + command_line) -args_cmd = shlex.split(command_line) -p = subprocess.Popen(args_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE) -(stdout, stderr) = p.communicate() - -# Parse output -if b'Timed out' in stdout: - print("Timed out") - exit(1) - -# Error messages -free_offset = "\tFALSE-FREE: Operand of free must have zero pointer offset" -deref_offset = "\tFALSE-DEREF: Reference to pointer was lost" -memtrack_offset = "\tFALSE-MEMTRACK" -memcleanup_offset = "\tFALSE-MEMCLEANUP" -target_offset = "\tFALSE: Target Reached" -overflow_offset = "\tOVERFLOW" - -if "VERIFICATION FAILED" in stdout.decode(): - if free_offset in stdout.decode(): - print("FALSE_FREE") - exit(0) - - if deref_offset in stdout.decode(): - print("FALSE_DEREF") - exit(0) - - if memtrack_offset in stdout.decode(): - print("FALSE_MEMTRACK") - exit(0) - - if memcleanup_offset in stdout.decode(): - print("FALSE_MEMCLEANUP") - exit(0) - - if target_offset in stdout.decode(): - print("FALSE") - exit(0) - - if overflow_offset in stdout.decode(): - print("FALSE_OVERFLOW") - exit(0) - -if "VERIFICATION SUCCEEDED" in stdout.decode(): - print("TRUE") - exit(0) - -print("UNKNOWN") -exit(0) diff --git a/test-comp2026/simulation/run_all_inside.sh b/test-comp2026/simulation/run_all_inside.sh deleted file mode 100755 index 2e544b64c..000000000 --- a/test-comp2026/simulation/run_all_inside.sh +++ /dev/null @@ -1,146 +0,0 @@ -#!/bin/bash -# run_all_inside.sh — Runs inside the Docker container -# Executes map2check on all test files from the .set categories -set -e - -MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release -SV_BENCH=/workspace/test-comp2026/simulation/sv-benchmarks/c -RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes -TIMEOUT=300 -INNER_TIMEOUT=$((TIMEOUT - 10)) - -export KLEE_RUNTIME_LIBRARY_PATH="$MAP2CHECK_PATH/lib/klee/runtime" - -mkdir -p "$RESULTS_DIR" - -CSV="$RESULTS_DIR/summary_report_v8.csv" -echo "category,file,time_s,result,expected" > "$CSV" - -TOTAL=0; T_TRUE=0; T_FALSE=0; T_UNKNOWN=0; T_ERROR=0; T_CORRECT=0 - -run_test() { - local c_file="$1" - local category="$2" - local expected="$3" - local basename=$(basename "$c_file") - - cd /tmp && rm -rf m2c_run && mkdir -p m2c_run && cd m2c_run - - local start_time=$(date +%s) - local output - output=$(timeout "$TIMEOUT" "$MAP2CHECK_PATH/map2check" \ - --timeout "$INNER_TIMEOUT" \ - --smt-solver z3 \ - --target-function \ - --target-function-name reach_error \ - "$c_file" 2>&1 || true) - local end_time=$(date +%s) - local elapsed=$((end_time - start_time)) - - local verdict="UNKNOWN" - if echo "$output" | grep -q "VERIFICATION FAILED"; then - verdict="FALSE" - elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then - verdict="TRUE" - fi - - local correct="?" - if [ "$expected" = "$verdict" ]; then - correct="OK" - elif [ "$verdict" = "UNKNOWN" ]; then - correct="UNK" - else - correct="WRONG" - fi - - printf " %-45s %-8s %-6s %3ds [exp: %-5s]\n" "$basename" "$verdict" "$correct" "$elapsed" "$expected" - echo "$category,$basename,$elapsed,$verdict,$expected" >> "$CSV" - - TOTAL=$((TOTAL + 1)) - case "$verdict" in - TRUE) T_TRUE=$((T_TRUE + 1)) ;; - FALSE) T_FALSE=$((T_FALSE + 1)) ;; - *) T_UNKNOWN=$((T_UNKNOWN + 1)) ;; - esac - if [ "$correct" = "OK" ]; then - T_CORRECT=$((T_CORRECT + 1)) - fi -} - -process_category() { - local cat_name="$1" - local set_file="$SV_BENCH/${cat_name}.set" - - [ ! -f "$set_file" ] && { echo "[WARN] $set_file not found"; return; } - - echo "" - echo "============================================================" - echo "[CAT] $cat_name" - echo "============================================================" - - local count=0 - - while IFS= read -r line; do - line=$(echo "$line" | xargs) - [[ -z "$line" || "$line" == \#* ]] && continue - - for yml in $SV_BENCH/$line; do - [ ! -f "$yml" ] && continue - - # Extract input file - local input_file - input_file=$(grep "^input_files:" "$yml" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - [ -z "$input_file" ] && continue - - local dir=$(dirname "$yml") - local c_file="$dir/$input_file" - [ ! -f "$c_file" ] && continue - - # Check for unreach-call property and expected verdict - if ! grep -q "unreach-call\|coverage-error-call" "$yml"; then - continue - fi - - local expected="UNKNOWN" - if grep -A1 "unreach-call\|coverage-error-call" "$yml" | grep -q "expected_verdict: false"; then - expected="FALSE" - elif grep -A1 "unreach-call\|coverage-error-call" "$yml" | grep -q "expected_verdict: true"; then - expected="TRUE" - fi - - run_test "$c_file" "$cat_name" "$expected" - count=$((count + 1)) - - # Limit for smoke test mode - if [ "${SMOKE_TEST:-false}" = "true" ] && [ "$count" -ge 5 ]; then - echo " [smoke-test limit reached]" - return - fi - done - done < "$set_file" - - echo " [$count tasks completed for $cat_name]" -} - -echo "============================================================" -echo "Map2Check v8 — TestComp 2026 Checkpoint" -echo "============================================================" -echo "Timeout: ${TIMEOUT}s | Solver: z3 | Target: reach_error" -echo "KLEE runtime: $KLEE_RUNTIME_LIBRARY_PATH" -echo "" - -for cat in Loops Arrays ControlFlow; do - process_category "$cat" -done - -echo "" -echo "============================================================" -echo "SUMMARY" -echo "============================================================" -echo "Total: $TOTAL" -echo "TRUE: $T_TRUE" -echo "FALSE: $T_FALSE" -echo "UNKNOWN: $T_UNKNOWN" -echo "CORRECT: $T_CORRECT / $TOTAL" -echo "" -echo "CSV: $CSV" diff --git a/test-comp2026/simulation/run_checkpoint.sh b/test-comp2026/simulation/run_checkpoint.sh deleted file mode 100755 index c65b71f1c..000000000 --- a/test-comp2026/simulation/run_checkpoint.sh +++ /dev/null @@ -1,180 +0,0 @@ -#!/bin/bash -# run_checkpoint.sh — Run TestComp 2026 checkpoint inside Docker -# Usage: ./run_checkpoint.sh [--smoke-test] - -set -e - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)" -RESULTS_DIR="$SCRIPT_DIR/resultados_de_testes" -RELEASE_DIR="$SCRIPT_DIR/release" -SV_BENCH="$SCRIPT_DIR/sv-benchmarks/c" -TIMEOUT=300 -SMOKE_TEST=false - -if [ "$1" = "--smoke-test" ]; then - SMOKE_TEST=true -fi - -mkdir -p "$RESULTS_DIR" - -echo "============================================================" -echo "TestComp 2026 Checkpoint — Map2Check v8 (LLVM 16)" -echo "============================================================" -echo "Project root: $PROJECT_ROOT" -echo "Smoke test: $SMOKE_TEST" -echo "Timeout: ${TIMEOUT}s per task" -echo "" - -# Step 1: Update release binaries inside Docker -echo "[SETUP] Updating release binaries..." -docker run --rm -v "$PROJECT_ROOT":/workspace map2check-dev bash -c ' -MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release -cp /workspace/build/modules/frontend/map2check $MAP2CHECK_PATH/map2check -cp /workspace/build/modules/backend/pass/lib*.so $MAP2CHECK_PATH/lib/ -mkdir -p $MAP2CHECK_PATH/lib/klee/runtime -cp /opt/klee/lib/klee/runtime/*.bca $MAP2CHECK_PATH/lib/klee/runtime/ -chmod +x $MAP2CHECK_PATH/map2check -echo "Done." -' - -# Step 2: Run tests -run_test() { - local c_file="$1" - local category="$2" - local prop="$3" - local basename=$(basename "$c_file") - - # Run inside Docker - local result - result=$(docker run --rm \ - -v "$PROJECT_ROOT":/workspace \ - -e KLEE_RUNTIME_LIBRARY_PATH=/workspace/test-comp2026/simulation/release/lib/klee/runtime \ - map2check-dev bash -c " - cd /tmp && mkdir -p m2c_run && cd m2c_run - timeout ${TIMEOUT} /workspace/test-comp2026/simulation/release/map2check \ - --timeout $((TIMEOUT - 10)) \ - --smt-solver z3 \ - --target-function \ - --target-function-name reach_error \ - /workspace/test-comp2026/simulation/$c_file 2>&1 | tail -3 - " 2>/dev/null || echo "DOCKER_ERROR") - - # Parse result - local verdict="UNKNOWN" - if echo "$result" | grep -q "VERIFICATION FAILED"; then - verdict="FALSE" - elif echo "$result" | grep -q "VERIFICATION SUCCEEDED"; then - verdict="TRUE" - elif echo "$result" | grep -q "VERIFICATION UNKNOWN"; then - verdict="UNKNOWN" - elif echo "$result" | grep -q "DOCKER_ERROR"; then - verdict="ERROR" - fi - - echo "$verdict" -} - -# Collect .c files from .set categories -collect_files() { - local set_file="$1" - local files=() - - while IFS= read -r line; do - line=$(echo "$line" | xargs) # trim - [[ -z "$line" || "$line" == \#* ]] && continue - - # Expand glob - for yml in $SV_BENCH/$line; do - if [ -f "$yml" ] && [ -s "$yml" ]; then - # Extract input_files from yml - local input_file - input_file=$(grep "input_files:" "$yml" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - if [ -n "$input_file" ]; then - local dir=$(dirname "$yml") - local rel_dir=$(echo "$dir" | sed "s|.*sv-benchmarks/c/||") - # Check if it has coverage-error-call property - if grep -q "coverage-error-call" "$yml"; then - files+=("sv-benchmarks/c/${rel_dir}/${input_file}") - fi - fi - fi - done - done < "$set_file" - - printf '%s\n' "${files[@]}" -} - -# Categories -CATEGORIES=("Loops" "Arrays" "ControlFlow") -TOTAL_TASKS=0 -TOTAL_TRUE=0 -TOTAL_FALSE=0 -TOTAL_UNKNOWN=0 -TOTAL_ERROR=0 -CSV_FILE="$RESULTS_DIR/summary_report_v8.csv" -echo "category,file,time_s,result" > "$CSV_FILE" - -for cat in "${CATEGORIES[@]}"; do - set_file="$SV_BENCH/${cat}.set" - if [ ! -f "$set_file" ]; then - echo "[WARN] Set file not found: $set_file" - continue - fi - - echo "" - echo "============================================================" - echo "[CAT] $cat (cover-error-call)" - echo "============================================================" - - cat_dir="$RESULTS_DIR/$cat" - mkdir -p "$cat_dir" - - mapfile -t test_files < <(collect_files "$set_file") - echo "[INFO] Found ${#test_files[@]} tasks with coverage-error-call" - - task_count=0 - for c_file in "${test_files[@]}"; do - [ -z "$c_file" ] && continue - full_path="$SCRIPT_DIR/$c_file" - [ ! -f "$full_path" ] && continue - - basename_file=$(basename "$c_file") - printf "[RUN] %-50s " "$basename_file" - - start_time=$(date +%s) - verdict=$(run_test "$c_file" "$cat" "coverage-error-call") - end_time=$(date +%s) - elapsed=$((end_time - start_time)) - - printf "%-10s (%ds)\n" "$verdict" "$elapsed" - - echo "$cat,$basename_file,$elapsed,$verdict" >> "$CSV_FILE" - echo "$basename_file: ${elapsed}s, Result: $verdict" >> "$cat_dir/tempos.txt" - - TOTAL_TASKS=$((TOTAL_TASKS + 1)) - case "$verdict" in - TRUE) TOTAL_TRUE=$((TOTAL_TRUE + 1)) ;; - FALSE) TOTAL_FALSE=$((TOTAL_FALSE + 1)) ;; - UNKNOWN) TOTAL_UNKNOWN=$((TOTAL_UNKNOWN + 1)) ;; - ERROR) TOTAL_ERROR=$((TOTAL_ERROR + 1)) ;; - esac - - task_count=$((task_count + 1)) - if [ "$SMOKE_TEST" = true ] && [ "$task_count" -ge 5 ]; then - echo "[INFO] Smoke test limit (5 tasks per category). Stopping." - break - fi - done -done - -echo "" -echo "============================================================" -echo "SUMMARY REPORT" -echo "============================================================" -echo "Total tasks: $TOTAL_TASKS" -echo "TRUE: $TOTAL_TRUE" -echo "FALSE: $TOTAL_FALSE" -echo "UNKNOWN: $TOTAL_UNKNOWN" -echo "ERROR: $TOTAL_ERROR" -echo "Report saved: $CSV_FILE" diff --git a/test-comp2026/simulation/run_controlflow_coverage_inside.sh b/test-comp2026/simulation/run_controlflow_coverage_inside.sh deleted file mode 100755 index 2b6ee70cf..000000000 --- a/test-comp2026/simulation/run_controlflow_coverage_inside.sh +++ /dev/null @@ -1,168 +0,0 @@ -#!/bin/bash -# run_controlflow_coverage_inside.sh — Run C.coverage-error-call.ControlFlow -# Follows TestComp 2026 guidelines -# Usage: This script runs INSIDE the Docker container via: -# docker run --rm -v $(pwd):/workspace map2check-dev bash /workspace/test-comp2026/simulation/run_controlflow_coverage_inside.sh -set -e - -MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release -SV_BENCH=/workspace/test-comp2026/simulation/sv-benchmarks/c -RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/controlflow_coverage_error_call -TIMEOUT=300 -INNER_TIMEOUT=$((TIMEOUT - 10)) -PROP_FILE=/workspace/test-comp2026/simulation/coverage-error-call.prp - -export KLEE_RUNTIME_LIBRARY_PATH="$MAP2CHECK_PATH/lib/klee/runtime" -export MAP2CHECK_PATH - -mkdir -p "$RESULTS_DIR" - -CSV="$RESULTS_DIR/controlflow_coverage_results_v8.csv" -echo "set_file,subdir,file,time_s,result" > "$CSV" - -TOTAL=0; T_FALSE=0; T_TRUE=0; T_UNKNOWN=0; T_TIMEOUT=0; T_ERROR=0 -SCORE=0 - -# Update binaries from build -echo "[SETUP] Updating release binaries from build..." -cp /workspace/build/modules/frontend/map2check $MAP2CHECK_PATH/map2check 2>/dev/null || true -cp /workspace/build/modules/backend/pass/lib*.so $MAP2CHECK_PATH/lib/ 2>/dev/null || true -mkdir -p $MAP2CHECK_PATH/lib/klee/runtime -cp /opt/klee/lib/klee/runtime/*.bca $MAP2CHECK_PATH/lib/klee/runtime/ 2>/dev/null || true -chmod +x $MAP2CHECK_PATH/map2check - -run_task() { - local c_file="$1" - local set_name="$2" - local subdir="$3" - local basename=$(basename "$c_file") - - cd /tmp && rm -rf m2c_cf_run && mkdir -p m2c_cf_run && cd m2c_cf_run - - local start_time=$(date +%s) - - # Use the wrapper (which handles the full pipeline) - local output - output=$(cd $MAP2CHECK_PATH && timeout "$TIMEOUT" python3 map2check-wrapper.py \ - -p "$PROP_FILE" "$c_file" 2>&1 || true) - local exit_code=$? - - local end_time=$(date +%s) - local elapsed=$((end_time - start_time)) - - # Parse result from wrapper output - local result="UNKNOWN" - while IFS= read -r line; do - line=$(echo "$line" | xargs) - case "$line" in - FALSE|FALSE_FREE|FALSE_DEREF|FALSE_MEMTRACK|FALSE_MEMCLEANUP|FALSE_OVERFLOW) - result="$line" ;; - TRUE) - result="TRUE" ;; - UNKNOWN) - result="UNKNOWN" ;; - "Timed out") - result="TIMEOUT" ;; - esac - done <<< "$output" - - # If elapsed >= TIMEOUT, mark as timeout - if [ "$elapsed" -ge "$TIMEOUT" ] && [ "$result" = "UNKNOWN" ]; then - result="TIMEOUT" - fi - - printf " %-55s %-12s %4ds\n" "$subdir/$basename" "$result" "$elapsed" - echo "$set_name,$subdir,$basename,$elapsed,$result" >> "$CSV" - - TOTAL=$((TOTAL + 1)) - case "$result" in - FALSE*) T_FALSE=$((T_FALSE + 1)); SCORE=$((SCORE + 1)) ;; - TRUE) T_TRUE=$((T_TRUE + 1)) ;; - TIMEOUT) T_TIMEOUT=$((T_TIMEOUT + 1)) ;; - UNKNOWN) T_UNKNOWN=$((T_UNKNOWN + 1)) ;; - *) T_ERROR=$((T_ERROR + 1)) ;; - esac -} - -process_set() { - local set_file="$1" - local set_name=$(basename "$set_file" .set) - - [ ! -f "$set_file" ] && { echo "[WARN] $set_file not found"; return; } - - echo "" - echo "============================================================" - echo "[SET] $set_name ($set_file)" - echo "============================================================" - - local count=0 - - while IFS= read -r line; do - line=$(echo "$line" | xargs) - [[ -z "$line" || "$line" == \#* ]] && continue - - for yml in $SV_BENCH/$line; do - [ ! -f "$yml" ] && continue - - # Extract input file - local input_file - input_file=$(grep "^input_files:" "$yml" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - [ -z "$input_file" ] && continue - - local dir=$(dirname "$yml") - local c_file="$dir/$input_file" - [ ! -f "$c_file" ] && continue - - local subdir_name=$(basename "$dir") - - # For coverage-error-call, check if program has reach_error - if ! grep -q "reach_error" "$c_file" 2>/dev/null; then - continue - fi - - run_task "$c_file" "$set_name" "$subdir_name" - count=$((count + 1)) - - # Limit for smoke test mode - if [ "${SMOKE_TEST:-false}" = "true" ] && [ "$count" -ge 5 ]; then - echo " [smoke-test limit reached]" - return - fi - done - done < "$set_file" - - echo " [$count tasks completed for $set_name]" -} - -echo "============================================================" -echo "Map2Check v8 — TestComp 2026" -echo "Category: C.coverage-error-call.ControlFlow" -echo "============================================================" -echo "Timeout: ${TIMEOUT}s | Solver: z3 | Property: coverage-error-call" -echo "KLEE runtime: $KLEE_RUNTIME_LIBRARY_PATH" -echo "Start time: $(date)" -echo "" - -START_GLOBAL=$(date +%s) - -# Process ControlFlow.set -process_set "$SV_BENCH/ControlFlow.set" - -END_GLOBAL=$(date +%s) -ELAPSED_GLOBAL=$((END_GLOBAL - START_GLOBAL)) - -echo "" -echo "============================================================" -echo "SUMMARY — C.coverage-error-call.ControlFlow" -echo "============================================================" -echo "Total tasks: $TOTAL" -echo "FALSE (reach_error found): $T_FALSE" -echo "TRUE: $T_TRUE" -echo "UNKNOWN: $T_UNKNOWN" -echo "TIMEOUT: $T_TIMEOUT" -echo "ERROR: $T_ERROR" -echo "Score: $SCORE / $TOTAL" -echo "Total time: ${ELAPSED_GLOBAL}s ($(( ELAPSED_GLOBAL / 3600 ))h $(( (ELAPSED_GLOBAL % 3600) / 60 ))m)" -echo "End time: $(date)" -echo "" -echo "CSV: $CSV" diff --git a/test-comp2026/simulation/run_controlflow_inside.sh b/test-comp2026/simulation/run_controlflow_inside.sh deleted file mode 100755 index b3ae4ef01..000000000 --- a/test-comp2026/simulation/run_controlflow_inside.sh +++ /dev/null @@ -1,210 +0,0 @@ -#!/bin/bash -# run_controlflow_inside.sh — Run C.no-overflow.ControlFlow inside a single Docker container -# Follows TestComp 2026 guidelines for the ControlFlow subcategory -# Usage: This script runs INSIDE the Docker container via: -# docker run --rm -v $(pwd):/workspace map2check-dev bash /workspace/test-comp2026/simulation/run_controlflow_inside.sh -set -e - -MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release -SV_BENCH=/workspace/test-comp2026/simulation/sv-benchmarks/c -RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/controlflow_no_overflow -TIMEOUT=300 -INNER_TIMEOUT=$((TIMEOUT - 10)) -PROP_FILE=/workspace/test-comp2026/simulation/coverage-error-call.prp - -export KLEE_RUNTIME_LIBRARY_PATH="$MAP2CHECK_PATH/lib/klee/runtime" -export MAP2CHECK_PATH - -mkdir -p "$RESULTS_DIR" - -CSV="$RESULTS_DIR/controlflow_results_v8.csv" -echo "set_file,subdir,file,time_s,result,expected" > "$CSV" - -TOTAL=0; T_FALSE=0; T_TRUE=0; T_UNKNOWN=0; T_TIMEOUT=0; T_ERROR=0; T_CORRECT=0 -SCORE=0 - -# Update binaries from build -echo "[SETUP] Updating release binaries from build..." -cp /workspace/build/modules/frontend/map2check $MAP2CHECK_PATH/map2check 2>/dev/null || true -cp /workspace/build/modules/backend/pass/lib*.so $MAP2CHECK_PATH/lib/ 2>/dev/null || true -mkdir -p $MAP2CHECK_PATH/lib/klee/runtime -cp /opt/klee/lib/klee/runtime/*.bca $MAP2CHECK_PATH/lib/klee/runtime/ 2>/dev/null || true -chmod +x $MAP2CHECK_PATH/map2check - -run_task() { - local c_file="$1" - local set_name="$2" - local subdir="$3" - local basename=$(basename "$c_file") - local yml_file="$4" - - cd /tmp && rm -rf m2c_cf_run && mkdir -p m2c_cf_run && cd m2c_cf_run - - local start_time=$(date +%s) - - # Use the wrapper (which handles the full pipeline) - local output - output=$(cd $MAP2CHECK_PATH && timeout "$TIMEOUT" python3 map2check-wrapper.py \ - -p "$PROP_FILE" "$c_file" 2>&1 || true) - local exit_code=$? - - local end_time=$(date +%s) - local elapsed=$((end_time - start_time)) - - # Parse result from wrapper output - local result="UNKNOWN" - while IFS= read -r line; do - line=$(echo "$line" | xargs) - case "$line" in - FALSE|FALSE_FREE|FALSE_DEREF|FALSE_MEMTRACK|FALSE_MEMCLEANUP|FALSE_OVERFLOW) - result="$line" ;; - TRUE) - result="TRUE" ;; - UNKNOWN) - result="UNKNOWN" ;; - "Timed out") - result="TIMEOUT" ;; - esac - done <<< "$output" - - # If elapsed >= TIMEOUT, mark as timeout - if [ "$elapsed" -ge "$TIMEOUT" ] && [ "$result" = "UNKNOWN" ]; then - result="TIMEOUT" - fi - - # Extract expected verdict from YML for no-overflow property - local expected="UNKNOWN" - if [ -f "$yml_file" ]; then - # Parse expected_verdict for the no-overflow property - expected=$(python3 -c " -import yaml -import sys -try: - with open('$yml_file', 'r') as f: - data = yaml.safe_load(f) - for prop in data.get('properties', []): - if 'no-overflow' in prop.get('property_file', ''): - verdict = prop.get('expected_verdict') - if verdict is True: - print('TRUE') - elif verdict is False: - print('FALSE') - else: - print('UNKNOWN') - break - else: - print('UNKNOWN') -except Exception as e: - print('UNKNOWN') -" 2>/dev/null || echo "UNKNOWN") - fi - - # Determine correctness - local correct="?" - if [ "$expected" = "$result" ]; then - correct="OK" - elif [ "$result" = "UNKNOWN" ] || [ "$result" = "TIMEOUT" ]; then - correct="UNK" - else - correct="WRONG" - fi - - printf " %-55s %-12s %4ds [exp: %-5s] %s\n" "$subdir/$basename" "$result" "$elapsed" "$expected" "$correct" - echo "$set_name,$subdir,$basename,$elapsed,$result,$expected" >> "$CSV" - - TOTAL=$((TOTAL + 1)) - case "$result" in - FALSE*) T_FALSE=$((T_FALSE + 1)); SCORE=$((SCORE + 1)) ;; - TRUE) T_TRUE=$((T_TRUE + 1)) ;; - TIMEOUT) T_TIMEOUT=$((T_TIMEOUT + 1)) ;; - UNKNOWN) T_UNKNOWN=$((T_UNKNOWN + 1)) ;; - *) T_ERROR=$((T_ERROR + 1)) ;; - esac - if [ "$correct" = "OK" ]; then - T_CORRECT=$((T_CORRECT + 1)) - fi -} - -process_set() { - local set_file="$1" - local set_name=$(basename "$set_file" .set) - - [ ! -f "$set_file" ] && { echo "[WARN] $set_file not found"; return; } - - echo "" - echo "============================================================" - echo "[SET] $set_name ($set_file)" - echo "============================================================" - - local count=0 - - while IFS= read -r line; do - line=$(echo "$line" | xargs) - [[ -z "$line" || "$line" == \#* ]] && continue - - for yml in $SV_BENCH/$line; do - [ ! -f "$yml" ] && continue - - # Extract input file - local input_file - input_file=$(grep "^input_files:" "$yml" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - [ -z "$input_file" ] && continue - - local dir=$(dirname "$yml") - local c_file="$dir/$input_file" - [ ! -f "$c_file" ] && continue - - local subdir_name=$(basename "$dir") - - # Check if program has no-overflow property - if ! grep -q "no-overflow" "$yml" 2>/dev/null; then - continue - fi - - run_task "$c_file" "$set_name" "$subdir_name" "$yml" - count=$((count + 1)) - - # Limit for smoke test mode - if [ "${SMOKE_TEST:-false}" = "true" ] && [ "$count" -ge 5 ]; then - echo " [smoke-test limit reached]" - return - fi - done - done < "$set_file" - - echo " [$count tasks completed for $set_name]" -} - -echo "============================================================" -echo "Map2Check v8 — TestComp 2026" -echo "Category: C.no-overflow.ControlFlow" -echo "============================================================" -echo "Timeout: ${TIMEOUT}s | Solver: z3 | Property: no-overflow" -echo "KLEE runtime: $KLEE_RUNTIME_LIBRARY_PATH" -echo "Start time: $(date)" -echo "" - -START_GLOBAL=$(date +%s) - -# Process ControlFlow.set -process_set "$SV_BENCH/ControlFlow.set" - -END_GLOBAL=$(date +%s) -ELAPSED_GLOBAL=$((END_GLOBAL - START_GLOBAL)) - -echo "" -echo "============================================================" -echo "SUMMARY — C.no-overflow.ControlFlow" -echo "============================================================" -echo "Total tasks: $TOTAL" -echo "FALSE (bug): $T_FALSE" -echo "TRUE: $T_TRUE" -echo "UNKNOWN: $T_UNKNOWN" -echo "TIMEOUT: $T_TIMEOUT" -echo "ERROR: $T_ERROR" -echo "CORRECT: $T_CORRECT / $TOTAL" -echo "Score: $SCORE / $TOTAL" -echo "Total time: ${ELAPSED_GLOBAL}s ($(( ELAPSED_GLOBAL / 3600 ))h $(( (ELAPSED_GLOBAL % 3600) / 60 ))m)" -echo "End time: $(date)" -echo "" -echo "CSV: $CSV" diff --git a/test-comp2026/simulation/run_heap_inside.sh b/test-comp2026/simulation/run_heap_inside.sh deleted file mode 100755 index ea670458f..000000000 --- a/test-comp2026/simulation/run_heap_inside.sh +++ /dev/null @@ -1,167 +0,0 @@ -#!/bin/bash -# run_heap_inside.sh — Run C.coverage-error-call.Heap inside a single Docker container -# Follows TestComp 2026 guidelines for the Heap subcategory -# Usage: This script runs INSIDE the Docker container via: -# docker run --rm -v $(pwd):/workspace map2check-dev bash /workspace/test-comp2026/simulation/run_heap_inside.sh -set -e - -MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release -SV_BENCH=/workspace/test-comp2026/simulation/sv-benchmarks/c -RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/heap_coverage_error_call -TIMEOUT=300 -INNER_TIMEOUT=$((TIMEOUT - 10)) -PROP_FILE=/workspace/test-comp2026/simulation/coverage-error-call.prp - -export KLEE_RUNTIME_LIBRARY_PATH="$MAP2CHECK_PATH/lib/klee/runtime" -export MAP2CHECK_PATH - -mkdir -p "$RESULTS_DIR" - -CSV="$RESULTS_DIR/heap_results_v8.csv" -echo "set_file,subdir,file,time_s,result" > "$CSV" - -TOTAL=0; T_FALSE=0; T_TRUE=0; T_UNKNOWN=0; T_TIMEOUT=0; T_ERROR=0 -SCORE=0 - -# Update binaries from build -echo "[SETUP] Updating release binaries from build..." -cp /workspace/build/modules/frontend/map2check $MAP2CHECK_PATH/map2check 2>/dev/null || true -cp /workspace/build/modules/backend/pass/lib*.so $MAP2CHECK_PATH/lib/ 2>/dev/null || true -mkdir -p $MAP2CHECK_PATH/lib/klee/runtime -cp /opt/klee/lib/klee/runtime/*.bca $MAP2CHECK_PATH/lib/klee/runtime/ 2>/dev/null || true -chmod +x $MAP2CHECK_PATH/map2check - -run_task() { - local c_file="$1" - local set_name="$2" - local subdir="$3" - local basename=$(basename "$c_file") - - cd /tmp && rm -rf m2c_heap_run && mkdir -p m2c_heap_run && cd m2c_heap_run - - local start_time=$(date +%s) - - # Use the wrapper (which handles the full pipeline) - local output - output=$(cd $MAP2CHECK_PATH && timeout "$TIMEOUT" python3 map2check-wrapper.py \ - -p "$PROP_FILE" "$c_file" 2>&1 || true) - local exit_code=$? - - local end_time=$(date +%s) - local elapsed=$((end_time - start_time)) - - # Parse result from wrapper output - local result="UNKNOWN" - while IFS= read -r line; do - line=$(echo "$line" | xargs) - case "$line" in - FALSE|FALSE_FREE|FALSE_DEREF|FALSE_MEMTRACK|FALSE_MEMCLEANUP|FALSE_OVERFLOW) - result="$line" ;; - TRUE) - result="TRUE" ;; - UNKNOWN) - result="UNKNOWN" ;; - "Timed out") - result="TIMEOUT" ;; - esac - done <<< "$output" - - # If elapsed >= TIMEOUT, mark as timeout - if [ "$elapsed" -ge "$TIMEOUT" ] && [ "$result" = "UNKNOWN" ]; then - result="TIMEOUT" - fi - - printf " %-55s %-12s %4ds\n" "$subdir/$basename" "$result" "$elapsed" - echo "$set_name,$subdir,$basename,$elapsed,$result" >> "$CSV" - - TOTAL=$((TOTAL + 1)) - case "$result" in - FALSE*) T_FALSE=$((T_FALSE + 1)); SCORE=$((SCORE + 1)) ;; - TRUE) T_TRUE=$((T_TRUE + 1)) ;; - TIMEOUT) T_TIMEOUT=$((T_TIMEOUT + 1)) ;; - UNKNOWN) T_UNKNOWN=$((T_UNKNOWN + 1)) ;; - *) T_ERROR=$((T_ERROR + 1)) ;; - esac -} - -process_set() { - local set_file="$1" - local set_name=$(basename "$set_file" .set) - - [ ! -f "$set_file" ] && { echo "[WARN] $set_file not found"; return; } - - echo "" - echo "============================================================" - echo "[SET] $set_name ($set_file)" - echo "============================================================" - - local count=0 - - while IFS= read -r line; do - line=$(echo "$line" | xargs) - [[ -z "$line" || "$line" == \#* ]] && continue - - for yml in $SV_BENCH/$line; do - [ ! -f "$yml" ] && continue - - # Extract input file - local input_file - input_file=$(grep "^input_files:" "$yml" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - [ -z "$input_file" ] && continue - - local dir=$(dirname "$yml") - local c_file="$dir/$input_file" - [ ! -f "$c_file" ] && continue - - local subdir_name=$(basename "$dir") - - # Check if program has reach_error (required for coverage-error-call) - if ! grep -q "reach_error" "$c_file" 2>/dev/null; then - # Some tasks define reach_error via extern or in included headers - # Still run them — the wrapper handles this - : - fi - - run_task "$c_file" "$set_name" "$subdir_name" - count=$((count + 1)) - done - done < "$set_file" - - echo " [$count tasks completed for $set_name]" -} - -echo "============================================================" -echo "Map2Check v8 — TestComp 2026" -echo "Category: C.coverage-error-call.Heap" -echo "============================================================" -echo "Timeout: ${TIMEOUT}s | Solver: z3 | Target: reach_error" -echo "KLEE runtime: $KLEE_RUNTIME_LIBRARY_PATH" -echo "Start time: $(date)" -echo "" - -START_GLOBAL=$(date +%s) - -# Process Heap.set -process_set "$SV_BENCH/Heap.set" - -# Process LinkedLists.set -process_set "$SV_BENCH/LinkedLists.set" - -END_GLOBAL=$(date +%s) -ELAPSED_GLOBAL=$((END_GLOBAL - START_GLOBAL)) - -echo "" -echo "============================================================" -echo "SUMMARY — C.coverage-error-call.Heap" -echo "============================================================" -echo "Total tasks: $TOTAL" -echo "FALSE (bug): $T_FALSE" -echo "TRUE: $T_TRUE" -echo "UNKNOWN: $T_UNKNOWN" -echo "TIMEOUT: $T_TIMEOUT" -echo "ERROR: $T_ERROR" -echo "Score: $SCORE / $TOTAL" -echo "Total time: ${ELAPSED_GLOBAL}s ($(( ELAPSED_GLOBAL / 3600 ))h $(( (ELAPSED_GLOBAL % 3600) / 60 ))m)" -echo "End time: $(date)" -echo "" -echo "CSV: $CSV" diff --git a/test-comp2026/simulation/run_heap_resume.sh b/test-comp2026/simulation/run_heap_resume.sh deleted file mode 100755 index 5440ed587..000000000 --- a/test-comp2026/simulation/run_heap_resume.sh +++ /dev/null @@ -1,281 +0,0 @@ -#!/bin/bash -# run_heap_resume.sh — Resume C.coverage-error-call.Heap from where it stopped -# Reads existing CSV to skip completed tasks, then verifies verdicts at the end -# Usage: docker run --rm -v $(pwd):/workspace map2check-dev bash /workspace/test-comp2026/simulation/run_heap_resume.sh -set -e - -MAP2CHECK_PATH=/workspace/test-comp2026/simulation/release -SV_BENCH=/workspace/test-comp2026/simulation/sv-benchmarks/c -RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/heap_coverage_error_call -TIMEOUT=300 -PROP_FILE=/workspace/test-comp2026/simulation/coverage-error-call.prp - -export KLEE_RUNTIME_LIBRARY_PATH="$MAP2CHECK_PATH/lib/klee/runtime" -export MAP2CHECK_PATH - -mkdir -p "$RESULTS_DIR" - -CSV="$RESULTS_DIR/heap_results_v8.csv" - -# === RESUME LOGIC: Build set of already-completed tasks === -declare -A COMPLETED -SKIPPED=0 -if [ -f "$CSV" ]; then - while IFS=, read -r set_name subdir file_name rest; do - [ "$set_name" = "set_file" ] && continue # skip header - COMPLETED["${set_name}::${subdir}::${file_name}"]=1 - done < "$CSV" - echo "[RESUME] Found ${#COMPLETED[@]} already-completed tasks in CSV" -else - echo "set_file,subdir,file,time_s,result" > "$CSV" - echo "[RESUME] No existing CSV, starting fresh" -fi - -TOTAL=0; T_FALSE=0; T_TRUE=0; T_UNKNOWN=0; T_TIMEOUT=0; T_ERROR=0; NEW_TASKS=0 -SCORE=0 - -# Update binaries from build -echo "[SETUP] Updating release binaries from build..." -cp /workspace/build/modules/frontend/map2check $MAP2CHECK_PATH/map2check 2>/dev/null || true -cp /workspace/build/modules/backend/pass/lib*.so $MAP2CHECK_PATH/lib/ 2>/dev/null || true -mkdir -p $MAP2CHECK_PATH/lib/klee/runtime -cp /opt/klee/lib/klee/runtime/*.bca $MAP2CHECK_PATH/lib/klee/runtime/ 2>/dev/null || true -chmod +x $MAP2CHECK_PATH/map2check - -run_task() { - local c_file="$1" - local set_name="$2" - local subdir="$3" - local basename=$(basename "$c_file") - - # Skip if already completed - if [ -n "${COMPLETED[${set_name}::${subdir}::${basename}]}" ]; then - SKIPPED=$((SKIPPED + 1)) - return - fi - - cd /tmp && rm -rf m2c_heap_run && mkdir -p m2c_heap_run && cd m2c_heap_run - - local start_time=$(date +%s) - - local output - output=$(cd $MAP2CHECK_PATH && timeout "$TIMEOUT" python3 map2check-wrapper.py \ - -p "$PROP_FILE" "$c_file" 2>&1 || true) - - local end_time=$(date +%s) - local elapsed=$((end_time - start_time)) - - # Parse result from wrapper output - local result="UNKNOWN" - while IFS= read -r line; do - line=$(echo "$line" | xargs) - case "$line" in - FALSE|FALSE_FREE|FALSE_DEREF|FALSE_MEMTRACK|FALSE_MEMCLEANUP|FALSE_OVERFLOW) - result="$line" ;; - TRUE) - result="TRUE" ;; - UNKNOWN) - result="UNKNOWN" ;; - "Timed out") - result="TIMEOUT" ;; - esac - done <<< "$output" - - if [ "$elapsed" -ge "$TIMEOUT" ] && [ "$result" = "UNKNOWN" ]; then - result="TIMEOUT" - fi - - printf " %-55s %-12s %4ds\n" "$subdir/$basename" "$result" "$elapsed" - echo "$set_name,$subdir,$basename,$elapsed,$result" >> "$CSV" - - TOTAL=$((TOTAL + 1)) - NEW_TASKS=$((NEW_TASKS + 1)) - case "$result" in - FALSE*) T_FALSE=$((T_FALSE + 1)); SCORE=$((SCORE + 1)) ;; - TRUE) T_TRUE=$((T_TRUE + 1)) ;; - TIMEOUT) T_TIMEOUT=$((T_TIMEOUT + 1)) ;; - UNKNOWN) T_UNKNOWN=$((T_UNKNOWN + 1)) ;; - *) T_ERROR=$((T_ERROR + 1)) ;; - esac -} - -process_set() { - local set_file="$1" - local set_name=$(basename "$set_file" .set) - - [ ! -f "$set_file" ] && { echo "[WARN] $set_file not found"; return; } - - echo "" - echo "============================================================" - echo "[SET] $set_name ($set_file)" - echo "============================================================" - - local count=0 - - while IFS= read -r line; do - line=$(echo "$line" | xargs) - [[ -z "$line" || "$line" == \#* ]] && continue - - for yml in $SV_BENCH/$line; do - [ ! -f "$yml" ] && continue - - local input_file - input_file=$(grep "^input_files:" "$yml" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - [ -z "$input_file" ] && continue - - local dir=$(dirname "$yml") - local c_file="$dir/$input_file" - [ ! -f "$c_file" ] && continue - - local subdir_name=$(basename "$dir") - - run_task "$c_file" "$set_name" "$subdir_name" - count=$((count + 1)) - done - done < "$set_file" - - echo " [$count tasks processed for $set_name, $SKIPPED skipped (already done)]" -} - -echo "============================================================" -echo "Map2Check v8 — TestComp 2026 (RESUME)" -echo "Category: C.coverage-error-call.Heap" -echo "============================================================" -echo "Timeout: ${TIMEOUT}s | Solver: z3 | Target: reach_error" -echo "KLEE runtime: $KLEE_RUNTIME_LIBRARY_PATH" -echo "Resuming from: ${#COMPLETED[@]} completed tasks" -echo "Start time: $(date)" -echo "" - -START_GLOBAL=$(date +%s) - -# Process Heap.set -process_set "$SV_BENCH/Heap.set" - -# Process LinkedLists.set -process_set "$SV_BENCH/LinkedLists.set" - -END_GLOBAL=$(date +%s) -ELAPSED_GLOBAL=$((END_GLOBAL - START_GLOBAL)) - -echo "" -echo "============================================================" -echo "EXECUTION SUMMARY (this session)" -echo "============================================================" -echo "New tasks run: $NEW_TASKS" -echo "Skipped (prev): $SKIPPED" -echo "FALSE (new): $T_FALSE" -echo "TRUE (new): $T_TRUE" -echo "UNKNOWN (new): $T_UNKNOWN" -echo "TIMEOUT (new): $T_TIMEOUT" -echo "ERROR (new): $T_ERROR" -echo "Session time: ${ELAPSED_GLOBAL}s ($(( ELAPSED_GLOBAL / 3600 ))h $(( (ELAPSED_GLOBAL % 3600) / 60 ))m)" -echo "" - -# ============================================================ -# VERDICT VERIFICATION against sv-benchmarks expected_verdict -# ============================================================ -echo "============================================================" -echo "VERDICT VERIFICATION" -echo "============================================================" - -VERIFY_CSV="$RESULTS_DIR/verdict_verification.csv" -echo "set_name,subdir,file,map2check_result,expected_verdict,match" > "$VERIFY_CSV" - -CORRECT=0; INCORRECT=0; UNVERIFIABLE=0; TOTAL_VERIFY=0 - -while IFS=, read -r set_name subdir file_name time_s result; do - [ "$set_name" = "set_file" ] && continue - - # Find the yml file for this task - yml_file="" - for candidate in "$SV_BENCH/$subdir"/*.yml; do - [ ! -f "$candidate" ] && continue - inp=$(grep "^input_files:" "$candidate" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - if [ "$inp" = "$file_name" ]; then - yml_file="$candidate" - break - fi - done - - if [ -z "$yml_file" ]; then - echo "$set_name,$subdir,$file_name,$result,N/A,UNVERIFIABLE" >> "$VERIFY_CSV" - UNVERIFIABLE=$((UNVERIFIABLE + 1)) - TOTAL_VERIFY=$((TOTAL_VERIFY + 1)) - continue - fi - - # Extract expected_verdict for unreach-call (coverage-error-call inverse) - # unreach-call: false => reach_error IS reachable => coverage-error-call expects FALSE (bug found) - # unreach-call: true => reach_error NOT reachable => coverage-error-call expects TRUE - expected=$(grep -A1 "unreach-call.prp" "$yml_file" | grep "expected_verdict:" | head -1 | awk '{print $2}') - - TOTAL_VERIFY=$((TOTAL_VERIFY + 1)) - - if [ -z "$expected" ]; then - # No expected verdict for unreach-call — might be coverage-only task - echo "$set_name,$subdir,$file_name,$result,N/A,UNVERIFIABLE" >> "$VERIFY_CSV" - UNVERIFIABLE=$((UNVERIFIABLE + 1)) - continue - fi - - # Map expected to our result space: - # expected=false (unreach-call) => bug IS reachable => map2check should say FALSE - # expected=true (unreach-call) => no bug => map2check should say TRUE (or UNKNOWN/TIMEOUT is not wrong, just inconclusive) - local match="INCONCLUSIVE" - case "$result" in - FALSE*) - if [ "$expected" = "false" ]; then - match="CORRECT" - CORRECT=$((CORRECT + 1)) - else - match="INCORRECT" - INCORRECT=$((INCORRECT + 1)) - fi - ;; - TRUE) - if [ "$expected" = "true" ]; then - match="CORRECT" - CORRECT=$((CORRECT + 1)) - else - match="INCORRECT" - INCORRECT=$((INCORRECT + 1)) - fi - ;; - UNKNOWN|TIMEOUT) - # Not wrong, just inconclusive - match="INCONCLUSIVE" - UNVERIFIABLE=$((UNVERIFIABLE + 1)) - ;; - *) - match="INCONCLUSIVE" - UNVERIFIABLE=$((UNVERIFIABLE + 1)) - ;; - esac - - echo "$set_name,$subdir,$file_name,$result,$expected,$match" >> "$VERIFY_CSV" -done < "$CSV" - -echo "" -echo "Total verified: $TOTAL_VERIFY" -echo "CORRECT: $CORRECT" -echo "INCORRECT: $INCORRECT" -echo "INCONCLUSIVE/N/A: $UNVERIFIABLE" -echo "" -echo "Accuracy (excl. inconclusive): $CORRECT / $((CORRECT + INCORRECT))" -echo "" -echo "Verdict CSV: $VERIFY_CSV" -echo "" - -# Print any INCORRECT verdicts for review -if [ "$INCORRECT" -gt 0 ]; then - echo "============================================================" - echo "⚠️ INCORRECT VERDICTS (need review):" - echo "============================================================" - grep "INCORRECT" "$VERIFY_CSV" -fi - -echo "" -echo "End time: $(date)" -echo "CSV: $CSV" -echo "Verification: $VERIFY_CSV" diff --git a/test-comp2026/simulation/script_execucao.py b/test-comp2026/simulation/script_execucao.py deleted file mode 100644 index 936d9f98f..000000000 --- a/test-comp2026/simulation/script_execucao.py +++ /dev/null @@ -1,276 +0,0 @@ -#!/usr/bin/env python3 -""" -TestComp 2026 Checkpoint — Execution Script for Map2Check v8. - -Runs Map2Check v8 inside Docker (map2check-dev) against sv-benchmarks. -Adapted from guilhermeToCheck/test-comp2023/simulation/script_execucao.py. - -Usage: - python3 script_execucao.py [--smoke-test] -""" - -import os -import subprocess -import xml.etree.ElementTree as ET -import yaml -import time -import glob -import argparse -import csv -import sys - -# --- Configuration --- -DOCKER_IMAGE = "map2check-dev" -WORKSPACE_MOUNT = "/workspace" -MAP2CHECK_BUILD = "/workspace/build/modules/frontend/map2check" -PASSES_DIR = "/workspace/build/modules/backend/pass" -TIMEOUT_SECONDS = 300 -PROPERTY_FILE = "coverage-error-call.prp" - -# Paths inside the Docker container -DOCKER_RELEASE_DIR = "/workspace/test-comp2026/simulation/release" -DOCKER_SV_BENCHMARKS = "/workspace/test-comp2026/simulation/sv-benchmarks" - - -def run_in_docker(command, cwd_inside=None, timeout=TIMEOUT_SECONDS + 30): - """Execute a command inside the map2check-dev Docker container.""" - docker_cmd = [ - "docker", "run", "--rm", - "-v", "{}:{}".format(os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..")), WORKSPACE_MOUNT), - "-e", "MAP2CHECK_PATH={}".format(DOCKER_RELEASE_DIR), - DOCKER_IMAGE, - "bash", "-c", command - ] - try: - result = subprocess.run( - docker_cmd, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - timeout=timeout - ) - return result.stdout.decode('utf-8', errors='replace'), result.stderr.decode('utf-8', errors='replace'), result.returncode - except subprocess.TimeoutExpired: - return "Timed out", "", 1 - except Exception as e: - return "", str(e), 1 - - -def setup_release_dir(): - """Copy map2check binary and passes into the release directory.""" - print("[INFO] Setting up release directory with map2check v8 binaries...") - setup_cmd = ( - "cp {build} {release}/map2check && " - "mkdir -p {release}/lib && " - "cp {passes}/lib*.so {release}/lib/ && " - "chmod +x {release}/map2check" - ).format( - build=MAP2CHECK_BUILD, - release=DOCKER_RELEASE_DIR, - passes=PASSES_DIR - ) - stdout, stderr, rc = run_in_docker(setup_cmd, timeout=30) - if rc != 0: - print("[ERRO] Failed to setup release dir: {}".format(stderr)) - sys.exit(1) - print("[INFO] Release directory ready.") - - -def ler_includesfile(includesfile_path): - """Read .set file and return list of subcategory glob patterns.""" - subcategorias = [] - if not os.path.exists(includesfile_path): - print("[ERRO] Includes file not found: {}".format(includesfile_path)) - return subcategorias - with open(includesfile_path, "r") as f: - for line in f: - line = line.strip() - if line and not line.startswith("#"): - subcategorias.append(line) - return subcategorias - - -def extrair_input_files(yml_path): - """Extract input_files from a .yml task definition.""" - try: - with open(yml_path, "r") as f: - data = yaml.safe_load(f) - if data and "input_files" in data: - raw_input = data["input_files"].strip("'") - return raw_input - except Exception as e: - print("[ERRO] Error reading {}: {}".format(yml_path, e)) - return None - - -def executar_task(input_file_rel, property_name): - """Run map2check on a single input file inside Docker.""" - # Build the command to run inside Docker - wrapper_cmd = ( - "cd {release} && " - "python3 map2check-wrapper.py -p {prop} {input_file}" - ).format( - release=DOCKER_RELEASE_DIR, - prop="/workspace/test-comp2026/simulation/{}".format(property_name), - input_file="{}/c/{}".format(DOCKER_SV_BENCHMARKS, input_file_rel) - ) - - inicio = time.time() - stdout, stderr, rc = run_in_docker(wrapper_cmd, timeout=TIMEOUT_SECONDS + 30) - fim = time.time() - tempo = fim - inicio - - # Parse result from stdout - resultado = "UNKNOWN" - for line in stdout.strip().splitlines(): - line = line.strip() - if line in ["FALSE", "FALSE_FREE", "FALSE_DEREF", "FALSE_MEMTRACK", - "FALSE_MEMCLEANUP", "FALSE_OVERFLOW", "TRUE", "UNKNOWN"]: - resultado = line - elif line == "Timed out": - resultado = "TIMEOUT" - - return tempo, resultado - - -def processar_tarefas(xml_file, resultados_dir, smoke_test=False): - """Process all tasks defined in the benchmark XML.""" - tree = ET.parse(xml_file) - root = tree.getroot() - - # Determine property file from rundefinition - property_name = PROPERTY_FILE - - all_results = [] - task_count = 0 - - for tasks_elem in root.findall("tasks"): - categoria = tasks_elem.get("name") - includesfile_rel = tasks_elem.find("includesfile").text - - # Resolve includesfile path - sim_dir = os.path.dirname(os.path.abspath(xml_file)) - includesfile_path = os.path.join(sim_dir, includesfile_rel) - - print("\n" + "=" * 60) - print("[INFO] Categoria: {}".format(categoria)) - print("=" * 60) - - subcategorias = ler_includesfile(includesfile_path) - if not subcategorias: - print("[WARN] No subcategories found for {}".format(categoria)) - continue - - # Determine property for this category - if "CoverBranches" in categoria: - prop = "coverage-branches.prp" - else: - prop = "coverage-error-call.prp" - - cat_dir = os.path.join(resultados_dir, categoria) - os.makedirs(cat_dir, exist_ok=True) - - tempos = [] - - for subcat_pattern in subcategorias: - # Find .yml files matching the pattern - sv_bench_c = os.path.join(sim_dir, "sv-benchmarks", "c") - yml_pattern = os.path.join(sv_bench_c, subcat_pattern) - yml_files = sorted(glob.glob(yml_pattern)) - - if not yml_files: - continue - - for yml_file in yml_files: - input_file_rel = extrair_input_files(yml_file) - if not input_file_rel: - continue - - # Resolve relative path from yml location - yml_dir = os.path.dirname(yml_file) - yml_dir_rel = os.path.relpath(yml_dir, sv_bench_c) - full_input_rel = os.path.join(yml_dir_rel, input_file_rel) - - task_name = os.path.basename(input_file_rel) - print("[RUN] {}/{}: {}".format(categoria, yml_dir_rel, task_name), end=" ... ", flush=True) - - tempo, resultado = executar_task(full_input_rel, prop) - print("{} ({:.1f}s)".format(resultado, tempo)) - - tempos.append((task_name, tempo, resultado)) - all_results.append((categoria, task_name, tempo, resultado)) - - task_count += 1 - if smoke_test and task_count >= 5: - print("\n[INFO] Smoke test limit reached (5 tasks). Stopping.") - return all_results - - # Write per-category results - tempos_file = os.path.join(cat_dir, "tempos.txt") - with open(tempos_file, "w") as f: - for arquivo, tempo, resultado in tempos: - f.write("{}: {:.3f}s, Result: {}\n".format(arquivo, tempo, resultado)) - print("[INFO] Results saved to {}".format(tempos_file)) - - return all_results - - -def gerar_relatorio(all_results, output_file): - """Generate CSV summary report.""" - with open(output_file, "w", newline='') as f: - writer = csv.writer(f) - writer.writerow(["category", "file", "time_s", "result"]) - for cat, name, tempo, resultado in all_results: - writer.writerow([cat, name, "{:.3f}".format(tempo), resultado]) - - # Summary stats - total = len(all_results) - solved = sum(1 for _, _, _, r in all_results if r in ["FALSE", "TRUE"]) - unknown = sum(1 for _, _, _, r in all_results if r == "UNKNOWN") - timeout = sum(1 for _, _, _, r in all_results if r == "TIMEOUT") - errors = total - solved - unknown - timeout - - print("\n" + "=" * 60) - print("SUMMARY REPORT") - print("=" * 60) - print("Total tasks: {}".format(total)) - print("Solved: {} ({:.1f}%)".format(solved, 100 * solved / max(total, 1))) - print("Unknown: {} ({:.1f}%)".format(unknown, 100 * unknown / max(total, 1))) - print("Timeout: {} ({:.1f}%)".format(timeout, 100 * timeout / max(total, 1))) - print("Errors: {} ({:.1f}%)".format(errors, 100 * errors / max(total, 1))) - print("Report saved: {}".format(output_file)) - - -if __name__ == "__main__": - ap = argparse.ArgumentParser(description="TestComp 2026 Checkpoint Runner") - ap.add_argument("--smoke-test", action="store_true", - help="Run only 5 tasks as smoke test") - ap.add_argument("--xml", default="map2check-v8.xml", - help="Benchmark XML file (default: map2check-v8.xml)") - cli_args = ap.parse_args() - - sim_dir = os.path.dirname(os.path.abspath(__file__)) - os.chdir(sim_dir) - - xml_file = cli_args.xml - resultados_dir = "resultados_de_testes" - os.makedirs(resultados_dir, exist_ok=True) - - print("=" * 60) - print("TestComp 2026 Checkpoint — Map2Check v8 (LLVM 16)") - print("=" * 60) - print("XML: {}".format(xml_file)) - print("Results dir: {}".format(os.path.abspath(resultados_dir))) - print("Smoke test: {}".format(cli_args.smoke_test)) - print("Timeout: {}s per task".format(TIMEOUT_SECONDS)) - print() - - # Setup release directory with binaries - setup_release_dir() - - # Run tasks - all_results = processar_tarefas(xml_file, resultados_dir, - smoke_test=cli_args.smoke_test) - - # Generate report - report_file = os.path.join(resultados_dir, "summary_report_v8.csv") - gerar_relatorio(all_results, report_file) diff --git a/test-comp2026/simulation/verify_verdicts.sh b/test-comp2026/simulation/verify_verdicts.sh deleted file mode 100755 index 92b8b84b4..000000000 --- a/test-comp2026/simulation/verify_verdicts.sh +++ /dev/null @@ -1,121 +0,0 @@ -#!/bin/bash -# verify_verdicts.sh — Verify Map2Check results against sv-benchmarks expected_verdict -# Usage: docker run --rm -v $(pwd):/workspace map2check-dev bash /workspace/test-comp2026/simulation/verify_verdicts.sh -set -e - -SV_BENCH=/workspace/test-comp2026/simulation/sv-benchmarks/c -RESULTS_DIR=/workspace/test-comp2026/simulation/resultados_de_testes/heap_coverage_error_call -CSV="$RESULTS_DIR/heap_results_v8.csv" -VERIFY_CSV="$RESULTS_DIR/verdict_verification.csv" - -echo "set_name,subdir,file,map2check_result,expected_verdict,match" > "$VERIFY_CSV" - -CORRECT=0; INCORRECT=0; INCONCLUSIVE=0; TOTAL_VERIFY=0 - -while IFS=, read -r set_name subdir file_name time_s result; do - [ "$set_name" = "set_file" ] && continue - - # Find the yml file for this task - yml_file="" - for candidate in "$SV_BENCH/$subdir"/*.yml; do - [ ! -f "$candidate" ] && continue - inp=$(grep "^input_files:" "$candidate" | head -1 | sed "s/.*: *'\\(.*\\)'/\\1/") - if [ "$inp" = "$file_name" ]; then - yml_file="$candidate" - break - fi - done - - if [ -z "$yml_file" ]; then - echo "$set_name,$subdir,$file_name,$result,N/A,UNVERIFIABLE" >> "$VERIFY_CSV" - INCONCLUSIVE=$((INCONCLUSIVE + 1)) - TOTAL_VERIFY=$((TOTAL_VERIFY + 1)) - continue - fi - - # Extract expected_verdict for unreach-call (coverage-error-call inverse) - # unreach-call: false => reach_error IS reachable => coverage-error-call expects FALSE (bug found) - # unreach-call: true => reach_error NOT reachable => coverage-error-call expects TRUE - expected=$(grep -A1 "unreach-call.prp" "$yml_file" | grep "expected_verdict:" | head -1 | awk '{print $2}') - - TOTAL_VERIFY=$((TOTAL_VERIFY + 1)) - - if [ -z "$expected" ]; then - # No expected verdict for unreach-call — might be coverage-only task - echo "$set_name,$subdir,$file_name,$result,N/A,UNVERIFIABLE" >> "$VERIFY_CSV" - INCONCLUSIVE=$((INCONCLUSIVE + 1)) - continue - fi - - # Determine match - match="INCONCLUSIVE" - case "$result" in - FALSE|FALSE_FREE|FALSE_DEREF|FALSE_MEMTRACK|FALSE_MEMCLEANUP|FALSE_OVERFLOW) - if [ "$expected" = "false" ]; then - match="CORRECT" - CORRECT=$((CORRECT + 1)) - else - match="INCORRECT" - INCORRECT=$((INCORRECT + 1)) - fi - ;; - TRUE) - if [ "$expected" = "true" ]; then - match="CORRECT" - CORRECT=$((CORRECT + 1)) - else - match="INCORRECT" - INCORRECT=$((INCORRECT + 1)) - fi - ;; - UNKNOWN|TIMEOUT) - match="INCONCLUSIVE" - INCONCLUSIVE=$((INCONCLUSIVE + 1)) - ;; - *) - match="INCONCLUSIVE" - INCONCLUSIVE=$((INCONCLUSIVE + 1)) - ;; - esac - - echo "$set_name,$subdir,$file_name,$result,$expected,$match" >> "$VERIFY_CSV" -done < "$CSV" - -echo "" -echo "============================================================" -echo "VERDICT VERIFICATION RESULTS" -echo "============================================================" -echo "Total tasks: $TOTAL_VERIFY" -echo "CORRECT: $CORRECT" -echo "INCORRECT: $INCORRECT" -echo "INCONCLUSIVE/N/A: $INCONCLUSIVE" -echo "" -DECISIVE=$((CORRECT + INCORRECT)) -if [ "$DECISIVE" -gt 0 ]; then - PCT=$((CORRECT * 100 / DECISIVE)) - echo "Accuracy (decisive): $CORRECT / $DECISIVE ($PCT%)" -else - echo "Accuracy: N/A (no decisive results)" -fi -echo "" - -# Print INCORRECT verdicts for review -if [ "$INCORRECT" -gt 0 ]; then - echo "============================================================" - echo "⚠️ INCORRECT VERDICTS (need review):" - echo "============================================================" - grep "INCORRECT" "$VERIFY_CSV" -fi - -# Summary by result type -echo "" -echo "============================================================" -echo "BREAKDOWN BY RESULT TYPE" -echo "============================================================" -echo "--- CORRECT ---" -grep "CORRECT" "$VERIFY_CSV" | grep -v "INCORRECT" | cut -d, -f4 | sort | uniq -c | sort -rn -echo "" -echo "--- INCORRECT ---" -grep "INCORRECT" "$VERIFY_CSV" | cut -d, -f4 | sort | uniq -c | sort -rn 2>/dev/null || echo " (none)" -echo "" -echo "Verdict CSV saved to: $VERIFY_CSV" diff --git a/tests/castle/CASTLE-Benchmark b/tests/castle/CASTLE-Benchmark new file mode 160000 index 000000000..231bc3eb3 --- /dev/null +++ b/tests/castle/CASTLE-Benchmark @@ -0,0 +1 @@ +Subproject commit 231bc3eb3e9e117278327a250915e3c6b470cbdf diff --git a/tests/castle/benchexec/generate_benchexec.py b/tests/castle/benchexec/generate_benchexec.py new file mode 100644 index 000000000..0362c2144 --- /dev/null +++ b/tests/castle/benchexec/generate_benchexec.py @@ -0,0 +1,163 @@ +#!/usr/bin/env python3 +"""Generate BenchExec YML task files, SET files, and XML for CASTLE C250.""" + +import json +import os + +SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) +JSON_PATH = os.path.join(SCRIPT_DIR, "..", "CASTLE-Benchmark", "datasets", "CASTLE-C250.min.json") +TASKS_DIR = os.path.join(SCRIPT_DIR, "tasks") +SETS_DIR = os.path.join(SCRIPT_DIR, "sets") +PROPS_DIR = os.path.join(SCRIPT_DIR, "properties") +XML_PATH = os.path.join(SCRIPT_DIR, "map2check_castle.xml") + +CWE_PROPERTY = { + 125: "valid-memsafety.prp", + 134: "unreach-call.prp", + 190: "no-overflow.prp", + 253: "unreach-call.prp", + 327: "unreach-call.prp", + 362: "unreach-call.prp", + 369: "unreach-call.prp", + 401: "valid-memcleanup.prp", + 415: "valid-memsafety.prp", + 416: "valid-memsafety.prp", + 476: "valid-memsafety.prp", + 522: "unreach-call.prp", + 617: "unreach-call.prp", + 628: "unreach-call.prp", + 674: "unreach-call.prp", + 761: "valid-memsafety.prp", + 770: "unreach-call.prp", + 787: "valid-memsafety.prp", + 798: "unreach-call.prp", + 822: "valid-memsafety.prp", + 835: "unreach-call.prp", + 843: "valid-memsafety.prp", + 22: "unreach-call.prp", + 78: "unreach-call.prp", + 89: "unreach-call.prp", +} + +SET_GROUPS = { + "castle-memsafety": [ + 125, 415, 416, 476, 761, 787, 822, 843, + ], + "castle-overflow": [190], + "castle-memcleanup": [401], + "castle-reachability": [ + 134, 253, 362, 369, 617, 628, 674, 770, 835, + 22, 78, 89, 327, 522, 798, + ], +} + +# Load JSON +with open(JSON_PATH) as f: + data = json.load(f) + +tests = data["tests"] +print(f"Loaded {len(tests)} tests from CASTLE-C250.min.json") + +# Clear and recreate task directories +for d in [TASKS_DIR, SETS_DIR]: + os.makedirs(d, exist_ok=True) + for fname in os.listdir(d): + os.remove(os.path.join(d, fname)) + +# CWE → list of test names (for set grouping) +cwe_tests = {cwe: [] for cwe in CWE_PROPERTY} + +# Generate YML and SET file content +yml_count = 0 +for t in tests: + name = t["name"] + cwe = t["cwe"] + vulnerable = t["vulnerable"] + test_id = t["id"] + + if cwe not in CWE_PROPERTY: + cwe = 843 # fallback to memsafety + print(f" WARNING: unknown CWE {t['cwe']} for {name}, using CWE-843") + + prop_file = CWE_PROPERTY[cwe] + expected_verdict = "false" if vulnerable else "true" + + # Path to C file relative to tasks/ directory + c_file_rel = f"../../CASTLE-Benchmark/datasets/CASTLE-C250/{name}" + + yml_content = f"""format_version: '2.0' +input_files: '{c_file_rel}' + +properties: + - property_file: ../properties/{prop_file} + expected_verdict: {expected_verdict} +""" + + yml_path = os.path.join(TASKS_DIR, f"CASTLE-{test_id}.yml") + with open(yml_path, "w") as f: + f.write(yml_content) + yml_count += 1 + cwe_tests[cwe].append(f"CASTLE-{test_id}") + +print(f"Generated {yml_count} YML task files") + +# Generate SET files grouped by verification mode +set_count = 0 +for set_name, cwe_list in SET_GROUPS.items(): + lines = [] + for cwe in cwe_list: + for task_file in cwe_tests.get(cwe, []): + lines.append(f"../tasks/{task_file}.yml") + + set_path = os.path.join(SETS_DIR, f"{set_name}.set") + with open(set_path, "w") as f: + f.write("\n".join(lines) + "\n") + set_count += 1 + print(f" {set_name}.set: {len(lines)} tasks") + +print(f"Generated {set_count} SET files") + +# Map2Check wrapper dir (relative to CASTLE dir inside Docker volume) +# The user mounts the whole repo at e.g. /home/bench/benchexec_files/ +# Map2Check binary is in release/ (the CWD when BenchExec runs) + +# Generate BenchExec XML +xml_parts = [ + '', + '', + '', + "", + ' ', + "", +] + +BENCHEXEC_BASE = "/home/bench/benchexec_files/tests/castle/benchexec" + +for set_name in ["castle-memsafety", "castle-overflow", "castle-memcleanup", "castle-reachability"]: + prop_file_map = { + "castle-memsafety": "valid-memsafety.prp", + "castle-overflow": "no-overflow.prp", + "castle-memcleanup": "valid-memcleanup.prp", + "castle-reachability": "unreach-call.prp", + } + prop_file = prop_file_map[set_name] + display_name = set_name.replace("castle-", "CASTLE-") + + xml_parts.append(f' ') + xml_parts.append(f' {BENCHEXEC_BASE}/sets/{set_name}.set') + xml_parts.append(f' {BENCHEXEC_BASE}/properties/{prop_file}') + xml_parts.append(" ") + xml_parts.append("") + +xml_parts.append("") + +with open(XML_PATH, "w") as f: + f.write("\n".join(xml_parts)) + +print(f"\nBenchExec XML written to {XML_PATH}") +print(f"\nTo run:") +print(f" cd Map2Check") +print(f" docker run -it --rm -v /sys/fs/cgroup:/sys/fs/cgroup:rw \\") +print(f" -v $(pwd):/home/bench/benchexec_files:Z hrocha/benchexec \\") +print(f' /bin/bash -c "cd release && python3 -m benchexec.benchexec --no-container ../tests/castle/benchexec/map2check_castle.xml"') diff --git a/tests/castle/benchexec/map2check_castle.xml b/tests/castle/benchexec/map2check_castle.xml new file mode 100644 index 000000000..7e0f0bb32 --- /dev/null +++ b/tests/castle/benchexec/map2check_castle.xml @@ -0,0 +1,28 @@ + + + + + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-memsafety.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/valid-memsafety.prp + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-overflow.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/no-overflow.prp + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-memcleanup.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/valid-memcleanup.prp + + + + /home/bench/benchexec_files/tests/castle/benchexec/sets/castle-reachability.set + /home/bench/benchexec_files/tests/castle/benchexec/properties/unreach-call.prp + + + \ No newline at end of file diff --git a/tests/castle/benchexec/properties/no-overflow.prp b/tests/castle/benchexec/properties/no-overflow.prp new file mode 120000 index 000000000..988a4e65b --- /dev/null +++ b/tests/castle/benchexec/properties/no-overflow.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/no-overflow.prp \ No newline at end of file diff --git a/tests/castle/benchexec/properties/unreach-call.prp b/tests/castle/benchexec/properties/unreach-call.prp new file mode 120000 index 000000000..660f202b7 --- /dev/null +++ b/tests/castle/benchexec/properties/unreach-call.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/unreach-call.prp \ No newline at end of file diff --git a/tests/castle/benchexec/properties/valid-memcleanup.prp b/tests/castle/benchexec/properties/valid-memcleanup.prp new file mode 120000 index 000000000..6fdfd3fc9 --- /dev/null +++ b/tests/castle/benchexec/properties/valid-memcleanup.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/valid-memcleanup.prp \ No newline at end of file diff --git a/tests/castle/benchexec/properties/valid-memsafety.prp b/tests/castle/benchexec/properties/valid-memsafety.prp new file mode 120000 index 000000000..08ca2076d --- /dev/null +++ b/tests/castle/benchexec/properties/valid-memsafety.prp @@ -0,0 +1 @@ +../../../regression_test/test_cases/sv-benchmarks/properties/valid-memsafety.prp \ No newline at end of file diff --git a/tests/castle/benchexec/sets/castle-memcleanup.set b/tests/castle/benchexec/sets/castle-memcleanup.set new file mode 100644 index 000000000..743f526e3 --- /dev/null +++ b/tests/castle/benchexec/sets/castle-memcleanup.set @@ -0,0 +1,10 @@ +../tasks/CASTLE-401-1.yml +../tasks/CASTLE-401-2.yml +../tasks/CASTLE-401-3.yml +../tasks/CASTLE-401-4.yml +../tasks/CASTLE-401-5.yml +../tasks/CASTLE-401-6.yml +../tasks/CASTLE-401-7.yml +../tasks/CASTLE-401-8.yml +../tasks/CASTLE-401-9.yml +../tasks/CASTLE-401-10.yml diff --git a/tests/castle/benchexec/sets/castle-memsafety.set b/tests/castle/benchexec/sets/castle-memsafety.set new file mode 100644 index 000000000..bce26ad60 --- /dev/null +++ b/tests/castle/benchexec/sets/castle-memsafety.set @@ -0,0 +1,80 @@ +../tasks/CASTLE-125-1.yml +../tasks/CASTLE-125-2.yml +../tasks/CASTLE-125-3.yml +../tasks/CASTLE-125-4.yml +../tasks/CASTLE-125-5.yml +../tasks/CASTLE-125-6.yml +../tasks/CASTLE-125-7.yml +../tasks/CASTLE-125-8.yml +../tasks/CASTLE-125-9.yml +../tasks/CASTLE-125-10.yml +../tasks/CASTLE-415-1.yml +../tasks/CASTLE-415-2.yml +../tasks/CASTLE-415-3.yml +../tasks/CASTLE-415-4.yml +../tasks/CASTLE-415-5.yml +../tasks/CASTLE-415-6.yml +../tasks/CASTLE-415-7.yml +../tasks/CASTLE-415-8.yml +../tasks/CASTLE-415-9.yml +../tasks/CASTLE-415-10.yml +../tasks/CASTLE-416-1.yml +../tasks/CASTLE-416-2.yml +../tasks/CASTLE-416-3.yml +../tasks/CASTLE-416-4.yml +../tasks/CASTLE-416-5.yml +../tasks/CASTLE-416-6.yml +../tasks/CASTLE-416-7.yml +../tasks/CASTLE-416-8.yml +../tasks/CASTLE-416-9.yml +../tasks/CASTLE-416-10.yml +../tasks/CASTLE-476-1.yml +../tasks/CASTLE-476-2.yml +../tasks/CASTLE-476-3.yml +../tasks/CASTLE-476-4.yml +../tasks/CASTLE-476-5.yml +../tasks/CASTLE-476-6.yml +../tasks/CASTLE-476-7.yml +../tasks/CASTLE-476-8.yml +../tasks/CASTLE-476-9.yml +../tasks/CASTLE-476-10.yml +../tasks/CASTLE-761-1.yml +../tasks/CASTLE-761-2.yml +../tasks/CASTLE-761-3.yml +../tasks/CASTLE-761-4.yml +../tasks/CASTLE-761-5.yml +../tasks/CASTLE-761-6.yml +../tasks/CASTLE-761-7.yml +../tasks/CASTLE-761-8.yml +../tasks/CASTLE-761-9.yml +../tasks/CASTLE-761-10.yml +../tasks/CASTLE-787-1.yml +../tasks/CASTLE-787-2.yml +../tasks/CASTLE-787-3.yml +../tasks/CASTLE-787-4.yml +../tasks/CASTLE-787-5.yml +../tasks/CASTLE-787-6.yml +../tasks/CASTLE-787-7.yml +../tasks/CASTLE-787-8.yml +../tasks/CASTLE-787-9.yml +../tasks/CASTLE-787-10.yml +../tasks/CASTLE-822-1.yml +../tasks/CASTLE-822-2.yml +../tasks/CASTLE-822-3.yml +../tasks/CASTLE-822-4.yml +../tasks/CASTLE-822-5.yml +../tasks/CASTLE-822-6.yml +../tasks/CASTLE-822-7.yml +../tasks/CASTLE-822-8.yml +../tasks/CASTLE-822-9.yml +../tasks/CASTLE-822-10.yml +../tasks/CASTLE-843-1.yml +../tasks/CASTLE-843-2.yml +../tasks/CASTLE-843-3.yml +../tasks/CASTLE-843-4.yml +../tasks/CASTLE-843-5.yml +../tasks/CASTLE-843-6.yml +../tasks/CASTLE-843-7.yml +../tasks/CASTLE-843-8.yml +../tasks/CASTLE-843-9.yml +../tasks/CASTLE-843-10.yml diff --git a/tests/castle/benchexec/sets/castle-overflow.set b/tests/castle/benchexec/sets/castle-overflow.set new file mode 100644 index 000000000..9ff4e7bdc --- /dev/null +++ b/tests/castle/benchexec/sets/castle-overflow.set @@ -0,0 +1,10 @@ +../tasks/CASTLE-190-1.yml +../tasks/CASTLE-190-2.yml +../tasks/CASTLE-190-3.yml +../tasks/CASTLE-190-4.yml +../tasks/CASTLE-190-5.yml +../tasks/CASTLE-190-6.yml +../tasks/CASTLE-190-7.yml +../tasks/CASTLE-190-8.yml +../tasks/CASTLE-190-9.yml +../tasks/CASTLE-190-10.yml diff --git a/tests/castle/benchexec/sets/castle-reachability.set b/tests/castle/benchexec/sets/castle-reachability.set new file mode 100644 index 000000000..ff043a3a3 --- /dev/null +++ b/tests/castle/benchexec/sets/castle-reachability.set @@ -0,0 +1,150 @@ +../tasks/CASTLE-134-1.yml +../tasks/CASTLE-134-2.yml +../tasks/CASTLE-134-3.yml +../tasks/CASTLE-134-4.yml +../tasks/CASTLE-134-5.yml +../tasks/CASTLE-134-6.yml +../tasks/CASTLE-134-7.yml +../tasks/CASTLE-134-8.yml +../tasks/CASTLE-134-9.yml +../tasks/CASTLE-134-10.yml +../tasks/CASTLE-253-1.yml +../tasks/CASTLE-253-2.yml +../tasks/CASTLE-253-3.yml +../tasks/CASTLE-253-4.yml +../tasks/CASTLE-253-5.yml +../tasks/CASTLE-253-6.yml +../tasks/CASTLE-253-7.yml +../tasks/CASTLE-253-8.yml +../tasks/CASTLE-253-9.yml +../tasks/CASTLE-253-10.yml +../tasks/CASTLE-362-1.yml +../tasks/CASTLE-362-2.yml +../tasks/CASTLE-362-3.yml +../tasks/CASTLE-362-4.yml +../tasks/CASTLE-362-5.yml +../tasks/CASTLE-362-6.yml +../tasks/CASTLE-362-7.yml +../tasks/CASTLE-362-8.yml +../tasks/CASTLE-362-9.yml +../tasks/CASTLE-362-10.yml +../tasks/CASTLE-369-1.yml +../tasks/CASTLE-369-2.yml +../tasks/CASTLE-369-3.yml +../tasks/CASTLE-369-4.yml +../tasks/CASTLE-369-5.yml +../tasks/CASTLE-369-6.yml +../tasks/CASTLE-369-7.yml +../tasks/CASTLE-369-8.yml +../tasks/CASTLE-369-9.yml +../tasks/CASTLE-369-10.yml +../tasks/CASTLE-617-1.yml +../tasks/CASTLE-617-2.yml +../tasks/CASTLE-617-3.yml +../tasks/CASTLE-617-4.yml +../tasks/CASTLE-617-5.yml +../tasks/CASTLE-617-6.yml +../tasks/CASTLE-617-7.yml +../tasks/CASTLE-617-8.yml +../tasks/CASTLE-617-9.yml +../tasks/CASTLE-617-10.yml +../tasks/CASTLE-628-1.yml +../tasks/CASTLE-628-2.yml +../tasks/CASTLE-628-3.yml +../tasks/CASTLE-628-4.yml +../tasks/CASTLE-628-5.yml +../tasks/CASTLE-628-6.yml +../tasks/CASTLE-628-7.yml +../tasks/CASTLE-628-8.yml +../tasks/CASTLE-628-9.yml +../tasks/CASTLE-628-10.yml +../tasks/CASTLE-674-1.yml +../tasks/CASTLE-674-2.yml +../tasks/CASTLE-674-3.yml +../tasks/CASTLE-674-4.yml +../tasks/CASTLE-674-5.yml +../tasks/CASTLE-674-6.yml +../tasks/CASTLE-674-7.yml +../tasks/CASTLE-674-8.yml +../tasks/CASTLE-674-9.yml +../tasks/CASTLE-674-10.yml +../tasks/CASTLE-770-1.yml +../tasks/CASTLE-770-2.yml +../tasks/CASTLE-770-3.yml +../tasks/CASTLE-770-4.yml +../tasks/CASTLE-770-5.yml +../tasks/CASTLE-770-6.yml +../tasks/CASTLE-770-7.yml +../tasks/CASTLE-770-8.yml +../tasks/CASTLE-770-9.yml +../tasks/CASTLE-770-10.yml +../tasks/CASTLE-835-1.yml +../tasks/CASTLE-835-2.yml +../tasks/CASTLE-835-3.yml +../tasks/CASTLE-835-4.yml +../tasks/CASTLE-835-5.yml +../tasks/CASTLE-835-6.yml +../tasks/CASTLE-835-7.yml +../tasks/CASTLE-835-8.yml +../tasks/CASTLE-835-9.yml +../tasks/CASTLE-835-10.yml +../tasks/CASTLE-22-1.yml +../tasks/CASTLE-22-2.yml +../tasks/CASTLE-22-3.yml +../tasks/CASTLE-22-4.yml +../tasks/CASTLE-22-5.yml +../tasks/CASTLE-22-6.yml +../tasks/CASTLE-22-7.yml +../tasks/CASTLE-22-8.yml +../tasks/CASTLE-22-9.yml +../tasks/CASTLE-22-10.yml +../tasks/CASTLE-78-1.yml +../tasks/CASTLE-78-2.yml +../tasks/CASTLE-78-3.yml +../tasks/CASTLE-78-4.yml +../tasks/CASTLE-78-5.yml +../tasks/CASTLE-78-6.yml +../tasks/CASTLE-78-7.yml +../tasks/CASTLE-78-8.yml +../tasks/CASTLE-78-9.yml +../tasks/CASTLE-78-10.yml +../tasks/CASTLE-89-1.yml +../tasks/CASTLE-89-2.yml +../tasks/CASTLE-89-3.yml +../tasks/CASTLE-89-4.yml +../tasks/CASTLE-89-5.yml +../tasks/CASTLE-89-6.yml +../tasks/CASTLE-89-7.yml +../tasks/CASTLE-89-8.yml +../tasks/CASTLE-89-9.yml +../tasks/CASTLE-89-10.yml +../tasks/CASTLE-327-1.yml +../tasks/CASTLE-327-2.yml +../tasks/CASTLE-327-3.yml +../tasks/CASTLE-327-4.yml +../tasks/CASTLE-327-5.yml +../tasks/CASTLE-327-6.yml +../tasks/CASTLE-327-7.yml +../tasks/CASTLE-327-8.yml +../tasks/CASTLE-327-9.yml +../tasks/CASTLE-327-10.yml +../tasks/CASTLE-522-1.yml +../tasks/CASTLE-522-2.yml +../tasks/CASTLE-522-3.yml +../tasks/CASTLE-522-4.yml +../tasks/CASTLE-522-5.yml +../tasks/CASTLE-522-6.yml +../tasks/CASTLE-522-7.yml +../tasks/CASTLE-522-8.yml +../tasks/CASTLE-522-9.yml +../tasks/CASTLE-522-10.yml +../tasks/CASTLE-798-1.yml +../tasks/CASTLE-798-2.yml +../tasks/CASTLE-798-3.yml +../tasks/CASTLE-798-4.yml +../tasks/CASTLE-798-5.yml +../tasks/CASTLE-798-6.yml +../tasks/CASTLE-798-7.yml +../tasks/CASTLE-798-8.yml +../tasks/CASTLE-798-9.yml +../tasks/CASTLE-798-10.yml diff --git a/tests/castle/benchexec/tasks/CASTLE-125-1.yml b/tests/castle/benchexec/tasks/CASTLE-125-1.yml new file mode 100644 index 000000000..d0f2522e3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-10.yml b/tests/castle/benchexec/tasks/CASTLE-125-10.yml new file mode 100644 index 000000000..e86112517 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-125-2.yml b/tests/castle/benchexec/tasks/CASTLE-125-2.yml new file mode 100644 index 000000000..e0e84ac99 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-3.yml b/tests/castle/benchexec/tasks/CASTLE-125-3.yml new file mode 100644 index 000000000..b03599a85 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-4.yml b/tests/castle/benchexec/tasks/CASTLE-125-4.yml new file mode 100644 index 000000000..96e94d201 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-5.yml b/tests/castle/benchexec/tasks/CASTLE-125-5.yml new file mode 100644 index 000000000..1c53e6308 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-6.yml b/tests/castle/benchexec/tasks/CASTLE-125-6.yml new file mode 100644 index 000000000..3d91486ac --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-125-7.yml b/tests/castle/benchexec/tasks/CASTLE-125-7.yml new file mode 100644 index 000000000..eebc8d953 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-125-8.yml b/tests/castle/benchexec/tasks/CASTLE-125-8.yml new file mode 100644 index 000000000..50fcf6844 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-125-9.yml b/tests/castle/benchexec/tasks/CASTLE-125-9.yml new file mode 100644 index 000000000..834746644 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-125-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-125-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-1.yml b/tests/castle/benchexec/tasks/CASTLE-134-1.yml new file mode 100644 index 000000000..74b36cddd --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-10.yml b/tests/castle/benchexec/tasks/CASTLE-134-10.yml new file mode 100644 index 000000000..e55812193 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-2.yml b/tests/castle/benchexec/tasks/CASTLE-134-2.yml new file mode 100644 index 000000000..5b4d45d15 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-3.yml b/tests/castle/benchexec/tasks/CASTLE-134-3.yml new file mode 100644 index 000000000..a559fe764 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-4.yml b/tests/castle/benchexec/tasks/CASTLE-134-4.yml new file mode 100644 index 000000000..d2b2cdf34 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-5.yml b/tests/castle/benchexec/tasks/CASTLE-134-5.yml new file mode 100644 index 000000000..f23e07967 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-6.yml b/tests/castle/benchexec/tasks/CASTLE-134-6.yml new file mode 100644 index 000000000..aff002f6d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-134-7.yml b/tests/castle/benchexec/tasks/CASTLE-134-7.yml new file mode 100644 index 000000000..8111d96da --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-8.yml b/tests/castle/benchexec/tasks/CASTLE-134-8.yml new file mode 100644 index 000000000..b9575e882 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-134-9.yml b/tests/castle/benchexec/tasks/CASTLE-134-9.yml new file mode 100644 index 000000000..0ca0c077e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-134-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-134-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-1.yml b/tests/castle/benchexec/tasks/CASTLE-190-1.yml new file mode 100644 index 000000000..96296c20a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-1.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-10.yml b/tests/castle/benchexec/tasks/CASTLE-190-10.yml new file mode 100644 index 000000000..def751944 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-10.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-2.yml b/tests/castle/benchexec/tasks/CASTLE-190-2.yml new file mode 100644 index 000000000..70cd842da --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-2.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-3.yml b/tests/castle/benchexec/tasks/CASTLE-190-3.yml new file mode 100644 index 000000000..868ef5a9b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-3.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-4.yml b/tests/castle/benchexec/tasks/CASTLE-190-4.yml new file mode 100644 index 000000000..c607786d5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-4.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-5.yml b/tests/castle/benchexec/tasks/CASTLE-190-5.yml new file mode 100644 index 000000000..293ead85a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-5.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-6.yml b/tests/castle/benchexec/tasks/CASTLE-190-6.yml new file mode 100644 index 000000000..a3de4b735 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-6.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-190-7.yml b/tests/castle/benchexec/tasks/CASTLE-190-7.yml new file mode 100644 index 000000000..0b7a86ec0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-7.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-8.yml b/tests/castle/benchexec/tasks/CASTLE-190-8.yml new file mode 100644 index 000000000..49fe2eeb2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-8.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-190-9.yml b/tests/castle/benchexec/tasks/CASTLE-190-9.yml new file mode 100644 index 000000000..20a7a7fe8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-190-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-190-9.c' + +properties: + - property_file: ../properties/no-overflow.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-1.yml b/tests/castle/benchexec/tasks/CASTLE-22-1.yml new file mode 100644 index 000000000..e224a915e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-10.yml b/tests/castle/benchexec/tasks/CASTLE-22-10.yml new file mode 100644 index 000000000..7f143ee3d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-2.yml b/tests/castle/benchexec/tasks/CASTLE-22-2.yml new file mode 100644 index 000000000..628e77dae --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-3.yml b/tests/castle/benchexec/tasks/CASTLE-22-3.yml new file mode 100644 index 000000000..2c6177e34 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-4.yml b/tests/castle/benchexec/tasks/CASTLE-22-4.yml new file mode 100644 index 000000000..346d89e21 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-5.yml b/tests/castle/benchexec/tasks/CASTLE-22-5.yml new file mode 100644 index 000000000..7ce5c89b5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-6.yml b/tests/castle/benchexec/tasks/CASTLE-22-6.yml new file mode 100644 index 000000000..697f351fa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-22-7.yml b/tests/castle/benchexec/tasks/CASTLE-22-7.yml new file mode 100644 index 000000000..900f4a642 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-8.yml b/tests/castle/benchexec/tasks/CASTLE-22-8.yml new file mode 100644 index 000000000..25ea047af --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-22-9.yml b/tests/castle/benchexec/tasks/CASTLE-22-9.yml new file mode 100644 index 000000000..5258ab26e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-22-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-22-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-1.yml b/tests/castle/benchexec/tasks/CASTLE-253-1.yml new file mode 100644 index 000000000..fe42b627e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-10.yml b/tests/castle/benchexec/tasks/CASTLE-253-10.yml new file mode 100644 index 000000000..fccf13882 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-2.yml b/tests/castle/benchexec/tasks/CASTLE-253-2.yml new file mode 100644 index 000000000..090b93ac8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-3.yml b/tests/castle/benchexec/tasks/CASTLE-253-3.yml new file mode 100644 index 000000000..10e8be43b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-4.yml b/tests/castle/benchexec/tasks/CASTLE-253-4.yml new file mode 100644 index 000000000..6f728c1f3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-5.yml b/tests/castle/benchexec/tasks/CASTLE-253-5.yml new file mode 100644 index 000000000..a14433deb --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-6.yml b/tests/castle/benchexec/tasks/CASTLE-253-6.yml new file mode 100644 index 000000000..92818bfda --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-253-7.yml b/tests/castle/benchexec/tasks/CASTLE-253-7.yml new file mode 100644 index 000000000..7cdf6929a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-8.yml b/tests/castle/benchexec/tasks/CASTLE-253-8.yml new file mode 100644 index 000000000..976da4c75 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-253-9.yml b/tests/castle/benchexec/tasks/CASTLE-253-9.yml new file mode 100644 index 000000000..07c25b818 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-253-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-253-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-1.yml b/tests/castle/benchexec/tasks/CASTLE-327-1.yml new file mode 100644 index 000000000..f84403cf2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-10.yml b/tests/castle/benchexec/tasks/CASTLE-327-10.yml new file mode 100644 index 000000000..8147fbbec --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-2.yml b/tests/castle/benchexec/tasks/CASTLE-327-2.yml new file mode 100644 index 000000000..79d731914 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-3.yml b/tests/castle/benchexec/tasks/CASTLE-327-3.yml new file mode 100644 index 000000000..14f846c1d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-4.yml b/tests/castle/benchexec/tasks/CASTLE-327-4.yml new file mode 100644 index 000000000..76b9f419d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-5.yml b/tests/castle/benchexec/tasks/CASTLE-327-5.yml new file mode 100644 index 000000000..d9c285a12 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-6.yml b/tests/castle/benchexec/tasks/CASTLE-327-6.yml new file mode 100644 index 000000000..3e5b1b167 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-327-7.yml b/tests/castle/benchexec/tasks/CASTLE-327-7.yml new file mode 100644 index 000000000..a8016237c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-8.yml b/tests/castle/benchexec/tasks/CASTLE-327-8.yml new file mode 100644 index 000000000..8f3726640 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-327-9.yml b/tests/castle/benchexec/tasks/CASTLE-327-9.yml new file mode 100644 index 000000000..10ca77d40 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-327-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-327-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-1.yml b/tests/castle/benchexec/tasks/CASTLE-362-1.yml new file mode 100644 index 000000000..64af2e91c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-10.yml b/tests/castle/benchexec/tasks/CASTLE-362-10.yml new file mode 100644 index 000000000..10565ce25 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-2.yml b/tests/castle/benchexec/tasks/CASTLE-362-2.yml new file mode 100644 index 000000000..e2078bc88 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-3.yml b/tests/castle/benchexec/tasks/CASTLE-362-3.yml new file mode 100644 index 000000000..b20f70525 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-4.yml b/tests/castle/benchexec/tasks/CASTLE-362-4.yml new file mode 100644 index 000000000..1e1dfbde2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-5.yml b/tests/castle/benchexec/tasks/CASTLE-362-5.yml new file mode 100644 index 000000000..2a963aecd --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-6.yml b/tests/castle/benchexec/tasks/CASTLE-362-6.yml new file mode 100644 index 000000000..f39f221e4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-362-7.yml b/tests/castle/benchexec/tasks/CASTLE-362-7.yml new file mode 100644 index 000000000..95928177c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-8.yml b/tests/castle/benchexec/tasks/CASTLE-362-8.yml new file mode 100644 index 000000000..658b75a15 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-362-9.yml b/tests/castle/benchexec/tasks/CASTLE-362-9.yml new file mode 100644 index 000000000..ce0032d18 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-362-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-362-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-1.yml b/tests/castle/benchexec/tasks/CASTLE-369-1.yml new file mode 100644 index 000000000..f7b4a77d6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-10.yml b/tests/castle/benchexec/tasks/CASTLE-369-10.yml new file mode 100644 index 000000000..e16c1827c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-2.yml b/tests/castle/benchexec/tasks/CASTLE-369-2.yml new file mode 100644 index 000000000..5698e90e1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-3.yml b/tests/castle/benchexec/tasks/CASTLE-369-3.yml new file mode 100644 index 000000000..e2b8a0cd4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-4.yml b/tests/castle/benchexec/tasks/CASTLE-369-4.yml new file mode 100644 index 000000000..68b742153 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-5.yml b/tests/castle/benchexec/tasks/CASTLE-369-5.yml new file mode 100644 index 000000000..4298d8f2c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-6.yml b/tests/castle/benchexec/tasks/CASTLE-369-6.yml new file mode 100644 index 000000000..129bd7822 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-369-7.yml b/tests/castle/benchexec/tasks/CASTLE-369-7.yml new file mode 100644 index 000000000..460ff4636 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-8.yml b/tests/castle/benchexec/tasks/CASTLE-369-8.yml new file mode 100644 index 000000000..20b8cc301 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-369-9.yml b/tests/castle/benchexec/tasks/CASTLE-369-9.yml new file mode 100644 index 000000000..7e59e5087 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-369-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-369-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-1.yml b/tests/castle/benchexec/tasks/CASTLE-401-1.yml new file mode 100644 index 000000000..7effbbaa9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-1.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-10.yml b/tests/castle/benchexec/tasks/CASTLE-401-10.yml new file mode 100644 index 000000000..a89655b03 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-10.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-2.yml b/tests/castle/benchexec/tasks/CASTLE-401-2.yml new file mode 100644 index 000000000..49d852aa8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-2.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-3.yml b/tests/castle/benchexec/tasks/CASTLE-401-3.yml new file mode 100644 index 000000000..d1cf54ebf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-3.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-4.yml b/tests/castle/benchexec/tasks/CASTLE-401-4.yml new file mode 100644 index 000000000..011ce4d84 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-4.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-5.yml b/tests/castle/benchexec/tasks/CASTLE-401-5.yml new file mode 100644 index 000000000..13f6080a5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-5.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-6.yml b/tests/castle/benchexec/tasks/CASTLE-401-6.yml new file mode 100644 index 000000000..ef265d663 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-6.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-401-7.yml b/tests/castle/benchexec/tasks/CASTLE-401-7.yml new file mode 100644 index 000000000..535c2b5ab --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-7.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-8.yml b/tests/castle/benchexec/tasks/CASTLE-401-8.yml new file mode 100644 index 000000000..fa06f285d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-8.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-401-9.yml b/tests/castle/benchexec/tasks/CASTLE-401-9.yml new file mode 100644 index 000000000..67ce01e22 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-401-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-401-9.c' + +properties: + - property_file: ../properties/valid-memcleanup.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-1.yml b/tests/castle/benchexec/tasks/CASTLE-415-1.yml new file mode 100644 index 000000000..add2267fb --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-10.yml b/tests/castle/benchexec/tasks/CASTLE-415-10.yml new file mode 100644 index 000000000..4f685705f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-2.yml b/tests/castle/benchexec/tasks/CASTLE-415-2.yml new file mode 100644 index 000000000..73d257a3b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-3.yml b/tests/castle/benchexec/tasks/CASTLE-415-3.yml new file mode 100644 index 000000000..ba4be573e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-4.yml b/tests/castle/benchexec/tasks/CASTLE-415-4.yml new file mode 100644 index 000000000..9177f0f1f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-5.yml b/tests/castle/benchexec/tasks/CASTLE-415-5.yml new file mode 100644 index 000000000..dc4991315 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-6.yml b/tests/castle/benchexec/tasks/CASTLE-415-6.yml new file mode 100644 index 000000000..4a7fedd6b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-415-7.yml b/tests/castle/benchexec/tasks/CASTLE-415-7.yml new file mode 100644 index 000000000..5a25d4985 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-8.yml b/tests/castle/benchexec/tasks/CASTLE-415-8.yml new file mode 100644 index 000000000..50aeebb48 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-415-9.yml b/tests/castle/benchexec/tasks/CASTLE-415-9.yml new file mode 100644 index 000000000..8566cc7b3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-415-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-415-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-1.yml b/tests/castle/benchexec/tasks/CASTLE-416-1.yml new file mode 100644 index 000000000..3e1cbe1b6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-10.yml b/tests/castle/benchexec/tasks/CASTLE-416-10.yml new file mode 100644 index 000000000..fe31f31f5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-2.yml b/tests/castle/benchexec/tasks/CASTLE-416-2.yml new file mode 100644 index 000000000..aa770b2a0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-3.yml b/tests/castle/benchexec/tasks/CASTLE-416-3.yml new file mode 100644 index 000000000..3c764e6f0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-4.yml b/tests/castle/benchexec/tasks/CASTLE-416-4.yml new file mode 100644 index 000000000..0f0b6c984 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-5.yml b/tests/castle/benchexec/tasks/CASTLE-416-5.yml new file mode 100644 index 000000000..d0bba96a6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-6.yml b/tests/castle/benchexec/tasks/CASTLE-416-6.yml new file mode 100644 index 000000000..878e780aa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-416-7.yml b/tests/castle/benchexec/tasks/CASTLE-416-7.yml new file mode 100644 index 000000000..81733931d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-8.yml b/tests/castle/benchexec/tasks/CASTLE-416-8.yml new file mode 100644 index 000000000..0de683abf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-416-9.yml b/tests/castle/benchexec/tasks/CASTLE-416-9.yml new file mode 100644 index 000000000..fc6e71c18 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-416-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-416-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-1.yml b/tests/castle/benchexec/tasks/CASTLE-476-1.yml new file mode 100644 index 000000000..5981c0f04 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-10.yml b/tests/castle/benchexec/tasks/CASTLE-476-10.yml new file mode 100644 index 000000000..09bbce668 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-2.yml b/tests/castle/benchexec/tasks/CASTLE-476-2.yml new file mode 100644 index 000000000..e7703d0d1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-3.yml b/tests/castle/benchexec/tasks/CASTLE-476-3.yml new file mode 100644 index 000000000..b98c094d5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-4.yml b/tests/castle/benchexec/tasks/CASTLE-476-4.yml new file mode 100644 index 000000000..f7f8d8744 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-5.yml b/tests/castle/benchexec/tasks/CASTLE-476-5.yml new file mode 100644 index 000000000..5236f5a70 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-6.yml b/tests/castle/benchexec/tasks/CASTLE-476-6.yml new file mode 100644 index 000000000..50cb213b8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-476-7.yml b/tests/castle/benchexec/tasks/CASTLE-476-7.yml new file mode 100644 index 000000000..f6c2b9ec9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-8.yml b/tests/castle/benchexec/tasks/CASTLE-476-8.yml new file mode 100644 index 000000000..95b747ace --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-476-9.yml b/tests/castle/benchexec/tasks/CASTLE-476-9.yml new file mode 100644 index 000000000..3a807aa19 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-476-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-476-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-1.yml b/tests/castle/benchexec/tasks/CASTLE-522-1.yml new file mode 100644 index 000000000..d2a48e3b5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-10.yml b/tests/castle/benchexec/tasks/CASTLE-522-10.yml new file mode 100644 index 000000000..fecaa76db --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-2.yml b/tests/castle/benchexec/tasks/CASTLE-522-2.yml new file mode 100644 index 000000000..ee30c5890 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-3.yml b/tests/castle/benchexec/tasks/CASTLE-522-3.yml new file mode 100644 index 000000000..867f77edf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-4.yml b/tests/castle/benchexec/tasks/CASTLE-522-4.yml new file mode 100644 index 000000000..580199139 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-5.yml b/tests/castle/benchexec/tasks/CASTLE-522-5.yml new file mode 100644 index 000000000..d9681c782 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-6.yml b/tests/castle/benchexec/tasks/CASTLE-522-6.yml new file mode 100644 index 000000000..c690769a5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-522-7.yml b/tests/castle/benchexec/tasks/CASTLE-522-7.yml new file mode 100644 index 000000000..ff1a0782b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-8.yml b/tests/castle/benchexec/tasks/CASTLE-522-8.yml new file mode 100644 index 000000000..d5e08d717 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-522-9.yml b/tests/castle/benchexec/tasks/CASTLE-522-9.yml new file mode 100644 index 000000000..7428db824 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-522-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-522-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-1.yml b/tests/castle/benchexec/tasks/CASTLE-617-1.yml new file mode 100644 index 000000000..9d8102c4d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-10.yml b/tests/castle/benchexec/tasks/CASTLE-617-10.yml new file mode 100644 index 000000000..1393ad4f6 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-2.yml b/tests/castle/benchexec/tasks/CASTLE-617-2.yml new file mode 100644 index 000000000..19ba973ab --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-3.yml b/tests/castle/benchexec/tasks/CASTLE-617-3.yml new file mode 100644 index 000000000..58cd59ef7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-4.yml b/tests/castle/benchexec/tasks/CASTLE-617-4.yml new file mode 100644 index 000000000..32bf344fc --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-5.yml b/tests/castle/benchexec/tasks/CASTLE-617-5.yml new file mode 100644 index 000000000..dbdd0d15e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-6.yml b/tests/castle/benchexec/tasks/CASTLE-617-6.yml new file mode 100644 index 000000000..2d98bb44b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-617-7.yml b/tests/castle/benchexec/tasks/CASTLE-617-7.yml new file mode 100644 index 000000000..b4712fea1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-8.yml b/tests/castle/benchexec/tasks/CASTLE-617-8.yml new file mode 100644 index 000000000..e7518087d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-617-9.yml b/tests/castle/benchexec/tasks/CASTLE-617-9.yml new file mode 100644 index 000000000..7059b8785 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-617-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-617-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-1.yml b/tests/castle/benchexec/tasks/CASTLE-628-1.yml new file mode 100644 index 000000000..221235f77 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-10.yml b/tests/castle/benchexec/tasks/CASTLE-628-10.yml new file mode 100644 index 000000000..87b23f3e8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-2.yml b/tests/castle/benchexec/tasks/CASTLE-628-2.yml new file mode 100644 index 000000000..21ff80ef5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-3.yml b/tests/castle/benchexec/tasks/CASTLE-628-3.yml new file mode 100644 index 000000000..6920540c7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-4.yml b/tests/castle/benchexec/tasks/CASTLE-628-4.yml new file mode 100644 index 000000000..2254cd8e4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-5.yml b/tests/castle/benchexec/tasks/CASTLE-628-5.yml new file mode 100644 index 000000000..ecadc408e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-6.yml b/tests/castle/benchexec/tasks/CASTLE-628-6.yml new file mode 100644 index 000000000..376a1ae9e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-628-7.yml b/tests/castle/benchexec/tasks/CASTLE-628-7.yml new file mode 100644 index 000000000..6aa514d66 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-8.yml b/tests/castle/benchexec/tasks/CASTLE-628-8.yml new file mode 100644 index 000000000..0911bcbd2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-628-9.yml b/tests/castle/benchexec/tasks/CASTLE-628-9.yml new file mode 100644 index 000000000..7e7e8a147 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-628-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-628-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-1.yml b/tests/castle/benchexec/tasks/CASTLE-674-1.yml new file mode 100644 index 000000000..7d94cf227 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-10.yml b/tests/castle/benchexec/tasks/CASTLE-674-10.yml new file mode 100644 index 000000000..82ba1fad7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-2.yml b/tests/castle/benchexec/tasks/CASTLE-674-2.yml new file mode 100644 index 000000000..0eb330955 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-3.yml b/tests/castle/benchexec/tasks/CASTLE-674-3.yml new file mode 100644 index 000000000..47ae35f98 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-4.yml b/tests/castle/benchexec/tasks/CASTLE-674-4.yml new file mode 100644 index 000000000..884760243 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-5.yml b/tests/castle/benchexec/tasks/CASTLE-674-5.yml new file mode 100644 index 000000000..851a371d8 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-6.yml b/tests/castle/benchexec/tasks/CASTLE-674-6.yml new file mode 100644 index 000000000..ddb114086 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-674-7.yml b/tests/castle/benchexec/tasks/CASTLE-674-7.yml new file mode 100644 index 000000000..f8173313c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-8.yml b/tests/castle/benchexec/tasks/CASTLE-674-8.yml new file mode 100644 index 000000000..516b13bf9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-674-9.yml b/tests/castle/benchexec/tasks/CASTLE-674-9.yml new file mode 100644 index 000000000..b3424b3d9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-674-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-674-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-1.yml b/tests/castle/benchexec/tasks/CASTLE-761-1.yml new file mode 100644 index 000000000..98ea94cf9 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-10.yml b/tests/castle/benchexec/tasks/CASTLE-761-10.yml new file mode 100644 index 000000000..fc1f5754a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-2.yml b/tests/castle/benchexec/tasks/CASTLE-761-2.yml new file mode 100644 index 000000000..5b27b25fc --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-3.yml b/tests/castle/benchexec/tasks/CASTLE-761-3.yml new file mode 100644 index 000000000..21a0cd87a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-4.yml b/tests/castle/benchexec/tasks/CASTLE-761-4.yml new file mode 100644 index 000000000..b29289309 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-5.yml b/tests/castle/benchexec/tasks/CASTLE-761-5.yml new file mode 100644 index 000000000..cbc41115a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-6.yml b/tests/castle/benchexec/tasks/CASTLE-761-6.yml new file mode 100644 index 000000000..ea694d049 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-761-7.yml b/tests/castle/benchexec/tasks/CASTLE-761-7.yml new file mode 100644 index 000000000..dcec468ec --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-8.yml b/tests/castle/benchexec/tasks/CASTLE-761-8.yml new file mode 100644 index 000000000..0ae8f1e4d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-761-9.yml b/tests/castle/benchexec/tasks/CASTLE-761-9.yml new file mode 100644 index 000000000..facc290fa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-761-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-761-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-1.yml b/tests/castle/benchexec/tasks/CASTLE-770-1.yml new file mode 100644 index 000000000..577804e8a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-10.yml b/tests/castle/benchexec/tasks/CASTLE-770-10.yml new file mode 100644 index 000000000..a1be6c831 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-2.yml b/tests/castle/benchexec/tasks/CASTLE-770-2.yml new file mode 100644 index 000000000..a14ec7de0 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-3.yml b/tests/castle/benchexec/tasks/CASTLE-770-3.yml new file mode 100644 index 000000000..9ad86f11f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-4.yml b/tests/castle/benchexec/tasks/CASTLE-770-4.yml new file mode 100644 index 000000000..1ffaf78ee --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-5.yml b/tests/castle/benchexec/tasks/CASTLE-770-5.yml new file mode 100644 index 000000000..7eac49143 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-6.yml b/tests/castle/benchexec/tasks/CASTLE-770-6.yml new file mode 100644 index 000000000..de7b36f69 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-770-7.yml b/tests/castle/benchexec/tasks/CASTLE-770-7.yml new file mode 100644 index 000000000..acb678dce --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-8.yml b/tests/castle/benchexec/tasks/CASTLE-770-8.yml new file mode 100644 index 000000000..c8b37904f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-770-9.yml b/tests/castle/benchexec/tasks/CASTLE-770-9.yml new file mode 100644 index 000000000..1979268e5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-770-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-770-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-1.yml b/tests/castle/benchexec/tasks/CASTLE-78-1.yml new file mode 100644 index 000000000..0a32b575d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-10.yml b/tests/castle/benchexec/tasks/CASTLE-78-10.yml new file mode 100644 index 000000000..94f258181 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-2.yml b/tests/castle/benchexec/tasks/CASTLE-78-2.yml new file mode 100644 index 000000000..9bb259863 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-3.yml b/tests/castle/benchexec/tasks/CASTLE-78-3.yml new file mode 100644 index 000000000..a14422e94 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-4.yml b/tests/castle/benchexec/tasks/CASTLE-78-4.yml new file mode 100644 index 000000000..e5c895537 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-5.yml b/tests/castle/benchexec/tasks/CASTLE-78-5.yml new file mode 100644 index 000000000..4a074ecfa --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-6.yml b/tests/castle/benchexec/tasks/CASTLE-78-6.yml new file mode 100644 index 000000000..5e7f02900 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-78-7.yml b/tests/castle/benchexec/tasks/CASTLE-78-7.yml new file mode 100644 index 000000000..9670d7f66 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-8.yml b/tests/castle/benchexec/tasks/CASTLE-78-8.yml new file mode 100644 index 000000000..628625d21 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-78-9.yml b/tests/castle/benchexec/tasks/CASTLE-78-9.yml new file mode 100644 index 000000000..f0b386dc7 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-78-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-78-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-1.yml b/tests/castle/benchexec/tasks/CASTLE-787-1.yml new file mode 100644 index 000000000..11095bc12 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-10.yml b/tests/castle/benchexec/tasks/CASTLE-787-10.yml new file mode 100644 index 000000000..d88cd3c81 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-2.yml b/tests/castle/benchexec/tasks/CASTLE-787-2.yml new file mode 100644 index 000000000..e978deebf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-3.yml b/tests/castle/benchexec/tasks/CASTLE-787-3.yml new file mode 100644 index 000000000..026f34bfb --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-4.yml b/tests/castle/benchexec/tasks/CASTLE-787-4.yml new file mode 100644 index 000000000..a641ed0a1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-5.yml b/tests/castle/benchexec/tasks/CASTLE-787-5.yml new file mode 100644 index 000000000..fb93e31ef --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-6.yml b/tests/castle/benchexec/tasks/CASTLE-787-6.yml new file mode 100644 index 000000000..a2eaf794b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-787-7.yml b/tests/castle/benchexec/tasks/CASTLE-787-7.yml new file mode 100644 index 000000000..f0b98224b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-8.yml b/tests/castle/benchexec/tasks/CASTLE-787-8.yml new file mode 100644 index 000000000..c3251c174 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-787-9.yml b/tests/castle/benchexec/tasks/CASTLE-787-9.yml new file mode 100644 index 000000000..3c0b97457 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-787-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-787-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-1.yml b/tests/castle/benchexec/tasks/CASTLE-798-1.yml new file mode 100644 index 000000000..04c8619ea --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-10.yml b/tests/castle/benchexec/tasks/CASTLE-798-10.yml new file mode 100644 index 000000000..3d9d24f3c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-2.yml b/tests/castle/benchexec/tasks/CASTLE-798-2.yml new file mode 100644 index 000000000..22aed01f3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-3.yml b/tests/castle/benchexec/tasks/CASTLE-798-3.yml new file mode 100644 index 000000000..4fa2c3ddc --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-4.yml b/tests/castle/benchexec/tasks/CASTLE-798-4.yml new file mode 100644 index 000000000..0818da41f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-5.yml b/tests/castle/benchexec/tasks/CASTLE-798-5.yml new file mode 100644 index 000000000..9dd1e8188 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-6.yml b/tests/castle/benchexec/tasks/CASTLE-798-6.yml new file mode 100644 index 000000000..9c6ff0310 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-798-7.yml b/tests/castle/benchexec/tasks/CASTLE-798-7.yml new file mode 100644 index 000000000..c1b683629 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-8.yml b/tests/castle/benchexec/tasks/CASTLE-798-8.yml new file mode 100644 index 000000000..cae6e6f99 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-798-9.yml b/tests/castle/benchexec/tasks/CASTLE-798-9.yml new file mode 100644 index 000000000..2bc6042b3 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-798-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-798-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-1.yml b/tests/castle/benchexec/tasks/CASTLE-822-1.yml new file mode 100644 index 000000000..b53c965cf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-10.yml b/tests/castle/benchexec/tasks/CASTLE-822-10.yml new file mode 100644 index 000000000..152d01199 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-2.yml b/tests/castle/benchexec/tasks/CASTLE-822-2.yml new file mode 100644 index 000000000..84913217b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-3.yml b/tests/castle/benchexec/tasks/CASTLE-822-3.yml new file mode 100644 index 000000000..ab6ae6053 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-4.yml b/tests/castle/benchexec/tasks/CASTLE-822-4.yml new file mode 100644 index 000000000..d458cafe5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-5.yml b/tests/castle/benchexec/tasks/CASTLE-822-5.yml new file mode 100644 index 000000000..616250b6e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-6.yml b/tests/castle/benchexec/tasks/CASTLE-822-6.yml new file mode 100644 index 000000000..e746b5e54 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-822-7.yml b/tests/castle/benchexec/tasks/CASTLE-822-7.yml new file mode 100644 index 000000000..385fd184b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-8.yml b/tests/castle/benchexec/tasks/CASTLE-822-8.yml new file mode 100644 index 000000000..28eb6056e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-822-9.yml b/tests/castle/benchexec/tasks/CASTLE-822-9.yml new file mode 100644 index 000000000..1ec7eb78a --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-822-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-822-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-1.yml b/tests/castle/benchexec/tasks/CASTLE-835-1.yml new file mode 100644 index 000000000..efc952568 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-10.yml b/tests/castle/benchexec/tasks/CASTLE-835-10.yml new file mode 100644 index 000000000..24f2ea851 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-2.yml b/tests/castle/benchexec/tasks/CASTLE-835-2.yml new file mode 100644 index 000000000..e8d8b6103 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-3.yml b/tests/castle/benchexec/tasks/CASTLE-835-3.yml new file mode 100644 index 000000000..2c1384348 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-4.yml b/tests/castle/benchexec/tasks/CASTLE-835-4.yml new file mode 100644 index 000000000..f38eca310 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-5.yml b/tests/castle/benchexec/tasks/CASTLE-835-5.yml new file mode 100644 index 000000000..fceb02987 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-6.yml b/tests/castle/benchexec/tasks/CASTLE-835-6.yml new file mode 100644 index 000000000..48fb4be4d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-835-7.yml b/tests/castle/benchexec/tasks/CASTLE-835-7.yml new file mode 100644 index 000000000..c0f854c4f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-8.yml b/tests/castle/benchexec/tasks/CASTLE-835-8.yml new file mode 100644 index 000000000..b9d625339 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-835-9.yml b/tests/castle/benchexec/tasks/CASTLE-835-9.yml new file mode 100644 index 000000000..720f53c4f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-835-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-835-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-1.yml b/tests/castle/benchexec/tasks/CASTLE-843-1.yml new file mode 100644 index 000000000..d2f00662f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-1.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-10.yml b/tests/castle/benchexec/tasks/CASTLE-843-10.yml new file mode 100644 index 000000000..f9d7c2058 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-10.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-2.yml b/tests/castle/benchexec/tasks/CASTLE-843-2.yml new file mode 100644 index 000000000..83fead22c --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-2.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-3.yml b/tests/castle/benchexec/tasks/CASTLE-843-3.yml new file mode 100644 index 000000000..3751f035b --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-3.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-4.yml b/tests/castle/benchexec/tasks/CASTLE-843-4.yml new file mode 100644 index 000000000..a50f56bc1 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-4.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-5.yml b/tests/castle/benchexec/tasks/CASTLE-843-5.yml new file mode 100644 index 000000000..cc7ddcb40 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-5.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-6.yml b/tests/castle/benchexec/tasks/CASTLE-843-6.yml new file mode 100644 index 000000000..a5f55c930 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-6.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-843-7.yml b/tests/castle/benchexec/tasks/CASTLE-843-7.yml new file mode 100644 index 000000000..69d639e52 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-7.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-8.yml b/tests/castle/benchexec/tasks/CASTLE-843-8.yml new file mode 100644 index 000000000..4484acecf --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-8.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-843-9.yml b/tests/castle/benchexec/tasks/CASTLE-843-9.yml new file mode 100644 index 000000000..36d3b960f --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-843-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-843-9.c' + +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-1.yml b/tests/castle/benchexec/tasks/CASTLE-89-1.yml new file mode 100644 index 000000000..3e2de17cd --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-1.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-1.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-10.yml b/tests/castle/benchexec/tasks/CASTLE-89-10.yml new file mode 100644 index 000000000..cc912bb1e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-10.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-10.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-2.yml b/tests/castle/benchexec/tasks/CASTLE-89-2.yml new file mode 100644 index 000000000..46f7b2817 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-2.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-2.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-3.yml b/tests/castle/benchexec/tasks/CASTLE-89-3.yml new file mode 100644 index 000000000..db6e846a5 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-3.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-3.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-4.yml b/tests/castle/benchexec/tasks/CASTLE-89-4.yml new file mode 100644 index 000000000..92cf6abf2 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-4.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-4.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-5.yml b/tests/castle/benchexec/tasks/CASTLE-89-5.yml new file mode 100644 index 000000000..4272beac4 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-5.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-5.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-6.yml b/tests/castle/benchexec/tasks/CASTLE-89-6.yml new file mode 100644 index 000000000..774d89c76 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-6.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-6.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: false diff --git a/tests/castle/benchexec/tasks/CASTLE-89-7.yml b/tests/castle/benchexec/tasks/CASTLE-89-7.yml new file mode 100644 index 000000000..7799f249d --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-7.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-7.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-8.yml b/tests/castle/benchexec/tasks/CASTLE-89-8.yml new file mode 100644 index 000000000..efab56787 --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-8.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-8.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/benchexec/tasks/CASTLE-89-9.yml b/tests/castle/benchexec/tasks/CASTLE-89-9.yml new file mode 100644 index 000000000..c824d872e --- /dev/null +++ b/tests/castle/benchexec/tasks/CASTLE-89-9.yml @@ -0,0 +1,6 @@ +format_version: '2.0' +input_files: '../../CASTLE-Benchmark/datasets/CASTLE-C250/CASTLE-89-9.c' + +properties: + - property_file: ../properties/unreach-call.prp + expected_verdict: true diff --git a/tests/castle/run_castle_benchexec.sh b/tests/castle/run_castle_benchexec.sh new file mode 100755 index 000000000..634ba239b --- /dev/null +++ b/tests/castle/run_castle_benchexec.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# run_castle_benchexec.sh — CASTLE C250 via BenchExec inside map2check-dev Docker +set -e + +REPO="/home/guilherme/github/Map2Check" +LOG="$REPO/tests/castle/results/benchexec_run.log" +mkdir -p "$(dirname "$LOG")" + +echo "=== CASTLE BenchExec started: $(date) ===" | tee "$LOG" + +docker run --rm -u root \ + --privileged \ + -v "$REPO:/workspace" \ + -w /workspace \ + ghcr.io/hbgit/map2check-dev:latest bash -c ' + set -e + LOG=/workspace/tests/castle/results/benchexec_run.log + + echo "=== Install BenchExec: $(date)" | tee -a $LOG + pip3 install benchexec 2>&1 | tail -3 | tee -a $LOG + + echo "=== Build Map2Check: $(date)" | tee -a $LOG + rm -rf /workspace/build_be /workspace/release + mkdir -p /workspace/build_be && cd /workspace/build_be + cmake .. -G Ninja \ + -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DENABLE_TEST=ON \ + -DMAP2CHECK_DYNAMIC_LINK=ON \ + -DCMAKE_INSTALL_PREFIX=/workspace/release + ninja 2>&1 | tail -5 | tee -a $LOG + ninja install 2>&1 | tail -5 | tee -a $LOG + + # Map2Check binary is installed at release/map2check directly + cp /workspace/utils/map2check-wrapper.py /workspace/release/map2check-wrapper.py + + mkdir -p /workspace/release/lib/klee + ln -sf /opt/klee/lib/klee/runtime /workspace/release/lib/klee/runtime + ln -sf /usr/lib/llvm-16/lib/clang /workspace/release/lib/clang + + # Symlink Z3 for --smt-solver flag in wrapper + ln -sf /opt/klee/lib/libz3* /workspace/release/lib/ 2>/dev/null || true + + echo "=== Run BenchExec: $(date)" | tee -a $LOG + mkdir -p /workspace/release/results + + cd /workspace/release + python3 -m benchexec.benchexec --no-container \ + ../tests/castle/benchexec/map2check_castle.xml 2>&1 | tee -a $LOG + + echo "=== Completed: $(date)" | tee -a $LOG + ' 2>&1 | tee -a "$LOG" + +echo "=== CASTLE BenchExec finished: $(date) ===" | tee -a "$LOG" +echo "Results in: release/results/" +ls -la "$REPO/release/results/" diff --git a/tests/castle/run_castle_evaluation.sh b/tests/castle/run_castle_evaluation.sh new file mode 100755 index 000000000..82116596f --- /dev/null +++ b/tests/castle/run_castle_evaluation.sh @@ -0,0 +1,331 @@ +#!/bin/bash +# run_castle_evaluation.sh — Run all 250 CASTLE C250 benchmarks through Map2Check +# Two-pass strategy: direct, then --add-invariants fallback on UNKNOWN +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +CASTLE_DIR="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250" +JSON_FILE="$SCRIPT_DIR/CASTLE-Benchmark/datasets/CASTLE-C250.min.json" +RESULTS_DIR="${RESULTS_DIR:-$SCRIPT_DIR/results}" +# Opt-in flags appended to every map2check run (e.g. "--slice"), for measuring +# a capability against the same corpus without it. Not part of the CWE's mode: +# the CSV's mode column stays the property that was checked. +EXTRA_FLAGS="${EXTRA_FLAGS:-}" +TIMEOUT_SEC=360 + +# CWE → mode mapping (single-pass flags, --add-invariants added on UNKNOWN) +# +# Only CWEs Map2Check actually supports carry a mode here. Everything else is +# declared in OUT_OF_SCOPE_CWES and skipped, because the old fallback for those +# was `--target-function --target-function-name main`, which is degenerate +# (finding B): TargetPass instruments call sites whose callee is the named +# function, a program never calls its own main, so nothing was instrumented and +# every vulnerable case was reported TRUE. A TRUE from an oracle that can only +# say "correct" earned 12 fake true negatives and 5 guaranteed false negatives +# on the v6 baseline. +declare -A CWE_MODE=( + # Memory safety (memtrack) + [125]="--memtrack" + [415]="--memtrack" + [416]="--memtrack" + [476]="--memtrack" + [761]="--memtrack" + [787]="--memtrack" + [822]="--memtrack" + [843]="--memtrack" + # Overflow + [190]="--check-overflow" + [369]="--check-overflow" + # Memcleanup + [401]="--memcleanup-property" + # Assert + [617]="--check-asserts" +) + +# Unsupported CWEs. 628/674/770/835 are termination/resource properties (loop, +# recursion, unbounded workers) that Map2Check does not model; the rest are +# injection/crypto categories outside SV-COMP's scorable set for this tool. +# These are NOT run -- running them under the degenerate reachability mode only +# produced misleading TRUEs and burned a full budget per case for nothing. +OUT_OF_SCOPE_CWES=(22 78 89 134 253 327 362 522 628 674 770 798 835) + +is_out_of_scope() { + local cwe="$1" + for o in "${OUT_OF_SCOPE_CWES[@]}"; do + [ "$cwe" = "$o" ] && return 0 + done + return 1 +} + +# Verdict classification is shared with the Juliet runner and covered by +# tests/integration/test_verdict_classifier.sh — see that file for why +# "Forcing timeout" is not a timeout signal. +# shellcheck source=../lib/verdict_classifier.sh +. "$SCRIPT_DIR/../lib/verdict_classifier.sh" +# shellcheck source=../lib/isolated_run.sh +. "$SCRIPT_DIR/../lib/isolated_run.sh" + +INNER_TIMEOUT=300 # map2check's own budget, passed as --timeout below + +mkdir -p "$RESULTS_DIR" +RAW_DIR="$RESULTS_DIR/raw" +mkdir -p "$RAW_DIR" + +echo "CASTLE C250 × Map2Check Evaluation" +echo "==================================" + +# --- Phase 1: Compile all --- +echo "" +echo "Phase 1: Compiling C → LLVM bitcode..." +mkdir -p "$RESULTS_DIR/bc" +COMPILED=0 +COMPILE_FAILED=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + bc_file="$RESULTS_DIR/bc/${name%.c}.bc" + if "$CLANG" -c -emit-llvm -g -O0 -Wno-everything "$c_file" -o "$bc_file" 2>/dev/null; then + COMPILED=$((COMPILED+1)) + else + COMPILE_FAILED=$((COMPILE_FAILED+1)) + echo " FAIL: $name" + fi +done + +echo " Compiled: $COMPILED, Failed: $COMPILE_FAILED" + +# --- Phase 2: Verify + Score --- +echo "" +echo "Phase 2: Running Map2Check on each benchmark..." +if [ ! -f "$RESULTS_DIR/castle_results.csv" ]; then + echo "id,cwe,name,vulnerable,mode,verdict,invariants,expected,result,time_sec" > "$RESULTS_DIR/castle_results.csv" +fi + +# Resume: skip ids already present in the CSV +declare -A DONE +while IFS=, read -r _cid _cwe _cname _vuln _mode _verdict _inv _exp _res _t; do + [ -n "$_cid" ] && DONE["$_cid"]=1 +done < <(tail -n +2 "$RESULTS_DIR/castle_results.csv" 2>/dev/null) + +RUN=0 +TP=0; TN=0; FP=0; FN=0; UNK=0; TO=0; NA=0; ERR=0 + +for c_file in "$CASTLE_DIR"/*.c; do + name=$(basename "$c_file") + id="${name%.c}" + id_short=$(echo "$id" | sed 's/CASTLE-//') + + [ -n "${DONE[$id_short]:-}" ] && continue + + bc_file="$RESULTS_DIR/bc/${id}.bc" + [ -f "$bc_file" ] || continue + + RUN=$((RUN+1)) + + # Extract ground truth from JSON + entry=$(python3 -c " +import json +with open('$JSON_FILE') as f: + data = json.load(f) +for t in data['tests']: + if t['name'] == '$name': + print(json.dumps({'vulnerable': t['vulnerable'], 'cwe': t['cwe'], 'lines': t.get('lines',[])})) + break +" 2>/dev/null) + + [ -n "$entry" ] || { echo " SKIP: $name not found in JSON"; continue; } + + vulnerable=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['vulnerable'])") + cwe=$(echo "$entry" | python3 -c "import sys,json; print(json.loads(sys.stdin.read())['cwe'])") + + # Unsupported CWEs are skipped outright, not run under a degenerate mode. + # Recorded as N/A so the row exists for completeness and for the resume map, + # but no budget is spent and no verdict is invented. + if is_out_of_scope "$cwe"; then + echo "$id_short,$cwe,$name,$vulnerable,N/A,,,,N/A,0.0" >> "$RESULTS_DIR/castle_results.csv" + NA=$((NA+1)) + echo " [$RUN/250] $name (CWE-$cwe): N/A (out of scope)" + continue + fi + + mode_flags="${CWE_MODE[$cwe]:-}" + if [ -z "$mode_flags" ]; then + echo " ERROR: no mode mapping for CWE-$cwe ($name) -- fix CWE_MODE or OUT_OF_SCOPE_CWES" >&2 + echo "$id_short,$cwe,$name,$vulnerable,UNMAPPED,,,,ERROR,0.0" >> "$RESULTS_DIR/castle_results.csv" + ERR=$((ERR+1)) + continue + fi + + # run_isolated gives each invocation a private CWD and captures to a file. + # + # The private CWD matters here beyond the usual hygiene: map2check names its + # scratch ".map2check/" relative to the CWD + # (caller.cpp:63), i.e. by input CONTENT rather than by run. Pass 1 and the + # --add-invariants pass below analyse the SAME .bc and so resolve to the SAME + # directory name, and a directory orphaned by an aborted run is reused the + # next time that input is analysed, carrying stale artefacts in. It also keeps + # the repo working tree free of scratch, which this runner used to litter + # because its CWD was the repo root. + raw="$RAW_DIR/${name%.c}.txt" + + # --- Pass 1: direct --- + start=$(date +%s%N) + rc=0 + run_isolated "$raw" "$TIMEOUT_SEC" \ + "$MAP2CHECK" $mode_flags $EXTRA_FLAGS --timeout "$INNER_TIMEOUT" "$bc_file" || rc=$? + end=$(date +%s%N) + elapsed=$(python3 -c "print(round(($end - $start) / 1000000000, 1))") + output=$(cat "$raw") + + used_invariants="no" + verdict=$(classify_map2check_verdict "$output" "$rc" "$elapsed" "$INNER_TIMEOUT") + + # --- Pass 2: --add-invariants fallback --- + # The flag is still requested unconditionally, on purpose: this pass exists to + # retry UNKNOWN cases with abstract-interpretation invariants, and map2check is + # supposed to be able to supply them. What is handled here is the documented + # exit code for "the generator is not installed" (3), and only because pass 2 + # REPLACES pass 1's verdict -- without this, a run made while Clam is missing + # would write ERROR over a perfectly good UNKNOWN and quietly corrupt the CSV + # instead of failing visibly. + # + # Reading v5 data: through that baseline the flag was accepted and ignored on + # the .bc path, so this pass was a byte-identical re-run of pass 1. It burned a + # second full budget per UNKNOWN row and recorded used_invariants=yes for runs + # that used none. See docs/reports/2026-08-16-crabllvm-review.md. + if [ "$verdict" = "UNKNOWN" ] && [ "$mode_flags" != "--check-asserts" ]; then + start=$(date +%s%N) + rc=0 + run_isolated "$raw" "$TIMEOUT_SEC" \ + "$MAP2CHECK" $mode_flags $EXTRA_FLAGS --add-invariants --timeout "$INNER_TIMEOUT" "$bc_file" || rc=$? + end=$(date +%s%N) + + if [ "$rc" -eq 3 ]; then + # Capability absent. Keep pass 1's verdict, elapsed time and raw output; + # say so in the CSV rather than pretending invariants were tried. + used_invariants="unavailable" + printf '%s' "$output" > "$raw" + else + used_invariants="yes" + output=$(cat "$raw") + elapsed=$(python3 -c "print(round(($end - $start) / 1000000000, 1))") + verdict=$(classify_map2check_verdict "$output" "$rc" "$elapsed" "$INNER_TIMEOUT") + fi + fi + + # run_isolated already wrote "$raw"; pass 2, when it runs, overwrites it so + # the file always matches the verdict finally recorded. Keeping it means a + # future classifier bug is repaired by reclassifying rather than re-running. + + # The violation line is only reported in the "Violated property" block as + # "file map2check_property line N". A bare `grep 'line \d+' | head -1` would + # instead match LibFuzzer's "inline 8-bit counters" (-> "line 8"). + reported_line=$(echo "$output" | grep -oP 'map2check_property line \K\d+' | head -1) + + # --- Classify --- + # Out-of-scope CWEs were skipped above (continue), so every case reaching + # here is in scope and gets a verdict-driven classification. + if [ "$verdict" = "TIMEOUT" ]; then + classification="TIMEOUT" + TO=$((TO+1)) + elif [ "$verdict" = "ERROR" ]; then + classification="ERROR" + ERR=$((ERR+1)) + elif [ "$verdict" = "UNKNOWN" ]; then + classification="UNKNOWN" + UNK=$((UNK+1)) + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "True" ]; then + has_line_match="false" + if [ -n "$reported_line" ]; then + expected_lines=$(echo "$entry" | python3 -c "import sys,json; print(','.join(str(l) for l in json.loads(sys.stdin.read())['lines']))" 2>/dev/null || echo "") + if [ -n "$expected_lines" ]; then + for exp_line in $(echo "$expected_lines" | tr ',' ' '); do + if [ "$reported_line" -eq "$exp_line" ] 2>/dev/null; then + has_line_match="true" + break + fi + done + else + has_line_match="true" + fi + else + has_line_match="true" + fi + if [ "$has_line_match" = "true" ]; then + classification="TP" + TP=$((TP+1)) + else + classification="FP" + FP=$((FP+1)) + fi + elif [ "$verdict" != "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="FP" + FP=$((FP+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "False" ]; then + classification="TN" + TN=$((TN+1)) + elif [ "$verdict" = "TRUE" ] && [ "$vulnerable" = "True" ]; then + classification="FN" + FN=$((FN+1)) + else + classification="UNCLASSIFIED" + UNK=$((UNK+1)) + fi + + echo "$id_short,$cwe,$name,$vulnerable,$mode_flags,$verdict,$used_invariants,$vulnerable,$classification,$elapsed" >> "$RESULTS_DIR/castle_results.csv" + echo " [$RUN/250] $name (CWE-$cwe): $verdict → $classification (${elapsed}s)" +done + +# --- Phase 3: Summary --- +echo "" +echo "Phase 3: Generating summary..." +TOTAL_SCOPE=$((TP+TN+FP+FN)) + +cat > "$RESULTS_DIR/castle_summary.txt" << EOF +CASTLE C250 × Map2Check Evaluation Results +=========================================== +Date: $(date -u +"%Y-%m-%dT%H:%M:%SZ") +Map2Check binary: $MAP2CHECK + +Totals: + Total tests: 250 + In-scope results: $TOTAL_SCOPE + Out of scope (N/A): $NA + Timeouts: $TO + Errors (infra): $ERR + Unknown: $UNK + +Detection Metrics (in-scope): + True Positives: $TP + False Positives: $FP + True Negatives: $TN + False Negatives: $FN + +EOF + + if [ $((TP + FP)) -gt 0 ]; then + prec=$(python3 -c "print(f'{$TP/($TP+$FP)*100:.1f}%')") + echo " Precision: $prec" >> "$RESULTS_DIR/castle_summary.txt" + else + echo " Precision: N/A (no positives)" >> "$RESULTS_DIR/castle_summary.txt" + fi + if [ $((TP + FN)) -gt 0 ]; then + rec=$(python3 -c "print(f'{$TP/($TP+$FN)*100:.1f}%')") + echo " Recall: $rec" >> "$RESULTS_DIR/castle_summary.txt" + else + echo " Recall: N/A (no condition positives)" >> "$RESULTS_DIR/castle_summary.txt" + fi + + cat >> "$RESULTS_DIR/castle_summary.txt" << EOF + +Results written to: + CSV: $RESULTS_DIR/castle_results.csv +EOF + +cat "$RESULTS_DIR/castle_summary.txt" + +echo "" +echo "Done. Results in $RESULTS_DIR/" diff --git a/tests/integration/test_add_invariants.sh b/tests/integration/test_add_invariants.sh new file mode 100644 index 000000000..581250cfd --- /dev/null +++ b/tests/integration/test_add_invariants.sh @@ -0,0 +1,170 @@ +#!/bin/bash +# test_add_invariants.sh -- the --add-invariants contract. +# +# This file has two jobs, and the second is unusual. +# +# The first is ordinary: --add-invariants must never be accepted and then +# ignored without a trace. That was the state issue #54 describes, and it held +# on the .bc input path -- which is how the entire v5 baseline and the CASTLE +# harness invoke the tool. The guard that was supposed to warn lived inside +# `if (!is_llvmir_in)`, so bitcode input skipped it entirely. +# +# The second job is to detect PROGRESS. The invariant generator is absent +# today, so the ABSENT assertions below are what passes. Once Clam dev16 is +# built into the image, the same run must instead succeed AND inject +# verifier.assume calls into the bitcode. The script probes which state it is +# in and asserts the contract for that state, printing the state either way. +# A green run means "the contract holds"; the CAPABILITY line says which +# contract that was, so the day invariants come back is visible in the CI log +# rather than inferred. +# +# Deliberately not done: parking a red check that is expected to be red. A +# permanently failing job gets ignored, and then nobody notices when it goes +# green -- which is exactly the transition this test exists to catch. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +# A loop with an inductive invariant (sum >= 0), which is the shape abstract +# interpretation is good at and a fuzzer is not. Once Clam is in place this is +# also a program where the invariant is worth something. +cat > "$WORK/loop.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int i = 0; + int sum = 0; + if (n < 0 || n > 100) return 0; + while (i < n) { sum += i; i++; } + if (sum < 0) { reach_error(); } + return 0; +} +EOF + +"$CLANG" -c -emit-llvm -g -o "$WORK/loop.bc" "$WORK/loop.c" 2>/dev/null + +echo "============================================================" +echo "--add-invariants contract" +echo "============================================================" + +# --debug keeps the scratch directory, which is the only place the intermediate +# bitcode exists: cleanGarbage() deletes it on a normal run, so without this +# there is nothing left to inspect for injected invariants. +run_flag() { + local input="$1" rc=0 + ( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 180 \ + "$MAP2CHECK" --debug --target-function --target-function-name reach_error \ + --add-invariants --nondet-generator symex --timeout 60 "$input" ) \ + > "$WORK/out.txt" 2>&1 || rc=$? + echo "$rc" +} + +rc_bc=$(run_flag loop.bc) +out_bc=$(cat "$WORK/out.txt") + +if [ "$rc_bc" -eq 3 ]; then + CAPABILITY="ABSENT" +elif [ "$rc_bc" -eq 0 ]; then + CAPABILITY="PRESENT" +else + CAPABILITY="BROKEN" +fi +echo " CAPABILITY: invariant generator is $CAPABILITY (exit $rc_bc)" + +case "$CAPABILITY" in + ABSENT) + # The contract while Clam is not built. + if echo "$out_bc" | grep -qi "add-invariants"; then + ok "the refusal names the flag that caused it" + else + fail "diagnostic" "exit 3 with no mention of --add-invariants" + fi + + # A refusal that does not say why, and does not say what to do about it, + # just moves the confusion from "it did nothing" to "it failed". + if echo "$out_bc" | grep -qiE "no invariant generator|not built|unavailable|not installed"; then + ok "the refusal says the generator is missing" + else + fail "diagnostic" "no explanation of why it refused" + fi + + if echo "$out_bc" | grep -q "ENABLE_CLAM"; then + ok "the refusal says how to fix it" + else + fail "diagnostic" "no remedy offered (-DENABLE_CLAM=ON)" + fi + + # The silence bug itself: .c input already warned, .bc did not. Both paths + # must behave identically now. + rc_c=$(run_flag loop.c) + if [ "$rc_c" -eq 3 ]; then + ok ".c input refuses the same way .bc does (issue #54)" + else + fail "input path parity" ".bc exited 3 but .c exited $rc_c" + fi + + # Runs that do not ask for invariants must be untouched. + rc_plain=0 + ( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 180 \ + "$MAP2CHECK" --target-function --target-function-name reach_error \ + --nondet-generator symex --timeout 60 loop.bc ) \ + > "$WORK/plain.txt" 2>&1 || rc_plain=$? + if [ "$rc_plain" -ne 3 ]; then + ok "runs without --add-invariants are unaffected" + else + fail "collateral damage" "a run without the flag also exited 3" + fi + ;; + + PRESENT) + # The contract once Clam dev16 is in place. Reaching this branch at all is + # the progress signal: it means the migration landed. + ok "--add-invariants completes successfully" + + # Succeeding is not enough. Without this assertion the flag could go back + # to being a no-op, only now wearing a success exit code -- which is worse + # than the bug this test was written for, because it looks correct. + # The scratch directory (.map2check/) holds every intermediate: the + # Clam-compiled bitcode carrying verifier.assume, and the instrumented one + # where NonDetPass has rewritten it to map2check_crab_assume. Either symbol + # proves the invariants reached the pipeline. + found="" + while IFS= read -r bc; do + if llvm-dis-16 -o - "$bc" 2>/dev/null \ + | grep -q 'verifier\.assume\|map2check_crab_assume'; then + found="$bc" + break + fi + done < <(find "$WORK" -name '*.bc' -type f 2>/dev/null | sort) + + if [ -n "$found" ]; then + ok "the produced bitcode carries invariant assumes ($(basename "$found"))" + else + n_bc=$(find "$WORK" -name '*.bc' -type f 2>/dev/null | wc -l) + fail "invariant injection" \ + "exit 0 but no assume symbol in any of the $n_bc bitcode files" + fi + ;; + + BROKEN) + fail "capability probe" "exit $rc_bc is neither 3 (absent) nor 0 (present)" + echo "$out_bc" | tail -20 + ;; +esac + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed [capability: $CAPABILITY]" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_benchexec_toolinfo.py b/tests/integration/test_benchexec_toolinfo.py new file mode 100644 index 000000000..6a4472450 --- /dev/null +++ b/tests/integration/test_benchexec_toolinfo.py @@ -0,0 +1,206 @@ +#!/usr/bin/env python3 +"""The BenchExec tool-info contract, for SV-COMP and Test-Comp. + +Map2Check cannot be submitted to a competition without a tool-info module that +BenchExec accepts, and the failure mode of a wrong one is nasty: it surfaces on +competition infrastructure, days after submission, as every task erroring out. +Nothing else in this repository exercises that module, so this file does -- +against the real benchexec package, not a stub, because the whole risk is that +the API is not what we assumed. + +There is one module, utils/moduleBenchExec/map2check.py, a copy of +benchexec/tools/map2check.py: the BenchExec maintainers asked for Test-Comp +support to live in the existing module rather than in a second one +(sosy-lab/benchexec#1352). So the old archives must keep working with it too: +the v7 wrapper of SV-COMP 2018-2020 rejects --data-model and --budget. + +Run with: python3 tests/integration/test_benchexec_toolinfo.py +Requires: pip3 install benchexec (already present wherever testcov is). +""" + +import os +import sys +import tempfile + +REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) +sys.path.insert(0, os.path.join(REPO, "utils", "moduleBenchExec")) + +import benchexec.result as result # noqa: E402 +import benchexec.tools.template as template # noqa: E402 +import benchexec.util as util # noqa: E402 + +import map2check # noqa: E402 + +PASSED = 0 +FAILED = 0 + + +def ok(what): + global PASSED + print(" PASS %s" % what) + PASSED += 1 + + +def fail(what, why): + global FAILED + print(" FAIL %s: %s" % (what, why)) + FAILED += 1 + + +def check(what, condition, why=""): + ok(what) if condition else fail(what, why) + + +def raises(what, fn, exc=template.UnsupportedFeatureException): + try: + fn() + except exc: + ok(what) + except Exception as other: # noqa: BLE001 + fail(what, "raised %s instead of %s" % (type(other).__name__, exc.__name__)) + else: + fail(what, "did not raise") + + +def write(directory, name, text): + path = os.path.join(directory, name) + with open(path, "w") as handle: + handle.write(text) + return path + + +def fake_tool(version): + """A tool directory whose wrapper only answers --version.""" + directory = tempfile.mkdtemp() + wrapper = write(directory, "map2check-wrapper.py", + "#!/bin/sh\necho %s\n" % version) + os.chmod(wrapper, 0o755) + tool = map2check.Tool() + executable = tool.executable(template.BaseTool2.ToolLocator( + tool_directory=directory, use_path=False, use_current=False)) + return tool, executable + + +def run_with(exit_value, output, termination_reason=None): + if exit_value is None: + exit_code = util.ProcessExitCode(raw=9, value=None, signal=9) + else: + exit_code = util.ProcessExitCode(raw=exit_value << 8, value=exit_value, signal=None) + return template.BaseTool2.Run( + cmdline=["map2check-wrapper.py"], + exit_code=exit_code, + output=template.BaseTool2.RunOutput(output), + termination_reason=termination_reason, + ) + + +def main(): + print("=== BenchExec tool-info (SV-COMP and Test-Comp) ===") + + tool, executable = fake_tool("v9.0.0-Songbirds:2026-10-13") + + check("the module is a BaseTool2, not the deprecated BaseTool", + isinstance(tool, template.BaseTool2)) + check("the tool names itself Map2Check", tool.name() == "Map2Check", + "got %r" % tool.name()) + check("the tool publishes a project URL", + tool.project_url().startswith("https://"), tool.project_url()) + check("the wrapper is the executable, not the raw binary", + executable.endswith("map2check-wrapper.py"), executable) + check("the archive paths include the wrapper", + "map2check-wrapper.py" in tool.program_files(executable)) + + work = tempfile.mkdtemp() + cover_error = write(work, "coverage-error-call.prp", + "COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )\n") + cover_branches = write(work, "coverage-branches.prp", + "COVER( init(main()), FQL(COVER EDGES(@DECISIONEDGE)) )\n") + unreachability = write(work, "unreach-call.prp", + "CHECK( init(main()), LTL(G ! call(reach_error())) )\n") + program = write(work, "prog.c", "int main(void) { return 0; }\n") + + limits = template.BaseTool2.ResourceLimits(walltime=900) + + # --- Map2Check 9: the task options reach the wrapper --------------------- + task = template.BaseTool2.Task.with_files([program], property_file=cover_error) + cmd = tool.cmdline(executable, [], task, limits) + + check("the property file is passed through", + "-p" in cmd and cmd[cmd.index("-p") + 1] == cover_error) + check("the program is the last argument", cmd[-1] == program, cmd[-1]) + check("the walltime limit becomes the tool's own budget", + "--budget" in cmd and cmd[cmd.index("--budget") + 1] == "900") + check("a task without a data model leaves the wrapper's default (LP64)", + "--data-model" not in cmd, cmd) + + # The machine model has to come from the task, not a guess. BenchExec only + # reads it from a task that declares its language, as sv-benchmarks do. + for model in ("ILP32", "LP64"): + task_model = template.BaseTool2.Task.with_files( + [program], property_file=cover_error, + options={"language": "C", "data_model": model}) + cmd_model = tool.cmdline(executable, [], task_model, limits) + check("a task declaring %s is honoured" % model, + "--data-model" in cmd_model + and cmd_model[cmd_model.index("--data-model") + 1] == model, cmd_model) + + # cover-branches used to be refused, because there was no source of + # per-path vectors. KLEE's .ktest output is now that source, so a + # regression to the refusal would silently drop a whole category. + cmd_branches = tool.cmdline(executable, [], template.BaseTool2.Task.with_files( + [program], property_file=cover_branches), limits) + check("cover-branches passes its own property file", + cmd_branches[cmd_branches.index("-p") + 1] == cover_branches) + + # One module now: an SV-COMP property is the wrapper's business, not a + # reason for the module to refuse the task. + cmd_check = tool.cmdline(executable, [], template.BaseTool2.Task.with_files( + [program], property_file=unreachability), limits) + check("an SV-COMP CHECK property is accepted", cmd_check[-1] == program) + + raises("a task with no property file is refused", + lambda: tool.cmdline(executable, [], template.BaseTool2.Task.with_files( + [program]), limits)) + + # --- older archives: no options their wrapper would reject -------------- + old_tool, old_executable = fake_tool("v7.3.1-Flock") + old_cmd = old_tool.cmdline(old_executable, [], task, limits) + check("a Map2Check 7 wrapper gets neither --data-model nor --budget", + "--data-model" not in old_cmd and "--budget" not in old_cmd, old_cmd) + check("a Map2Check 7 command line is unchanged", + old_cmd == [old_executable, "-p", cover_error, program], old_cmd) + + silent_tool, silent_executable = fake_tool("") + silent_cmd = silent_tool.cmdline(silent_executable, [], task, limits) + check("a wrapper that does not tell its version gets no new options", + "--budget" not in silent_cmd, silent_cmd) + + # --- determine_result ---------------------------------------------------- + check("DONE as the last line is DONE", + tool.determine_result(run_with(0, ["Test suite in /x/test-suite", "DONE"])) + == result.RESULT_DONE) + check("a failed generation is ERROR", + tool.determine_result(run_with(1, ["ERROR: no test-suite/ directory was produced"])) + == "ERROR") + check("a crashed map2check is ERROR, not DONE", + tool.determine_result(run_with(2, ["Test suite in /x/test-suite", + "ERROR: map2check exited with 2"])) + == "ERROR") + check("a run killed by the harness is TIMEOUT", + tool.determine_result(run_with(None, ["Generating tests with MAP2CHECK"], + termination_reason="walltime")) + == result.RESULT_TIMEOUT) + check("SV-COMP verdicts are untouched: TRUE", + tool.determine_result(run_with(0, ["TRUE"])) == result.RESULT_TRUE_PROP) + check("SV-COMP verdicts are untouched: FALSE_DEREF", + tool.determine_result(run_with(0, ["FALSE_DEREF"])) == result.RESULT_FALSE_DEREF) + check("SV-COMP verdicts are untouched: FALSE", + tool.determine_result(run_with(0, ["FALSE"])) == result.RESULT_FALSE_REACH) + + print(" ---") + print(" Results: %d passed, %d failed" % (PASSED, FAILED)) + return 1 if FAILED else 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/tests/integration/test_castle_regression.sh b/tests/integration/test_castle_regression.sh new file mode 100755 index 000000000..da97f4158 --- /dev/null +++ b/tests/integration/test_castle_regression.sh @@ -0,0 +1,70 @@ +#!/bin/bash +set -e + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +CASTLE_DIR="tests/castle/CASTLE-Benchmark/datasets/CASTLE-C250" +TMPDIR=$(mktemp -d) +PASSED=0 +FAILED=0 + +cleanup() { rm -rf "$TMPDIR"; } +trap cleanup EXIT + +echo "============================================================" +echo "Map2Check CASTLE Regression Tests" +echo "============================================================" + +run_castle_test() { + local name="$1" + local cwe="$2" + local expect_fail="$3" + + local src="$CASTLE_DIR/$name" + local bc="$TMPDIR/$name.bc" + + echo "" + echo "--- Test: $name (CWE-$cwe) ---" + + $CLANG -c -emit-llvm -g -O0 "$src" -o "$bc" 2>/dev/null || { + echo " SKIP: compile failed" + return 0 + } + + local output + output=$(timeout 120 "$MAP2CHECK" --memtrack --timeout 60 "$bc" 2>&1) || true + + if [ "$expect_fail" = "true" ]; then + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " PASS: vulnerability detected" + PASSED=$((PASSED+1)) + else + echo " FAIL: expected FALSE, got:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + else + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " FAIL: expected TRUE, got FALSE:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + else + echo " PASS: no false alarm" + PASSED=$((PASSED+1)) + fi + fi +} + +run_castle_test "CASTLE-476-5.c" "476" "true" +run_castle_test "CASTLE-415-2.c" "415" "true" +run_castle_test "CASTLE-476-8.c" "476" "false" +run_castle_test "CASTLE-416-1.c" "416" "true" +run_castle_test "CASTLE-787-6.c" "787" "true" + +echo "" +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ $FAILED -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_cover_branches.sh b/tests/integration/test_cover_branches.sh new file mode 100755 index 000000000..6c20e6bf9 --- /dev/null +++ b/tests/integration/test_cover_branches.sh @@ -0,0 +1,126 @@ +#!/bin/bash +# test_cover_branches.sh -- the Cover-Branches suite, validated by TestCov. +# +# Cover-Error asks for one test case, the violating one. Cover-Branches asks +# for a suite that exercises as many branches as possible, and the difference +# is not a parameter -- it is a different source of input vectors. +# +# The vectors come from KLEE's own .ktest output, one per explored path. The +# alternative, having the instrumented program write a log per state, was tried +# and measured: it turned a 1-second run answering FALSE into a 100-second run +# that exhausted its budget and answered TRUE, because every write is an +# external call KLEE executes concretely. Reading .ktest files after the search +# has finished costs the search nothing. +# +# The assertion that matters is the last one. Well-formed XML proves nothing +# about coverage; only an independent validator can say whether the suite +# actually exercises the branches, and TestCov is that validator. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +TESTCOV="${TESTCOV:-testcov}" +BUDGET="${BUDGET:-120}" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +cat > "$WORK/branches.prp" <<'EOF' +COVER( init(main()), FQL(COVER EDGES(@DECISIONEDGE)) ) +EOF + +# Six decision edges over two independent inputs. A single-test-case suite can +# reach at most half of them, so a tool that quietly fell back to the +# Cover-Error path would show up as ~50% coverage rather than as an error. +cat > "$WORK/branches.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + int y = __VERIFIER_nondet_int(); + int r = 0; + if (x > 10) { r += 1; } else { r += 2; } + if (y < -5) { r += 4; } else { r += 8; } + if (x == y) { r += 16; } + return r; +} +EOF + +echo "=== Cover-Branches suite ===" + +if ! command -v "$TESTCOV" >/dev/null 2>&1; then + echo " SKIP: $TESTCOV not installed (pip3 install testcov)" + exit 0 +fi + +( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 $((BUDGET + 60)) \ + "$MAP2CHECK" --nondet-generator symex --generate-test-suite --cover-branches \ + --property-file branches.prp --architecture 64bit \ + --timeout "$BUDGET" branches.c ) > "$WORK/m2c.log" 2>&1 + +n_tests=$(ls "$WORK/test-suite"/testcase-*.xml 2>/dev/null | wc -l) + +# More than one, because that is the whole point: Cover-Error emits exactly one. +if [ "$n_tests" -gt 1 ]; then + ok "the suite holds more than one test case ($n_tests)" +else + fail "test case count" "got $n_tests, expected several (one per KLEE path)" + tail -5 "$WORK/m2c.log" | sed 's/^/ /' + echo " Results: $PASSED passed, $FAILED failed" + exit 1 +fi + +# Distinct vectors. Identical ones would mean the same path was recorded many +# times, which inflates the suite while covering nothing extra. +vectors=$(for f in "$WORK/test-suite"/testcase-*.xml; do + sed -n 's:.*\(.*\).*:\1:p' "$f" | tr '\n' ',' ; echo + done) +n_distinct=$(printf '%s\n' "$vectors" | sort -u | grep -c .) +if [ "$n_distinct" -eq "$n_tests" ]; then + ok "every test case is a distinct input vector ($n_distinct)" +else + fail "vector distinctness" "$n_distinct distinct out of $n_tests" +fi + +# Cover-Branches test cases are paths, not violations. +if grep -q 'coversError="true"' "$WORK/test-suite"/testcase-*.xml 2>/dev/null; then + fail "coversError" "a branch test case claims to cover the error" +else + ok "no branch test case claims coversError" +fi + +if grep -q "@DECISIONEDGE" "$WORK/test-suite/metadata.xml"; then + ok "metadata records the branch-coverage specification" +else + fail "specification" "metadata does not carry the cover-branches property" +fi + +# The one that cannot be faked. +( cd "$WORK/test-suite" && zip -q -r ../suite.zip . ) +( cd "$WORK" && timeout -k 10 300 "$TESTCOV" --test-suite suite.zip \ + --no-isolation -64 --goal branches.prp branches.c ) > "$WORK/tc.log" 2>&1 + +coverage=$(grep -oE '^Coverage: [0-9.]+' "$WORK/tc.log" | tail -1 | awk '{print $2}') +if [ -z "$coverage" ]; then + fail "TestCov ran" "no Coverage line -- see below" + tail -15 "$WORK/tc.log" | sed 's/^/ /' +else + # 100% is what this program should reach; the threshold is set below it so a + # small change in KLEE's path ordering does not turn into a red build, while + # a fallback to a one-case suite (~50%) still fails. + reached=$(python3 -c "print(1 if float('$coverage') >= 80.0 else 0)") + if [ "$reached" = "1" ]; then + ok "TestCov measures ${coverage}% branch coverage" + else + fail "branch coverage" "only ${coverage}%, expected >= 80%" + fi +fi + +echo " ---" +echo " Results: $PASSED passed, $FAILED failed" +[ "$FAILED" -eq 0 ] || exit 1 diff --git a/tests/integration/test_cwe_mode_mapping.sh b/tests/integration/test_cwe_mode_mapping.sh new file mode 100644 index 000000000..295c7cfbf --- /dev/null +++ b/tests/integration/test_cwe_mode_mapping.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# test_cwe_mode_mapping.sh — the CASTLE CWE→mode mapping must never fall back to +# reachability mode. +# +# Finding B: 13 CWEs were mapped to `--target-function --target-function-name +# main`, which is degenerate — TargetPass instruments call sites whose callee is +# the named function, and a program never calls its own main. On the v6 baseline +# 98 of 217 runs went through that mode and produced zero FALSEs on 59 known +# vulnerable programs, earning 12 fake true negatives and 5 guaranteed false +# negatives. +# +# The contract this pins down: +# 1. no CWE maps to a reachability target of `main` (or any reachability mode); +# 2. 628/674/770/835 (termination/resource) are declared out of scope; +# 3. every CWE in the benchmark has an explicit mode or an out-of-scope +# declaration — nothing can silently fall through unmapped. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +RUNNER="$SCRIPT_DIR/../castle/run_castle_evaluation.sh" +JSON="$SCRIPT_DIR/../castle/CASTLE-Benchmark/datasets/CASTLE-C250.min.json" + +[ -f "$RUNNER" ] || { echo " FAIL: $RUNNER not found"; exit 1; } +[ -f "$JSON" ] || { echo " FAIL: $JSON not found"; exit 1; } + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +# Source the two declarations in a subshell so the runner itself never runs. +eval "$(sed -n '/declare -A CWE_MODE=/,/^)/p' "$RUNNER")" +eval "$(grep '^OUT_OF_SCOPE_CWES=' "$RUNNER")" + +echo "=== CWE→mode mapping contract ===" + +# 1. No mode may name a reachability target. +offender="" +for cwe in "${!CWE_MODE[@]}"; do + case "${CWE_MODE[$cwe]}" in + *target-function*) offender="$offender $cwe";; + esac +done +if [ -n "$offender" ]; then + fail "no reachability target" "CWE(s)$offender still use --target-function" +else + ok "no CWE maps to --target-function (finding B guard)" +fi + +# 2. The termination/resource CWEs must be declared out of scope. +missing="" +for cwe in 628 674 770 835; do + found="" + for o in "${OUT_OF_SCOPE_CWES[@]}"; do + [ "$o" = "$cwe" ] && found=1 + done + [ -n "$found" ] || missing="$missing $cwe" +done +if [ -n "$missing" ]; then + fail "termination CWEs out of scope" "missing from OUT_OF_SCOPE_CWES:$missing" +else + ok "628/674/770/835 declared out of scope" +fi + +# 3. Every CWE in the benchmark is either mapped or out of scope. +bench_cwes=$(python3 -c " +import json +data = json.load(open('$JSON')) +print(' '.join(sorted({str(t['cwe']) for t in data['tests']}))) +") +unmapped="" +for cwe in $bench_cwes; do + in_mode="" + for k in "${!CWE_MODE[@]}"; do [ "$k" = "$cwe" ] && in_mode=1; done + in_scope="" + for o in "${OUT_OF_SCOPE_CWES[@]}"; do [ "$o" = "$cwe" ] && in_scope=1; done + if [ -z "$in_mode" ] && [ -z "$in_scope" ]; then unmapped="$unmapped $cwe"; fi +done +if [ -n "$unmapped" ]; then + fail "full coverage" "CWE(s) neither mapped nor out of scope:$unmapped" +else + ok "every benchmark CWE is mapped or declared out of scope" +fi + +echo "=== Results: $PASSED passed, $FAILED failed ===" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_exit_codes.sh b/tests/integration/test_exit_codes.sh new file mode 100644 index 000000000..ef5bb384e --- /dev/null +++ b/tests/integration/test_exit_codes.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# test_exit_codes.sh — the process exit code must reflect how the run ended. +# +# Finding G: main() discarded the return value of map2check_execution() at all +# three call sites, so the exit code was always 0 (or SIGABRT from the +# --expected-result path). Two consequences: +# +# 1. The Test-Comp tool-info (then utils/moduleBenchExec/map2check_testcomp.py) +# decided DONE vs ERROR from `exit_code == 0`, so an internally failed run +# was reported DONE. The wrapper now prints DONE only for an exit code it +# accepts, so the exit code still decides. +# 2. --expected-result signalled a wrong answer with abort() (SIGABRT, 134), +# which BenchExec reads as "the tool crashed" -- the opposite of the truth. +# +# The convention this test pins down: exit 0 means "the analysis ran to a +# verdict, whatever it was" (the verdict lives in stdout, which is what SV-COMP +# parses), and non-zero means "the run itself failed or disagreed with the +# harness", with --expected-result getting its own code (4). + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +TMPDIR=$(mktemp -d) +trap 'rm -rf "$TMPDIR"' EXIT + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +cat > "$TMPDIR/ov_bug.c" <<'EOF' +#include +int main(void) { int x = 2147483647; int y = x + 1; return y; } +EOF + +"$CLANG" -c -emit-llvm -g -O0 "$TMPDIR/ov_bug.c" -o "$TMPDIR/ov_bug.bc" 2>/dev/null || { + echo " SKIP: compile failed" + exit 1 +} + +echo "=== Exit-code contract ===" + +# 1. A definitive FALSE is still exit 0 -- the verdict is in stdout, not the code. +output=$("$MAP2CHECK" --nondet-generator symex --check-overflow --timeout 60 \ + "$TMPDIR/ov_bug.bc" 2>&1) +rc=$? +if [ "$rc" -eq 0 ] && echo "$output" | grep -qE "VERIFICATION FAILED|OVERFLOW"; then + ok "FALSE verdict keeps exit code 0 (verdict in stdout)" +else + fail "FALSE exit code" "rc=$rc (want 0 with FALSE on stdout)" + echo "$output" | tail -5 +fi + +# 2. A matching --expected-result is exit 0. +output=$("$MAP2CHECK" --nondet-generator symex --check-overflow --timeout 60 \ + --expected-result OVERFLOW "$TMPDIR/ov_bug.bc" 2>&1) +rc=$? +if [ "$rc" -eq 0 ]; then + ok "--expected-result OVERFLOW (matching) exits 0" +else + fail "matching expected-result" "rc=$rc (want 0)" +fi + +# 3. A mismatching --expected-result is a distinct exit code, not SIGABRT. +output=$("$MAP2CHECK" --nondet-generator symex --check-overflow --timeout 60 \ + --expected-result FALSE-FREE "$TMPDIR/ov_bug.bc" 2>&1) +rc=$? +if [ "$rc" -eq 4 ]; then + ok "--expected-result mismatch exits 4 (not SIGABRT 134)" +elif [ "$rc" -eq 134 ]; then + fail "mismatching expected-result" "rc=134 (SIGABRT) -- abort() still in place" +else + fail "mismatching expected-result" "rc=$rc (want 4)" +fi + +echo "=== Results: $PASSED passed, $FAILED failed ===" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_juliet_sampling.sh b/tests/integration/test_juliet_sampling.sh new file mode 100644 index 000000000..68857d738 --- /dev/null +++ b/tests/integration/test_juliet_sampling.sh @@ -0,0 +1,189 @@ +#!/bin/bash +# test_juliet_sampling.sh — tests for the Juliet stratified sampler. +# +# This file exists because of a specific failure. The v3 baseline capped work +# with LIMIT_PER_CWE, which took the first N files alphabetically. Since a test +# family owns ~26 consecutive filenames, 60 files collapsed into 2-3 families: +# CWE-190 was measured on 6 of its 90 families, CWE-369 on 2 of 18. Every +# int64_t family went untested -- including the exact ones the overflow work +# existed to validate. Nothing failed, nothing warned; the CSV looked complete +# and two full runs were published off it. +# +# A sampler that is wrong produces plausible output, so it needs assertions +# rather than inspection. The invariants below are the ones whose violation +# would repeat that failure silently. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +RUNNER="$SCRIPT_DIR/../juliet/run_juliet_evaluation.sh" + +PASSED=0 +FAILED=0 + +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +# --- The selection logic, lifted verbatim from the runner ------------------- +# Kept as a mirror rather than sourced: the runner is a top-to-bottom script +# that would start compiling and analysing on source. If these ever drift the +# family-coverage test below still runs against the real runner and catches it. +select_stratified() { + local per="$1"; shift + local -A FAM_FILES=() + local fam_order=() base fam f n i + local SELECTED=() + + for f in "$@"; do + base="${f##*/}" + case "$base" in *[a-z].c) continue ;; esac + fam="${base##*__}" + fam="${fam%_*.c}" + if [ -z "${FAM_FILES[$fam]+set}" ]; then + fam_order+=("$fam") + FAM_FILES[$fam]="" + fi + FAM_FILES[$fam]+="$f"$'\n' + done + + for fam in "${fam_order[@]}"; do + local fam_list=() + mapfile -t fam_list < <(printf '%s' "${FAM_FILES[$fam]}") + n=${#fam_list[@]} + if [ "$per" -le 0 ] || [ "$n" -le "$per" ]; then + SELECTED+=("${fam_list[@]}") + elif [ "$per" -eq 1 ]; then + SELECTED+=("${fam_list[0]}") + else + for ((i = 0; i < per; i++)); do + SELECTED+=("${fam_list[$((i * (n - 1) / (per - 1)))]}") + done + fi + done + printf '%s\n' "${SELECTED[@]}" +} + +famof() { local b="${1##*/}"; b="${b##*__}"; echo "${b%_*.c}"; } + +# Build a synthetic tree: 3 families x 26 variants, plus fragments and a +# single-variant family. +CORPUS=() +for f in int_max_multiply int64_t_rand_square short_min_sub; do + for i in $(seq -w 1 26); do CORPUS+=("/t/CWE190_Integer_Overflow__${f}_${i}.c"); done +done +CORPUS+=("/t/CWE190_Integer_Overflow__int_fscanf_add_51a.c") # fragment +CORPUS+=("/t/CWE190_Integer_Overflow__int_fscanf_add_51b.c") # fragment +CORPUS+=("/t/CWE190_Integer_Overflow__lonely_family_01.c") # 1 variant only + +echo "============================================================" +echo "Juliet stratified sampler" +echo "============================================================" + +# --- Every family is represented, whatever PER_FAMILY is -------------------- +# This is the invariant the v3 bug violated. +ALL_FAMS=$(for f in "${CORPUS[@]}"; do + case "${f##*/}" in *[a-z].c) continue ;; esac; famof "$f"; done | sort -u) +N_FAMS=$(echo "$ALL_FAMS" | wc -l) + +for per in 1 2 3 5 0; do + got=$(select_stratified "$per" "${CORPUS[@]}" | while read -r f; do famof "$f"; done | sort -u) + if [ "$got" = "$ALL_FAMS" ]; then + ok "PER_FAMILY=$per covers all $N_FAMS families" + else + fail "PER_FAMILY=$per family coverage" "expected [$(echo $ALL_FAMS)], got [$(echo $got)]" + fi +done + +# --- Exactly PER_FAMILY files per family, and no duplicates ----------------- +for per in 2 3 5; do + bad="" + while read -r fam cnt; do + [ "$cnt" -ne "$per" ] && bad="$bad $fam=$cnt" + done < <(select_stratified "$per" "${CORPUS[@]}" \ + | while read -r f; do famof "$f"; done \ + | sort | uniq -c | awk '$2!="lonely_family"{print $2" "$1}') + [ -z "$bad" ] && ok "PER_FAMILY=$per takes exactly $per per family" \ + || fail "PER_FAMILY=$per per-family count" "$bad" + + total=$(select_stratified "$per" "${CORPUS[@]}" | wc -l) + uniqn=$(select_stratified "$per" "${CORPUS[@]}" | sort -u | wc -l) + [ "$total" -eq "$uniqn" ] && ok "PER_FAMILY=$per selects no file twice" \ + || fail "PER_FAMILY=$per duplicates" "$total selected, $uniqn unique" +done + +# --- A family smaller than PER_FAMILY yields what it has, not an error ------ +n_lonely=$(select_stratified 3 "${CORPUS[@]}" | grep -c 'lonely_family') +[ "$n_lonely" -eq 1 ] && ok "family with fewer files than PER_FAMILY is taken whole" \ + || fail "small family" "expected 1, got $n_lonely" + +# --- Multi-file fragments stay out ----------------------------------------- +n_frag=$(select_stratified 0 "${CORPUS[@]}" | grep -c '_51[ab]\.c') +[ "$n_frag" -eq 0 ] && ok "multi-file fragments (_51a/_51b) are excluded" \ + || fail "fragments" "$n_frag leaked into the sample" + +# --- The sample spans the variant range, it is not a prefix ----------------- +# Taking _01.._03 would re-introduce the same bias one level down: the simple +# control-flow shapes live at the start of the range and the hard ones +# (function pointers, unions, interprocedural flow) at the end. +sel=$(select_stratified 3 "${CORPUS[@]}" | grep 'int_max_multiply' | sed 's/.*_\([0-9]*\)\.c/\1/' | sort) +if [ "$sel" = "$(printf '01\n13\n26')" ]; then + ok "3 of 26 are spread first/middle/last, not a prefix" +else + fail "variant spread" "expected 01,13,26 -- got $(echo $sel | tr '\n' ',')" +fi + +# --- PER_FAMILY=0 means everything ----------------------------------------- +n_all=$(select_stratified 0 "${CORPUS[@]}" | wc -l) +[ "$n_all" -eq 79 ] && ok "PER_FAMILY=0 selects every self-contained file (79)" \ + || fail "PER_FAMILY=0" "expected 79, got $n_all" + +# --- LIMIT_PER_CWE: rejected when it would cap, accepted when inert --------- +# +# These two are the only assertions that execute the real runner, and they are +# sandboxed: JULIET_DIR points at nothing and RESULTS_DIR at a temp directory. +# That matters for three reasons. The runner is not a library -- sourcing or +# calling it starts compiling and analysing -- so an unsandboxed call creates +# result directories in the working tree (it did, before this was fixed). It +# would also make the test depend on the 570 MB Juliet submodule and on a +# working clang, neither of which the sampling logic needs. And it would be +# slow, where the whole point is a guard that trips in milliseconds. +# +# The assertion is on the exit code as well as the message, because "did not +# print the LIMIT_PER_CWE error" is satisfied by any other failure too. Exit 2 +# is the guard; exit 1 is the stubs check further down, which only runs if the +# guard let execution through -- so it is positive evidence, not absence. +run_guard() { + local tmp out rc=0 + tmp=$(mktemp -d) + out=$(JULIET_DIR="$tmp/absent" RESULTS_DIR="$tmp/out" bash "$RUNNER" 2>&1) || rc=$? + rm -rf "$tmp" + printf '%s\n__RC__%s\n' "$out" "$rc" +} + +got=$(LIMIT_PER_CWE=60 run_guard) +if echo "$got" | grep -q 'FATAL: LIMIT_PER_CWE' && echo "$got" | grep -q '__RC__2'; then + ok "LIMIT_PER_CWE=60 aborts with exit 2 (it is the v3 sampling bias)" +else + fail "LIMIT_PER_CWE=60" "expected the guard and exit 2, got: $(echo "$got" | tr '\n' ' ' | cut -c1-90)" +fi + +got=$(LIMIT_PER_CWE=0 run_guard) +if echo "$got" | grep -q 'FATAL: LIMIT_PER_CWE'; then + fail "LIMIT_PER_CWE=0" "0 meant 'unlimited' and was a no-op; must not abort" +elif echo "$got" | grep -q 'FATAL: juliet_stubs.c failed to compile'; then + ok "LIMIT_PER_CWE=0 passes the guard (reaches the stubs check downstream)" +else + fail "LIMIT_PER_CWE=0" "expected to reach the stubs check, got: $(echo "$got" | tr '\n' ' ' | cut -c1-90)" +fi + +# Nothing above may have written into the repository. +if [ -e "$SCRIPT_DIR/../juliet/results" ]; then + fail "no side effects" "the runner created tests/juliet/results in the working tree" +else + ok "no results directories created in the working tree" +fi + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_ktest_object_names.sh b/tests/integration/test_ktest_object_names.sh new file mode 100755 index 000000000..0b99e554c --- /dev/null +++ b/tests/integration/test_ktest_object_names.sh @@ -0,0 +1,120 @@ +#!/bin/bash +# test_ktest_object_names.sh -- symbolic objects must be named by their type. +# +# KLEE writes one .ktest per explored path, and each holds that path's input +# vector: the symbolic objects in the order the program consumed them. That is +# exactly the material a Cover-Branches suite is made of, produced by the +# engine at no cost and without perturbing the search. +# +# What a .ktest records per object is a NAME, a SIZE and the bytes -- not a +# type. So the name is the only place the type can travel, and it got there by +# accident of a macro: +# +# klee_make_symbolic(&non_det, sizeof(non_det), "non_det_#type"); +# +# `#type` inside a string literal is not the stringify operator, it is the two +# characters # and t. Every object in every .ktest was called "non_det_#type", +# identical for an int, a double and a char. Nothing read it, so nothing broke, +# and it survived every baseline this tool has run. +# +# This test exists because the bug was invisible: the suites were correct, the +# verdicts were correct, and only a consumer of the .ktest files would ever +# notice. Now there is one. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +KTEST_TOOL="$MAP2CHECK_DIR/bin/ktest-tool" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +# Two different types, so a name that ignored the type would collide visibly. +# The sizes differ too (4 and 1), which is what makes the collision harmful: +# without the name there is nothing to say whether one byte is a char or the +# low byte of something wider. +cat > "$WORK/typed.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern char __VERIFIER_nondet_char(void); +extern void reach_error(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + char c = __VERIFIER_nondet_char(); + if (a == 42 && c == 'z') { reach_error(); } + return 0; +} +EOF + +echo "=== KLEE symbolic object names ===" + +if [ ! -x "$KTEST_TOOL" ]; then + fail "ktest-tool available" "not found at $KTEST_TOOL" + echo " Results: $PASSED passed, $FAILED failed" + exit 1 +fi + +# --debug keeps the scratch directory, which is where klee-last lives. +( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 250 \ + "$MAP2CHECK" --target-function --target-function-name reach_error \ + --nondet-generator symex --debug --timeout 120 typed.c ) \ + > "$WORK/run.log" 2>&1 + +scratch=$(find "$WORK" -maxdepth 1 -name '*.map2check' -print -quit) +if [ -z "$scratch" ]; then + fail "scratch directory kept" "no *.map2check directory under --debug" + echo " Results: $PASSED passed, $FAILED failed" + exit 1 +fi + +# -L: klee-last is a symlink to klee-out-N, and find does not descend into a +# symlinked start point without it. Without the -L this reported "no ktest +# files" on a run that had produced three. +mapfile -t ktests < <(find -L "$scratch/klee-last" -name '*.ktest' 2>/dev/null | sort) +if [ "${#ktests[@]}" -ge 1 ]; then + ok "KLEE produced per-path test vectors (${#ktests[@]})" +else + fail "ktest files" "none produced" + echo " Results: $PASSED passed, $FAILED failed" + exit 1 +fi + +# The last one is the deepest path, the one that satisfied both conditions. +dump=$("$KTEST_TOOL" "${ktests[-1]}" 2>&1) + +if echo "$dump" | grep -q "non_det_#type"; then + fail "object names carry the type" \ + "still the literal 'non_det_#type' -- the macro does not stringify" +else + ok "no object is named with the unexpanded macro text" +fi + +if echo "$dump" | grep -q "name: 'non_det_int'"; then + ok "the int read is named non_det_int" +else + fail "int object name" "$(echo "$dump" | grep -m1 name)" +fi + +if echo "$dump" | grep -q "name: 'non_det_char'"; then + ok "the char read is named non_det_char" +else + fail "char object name" "$(echo "$dump" | grep -m2 name | tail -1)" +fi + +# Names alone are not enough: the pairing of name to size is what lets a +# consumer decode the bytes. A char named non_det_int would be worse than no +# name at all. +if echo "$dump" | grep -A1 "name: 'non_det_char'" | grep -q "size: 1"; then + ok "non_det_char is one byte, as its name promises" +else + fail "char object size" "not 1" +fi + +echo " ---" +echo " Results: $PASSED passed, $FAILED failed" +[ "$FAILED" -eq 0 ] || exit 1 diff --git a/tests/integration/test_main_argv.sh b/tests/integration/test_main_argv.sh new file mode 100755 index 000000000..c7c302be5 --- /dev/null +++ b/tests/integration/test_main_argv.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# test_main_argv.sh — regression test for main(int argc, char *argv[]) support. +# +# Bug fixed: NonDetGeneratorKlee.c / NonDetGeneratorLibFuzzy.c used to call +# __map2check_main__() with no arguments, so any program whose main takes +# (argc, argv) hit KLEE's "calling function with too few arguments" error and +# was reported UNKNOWN (safe programs could never be verified TRUE). +# +# This test compiles a buggy and a safe program, both using main(argc, argv), +# and asserts the verdicts are FALSE and TRUE respectively. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +TMPDIR=$(mktemp -d) +trap 'rm -rf "$TMPDIR"' EXIT + +PASSED=0 +FAILED=0 + +cat > "$TMPDIR/argv_bug.c" <<'EOF' +/* NULL dereference, always reached, in a main(argc, argv) program */ +int main(int argc, char *argv[]) { + int *a = 0; + (void)argc; + (void)argv; + return *a; +} +EOF + +cat > "$TMPDIR/argv_safe.c" <<'EOF' +/* No bug, in a main(argc, argv) program */ +int main(int argc, char *argv[]) { + (void)argc; + (void)argv; + return 0; +} +EOF + +run() { + local src="$1" expect="$2" name="$3" + local bc="$TMPDIR/$name.bc" + + "$CLANG" -c -emit-llvm -g -O0 "$src" -o "$bc" 2>/dev/null || { + echo " SKIP $name: compile failed" + return + } + + local output + output=$(timeout 120 "$MAP2CHECK" --memtrack --timeout 60 "$bc" 2>&1) || true + + if [ "$expect" = "FALSE" ]; then + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " PASS $name: vulnerability detected" + PASSED=$((PASSED+1)) + else + echo " FAIL $name: expected FALSE, got:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + else + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " FAIL $name: expected TRUE, got FALSE" + FAILED=$((FAILED+1)) + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + echo " PASS $name: no false alarm" + PASSED=$((PASSED+1)) + else + echo " FAIL $name: expected TRUE, got UNKNOWN" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + fi +} + +echo "============================================================" +echo "Map2Check main(argc, argv) Regression" +echo "============================================================" +run "$TMPDIR/argv_bug.c" FALSE argv_bug +run "$TMPDIR/argv_safe.c" TRUE argv_safe +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_memsafety_classifier.sh b/tests/integration/test_memsafety_classifier.sh new file mode 100755 index 000000000..d25d95097 --- /dev/null +++ b/tests/integration/test_memsafety_classifier.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# Table test for classify_memsafety_result: a FALSE only counts when its kind +# matches the task's subproperty; a TRUE on a false task is the dangerous error. +set -u +. "$(dirname "$0")/../lib/memsafety_classifier.sh" +PASSED=0; FAILED=0 +check() { # expected subproperty verdict want + got=$(classify_memsafety_result "$1" "$2" "$3") + if [ "$got" = "$4" ]; then PASSED=$((PASSED+1)); else FAILED=$((FAILED+1)); echo " FAIL $1/$2/$3: want $4 got $got"; fi +} +check true "" TRUE correct-true +check true "" FALSE-DEREF wrong-false +check false valid-deref FALSE-DEREF correct-false +check false valid-free FALSE-FREE correct-false +check false valid-memtrack FALSE-MEMTRACK correct-false +check false valid-memcleanup FALSE-MEMCLEANUP correct-false +check false valid-deref FALSE-FREE wrong-false +check false valid-deref TRUE wrong-true +check false valid-deref UNKNOWN unknown +check false valid-deref TIMEOUT unknown +check true "" ERROR error +check false no-overflow FALSE-OVERFLOW correct-false +check false no-overflow FALSE-DEREF wrong-false +check true "" FALSE-OVERFLOW wrong-false +# sv-benchmarks' Juliet_Test MemSafety tasks declare no subproperty: any +# memory FALSE is the right answer there, but not a leak-at-exit or overflow. +check false any FALSE-DEREF correct-false +check false any FALSE-MEMTRACK correct-false +check false any FALSE-OVERFLOW wrong-false +echo " Results: $PASSED passed, $FAILED failed" +[ "$FAILED" -eq 0 ] diff --git a/tests/integration/test_modes.sh b/tests/integration/test_modes.sh new file mode 100755 index 000000000..3395ecaed --- /dev/null +++ b/tests/integration/test_modes.sh @@ -0,0 +1,167 @@ +#!/bin/bash +# test_modes.sh — regression test for the non-memtrack analysis modes. +# +# Bug caught: caller.cpp passed -m2c-entry-function to opt unconditionally, but +# that cl::opt is registered only by MemoryTrackPass. In --check-overflow, +# --check-asserts and --target-function modes (which do not load MemoryTrackPass) +# opt aborted with "Unknown command line argument '-m2c-entry-function'", so main +# was never renamed and every program was reported ERROR/UNKNOWN. +# +# This test exercises each mode with a buggy and a safe program and asserts a +# definitive verdict (FALSE / TRUE), so any such regression fails the build. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +TMPDIR=$(mktemp -d) +trap 'rm -rf "$TMPDIR"' EXIT + +PASSED=0 +FAILED=0 + +cat > "$TMPDIR/ov_bug.c" <<'EOF' +#include +int main(void) { int x = 2147483647; int y = x + 1; return y; } +EOF + +cat > "$TMPDIR/ov_safe.c" <<'EOF' +int main(void) { int x = 1; int y = x + 1; return y; } +EOF + +# 64-bit arithmetic. OverflowPass used to declare the binop checkers with i64 +# operands while the runtime took int, so the check read garbage; the first fix +# aligned both at i32, which made every long/long long operation skip +# instrumentation entirely. SV-COMP defines no-overflow over the result type of +# the operation, so both widths must be reported -- and widening i32 operands to +# 64 bits must not mask the i32 cases above (ov_bug guards that direction). +cat > "$TMPDIR/ov_bug_ll.c" <<'EOF' +#include +int main(void) { long long x = LLONG_MAX; long long y = x + 1; return (int)y; } +EOF + +cat > "$TMPDIR/ov_safe_ll.c" <<'EOF' +#include +int main(void) { long long x = INT_MAX; long long y = x + 1; return (int)(y >> 1); } +EOF + +cat > "$TMPDIR/ov_bug_ll_mul.c" <<'EOF' +#include +int main(void) { long long x = 4294967296LL; long long y = x * x; return (int)y; } +EOF + +cat > "$TMPDIR/div_bug.c" <<'EOF' +int main(void) { int a = 10; int b = 0; return a / b; } +EOF + +cat > "$TMPDIR/div_safe.c" <<'EOF' +int main(void) { int a = 10; int b = 2; return a / b; } +EOF + +# INT_MIN / -1 overflows: the quotient is one past INT_MAX. The old runtime +# check used || where it needed &&, so it also fired on safe divisions. +cat > "$TMPDIR/div_min_bug.c" <<'EOF' +#include +int main(void) { int a = INT_MIN; int b = -1; return a / b; } +EOF + +cat > "$TMPDIR/div_min_safe.c" <<'EOF' +#include +int main(void) { int a = INT_MIN; int b = 1; return a / b; } +EOF + +# SRem was an empty case in the pass, so "x % 0" went entirely unchecked. +cat > "$TMPDIR/mod_bug.c" <<'EOF' +int main(void) { int a = 10; int b = 0; return a % b; } +EOF + +cat > "$TMPDIR/mod_safe.c" <<'EOF' +int main(void) { int a = 10; int b = 3; return a % b; } +EOF + +cat > "$TMPDIR/as_bug.c" <<'EOF' +extern void __VERIFIER_assert(int); +int main(void) { int x = 0; __VERIFIER_assert(x > 0); return 0; } +EOF + +cat > "$TMPDIR/as_safe.c" <<'EOF' +extern void __VERIFIER_assert(int); +int main(void) { int x = 1; __VERIFIER_assert(x > 0); return 0; } +EOF + +cat > "$TMPDIR/as_libc_bug.c" <<'EOF' +#include +int main(void) { int x = 0; assert(x > 0); return 0; } +EOF + +cat > "$TMPDIR/tg_bug.c" <<'EOF' +extern void __VERIFIER_error(void); +int main(void) { __VERIFIER_error(); return 0; } +EOF + +cat > "$TMPDIR/tg_safe.c" <<'EOF' +extern void __VERIFIER_error(void); +int main(void) { return 0; } +EOF + +run() { + local src="$1" mode="$2" expect="$3" name="$4" + local bc="$TMPDIR/$name.bc" + + "$CLANG" -c -emit-llvm -g -O0 "$src" -o "$bc" 2>/dev/null || { + echo " SKIP $name: compile failed" + return + } + + local output + output=$(timeout 120 "$MAP2CHECK" $mode --timeout 60 "$bc" 2>&1) || true + + if [ "$expect" = "FALSE" ]; then + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " PASS $name [$mode]: vulnerability detected" + PASSED=$((PASSED+1)) + else + echo " FAIL $name [$mode]: expected FALSE, got:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + else + if echo "$output" | grep -qE "VERIFICATION FAILED|FALSE_"; then + echo " FAIL $name [$mode]: expected TRUE, got FALSE" + FAILED=$((FAILED+1)) + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + echo " PASS $name [$mode]: no false alarm" + PASSED=$((PASSED+1)) + else + echo " FAIL $name [$mode]: expected TRUE, got UNKNOWN/ERROR:" + echo "$output" | tail -5 + FAILED=$((FAILED+1)) + fi + fi +} + +echo "============================================================" +echo "Map2Check Non-Memtrack Modes Regression" +echo "============================================================" +run "$TMPDIR/ov_bug.c" "--check-overflow" FALSE overflow_bug +run "$TMPDIR/ov_safe.c" "--check-overflow" TRUE overflow_safe +run "$TMPDIR/ov_bug_ll.c" "--check-overflow" FALSE overflow_bug_longlong +run "$TMPDIR/ov_safe_ll.c" "--check-overflow" TRUE overflow_safe_longlong +run "$TMPDIR/ov_bug_ll_mul.c" "--check-overflow" FALSE overflow_bug_longlong_mul +run "$TMPDIR/div_bug.c" "--check-overflow" FALSE div_bug +run "$TMPDIR/div_safe.c" "--check-overflow" TRUE div_safe +run "$TMPDIR/div_min_bug.c" "--check-overflow" FALSE div_min_overflow_bug +run "$TMPDIR/div_min_safe.c" "--check-overflow" TRUE div_min_safe +run "$TMPDIR/mod_bug.c" "--check-overflow" FALSE mod_by_zero_bug +run "$TMPDIR/mod_safe.c" "--check-overflow" TRUE mod_safe +run "$TMPDIR/as_bug.c" "--check-asserts" FALSE assert_bug +run "$TMPDIR/as_safe.c" "--check-asserts" TRUE assert_safe +run "$TMPDIR/as_libc_bug.c" "--check-asserts" FALSE assert_libc_bug +run "$TMPDIR/tg_bug.c" "--target-function --target-function-name __VERIFIER_error" FALSE target_bug +run "$TMPDIR/tg_safe.c" "--target-function --target-function-name __VERIFIER_error" TRUE target_safe +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_target_coverage.sh b/tests/integration/test_target_coverage.sh new file mode 100755 index 000000000..5aab5c024 --- /dev/null +++ b/tests/integration/test_target_coverage.sh @@ -0,0 +1,104 @@ +#!/bin/bash +# test_target_coverage.sh -- reachability targets that are never called. +# +# TargetPass instruments CALL SITES whose callee matches --target-function-name. +# If the program never calls that function, nothing is instrumented, and the +# reachability property holds for a reason that has nothing to do with the +# program: the target simply is not there. +# +# That is not an error, and this test does not treat it as one. A program that +# genuinely never calls reach_error IS safe with respect to reach_error, and +# TRUE is the right answer. The defect is that such a TRUE is indistinguishable +# in the output from a TRUE earned by exploring the program. +# +# That indistinguishability is finding B, and it is not hypothetical. The +# CASTLE harness mapped seven CWEs onto `--target-function-name main`; a +# program does not call its own entry point, so zero sites were instrumented. +# On the v6 baseline, 98 of 217 runs went through that mode: 57 TRUE, 22 +# TIMEOUT, 9 ERROR, 10 UNKNOWN -- and not one FALSE, across 59 programs known +# to be vulnerable. Twelve of them were scored as true negatives. +# +# So the contract asserted here is about VISIBILITY: the trivial case must +# announce itself, and the real case must not cry wolf. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +# One program, used for both cases. It really does call reach_error, so the +# difference between the two runs below is only which name is asked for -- +# which is the point: the same program is trivially safe with respect to a +# target it does not contain, and genuinely analysable with respect to one it +# does. +cat > "$WORK/prog.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x == 7) { + reach_error(); + } + return 0; +} +EOF + +MARKER="is never called in this module" + +echo "=== Target coverage warning ===" + +# --- Case 1: a target the program really calls ------------------------------- +# The budget is small on purpose. The warning is emitted during instrumentation, +# long before any solving, so this test never needs the analysis to finish. +out_real=$( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 5 90 \ + "$MAP2CHECK" --target-function --target-function-name reach_error \ + --timeout 10 prog.c 2>&1 ) + +if echo "$out_real" | grep -q "$MARKER"; then + fail "a called target stays quiet" \ + "warned about reach_error, which this program does call" +else + ok "a called target stays quiet" +fi + +# --- Case 2: the degenerate target (finding B) ------------------------------- +out_main=$( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 5 90 \ + "$MAP2CHECK" --target-function --target-function-name main \ + --timeout 10 prog.c 2>&1 ) + +if echo "$out_main" | grep -q "$MARKER"; then + ok "an uncalled target announces itself" +else + fail "an uncalled target announces itself" \ + "no warning for --target-function-name main, which nothing calls" +fi + +# The warning has to name the target. A generic "target not found" would send +# whoever reads the log looking for the wrong thing. +if echo "$out_main" | grep -q "'main'"; then + ok "the warning names the target it is about" +else + fail "the warning names the target it is about" "target name absent" +fi + +# And it has to say what the verdict is worth, not just that something is +# missing. "TRUE means the target is absent, not that the program is safe" is +# the part a reader acts on. +if echo "$out_main" | grep -qi "not that the program is safe"; then + ok "the warning says what a TRUE verdict is worth here" +else + fail "the warning says what a TRUE verdict is worth here" \ + "no statement about the meaning of the verdict" +fi + +echo " ---" +echo " Results: $PASSED passed, $FAILED failed" +[ "$FAILED" -eq 0 ] || exit 1 diff --git a/tests/integration/test_test_suite_emission.sh b/tests/integration/test_test_suite_emission.sh new file mode 100644 index 000000000..a95030140 --- /dev/null +++ b/tests/integration/test_test_suite_emission.sh @@ -0,0 +1,189 @@ +#!/bin/bash +# test_test_suite_emission.sh -- the --generate-test-suite contract. +# +# Asserts structure, not coverage. Whether the suite actually reproduces the +# bug is TestCov's question and is asked by a separate gate; what is checked +# here is the part nothing else covers -- that the files exist, are well-formed +# XML, carry the right public identifiers, and that the input sequence is the +# sequence the program consumed. +# +# The ordering assertion is the important one. A suite with the right values in +# the wrong order is structurally perfect and worth exactly zero points, and +# nothing about the run looks wrong when it happens. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +# Two nondet reads, one error reachable only when both match. The suite must +# therefore carry 42 then 7, in that order. +cat > "$WORK/target.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a == 42) { + if (b == 7) { + reach_error(); + } + } + return 0; +} +EOF + +echo "============================================================" +echo "Test-Comp test-suite emission" +echo "============================================================" + +( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 \ + "$MAP2CHECK" --target-function --target-function-name reach_error \ + --generate-test-suite --nondet-generator symex --timeout 120 target.c ) \ + > "$WORK/run.log" 2>&1 + +SUITE="$WORK/test-suite" + +if [ -d "$SUITE" ]; then + ok "test-suite/ directory created" +else + fail "suite directory" "not created" + tail -15 "$WORK/run.log" + echo "Results: $PASSED passed, $FAILED failed" + exit 1 +fi + +[ -f "$SUITE/metadata.xml" ] && ok "metadata.xml written" \ + || fail "metadata.xml" "absent" + +n_tc=$(find "$SUITE" -name 'testcase-*.xml' | wc -l) +[ "$n_tc" -ge 1 ] && ok "at least one testcase file ($n_tc)" \ + || fail "testcase files" "none written" + +# Well-formedness checked by a real parser, not by grepping. Python's expat is +# used rather than xmllint because it ships with the image; the DOCTYPE is +# external and must not be fetched, hence the no-op entity resolver. +bad=0 +for f in "$SUITE"/*.xml; do + python3 - "$f" <<'PY' || { bad=1; echo " malformed: $f"; } +import sys, xml.parsers.expat +p = xml.parsers.expat.ParserCreate() +p.ExternalEntityRefHandler = lambda *a: 1 +try: + with open(sys.argv[1], 'rb') as fh: + p.ParseFile(fh) +except Exception as e: + print(" ", e) + sys.exit(1) +PY +done +[ "$bad" -eq 0 ] && ok "every emitted file is well-formed XML" \ + || fail "well-formedness" "a file failed to parse" + +grep -q 'DTD test-format test-metadata 1.1//EN' "$SUITE/metadata.xml" \ + && ok "metadata carries the 1.1 public identifier" \ + || fail "metadata doctype" "public identifier missing or wrong" + +grep -q 'C' "$SUITE/metadata.xml" \ + && ok "sourcecodelang is C" || fail "sourcecodelang" "wrong or missing" + +grep -qE '[0-9a-f]{64}' "$SUITE/metadata.xml" \ + && ok "programhash is 64 hex characters" \ + || fail "programhash" "not a SHA-256 digest" + +# It must be the hash OF THE PROGRAM, so sha256sum has to agree exactly. +want=$(sha256sum "$WORK/target.c" | cut -d' ' -f1) +got=$(sed -n 's:.*\(.*\).*:\1:p' "$SUITE/metadata.xml") +[ "$want" = "$got" ] && ok "programhash matches sha256sum of the program" \ + || fail "programhash value" "want $want, got $got" + +first_tc=$(find "$SUITE" -name 'testcase-*.xml' | sort | head -1) + +grep -q 'DTD test-format testcase 1.1//EN' "$first_tc" \ + && ok "testcase carries the 1.1 public identifier" \ + || fail "testcase doctype" "public identifier missing or wrong" + +grep -q 'coversError="true"' "$first_tc" \ + && ok "the violating test case is marked coversError" \ + || fail "coversError" "not set on a run that found the error" + +mapfile -t inputs < <(sed -n 's:.*\(.*\).*:\1:p' "$first_tc") +if [ "${#inputs[@]}" -eq 2 ] && [ "${inputs[0]}" = "42" ] && [ "${inputs[1]}" = "7" ]; then + ok "inputs are 42 then 7, in consumption order" +else + fail "input vector" "expected [42, 7], got [${inputs[*]}]" +fi + +# --- the nondet log's own shape ----------------------------------------------- +# The suite is only as good as the CSV it is serialized from, and that CSV is +# written by the C runtime, where nothing else checks it. An UNSIGNED row used +# to come out with EIGHT fields instead of seven: the UNSIGNED arm of the writer +# was an `if` with no `else`, so the value was printed once as %u and again as +# %d. It parsed by accident -- the value column is first, so it still landed at +# index 5 -- while the type column silently moved to index 7. +# +# Checked on __VERIFIER_nondet_unsigned specifically: __VERIFIER_nondet_uint is +# tagged UINT, a different enumerator, and takes the arm that was always right. +# +# Runs in its own subdirectory, because --debug keeps the scratch directory and +# the cleanup assertion below looks for exactly that at depth 1 of $WORK. +UWORK="$WORK/unsigned_run" +mkdir -p "$UWORK" +cat > "$UWORK/unsigned.c" <<'EOF' +extern unsigned __VERIFIER_nondet_unsigned(void); +extern void reach_error(void); +int main(void) { + unsigned u = __VERIFIER_nondet_unsigned(); + if (u == 5u) { reach_error(); } + return 0; +} +EOF + +( + cd "$UWORK" || exit 1 + MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error \ + --nondet-generator symex --debug --timeout 120 unsigned.c +) > "$UWORK/unsigned.log" 2>&1 + +csv=$(find "$UWORK" -name klee_log.csv -print -quit) +if [ -z "$csv" ]; then + fail "unsigned nondet log" "no klee_log.csv produced" +else + malformed=$(awk -F';' 'NF != 7 {print NF" fields: "$0}' "$csv" | head -1) + if [ -z "$malformed" ]; then + ok "every nondet log row has exactly 7 fields" + else + fail "nondet log row shape" "$malformed" + fi + + # The type column is the one the duplicated value displaced. UNSIGNED is 5 in + # enum NONDET_TYPE, and it has to be readable as the LAST field. + last=$(awk -F';' 'NR==1{print $7}' "$csv") + if [ "$last" = "5" ]; then + ok "the type column survives as the last field (UNSIGNED=5)" + else + fail "type column" "last field is '$last', expected 5" + fi +fi + +# The suite must survive cleanGarbage(), which removes the scratch directory. +if [ -z "$(find "$WORK" -maxdepth 1 -name '*.map2check' -print -quit)" ]; then + ok "scratch directory cleaned and the suite survived" +else + fail "cleanup" "scratch directory left behind" +fi + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_testcomp_regressions.sh b/tests/integration/test_testcomp_regressions.sh new file mode 100755 index 000000000..8af6dd24d --- /dev/null +++ b/tests/integration/test_testcomp_regressions.sh @@ -0,0 +1,1388 @@ +#!/bin/bash +# test_testcomp_regressions.sh -- the five defects the Test-Comp corpus caught. +# +# Every one of these was invisible to the tests that existed. They produced +# well-formed output, plausible verdicts and green runs; what they did not +# produce was a suite a validator would accept. They were found by running 2340 +# real tasks and reading the numbers, which is expensive, so each one gets a +# cheap test here to make sure it is found for free next time. +# +# 1 a Cover-Error suite with no at all (290 of 376 FAILED runs) +# 2 --property-file ignored when relative (every task in the corpus) +# 3 --cover-branches loading the memtrack pipeline (110 of 110 ProductLines) +# 4 MemoryTrackPass emitting a type-mismatched call (same 110, plus ECA) +# 5 a branch suite too large for TestCov to check (116 validation failures) +# 6 KLEE killed by the budget, discarding everything (3982 paths -> 0 tests) + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" + +PASSED=0 +FAILED=0 +ok() { echo " PASS $1"; PASSED=$((PASSED+1)); } +fail() { echo " FAIL $1: $2"; FAILED=$((FAILED+1)); } + +WORK=$(mktemp -d) +trap 'rm -rf "$WORK"' EXIT + +echo "=== Test-Comp regressions ===" + +# --- 1. a Cover-Error suite must carry the input vector ---------------------- +# The state that reaches the target aborts, and an aborted KLEE state runs no +# exit handler, so the runtime's klee_log.csv is never written. The suite used +# to come out with a testcase element and nothing inside it: the tool had found +# the bug and could not prove it. KLEE's own .ktest for the failing path holds +# the vector, and that is now the fallback. +mkdir -p "$WORK/one" +cat > "$WORK/one/reach.prp" <<'EOF' +COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) ) +EOF +cat > "$WORK/one/reach.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + if (a == 4242) { reach_error(); } + return 0; +} +EOF +( cd "$WORK/one" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --generate-test-suite --property-file reach.prp --timeout 120 reach.c ) \ + > "$WORK/one/run.log" 2>&1 + +inputs=$(sed -n 's:.*\(.*\).*:\1:p' "$WORK/one/test-suite/testcase-1.xml" 2>/dev/null) +if [ -n "$inputs" ]; then + ok "a Cover-Error test case carries its input vector [$(echo $inputs | tr '\n' ' ')]" +else + fail "Cover-Error inputs" "test case has no -- the suite proves nothing" + tail -4 "$WORK/one/run.log" | sed 's/^/ /' +fi + +# --- 2. a relative --property-file must be read ------------------------------ +# resolveSpecification runs after the pipeline has chdir'd into the scratch +# directory, so a relative path -- what BenchExec and every harness here pass -- +# resolved against the wrong place and fell through to a guessed specification. +# +# The property text below is DELIBERATELY not one of the two the fallback +# guesses. That is the whole difficulty: with a real property file the guess +# happens to match, so the bug produced identical output and no test could see +# it. Only a specification the tool could not have invented proves it was read. +mkdir -p "$WORK/spec" +cat > "$WORK/spec/custom.prp" <<'EOF' +COVER( init(main()), FQL(COVER EDGES(@CALL(a_marker_no_fallback_would_guess))) ) +EOF +cp "$WORK/one/reach.c" "$WORK/spec/" +( cd "$WORK/spec" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --generate-test-suite --property-file custom.prp --timeout 60 reach.c ) \ + > "$WORK/spec/run.log" 2>&1 + +if grep -q "a_marker_no_fallback_would_guess" "$WORK/spec/test-suite/metadata.xml" 2>/dev/null; then + ok "a relative --property-file reaches verbatim" +else + fail "property file" "metadata does not carry the supplied specification" + grep -o ".*" "$WORK/spec/test-suite/metadata.xml" 2>/dev/null | sed 's/^/ got: /' +fi +if grep -q "could not read property file" "$WORK/spec/run.log"; then + fail "property file resolution" "still reported unreadable" +else + ok "no 'could not read property file' warning" +fi + +# --- 3. --cover-branches must not run the memory-tracking pipeline ----------- +# With no mode flag the run fell through to the MEMTRACK default and +# instrumented memory tracking for a task that checks no property: pure +# overhead, and on some programs a broken module. +mkdir -p "$WORK/lean" +cat > "$WORK/lean/branches.prp" <<'EOF' +COVER( init(main()), FQL(COVER EDGES(@DECISIONEDGE)) ) +EOF +cat > "$WORK/lean/lean.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 0) { return 1; } + return 2; +} +EOF +( cd "$WORK/lean" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --nondet-generator symex --generate-test-suite --cover-branches \ + --property-file branches.prp --debug --timeout 60 lean.c ) \ + > "$WORK/lean/run.log" 2>&1 + +if grep -q "memory-track" "$WORK/lean/run.log"; then + fail "lean pipeline" "--cover-branches still loads the memory-track pass" +else + ok "--cover-branches runs without the memory-track pass" +fi + +# --- 4. MemoryTrackPass must coerce the size to the declared parameter type -- +# The helper is registered with an i64 size and the operand comes straight from +# the program's own call. A program allocating with a narrower integer -- which +# is what the CIL-processed sources in ProductLines and ECA do -- produced a +# call whose argument type did not match its signature, and LLVM rejected the +# module outright, two seconds into a sixty-second budget. +mkdir -p "$WORK/i32" +cat > "$WORK/i32/narrow.c" <<'EOF' +/* Declares malloc with a 32-bit size, as CIL-processed sources do. */ +extern void *malloc(unsigned int size); +extern void free(void *p); +extern int __VERIFIER_nondet_int(void); +int main(void) { + unsigned int n = 16; + char *p = (char *)malloc(n); + if (p) { + p[0] = (char)__VERIFIER_nondet_int(); + free(p); + } + return 0; +} +EOF +( cd "$WORK/i32" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 60 narrow.c ) \ + > "$WORK/i32/run.log" 2>&1 + +if grep -qE "Broken module|does not match function signature" "$WORK/i32/run.log"; then + fail "size coercion" "memtrack still emits a type-mismatched call" + grep -m2 -E "Broken module|does not match" "$WORK/i32/run.log" | sed 's/^/ /' +else + ok "memtrack instruments a 32-bit allocation without breaking the module" +fi + +# --- 5. the branch suite must stay small enough to validate ------------------ +# Of 116 tasks whose validation failed outright, 115 had at least 100 test +# cases and the median was exactly 500 -- the old cap. Suites that large cannot +# be checked in the time available, so the extra vectors scored nothing and +# cost everything. +mkdir -p "$WORK/cap" +cp "$WORK/lean/branches.prp" "$WORK/cap/" +# Six independent branches: 64 terminating paths, comfortably more than the cap +# and few enough that KLEE finishes them well inside the budget. The assertion +# is EQUALITY, not "at most 50" -- a suite that came out empty would satisfy an +# upper bound while proving nothing, which is exactly how the first version of +# this test passed against a run that produced zero test cases. +cat > "$WORK/cap/many.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int total = 0; + for (int i = 0; i < 6; i++) { + int x = __VERIFIER_nondet_int(); + if (x > i) { total += 1; } else { total -= 1; } + } + return total; +} +EOF +( cd "$WORK/cap" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 250 "$MAP2CHECK" \ + --nondet-generator symex --generate-test-suite --cover-branches \ + --property-file branches.prp --timeout 120 many.c ) \ + > "$WORK/cap/run.log" 2>&1 + +n=$(ls "$WORK/cap/test-suite"/testcase-*.xml 2>/dev/null | wc -l) +if [ "$n" -eq 50 ]; then + ok "a 64-path program is capped to exactly 50 test cases" +else + fail "suite cap" "$n test cases, expected exactly 50 (64 paths, cap 50)" + tail -3 "$WORK/cap/run.log" | sed 's/^/ /' +fi + +# --- 6. KLEE must keep the paths it explored when its budget runs out -------- +# The tests are written by KLEE as states terminate, and an external `timeout` +# that kills it discards every one. Measured before the fix: a program with +# twelve nondeterministic reads explored 3982 paths and produced ZERO .ktest +# files. Reaching the budget is the normal case in a competition run, so this +# was the common path throwing away all of its work. +mkdir -p "$WORK/deep" +cp "$WORK/lean/branches.prp" "$WORK/deep/" +cat > "$WORK/deep/deep.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int total = 0; + for (int i = 0; i < 12; i++) { + int x = __VERIFIER_nondet_int(); + if (x > i) { total += 1; } else { total -= 1; } + } + return total; +} +EOF +( cd "$WORK/deep" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --nondet-generator symex --generate-test-suite --cover-branches \ + --property-file branches.prp --timeout 90 deep.c ) \ + > "$WORK/deep/run.log" 2>&1 + +n_deep=$(ls "$WORK/deep/test-suite"/testcase-*.xml 2>/dev/null | wc -l) +if [ "$n_deep" -gt 0 ]; then + ok "a path-heavy program still yields a suite ($n_deep test cases)" +else + fail "budget exhaustion" "no test cases -- KLEE's exploration was discarded" + tail -3 "$WORK/deep/run.log" | sed 's/^/ /' +fi + +# --- 7. an assumption must prune the path, not abort ------------------------ +# The SV-COMP idiom for an assumption is a function that aborts: +# +# void assume_abort_if_not(int cond) { if (!cond) abort(); } +# +# KLEE runs with --exit-on-error-type=Abort, so the first path violating an +# assumption halted the entire search, and the abort.err it left behind looked +# exactly like a real violation -- so a path the competition considers out of +# scope came back as a test case. One measured suite carried 25 inputs and +# covered 0.0%. +# +# Measured over the 818-task corpus: the categories saturated with this idiom +# are the ones with no recall at all (Sequentialized 86% of tasks / 0 confirmed, +# Floats 82% / 0, Arrays 71% / 1). +mkdir -p "$WORK/assume" +cp "$WORK/one/reach.prp" "$WORK/assume/" +cat > "$WORK/assume/assume.c" <<'EOF' +extern void abort(void); +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +void assume_abort_if_not(int cond) { if (!cond) { abort(); } } +int main(void) { + int a = __VERIFIER_nondet_int(); + assume_abort_if_not(a >= 0); + assume_abort_if_not(a < 100); + if (a == 77) { reach_error(); } + return 0; +} +EOF +( cd "$WORK/assume" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 250 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --generate-test-suite --property-file reach.prp --timeout 120 assume.c ) \ + > "$WORK/assume/run.log" 2>&1 + +if grep -q "to prune the path instead of aborting" "$WORK/assume/run.log"; then + ok "assume_abort_if_not is rewritten to prune the path" +else + fail "assume rewriting" "the abort-based assumption was left as an abort" +fi + +# The SAME idiom under a shorter name, and the name was the whole difference. +# The XCSP family writes `void assume(int c){ if(!c) abort(); }`, which the +# first version of the list did not match -- so all 59 XCSP tasks answered +# "program correct" in two seconds, every one of them on a program with a +# reachable bug. A defect found by spelling. +mkdir -p "$WORK/assume2" +cp "$WORK/one/reach.prp" "$WORK/assume2/" +cat > "$WORK/assume2/plain.c" <<'EOF' +extern void abort(void); +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "plain.c", 3, "reach_error"); } +void assume(int cond) { if (!cond) { abort(); } } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + assume(a >= 0); + assume(a < 50); + reach_error(); + return 0; +} +EOF +( cd "$WORK/assume2" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 250 "$MAP2CHECK" --target-function --target-function-name reach_error --timeout 90 plain.c ) > "$WORK/assume2/run.log" 2>&1 + +# reach_error sits AFTER the assumptions, exactly as the XCSP programs place +# it, so a run that still aborts on the first one cannot get there. +if grep -q 'VERIFICATION FAILED' "$WORK/assume2/run.log"; then + ok "a bug behind a plain assume() is found, not called correct" +else + fail "plain assume" "got $(grep -oE 'VERIFICATION [A-Z]+' "$WORK/assume2/run.log" | tail -1) -- the program has a reachable bug" +fi + +# The error is behind two assumptions, so a run that halts on the first +# assumption violation cannot reach it. Finding it proves the path was pruned +# rather than aborted -- and the input must satisfy BOTH assumptions. +verdict=$(grep -oE 'VERIFICATION [A-Z]+' "$WORK/assume/run.log" | tail -1) +inputs=$(sed -n 's:.*\(.*\).*:\1:p' "$WORK/assume/test-suite/testcase-1.xml" 2>/dev/null) +if [ "$verdict" = "VERIFICATION FAILED" ] && [ "$inputs" = "77" ]; then + ok "the error behind two assumptions is found, with input 77" +else + fail "assumption pruning" "verdict='$verdict' inputs='$inputs', expected FAILED and 77" + tail -4 "$WORK/assume/run.log" | sed 's/^/ /' +fi + +# --- 8. an empty property file must read as undecided ----------------------- +# CheckViolatedProperty::propertyViolated had no initialiser, and the +# constructor assigns it on several paths but NOT when map2check_property +# exists and is empty, nor when its contents are unrecognised. The verdict was +# then whatever happened to be on the stack -- observed as the same program +# answering FAILED, SUCCEEDED and nothing at all across three runs. +# +# Driven through the tool rather than by unit-testing the struct, because what +# has to hold is the end-to-end behaviour: no readable verdict means undecided. +mkdir -p "$WORK/empty" +cp "$WORK/one/reach.c" "$WORK/empty/" +cp "$WORK/one/reach.prp" "$WORK/empty/" +( cd "$WORK/empty" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --debug --timeout 60 reach.c ) > "$WORK/empty/run.log" 2>&1 +scratch=$(find "$WORK/empty" -maxdepth 1 -name '*.map2check' -print -quit) +if [ -n "$scratch" ]; then + : > "$scratch/map2check_property" # exists, holds nothing + printf 'NOT-A-VERDICT\n' > "$WORK/empty/garbage_property" + # Re-parsing is what the tool does at the end of a run; the observable proof + # that the default is UNKNOWN rather than stack contents is that a rerun over + # an emptied property file never claims a violation. + ( cd "$WORK/empty" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 60 reach.c ) > "$WORK/empty/run2.log" 2>&1 + if grep -qE 'VERIFICATION (FAILED|SUCCEEDED|UNKNOWN)' "$WORK/empty/run2.log"; then + ok "a run always reports one of the three verdicts, never nothing" + else + fail "verdict reporting" "no VERIFICATION line at all" + fi +else + fail "scratch directory" "not kept under --debug" +fi + +# --- 9. every generator must report a verdict -------------------------------- +# The UNKNOWN branch was guarded on the generator being KLEE, so an undecided +# LibFuzzer run printed no verdict line at all. Every harness here parses +# stdout for one, and so does the BenchExec tool-info; silence reads as a +# crash. Whole categories came back as ERROR in the engine comparison for this +# reason alone. +mkdir -p "$WORK/verdict" +cat > "$WORK/verdict/hard.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "hard.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + /* Two exact 32-bit matches at once: a fuzzer will not stumble onto this + * inside the budget, so the run ends undecided -- which is the point. */ + if (a == 1234567 && b == 7654321) { reach_error(); } + return 0; +} +EOF +for gen in afl symex; do + ( cd "$WORK/verdict" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 120 "$MAP2CHECK" \ + --target-function --target-function-name reach_error \ + --nondet-generator "$gen" --timeout 45 hard.c ) > "$WORK/verdict/$gen.log" 2>&1 + if grep -qE 'VERIFICATION (FAILED|SUCCEEDED|UNKNOWN)' "$WORK/verdict/$gen.log"; then + ok "the $gen generator reports a verdict" + else + fail "$gen verdict" "no VERIFICATION line -- a caller reads this as a crash" + fi +done + +# --- 10. the fuzzer must reach the whole width of a type --------------------- +# Each generator took ONE byte and cast it, so a short could only be 0..255 and +# nothing negative was reachable at all -- an unsigned byte cast to a signed +# type stays non-negative. Half of every signed type was unreachable. +# +# It also blocked seeding: the byte layout IS the exchange format between the +# engines, and a KLEE vector holding short x = 4242 cannot be written into a +# slot one byte wide. sizeof(type) is what KLEE already passes to +# klee_make_symbolic, so this puts both engines on one layout. +mkdir -p "$WORK/width" +cat > "$WORK/width/neg.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "neg.c", 3, "reach_error"); } +extern short __VERIFIER_nondet_short(void); +int main(void) { + short s = __VERIFIER_nondet_short(); + if (s < 0) { reach_error(); } + return 0; +} +EOF +( cd "$WORK/width" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 150 "$MAP2CHECK" \ + --target-function --target-function-name reach_error \ + --nondet-generator afl --timeout 60 neg.c ) > "$WORK/width/run.log" 2>&1 + +if grep -q 'VERIFICATION FAILED' "$WORK/width/run.log"; then + ok "the fuzzer reaches a negative short" +else + fail "fuzzer value range" \ + "did not reach short < 0 -- half of the type is unreachable" +fi + +# --- 11. the engines must be able to hand each other input vectors ---------- +# Two engines that cover almost disjoint sets -- measured over 372 tasks, 65 +# reachable only by the fuzzer and 47 only by KLEE -- and until now they shared +# nothing. LibFuzzer did not even keep its own corpus: with no corpus directory +# it holds everything in memory and drops it when the process ends. +# +# Asserted here is the MECHANISM, not a coverage gain. Whether cooperating +# finds more is a question for the corpus, not for a unit-sized program; what +# a test can pin is that the channel exists, is off by default, and carries +# vectors in the direction it claims to. +mkdir -p "$WORK/seed" +cat > "$WORK/seed/seed.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "seed.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 100 && a < 200) { + if (b == a + 7) { reach_error(); } + } + return 0; +} +EOF + +# The 8.x fixed hybrid keeps its behaviour: no exchange unless asked. (Since +# 9.0 the default hybrid is the alternation, which exchanges seeds.) +( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 250 "$MAP2CHECK" \ + --fixed-hybrid --target-function --target-function-name reach_error \ + --debug --timeout 60 seed.c ) > "$WORK/seed/off.log" 2>&1 +# The seed store lives BESIDE the scratch directory (.seeds): every +# hybrid phase recreates the scratch directory, and a store inside it never +# reached the next phase (tacasv3a). +n_off=$(ls -d "$WORK/seed"/*.seeds 2>/dev/null | wc -l) +if [ "$n_off" -eq 0 ]; then + ok "no seed store with --fixed-hybrid and without --seed-exchange" +else + fail "default behaviour" "a seed store was created without asking" +fi +rm -rf "$WORK/seed"/*.map2check + +( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 seed.c ) > "$WORK/seed/on.log" 2>&1 +store=$(ls -d "$WORK/seed"/*.seeds 2>/dev/null | head -1) +# Only the fuzzer's own discoveries count: the Caller writes a placeholder +# seed itself, so a plain file count would pass with no copy-back. +n_on=$(ls "$store/afl" 2>/dev/null | grep -c '^afl-') +if [ -n "$store" ] && [ "$n_on" -gt 0 ]; then + ok "the fuzzer discoveries reach the seed store beside the scratch ($n_on files)" +else + fail "seed store" "no store beside the scratch directory, or no fuzzer discoveries in it" +fi + +# Without --debug the store is removed after the last phase. +rm -rf "$WORK/seed"/*.map2check "$WORK/seed"/*.seeds +( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --timeout 60 seed.c ) > "$WORK/seed/on-clean.log" 2>&1 +if [ "$(ls -d "$WORK/seed"/*.seeds 2>/dev/null | wc -l)" -eq 0 ]; then + ok "no seed store is left behind without --debug" +else + fail "seed store cleanup" "a *.seeds directory survived a run without --debug" +fi + +# KLEE -> fuzzer: its per-path vectors become seed files. Sound only because +# both engines now consume sizeof(type) per read, so concatenating a .ktest's +# objects is exactly the buffer that drives the fuzzer down the same path. +# +# The export only happens if the KLEE phase runs, and with CmpLog the fuzzer +# phase sometimes solves seed.c on its own and ends the hybrid first. That is +# not a failure of the channel, so retry a couple of times for a run where +# KLEE gets its turn; only a KLEE phase that ran and exported nothing fails. +klee_log="$WORK/seed/on.log" +for attempt in 2 3; do + grep -q "Executing Klee" "$klee_log" && break + rm -rf "$WORK/seed"/*.map2check + klee_log="$WORK/seed/on.$attempt.log" + ( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --timeout 60 seed.c ) > "$klee_log" 2>&1 +done +if grep -q "Seeded the fuzzer corpus with" "$klee_log"; then + ok "KLEE's path vectors are exported into the seed corpus" +elif ! grep -q "Executing Klee" "$klee_log"; then + ok "KLEE -> fuzzer not exercised: the fuzzer solved seed.c first in 3 runs" +else + fail "KLEE -> fuzzer" "no vectors exported" +fi + +# --- 12. slicing must degrade loudly, never silently ------------------------- +# Finding K2 measured a nondeterministic read at 1 -> 21 -> 114 -> 861 partial +# paths for 2 -> 4 reads, and most of that forking happens in code that cannot +# influence the target. Slicing removes it before KLEE ever sees it. +# +# What is asserted here is the behaviour when things are NOT ideal, because +# that is where this class of feature fails: --add-invariants spent years +# accepted and ignored (issue #54), and a slicer that quietly does nothing +# would be the same defect wearing a different name. +mkdir -p "$WORK/slice" +cp "$WORK/one/reach.c" "$WORK/slice/" + +( cd "$WORK/slice" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --slice \ + --nondet-generator symex --timeout 45 reach.c ) > "$WORK/slice/run.log" 2>&1 + +# Either the slicer is installed and slices, or it is absent and the run says +# so. What must never happen is silence. +if grep -q "Sliced with respect to" "$WORK/slice/run.log"; then + ok "the program was sliced with respect to the target" +elif grep -q "sbt-slicer is not installed" "$WORK/slice/run.log"; then + ok "an absent slicer is reported, and the run continues unsliced" +else + fail "slicing" "--slice produced neither a slice nor an explanation" +fi + +# There is no criterion to slice towards when the goal is a memory property or +# branch coverage, so asking must be refused rather than quietly ignored. +( cd "$WORK/slice" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --cover-branches --slice --nondet-generator symex --timeout 45 reach.c ) \ + > "$WORK/slice/mode.log" 2>&1 +if grep -q "applies to reachability, assert, memory and overflow properties only" "$WORK/slice/mode.log"; then + ok "--slice is refused where there is no criterion to slice towards" +else + fail "slice mode guard" "--slice was accepted in a mode that has no criterion" +fi + +# --- 13. a slice must leave KLEE something it can run ------------------------- +# sbt-slicer's --cutoff-diverging (default on) rewrites every path that cannot +# reach the criterion into a `diverge:` block calling exit(0) -- with no debug +# location. The program is compiled with -g; once KLEE links uClibc, exit has a +# body, and the verifier rejects the module ("inlinable function call in a +# function with debug info must have a !dbg location"). KLEE aborted before +# executing anything, on every sliced task with a cut path: the slice arm of +# the v15 campaign ran without its symbolic engine. +mkdir -p "$WORK/cut" +# ECA-shaped on purpose: the slicer turns a plain return from main into a +# `safe_return`, so a straight-line program never gets a `diverge:` block. A +# reactive loop whose step can take a path that never reaches the target does; +# bounded to two steps so that KLEE decides it well inside the budget. +cat > "$WORK/cut/cut.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +extern void exit(int); +int a = 1; +void step(int in) { + if (in == 5) { a = 2; return; } + if (in == 6 && a == 2) { reach_error(); } + if (in == 9) { exit(0); } +} +int main(void) { + for (int i = 0; i < 2; i++) { + int in = __VERIFIER_nondet_int(); + step(in); + } + return 0; +} +EOF +( cd "$WORK/cut" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --slice \ + --nondet-generator symex --timeout 45 cut.c ) > "$WORK/cut/run.log" 2>&1 +if grep -q "Broken module" "$WORK/cut/run.log"; then + fail "slice + KLEE" "KLEE rejected the sliced module (cutoff exit without !dbg)" +elif grep -q "VERIFICATION FAILED" "$WORK/cut/run.log"; then + ok "KLEE runs on the slice and reaches the target" +else + fail "slice + KLEE" "no FAILED verdict on a trivially reachable target" + grep -E "Sliced|Exited klee|VERIFICATION" "$WORK/cut/run.log" | sed 's/^/ /' +fi + +# --- 14. a suite found on the slice must hold on the original ---------------- +# TestCov runs the suite on the ORIGINAL program. A nondet read the slicer +# dropped -- its value does not reach the target -- is still consumed there, +# so the vector shifts: measured on ntdrivers/floppy.i.cil-1.c, FAILED and +# NOT_COVERED. The slice keeps every nondet call, so both values appear, in +# the original order. +mkdir -p "$WORK/order" +cp "$WORK/one/reach.prp" "$WORK/order/" +cat > "$WORK/order/order.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (b == 42) { reach_error(); } + return a; +} +EOF +( cd "$WORK/order" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --slice \ + --nondet-generator symex --generate-test-suite --property-file reach.prp \ + --timeout 60 order.c ) > "$WORK/order/run.log" 2>&1 +order_inputs=$(sed -n 's:.*\(.*\).*:\1:p' \ + "$WORK/order/test-suite/testcase-1.xml" 2>/dev/null | tr '\n' ' ') +if [ "$(echo $order_inputs | wc -w)" -eq 2 ] && \ + [ "$(echo $order_inputs | awk '{print $2}')" = "42" ]; then + ok "the sliced suite keeps the original read order [$order_inputs]" +else + fail "slice read order" "expected 2 inputs ending in 42, got [$order_inputs]" +fi + +# --- 15. assert mode slices towards the assertions ---------------------------- +# AssertPass instruments __VERIFIER_assert and __assert_fail, so those are the +# criteria. The program only DECLARES __VERIFIER_assert: the weak stub must +# take the condition, or llvm-link rejects the (void) definition. +mkdir -p "$WORK/assert" +cat > "$WORK/assert/assert.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern void __VERIFIER_assert(int cond); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 0) { a = a - 1; } + __VERIFIER_assert(b != 77); + return a; +} +EOF +( cd "$WORK/assert" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --check-asserts --slice --nondet-generator symex --timeout 45 assert.c ) \ + > "$WORK/assert/run.log" 2>&1 +if grep -q "Sliced with respect to __VERIFIER_assert,__assert_fail" "$WORK/assert/run.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/assert/run.log"; then + ok "assert mode slices towards the assertions and still finds the violation" +else + fail "assert slice" "no assert-criterion slice, or the violation was lost" + grep -E "Sliced|slice|VERIFICATION" "$WORK/assert/run.log" | sed 's/^/ /' +fi + +# --- 16. nondet names the fixed list does not know are kept too -------------- +# The criteria carry a fixed list of __VERIFIER_nondet_* names, and no fixed +# list knows every name a benchmark declares (int128, uint128, ...). A missing +# one silently brings back the shifted suite of section 14, so the names are +# also read from the program. Checked on the slicer command itself: int128 is +# not in the fixed list, so its presence there proves it came from the program. +mkdir -p "$WORK/names" +cat > "$WORK/names/names.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +extern __int128 __VERIFIER_nondet_int128(void); +extern void reach_error(void); +int main(void) { + __int128 wide = __VERIFIER_nondet_int128(); + int b = __VERIFIER_nondet_int(); + if (b == 42) { reach_error(); } + return (int)wide; +} +EOF +( cd "$WORK/names" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --slice --debug \ + --nondet-generator symex --timeout 30 names.c ) > "$WORK/names/run.log" 2>&1 +if grep "sbt-slicer" "$WORK/names/run.log" | grep -q "__VERIFIER_nondet_int128"; then + ok "nondet names declared by the program are slicing criteria too" +else + fail "program nondet names" "__VERIFIER_nondet_int128 is not among the criteria" +fi + +# --- 17. memtrack slices the instrumented module and keeps the violation ----- +# Memory has no criterion in the user's program: the property is decided by the +# runtime calls MemoryTrackPass inserts, so the slice is taken AFTER +# instrumentation with every map2check_* call as a criterion. +mkdir -p "$WORK/mem" +cat > "$WORK/mem/dfree.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int unrelated = 0; + for (int i = 0; i < 4; i++) { unrelated += i; } + int *p = malloc(sizeof(int)); + free(p); + if (n == 11) { free(p); } + return unrelated; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 dfree.c ) > "$WORK/mem/plain.log" 2>&1 +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 dfree.c ) > "$WORK/mem/slice.log" 2>&1 +plain_v=$(grep -oE "FALSE-[A-Z]+" "$WORK/mem/plain.log" | tail -1) +slice_v=$(grep -oE "FALSE-[A-Z]+" "$WORK/mem/slice.log" | tail -1) +if grep -q "Sliced with respect to map2check runtime" "$WORK/mem/slice.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/mem/slice.log" && [ -n "$slice_v" ] && \ + [ "$slice_v" = "$plain_v" ]; then + ok "memtrack slices after instrumentation and keeps the violation ($slice_v)" +else + fail "memtrack slice" "plain=[$plain_v] slice=[$slice_v]" + grep -E "Sliced|slice|VERIFICATION" "$WORK/mem/slice.log" | sed 's/^/ /' +fi + +# --- 18. memcleanup slices too and still sees the leak ---------------------- +cat > "$WORK/mem/leak.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int *p = malloc(sizeof(int)); + if (n == 5) { return 0; } + free(p); + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memcleanup-property --slice --nondet-generator symex --timeout 45 leak.c ) \ + > "$WORK/mem/leak.log" 2>&1 +if grep -q "Sliced with respect to map2check runtime" "$WORK/mem/leak.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/mem/leak.log"; then + ok "memcleanup slices and still finds the leak" +else + fail "memcleanup slice" "no slice, or the leak was lost" + grep -E "Sliced|slice|VERIFICATION" "$WORK/mem/leak.log" | sed 's/^/ /' +fi + +# --- 19. slicing must not invent a memory violation -------------------------- +cat > "$WORK/mem/safe.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + int *p = malloc(sizeof(int)); + if (p == 0) { return 0; } + *p = n; + if (n == 11) { *p = 0; } + free(p); + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 safe.c ) > "$WORK/mem/safe.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/mem/safe.log"; then + fail "slice soundness" "a safe program was reported FALSE after slicing" +else + ok "slicing does not invent a memory violation" +fi + +# --- 20. a construct the slicer rejects falls back, loudly ------------------- +# sbt-slicer errors on llvm.stacksave (variable-length arrays). The run must +# fall back to the unsliced module and reach the same verdict. +cat > "$WORK/mem/vla.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + if (n > 0 && n < 10) { + int a[n]; + a[n] = 1; + return a[0]; + } + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 vla.c ) > "$WORK/mem/vla-plain.log" 2>&1 +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 vla.c ) > "$WORK/mem/vla.log" 2>&1 +vla_plain=$(grep -oE "VERIFICATION [A-Z]+" "$WORK/mem/vla-plain.log" | tail -1) +vla_slice=$(grep -oE "VERIFICATION [A-Z]+" "$WORK/mem/vla.log" | tail -1) +if { grep -q "Sliced with respect to map2check runtime" "$WORK/mem/vla.log" || \ + grep -q "analysing the unsliced program" "$WORK/mem/vla.log"; } && \ + [ -n "$vla_slice" ] && [ "$vla_slice" = "$vla_plain" ]; then + ok "a slicer failure falls back and keeps the verdict ($vla_slice)" +else + fail "slice fallback" "plain=[$vla_plain] slice=[$vla_slice]" +fi + +# --- 21. a memory error inside an external function must not be sliced away -- +# CASTLE-787-2 overflows a stack buffer inside strcpy. No map2check_* call +# depends on that call, and the slicer treats external functions as only +# reading their arguments, so it was dropped -- and the run answered TRUE for a +# program with an out-of-bounds write. Every external call is a criterion now. +cat > "$WORK/mem/strcpy.c" <<'EOF' +#include +#include +int main(void) { + char username[10]; + strcpy(username, "Is_this_too_long_for_this_array_buffer?"); + printf("Hello %s!\n", username); + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --nondet-generator symex --timeout 45 strcpy.c ) > "$WORK/mem/strcpy.log" 2>&1 +if grep -q "VERIFICATION SUCCEEDED" "$WORK/mem/strcpy.log"; then + fail "external call slicing" "the overflowing strcpy was sliced away: TRUE" +else + ok "a memory error inside an external call survives slicing" +fi + +# --- 22. KLEE stopping on its timer is not a proof --------------------------- +# KLEE halting on --max-time exits 0, like a run that explored every path. One +# short path wrote NONE to the property file, and the run answered TRUE for a +# program with a reachable null dereference. Found by slicing (memsafety-cve +# frr.i, pacparser.i: the slice let KLEE reach its own timer), but it is not a +# slicing defect -- this program is not sliced. +mkdir -p "$WORK/halt" +cat > "$WORK/halt/halt.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x == 0) { return 0; } + int n = 0; + while (1) { + int y = __VERIFIER_nondet_int(); + if (y > 3) { n++; } else { n += 2; } + if (n == 200000) { int *p = 0; *p = 1; } + } + return 0; +} +EOF +( cd "$WORK/halt" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 20 halt.c ) > "$WORK/halt/run.log" 2>&1 +if grep -q "VERIFICATION SUCCEEDED" "$WORK/halt/run.log"; then + fail "halted KLEE verdict" "TRUE after KLEE stopped on its timer" +else + ok "a KLEE run halted on its timer is not reported TRUE" +fi + +# --- 23. an overflowing memcpy into a buffer nothing reads survives slicing -- +# clang lowers memcpy to llvm.memcpy.*; the copy feeds no criterion when the +# destination is never read again, so without the intrinsic as a criterion the +# slicer removed the overflow and the run could answer TRUE (review of 2b). +cat > "$WORK/mem/memcpy.c" <<'EOF' +#include +extern int __VERIFIER_nondet_int(void); +int main(void) { + char src[20]; + char buf[10]; + int n = __VERIFIER_nondet_int(); + memset(src, n, sizeof(src)); + memcpy(buf, src, 20); + return 0; +} +EOF +( cd "$WORK/mem" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --slice --debug --nondet-generator symex --timeout 30 memcpy.c ) > "$WORK/mem/memcpy.log" 2>&1 +if grep "sbt-slicer" "$WORK/mem/memcpy.log" | grep -q "llvm.memcpy" && \ + ! grep -q "VERIFICATION SUCCEEDED" "$WORK/mem/memcpy.log"; then + ok "memory intrinsics are slicing criteria and the overflow is not called safe" +else + fail "intrinsic slicing" "llvm.memcpy not among the criteria, or TRUE" +fi + +# --- 24. overflow slices the instrumented module and keeps the violation ----- +# Overflow checks are map2check_binop_* runtime calls, so the same +# post-instrumentation slice as the memory properties applies. +mkdir -p "$WORK/ovf" +cat > "$WORK/ovf/ovf.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + int unrelated = 0; + for (int i = 0; i < 4; i++) { unrelated += i; } + if (x > 2147483000) { x = x + 1000; } + return x + unrelated; +} +EOF +( cd "$WORK/ovf" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --check-overflow --slice --nondet-generator symex --timeout 45 ovf.c ) > "$WORK/ovf/run.log" 2>&1 +if grep -q "Sliced with respect to map2check runtime" "$WORK/ovf/run.log" && \ + grep -q "VERIFICATION FAILED" "$WORK/ovf/run.log"; then + ok "overflow slices after instrumentation and keeps the violation" +else + fail "overflow slice" "no slice, or the overflow was lost" + grep -E "Sliced|slice|VERIFICATION" "$WORK/ovf/run.log" | sed 's/^/ /' +fi + +# --- 25. slicing must not invent an overflow --------------------------------- +cat > "$WORK/ovf/safe.c" <<'EOF' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 0 && x < 1000) { x = x + 1000; } + return x; +} +EOF +( cd "$WORK/ovf" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --check-overflow --slice --nondet-generator symex --timeout 45 safe.c ) > "$WORK/ovf/safe.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/ovf/safe.log"; then + fail "overflow slice soundness" "a safe program was reported FALSE after slicing" +else + ok "slicing does not invent an overflow" +fi + +# --- 26. the fuzzer's corpus reaches KLEE as typed seeds --------------------- +# Each queue entry is replayed through the witness binary (inside the store's +# replay/, so nothing it writes touches the phase), and the typed nondet log +# becomes a .ktest; KLEE starts from the whole set with --seed-dir. The old +# channel read a log from a scratch directory that no longer existed and sent +# at most one vector. +# An unreachable guard (44522 is not a square), so no phase can end the hybrid +# early: the fuzzer phase always hands its corpus over and KLEE always runs +# with it -- the test cannot pass without exercising the channel. +mkdir -p "$WORK/seed2" +cat > "$WORK/seed2/square.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "square.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 100 && a < 300 && b > 0) { + if (a * a == 44522) { reach_error(); } + } + return 0; +} +EOF +( cd "$WORK/seed2" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 square.c ) > "$WORK/seed2/run.log" 2>&1 +n_seeds=$(grep -aoE "Seeded KLEE with [0-9]+ vectors from AFL\+\+" "$WORK/seed2/run.log" \ + | grep -oE "[0-9]+" | head -1) +if [ "${n_seeds:-0}" -gt 0 ] && grep -q -- "--seed-dir=" "$WORK/seed2/run.log"; then + ok "the fuzzer corpus reaches KLEE ($n_seeds seeds via --seed-dir)" +else + fail "fuzzer -> KLEE" "KLEE ran without seeds from the fuzzer" +fi +# The program is safe and KLEE proves it: that proof is the run's answer. The +# third (fuzzer) phase is for runs nothing has decided yet; running it after a +# proof printed UNKNOWN last, and every harness reads the last verdict. +last_verdict=$(grep -aoE "VERIFICATION (FAILED|SUCCEEDED|UNKNOWN)" "$WORK/seed2/run.log" | tail -1) +if [ "$last_verdict" = "VERIFICATION SUCCEEDED" ]; then + ok "a proof from the KLEE phase stays the final verdict under --seed-exchange" +else + fail "exchange verdict" "KLEE proved the program safe but the run ended with [$last_verdict]" +fi + +# --- 27. replaying the corpus must not erase a violation the fuzzer found ---- +mkdir -p "$WORK/seed3" +cat > "$WORK/seed3/easy.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "easy.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 1000 && x < 1100) { reach_error(); } + return 0; +} +EOF +( cd "$WORK/seed3" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --timeout 30 easy.c ) > "$WORK/seed3/run.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/seed3/run.log"; then + ok "a violation found by the fuzzer survives the seed replays" +else + fail "seed replay" "the violation was lost with --seed-exchange" +fi + +# --- 28. the seed store starts clean, and the last phase replays nothing ---- +# The store's name is derived from the program's content, so a store left by +# an earlier run -- a --debug run keeps it on purpose, a killed one leaks it -- +# would feed its seeds into the next run of the same program: it is wiped at +# the start of a run. And the fuzzer's corpus is converted for KLEE only when a +# KLEE phase follows; after the last phase the replays would be pure cost. +mkdir -p "$WORK/seed4" +cat > "$WORK/seed4/safe.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "safe.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 100 && b > a) { b = b - a; } + if (a != a) { reach_error(); } + return b; +} +EOF +( cd "$WORK/seed4" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 safe.c ) > "$WORK/seed4/first.log" 2>&1 +store4=$(ls -d "$WORK/seed4"/*.seeds 2>/dev/null | head -1) +[ -n "$store4" ] && mkdir -p "$store4/ktest" && echo stale > "$store4/ktest/stale-from-an-old-run.ktest" +rm -rf "$WORK/seed4"/*.map2check +( cd "$WORK/seed4" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 safe.c ) > "$WORK/seed4/run.log" 2>&1 +replays=$(grep -c "Seeded KLEE with" "$WORK/seed4/run.log") +if [ -n "$store4" ] && [ ! -e "$store4/ktest/stale-from-an-old-run.ktest" ] && \ + [ "$replays" -le 1 ] && ! grep -q "VERIFICATION FAILED" "$WORK/seed4/run.log"; then + ok "the seed store starts clean and only the first fuzzer phase feeds KLEE" +else + fail "seed store lifecycle" "stale seed kept, $replays conversions, or a safe program reported FALSE" +fi + +# --- 29. an inline "if (!c) abort();" is an assumption, not the end of search -- +# In SV-COMP abort() is not an error: it discards the path. The benchmarks use +# it inline (seq-mthreaded/pals_*: `if(!(i2)) {abort();}`), and KLEE runs with +# --exit-on-error-type=Abort, so the first path violating that assumption ended +# the WHOLE search with exit 0 -- and the run answered TRUE for a program with a +# reachable bug. Measured: every wrong TRUE of the tacasv2 control arm in R15. +mkdir -p "$WORK/abort" +cat > "$WORK/abort/inline.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "inline.c", 3, "reach_error"); } +extern void abort(void); +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (!(x > 0)) { abort(); } + int y = __VERIFIER_nondet_int(); + if (y == x + 1) { ERROR: { reach_error(); abort(); } } + return 0; +} +EOF +( cd "$WORK/abort" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 45 inline.c ) > "$WORK/abort/inline.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/abort/inline.log"; then + ok "an inline abort() assumption prunes the path and the bug behind it is found" +else + fail "inline abort" "the bug after an inline abort() assumption was not found: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/abort/inline.log" | tail -1)" +fi + +# The same shape with no reachable bug must not turn into a violation. +cat > "$WORK/abort/safe.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "safe.c", 3, "reach_error"); } +extern void abort(void); +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (!(x > 0)) { abort(); } + if (x < 0) { ERROR: { reach_error(); abort(); } } + return 0; +} +EOF +( cd "$WORK/abort" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 45 safe.c ) > "$WORK/abort/safe.log" 2>&1 +# And it is still provable: the pruned path is not a dropped one. Reading +# KLEE's "partially completed paths" as dropped paths turned this into UNKNOWN. +if grep -q "VERIFICATION SUCCEEDED" "$WORK/abort/safe.log"; then + ok "an inline abort() assumption does not invent a violation, and is provable" +else + fail "inline abort soundness" "a safe program with an inline abort() assumption: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/abort/safe.log" | tail -1), expected SUCCEEDED" +fi + +# --- 30. KLEE finishing after dropping paths is not a proof ----------------- +# KLEE exits 0 whenever its queue empties -- also after pinning a symbolic +# double to 0 ("silently concretizing (reason: floating point)"): one path, +# explored "completely", and float-benchs/sin_interpolated_index-1 came back +# TRUE with a reachable bug. +mkdir -p "$WORK/dropped" +cat > "$WORK/dropped/float.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "float.c", 3, "reach_error"); } +extern double __VERIFIER_nondet_double(void); +int main(void) { + double x = __VERIFIER_nondet_double(); + if (x > 179.5 && x < 180.5) { reach_error(); } + return 0; +} +EOF2 +( cd "$WORK/dropped" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 45 float.c ) > "$WORK/dropped/float.log" 2>&1 +if grep -q "VERIFICATION SUCCEEDED" "$WORK/dropped/float.log"; then + fail "concretized verdict" "TRUE after KLEE concretized the symbolic double" +else + ok "a KLEE run that concretized an input is not reported TRUE" +fi + +# --- 31. the hybrid slices once per run, not once per phase ----------------- +# Every phase recreates the scratch directory, and each used to run sbt-slicer +# again. On eca-* the slicer timed out (0.2T) in phase 1 AND phase 2, the run +# overran its budget and was killed with no suite (R15, 4 ERROR). A slice, or a +# slicer failure, is now kept for the later phases of the same run. +mkdir -p "$WORK/slicecache" +cat > "$WORK/slicecache/safe.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "safe.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + int y = x > 0 ? x : -x; + if (y < 0 && x > 0) { reach_error(); } + return 0; +} +EOF2 +( cd "$WORK/slicecache" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --debug --slice --target-function --target-function-name reach_error \ + --timeout 30 safe.c ) > "$WORK/slicecache/safe.log" 2>&1 +slicer_runs=$(grep -c "sbt-slicer -c" "$WORK/slicecache/safe.log") +if [ "$slicer_runs" -eq 1 ] && grep -q "reusing the slice from an earlier phase" "$WORK/slicecache/safe.log"; then + ok "a slice is computed once and reused by the later phases" +else + fail "slice cache" "sbt-slicer ran $slicer_runs time(s); reuse logged: $(grep -c 'reusing the slice' "$WORK/slicecache/safe.log")" +fi + +# A slicer failure is remembered too: the VLA makes sbt-slicer fail, and the +# later phases must not pay for it again. +cat > "$WORK/slicecache/vla.c" <<'EOF2' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + if (n > 0 && n < 10) { + int a[n]; + a[0] = 1; + return a[0]; + } + return 0; +} +EOF2 +( cd "$WORK/slicecache" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --debug --memtrack --slice --timeout 30 vla.c ) > "$WORK/slicecache/vla.log" 2>&1 +slicer_runs=$(grep -c "sbt-slicer -c" "$WORK/slicecache/vla.log") +if [ "$slicer_runs" -eq 1 ] && grep -q "no usable output (cached" "$WORK/slicecache/vla.log"; then + ok "a slicer failure is remembered by the later phases" +else + fail "slice failure cache" "sbt-slicer ran $slicer_runs time(s); cached failure logged: $(grep -c 'no usable output (cached' "$WORK/slicecache/vla.log")" +fi + +# --- 32. the fuzzer's input runs out as zeros, not as a replay of itself ----- +# Past the end of the test case the AFL++ generator used to start over from +# its first byte, so `while (__VERIFIER_nondet_int())` fed by the placeholder +# seed "A" never ended: afl-fuzz's dry run timed out on it and the fuzzer +# aborted before its first execution -- on the loop idiom sv-benchmarks is +# full of. Reads past the end now return zero. +mkdir -p "$WORK/aflloop" +cat > "$WORK/aflloop/loop.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "loop.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + while (__VERIFIER_nondet_int()) { + if (__VERIFIER_nondet_int() == 7) { reach_error(); } + } + return 0; +} +EOF2 +( cd "$WORK/aflloop" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator afl \ + --timeout 45 loop.c ) > "$WORK/aflloop/loop.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/aflloop/loop.log"; then + ok "a nondet-driven loop does not hang the fuzzer's dry run" +else + fail "fuzzer on a nondet loop" "expected FAILED, got: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/aflloop/loop.log" | tail -1)" +fi + +# --- 33. --alternate-engines takes turns and stops a stagnant KLEE ---------- +# The fixed 0.2/0.6/0.2 split held an engine that had stopped progressing to +# the end of its share. Alternating, each phase ends when its engine stagnates +# and the other gets the time; KLEE stopped that way was left with states, so +# the run is never TRUE, and the whole run stays inside its budget. +mkdir -p "$WORK/alternate" +cat > "$WORK/alternate/grow.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "grow.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int s = 0; + while (__VERIFIER_nondet_int()) { + if (__VERIFIER_nondet_int() > 0) s += 1; else s += 2; + if (s < 0) { reach_error(); } + } + return 0; +} +EOF2 +t0=$(date +%s) +( cd "$WORK/alternate" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --alternate-engines --target-function --target-function-name reach_error \ + --timeout 60 grow.c ) > "$WORK/alternate/grow.log" 2>&1 +t1=$(date +%s) +phases=$(grep -c "Alternation phase" "$WORK/alternate/grow.log") +if [ "$phases" -ge 3 ] && grep -q "KLEE stagnated" "$WORK/alternate/grow.log" && \ + ! grep -q "VERIFICATION SUCCEEDED" "$WORK/alternate/grow.log" && \ + [ $((t1 - t0)) -le 75 ]; then + ok "the engines alternate, a stagnant KLEE is stopped, no TRUE ($phases phases, $((t1 - t0)) s)" +else + fail "alternation" "phases=$phases stagnated=$(grep -c 'KLEE stagnated' "$WORK/alternate/grow.log") elapsed=$((t1 - t0))s verdict=$(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/alternate/grow.log" | tail -1)" +fi + +# --- 34. memset/memcpy/memmove are checked under LLVM 16's opaque pointers -- +# MemoryTrackPass matched the intrinsics by name, and the names carried the +# pointer types (llvm.memset.p0i8.i64) that LLVM 16 no longer writes +# (llvm.memset.p0.i64): no memory intrinsic clang emitted was checked. +mkdir -p "$WORK/intrinsics" +cat > "$WORK/intrinsics/over.c" <<'EOF2' +#include +#include +int main(void) { + char *p = malloc(8); + if (!p) return 0; + memset(p, 0, 16); + free(p); + return 0; +} +EOF2 +cat > "$WORK/intrinsics/safe.c" <<'EOF2' +#include +#include +struct S { int a[10]; char name[16]; }; +int main(void) { + char s[] = "hello, world"; + struct S x = {{1, 2, 3}, "abc"}, y; + y = x; + char *p = malloc(sizeof s); + if (!p) return 0; + memcpy(p, s, sizeof s); + memmove(p + 1, p, 4); + memset(y.name, 'z', sizeof y.name); + free(p); + return y.a[0] + s[0]; +} +EOF2 +( cd "$WORK/intrinsics" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 over.c ) > "$WORK/intrinsics/over.log" 2>&1 +( cd "$WORK/intrinsics" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 safe.c ) > "$WORK/intrinsics/safe.log" 2>&1 +if grep -q "FALSE-DEREF" "$WORK/intrinsics/over.log"; then + ok "a memset past the end of a heap block is a FALSE-DEREF" +else + fail "memset intrinsic" "expected FALSE-DEREF, got: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/intrinsics/over.log" | tail -1)" +fi +if grep -q "VERIFICATION SUCCEEDED" "$WORK/intrinsics/safe.log"; then + ok "in-bounds memcpy/memmove/memset and struct copies stay TRUE" +else + fail "intrinsics soundness" "safe program: $(grep -aoE 'VERIFICATION [A-Z]+|FALSE[-_A-Z]*' "$WORK/intrinsics/safe.log" | tr '\n' ' ')" +fi + +# --- 35. a fuzzer binary that fails to link says so --------------------------- +# Every missing AFL++ binary was reported as one that "did not build within +# Ns", the budget's fault -- including a link error that no budget would fix. +mkdir -p "$WORK/afllink" +cat > "$WORK/afllink/decl.c" <<'EOF2' +extern void reach_error(void); +extern int __VERIFIER_nondet_int(void); +int main(void) { if (__VERIFIER_nondet_int() == 3) reach_error(); return 0; } +EOF2 +( cd "$WORK/afllink" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 100 "$MAP2CHECK" \ + --nondet-generator afl --target-function --target-function-name reach_error \ + --timeout 30 decl.c ) > "$WORK/afllink/decl.log" 2>&1 +if grep -q "AFL++ binary failed to build.*undefined reference" "$WORK/afllink/decl.log"; then + ok "a fuzzer link error is reported as one, with its cause" +else + fail "fuzzer link error" "$(grep -a 'AFL++ binary' "$WORK/afllink/decl.log" | head -1)" +fi + +# --- 36. MAP2CHECK_CHECK_CSTRINGS=1: a %s that reads past its buffer is a FALSE-DEREF +# KLEE's uClibc declares printf without defining it, so KLEE runs it as a +# native external call: the read of an unterminated string happened outside +# every check, and Juliet's CWE121 CWE193 "cpy" tasks came back TRUE. The +# strings a %s (or puts) will read are checked before the call. +mkdir -p "$WORK/cstring" +cat > "$WORK/cstring/unterminated.c" <<'EOF2' +#include +#include +int main(void) { + char buf[10]; + char src[11] = "AAAAAAAAAA"; + memcpy(buf, src, strlen(src)); + printf("%s\n", buf); + return 0; +} +EOF2 +cat > "$WORK/cstring/fine.c" <<'EOF2' +#include +#include +#include +int main(void) { + char buf[16] = "hello"; + char *heap = malloc(8); + if (!heap) return 0; + strcpy(heap, "abc"); + printf("%s %s %d %.3s %5s\n", buf, "literal", 42, heap, heap); + /* %m reads errno, not an argument: the %s is buf, not &byte (review of + * #73: counting %m made the check read the one-byte &byte as a string). */ + char byte = 'x'; + printf("%m %s %p\n", buf, (void *)&byte); + puts(buf); + free(heap); + return 0; +} +EOF2 +( cd "$WORK/cstring" && MAP2CHECK_CHECK_CSTRINGS=1 MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 unterminated.c ) > "$WORK/cstring/unterminated.log" 2>&1 +( cd "$WORK/cstring" && MAP2CHECK_CHECK_CSTRINGS=1 MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 fine.c ) > "$WORK/cstring/fine.log" 2>&1 +if grep -q "FALSE-DEREF" "$WORK/cstring/unterminated.log"; then + ok "printing an unterminated buffer with %s is a FALSE-DEREF" +else + fail "%s past the buffer" "expected FALSE-DEREF, got: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/cstring/unterminated.log" | tail -1)" +fi +if grep -q "VERIFICATION SUCCEEDED" "$WORK/cstring/fine.log"; then + ok "terminated strings, literals, %.Ns and puts stay TRUE" +else + fail "%s soundness" "fine program: $(grep -aoE 'VERIFICATION [A-Z]+|FALSE[-_A-Z]*' "$WORK/cstring/fine.log" | tr '\n' ' ')" +fi + +# --- 37. MAP2CHECK_FUZZER_SUITE=1: the fuzzer's corpus joins a Cover-Branches suite +# The suite came only from KLEE's paths; the fuzzer's queue -- the inputs that +# reached new edges -- was thrown away with the scratch directory. +mkdir -p "$WORK/fuzzersuite" +cat > "$WORK/fuzzersuite/br.c" <<'EOF2' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(), b = __VERIFIER_nondet_int(); + int r = 0; + if (a > 100) r += 1; else r -= 1; + if (b == 4242) r += 2; + return r; +} +EOF2 +( cd "$WORK/fuzzersuite" && MAP2CHECK_FUZZER_SUITE=1 MAP2CHECK_PATH="$MAP2CHECK_DIR" \ + timeout -k 10 200 "$MAP2CHECK" --cover-branches --generate-test-suite \ + --timeout 40 br.c ) > "$WORK/fuzzersuite/br.log" 2>&1 +fuzzed=$(grep -aoE "[0-9]+ test cases from the fuzzer's corpus" "$WORK/fuzzersuite/br.log" | grep -oE '^[0-9]+') +dups=$( + for f in "$WORK"/fuzzersuite/test-suite/testcase-*.xml; do grep -o '[^<]*' "$f" | tr '\n' ' '; echo; done | sort | uniq -d | wc -l) +if [ "${fuzzed:-0}" -ge 1 ] && [ "$dups" -eq 0 ]; then + ok "the fuzzer's corpus contributes test cases, without duplicates ($fuzzed)" +else + fail "fuzzer suite" "fuzzer cases=${fuzzed:-0}, duplicate cases=$dups" +fi + +# --- 38. KLEE: a dozen nondet reads still reach a verdict (issue #75) +# The runtime printed its nondet log with the values still symbolic, and +# uClibc's vfprintf forks on every digit: with ten reads KLEE reached the +# target and never finished writing the log -- UNKNOWN on a straight line. +mkdir -p "$WORK/manyreads" +cat > "$WORK/manyreads/many.c" <<'EOF2' +extern void abort(void); +void reach_error(void) {} +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a[12]; + for (int i = 0; i < 12; i++) a[i] = __VERIFIER_nondet_int(); + if (a[0] == 7 && a[11] == 42) { reach_error(); abort(); } + return 0; +} +EOF2 +echo 'CHECK( init(main()), LTL(G ! call(reach_error())) )' > "$WORK/manyreads/prop.prp" +( cd "$WORK/manyreads" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --nondet-generator symex --generate-test-suite --target-function --target-function-name reach_error \ + --property-file prop.prp --timeout 60 many.c ) > "$WORK/manyreads/many.log" 2>&1 +vec=$(grep -ho '[^<]*' "$WORK"/manyreads/test-suite/testcase-*.xml 2>/dev/null | sed 's///' | tr '\n' ' ') +set -- $vec +if grep -q "VERIFICATION FAILED" "$WORK/manyreads/many.log" && [ "$#" -eq 12 ] && [ "$1" = 7 ] && [ "${12}" = 42 ]; then + ok "KLEE alone finds the error behind 12 nondet reads, with the full vector" +else + fail "nondet log explosion" "$(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/manyreads/many.log" | tail -1); vector: $vec" +fi + +# --- 39. abort() and __VERIFIER_assume in one function share map2check_assume +# The abort() rewrite declared map2check_assume first; NonDetPass then renamed +# the program's __VERIFIER_assume onto the occupied name, LLVM made it +# map2check_assume.1, which the runtime does not define: the native builds +# failed to link ("undefined reference to `map2check_assume.1'") and a +# reachable target came back UNKNOWN (review of #73). +mkdir -p "$WORK/abortassume" +cat > "$WORK/abortassume/both.c" <<'EOF2' +extern void abort(void); +extern void __VERIFIER_assume(int); +extern int __VERIFIER_nondet_int(void); +void reach_error(void) {} +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x < 0) abort(); + __VERIFIER_assume(x < 100); + if (x == 42) { reach_error(); abort(); } + return 0; +} +EOF2 +echo 'COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )' > "$WORK/abortassume/prop.prp" +( cd "$WORK/abortassume" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --debug --generate-test-suite --target-function --target-function-name reach_error \ + --property-file prop.prp --timeout 60 both.c ) > "$WORK/abortassume/run.log" 2>&1 +if grep -rqa "map2check_assume\.[0-9]" "$WORK/abortassume" 2>/dev/null; then + fail "abort + assume" "a suffixed map2check_assume was emitted" +elif grep -q "VERIFICATION FAILED" "$WORK/abortassume/run.log"; then + ok "abort() and __VERIFIER_assume in one function share map2check_assume" +else + fail "abort + assume" "$(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/abortassume/run.log" | tail -1)" +fi + +echo " ---" +echo " Results: $PASSED passed, $FAILED failed" +[ "$FAILED" -eq 0 ] || exit 1 diff --git a/tests/integration/test_verdict_classifier.sh b/tests/integration/test_verdict_classifier.sh new file mode 100644 index 000000000..cc6946ba5 --- /dev/null +++ b/tests/integration/test_verdict_classifier.sh @@ -0,0 +1,146 @@ +#!/bin/bash +# test_verdict_classifier.sh — unit tests for the shared evaluation classifier. +# +# The CASTLE and Juliet baselines are only as trustworthy as this function: it +# turns map2check's raw output into the TP/TN/FP/FN buckets the reports are +# computed from. Two separate mislabelling bugs have already made it into +# published numbers, so every rule here has a case. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +# shellcheck source=../lib/verdict_classifier.sh +. "$SCRIPT_DIR/../lib/verdict_classifier.sh" + +PASSED=0 +FAILED=0 + +check() { + local name="$1" expect="$2" output="$3" code="${4:-0}" elapsed="${5:-0}" budget="${6:-0}" + local got + got=$(classify_map2check_verdict "$output" "$code" "$elapsed" "$budget") + if [ "$got" = "$expect" ]; then + echo " PASS $name" + PASSED=$((PASSED+1)) + else + echo " FAIL $name: expected $expect, got $got" + FAILED=$((FAILED+1)) + fi +} + +echo "============================================================" +echo "Map2Check Evaluation Verdict Classifier" +echo "============================================================" + +# --- The regression this file exists for ------------------------------------- +# A hybrid run whose fuzzer phase used its slice, then reached KLEE and came +# back undecided. "Note: Forcing timeout" is the fuzzer handing over to KLEE, +# not a verdict. This used to classify as TIMEOUT. +HYBRID_UNKNOWN='Started Map2Check +Instrumenting with LLVM LibFuzzer +Exited fuzzer with 31744 +Note: Forcing timeout +Started Map2Check +Executing Klee with map2check +Exited klee with 0 +Unable to prove or falsify the program. +VERIFICATION UNKNOWN' +check "hybrid handover then undecided is UNKNOWN, not TIMEOUT" \ + UNKNOWN "$HYBRID_UNKNOWN" 0 12 60 + +# Same handover, but KLEE crashed. That is a tool failure worth its own bucket, +# and it was also being hidden as TIMEOUT. +HYBRID_CRASH='Note: Forcing timeout +KLEE: WARNING: undefined reference to function: __isoc99_fscanf +timeout: the monitored command dumped core +Segmentation fault +Exited klee with 35584 +Unable to prove or falsify the program. +VERIFICATION UNKNOWN' +check "KLEE crash is ERROR, not TIMEOUT" \ + ERROR "$HYBRID_CRASH" 0 13 60 + +# The fuzzer's crash replayed through the program under test: the program +# segfaults (a nondet-sized alloca), which is what a crash replay is for. Not +# a tool failure -- the tool went on to KLEE and answered. +AFL_REPLAY_CRASH='Executing AFL++ with map2check +Exited fuzzer with 0 +timeout: the monitored command dumped core +Segmentation fault +Note: Could not replicate error +VERIFICATION UNKNOWN +Started Map2Check +Executing Klee with map2check +Exited klee with 0 +VERIFICATION UNKNOWN' +check "a crash replayed from the fuzzer is not ERROR" \ + UNKNOWN "$AFL_REPLAY_CRASH" 0 13 60 + +# Map2Check itself dying after the fuzzer phase: the replay filter must not +# hide it -- the outer process's own SIGSEGV/SIGABRT says the tool crashed. +TOOL_CRASH_AFTER_FUZZER='Executing AFL++ with map2check +Exited fuzzer with 0 +Segmentation fault' +check "the tool crashing after the fuzzer phase is ERROR (SIGSEGV)" \ + ERROR "$TOOL_CRASH_AFTER_FUZZER" 139 13 60 +check "the tool aborting after the fuzzer phase is ERROR (SIGABRT)" \ + ERROR "$TOOL_CRASH_AFTER_FUZZER" 134 13 60 +check "the same log with the tool exiting normally stays UNKNOWN" \ + UNKNOWN "$TOOL_CRASH_AFTER_FUZZER" 0 13 60 + +# A definitive verdict still wins even when a phase died along the way. +check "verdict survives a crash in the other phase" \ + FALSE-OVERFLOW "$HYBRID_CRASH +FALSE-OVERFLOW" 0 13 60 + +# --- KLEE's own warnings are not infrastructure failures ---------------------- +KLEE_WARNINGS='Note: Forcing timeout +KLEE: WARNING: undefined reference to function: fscanf +KLEE: WARNING: undefined reference to function: open +Unable to prove or falsify the program. +VERIFICATION UNKNOWN' +check "KLEE undefined-reference warnings are not ERROR" \ + UNKNOWN "$KLEE_WARNINGS" 0 5 60 + +check "linker undefined reference is ERROR" \ + ERROR 'undefined reference to `__map2check_main__` +collect2: error: ld returned 1 exit status' 0 1 60 + +check "opt rejecting a flag is ERROR" \ + ERROR "opt: Unknown command line argument '-m2c-entry-function'" 0 1 60 + +check "coreutils timeout failing to exec is ERROR" \ + ERROR "timeout: failed to run command '/x/map2check': No such file or directory" 0 1 60 + +# --- Timeouts ----------------------------------------------------------------- +check "outer timeout exit 124 is TIMEOUT" \ + TIMEOUT "Started Map2Check" 124 300 300 + +check "budget exhausted without a verdict is TIMEOUT" \ + TIMEOUT "$HYBRID_UNKNOWN" 0 58 60 + +check "well under budget without a verdict is UNKNOWN" \ + UNKNOWN "$HYBRID_UNKNOWN" 0 3 60 + +check "no budget given falls back to UNKNOWN" \ + UNKNOWN "$HYBRID_UNKNOWN" 0 0 0 + +# --- Definitive verdicts ------------------------------------------------------ +check "FALSE-DEREF" FALSE-DEREF "FALSE-DEREF detected" 0 1 60 +check "FALSE-FREE" FALSE-FREE "FALSE-FREE detected" 0 1 60 +check "FALSE-MEMTRACK" FALSE-MEMTRACK "FALSE-MEMTRACK detected" 0 1 60 +check "FALSE-OVERFLOW" FALSE-OVERFLOW "FALSE-OVERFLOW detected" 0 1 60 +check "FALSE-DIVBYZERO" FALSE-DIVBYZERO "FALSE-DIVBYZERO detected" 0 1 60 +check "FALSE-MEMCLEANUP" FALSE-MEMCLEANUP "FALSE-MEMCLEANUP detected" 0 1 60 +check "generic VERIFICATION FAILED" FALSE "VERIFICATION FAILED" 0 1 60 +check "VERIFICATION SUCCEEDED" TRUE "VERIFICATION SUCCEEDED" 0 1 60 + +# A proven-safe program that took its whole budget is still TRUE. +check "verdict wins over budget exhaustion" \ + TRUE "VERIFICATION SUCCEEDED" 0 60 60 + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" + +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/integration/test_wasm_entrypoint.sh b/tests/integration/test_wasm_entrypoint.sh index 8129fccba..a13a8118f 100755 --- a/tests/integration/test_wasm_entrypoint.sh +++ b/tests/integration/test_wasm_entrypoint.sh @@ -4,7 +4,7 @@ # from w2c_*_start entrypoints and generates valid wrappers. set -e -MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/test-comp2026/simulation/release}" +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" MAP2CHECK="$MAP2CHECK_DIR/map2check" WASI_CLANG="${WASI_SDK_PATH:-/opt/wasi-sdk-33.0-x86_64-linux}/bin/clang" TMPDIR=$(mktemp -d) diff --git a/tests/integration/test_wasm_pipeline.sh b/tests/integration/test_wasm_pipeline.sh index 688e21c40..19b5afdb4 100755 --- a/tests/integration/test_wasm_pipeline.sh +++ b/tests/integration/test_wasm_pipeline.sh @@ -4,7 +4,7 @@ # Must run inside the Docker container or with map2check-dev environment. set -e -MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/test-comp2026/simulation/release}" +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" MAP2CHECK="$MAP2CHECK_DIR/map2check" WASI_CLANG="${WASI_SDK_PATH:-/opt/wasi-sdk-33.0-x86_64-linux}/bin/clang" TMPDIR=$(mktemp -d) diff --git a/tests/juliet/juliet-test-suite-c b/tests/juliet/juliet-test-suite-c new file mode 160000 index 000000000..f88433e34 --- /dev/null +++ b/tests/juliet/juliet-test-suite-c @@ -0,0 +1 @@ +Subproject commit f88433e3443648a17671398797a04ea1f8e1a274 diff --git a/tests/juliet/juliet_stubs.c b/tests/juliet/juliet_stubs.c new file mode 100644 index 000000000..708cdaf9b --- /dev/null +++ b/tests/juliet/juliet_stubs.c @@ -0,0 +1,157 @@ +/* + * map2check_stubs.c — KLEE-friendly replacement for Juliet testcasesupport/io.c + * + * The stock io.c routes output through printf/wprintf and seeds randomness with + * srand(time(NULL)) / rand(), which KLEE models as external calls and therefore + * leaves every safe (good) program in a "partially completed path" state, making + * Map2Check report UNKNOWN instead of TRUE. + * + * These stubs neutralise that I/O so KLEE can exhaust safe programs: + * - print*Line are no-ops (the bug, when present, happens *before* the sink); + * - globalReturnsTrueOrFalse() becomes nondeterministic via __VERIFIER_nondet_int + * (replaced by Map2Check's NonDetPass and made symbolic by the KLEE backend), + * so both branches are explored; + * - rand()/srand() are modelled as nondeterministic over [0, RAND_MAX] + * (see the long note above their definition — this is the one stub that + * changes what the verifier may conclude); + * - decodeHexChars/decodeHexWChars return 0 (hex-input variants are a small + * minority of the scope and are out of the first baseline). + * + * KNOWN BIAS, recorded so it is not mistaken for a result: + * - decodeHexChars returning 0 means "nothing decoded", which can turn a real + * bug into a trivially safe program. Those variants must be EXCLUDED from + * the scope rather than counted as easy true negatives. + * - printLine() in the stock io.c does `if (line != NULL) printf("%s\n", ...)`, + * i.e. it READS the buffer. As a no-op it stops reading, which can mask an + * out-of-bounds READ whose only sink is the print. 1924 CWE121 testcases + * call printLine(data); zero do in CWE190/191/369, so this does not affect + * the overflow scope — but it must be revisited before buffer-overflow CWEs + * enter the baseline. + * + * Link this (instead of io.c) into the Juliet bitcode passed to map2check. + */ +#include "std_testcase.h" +#include +#include + +#define NODISCARD(x) (void)(x) + +void printLine(const char *line) { NODISCARD(line); } +void printWLine(const wchar_t *line) { NODISCARD(line); } +void printIntLine(int intNumber) { NODISCARD(intNumber); } +void printShortLine(short shortNumber) { NODISCARD(shortNumber); } +void printFloatLine(float floatNumber) { NODISCARD(floatNumber); } +void printLongLine(long longNumber) { NODISCARD(longNumber); } +void printLongLongLine(int64_t longLongIntNumber) { NODISCARD(longLongIntNumber); } +void printSizeTLine(size_t sizeTNumber) { NODISCARD(sizeTNumber); } +void printHexCharLine(char charHex) { NODISCARD(charHex); } +void printWcharLine(wchar_t wideChar) { NODISCARD(wideChar); } +void printUnsignedLine(unsigned unsignedNumber) { NODISCARD(unsignedNumber); } +void printHexUnsignedCharLine(unsigned char c) { NODISCARD(c); } +void printDoubleLine(double doubleNumber) { NODISCARD(doubleNumber); } +void printStructLine(const twoIntsStruct *s) { NODISCARD(s); } +void printBytesLine(const unsigned char *bytes, size_t numBytes) { + NODISCARD(bytes); + NODISCARD(numBytes); +} + +size_t decodeHexChars(unsigned char *bytes, size_t numBytes, const char *hex) { + NODISCARD(bytes); NODISCARD(numBytes); NODISCARD(hex); + return 0; +} +size_t decodeHexWChars(unsigned char *bytes, size_t numBytes, const wchar_t *hex) { + NODISCARD(bytes); NODISCARD(numBytes); NODISCARD(hex); + return 0; +} + +/* + * rand()/srand() — modelled as nondeterministic, NOT neutralised. + * + * This is the one stub that changes what the verifier is allowed to conclude, + * so the reasoning matters. + * + * Juliet feeds its "random" inputs through std_testcase.h: + * #define URAND31() (((unsigned)rand()<<30) ^ ((unsigned)rand()<<15) ^ rand()) + * #define RAND32() ((int)(rand() & 1 ? URAND31() : -URAND31() - 1)) + * Those are macros, expanded inside each testcase, so they cannot be overridden + * from here — the only interception point is rand() itself. + * + * Left unstubbed, rand() is an unresolved external: KLEE calls the real libc + * function and gets back ONE concrete value. The whole program then has a + * single feasible path, and Map2Check answers VERIFICATION SUCCEEDED — not + * UNKNOWN, but a confident wrong TRUE. Measured on the v3 baseline: all 6 + * CWE190 int_rand_add false negatives came from exactly this. (int_rand_square + * escaped only by luck: data*data overflows for |data| > 46340, so almost any + * concrete draw trips it. int_rand_add needs data == INT_MAX exactly.) + * + * Modelling an unknown external as nondeterministic is a SOUND + * over-approximation — it admits every behaviour the concrete function could + * have, plus possibly more — and is the standard treatment in SV-COMP. The + * concrete-value alternative is the unsound one. + * + * "Plus possibly more" is where a naive stub creates FALSE POSITIVES, so the + * range is constrained rather than left open: rand() is specified to return a + * value in [0, RAND_MAX], and code like URAND31() above depends on that (it + * assumes each draw contributes only low bits). Returning an unconstrained int + * would hand the solver negative draws that real rand() cannot produce. + * + * The mask is exact only when RAND_MAX+1 is a power of two, which the static + * assert enforces — if some libc ever breaks that, the build fails loudly + * instead of silently biasing the input space. A masked nondet value is + * preferred over __VERIFIER_assume here because it constrains by construction + * and costs the solver no extra path splitting. + */ +_Static_assert((RAND_MAX & ((unsigned)RAND_MAX + 1u)) == 0, + "RAND_MAX+1 is not a power of two, so `& RAND_MAX` no longer " + "yields exactly [0, RAND_MAX]; use __VERIFIER_assume instead"); + +int rand(void) { + extern int __VERIFIER_nondet_int(void); + return __VERIFIER_nondet_int() & RAND_MAX; +} + +/* Seeding is meaningless once rand() is symbolic, and the stock call is + * srand(time(NULL)) — time() being another unresolved external that pins KLEE + * to a concrete value. Dropping it removes the external without affecting the + * input space, which rand() above now owns entirely. */ +void srand(unsigned seed) { NODISCARD(seed); } + +int globalReturnsTrue(void) { return 1; } +int globalReturnsFalse(void) { return 0; } +int globalReturnsTrueOrFalse(void) { + int v; + extern int __VERIFIER_nondet_int(void); + v = __VERIFIER_nondet_int(); + return v & 1; +} + +const int GLOBAL_CONST_TRUE = 1; +const int GLOBAL_CONST_FALSE = 0; +const int GLOBAL_CONST_FIVE = 5; + +int globalTrue = 1; +int globalFalse = 0; +int globalFive = 5; + +void good1(void) {} +void good2(void) {} +void good3(void) {} +void good4(void) {} +void good5(void) {} +void good6(void) {} +void good7(void) {} +void good8(void) {} +void good9(void) {} + +void bad1(void) {} +void bad2(void) {} +void bad3(void) {} +void bad4(void) {} +void bad5(void) {} +void bad6(void) {} +void bad7(void) {} +void bad8(void) {} +void bad9(void) {} + +int globalArgc = 0; +char **globalArgv = NULL; diff --git a/tests/juliet/launch-juliet-cd-later.sh b/tests/juliet/launch-juliet-cd-later.sh new file mode 100755 index 000000000..a06144ea4 --- /dev/null +++ b/tests/juliet/launch-juliet-cd-later.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# Shards c and d wait for a and b. The Juliet harness appends to its CSV and +# skips what it already has, so a shard that starts late loses nothing. +set -u +REPO="$(cd "$(dirname "$0")/../.." && pwd)" +IMAGE="${IMAGE:-map2check-testcov:latest}" +while [ "$(docker ps -q --filter 'name=m2c-v12-juliet' | wc -l)" -gt 0 ]; do sleep 300; done +COMMON="--restart=on-failure:100 --memory=4g -u 0 -v $REPO:/workspace -w /workspace --cpus=1" +COMMON="$COMMON -e MAP2CHECK_PATH=/workspace/install_v12" +for pair in "c:190 191" "d:401 415 416 476"; do + s="${pair%%:*}"; cwes="${pair#*:}" + docker rm -f "m2c-v12-juliet-$s" >/dev/null 2>&1 + docker run -d --name "m2c-v12-juliet-$s" $COMMON \ + -e JULIET_CWES="$cwes" -e RESULTS_DIR="/workspace/tests/juliet/results_v12_$s" \ + "$IMAGE" bash tests/juliet/run_juliet_evaluation.sh >/dev/null +done +echo "juliet c+d launched" diff --git a/tests/juliet/launch-v12-regression.sh b/tests/juliet/launch-v12-regression.sh new file mode 100755 index 000000000..d6c37276b --- /dev/null +++ b/tests/juliet/launch-v12-regression.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# launch-v12-regression.sh -- non-regression sweep for the weak-stub slicing fix. +# +# The fix only touches Caller::sliceWithRespectToTarget, which nothing outside +# --slice calls, so the expected result is TP/FP/FN identical to v9. That is +# exactly why it is worth running: a difference here means the change reached +# somewhere it had no business reaching. +# +# Sized to leave the v12 Test-Comp campaign its cores. That campaign is the +# measurement with a deadline; this one only has to finish before it is read. +set -u +REPO="$(cd "$(dirname "$0")/../.." && pwd)" +IMAGE="${IMAGE:-map2check-testcov:latest}" +COMMON="--restart=on-failure:100 --memory=4g -u 0 -v $REPO:/workspace -w /workspace" +COMMON="$COMMON -e MAP2CHECK_PATH=/workspace/install_v12 --cpus=1" + +# Same CWE split as v9, so the comparison is shard-for-shard. +launch_juliet() { + docker rm -f "m2c-v12-juliet-$1" >/dev/null 2>&1 + docker run -d --name "m2c-v12-juliet-$1" $COMMON \ + -e JULIET_CWES="$2" -e RESULTS_DIR="/workspace/tests/juliet/results_v12_$1" \ + "$IMAGE" bash tests/juliet/run_juliet_evaluation.sh >/dev/null +} +launch_juliet a "121" +launch_juliet b "122 761" +launch_juliet c "190 191" +launch_juliet d "401 415 416 476" + +docker rm -f m2c-v12-castle >/dev/null 2>&1 +docker run -d --name m2c-v12-castle $COMMON \ + -e RESULTS_DIR="/workspace/tests/castle/results_v12" \ + "$IMAGE" bash tests/castle/run_castle_evaluation.sh >/dev/null + +sleep 5 +echo "regression launched: $(docker ps -q --filter 'name=m2c-v12-juliet' | wc -l) juliet + $(docker ps -q --filter 'name=m2c-v12-castle' | wc -l) castle" diff --git a/tests/juliet/launch-v15-regression.sh b/tests/juliet/launch-v15-regression.sh new file mode 100755 index 000000000..c96f53f8c --- /dev/null +++ b/tests/juliet/launch-v15-regression.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# Non-regression on the paper binary. Runs BESIDE the Test-Comp phases, at one +# CPU each, because container count is what oversubscribes this machine. +# +# PER_FAMILY=10 rather than the 3 every previous baseline used. That buys much +# wider CWE coverage and costs the line-by-line comparison with v9 -- so the +# comparison is made on the INTERSECTION, which is still every case v9 ran. +set -u +REPO="$(cd "$(dirname "$0")/../.." && pwd)" +IMAGE="${IMAGE:-map2check-testcov:latest}" +POLL="${POLL:-300}" +R="--restart=on-failure:100 --memory=4g -u 0 -v $REPO:/workspace -w /workspace --cpus=1" +R="$R -e MAP2CHECK_PATH=/workspace/install_v15 -e PER_FAMILY=10" + +while [ "$(docker ps -q --filter 'name=m2c-validate' | wc -l)" -gt 0 ]; do sleep 30; done + + +jul() { + docker rm -f "m2c-v15-juliet-$1" >/dev/null 2>&1 + docker run -d --name "m2c-v15-juliet-$1" $R -e JULIET_CWES="$2" \ + -e RESULTS_DIR="/workspace/tests/juliet/results_v15_$1" \ + "$IMAGE" bash tests/juliet/run_juliet_evaluation.sh >/dev/null +} +docker rm -f m2c-v15-castle >/dev/null 2>&1 +docker run -d --name m2c-v15-castle $R \ + -e RESULTS_DIR="/workspace/tests/castle/results_v15" \ + "$IMAGE" bash tests/castle/run_castle_evaluation.sh >/dev/null +jul a "121" +jul b "122 761" +echo "castle + juliet a,b launched" + +while [ "$(docker ps -q --filter 'name=m2c-v15-juliet' | wc -l)" -gt 0 ]; do sleep "$POLL"; done +jul c "190 191" +jul d "401 415 416 476" +echo "juliet c,d launched" diff --git a/tests/juliet/run_juliet_evaluation.sh b/tests/juliet/run_juliet_evaluation.sh new file mode 100755 index 000000000..010e416ba --- /dev/null +++ b/tests/juliet/run_juliet_evaluation.sh @@ -0,0 +1,279 @@ +#!/bin/bash +# run_juliet_evaluation.sh — Run Juliet scope-C through Map2Check (sequential, resumable) +# +# Scope C: CWEs 121, 122, 415, 416, 476, 761 (--memtrack), 190 (--check-overflow), +# 401 (--memcleanup-property). +# +# Juliet here is the RAW NIST tree under tests/juliet/juliet-test-suite-c/testcases/ (not the +# sv-benchmarks tasks). Each .c file is compiled TWICE to separate the variants: +# bad = -DINCLUDEMAIN -DOMITGOOD -> vulnerable (expect FALSE) +# good = -DINCLUDEMAIN -DOMITBAD -> safe (expect TRUE) +# +# Two harness adaptations are required (see docs/superpowers/specs/*-castle-juliet-baseline.md): +# 1. The KLEE/LibFuzzer wrapper forwards argc/argv to __map2check_main__ (fixed in +# NonDetGeneratorKlee.c / NonDetGeneratorLibFuzzy.c — main(argc,argv) is now supported). +# 2. testcasesupport/io.c I/O (printf/time/rand) is replaced by juliet_stubs.c so +# KLEE can exhaust safe programs (otherwise "partially completed paths" -> UNKNOWN). +# +# Resumable: rows already present in the CSV are skipped (key = |). +# Each run executes in an isolated CWD (map2check writes CWD-relative artifacts). +# +# Env: MAP2CHECK_PATH (dir with map2check binary), JULIET_DIR (default the +# juliet-test-suite-c submodule beside this script), +# RESULTS_DIR, OUTER_TIMEOUT, INNER_TIMEOUT, LIMIT (max files, for smoke tests), +# PER_FAMILY (files sampled per test family — see "SAMPLING" below). +# +# --------------------------------------------------------------------------- +# SAMPLING: stratified by test family, NOT by alphabetical prefix +# --------------------------------------------------------------------------- +# +# Juliet names every testcase CWE___<family>_<NN>.c, where: +# <family> encodes WHAT is being tested — the data type, the input source and +# the operation, e.g. `int64_t_max_multiply`, `short_min_sub`, +# `int_zero_divide`. This is the axis the verifier's behaviour +# actually varies along. +# <NN> (01..26+) is the "flow variant" — the same bug wrapped in a +# different control-flow shape (if(1), static const guard, function +# pointer, union, goto...). It varies how hard the bug is to REACH, +# not what the bug IS. +# +# The v3 baseline capped work with LIMIT_PER_CWE, which took the first N files +# in alphabetical order. Because a family owns ~26 consecutive filenames, 60 +# files collapsed into 2-3 families. Measured coverage was: +# +# CWE-190: 6 of 90 families (6.7%) +# CWE-191: 5 of 69 families (7.2%) +# CWE-369: 2 of 18 families (11.1%) +# +# The consequences were not subtle. Every `int64_t_*` family went untested — so +# the width-aware i64 overflow work the baseline existed to validate was never +# exercised once. In CWE-369 only `float_*` families were reached, so every +# genuine integer divide-by-zero (`int_zero_divide`, `int_zero_modulo`, ...) +# was missed while the sample filled with float division, which yields IEEE +# infinity and is not undefined behaviour at all. The resulting "0% recall on +# CWE-369" measured the sampler, not the tool. +# +# So: sample per FAMILY, and cover every family. +# +# How many files per family? The v3 data answers this empirically. Grouping its +# rows by (family, bad|good) gave 26 groups, and ALL 26 were perfectly +# homogeneous — every flow variant in a family produced the identical +# classification, with `short_min_multiply` alone covering 25 of its 26 +# variants and never once disagreeing with itself. Within-family variance was +# zero. Spending 26 runs to re-measure one answer, while 84 other families go +# untouched, is the worst possible allocation of a fixed time budget. +# +# PER_FAMILY=3 is therefore the default: enough to catch a family that is NOT +# homogeneous (which the v3 slice cannot rule out for the ~85% of families it +# never saw), cheap enough to cover all 177 families across the three CWEs. +# +# The three files are spread ACROSS the variant range (first / middle / last) +# rather than taken from the front. Variants _01.._09 are the simple +# control-flow shapes; the harder ones (function pointers, unions, inter- +# procedural flow) live in the _1x/_2x range. Taking a prefix here would +# re-introduce, at the variant level, the exact bias being removed at the +# family level. +# +# Set PER_FAMILY=0 to disable sampling and run every file in the CWE. + +set -u + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_castle_ci}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +CLANG="${CLANG:-/usr/bin/clang-16}" +LLVM_LINK="${LLVM_LINK:-/usr/bin/llvm-link-16}" +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +JULIET_DIR="${JULIET_DIR:-$SCRIPT_DIR/juliet-test-suite-c}" +SUPPORT_DIR="$JULIET_DIR/testcasesupport" +TESTCASES_DIR="$JULIET_DIR/testcases" +STUBS="$SCRIPT_DIR/juliet_stubs.c" +RESULTS_DIR="${RESULTS_DIR:-$SCRIPT_DIR/results}" +OUTER_TIMEOUT="${OUTER_TIMEOUT:-300}" +INNER_TIMEOUT="${INNER_TIMEOUT:-60}" +LIMIT="${LIMIT:-0}" # 0 = unlimited, counted across all CWEs +PER_FAMILY="${PER_FAMILY:-3}" # files sampled per family; 0 = all +EXTRA_FLAGS="${EXTRA_FLAGS:-}" # opt-in flags for every run, e.g. --slice +# LIMIT_PER_CWE is deliberately gone: it was the alphabetical-prefix cap that +# produced the v3 sampling failure documented in the header. A per-CWE ceiling +# cannot be expressed without reintroducing that bias, so the knob is +# PER_FAMILY instead, which scales coverage while keeping it uniform. +# Only a value that would actually have capped anything is an error: 0 was the +# documented "unlimited" default, so an old caller passing LIMIT_PER_CWE=0 was +# asking for exactly what it gets now and must not be failed. +if [ -n "${LIMIT_PER_CWE:-}" ] && [ "${LIMIT_PER_CWE:-0}" -ne 0 ] 2>/dev/null; then + echo "FATAL: LIMIT_PER_CWE is no longer supported (it caused the v3 sampling" >&2 + echo " bias: 6/90 families on CWE-190). Use PER_FAMILY instead." >&2 + exit 2 +fi + +declare -A CWE_MODE=( + [121]="--memtrack" + [122]="--memtrack" + [415]="--memtrack" + [416]="--memtrack" + [476]="--memtrack" + [761]="--memtrack" + [190]="--check-overflow" + [191]="--check-overflow" + [369]="--check-overflow" + [401]="--memcleanup-property" +) +# CWE-191 (underflow) is the same no-overflow property as 190, and CWE-369 +# (divide by zero) is reported as FALSE-DIVBYZERO; both are covered by +# --check-overflow. Override with e.g. JULIET_CWES="190 191 369" to run a +# targeted slice. +DEFAULT_SCOPE_CWES=(121 122 415 416 476 761 190 191 369 401) +read -r -a SCOPE_CWES <<< "${JULIET_CWES:-${DEFAULT_SCOPE_CWES[*]}}" + +CSV="$RESULTS_DIR/juliet_scope_c_results.csv" +LOG="$RESULTS_DIR/run.log" +BC_DIR="$RESULTS_DIR/bc" +RAW_DIR="$RESULTS_DIR/raw" +mkdir -p "$RESULTS_DIR" "$BC_DIR" "$RAW_DIR" + +# --- resume map --- +declare -A DONE +if [ -f "$CSV" ]; then + while IFS=, read -r _cwe _name _variant _vuln _mode _verdict _elapsed _cls; do + DONE["$_name|$_variant"]=1 + done < <(tail -n +2 "$CSV" 2>/dev/null) +fi +[ -f "$CSV" ] || echo "cwe,name,variant,vulnerable,mode,verdict,elapsed_s,classification" > "$CSV" + +# --- precompile stubs --- +STUBS_BC="$BC_DIR/juliet_stubs.bc" +"$CLANG" -c -emit-llvm -g -O0 -I "$SUPPORT_DIR" "$STUBS" -o "$STUBS_BC" 2>/dev/null \ + || { echo "FATAL: juliet_stubs.c failed to compile"; exit 1; } + +log() { echo "[$(date -u +%H:%M:%S)] $*" | tee -a "$LOG"; } + +# Verdict classification is shared with the CASTLE runner and covered by +# tests/integration/test_verdict_classifier.sh — see that file for why +# "Forcing timeout" is not a timeout signal. Juliet only needs the coarse +# FALSE/TRUE distinction, so the fine-grained FALSE-* verdicts collapse here. +# shellcheck source=../lib/verdict_classifier.sh +. "$SCRIPT_DIR/../lib/verdict_classifier.sh" +# shellcheck source=../lib/isolated_run.sh +. "$SCRIPT_DIR/../lib/isolated_run.sh" + +classify_verdict() { + local verdict + verdict=$(classify_map2check_verdict "$1" "${2:-0}" "${3:-0}" "${4:-0}") + case "$verdict" in + FALSE-*) echo "FALSE" ;; + *) echo "$verdict" ;; + esac +} + +PROCESSED=0 +SKIP=0 +CF=0 + +for cwe in "${SCOPE_CWES[@]}"; do + mode="${CWE_MODE[$cwe]:-}" + [ -n "$mode" ] || { log "CWE-$cwe: no mode mapping, skipping"; continue; } + cwe_dir=$(ls -d "$TESTCASES_DIR"/CWE${cwe}_* 2>/dev/null | head -1) + [ -n "$cwe_dir" ] || { log "CWE-$cwe: no testcase dir, skipping"; continue; } + + # --- Stratified selection (see SAMPLING in the header) -------------------- + # Bucket every self-contained testcase by family, preserving alphabetical + # order inside each bucket so the choice is deterministic and reproducible. + unset FAM_FILES; declare -A FAM_FILES + fam_order=() + while IFS= read -r -d '' f; do + base="${f##*/}" + case "$base" in + *[a-z].c) continue ;; # multi-file fragments (_22a/_51b/...), not self-contained + esac + fam="${base##*__}" # drop "CWE190_Integer_Overflow__" + fam="${fam%_*.c}" # drop the "_01.c" flow-variant suffix + if [ -z "${FAM_FILES[$fam]+set}" ]; then + fam_order+=("$fam") + FAM_FILES[$fam]="" + fi + FAM_FILES[$fam]+="$f"$'\n' + done < <(find "$cwe_dir" -type f -name "*.c" -print0 | sort -z) + + # Pick PER_FAMILY files per family, spread evenly across the variant range so + # the sample spans simple and hard control-flow shapes alike. + SELECTED=() + for fam in "${fam_order[@]}"; do + mapfile -t fam_list < <(printf '%s' "${FAM_FILES[$fam]}") + n=${#fam_list[@]} + if [ "$PER_FAMILY" -le 0 ] || [ "$n" -le "$PER_FAMILY" ]; then + SELECTED+=("${fam_list[@]}") + elif [ "$PER_FAMILY" -eq 1 ]; then + SELECTED+=("${fam_list[0]}") + else + for ((i = 0; i < PER_FAMILY; i++)); do + SELECTED+=("${fam_list[$((i * (n - 1) / (PER_FAMILY - 1)))]}") + done + fi + done + log "CWE-$cwe: ${#fam_order[@]} families, sampling ${#SELECTED[@]} files (PER_FAMILY=$PER_FAMILY)" + + for f in "${SELECTED[@]}"; do + rel="${f#$TESTCASES_DIR/}" + + for variant in bad:OMITGOOD:True good:OMITBAD:False; do + IFS=: read -r vtag def vuln <<< "$variant" + key="$rel|$vtag" + [ -n "${DONE[$key]:-}" ] && { SKIP=$((SKIP+1)); continue; } + + bc="$BC_DIR/${rel//\//__}.$vtag.bc" + "$CLANG" -c -emit-llvm -g -O0 -DINCLUDEMAIN -D"$def" \ + -I "$SUPPORT_DIR" "$f" -o "$bc" 2>/dev/null || { + echo "$cwe,$rel,$vtag,$vuln,$mode,COMPILE-FAIL,0,COMPILE-FAIL" >> "$CSV" + CF=$((CF+1)); continue + } + + combined="$BC_DIR/${rel//\//__}.$vtag.combined.bc" + "$LLVM_LINK" "$bc" "$STUBS_BC" -o "$combined" 2>/dev/null || { + echo "$cwe,$rel,$vtag,$vuln,$mode,LINK-FAIL,0,LINK-FAIL" >> "$CSV" + CF=$((CF+1)); continue + } + + ( + # The raw output is written first and read back: run_isolated captures + # to a file precisely so no pipe can be held open by an orphaned + # backend (see tests/lib/isolated_run.sh). Keeping it also means a + # future classifier bug is repaired by reclassifying, not by re-running. + raw="$RAW_DIR/${rel//\//__}.$vtag.txt" + start=$(date +%s%N) + rc=0 + run_isolated "$raw" "$OUTER_TIMEOUT" \ + "$MAP2CHECK" $mode $EXTRA_FLAGS --timeout "$INNER_TIMEOUT" "$combined" || rc=$? + end=$(date +%s%N) + elapsed=$(python3 -c "print(round(($end - $start) / 1000000000, 1))") + output=$(cat "$raw") + verdict=$(classify_verdict "$output" "$rc" "$elapsed" "$INNER_TIMEOUT") + if [ "$verdict" = "FALSE" ]; then + [ "$vuln" = "True" ] && cls="TP" || cls="FP" + elif [ "$verdict" = "TRUE" ]; then + [ "$vuln" = "True" ] && cls="FN" || cls="TN" + elif [ "$verdict" = "TIMEOUT" ]; then + cls="TIMEOUT" + elif [ "$verdict" = "ERROR" ]; then + cls="ERROR" + else + cls="UNKNOWN" + fi + echo "$cwe,$rel,$vtag,$vuln,$mode,$verdict,$elapsed,$cls" >> "$CSV" + log "CWE-$cwe $rel/$vtag => $verdict [$cls] ${elapsed}s" + ) + done + + PROCESSED=$((PROCESSED+1)) + # LIMIT is a smoke-test escape hatch only. Unlike the removed LIMIT_PER_CWE + # it is never used for a real baseline, so the prefix bias it introduces is + # acceptable — but it is logged loudly so a truncated run can never be + # mistaken for a complete one. + if [ "$LIMIT" -gt 0 ] && [ "$PROCESSED" -ge "$LIMIT" ]; then + log "LIMIT reached ($LIMIT files): run is TRUNCATED and NOT a valid baseline." + break 2 + fi + done +done + +log "DONE: files_processed=$PROCESSED skipped=$SKIP compile_fail=$CF (authoritative tallies: analyze $CSV)" +log "Results: $CSV" diff --git a/tests/lib/baseline_watchdog.sh b/tests/lib/baseline_watchdog.sh new file mode 100755 index 000000000..87d3357ea --- /dev/null +++ b/tests/lib/baseline_watchdog.sh @@ -0,0 +1,77 @@ +#!/bin/bash +# baseline_watchdog.sh — storage guard for long baseline runs. +# +# baseline_watchdog.sh <monitor_log> <min_free_gb> <interval_s> <container>... +# +# Samples disk, docker log sizes and results-dir sizes on every tick, appends a +# machine-readable line to the monitor log, and HALTS the named containers if +# free space falls under the floor. Observation alone is not enough: a baseline +# left unattended for hours can fill a disk between two glances, and a filled +# disk corrupts the CSV it was writing at the time. Stopping is recoverable +# because both runners resume from their CSV; a truncated CSV is not. +# +# Docker's default json-file driver is unbounded, so the containers must ALSO be +# started with --log-opt max-size/max-file. This watchdog reports the sizes so a +# missing rotation flag is visible rather than silent. + +set -u + +LOG="$1"; MIN_FREE_GB="$2"; INTERVAL="$3"; shift 3 +CONTAINERS=("$@") +REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)" + +# Which run to count rows for. Everything else here is derived from arguments, +# so a hardcoded tag would make the progress counters read a stale directory and +# report 0 rows forever on the next run -- silently, while the disk guard kept +# working. A wrong monitoring number is worse than none, so the tag is explicit. +: "${BASELINE_TAG:=v5}" +JULIET_GLOB="$REPO/tests/juliet/results_${BASELINE_TAG}_*/juliet_scope_c_results.csv" +CASTLE_CSV="$REPO/tests/castle/results_${BASELINE_TAG}/castle_results.csv" + +say() { printf '%s %s\n' "$(date -u +%H:%M:%S)" "$*" >> "$LOG"; } + +say "WATCHDOG start floor=${MIN_FREE_GB}G interval=${INTERVAL}s containers=${CONTAINERS[*]}" + +while :; do + free_gb=$(df -BG --output=avail "$REPO" | tail -1 | tr -dc '0-9') + # `du /var/lib/docker` needs root and silently under-reports without it, which + # is exactly the kind of quietly-wrong number this script exists to avoid. + # `docker system df` reports the same total over the API, no privileges needed. + docker_gb=$(docker system df --format '{{.Size}}' 2>/dev/null \ + | awk '/GB/{s+=$1} /MB/{s+=$1/1024} END {printf "%d", s+0}') + res_mb=$(du -sBM "$REPO/tests/castle" "$REPO/tests/juliet" 2>/dev/null \ + | awk '{s+=$1} END {print s+0}') + + # Container log sizes (the unbounded-by-default risk) and liveness. + logs_mb=0; alive=0 + for c in "${CONTAINERS[@]}"; do + st=$(docker inspect -f '{{.State.Status}}' "$c" 2>/dev/null || echo gone) + [ "$st" = "running" ] && alive=$((alive+1)) + lf=$(docker inspect -f '{{.LogPath}}' "$c" 2>/dev/null || true) + if [ -n "$lf" ] && [ -r "$lf" ]; then + sz=$(du -sBM "$lf" 2>/dev/null | cut -f1 | tr -dc '0-9') + logs_mb=$((logs_mb + ${sz:-0})) + fi + done + + # shellcheck disable=SC2086 # JULIET_GLOB must stay unquoted to expand + rows=$(cat $JULIET_GLOB 2>/dev/null | grep -cv '^cwe,' || true) + crows=$(($(wc -l < "$CASTLE_CSV" 2>/dev/null || echo 1) - 1)) + + say "free=${free_gb}G docker=${docker_gb:-?}G results=${res_mb}M clogs=${logs_mb}M alive=${alive}/${#CONTAINERS[@]} juliet_rows=${rows:-0} castle_rows=${crows}" + + if [ "${free_gb:-9999}" -lt "$MIN_FREE_GB" ]; then + say "ALERT free=${free_gb}G below floor ${MIN_FREE_GB}G -- STOPPING CONTAINERS" + docker stop "${CONTAINERS[@]}" >/dev/null 2>&1 + say "HALTED. Both runners resume from their CSV once space is reclaimed." + exit 1 + fi + + # Everything finished: nothing left to guard. + if [ "$alive" -eq 0 ]; then + say "all containers finished; watchdog exiting" + exit 0 + fi + + sleep "$INTERVAL" +done diff --git a/tests/lib/isolated_run.sh b/tests/lib/isolated_run.sh new file mode 100644 index 000000000..b4b52d93e --- /dev/null +++ b/tests/lib/isolated_run.sh @@ -0,0 +1,66 @@ +# shellcheck shell=bash +# Shared runner for the CASTLE and Juliet evaluation harnesses. +# +# run_isolated <raw_output_file> <outer_timeout_s> <command> [args...] +# +# Runs one map2check invocation in a private working directory, captures its +# combined output to a FILE, reaps every descendant, and returns the command's +# exit code. Nothing is written to stdout, so the caller reads the raw file. +# +# --- Why the output must NOT go through $( ) --- +# +# The obvious form is +# output=$(timeout "$T" "$MAP2CHECK" ... 2>&1) +# and it deadlocks. Command substitution reads its pipe until EOF, and EOF only +# arrives once EVERY write end is closed. map2check spawns KLEE and LibFuzzer as +# grandchildren which inherit that pipe; when the outer `timeout` kills +# map2check, the grandchildren are orphaned but keep the write end open. The +# read then blocks forever. +# +# Observed directly on the v4 Juliet run, stalled 18 minutes on its first file: +# pipe:[472046] +# pid=113 fd=3 <- the harness subshell, blocked reading +# pid=48538 fd=2 <- orphaned `timeout 48 klee`, write end held +# pid=48539 fd=2 <- orphaned klee, write end held +# map2check itself was already gone. Redirecting to a file removes the +# dependency entirely: the harness never waits on a pipe, so an orphan can +# delay nothing. +# +# --- Why the descendants have to be reaped explicitly --- +# +# `timeout` signals only its direct child. Killing map2check therefore leaves +# KLEE running, burning CPU for the rest of the suite. Over a 21k-run baseline +# those accumulate until the machine is unusable. The private CWD makes them +# identifiable without guessing at process names or parsing pgids: any process +# whose cwd is inside this run's temp directory belongs to this run and to +# nothing else. +# +# `timeout -k` is also passed so a backend that catches SIGTERM without exiting +# is escalated to SIGKILL rather than waited on indefinitely. map2check applies +# the same escalation to its own internal KLEE/LibFuzzer invocations +# (tools.hpp:killGracePeriod); this is the outer belt to that inner braces. + +# Seconds between SIGTERM and SIGKILL for the outer timeout. +: "${RUN_KILL_GRACE:=30}" + +run_isolated() { + local raw="$1" tmo="$2" + shift 2 + + local work rc=0 p cwd + work=$(mktemp -d) + + # No pipe anywhere in this pipeline -- output lands straight in a file. + ( cd "$work" && timeout -k "$RUN_KILL_GRACE" "$tmo" "$@" ) > "$raw" 2>&1 || rc=$? + + # Reap anything still rooted in this run's directory. + for p in /proc/[0-9]*; do + cwd=$(readlink "$p/cwd" 2>/dev/null) || continue + case "$cwd" in + "$work" | "$work"/*) kill -KILL "${p##*/}" 2>/dev/null || true ;; + esac + done + + rm -rf "$work" + return "$rc" +} diff --git a/tests/lib/memsafety_classifier.sh b/tests/lib/memsafety_classifier.sh new file mode 100644 index 000000000..24e91de88 --- /dev/null +++ b/tests/lib/memsafety_classifier.sh @@ -0,0 +1,25 @@ +# shellcheck shell=bash +# classify_memsafety_result <expected true|false> <subproperty> <verdict> +# <verdict> is classify_map2check_verdict's output. A FALSE counts as correct +# only when its kind matches the subproperty the task declares; FALSE of the +# wrong kind is a wrong answer, not a lucky one. +classify_memsafety_result() { + local expected="$1" sub="$2" verdict="$3" want="" + case "$sub" in + valid-deref) want="FALSE-DEREF" ;; + valid-free) want="FALSE-FREE" ;; + valid-memtrack) want="FALSE-MEMTRACK" ;; + valid-memcleanup) want="FALSE-MEMCLEANUP" ;; + no-overflow) want="FALSE-OVERFLOW" ;; + # MemSafety tasks that declare no subproperty (sv-benchmarks' Juliet_Test): + # any memory-safety FALSE answers them, a leak-at-exit or overflow does not. + any) case "$verdict" in FALSE-DEREF|FALSE-FREE|FALSE-MEMTRACK) want="$verdict" ;; esac ;; + esac + case "$verdict" in + TRUE) [ "$expected" = "true" ] && echo correct-true || echo wrong-true ;; + FALSE*) if [ "$expected" = "false" ] && [ "$verdict" = "$want" ]; then + echo correct-false; else echo wrong-false; fi ;; + ERROR) echo error ;; + *) echo unknown ;; + esac +} diff --git a/tests/lib/verdict_classifier.sh b/tests/lib/verdict_classifier.sh new file mode 100644 index 000000000..128058471 --- /dev/null +++ b/tests/lib/verdict_classifier.sh @@ -0,0 +1,106 @@ +# shellcheck shell=bash +# Shared verdict classifier for the CASTLE and Juliet evaluation runners. +# +# classify_map2check_verdict <output> <exit_code> <elapsed_s> <budget_s> +# +# Prints exactly one of: +# FALSE-DEREF FALSE-FREE FALSE-MEMTRACK FALSE-OVERFLOW FALSE-DIVBYZERO +# FALSE-MEMCLEANUP FALSE TRUE TIMEOUT ERROR UNKNOWN +# +# Both runners used to carry their own copy of this logic and both got the +# timeout oracle wrong in the same way, so it lives here once and is covered by +# tests/integration/test_verdict_classifier.sh. +# +# --- Why "Forcing timeout" is NOT a timeout signal --- +# +# map2check's default is hybrid: LibFuzzer for 0.2x the budget, then KLEE for +# the remaining 0.8x. map2check.cpp prints "Note: Forcing timeout" whenever a +# phase exhausts its slice -- which the fuzzer phase does on essentially every +# run that does not get an early hit. It is the normal path into the KLEE +# phase, not a verdict. Keying TIMEOUT off it relabels every UNKNOWN and every +# ERROR as TIMEOUT, which silently hides real tool failures (a KLEE segfault on +# an external call, for one) behind a bucket that reads as "just needs more +# time". +# +# The trustworthy timeout signals are the harness's own: the outer `timeout` +# exiting 124, or a run that consumed its whole budget without deciding. +# +# --- Why "undefined reference" needs qualifying --- +# +# KLEE prints "KLEE: WARNING: undefined reference to function: fscanf" on +# perfectly healthy runs for every unresolved external. The pattern was meant +# to catch the *linker* error ("undefined reference to __map2check_main__"), so +# it has to skip KLEE's warning lines or every benchmark touching libc lands in +# ERROR. + +classify_map2check_verdict() { + local output="$1" + local exit_code="${2:-0}" + local elapsed="${3:-0}" + local budget="${4:-0}" + + # 1. A definitive verdict wins over everything else. A crash in one phase + # does not invalidate a decision reached by the other. + if echo "$output" | grep -q "FALSE-DEREF"; then + echo "FALSE-DEREF"; return + elif echo "$output" | grep -q "FALSE-FREE"; then + echo "FALSE-FREE"; return + elif echo "$output" | grep -q "FALSE-MEMTRACK"; then + echo "FALSE-MEMTRACK"; return + elif echo "$output" | grep -q "FALSE-OVERFLOW"; then + echo "FALSE-OVERFLOW"; return + elif echo "$output" | grep -q "FALSE-DIVBYZERO"; then + echo "FALSE-DIVBYZERO"; return + elif echo "$output" | grep -q "FALSE-MEMCLEANUP"; then + echo "FALSE-MEMCLEANUP"; return + elif echo "$output" | grep -q "VERIFICATION FAILED"; then + echo "FALSE"; return + elif echo "$output" | grep -q "VERIFICATION SUCCEEDED"; then + echo "TRUE"; return + fi + + # 2. Hard timeout: the outer `timeout` killed the process. + if [ "$exit_code" = "124" ]; then + echo "TIMEOUT"; return + fi + + # 3. Infrastructure and tool failures. Distinct from UNKNOWN because they are + # actionable: the tool broke rather than failed to decide. + if echo "$output" | grep -qE "timeout: failed to run command|Unknown command line argument"; then + echo "ERROR"; return + fi + if echo "$output" | grep -E "undefined reference to" | grep -qv "KLEE: WARNING"; then + echo "ERROR"; return + fi + # The outer process itself died on SIGSEGV (139) or SIGABRT (134): that is + # Map2Check crashing, whatever phase the log was in. Checked before the + # replay filter below, which would otherwise hide a crash of the tool during + # replay processing, suite generation or cleanup (review of #73). + if [ "$exit_code" = "139" ] || [ "$exit_code" = "134" ]; then + echo "ERROR"; return + fi + # A crash counts where the TOOL crashed. After "Exited fuzzer with" and + # before the next phase, the process that dumps core is the program under + # test, replayed on the fuzzer's crash to confirm it -- that is the program + # crashing, as it should (array-memsafety/*-alloca: a nondet-sized alloca). + if echo "$output" | awk ' + /Exited fuzzer with/ { replay = 1 } + /Started Map2Check/ { replay = 0 } + /Segmentation fault|dumped core|Aborted \(core dumped\)/ { if (!replay) found = 1 } + END { exit !found }'; then + echo "ERROR"; return + fi + + # 4. Soft timeout: no verdict, and the run consumed (nearly) its whole + # budget. Reported separately from UNKNOWN so the baseline can tell + # "needs more time" apart from "explored and still undecided". + if [ "$budget" -gt 0 ] 2>/dev/null; then + local threshold + threshold=$(awk -v b="$budget" 'BEGIN { printf "%d", b * 9 / 10 }') + if awk -v e="$elapsed" -v t="$threshold" 'BEGIN { exit !(e >= t) }'; then + echo "TIMEOUT"; return + fi + fi + + echo "UNKNOWN" +} diff --git a/tests/memsafety/run_memsafety_evaluation.sh b/tests/memsafety/run_memsafety_evaluation.sh new file mode 100755 index 000000000..11676a542 --- /dev/null +++ b/tests/memsafety/run_memsafety_evaluation.sh @@ -0,0 +1,133 @@ +#!/bin/bash +# run_memsafety_evaluation.sh -- Map2Check over a stratified SV-COMP MemSafety, +# MemCleanup or NoOverflows corpus, scoring each verdict against the task's expected +# verdict AND subproperty. +# +# Built for tacasv2b (slicing for the memory properties): the same corpus is +# run twice, with and without EXTRA_FLAGS=--slice, on the same build. What the +# comparison must show first is that slicing introduces no wrong answer, so +# the classes keep the two kinds of error apart: +# +# correct-true expected true, TRUE +# correct-false expected false, FALSE of the task's subproperty +# wrong-true expected false, TRUE -- the dangerous one +# wrong-false expected true and FALSE, or FALSE of the wrong kind +# unknown UNKNOWN or TIMEOUT +# error the tool failed +# +# Resumable: the CSV is the state, a task already in it is skipped. +# +# Environment: +# MANIFEST from build_corpus.py --property memsafety|memcleanup (required) +# PROPERTY memsafety | memcleanup | overflow (required) +# RESULTS_DIR where the CSV and raw logs go (required) +# MAP2CHECK_PATH install to run (required) +# SHARD/SHARDS process every SHARDS-th task starting at SHARD (default 0/1) +# BUDGET seconds given to map2check per task (default 120) +# DEADLINE_S stop starting new tasks after this many seconds (default 18000) +# EXTRA_FLAGS passed verbatim to map2check (e.g. "--slice") +set -u +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +BENCH="$SCRIPT_DIR/../testcomp/bench/sv-benchmarks/c" +. "$SCRIPT_DIR/../lib/verdict_classifier.sh" +. "$SCRIPT_DIR/../lib/memsafety_classifier.sh" + +MANIFEST="${MANIFEST:?set MANIFEST}" +PROPERTY="${PROPERTY:?set PROPERTY to memsafety or memcleanup}" +RESULTS_DIR="${RESULTS_DIR:?set RESULTS_DIR}" +MAP2CHECK_DIR="${MAP2CHECK_PATH:?set MAP2CHECK_PATH}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +SHARD="${SHARD:-0}" +SHARDS="${SHARDS:-1}" +BUDGET="${BUDGET:-120}" +DEADLINE_S="${DEADLINE_S:-18000}" +EXTRA_FLAGS="${EXTRA_FLAGS:-}" + +case "$PROPERTY" in + memsafety) MODE_FLAGS="--memtrack" ;; + memcleanup) MODE_FLAGS="--memcleanup-property" ;; + overflow) MODE_FLAGS="--check-overflow" ;; + *) echo "unknown PROPERTY: $PROPERTY" >&2; exit 2 ;; +esac + +mkdir -p "$RESULTS_DIR/raw" +CSV="$RESULTS_DIR/results.csv" +if [ ! -f "$CSV" ]; then + echo "category,program,data_model,expected,subproperty,verdict,class,elapsed_s,slice" > "$CSV" +fi + +# Already-done set, read once (per-task re-reads make a resume O(n^2)). +declare -A DONE +while IFS=, read -r _cat prog _rest; do + [ -n "$prog" ] && DONE["$prog"]=1 +done < <(tail -n +2 "$CSV") + +started=$(date +%s) +index=-1 +processed=0 +skipped=0 + +# fd 3, not stdin: map2check inherits stdin, and consuming it would eat the +# rest of the manifest. +while IFS=$'\t' read -r category program data_model expected subproperty <&3; do + case "$category" in ''|\#*) continue ;; esac + index=$((index + 1)) + [ $((index % SHARDS)) -eq "$SHARD" ] || continue + + if [ -n "${DONE[$program]:-}" ]; then + skipped=$((skipped + 1)) + continue + fi + + now=$(date +%s) + if [ $((now - started)) -ge "$DEADLINE_S" ]; then + echo "[deadline] stopping after ${processed} tasks ($(( (now-started)/60 )) min)" + break + fi + + src="$BENCH/$program" + if [ ! -f "$src" ]; then + echo "$category,$program,$data_model,$expected,$subproperty,MISSING,error,0," >> "$CSV" + continue + fi + + # A private directory per task: map2check names its scratch by the input's + # hash, and a directory left behind by an aborted run would be reused. + work=$(mktemp -d) + cp "$src" "$work/" 2>/dev/null || { rm -rf "$work"; continue; } + name=$(basename "$src") + arch=$([ "$data_model" = "LP64" ] && echo 64bit || echo 32bit) + + t0=$(date +%s) + rc=0 + # shellcheck disable=SC2086 # the flag strings are word lists on purpose + ( cd "$work" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 $((BUDGET + 30)) \ + "$MAP2CHECK" $MODE_FLAGS $EXTRA_FLAGS --architecture "$arch" \ + --timeout "$BUDGET" "$name" ) > "$work/map2check.log" 2>&1 </dev/null 3<&- || rc=$? + t1=$(date +%s) + + output=$(cat "$work/map2check.log") + verdict=$(classify_map2check_verdict "$output" "$rc" "$((t1 - t0))" "$BUDGET") + class=$(classify_memsafety_result "$expected" "$subproperty" "$verdict") + # The slice line, commas stripped so the CSV stays well-formed. + slice=$(grep -aoE "Sliced with respect to [^:]*: [^(]*" "$work/map2check.log" \ + | tail -1 | sed 's/.*: //; s/ *$//; s/,/;/g') + + echo "$category,$program,$data_model,$expected,$subproperty,$verdict,$class,$((t1-t0)),$slice" >> "$CSV" + printf '[%s] %-12s %-52s %-17s %-13s %s\n' \ + "$(date +%H:%M:%S)" "$category" "$(basename "$program")" "$verdict" "$class" "${slice:-—}" + + # Raw logs only for the cases worth reading: every wrong answer and error. + case "$class" in + wrong-*|error) + cp "$work/map2check.log" "$RESULTS_DIR/raw/$(echo "$program" | tr '/' '_').m2c.log" 2>/dev/null ;; + esac + + rm -rf "$work" + processed=$((processed + 1)) +done 3< "$MANIFEST" + +echo "==========================================================" +echo "shard $SHARD/$SHARDS: $processed processed, $skipped already done" +echo "CSV: $CSV" +echo "==========================================================" diff --git a/tests/testcomp/NOTES-testcov-output.md b/tests/testcomp/NOTES-testcov-output.md new file mode 100644 index 000000000..1fa730af1 --- /dev/null +++ b/tests/testcomp/NOTES-testcov-output.md @@ -0,0 +1,82 @@ +# TestCov 3.7 output contract, as observed + +Recorded 2026-08-16 inside `map2check-dev`, TestCov 3.7 from PyPI, invoked as +`testcov --test-suite <zip> --no-isolation -64 --goal cover-error-call.prp <program.c>`. + +Both runs used the same program (`programs/two_guards.c`, error reachable only at +`a == 42 && b == 7`). The first used the suite Map2Check generated; the second used +a byte-identical suite with the two input values replaced by `1` and `2`, so it is +structurally valid and covers nothing. + +## Suite that covers the error + +Exit code: **0** + +``` +⏳ Executing tests 1/1 +WARNING:suite_validation:Unmatched occurence of reach_error: extern void reach_error(void); +INFO:suite_validation:Stopping. Error found for test testcase-1.xml +✔️ Done! +INFO:suite_validation:Function-covering test case written to output/covering-test.c + +---Results--- +Tests run: 1 +Tests in suite: 1 +Coverage: 100.0% +Number of goals: 1 +Result: TRUE +``` + +## Valid suite that does not cover the error + +Exit code: **0** + +``` +⏳ Executing tests 1/1 +WARNING:suite_validation:Unmatched occurence of reach_error: extern void reach_error(void); +✔️ Done! + +---Results--- +Tests run: 1 +Tests in suite: 1 +Coverage: 0.0% +Number of goals: 1 +Result: UNKNOWN +``` + +## Consequence + +**The exit code is 0 in both cases.** A gate that keyed off `$?` would pass +unconditionally and be worth nothing — which is the single most important reason +this file exists. `testcov_verdict()` in `run_testcov.sh` matches the `Result:` line +instead: + +| observed line | verdict | +|---|---| +| `Result: TRUE` | `COVERED` | +| `Result: UNKNOWN` | `NOT_COVERED` | +| neither present | `ERROR` | + +Falling through to `ERROR` rather than to `NOT_COVERED` is deliberate. If a TestCov +upgrade changes the wording, the gate fails loudly instead of silently reporting that +nothing covers anything — a green-but-vacuous gate is worse than a red one. + +## Two things that look like problems and are not + +- `WARNING: Unmatched occurence of reach_error` appears in **both** runs, including + the successful one. It refers to the `extern` declaration line, not to the call. + Do not treat it as a failure signal. +- `WARNING: Not plotting coverage statistics: No module named 'matplotlib'` is + cosmetic. Installing matplotlib in CI would buy nothing. + +## Environment notes + +- `--no-isolation` is required wherever cgroups are unavailable (GitHub Actions + runners). It disables TestCov's own resource limits, so the caller must impose a + timeout. +- `-64` is required: TestCov defaults to `-m32`, while Map2Check compiles for the + host's 64-bit model. A mismatch shows up as a suite that mysteriously covers + nothing rather than as an error. +- `--test-suite` takes a **zip**, while the competition consumes a directory. The + driver zips; the tool must not. +- Packages needed beyond the base image: `python3-pip`, `zip`, `gcc`, `lcov`. diff --git a/tests/testcomp/PREDICOES-v9.md b/tests/testcomp/PREDICOES-v9.md new file mode 100644 index 000000000..5187c2bb5 --- /dev/null +++ b/tests/testcomp/PREDICOES-v9.md @@ -0,0 +1,41 @@ +# Previsões para o v9, registradas antes de rodar + +Escritas **antes** do lançamento, para que um erro fique visível em vez de ser +racionalizado depois. No v8 eu previ 30–50% de confirmação no cover-error e deu +13,9% — o diagnóstico estava incompleto, e é por isso que isto existe. + +## Desenho + +Corpus de cota 40, que a amostragem aninhada garante ser **subconjunto exato** +da cota 150 usada no v8. A comparação é pareada nas mesmas tarefas. + +| grupo | categorias | n | previsão | +|---|---|---|---| +| **tratamento** | Sequentialized, Floats, Arrays, Loops, ControlFlow | 158 | devem melhorar | +| **controle** | as outras sete | 214 | não devem mudar | + +O grupo de controle é o que separa "a correção funcionou" de "a corrida variou". + +## O que eu espero + +**Cover-error, tratamento.** No v8: Sequentialized 0/40, Floats 0/33, Arrays +1/40. Se `assume_abort_if_not` é mesmo a causa, essas três saem do zero. Não +arrisco número: a hipótese sustenta a *direção*, não a magnitude — o que a +correção remove é um obstáculo, e nada garante que não haja outro atrás dele. +Um único caso confirmado em Sequentialized já falsifica "0% é estrutural". + +**Cover-error, controle.** Sem mudança além de ruído de execução. Se o controle +se mover junto, a atribuição à correção do assume não se sustenta. + +**Falsos positivos.** Devem CAIR. O `pals_lcr` dava FAILED com 25 inputs que +cobriam 0,0%; agora dá UNKNOWN. Contagem de `FAILED` menor com confirmação +maior é o resultado bom aqui — um `FAILED` a menos que era falso vale mais que +um a mais que não se sustenta. + +**Juliet e CASTLE.** A instabilidade `UNKNOWN↔ERROR` (45–48 trocas em três +corridas) deve encolher, porque a causa provável era o campo não inicializado. +Se persistir no mesmo tamanho, a causa é outra e eu estava errado. + +**CASTLE.** Com o achado B corrigido no harness (commit do opencode), os 98 +casos em modo degenerado deixam de rodar. Menos tempo gasto, e os 12 TN falsos +que aquele modo rendia desaparecem — a precisão pode CAIR e isso é correto. diff --git a/tests/testcomp/README.md b/tests/testcomp/README.md new file mode 100644 index 000000000..f74f5aa84 --- /dev/null +++ b/tests/testcomp/README.md @@ -0,0 +1,84 @@ +# Test-Comp conformance corpus + +Programs and property files used to check that Map2Check emits a test suite the +official validator accepts **and can execute to reach the bug**. That second half is +the point: structural validity of the XML is asserted separately by +`tests/integration/test_test_suite_emission.sh`, and a suite can be perfectly +well-formed and worth zero points. + +## Layout + +| Path | What it is | +|---|---| +| `cover-error-call.prp` | The Cover-Error property, as the competition states it | +| `programs/` | Small programs with a known outcome for `reach_error` | +| `expected.txt` | The expected TestCov verdict per program | +| `run_testcov.sh` | One program: generate a suite, zip it, ask TestCov | +| `run_testcov_suite.sh` | The whole corpus, compared against `expected.txt` | +| `NOTES-testcov-output.md` | TestCov's observed output contract, and why the parser looks the way it does | + +## Running it + +```sh +pip3 install testcov # 3.7 at the time of writing +MAP2CHECK_PATH=<install prefix> bash tests/testcomp/run_testcov_suite.sh +``` + +Also needs `zip`, `gcc` and `lcov` on PATH. TestCov is the same tool the competition +uses; it comes from +[test-suite-validator](https://gitlab.com/sosy-lab/software/test-suite-validator). + +## What the corpus is for + +Each program isolates one thing the emitter can get wrong: + +| Program | Isolates | +|---|---| +| `single_int.c` | The minimal path. A failure here means the mechanism is broken, not an edge case | +| `two_guards.c` | Ordering of two inputs — right values, wrong order reaches nothing | +| `no_input.c` | The empty test vector, which a naive emitter drops entirely | +| `char_input.c` | A non-`int` nondet type, i.e. a different branch of the value serializer | +| `loop_reads.c` | Four reads, where an off-by-one in count or order becomes visible | +| `unreachable.c` | **Negative control** — the error cannot be reached by any input | + +`unreachable.c` earns its place: if it ever reports `COVERED`, the harness is lying +and no other result in this directory can be trusted. A gate that cannot fail is not +a gate. + +## The manifest is bidirectional + +`expected.txt` records one verdict per program, and `run_testcov_suite.sh` fails on +**any** mismatch — including a program that starts passing when the manifest says it +should not. That is deliberate. An unrecorded improvement looks exactly like a broken +harness, and the way to tell them apart is to make somebody change the line on +purpose, in the commit that caused it. + +If a program does not reach its expected verdict, do not delete the line and do not +quietly relax it. Change it to the observed verdict and write down why in the commit +message. An honest `NOT_COVERED` with a reason is data; a deleted test is a blind +spot. + +## Proof that the gate can fail + +A gate nobody has seen fail is a gate nobody should trust. Reversing the order of +`<input>` elements in the emitter — a change that leaves every suite structurally +perfect and semantically worthless — was run against this corpus on 2026-08-16: + +``` + PASS single_int.c COVERED + FAIL two_guards.c expected COVERED, observed NOT_COVERED + PASS no_input.c COVERED + PASS char_input.c COVERED + PASS unreachable.c NOT_COVERED + PASS loop_reads.c NOT_COVERED +Results: 5 passed, 1 failed (exit 1) +``` + +The gate goes red, as it must. But note **which** program caught it: only +`two_guards.c`. The others are structurally insensitive to ordering — one input each, +or none — and `loop_reads.c`, which has four and would also have caught it, is +currently undecided by the tool (finding K). + +So the ordering guarantee rests on a single program today. Two consequences worth +keeping in mind: do not remove `two_guards.c` without adding another multi-input +program first, and fixing finding K would restore a second, independent witness. diff --git a/tests/testcomp/RUN-2026-08-22-NOTES.md b/tests/testcomp/RUN-2026-08-22-NOTES.md new file mode 100644 index 000000000..3af265a75 --- /dev/null +++ b/tests/testcomp/RUN-2026-08-22-NOTES.md @@ -0,0 +1,69 @@ +# Corrida Test-Comp de 2026-08-22 — como ler os CSVs + +Resultados em `results_cover-error_s{0,1}/` e `results_cover-branches_s{0,1}/`, +produzidos por `run_testcomp_evaluation.sh` a partir dos manifestos em +`corpus/`. + +## Os rótulos `testcov` desta corrida são os antigos + +O script foi corrigido **depois** que os containers já estavam rodando, e um +`bash` em execução mantém o inode que abriu — a correção vale para as próximas +corridas, não para esta. Equivalência: + +| nesta corrida | significa | rótulo atual do script | +|---|---|---| +| `FULL` | TestCov validou sem abortar nenhum teste (`Result: DONE`) | `VALIDATED` | +| `PARTIAL` | TestCov abortou a execução de algum teste (`Result: UNKNOWN`) | `VALIDATED_ABORTS` | +| `COVERED` / `NOT_COVERED` | (cover-error) o erro foi ou não reproduzido | inalterados | + +**`FULL` não significa cobertura total.** Foi exatamente essa a inferência que +a corrida desmentiu nos primeiros minutos: `Result: DONE` aparece a 100%, a +77,78% e a 11,11%. A linha `Result` diz se a validação correu limpa, não quanto +foi coberto. + +## Qual coluna vale + +- **cover-branches**: `coverage` (percentual sobre `goals`). A competição + pontua a fração de ramos, não um passa/não-passa. +- **cover-error**: `testcov = COVERED`. Aí sim é binário — ou a suíte reproduz + o erro, ou não. + +## Estes números não são pontuação de competição + +`BUDGET=60s` por tarefa contra os **900s** do Test-Comp, e um subconjunto +estratificado de 372 + 480 tarefas contra o benchmark inteiro. O que a corrida +mede é cobertura funcional — a ferramenta produz suíte bem-formada em toda a +extensão do benchmark, e um validador independente concorda com o que a suíte +afirma. Citar como score seria enganoso. + +## Amostragem + +Cota fixa por subcategoria com passo determinístico (`build_corpus.py`), não +amostra uniforme: Floats e ECA sozinhos somam 2,6 mil das 33 mil tarefas, e uma +amostra uniforme reportaria o formato do benchmark em vez do comportamento da +ferramenta. Sem RNG — reexecutar o script no mesmo checkout dá o mesmo +manifesto. + + +## O que estes arquivos contêm + +| arquivo | tarefas | completude | +|---|---|---| +| `results_cover-error_s{0,1,2}/results.csv` | **818 de 818** | ✅ campanha completa | +| `results_cover-branches_s{0..4}/results.csv` | **1344 de 1522** | 🟡 parcial — as corridas foram encerradas para implementar as correções que estes dados motivaram | +| `results.q40-stride.csv` | 159 | amostragem ANTIGA (cota 40, passo uniforme), preservada para não se perder; **não misturar** com as acima, vieram de amostra diferente | + +Os parciais continuam válidos: o manifesto é intercalado por subcategoria, então +um prefixo é uma amostra balanceada das 12, não "as primeiras categorias +inteiras". + +## Os seis defeitos que estes dados revelaram + +Estão em [docs/TESTCOMP-CHECKLIST.md](../../docs/TESTCOMP-CHECKLIST.md) como +achados **L** a **Q**, todos corrigidos e cobertos por +`tests/integration/test_testcomp_regressions.sh`. Em resumo: suíte de +cover-error sem `<input>` (290 casos), `--property-file` relativo nunca lido, +`--cover-branches` caindo no pipeline de memtrack, coerção de tipo no +`MemoryTrackPass` (110 tarefas mortas em 2s), teto de 500 casos inviabilizando +a validação (116 falhas), e o KLEE descartando 3982 caminhos explorados ao +esgotar o orçamento. diff --git a/tests/testcomp/build_corpus.py b/tests/testcomp/build_corpus.py new file mode 100755 index 000000000..d1192250c --- /dev/null +++ b/tests/testcomp/build_corpus.py @@ -0,0 +1,302 @@ +#!/usr/bin/env python3 +"""Builds a stratified Test-Comp corpus manifest from sv-benchmarks. + +Stratified rather than random, and by SUBCATEGORY rather than over the whole +pool, for the same reason the Juliet runs are sharded by CWE: a uniform sample +of 33k tasks is dominated by whichever families happen to be largest (Floats +and ECA alone are 2.6k), and a result computed over it says more about the +benchmark's shape than about the tool. Fixing a quota per subcategory makes +"Map2Check does badly on Recursive" a statement the numbers can support. + +Selection inside a subcategory is deterministic and NESTED: the candidates are +sorted by path, then ordered by recursive bisection, and the first N are taken. +No RNG, no seed to record, and two properties fall out that a plain stride does +not give: + + * every prefix is evenly spread over the family, so a run cut short by its + deadline still sampled the whole range rather than one alphabetical corner; + * a larger quota is a SUPERSET of a smaller one. That matters as soon as the + corpus grows: with an even stride, raising the quota from 40 to 150 + preserved only 12 of 40 tasks in Arrays and 10 of 40 in Loops, Floats and + ECA -- 70% overall, but the big families almost entirely resampled, so the + measurements already taken could not be reused. + +The manifest itself is written round-robin across subcategories, not grouped by +them. A run that stops at its deadline stops after a balanced prefix; grouped +by category it would have finished Arrays and never reached XCSP, which throws +away the stratification the sampling exists to provide. + +Usage: + build_corpus.py --property cover-error --per-category 40 --out manifest.tsv + build_corpus.py --property cover-branches --per-category 40 --out manifest.tsv + build_corpus.py --property memsafety --per-category 10 --out manifest.tsv + build_corpus.py --property memcleanup --per-category 10 --out manifest.tsv + +For the memory properties the manifest carries two more columns, the expected +verdict and the subproperty (valid-deref, valid-free, valid-memtrack, +valid-memcleanup), because a FALSE only counts when its kind matches. +""" + +import argparse +import os +import sys + +HERE = os.path.dirname(os.path.abspath(__file__)) +BENCH = os.path.join(HERE, "bench", "sv-benchmarks", "c") + +# The subcategories, and why these. They span the shapes a test generator is +# actually challenged by -- array reasoning, bit-level operations, control-flow +# depth, heap shape, loop invariants, recursion, floating point, event-condition +# -action tables, feature interaction -- rather than the largest directories. +# Concurrency and the Termination sets are excluded: Map2Check declares no +# support for either, and running them would report zeros that mean nothing. +CATEGORIES = [ + "Arrays", + "BitVectors", + "ControlFlow", + "Heap", + "Loops", + "Recursive", + "Sequentialized", + "Floats", + "ECA", + "ProductLines", + "XCSP", + "LinkedLists", +] + +PROPERTY_FILE = { + "cover-error": "coverage-error-call.prp", + "cover-branches": "coverage-branches.prp", + "memsafety": "valid-memsafety.prp", + "memcleanup": "valid-memcleanup.prp", + "overflow": "no-overflow.prp", +} + +# The memory properties have no .set files in the local sv-benchmarks copy, so +# their categories are directory lists mirroring SV-COMP's MemSafety sets +# (tacasv2b spec, section 3.4). Threads and termination are left out: Map2Check +# supports neither, and running them would report zeros that mean nothing. +MEMORY_CATEGORIES = { + "memsafety": { + "Arrays": ["array-memsafety", "array-memsafety-realloc"], + "Heap": ["memsafety", "memsafety-ext", "memsafety-ext2", + "memsafety-ext3", "memsafety-broom", "ldv-memsafety", + "ldv-memsafety-bitfields", "forester-heap", + "heap-manipulation"], + "LinkedLists": ["list-simple", "list-ext-properties", + "list-properties", "ddv-machzwd"], + "Other": ["busybox-1.22.0", "coreutils-v8.31", "coreutils-v9.5-units", + "memsafety-cve", "uthash-2.0.2", "goblint-regression", + "goblint-coreutils"], + "Juliet": ["Juliet_Test"], + }, + "memcleanup": {"MemCleanup": ["*"]}, + # NoOverflows, mirroring SV-COMP's NoOverflows-Main/-BusyBox (tacasv2c). + "overflow": { + "Main": ["bitvector", "nla-digbench-scaling", "recursive-simple", + "loop-zilu", "signedintegeroverflow-regression", + "goblint-regression"], + "BusyBox": ["busybox-1.22.0"], + # No Juliet here: sv-benchmarks' Juliet_Test declares no no-overflow + # task. Juliet's CWE-190/191 are measured by tests/juliet instead. + }, +} + +EXCLUDED_DIRS = ("pthread", "weaver", "termination") + + +def expand_dirs(dirs): + """Every task definition in the given directories, in sorted order.""" + import glob + + paths = [] + for directory in dirs: + for path in glob.glob(os.path.join(BENCH, directory, "*.yml")): + top = os.path.relpath(path, BENCH).split(os.sep)[0] + if top.startswith(EXCLUDED_DIRS): + continue + paths.append(path) + return sorted(set(paths)) + + +def expand_set(name): + """Every task definition a .set file names, in sorted order.""" + import glob + + paths = [] + set_path = os.path.join(BENCH, name + ".set") + with open(set_path) as handle: + for line in handle: + line = line.strip() + if not line or line.startswith("#"): + continue + paths.extend(glob.glob(os.path.join(BENCH, line))) + return sorted(set(paths)) + + +def task_info(yml_path, wanted_property): + """Reads the fields the runner needs, or None if the task does not apply. + + Parsed by hand rather than with PyYAML: the fields wanted are three flat + scalars and one list of maps, the format is stable and version-stamped, and + a dependency here would have to exist inside the runner container too. + """ + input_file = None + data_model = "ILP32" # the sv-benchmarks default when unstated + has_property = False + expected = "" + subproperty = "" + in_properties = False + current_property = None + + with open(yml_path, errors="replace") as handle: + for raw in handle: + line = raw.rstrip("\n") + stripped = line.strip() + if stripped.startswith("input_files:"): + input_file = stripped.split(":", 1)[1].strip().strip("'\"") + elif stripped.startswith("data_model:"): + data_model = stripped.split(":", 1)[1].strip().strip("'\"") + elif stripped.startswith("properties:"): + in_properties = True + elif in_properties and stripped.startswith("- property_file:"): + current_property = stripped.split(":", 1)[1].strip() + elif in_properties and stripped.startswith("expected_verdict:"): + # Cover-* tasks report the unreach-call verdict (whether the + # error is reachable); the memory properties report their own. + verdict_of = ("unreach-call.prp" + if wanted_property.startswith("cover") + else PROPERTY_FILE[wanted_property]) + if current_property and current_property.endswith(verdict_of): + expected = stripped.split(":", 1)[1].strip() + elif in_properties and stripped.startswith("subproperty:"): + if current_property and current_property.endswith( + PROPERTY_FILE[wanted_property]): + subproperty = stripped.split(":", 1)[1].strip() + if current_property and current_property.endswith( + PROPERTY_FILE[wanted_property]): + has_property = True + + if input_file is None or not has_property: + return None + # A task definition may name several input files; Map2Check takes one. + if " " in input_file or "," in input_file: + return None + program = os.path.join(os.path.dirname(yml_path), input_file) + if not os.path.isfile(program): + return None + # Single-subproperty properties declare none on their tasks, but a FALSE + # of any other kind is still the wrong answer; Juliet_Test's MemSafety + # tasks declare none either, and any memory-safety FALSE answers them. + if expected == "false" and not subproperty: + if wanted_property == "memcleanup": + subproperty = "valid-memcleanup" + elif wanted_property == "overflow": + subproperty = "no-overflow" + elif wanted_property == "memsafety": + subproperty = "any" + return program, data_model, expected, subproperty + + +def spread_order(items): + """Deterministic permutation whose every prefix is evenly spread. + + Breadth-first recursive bisection: the middle element first, then the + middles of the two halves, then of the four quarters, and so on. Two + properties follow, and both are why this replaced an even stride. + + Any prefix covers the whole range. Taking the first N of a sorted list + would give N variations of one program, since task names inside a family + are ordered; taking a bisection prefix gives N spread across it. + + Prefixes nest. Because the order does not depend on N, the first 40 of this + sequence are the first 40 of any longer one -- so raising the quota ADDS + tasks instead of substituting them, and measurements already taken at the + smaller quota stay valid. An even stride does not have that property: at + the real pool sizes here, going from 40 to 150 kept 12 of 40 tasks in + Arrays and 10 of 40 in Loops, Floats and ECA. + """ + from collections import deque + + order = [] + queue = deque([(0, len(items) - 1)]) + while queue: + low, high = queue.popleft() + if low > high: + continue + middle = (low + high) // 2 + order.append(items[middle]) + queue.append((low, middle - 1)) + queue.append((middle + 1, high)) + return order + + +def nested_sample(items, quota): + """The first `quota` of the spread order.""" + if quota <= 0: + return [] + return spread_order(items)[:quota] + + +def main(): + parser = argparse.ArgumentParser() + parser.add_argument("--property", choices=sorted(PROPERTY_FILE), + required=True) + parser.add_argument("--per-category", type=int, default=40) + parser.add_argument("--out", required=True) + args = parser.parse_args() + + if not os.path.isdir(BENCH): + sys.exit("sv-benchmarks not found at %s -- run fetch-benchmarks.sh" + % BENCH) + + memory = args.property in MEMORY_CATEGORIES + categories = (list(MEMORY_CATEGORIES[args.property]) if memory + else CATEGORIES) + + per_category = {} + summary = [] + for category in categories: + applicable = [] + ymls = (expand_dirs(MEMORY_CATEGORIES[args.property][category]) + if memory else expand_set(category)) + for yml in ymls: + info = task_info(yml, args.property) + if info is not None: + applicable.append((yml,) + info) + chosen = nested_sample(applicable, args.per_category) + summary.append((category, len(applicable), len(chosen))) + per_category[category] = [ + (category, os.path.relpath(program, BENCH), data_model, + expected or "unknown") + ((subproperty,) if memory else ()) + for yml, program, data_model, expected, subproperty in chosen + ] + + # Round-robin, not grouped. A run that stops at its deadline should stop + # after a balanced prefix of every subcategory; written grouped, it would + # finish Arrays and never reach XCSP. + rows = [] + depth = max((len(v) for v in per_category.values()), default=0) + for index in range(depth): + for category in categories: + bucket = per_category.get(category, []) + if index < len(bucket): + rows.append(bucket[index]) + + with open(args.out, "w") as handle: + if memory: + handle.write( + "# category\tprogram\tdata_model\texpected\tsubproperty\n") + else: + handle.write("# category\tprogram\tdata_model\texpected_unreach\n") + for row in rows: + handle.write("\t".join(row) + "\n") + + for category, available, taken in summary: + print(" %-16s %5d applicable, %3d taken" % (category, available, taken)) + print(" %-16s %5d tasks written to %s" % ("TOTAL", len(rows), args.out)) + + +if __name__ == "__main__": + main() diff --git a/tests/testcomp/build_corpus_official.py b/tests/testcomp/build_corpus_official.py new file mode 100644 index 000000000..db25d4da1 --- /dev/null +++ b/tests/testcomp/build_corpus_official.py @@ -0,0 +1,207 @@ +#!/usr/bin/env python3 +"""Builds a PROPORTIONAL stratified Test-Comp corpus from the official +Test-Comp 2026 definitions. + +`build_corpus.py` stratifies by a FIXED quota per category (equal +representation). This script does the other thing the rerun asks for: the quota +of each category is proportional to how many applicable tasks it has, so the +corpus mirrors the benchmark's shape while still guaranteeing every category a +seat. + +The categories are not a hand-kept list here: they are read from the official +benchmark definition (the same file the validators use), including each +category's `<includesfile>`/`<excludesfile>`, so the corpus tracks the +competition's own task structure. A category that expands to no applicable task +gets no seat. + +Selection inside a category is the deterministic, nested bisection order of +`build_corpus.spread_order`, and the manifest is written round-robin, so a run +cut short by its deadline stays balanced. + +Usage: + build_corpus_official.py --property cover-error --total 0 --out ce.tsv + build_corpus_official.py --property cover-branches --total 3500 --out cb.tsv + +`--total 0` means "all applicable tasks" (no sampling). +""" + +import argparse +import glob +import os +import sys +import xml.etree.ElementTree as ET + +HERE = os.path.dirname(os.path.abspath(__file__)) +sys.path.insert(0, HERE) +import build_corpus as bc # noqa: E402 + +OFFICIAL_DEF = os.path.join(HERE, "official", "bench-defs", + "testcov-validate-test-suites-gcc-unformatted.xml") +DEF_DIR = os.path.dirname(OFFICIAL_DEF) + +RUNDEF = { + "cover-error": "Test-Comp26_coverage-error-call", + "cover-branches": "Test-Comp26_coverage-branches", +} + + +def category_name(rawname): + return rawname.rsplit(".", 1)[-1] + + +def set_file(entry, include): + """Where a definition's includesfile/excludesfile lives. + + Includes are all under sv-benchmarks/c. Excludes are either there + (DeviceDriversLinux64Large.set) or beside the definition (the ECA one), + referenced relative to it. + """ + entry = entry.strip() + if include or entry.startswith("../sv-benchmarks/c/"): + return os.path.join(bc.BENCH, os.path.basename(entry)) + return os.path.join(DEF_DIR, entry) + + +def read_set(path): + """Every .yml a set file names, resolved relative to sv-benchmarks/c.""" + paths = set() + if not os.path.isfile(path): + print(" (missing set file: %s)" % path, file=sys.stderr) + return paths + with open(path) as handle: + for line in handle: + line = line.strip() + if not line or line.startswith("#"): + continue + for hit in glob.glob(os.path.join(bc.BENCH, line)): + paths.add(os.path.realpath(hit)) + return paths + + +def applicable_categories(rundefinition, property_name): + """category -> applicable task tuples, in the definition's own order.""" + root = ET.parse(OFFICIAL_DEF).getroot() + run = next((r for r in root.findall("rundefinition") + if r.get("name") == rundefinition), None) + if run is None: + sys.exit("no rundefinition %s in %s" % (rundefinition, OFFICIAL_DEF)) + pools = {} + for tasks in run.findall("tasks"): + category = category_name(tasks.get("name")) + included = set() + for e in tasks.findall("includesfile"): + included |= read_set(set_file(e.text, True)) + excluded = set() + for e in tasks.findall("excludesfile"): + excluded |= read_set(set_file(e.text, False)) + rows = [] + for yml in sorted(included - excluded): + info = bc.task_info(yml, property_name) + if info is not None: + rows.append((yml,) + info) + if rows: + pools[category] = rows + return pools + + +def proportional_alloc(sizes, total): + """Quota per category: proportional to size, at least 1, at most size. + + Largest-remainder rounding, so the quotas add up to `total` (or to the whole + pool when that is smaller). + """ + pool = sum(sizes.values()) + target = pool if total <= 0 else min(total, pool) + categories = list(sizes) + if target <= 0: + return {c: 0 for c in categories} + if target < len(categories): + # Fewer seats than categories: keep the largest categories. + keep = set(sorted(categories, key=lambda c: (-sizes[c], c))[:target]) + return {c: (1 if c in keep else 0) for c in categories} + + ideal = {c: target * sizes[c] / pool for c in categories} + quotas = {} + for c in categories: + floor = int(ideal[c]) + quotas[c] = min(sizes[c], max(1, floor)) + short = target - sum(quotas.values()) + + # Largest fractional remainder takes the surplus, smallest gives back the + # overshoot, never below one seat and never above the pool. + if short != 0: + if short > 0: + order = sorted(categories, + key=lambda c: (-(ideal[c] - int(ideal[c])), -sizes[c], c)) + move = 1 + else: + order = sorted(categories, + key=lambda c: (ideal[c] - int(ideal[c]), sizes[c], c)) + move = -1 + guard = 0 + limit = len(order) * (max(sizes.values()) + 2) + while short != 0 and guard < limit: + for c in order: + if short == 0: + break + if move > 0 and quotas[c] < sizes[c]: + quotas[c] += 1 + short -= 1 + elif move < 0 and quotas[c] > 1: + quotas[c] -= 1 + short += 1 + guard += 1 + if short != 0: + sys.exit("proportional_alloc: could not reach target %d (off by %d)" + % (target, short)) + return quotas + + +def main(): + parser = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("--property", choices=sorted(RUNDEF), required=True) + parser.add_argument("--total", type=int, default=0, + help="target corpus size; 0 = all applicable") + parser.add_argument("--out", required=True) + args = parser.parse_args() + + if not os.path.isdir(bc.BENCH): + sys.exit("sv-benchmarks not found at %s" % bc.BENCH) + if not os.path.isfile(OFFICIAL_DEF): + sys.exit("official definition not found at %s" % OFFICIAL_DEF) + + pools = applicable_categories(RUNDEF[args.property], args.property) + sizes = {c: len(v) for c, v in pools.items()} + quotas = proportional_alloc(sizes, args.total) + + per_category = {} + print("%-45s %6s %6s" % ("category", "pool", "chosen")) + total = 0 + for category, rows in pools.items(): + chosen = bc.spread_order(rows)[:quotas[category]] + per_category[category] = [ + (category, os.path.relpath(program, bc.BENCH), data_model, + expected or "unknown") + for yml, program, data_model, expected, subproperty in chosen + ] + print("%-45s %6d %6d" % (category, sizes[category], len(chosen))) + total += len(chosen) + + depth = max((len(v) for v in per_category.values()), default=0) + rows = [] + for i in range(depth): + for category in pools: # round-robin, the definition's order + bucket = per_category[category] + if i < len(bucket): + rows.append(bucket[i]) + + with open(args.out, "w") as handle: + handle.write("# category\tprogram\tdata_model\texpected_unreach\n") + for row in rows: + handle.write("\t".join(row) + "\n") + print("total: %d tasks -> %s" % (len(rows), args.out)) + + +if __name__ == "__main__": + main() diff --git a/tests/testcomp/corpus/README.md b/tests/testcomp/corpus/README.md new file mode 100644 index 000000000..120959435 --- /dev/null +++ b/tests/testcomp/corpus/README.md @@ -0,0 +1,41 @@ +# Test-Comp corpus manifests + +Each `.tsv` lists the sv-benchmarks tasks a Test-Comp run executes, one per +line: `category`, `program` (relative to `sv-benchmarks/c/`), `data_model` +(ILP32 or LP64) and `expected_unreach`. The harness +(`tests/testcomp/run_testcomp_evaluation.sh`) reads it through `MANIFEST`. + +None is hand-edited: each comes from a builder script, and rebuilding it +reproduces the committed file byte for byte. Checked on 2026-10-22 against +sv-benchmarks `7efe28dd2`, the commit pinned by Test-Comp 2026 (`testcomp26` +tag of bench-defs). + +| Manifest | Tasks | Command | Commit | +|---|---|---|---| +| `cover-error-official.tsv` | 1902 | `build_corpus_official.py --property cover-error --total 0` | `0149e22f5` | +| `cover-branches-3500.tsv` | 3500 | `build_corpus_official.py --property cover-branches --total 3500` | `0149e22f5` | +| `cover-error-q400.tsv` | 1087 | `build_corpus.py --property cover-error --per-category 400` | `241adb230` | +| `cover-branches-q400.tsv` | 2765 | `build_corpus.py --property cover-branches --per-category 400` | `241adb230` | +| `cover-error.tsv` | 818 | `build_corpus.py --property cover-error --per-category 150` | `67b837834` | +| `cover-branches.tsv` | 1522 | `build_corpus.py --property cover-branches --per-category 150` | `67b837834` | +| `cover-error-q40.tsv` | 372 | `build_corpus.py --property cover-error --per-category 40` | `1f76c70d1` | +| `cover-branches-q40.tsv` | 480 | `build_corpus.py --property cover-branches --per-category 40` | `1f76c70d1` | + +Run the scripts from `tests/testcomp/` with `--out <file>`, after linking +`tests/testcomp/bench/sv-benchmarks` to an sv-benchmarks checkout. + +## The two builders + +- `build_corpus.py` takes a **fixed quota per subcategory** (`--per-category`), + so every family is equally represented. Its categories are the `.set` files + of sv-benchmarks. +- `build_corpus_official.py` reads the categories, with their + `<includesfile>`/`<excludesfile>`, from the **official Test-Comp 2026 + definition** (`official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml`), + and gives each a quota **proportional** to its size (`--total`; 0 means + every applicable task). This is the shape of the competition itself. + +Both select inside a category deterministically, by a nested bisection order: +the first N tasks of a larger quota are the N of a smaller one, so raising a +quota adds tasks instead of replacing them. Both write the rows round-robin +across categories, so a run cut short by its deadline is still balanced. diff --git a/tests/testcomp/corpus/cover-branches-3500.tsv b/tests/testcomp/corpus/cover-branches-3500.tsv new file mode 100644 index 000000000..719e8f8e6 --- /dev/null +++ b/tests/testcomp/corpus/cover-branches-3500.tsv @@ -0,0 +1,3501 @@ +# category program data_model expected_unreach +Arrays array-fpi/s52iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1a.cil.c ILP32 unknown +ECA eca-rers2012/Problem16_label00.c ILP32 false +Floats neural-networks/dubinsrejoin_79_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-99.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop3-back-serstep.c LP64 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_prod4br.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.ufo.BOUNDED-12.pals.c ILP32 true +XCSP xcsp/Haystacks-08.c ILP32 true +Combinations combinations/pals_lcr.3_overflow.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_callback_c_str_eq_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/printf-3.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/od_3args_klee-sa_ko_496_csa_nd.c LP64 unknown +SoftwareSystems-OpenBSD openbsd-6.2/if_etherip-fixed.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--common--tuners--mt2131.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-uthash uthash-2.0.2/uthash_JEN_nondet_test3-1.i ILP32 true +SoftwareSystems-SQLite sqlite/sqlite_merged_comb.i LP64 unknown +Termination-BitVectors termination-bwb/not-03.c LP64 unknown +Termination-MainControlFlow termination-crafted/NestedRecursion_2a.c LP64 unknown +Termination-MainHeap termination-memory-alloca/a.07-alloca.i LP64 unknown +Arrays array-examples/standard_two_index_08.i ILP32 true +BitVectors bitvector/jain_2-2.c ILP32 unknown +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +ECA eca-rers2012/Problem07_label00.c ILP32 true +Floats floats-esbmc-regression/ceil_nondet.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-188.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal212.c LP64 true +Heap ldv-memsafety/memleaks_test20-1.i ILP32 unknown +Loops loops/bubble_sort-1.c ILP32 unknown +ProductLines product-lines/elevator_spec3_product25.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohendiv.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/Dubois-017.c ILP32 true +Combinations combinations/Problem05_label48+token_ring.04.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_from_empty_array_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/fold-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/env_3args_klee-sa_ko_812-816-605_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-msi-digivox-ii.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-uthash uthash-2.0.2/uthash_JEN_nondet_test1-2.i ILP32 true +Termination-BitVectors termination-bwb/and-05.c LP64 unknown +Termination-MainControlFlow termination-crafted-lit/HeizmannHoenickeLeikePodelski-ATVA2013-Fig4.c LP64 unknown +Termination-MainHeap termination-dietlibc/atoll.i LP64 unknown +Arrays array-multidimensional/copy-partial-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_1-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.07.i.cil-1.c ILP32 unknown +ECA eca-rers2018/Problem14.c ILP32 false +Floats neural-networks/poly_256_thresh_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount25_file-188.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop2-func-interl.c LP64 true +Heap memsafety-cve/libredwg.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_unwindbound10.c ILP32 true +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +Combinations combinations/pals_lcr.8.ufo.UNBOUNDED.pals+Problem12_label07.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_capacity_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/tee-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_all_nines_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-nebula.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-BitVectors termination-bwb/or-03.c LP64 unknown +Termination-MainControlFlow termination-nla/prod4br-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cmemchr-alloca-1.i LP64 unknown +Arrays array-examples/sanfoundry_24-1.i ILP32 true +BitVectors bitvector/byte_add_1-2.i ILP32 unknown +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-2.c ILP32 unknown +ECA eca-rers2012/Problem03_label00.c ILP32 true +Floats float-newlib/double_req_bl_1231b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-142.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop3-func-interl.c LP64 true +Heap heap-data/shared_mem1.i ILP32 true +Loops loop-simple/nested_2.c ILP32 true +ProductLines product-lines/elevator_spec2_product01.cil.c ILP32 true +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+lhb-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +Combinations combinations/Problem05_label44+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_pop_back_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/cut-3.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_358_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-cinergy.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_entry_havoc_object.i LP64 false +Termination-BitVectors termination-bwb/and-02-false.c LP64 unknown +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex1.05.c LP64 unknown +Termination-MainHeap termination-15/cstrcpy_mixed_alloca.i LP64 unknown +Arrays array-fpi/modpf.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_2.cil-2.c ILP32 unknown +ECA eca-rers2012/Problem11_label00.c ILP32 false +Floats neural-networks/cartpole_7_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-53.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d128_e0.c LP64 false +Heap ldv-regression/test19.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo1-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.ufo.BOUNDED-10.pals.c ILP32 true +XCSP xcsp/Dubois-040.c ILP32 true +Combinations combinations/gcd_2+newton_3_7.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_eq_c_str_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/ls-incomplete-3.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/ln_3args_klee-sa_ko_147_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-videomate-m1f.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__safety_requirement_havoc_memory.i LP64 true +Termination-BitVectors termination-bwb/counting-bits-BK.i LP64 unknown +Termination-MainControlFlow termination-crafted/2Nested-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/BrockschmidtCookFuhs-2013CAV-Fig1-alloca-2.i LP64 unknown +Arrays array-memsafety/count_down-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_2.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.02.i.cil-2.c ILP32 unknown +ECA eca-rers2018/Problem10.c ILP32 false +Floats neural-networks/lunarlander_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-142.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.7.prop1-func-interl.c LP64 true +Heap memsafety-broom/sll-shared-before.i LP64 unknown +Loops nla-digbench-scaling/geo2-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +Recursive recursive-simple/id2_b3_o5.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +Combinations combinations/pals_lcr.6.ufo.BOUNDED-12.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_is_power_of_two_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/sleep-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/uniq_3args_klee-sa_ko_292_csa_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-digittrade.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_exit_havoc_object.i LP64 false +Termination-BitVectors termination-bwb/or-01-false.c LP64 unknown +Termination-MainControlFlow termination-nla/cohencu2-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/c.02-alloca.i LP64 unknown +Arrays array-programs/partial_mod_count_limited_5.c ILP32 true +BitVectors bitvector/soft_float_4-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.13.i.cil-1.c ILP32 unknown +ECA eca-rers2018/Problem18.c ILP32 false +Floats neural-networks/softsign_w16_r2_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-53.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.2.prop1-back-serstep.c LP64 true +Heap memsafety-cve/zchunkFixed.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound1.c ILP32 true +ProductLines product-lines/email_spec8_product14.cil.c ILP32 true +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-2+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_bytes_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/uudecode-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_different_paths_output_cover_target.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-winfast.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_exit_havoc_object.i LP64 false +Termination-BitVectors termination-bwb/parity1.i LP64 unknown +Termination-MainControlFlow termination-restricted-15/PastaA4.c LP64 unknown +Termination-MainHeap termination-memory-linkedlists/ll_search-alloca.i LP64 unknown +Arrays array-crafted/xor1.i ILP32 true +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow infeasible-control-flow/unreach_branch3.c ILP32 true +ECA eca-programs/Problem102_label00.c ILP32 true +Floats float-benchs/sin_interpolated_negation.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-12.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d64_e0.c LP64 false +Heap forester-heap/sll-circular-1.i ILP32 true +Loops loop-invgen/heapsort.i ILP32 true +ProductLines product-lines/elevator_spec1_product17.cil.c ILP32 true +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +Combinations combinations/Problem05_label42+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_clear_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/chgrp-incomplete-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1366-1317-1319-1334_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-anysee.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-speedpldi4.c LP64 unknown +Termination-MainHeap termination-15/array20_alloca.i LP64 unknown +Arrays array-examples/standard_copy9_ground-2.i ILP32 true +BitVectors bitvector/gcd_2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl1.cil.c ILP32 unknown +Floats floats-cbmc-regression/float-flags-simp1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-165.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal146.c LP64 true +Heap ldv-memsafety/memleaks_test12-2.i ILP32 unknown +Loops loop-zilu/benchmark40_polynomial.i ILP32 unknown +ProductLines product-lines/elevator_spec2_product29.cil.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +Combinations combinations/Problem05_label46+token_ring.02.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_append_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/du-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_584-249-471_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-gadmei-rm008z.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex3.03.c LP64 unknown +Termination-MainHeap termination-15/cstrncmp_reverse_alloca.i LP64 unknown +Arrays array-fpi/eqn4.c ILP32 true +BitVectors bitvector/modulus-1.i ILP32 unknown +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Floats neural-networks/cartpole_31_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-30.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal69.c LP64 true +Heap ldv-memsafety/memleaks_test6_1.i ILP32 unknown +Loops loops/trex04_abstracted.c ILP32 true +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_egcd2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/Dubois-024.c ILP32 true +Combinations combinations/gcd_1+newton_1_5.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_from_whole_buffer_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/hostid.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/join_3args_klee-sa_ko_473-810_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-proteus-2309.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/Masse-VMCAI2014-Fig1b.c LP64 unknown +Termination-MainHeap termination-dietlibc/strlcat.i LP64 unknown +Arrays array-fpi/s12iff.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1.cil-1.c ILP32 unknown +Floats neural-networks/dubinsrejoin_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-76.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.exit.2.prop1-back-serstep.c LP64 true +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_valuebound1.c ILP32 true +ProductLines product-lines/email_spec11_product23.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_hard-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/Dubois-075.c ILP32 true +Combinations combinations/gcd_4+newton_3_1.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_read_be32_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/od-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/nl_3args_klee-sa_ko_172-232_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--w1--slaves--w1_ds2760.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Copenhagen_disj-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/Masse-alloca.i LP64 unknown +Arrays array-fpi/ss4f.c ILP32 false +BitVectors bitvector/s3_srvr_1.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_6.cil-2.c ILP32 unknown +Floats neural-networks/gelu_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-12.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.3.prop1-func-interl.c LP64 false +Heap memsafety-broom/dll-fst-shared.i LP64 unknown +Loops nla-digbench-scaling/geo1-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps4.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.ufo.BOUNDED-16.pals.c ILP32 true +XCSP xcsp/Haystacks-15.c ILP32 true +Combinations combinations/pals_lcr.5.1.ufo.UNBOUNDED.pals+Problem12_label02.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_create_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/realpath-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/split_3args_klee-sa_ko_235_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-ati-x10.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Singapore_plus.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.06-alloca.i LP64 unknown +Arrays array-memsafety/openbsd_cmemset-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.01.i.cil-2.c ILP32 unknown +Floats neural-networks/lunarlander_88_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount10_file-165.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop3-back-serstep.c LP64 true +Heap memsafety-cve/gpac_16Found.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +Combinations combinations/pals_lcr.7.ufo.UNBOUNDED.pals+Problem12_label00.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_pop_back_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/stty-3.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/uniq_3args_ok.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-imon-mce.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-nla/egcd3-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/diff-alloca-1.i LP64 unknown +Arrays array-patterns/array22_pattern.c ILP32 true +BitVectors bitvector/soft_float_2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.10.i.cil-1.c ILP32 unknown +Floats neural-networks/poly_8_8_8_thresh_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-30.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.2.prop2-func-interl.c LP64 true +Heap memsafety-cve/pacparser.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_unwindbound1.c ILP32 true +ProductLines product-lines/email_spec7_product17.cil.c ILP32 true +Recursive recursive/Addition03-1.c ILP32 true +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-2+token_ring.11.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_s_sift_either_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/uname-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_identical_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-real-audio-220-32-keys.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-numeric/Fibonacci01-2-overflow.c LP64 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstrpbrk-alloca-1.i LP64 unknown +Arrays array-tiling/tcpy.c ILP32 true +BitVectors bitvector/soft_float_5.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.16.i.cil-1.c ILP32 unknown +Floats neural-networks/tanh_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-76.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p12.c LP64 true +Heap memsafety/global-atexit-5.i ILP32 unknown +Loops nla-digbench/egcd2.c ILP32 unknown +ProductLines product-lines/email_spec9_product12.cil.c ILP32 true +Recursive recursive/recHanoi02-2.c ILP32 true +Sequentialized seq-pthread/cs_sync.i ILP32 true +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +Combinations combinations/square_2+soft_float_4-2a.c.cil.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_eq_ignore_case_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/who-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_potential_buffer_overflow_functional.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--regulator--userspace-consumer.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-restricted-15/b.03-no-inv_assume.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/rec_malloc_ex11C.i LP64 unknown +Arrays array-crafted/bor1.i ILP32 true +ControlFlow infeasible-control-flow/conflict_branch3.c ILP32 true +Floats float-benchs/interpolation.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-108.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d16_e0.c LP64 false +Heap forester-heap/dll-rb-sentinel-2.i ILP32 true +Loops loop-industry-pattern/aiob_3.c ILP32 true +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +Combinations combinations/Problem05_label41+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/basename-2.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1318-1332_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--leds--ledtrig-default-on.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-easy2-2.c LP64 unknown +Termination-MainHeap termination-15/array09_alloca.i LP64 unknown +Arrays array-crafted/zero_sum_const_m2.c ILP32 true +ControlFlow memory-model/2SB.i ILP32 false +Floats float-newlib/double_req_bl_0670.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-130.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.4.prop1-back-serstep.c LP64 false +Heap forester-heap/sll-simple-white-blue-2.i ILP32 false +Loops loop-lit/gj2007b.i ILP32 true +ProductLines product-lines/elevator_spec1_product25.cil.c ILP32 true +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +Combinations combinations/Problem05_label43+token_ring.05.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_get_at_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/chroot-incomplete-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_486-536-923_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-avermedia-m733a-rm-k6.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChawdharyCookGulwaniSagivYang-ESOP2008-aaron12.c LP64 unknown +Termination-MainHeap termination-15/cstrchr_malloc.i LP64 unknown +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-2.c ILP32 unknown +Floats float-newlib/float_req_bl_0875.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-153.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal112.c LP64 true +Heap heap-manipulation/tree-2.i ILP32 false +Loops loop-zilu/benchmark18_conjunctive.i ILP32 true +ProductLines product-lines/elevator_spec2_product21.cil.c ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +Combinations combinations/Problem05_label45+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_sort_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/date-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_462-471_csa_infer_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-em-terratec.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.12.c LP64 unknown +Termination-MainHeap termination-15/cstrlen_reverse_alloca.i LP64 unknown +Arrays array-examples/standard_running-2.i ILP32 true +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-176.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal18.c LP64 true +Heap ldv-memsafety/memleaks_test16_2.i ILP32 unknown +Loops loops-crafted-1/in-de61.c ILP32 true +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_bresenham-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +XCSP xcsp/CostasArray-16.c ILP32 false +Combinations combinations/Problem05_label46+token_ring.12.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_eq_c_str_ignore_case_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/echo-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/env_3args_klee-sa_ko_617-835_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-kaiomy.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/CookSeeZuleger-TACAS2013-Fig7b.c LP64 unknown +Termination-MainHeap termination-15/cstrpbrk_reverse_alloca.i LP64 unknown +Arrays array-fpi/brs5f_overflow.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-3.c ILP32 true +Floats loop-floats-scientific-comp/loop3.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-199.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal35.c LP64 true +Heap ldv-memsafety/memleaks_test23_1.i ILP32 unknown +Loops loops/string-2.i ILP32 false +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_divbin2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +XCSP xcsp/Dubois-020.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.06.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_reset_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/env_3args_klee-sa_ko_884-777_infer_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-pctv-sedna.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/LeeJonesBen-Amram-POPL2001-Ex4.c LP64 unknown +Termination-MainHeap termination-dietlibc/strcat.i LP64 unknown +Arrays array-fpi/ifeqn5f.c ILP32 false +ControlFlow openssl-simplified/s3_clnt_1.cil-1.c ILP32 unknown +Floats neural-networks/cartpole_55_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-41.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.1.prop2-func-interl.c LP64 true +Heap ldv-regression/alias_of_return_2.i ILP32 true +Loops nla-digbench-scaling/cohencu-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_fermat1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/Dubois-028.c ILP32 true +Combinations combinations/gcd_2+newton_1_2.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_advance_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/join_3args_klee-sa_ko_696-489_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-terratec-cinergy-xs.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/Urban-WST2013-Fig2.c LP64 unknown +Termination-MainHeap termination-dietlibc/strtok_r.i LP64 unknown +Arrays array-fpi/nsqm-if.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_3.cil-3.c ILP32 unknown +Floats neural-networks/cos_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_fillercode_normal_file-64.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.1.prop1-back-serstep.c LP64 false +Heap ldv-regression/test27-1.c ILP32 true +Loops nla-digbench-scaling/divbin2_valuebound20.i ILP32 true +ProductLines product-lines/email_spec11_product03.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo2-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.ufo.BOUNDED-12.pals.c ILP32 true +XCSP xcsp/Dubois-055.c ILP32 true +Combinations combinations/gcd_3+newton_3_4.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_from_buf_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/ln_3args_klee-sa_ko_194-351_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--platform--x86--topstar-laptop.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Bangalore_v4.c LP64 unknown +Termination-MainHeap termination-memory-alloca/CookSeeZuleger-2013TACAS-Fig7b-alloca.i LP64 unknown +Arrays array-fpi/s3lif.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_11.cil.c ILP32 unknown +Floats neural-networks/dubinsrejoin_54_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-87.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.4.prop2-back-serstep.c LP64 true +Heap list-ext-properties/test-0158_1-1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec11_product36.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_knuth.i ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/Dubois-095.c ILP32 true +Combinations combinations/pals_lcr.3.ufo.BOUNDED-6.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_satisfies_pred_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/nl_3args_klee-sa_ko_569-365_csa_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--hwmon--max1111.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted/Lobnya-Boolean-Reordered-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/Toulouse-MultiBranchesToLoop-alloca.i LP64 unknown +Arrays array-fpi/sina4.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_3.cil.c ILP32 unknown +Floats neural-networks/erf_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-108.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.1.prop1-back-serstep.c LP64 false +Heap list-properties/list-1.i ILP32 true +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.ufo.BOUNDED-14.pals.c ILP32 true +XCSP xcsp/Haystacks-11.c ILP32 true +Combinations combinations/pals_lcr.4.ufo.UNBOUNDED.pals+Problem12_label00.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_iter_done_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/od_3args_klee-sa_ko_917-491_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--dvb--frontends--dib3000mc.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Nyala-2lex-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/array03-alloca-1.i LP64 unknown +Arrays array-lopstr16/base_case.i ILP32 true +Floats neural-networks/lunarlander_16_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-130.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.2.prop1-back-serstep.c LP64 true +Heap memsafety-broom/sll-fst-data.i LP64 unknown +Loops nla-digbench-scaling/geo1-u_valuebound2.c ILP32 false +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps6.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/Haystacks-19.c ILP32 true +Combinations combinations/pals_lcr.5.ufo.UNBOUNDED.pals+Problem12_label07.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_init_bounded_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/split_3args_klee-sa_ko_664_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-azurewave-ad-tu700.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Toulouse-MultiBranchesToLoop-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.14-alloca.i LP64 unknown +Arrays array-memsafety/cstrpbrk-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_63_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount100_file-153.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.4.prop1-back-serstep.c LP64 true +Heap memsafety-cve/dlt-daemon.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-3.c ILP32 true +Combinations combinations/pals_lcr.6_overflow.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_init_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/uniq_3args_klee-sa_ko_499-513-538-654_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-evga-indtube.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-nla/dijkstra3-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/cstrcpy-alloca-2.i LP64 unknown +Arrays array-memsafety/openbsd_cstrstr-alloca-2.i ILP32 unknown +Floats neural-networks/poly_128_thresh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-176.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop5-func-interl.c LP64 false +Heap memsafety-cve/jhead.i ILP32 unknown +Loops nla-digbench-scaling/knuth_unwindbound100.i ILP32 true +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-3.c ILP32 true +Combinations combinations/pals_lcr.8.1.ufo.UNBOUNDED.pals+Problem12_label02.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_remove_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_64bit_number_cover_target.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-leadtek-y04g0051.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-nla/geo3-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/insertionsort-alloca-2.i LP64 unknown +Arrays array-multidimensional/transpose-u.c ILP32 true +Floats neural-networks/poly_4_4_4_4_thresh_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-199.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.1.prop1-func-interl.c LP64 false +Heap memsafety-cve/mujs.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +Recursive recursive/Ackermann04.c ILP32 true +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-2+token_ring.01.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_push_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_negative_cover_target.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-pixelview-002t.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/ps6-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstrcpy-alloca-1.i LP64 unknown +Arrays array-patterns/array5_pattern.c ILP32 true +Floats neural-networks/softmax_10_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-41.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d64_e0.c LP64 false +Heap memsafety-cve/smartdns.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-2.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-1+token_ring.08.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_ring_buffer_acquire_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_symmetry_functional.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-tivo.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-numeric/twisted.c LP64 unknown +Termination-MainHeap termination-memory-alloca/subseq-alloca-1.i LP64 unknown +Arrays array-tiling/pnr4.c ILP32 true +Floats neural-networks/softsign_w64_r3_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-64.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.8.prop1-func-interl.c LP64 false +Heap memsafety-ext2/length_test03-1.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_unwindbound2.c ILP32 true +ProductLines product-lines/email_spec8_product29.cil.c ILP32 true +Recursive recursive/McCarthy91-2.c ILP32 true +Combinations combinations/pc_sfifo_3.cil+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_eq_byte_buf_ignore_case_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_matching_paths_output_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--mmc--host--sdricoh_cs.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-restricted-15/PastaC7.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/insertionSort_recursive.i LP64 unknown +Arrays reducercommutativity/rangesum10.i ILP32 false +Floats neural-networks/tanh_w64_r1_case_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-88.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_am2910_p2.c LP64 true +Heap memsafety/test-0232-1.i ILP32 unknown +Loops nla-digbench/lcm2.c ILP32 true +ProductLines product-lines/email_spec9_product28.cil.c ILP32 true +Recursive verifythis/prefixsum_rec.c ILP32 true +Combinations combinations/square_6+soft_float_1-2a.c.cil.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/sliced_aws_array_eq_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/seq_incr_no_carry_cover_target.i LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--w1--slaves--w1_ds2408.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-restricted-15/b.15.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/rec_malloc_ex7.i LP64 unknown +Arrays array-cav19/array_min_and_copy_shift_sum_add.c ILP32 true +Floats float-benchs/filter1.c.v+lhb-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-193.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-back-serstep.c LP64 false +Heap forester-heap/dll-optional-2.i ILP32 false +Loops loop-acceleration/simple_2-1.c ILP32 true +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Combinations combinations/Problem05_label40+token_ring.10.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_c_str_harness-1.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/comm_3args_klee-sa_ko_243_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--acpi--container.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-complex.c LP64 unknown +Termination-MainHeap termination-15/array05_alloca.i LP64 unknown +Arrays array-crafted/mapavg3.i ILP32 true +Floats float-benchs/mea8000.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-24.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d8_e0.c LP64 false +Heap forester-heap/dll-token-1.i ILP32 true +Loops loop-invgen/SpamAssassin-loop.i.v+cfa-reducer.c ILP32 true +ProductLines product-lines/elevator_spec1_product01.cil.c ILP32 true +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Combinations combinations/Problem05_label42+token_ring.03.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_back_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1332_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--dvb--frontends--dvb_dummy_fe.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-random1d-1.c LP64 unknown +Termination-MainHeap termination-15/array16_alloca_fixed.i LP64 unknown +Arrays array-crafted/zero_sum3.c ILP32 true +Floats float-benchs/zonotope_loose.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-36.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.2.prop1-back-serstep.c LP64 false +Heap forester-heap/sll-rb-cnstr_1-1.i ILP32 true +Loops loop-invgen/up.i ILP32 true +ProductLines product-lines/elevator_spec1_product21.cil.c ILP32 true +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Combinations combinations/Problem05_label42+token_ring.13.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_ensure_capacity_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1367-1318-1319-1332_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-ati-x10.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/Ben-Amram-LMCS2010-Ex2.3.c LP64 unknown +Termination-MainHeap termination-15/cstrcat_malloc.i LP64 unknown +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Floats float-newlib/double_req_bl_0876.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-47.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.6.prop1-back-serstep.c LP64 false +Heap heap-data/cart.i ILP32 true +Loops loop-new/count_by_1_variant.i ILP32 true +ProductLines product-lines/elevator_spec1_product29.cil.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.10.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_init_dynamic_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_685_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-azurewave-ad-tu700.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChawdharyCookGulwaniSagivYang-ESOP2008-easy2.c LP64 unknown +Termination-MainHeap termination-15/cstrcmp_mixed_alloca.i LP64 unknown +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Floats float-newlib/float_req_bl_0670.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-59.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop3-func-interl.c LP64 true +Heap heap-manipulation/dll_of_dll-2.i ILP32 false +Loops loop-zilu/benchmark07_linear.i ILP32 unknown +ProductLines product-lines/elevator_spec2_product17.cil.c ILP32 true +Combinations combinations/Problem05_label44+token_ring.12.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_push_back_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_368_infer_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-digittrade.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.06.c LP64 unknown +Termination-MainHeap termination-15/cstrcspn_mixed_alloca.i LP64 unknown +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +Floats float-newlib/float_req_bl_1130b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-7.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal129.c LP64 true +Heap ldv-memsafety/memleaks_test10-1.i ILP32 unknown +Loops loop-zilu/benchmark28_linear.i ILP32 unknown +ProductLines product-lines/elevator_spec2_product25.cil.c ILP32 true +Combinations combinations/Problem05_label45+token_ring.10.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_swap_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_573-462-256-471_csa_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-evga-indtube.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.18.c LP64 unknown +Termination-MainHeap termination-15/cstrncat_reverse_alloca.i LP64 unknown +Arrays array-examples/standard_palindrome_ground.i ILP32 true +Floats floats-cbmc-regression/float8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-81.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal162.c LP64 true +Heap ldv-memsafety/memleaks_test14_2.i ILP32 unknown +Loops loop-zilu/benchmark51_polynomial.i ILP32 true +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +Combinations combinations/Problem05_label46+token_ring.07.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_clean_up_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-imon-mce.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex3.09.c LP64 unknown +Termination-MainHeap termination-15/cstrncpy_reverse_alloca.i LP64 unknown +Arrays array-examples/standard_strcpy_original-2.i ILP32 true +Floats floats-cdfpl/sine_3.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-92.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal196.c LP64 true +Heap ldv-memsafety/memleaks_test18.i ILP32 unknown +Loops loops-crafted-1/sumt3.c ILP32 true +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +Combinations combinations/Problem05_label47+token_ring.06.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_from_array_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-leadtek-y04g0051.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/GulavaniGulwani-CAV2008-Fig1c.c LP64 unknown +Termination-MainHeap termination-15/cstrspn_reverse_alloca.i LP64 unknown +Arrays array-fpi/brs2f.c ILP32 false +Floats floats-nonlinear/coral-benchmark01.c ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_co_file-102.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal23.c LP64 true +Heap ldv-memsafety/memleaks_test22_2-1.i ILP32 unknown +Loops loops/invert_string-3.c ILP32 true +ProductLines product-lines/elevator_spec3_product29.cil.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.01.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_init_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-nebula.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_num_tdcx__cover_entry_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/KroeningSharyginaTsitovichWintersteiger-CAV2010-Ex.c LP64 unknown +Termination-MainHeap termination-dietlibc/dirname-2.i LP64 unknown +Arrays array-fpi/condn.c ILP32 true +Floats neural-networks/cartpole_19_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-113.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal51.c LP64 true +Heap ldv-memsafety/memleaks_test4-1.i ILP32 unknown +Loops loops/terminator_02-2.c ILP32 true +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +Combinations combinations/Problem05_label49+token_ring.11.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_be16_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-pixelview-002t.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/LeikeHeizmann-TACAS2014-Ex9.c LP64 unknown +Termination-MainHeap termination-dietlibc/strcmp_short.i LP64 unknown +Arrays array-fpi/ifeqn1f.c ILP32 false +Floats neural-networks/cartpole_43_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-125.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal85.c LP64 true +Heap ldv-memsafety/memleaks_test8_1.i ILP32 unknown +Loops nla-digbench-scaling/bresenham-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec0_product05.cil.c ILP32 true +Combinations combinations/gcd_1+newton_2_7.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_from_whole_string_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-real-audio-220-32-keys.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/PodelskiRybalchenko-TACAS2011-Fig1.c LP64 unknown +Termination-MainHeap termination-dietlibc/strrchr.i LP64 unknown +Arrays array-fpi/indp3f.c ILP32 false +Floats neural-networks/cartpole_67_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-136.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.6.prop1-func-interl.c LP64 false +Heap ldv-regression/rule60_list2.i ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_unwindbound100.c ILP32 true +ProductLines product-lines/email_spec0_product24.cil.c ILP32 true +Combinations combinations/gcd_2+newton_2_4.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_compare_lookup_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-tivo.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/cstrncmp.c LP64 unknown +Termination-MainHeap termination-dietlibc/wcsrchr.i LP64 unknown +Arrays array-fpi/ms3.c ILP32 true +Floats neural-networks/cartpole_91_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-148.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.collision.4.prop1-func-interl.c LP64 true +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/dijkstra-u_valuebound50.c ILP32 true +ProductLines product-lines/email_spec0_product37.cil.c ILP32 true +Combinations combinations/gcd_3+newton_2_1.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_eq_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-winfast.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Arrays01-EquivalentConstantIndices-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/CookSeeZuleger-2013TACAS-Fig3-alloca.i LP64 unknown +Arrays array-fpi/res1f.c ILP32 false +Floats neural-networks/dubinsrejoin_17_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-159.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.elevator.4.prop1-func-interl.c LP64 true +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/divbin_valuebound100.i ILP32 true +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +Combinations combinations/gcd_4+newton_1_6.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_left_trim_pred_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--uwb--i1480--i1480-est.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Cairo_nondet.c LP64 unknown +Termination-MainHeap termination-memory-alloca/HarrisLalNoriRajamani-2010SAS-Fig3-alloca.i LP64 unknown +Arrays array-fpi/s2if.c ILP32 true +Floats neural-networks/dubinsrejoin_41_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-170.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.1.prop1-func-interl.c LP64 true +Heap list-ext-properties/list-ext_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +Combinations combinations/pals_lcr.3.1.ufo.BOUNDED-6.pals+Problem12_label04.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_read_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--acpi--container.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Hanoi_3vars.c LP64 unknown +Termination-MainHeap termination-memory-alloca/TelAviv-Amir-Minimum-alloca.i LP64 unknown +Arrays array-fpi/s4iff_overflow.c ILP32 unknown +Floats neural-networks/dubinsrejoin_66_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-181.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.5.prop1-func-interl.c LP64 false +Heap list-ext-properties/test-0232_1-2.i ILP32 unknown +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +Combinations combinations/pals_lcr.3.ufo.UNBOUNDED.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_byte_cursor_ptr_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--leds--leds-bd2802.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Mysore-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/a.01-alloca.i LP64 unknown +Arrays array-fpi/s5liff.c ILP32 false +Floats neural-networks/dubinsrejoin_90_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-193.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_FourbyFour.c LP64 true +Heap list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_valuebound5.c ILP32 true +ProductLines product-lines/email_spec1_product28.cil.c ILP32 true +Combinations combinations/pals_lcr.4.1.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_iter_begin_harness-1.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--common--tuners--tda9887.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/NonTerminationSimple4.c LP64 unknown +Termination-MainHeap termination-memory-alloca/a.10-alloca.i LP64 unknown +Arrays array-fpi/sqmf.c ILP32 false +Floats neural-networks/gcas_10_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-24.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.6.prop1-back-serstep.c LP64 false +Heap list-properties/simple_built_from_end.i ILP32 true +Loops nla-digbench-scaling/geo1-ll2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +Combinations combinations/pals_lcr.4_overflow.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_string_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-alink-dtu-m.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Pure3Phase-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.03-no-inv_assume-alloca.i LP64 unknown +Arrays array-industry-pattern/array_of_struct_ptr_monotonic.i ILP32 true +Floats neural-networks/logistic_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-36.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.5.prop1-func-interl.c LP64 true +Heap memsafety-broom/linux-hlist-fst-data.i LP64 unknown +Loops nla-digbench-scaling/geo1-u2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +Combinations combinations/pals_lcr.5.ufo.BOUNDED-10.pals+Problem12_label06.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_find_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-avermedia-m135a.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted/SyntaxSupportPointer01-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.10-alloca.i LP64 unknown +Arrays array-memsafety-realloc/array-realloc-3.i ILP32 unknown +Floats neural-networks/lunarlander_27_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-47.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.5.prop1-back-serstep.c LP64 true +Heap memsafety-broom/sll-nested-linux-list.i LP64 unknown +Loops nla-digbench-scaling/geo2-ll2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +Combinations combinations/pals_lcr.6.1.ufo.BOUNDED-12.pals+Problem12_label04.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_put_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-cinergy-1400.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/easy1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.18-alloca.i LP64 unknown +Arrays array-memsafety/cstrcspn-alloca-1.i ILP32 unknown +Floats neural-networks/lunarlander_51_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-59.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mcs.1.prop1-func-interl.c LP64 true +Heap memsafety-cve/NanoNNG.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +Combinations combinations/pals_lcr.6.ufo.UNBOUNDED.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_begin_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-em-terratec.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/cohencu5-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/count_down-alloca-2.i LP64 unknown +Arrays array-memsafety/knapsack_alloca_unsafe.i ILP32 unknown +Floats neural-networks/lunarlander_75_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-7.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop1-func-interl.c LP64 false +Heap memsafety-cve/gpac_1.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_valuebound10.c ILP32 true +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +Combinations combinations/pals_lcr.7.1.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_next_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-fusionhdtv-mce.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/dijkstra6-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/cstrncmp-alloca-2.i LP64 unknown +Arrays array-memsafety/openbsd_cstrlcpy-alloca-1.i ILP32 unknown +Floats neural-networks/lunarlander_99_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount10_file-81.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.1.prop1-back-serstep.c LP64 true +Heap memsafety-cve/gpac_5.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound20.c ILP32 unknown +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +Combinations combinations/pals_lcr.7_overflow.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_push_back_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-it913x-v2.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/freire1-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/ex3a-alloca.i LP64 unknown +Arrays array-memsafety/stroeder2-alloca-1.i ILP32 unknown +Floats neural-networks/poly_16_16_16_thresh_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-92.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.4.prop1-back-serstep.c LP64 true +Heap memsafety-cve/krb5.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +Combinations combinations/pals_lcr.8.ufo.BOUNDED-16.pals+Problem12_label06.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_mul_size_checked_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-medion-x10.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/knuth-nosqrt-both-t.i ILP32 unknown +Termination-MainHeap termination-memory-alloca/lis-alloca-2.i LP64 unknown +Arrays array-multidimensional/init-non-constant-2-n-u.c ILP32 true +Floats neural-networks/poly_32_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-102.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop5-func-interl.c LP64 false +Heap memsafety-cve/minizip-ngFixed.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_valuebound50.c ILP32 true +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-1+token_ring.03.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_init_dynamic_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-pctv-sedna.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-nla/ps3-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstpcpy-alloca-2.i LP64 unknown +Arrays array-patterns/array16_pattern.c ILP32 true +Floats neural-networks/poly_64_64_thresh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-113.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.4.prop1-func-interl.c LP64 false +Heap memsafety-cve/openNDS_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_unwindbound100.c ILP32 true +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-2+token_ring.06.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_remove_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-powercolor-real-angel.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-numeric/Avg_true.c LP64 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstrncat-alloca-1.i LP64 unknown +Arrays array-patterns/array29_pattern.c ILP32 true +Floats neural-networks/robot_5_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-125.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.1.prop1-func-interl.c LP64 false +Heap memsafety-cve/radare2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound5.c ILP32 true +ProductLines product-lines/email_spec7_product24.cil.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-1+token_ring.02.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_size_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-technisat-usb2.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-numeric/TerminatorRec02.c LP64 unknown +Termination-MainHeap termination-memory-alloca/selectionsort-alloca-2.i LP64 unknown +Arrays array-programs/copysome1-1.i ILP32 true +Floats neural-networks/softplus_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-136.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.1.prop1-func-interl.c LP64 false +Heap memsafety-cve/sofia-sip_2.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_valuebound10.c ILP32 true +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-1+token_ring.13.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_ring_buffer_init_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-twinhan1027.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-restricted-15/Log.c LP64 unknown +Termination-MainHeap termination-memory-linkedlists/cll_search-alloca-1.i LP64 unknown +Arrays array-tiling/mlceu.c ILP32 false +Floats neural-networks/softsign_w32_r4_case_1_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-148.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.4.prop1-back-serstep.c LP64 false +Heap memsafety-ext/skiplist_3lvl.i ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +Combinations combinations/pc_sfifo_3.cil+token_ring.03.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_destroy_harness_negated.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--misc--apds9802als.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-restricted-15/PastaB17.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/chunk1-2.i LP64 unknown +Arrays array-tiling/revcpyswp2.c ILP32 true +Floats neural-networks/sqrt_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-159.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.twocount32.c LP64 false +Heap memsafety-ext3/freeAlloca.c ILP32 unknown +Loops nla-digbench/bresenham.c ILP32 unknown +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +Combinations combinations/pc_sfifo_3.cil+token_ring.13.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_eq_c_str_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--mtd--tests--mtd_subpagetest.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-restricted-15/a.06.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/rec_malloc_ex1.i LP64 unknown +Arrays reducercommutativity/max.i ILP32 true +Floats neural-networks/tanh_w32_r2_case_1_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_s_file-170.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_arrays_itc99_b12_p2.c LP64 true +Heap memsafety/test-0102-1.i ILP32 unknown +Loops nla-digbench/geo2-ll.c ILP32 true +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +Combinations combinations/square_4+soft_float_3a.c.cil.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_new_from_c_str_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--usb--misc--trancevibrator.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_num_tdcx__cover_entry_havoc_memory.i LP64 true +Termination-MainControlFlow termination-restricted-15/b.09-no-inv_assume.c LP64 unknown +Arrays reducercommutativity/sep40-1.i ILP32 true +Floats neural-networks/tanh_w8_r4_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-182.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p7.c LP64 false +Heap memsafety/test-0235-2.i ILP32 unknown +Loops nla-digbench/ps5-ll.c ILP32 true +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +Combinations combinations/square_7+soft_float_3a.c.cil.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/sliced_aws_byte_cursor_eq_c_str_ignore_case_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--w1--slaves--w1_ds2760.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-restricted-15/c.02.c LP64 unknown +Arrays array-cav19/array_init_pair_symmetr2.c ILP32 true +Floats float-benchs/cast_union_tight.c ILP32 false +Hardness hardness/hardness_codemodifications_dependencies_file-145.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-func-interl.c LP64 false +Heap forester-heap/dll-circular-1.i ILP32 false +Loops loop-acceleration/array_4.i ILP32 true +ProductLines product-lines/elevator_spec14_product11.cil.c ILP32 true +Combinations combinations/Problem05_label40+token_ring.05.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_add_size_checked_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-consumption/32_7a_cilled_linux-3.8-rc1-32_7a-drivers--media--dvb-frontends--stv090x.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-Fig2b.c LP64 unknown +Arrays array-crafted/bAnd2.i ILP32 true +Floats float-benchs/filter2_set.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-61.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.4.prop1-func-interl.c LP64 true +Heap forester-heap/dll-rb-cnstr_1-1.i ILP32 true +Loops loop-crafted/simple_array_index_value_2.i ILP32 true +Combinations combinations/Problem05_label41+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_c_str_ignore_case_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--hwmon--gpio-fan.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-cousot9.c LP64 unknown +Arrays array-crafted/bor4.i ILP32 true +Floats float-benchs/inv_Newton-2.c ILP32 false +Hardness hardness/hardness_codemodifications_functionizing_file-156.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d128_e0.c LP64 false +Heap forester-heap/dll-simple-white-blue-2.i ILP32 true +Loops loop-invariants/linear-inequality-inv-a.c ILP32 true +Combinations combinations/Problem05_label41+token_ring.13.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_ignore_case_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--macintosh--mac_hid.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-ndecr.c LP64 unknown +Arrays array-crafted/mapsum2.i ILP32 true +Floats float-benchs/rlim_invariant.c.v+lhb-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-72.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d64_e0.c LP64 false +Heap forester-heap/sll-01-2.i ILP32 false +Loops loop-invgen/apache-get-tag.i.v+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label42+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_clean_up_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--dvb--frontends--tua6100.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-rsd.c LP64 unknown +Arrays array-crafted/xor4.i ILP32 true +Floats float-benchs/sqrt_biNewton_pseudoconstant.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-168.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.4.prop1-func-interl.c LP64 true +Heap forester-heap/sll-optional-2.i ILP32 false +Loops loop-invgen/large_const.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_comparator_string_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-asus-pc39.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-while2.c LP64 unknown +Arrays array-crafted/zero_sum_const2.c ILP32 true +Floats float-newlib/double_req_bl_0660b.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-84.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.6.prop1-func-interl.c LP64 false +Heap forester-heap/sll-rb-sentinel-2.i ILP32 false +Loops loop-lit/css2003.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.02.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_erase_harness_negated.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/BrockschmidtCookFuhs-CAV2013-Fig1.c LP64 unknown +Arrays array-crafted/zero_sum_m2.c ILP32 true +Floats float-newlib/double_req_bl_0684b.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-179.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.1.prop1-func-interl.c LP64 true +Heap forester-heap/sll-token-1.i ILP32 false +Loops loop-lit/hhk2008.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.07.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_get_at_ptr_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_success_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChawdharyCookGulwaniSagivYang-ESOP2008-aaron4.c LP64 unknown +Arrays array-examples/relax-2-2.i ILP32 true +Floats float-newlib/double_req_bl_1122a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-95.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop1-func-interl.c LP64 false +Heap heap-data/process_queue.i ILP32 true +Loops loop-new/gauss_sum.i.v+cfa-reducer.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.12.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_length_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex1.01.c LP64 unknown +Arrays array-examples/sanfoundry_43_ground.i ILP32 true +Floats float-newlib/float_req_bl_0660b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-190.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.5.prop2-back-serstep.c LP64 true +Heap heap-manipulation/bubble_sort_linux-2.i ILP32 false +Loops loop-zilu/benchmark02_linear.i ILP32 true +Combinations combinations/Problem05_label44+token_ring.07.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_pop_front_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.03.c LP64 unknown +Arrays array-examples/standard_compareModified_ground.i ILP32 true +Floats float-newlib/float_req_bl_0684b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-105.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal103.c LP64 true +Heap heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Loops loop-zilu/benchmark12_linear.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.02.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_set_at_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.09.c LP64 unknown +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +Floats float-newlib/float_req_bl_0920a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-21.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal120.c LP64 true +Heap ldv-memsafety/memleaks_test1-1.i ILP32 unknown +Loops loop-zilu/benchmark24_conjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.08.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_swap_contents_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.15.c LP64 unknown +Arrays array-examples/standard_copy7_ground-2.i ILP32 true +Floats float-newlib/float_req_bl_1270a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-116.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal137.c LP64 true +Heap ldv-memsafety/memleaks_test11_1.i ILP32 unknown +Loops loop-zilu/benchmark34_conjunctive.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.13.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_append_dynamic_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.21.c LP64 unknown +Arrays array-examples/standard_find_ground-2.i ILP32 unknown +Floats floats-cbmc-regression/float19.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-33.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal154.c LP64 true +Heap ldv-memsafety/memleaks_test13_2.i ILP32 unknown +Loops loop-zilu/benchmark45_disjunctive.i ILP32 unknown +Combinations combinations/Problem05_label46+token_ring.04.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_append_with_lookup_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex3.06.c LP64 unknown +Arrays array-examples/standard_partition_original_ground.i ILP32 true +Floats floats-cdfpl/newton_1_7.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-128.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal170.c LP64 true +Heap ldv-memsafety/memleaks_test15-2.i ILP32 unknown +Loops loops-crafted-1/in-de31.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.09.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_clean_up_secure_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Fig1.c LP64 unknown +Arrays array-examples/standard_strcmp_ground.i ILP32 true +Floats floats-cdfpl/newton_3_4.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-44.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal188.c LP64 true +Heap ldv-memsafety/memleaks_test17_2-1.i ILP32 unknown +Loops loops-crafted-1/nested_delay_nd.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.01.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_eq_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/CookSeeZuleger-TACAS2013-Fig8b.c LP64 unknown +Arrays array-examples/standard_two_index_04.i ILP32 true +Floats floats-cdfpl/square_2.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_cn_file-139.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal203.c LP64 true +Heap ldv-memsafety/memleaks_test18_3.i ILP32 unknown +Loops loops-crafted-1/sumt9.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.11.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_from_c_str_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/HarrisLalNoriRajamani-SAS2010-Fig2.c LP64 unknown +Arrays array-examples/standard_vector_difference_ground.i ILP32 true +Floats floats-esbmc-regression/trunc_nondet_2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-56.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal221.c LP64 true +Heap ldv-memsafety/memleaks_test21-2.i ILP32 unknown +Loops loops/insertion_sort-1-2.c ILP32 false +Combinations combinations/Problem05_label48+token_ring.09.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_init_copy_from_cursor_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/HeizmannHoenickeLeikePodelski-ATVA2013-Fig7.c LP64 unknown +Arrays array-fpi/brs4f.c ILP32 false +Floats floats-nonlinear/coral-benchmark21.c ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_co_file-150.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal26.c LP64 true +Heap ldv-memsafety/memleaks_test22_3-2.i ILP32 unknown +Loops loops/n.c24.i ILP32 false +Combinations combinations/Problem05_label49+token_ring.03.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_reserve_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_num_tdcx__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/LeeJonesBen-Amram-POPL2001-Ex1.c LP64 unknown +Arrays array-fpi/condg.c ILP32 true +Floats neural-networks/cartpole_12_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-67.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal43.c LP64 true +Heap ldv-memsafety/memleaks_test23_4.i ILP32 unknown +Loops loops/sum_array-1.c ILP32 unknown +Combinations combinations/Problem05_label49+token_ring.09.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_secure_zero_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/LeikeHeizmann-TACAS2014-Ex1.c LP64 unknown +Arrays array-fpi/eqn2.c ILP32 true +Floats neural-networks/cartpole_25_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-161.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal6.c LP64 true +Heap ldv-memsafety/memleaks_test5_1.i ILP32 unknown +Loops loops/trex01-2.i ILP32 true +Combinations combinations/Problem05_label49+token_ring.14.cil.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_be64_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/LeikeHeizmann-WST2014-Ex6.c LP64 unknown +Arrays array-fpi/eqn5f.c ILP32 false +Floats neural-networks/cartpole_37_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-79.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal77.c LP64 true +Heap ldv-memsafety/memleaks_test7-1.i ILP32 unknown +Loops nla-digbench-scaling/bresenham-ll_unwindbound1.c ILP32 false +Combinations combinations/gcd_1+newton_2_2.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_from_whole_cursor_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/PodelskiRybalchenko-LICS2004-Fig1.c LP64 unknown +Arrays array-fpi/ifeqn3f.c ILP32 false +Floats neural-networks/cartpole_49_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-173.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal93.c LP64 true +Heap ldv-memsafety/memleaks_test9_1.i ILP32 unknown +Loops nla-digbench-scaling/bresenham-ll_valuebound5.c ILP32 true +Combinations combinations/gcd_1+newton_3_4.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_u8_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/PodelskiRybalchenko-TACAS2011-Fig4.c LP64 unknown +Arrays array-fpi/indp1f.c ILP32 false +Floats neural-networks/cartpole_60_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-9.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.4.prop1-back-serstep.c LP64 true +Heap ldv-regression/rule57_ebda_blast.i ILP32 true +Loops nla-digbench-scaling/cohencu-ll_valuebound2.c ILP32 true +Combinations combinations/gcd_2+newton_1_7.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_advance_nospec_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/cstrcmp.c LP64 unknown +Arrays array-fpi/indp5f.c ILP32 false +Floats neural-networks/cartpole_73_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-184.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d128_e0.c LP64 false +Heap ldv-regression/test11.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_valuebound10.c ILP32 true +Combinations combinations/gcd_2+newton_3_1.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_eq_byte_buf_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/gcd1.c LP64 unknown +Arrays array-fpi/ms1.c ILP32 true +Floats neural-networks/cartpole_85_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-10.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d8_e0.c LP64 false +Heap ldv-regression/test22-1.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_valuebound1.c ILP32 true +Combinations combinations/gcd_3+newton_1_4.i ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_no_tdcx__cover_proof_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted/4NestedWith3Variables-2.c LP64 unknown +Arrays array-fpi/ms5.c ILP32 true +Floats neural-networks/cartpole_97_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-196.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.1.prop1-back-serstep.c LP64 true +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/divbin2_unwindbound5.i ILP32 true +Combinations combinations/gcd_3+newton_2_6.i ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Bangalore-1.c LP64 unknown +Arrays array-fpi/nsqmf.c ILP32 false +Floats neural-networks/dubinsrejoin_10_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-110.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.5.prop1-func-interl.c LP64 false +Heap ldv-regression/test28-2.c ILP32 true +Loops nla-digbench-scaling/divbin_unwindbound2.i ILP32 true +Combinations combinations/gcd_4+newton_1_1.i ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Benghazi_nondet-2.c LP64 unknown +Arrays array-fpi/res2f.c ILP32 false +Floats neural-networks/dubinsrejoin_23_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-27.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v1.c LP64 true +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +Combinations combinations/gcd_4+newton_2_3.i ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Collatz.c LP64 unknown +Arrays array-fpi/s1lif.c ILP32 true +Floats neural-networks/dubinsrejoin_35_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-122.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.1.prop1-func-interl.c LP64 true +Heap list-ext-properties/960521-1_1-2.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_valuebound50.c ILP32 true +Combinations combinations/gcd_4+newton_3_6.i ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Gothenburg_v2-1.c LP64 unknown +Arrays array-fpi/s32if.c ILP32 true +Floats neural-networks/dubinsrejoin_48_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-39.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.2.prop3-back-serstep.c LP64 false +Heap list-ext-properties/list-ext_flag_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound20.c ILP32 true +Combinations combinations/pals_lcr.3.1.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/LexIndexValue-Array-2.c LP64 unknown +Arrays array-fpi/s42iff.c ILP32 false +Floats neural-networks/dubinsrejoin_5_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-133.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.5.prop3-func-interl.c LP64 true +Loops nla-digbench-scaling/egcd3-ll_valuebound100.c ILP32 true +Combinations combinations/pals_lcr.3.ufo.BOUNDED-6.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/McCarthy91_Recursion.c LP64 unknown +Arrays array-fpi/s4liff_overflow.c ILP32 unknown +Floats neural-networks/dubinsrejoin_72_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-5.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.3.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/fermat1-ll_valuebound1.c ILP32 true +Combinations combinations/pals_lcr.3.ufo.UNBOUNDED.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/NestedRecursion_1a-1.c LP64 unknown +Arrays array-fpi/s5iff.c ILP32 false +Floats neural-networks/dubinsrejoin_84_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_while_file-145.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop3-func-interl.c LP64 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +Combinations combinations/pals_lcr.4.1.ufo.BOUNDED-8.pals+Problem12_label09.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/NonTermination2.c LP64 unknown +Arrays array-fpi/sina2.c ILP32 true +Floats neural-networks/dubinsrejoin_9_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-61.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_Vsa16.c LP64 true +Loops nla-digbench-scaling/freire1_valuebound20.c ILP32 true +Combinations combinations/pals_lcr.4.ufo.BOUNDED-8.pals+Problem12_label04.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/NonTerminationSimple8.c LP64 unknown +Arrays array-fpi/sina5f.c ILP32 false +Floats neural-networks/exp_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-156.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.1.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/geo1-ll2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.4.ufo.UNBOUNDED.pals+Problem12_label05.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Pure2Phase-1.c LP64 unknown +Arrays array-fpi/ss2f.c ILP32 false +Floats neural-networks/gcas_6_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-72.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.2.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/geo1-ll_unwindbound20.c ILP32 true +Combinations combinations/pals_lcr.5.1.ufo.BOUNDED-10.pals+Problem12_label01.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/RecursiveNonterminating-2.c LP64 unknown +Arrays array-industry-pattern/array_monotonic.i ILP32 true +Floats neural-networks/log_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-168.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.1.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo1-u2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.5.ufo.BOUNDED-10.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__safety_requirement_havoc_object.i LP64 true +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +Floats neural-networks/lunarlander_0_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-84.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lann.5.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo1-u_unwindbound20.c ILP32 false +Combinations combinations/pals_lcr.5.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +Arrays array-lopstr16/single_elem_safe.i ILP32 true +Floats neural-networks/lunarlander_21_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-179.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.6.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/geo2-ll2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.5_overflow.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +Arrays array-memsafety/array02-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_33_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-95.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.2.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/geo2-ll_unwindbound20.c ILP32 true +Combinations combinations/pals_lcr.6.1.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Arrays array-memsafety/cstrchr-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_45_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-190.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lup.1.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo3-ll2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.6.ufo.BOUNDED-12.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_entry_havoc_object.i LP64 false +Arrays array-memsafety/cstrncat_unsafe.c ILP32 unknown +Floats neural-networks/lunarlander_57_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount100_file-105.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mcs.6.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo3-ll_unwindbound20.c ILP32 true +Combinations combinations/pals_lcr.6.ufo.UNBOUNDED.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__safety_requirement_havoc_memory.i LP64 true +Arrays array-memsafety/diff-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_69_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount100_file-21.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/hard-ll_unwindbound100.c ILP32 false +Combinations combinations/pals_lcr.7.1.ufo.BOUNDED-14.pals+Problem12_label09.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Arrays array-memsafety/mult_array_unsafe.i ILP32 unknown +Floats neural-networks/lunarlander_81_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount10_file-116.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop2-back-serstep.c LP64 true +Loops nla-digbench-scaling/hard-u_unwindbound1.c ILP32 false +Combinations combinations/pals_lcr.7.ufo.BOUNDED-14.pals+Problem12_label04.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-memsafety/openbsd_cstrcat-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_92_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-33.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.2.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/hard-u_valuebound5.c ILP32 true +Combinations combinations/pals_lcr.7.ufo.UNBOUNDED.pals+Problem12_label05.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_exit_havoc_object.i LP64 false +Arrays array-memsafety/openbsd_cstrncpy-alloca-2.i ILP32 unknown +Floats neural-networks/poly_1024_thresh_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount250_file-128.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.5.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/hard2_valuebound2.c ILP32 true +Combinations combinations/pals_lcr.8.1.ufo.BOUNDED-16.pals+Problem12_label01.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_entry_havoc_memory.i LP64 false +Arrays array-memsafety/selectionsort-alloca-1.i ILP32 unknown +Floats neural-networks/poly_16_16_16_16_thresh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-44.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.2.prop6-back-serstep.c LP64 true +Loops nla-digbench-scaling/knuth_valuebound100.i ILP32 true +Combinations combinations/pals_lcr.8.ufo.BOUNDED-16.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Arrays array-multidimensional/add-2-n-u.c ILP32 true +Floats neural-networks/poly_16_16_thresh_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-139.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/lcm1_valuebound10.c ILP32 true +Combinations combinations/pals_lcr.8.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_exit_havoc_object.i LP64 false +Arrays array-multidimensional/diff-3-n-u.c ILP32 true +Floats neural-networks/poly_32_32_32_32_thresh_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount25_file-56.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.7.prop5-back-serstep.c LP64 true +Loops nla-digbench-scaling/lcm2_valuebound1.c ILP32 true +Combinations combinations/pals_lcr.8_overflow.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__safety_requirement_havoc_memory.i LP64 true +Arrays array-multidimensional/min-2-u.c ILP32 true +Floats neural-networks/poly_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-150.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.plc.2.prop2-func-interl.c LP64 true +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-1+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Arrays array-patterns/array12_pattern.c ILP32 true +Floats neural-networks/poly_512_thresh_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-67.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.6.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/prod4br-ll_valuebound2.c ILP32 true +Combinations combinations/pc_sfifo_1.cil-2+token_ring.03.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-patterns/array1_pattern.c ILP32 true +Floats neural-networks/poly_8_8_8_8_thresh_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-161.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.recount4.c LP64 false +Loops nla-digbench-scaling/prodbin-ll_valuebound10.c ILP32 true +Combinations combinations/pc_sfifo_1.cil-2+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_exit_havoc_object.i LP64 false +Arrays array-patterns/array25_pattern.c ILP32 true +Floats neural-networks/relu_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-79.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rether.4.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/ps2-ll_unwindbound50.c ILP32 true +Combinations combinations/pc_sfifo_1.cil-2+token_ring.14.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-patterns/array3_pattern.c ILP32 true +Floats neural-networks/sin_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-173.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.1.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/ps3-ll_unwindbound20.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-1+token_ring.05.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_exit_havoc_object.i LP64 false +Arrays array-patterns/array7_pattern.c ILP32 true +Floats neural-networks/softmax_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_normal_file-9.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d32_e0.c LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound100.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-1+token_ring.10.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_entry_havoc_memory.i LP64 false +Arrays array-programs/partial_mod_count_limited_1.c ILP32 true +Floats neural-networks/softsign_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-184.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.sw_loop_v.c LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound1.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-2+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/softsign_w32_r1_case_0_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-10.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.6.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/ps5-ll_valuebound50.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-2+token_ring.13.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_entry_havoc_object.i LP64 false +Floats neural-networks/softsign_w4_r3_case_1_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-196.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.3.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/ps6-ll_valuebound20.c ILP32 true +Combinations combinations/pc_sfifo_3.cil+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/softsign_w8_r2_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-110.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.4.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/sqrt1-ll_valuebound100.c ILP32 true +Combinations combinations/pc_sfifo_3.cil+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Floats neural-networks/tanh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-27.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p02.c LP64 true +Loops nla-digbench/dijkstra.c ILP32 unknown +Combinations combinations/square_1+soft_float_3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/tanh_w16_r3_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-122.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p21.c LP64 true +Loops nla-digbench/fermat2.c ILP32 unknown +Combinations combinations/square_3+soft_float_4-2a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Floats neural-networks/tanh_w4_r2_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-39.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_s1269b_p3.c LP64 true +Loops nla-digbench/hard-ll.c ILP32 true +Combinations combinations/square_5+soft_float_1-3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_num_tdcx__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/tanh_w64_r4_case_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-134.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_field5.c LP64 true +Loops nla-digbench/ps2-ll.c ILP32 true +Combinations combinations/square_6+soft_float_4-3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +Floats neural-networks/vdp_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_sp_file-50.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p08.c LP64 true +Loops verifythis/duplets.c ILP32 true +Combinations combinations/square_8+soft_float_1-3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_entry_havoc_object.i LP64 false +Floats float-benchs/cast_float_ptr.c ILP32 false +Hardness hardness/hardness_codemodifications_dependencies_file-120.i ILP32 true +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_linked_list_fifo_n2d4.c LP64 false +Loops loop-acceleration/array_2-2.i ILP32 true +Combinations combinations/Problem05_label40+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_exit_havoc_memory.i LP64 false +Floats float-benchs/divmul_diverge.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-169.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-func-interl.c LP64 false +Loops loop-acceleration/diamond_2-2.c ILP32 true +Combinations combinations/Problem05_label40+token_ring.07.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats float-benchs/filter2.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-37.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.2.prop1-back-serstep.c LP64 true +Loops loop-acceleration/simple_3-1.c ILP32 false +Combinations combinations/Problem05_label40+token_ring.12.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_exit_havoc_object.i LP64 false +Floats float-benchs/image_filter.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-85.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.7.prop1-back-serstep.c LP64 false +Loops loop-crafted/simple_array_index_value_4.i ILP32 true +Combinations combinations/Problem05_label41+token_ring.05.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_entry_havoc_object.i LP64 false +Floats float-benchs/interpolation2.c.v+nlh-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-131.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d128_e0.c LP64 false +Loops loop-industry-pattern/mod3.c.v+sep-reducer.c ILP32 true +Combinations combinations/Problem05_label41+token_ring.10.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats float-benchs/inv_sqrt_Quake.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-18.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d8_e0.c LP64 false +Loops loop-invariants64/linear-inequality-inv-d.c LP64 true +Combinations combinations/Problem05_label42+token_ring.01.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_exit_havoc_memory.i LP64 false +Floats float-benchs/nan_float.c ILP32 false +Hardness hardness/hardness_codemodifications_functionizing_file-48.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d64_e0.c LP64 false +Loops loop-invgen/apache-get-tag.i.p+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label42+token_ring.04.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_entry_havoc_object.i LP64 false +Floats float-benchs/sin_interpolated_bigrange_loose.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-97.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d64_e0.c LP64 false +Loops loop-invgen/down.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.07.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__safety_requirement_havoc_object.i LP64 true +Floats float-benchs/sqrt_Householder_interval.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-143.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.2.prop1-back-serstep.c LP64 false +Loops loop-invgen/id_build.i.v+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label42+token_ring.09.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_exit_havoc_memory.i LP64 false +Floats float-benchs/zonotope_3.c.p+cfa-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-191.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.6.prop1-func-interl.c LP64 false +Loops loop-invgen/nested9.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.12.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_entry_havoc_memory.i LP64 false +Floats float-newlib/double_req_bl_0320.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-6.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.4.prop1-back-serstep.c LP64 false +Loops loop-lit/cggmp2005.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.15.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__safety_requirement_havoc_object.i LP64 true +Floats float-newlib/double_req_bl_0662a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-106.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bit-vector.c LP64 true +Loops loop-lit/gj2007.c.i.p+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.03.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_proof_havoc_object.i LP64 false +Floats float-newlib/double_req_bl_0683a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-154.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.2.prop1-back-serstep.c LP64 false +Loops loop-lit/gsv2008.c.i.v+cfa-reducer.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.06.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__safety_requirement_havoc_memory.i LP64 true +Floats float-newlib/double_req_bl_0870b.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-22.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.3.prop1-func-interl.c LP64 false +Loops loop-lit/jm2006_variant.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_entry_havoc_memory.i LP64 false +Floats float-newlib/double_req_bl_0920a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-70.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop2-back-serstep.c LP64 true +Loops loop-new/count_by_nondet.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__safety_requirement_havoc_object.i LP64 true +Floats float-newlib/double_req_bl_1131a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-118.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop1-back-serstep.c LP64 false +Loops loop-new/nested-1.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.14.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_proof_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_0281.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-166.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop2-func-interl.c LP64 true +Loops loop-simple/nested_5.c ILP32 true +Combinations combinations/Problem05_label44+token_ring.04.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_proof_havoc_memory.i LP64 false +Floats float-newlib/float_req_bl_0662a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-34.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop1-back-serstep.c LP64 false +Loops loop-zilu/benchmark04_conjunctive.i ILP32 true +Combinations combinations/Problem05_label44+token_ring.09.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_exit_havoc_memory.i LP64 false +Floats float-newlib/float_req_bl_0683a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-82.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal1.c LP64 true +Loops loop-zilu/benchmark10_conjunctive.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.01.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_success_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_0870b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-129.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal108.c LP64 true +Loops loop-zilu/benchmark15_conjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.04.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_exit_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_0880.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-177.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal116.c LP64 true +Loops loop-zilu/benchmark21_disjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.06.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_entry_havoc_memory.i LP64 false +Floats float-newlib/float_req_bl_1121b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-45.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal124.c LP64 true +Loops loop-zilu/benchmark26_linear.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.09.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__safety_requirement_havoc_memory.i LP64 true +Floats float-newlib/float_req_bl_1211a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-93.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal132.c LP64 true +Loops loop-zilu/benchmark31_disjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.11.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_exit_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_1270d.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-140.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal141.c LP64 true +Loops loop-zilu/benchmark37_conjunctive.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.15.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_entry_havoc_object.i LP64 false +Floats floats-cbmc-regression/float-rounding1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-189.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal15.c LP64 true +Loops loop-zilu/benchmark43_conjunctive.i ILP32 true +Combinations combinations/Problem05_label46+token_ring.03.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats floats-cbmc-regression/float3.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-57.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal158.c LP64 true +Loops loop-zilu/benchmark48_linear.i ILP32 unknown +Combinations combinations/Problem05_label46+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_exit_havoc_memory.i LP64 false +Floats floats-cdfpl/newton_1_3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-103.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal166.c LP64 true +Loops loops-crafted-1/discover_list.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.08.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_entry_havoc_object.i LP64 false +Floats floats-cdfpl/newton_2_2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-151.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal175.c LP64 true +Loops loops-crafted-1/in-de42.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__safety_requirement_havoc_object.i LP64 true +Floats floats-cdfpl/newton_3_1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-2.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal183.c LP64 true +Loops loops-crafted-1/loopv2.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.13.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_proof_havoc_memory.i LP64 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-68.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal191.c LP64 true +Loops loops-crafted-1/sum_by_3_abstracted.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.03.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_exit_havoc_memory.i LP64 false +Floats floats-cdfpl/sine_6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-114.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal2.c LP64 true +Loops loops-crafted-1/sumt6.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_entry_havoc_object.i LP64 false +Floats floats-cdfpl/square_5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-163.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal208.c LP64 true +Loops loops-crafted-1/vnew2.c ILP32 true +Combinations combinations/Problem05_label48+token_ring.01.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_entry_havoc_memory.i LP64 false +Floats floats-esbmc-regression/fmod3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-31.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal217.c LP64 true +Loops loops/count_up_down-1.c ILP32 true +Combinations combinations/Problem05_label48+token_ring.06.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__safety_requirement_havoc_object.i LP64 true +Floats floats-nonlinear/bound-unconstrained.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-8.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal225.c LP64 true +Loops loops/insertion_sort-2.c ILP32 unknown +Combinations combinations/Problem05_label48+token_ring.11.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Floats floats-nonlinear/coral-benchmark09.c ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_co_file-126.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal233.c LP64 true +Loops loops/matrix-1.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.02.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_num_tdcx__cover_proof_havoc_memory.i LP64 true +Floats loop-floats-scientific-comp/loop1-1.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-174.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal30.c LP64 true +Loops loops/nec40.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.05.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-42.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal39.c LP64 true +Loops loops/sum01_bug02.i ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Floats neural-networks/cartpole_15_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-90.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal47.c LP64 true +Loops loops/sum_array-2.i ILP32 unknown +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_success_havoc_object.i LP64 false +Floats neural-networks/cartpole_21_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-137.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal55.c LP64 true +Loops loops/terminator_03-2.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/cartpole_28_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-186.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal64.c LP64 true +Loops loops/trex03-1.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_34_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-54.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal72.c LP64 true +Loops loops/verisec_OpenSER_cases1_stripFullBoth_arr.i ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_exit_havoc_object.i LP64 false +Floats neural-networks/cartpole_3_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-100.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal80.c LP64 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound2.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_entry_havoc_object.i LP64 false +Floats neural-networks/cartpole_46_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-149.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal89.c LP64 true +Loops nla-digbench-scaling/bresenham-ll_valuebound100.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_51_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-197.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal98.c LP64 true +Loops nla-digbench-scaling/cohencu-ll_unwindbound10.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/cartpole_58_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-65.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.2.prop2-func-interl.c LP64 true +Loops nla-digbench-scaling/cohencu-ll_valuebound1.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/cartpole_63_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-111.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.5.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/cohencu-ll_valuebound50.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_proof_havoc_object.i LP64 false +Floats neural-networks/cartpole_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-16.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.7.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound5.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/cartpole_76_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-29.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d128_e0.c LP64 false +Loops nla-digbench-scaling/cohendiv-ll_valuebound20.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_82_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-77.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d8_e0.c LP64 false +Loops nla-digbench-scaling/dijkstra-u_unwindbound20.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_no_tdcx__cover_entry_havoc_object.i LP64 true +Floats neural-networks/cartpole_88_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-123.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.collision.2.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/dijkstra-u_valuebound2.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_no_tdcx__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/cartpole_94_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-171.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.collision.6.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/divbin2_unwindbound100.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/cartpole_9_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-4.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.3.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/divbin2_valuebound10.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/cos_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-88.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.3.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/divbin_unwindbound1.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_13_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-134.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.elevator.2.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/divbin_unwindbound50.i ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-182.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.1.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/divbin_valuebound5.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/dubinsrejoin_26_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-51.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v6.c LP64 true +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_32_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-0.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.exit.4.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/egcd-ll_valuebound2.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_38_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-146.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.3.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_44_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-194.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.1.prop3-func-interl.c LP64 true +Loops nla-digbench-scaling/egcd2-ll_valuebound10.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_50_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-62.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.3.prop2-func-interl.c LP64 true +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_57_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-109.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.5.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_62_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-157.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_entry_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_69_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_1loop_file-25.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_75_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_1loop_file-74.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.5.prop1-func-interl.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_81_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-120.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_87_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_while_file-169.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_Barrel.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_93_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_while_file-37.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_Spinner.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/elu_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-85.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_b06.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +Floats neural-networks/erf_4_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-131.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/exp_4_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-18.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/gcas_2_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-48.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.itc99_b12.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Floats neural-networks/gcas_9_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-97.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.1.prop1-back-serstep.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_proof_havoc_object.i LP64 false +Floats neural-networks/log_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-143.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/log_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-191.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/logistic_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-6.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lann.2.prop1-func-interl.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Floats neural-networks/lunarlander_12_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-106.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lann.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/lunarlander_19_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-154.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.4.prop1-back-serstep.c LP64 false +Floats neural-networks/lunarlander_24_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-22.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.2.prop1-func-interl.c LP64 false +Floats neural-networks/lunarlander_2_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-70.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.7.prop1-back-serstep.c LP64 true +Floats neural-networks/lunarlander_36_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-118.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.5.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_kloop_50_while_file-166.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.1.prop1-func-interl.c LP64 false +Hardness hardness/hardness_kloop_50_while_file-34.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lup.3.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_kloop_50_while_file-82.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mcs.3.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount100_file-129.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.1.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount100_file-177.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mul11.c LP64 false +Hardness hardness/hardness_operatoramount_amount100_file-45.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop3-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount100_file-93.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop3-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount10_file-140.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop4-func-interl.c LP64 false +Hardness hardness/hardness_operatoramount_amount10_file-189.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.noninitstate.c LP64 false +Hardness hardness/hardness_operatoramount_amount10_file-57.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.4.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount250_file-103.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount250_file-151.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount250_file-2.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.2.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount250_file-68.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.3.prop2-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-114.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.4.prop5-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-163.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop6-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-31.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop6-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-8.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount500_file-126.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pj_icram.c LP64 true +Hardness hardness/hardness_operatoramount_amount500_file-174.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount500_file-42.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.3.prop1-func-interl.c LP64 false +Hardness hardness/hardness_operatoramount_amount500_file-90.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.2.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount50_file-137.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.1.prop1-func-interl.c LP64 false +Hardness hardness/hardness_operatoramount_amount50_file-186.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.1.prop3-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount50_file-54.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rether.1.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_normal_file-100.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rether.6.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_wrappers_normal_file-149.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.3.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_normal_file-197.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.3.prop1-func-interl.c LP64 false +Hardness hardness/hardness_wrappers_normal_file-65.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d32_e0.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_a_file-111.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d16_e0.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_a_file-16.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.3.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_a_file-29.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.swap_two.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_a_file-77.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.4.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-123.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.1.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-171.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-4.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.6.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-88.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.2.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_p_file-134.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.6.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_p_file-182.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.v_DAIO.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_p_file-51.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p07.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_s_file-0.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p16.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_s_file-146.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_pj_icu_icctl_p3.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_s_file-194.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p3.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_s_file-63.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_vMiim_p2.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_sp_file-11.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p2.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_sp_file-158.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p2.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-26.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p03.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-75.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p13.c LP64 true +Hardness hardness/hardness_codemodifications_dependencies_file-109.i ILP32 true +Hardware hardware-verification-array/btor2c-lazyMod.safe_linked_list_fifo_n2d4.c LP64 true +Hardness hardness/hardness_codemodifications_dependencies_file-132.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.Huffman_dec.c LP64 true +Hardness hardness/hardness_codemodifications_dependencies_file-157.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-180.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-25.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-49.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-73.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.5.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-97.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.8.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_functionizing_file-12.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d64_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-143.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d32_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-168.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d32_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-191.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d16_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-36.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d16_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-6.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d128_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-84.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d128_e0.c LP64 false +Hardness hardness/hardness_codemodifications_normal_file-107.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d128_e0.c LP64 false +Hardness hardness/hardness_codemodifications_normal_file-131.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.1.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-155.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_normal_file-18.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.5.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-23.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.7.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-48.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.3.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-71.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.5.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-96.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.7.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_steplocals_file-118.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.2.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_steplocals_file-142.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-166.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-190.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.2.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-34.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.4.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-59.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-82.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop3-back-serstep.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-105.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop2-func-interl.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-13.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop2-back-serstep.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-154.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop1-func-interl.c LP64 false +Hardness hardness/hardness_fillercode_filler_pe_ci_file-178.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop3-func-interl.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-46.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-94.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-140.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-189.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-57.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-103.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-128.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-152.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-177.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-20.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-69.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-93.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-115.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-14.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-163.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-188.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-31.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-56.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-102.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-175.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-43.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-68.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-91.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-138.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-186.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-30.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-54.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-79.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-100.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-125.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-149.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-173.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-198.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-42.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-66.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-90.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-112.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-137.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-160.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-185.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-29.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-53.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-77.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-10.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-123.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-148.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-171.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-40.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-65.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-89.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-111.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-135.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-183.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-51.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-76.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-0.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-122.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-146.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-170.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-194.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-39.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-63.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-88.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-11.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-134.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-158.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-182.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-26.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-50.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-74.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-99.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-120.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-145.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-169.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-193.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-37.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-61.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-86.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-109.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-132.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-157.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-180.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-25.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-49.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-73.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-97.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-12.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-143.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-168.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-191.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-36.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-6.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-84.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-107.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-131.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-155.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-18.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-23.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-48.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-71.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-96.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-118.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-142.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-166.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-190.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-34.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-59.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-82.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-105.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-13.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-154.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-178.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-22.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-46.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-70.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-94.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-117.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-140.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-165.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-189.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-33.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-57.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-81.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-103.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-128.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-152.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-177.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-20.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-45.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-69.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-93.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-115.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-14.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-163.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-188.i ILP32 unknown +Hardness hardness/hardness_operatoramount_amount250_file-31.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-56.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-8.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-102.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-126.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-150.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-175.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-2.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-43.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-68.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-91.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-114.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-138.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-162.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-186.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-30.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-54.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-79.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-100.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-125.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-149.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-173.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-198.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-42.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-66.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-90.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-112.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-137.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-160.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-185.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-29.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-53.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-77.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-10.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-123.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-148.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-171.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-196.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-40.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-65.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-89.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-111.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-135.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-16.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-183.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-28.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-51.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-76.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-0.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-122.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-146.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-170.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-194.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-39.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-63.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-88.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-11.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-134.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-158.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-182.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-26.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-50.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-75.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-0.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-121.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-146.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-17.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-194.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-38.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-62.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-87.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-102.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-114.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-126.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-139.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-150.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-162.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-174.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-187.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-199.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-30.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-42.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-55.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-67.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-79.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-90.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-101.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-113.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-125.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-137.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-15.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-161.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-173.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-185.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-198.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-3.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-41.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-53.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-66.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-78.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-90.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-100.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-113.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-125.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-137.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-149.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-161.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-173.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-185.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-197.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-3.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-41.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-53.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-65.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-78.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-9.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-10.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-111.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-124.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-136.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-148.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-16.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-172.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-184.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-196.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-28.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-40.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-52.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-64.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-76.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-89.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-111.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-123.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-136.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-148.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-171.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-184.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-4.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-52.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-64.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-76.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-88.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-110.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-122.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-134.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-147.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-159.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-170.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-195.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-63.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-11.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-134.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-146.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-159.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-170.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-194.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-62.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-109.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-133.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-17.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-181.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-38.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-86.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-132.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-169.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-181.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-37.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-85.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-131.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-156.i ILP32 unknown +Hardness hardness/hardness_fillercode_filler_pr_co_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-192.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-60.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-107.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-119.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-142.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-155.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-167.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-191.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-106.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-119.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-142.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-154.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-167.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-179.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-190.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-35.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-47.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-83.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-95.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-13.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-141.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-178.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-19.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-34.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-47.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-82.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-95.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-129.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-141.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-177.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-19.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-21.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-58.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-7.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-93.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-104.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-116.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-128.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-14.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-152.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-164.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-176.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-188.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-20.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-32.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-45.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-57.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-7.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-81.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-93.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-103.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-116.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-128.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-14.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-151.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-164.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-176.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-188.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-2.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-32.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-44.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-56.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-68.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-80.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-92.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-102.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-114.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-127.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-139.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-150.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-162.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-175.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-187.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-199.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-30.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-43.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-55.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-68.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-8.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-92.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-102.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-114.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-126.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-139.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-150.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-162.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-174.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-187.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-199.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-30.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-42.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-55.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-67.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-79.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-90.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-101.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-113.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-125.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-137.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-15.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-161.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-173.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-185.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-198.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-3.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-41.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-53.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-66.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-78.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-90.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-100.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-113.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-125.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-137.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-149.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-161.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-173.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-185.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-197.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-3.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-41.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-53.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-65.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-78.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-9.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-10.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-111.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-124.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-136.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-148.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-16.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-172.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-184.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-196.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-28.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-40.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-52.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-64.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-76.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-89.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-1.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-111.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-123.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-136.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-148.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-16.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-171.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-184.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-196.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-28.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-4.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-52.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-64.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-76.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-88.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-1.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-110.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-122.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-134.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-147.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-159.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-170.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-182.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-195.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-27.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-39.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-50.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-63.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-75.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-87.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-99.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-11.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-121.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-134.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-146.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-159.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-170.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-182.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-194.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-27.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-39.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-50.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-62.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-75.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-87.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-99.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-109.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-121.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-133.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-145.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-157.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-17.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-181.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-193.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-25.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-38.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-5.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-61.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-73.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-86.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-98.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-108.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-12.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-132.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-144.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-157.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-169.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-181.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-193.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-25.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-37.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-5.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-61.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-73.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-85.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-98.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-108.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-12.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-131.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-144.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-156.i ILP32 unknown +Hardness hardness/hardness_operatoramount_amount500_file-168.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-18.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-192.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-24.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-36.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-48.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-60.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-72.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-84.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-96.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-107.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-119.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-130.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-142.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-155.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-167.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-18.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-191.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-24.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-36.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-48.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-6.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-72.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-84.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-96.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-106.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-119.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-130.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-142.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-154.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-167.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-179.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-190.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-22.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-35.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-47.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-59.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-70.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-83.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-95.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-105.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-117.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-13.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-141.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-153.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-165.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-178.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-19.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-22.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-34.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-47.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-59.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-70.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-82.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-95.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-105.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-117.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-129.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-141.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-153.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-165.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-177.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-19.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-21.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-33.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-45.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-58.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-7.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-81.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-93.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-104.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-116.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-128.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-14.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-152.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-164.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-176.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-188.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-20.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-32.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-45.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-57.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-7.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-81.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-93.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-103.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-116.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-128.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-14.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-151.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-164.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-176.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-188.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-2.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-32.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-44.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-57.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-69.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-81.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-93.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-103.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-115.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-128.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-14.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-151.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-163.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-176.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-188.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-2.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-31.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-44.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-56.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-69.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-80.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-93.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-10.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-105.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-111.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-117.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-123.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-129.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-135.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-141.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-148.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-153.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-16.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-165.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-171.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-177.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-183.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-19.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-196.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-21.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-28.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-33.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-4.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-45.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-51.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-58.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-64.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-7.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-76.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-81.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-88.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-93.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-0.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-104.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-110.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-116.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-122.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-128.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-134.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-14.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-146.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-152.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-159.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-164.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-170.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-176.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-182.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-188.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-194.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-20.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-27.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-32.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-39.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-44.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-50.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-56.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-62.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-69.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-75.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-80.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-87.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-93.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-0.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-103.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-11.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-116.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-122.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-128.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-134.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-14.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-146.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-151.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-158.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-164.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-170.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-176.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-182.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-188.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-194.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-2.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-26.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-32.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-39.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-44.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-50.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-56.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-62.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-68.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-74.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-80.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-87.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-92.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-99.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-102.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-109.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-114.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-120.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-127.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-133.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-139.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-145.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-150.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-157.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-162.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-169.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-175.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-181.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-187.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-193.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-199.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-25.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-30.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-37.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-43.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-5.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-55.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-61.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-67.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-73.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-79.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-85.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-91.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-101.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-120.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-132.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-139.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-169.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-174.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-180.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-187.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-199.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-30.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-37.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-42.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-49.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-55.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-67.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-79.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-85.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-90.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-97.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-101.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-113.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-125.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-131.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-137.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-143.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-15.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-156.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-161.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-173.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-185.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-191.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-198.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-41.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-53.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-66.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-78.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-9.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-10.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-106.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-112.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-119.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-124.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-137.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-143.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-149.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-155.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-161.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-173.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-185.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-191.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-197.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-23.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-41.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-53.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-65.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-71.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-78.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-9.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-10.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-106.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-111.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-118.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-124.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-136.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-142.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-148.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-154.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-166.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-172.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-179.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-184.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-190.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-34.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-40.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-47.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-52.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-64.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-76.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-82.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-89.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-95.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-110.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-122.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-129.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-135.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-141.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-147.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-166.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-171.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-178.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-184.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-190.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-34.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-4.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-46.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-52.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-64.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-76.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-82.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-88.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-94.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-110.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-122.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-129.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-134.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-140.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-147.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-159.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-170.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-177.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-189.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-195.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-21.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-57.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-63.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-7.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-93.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-103.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-11.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-116.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-128.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-133.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-14.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-151.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-158.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-164.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-17.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-176.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-189.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-194.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-20.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-57.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-62.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-69.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-93.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-103.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-109.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-115.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-128.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-133.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-14.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-151.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-163.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-17.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-176.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-181.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-188.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-31.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-38.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-44.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-56.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-68.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-86.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-92.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-102.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-132.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-139.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-156.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-174.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-180.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-187.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-192.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-199.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-31.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-37.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-43.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-56.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-68.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-85.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-91.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-102.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-131.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-138.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-156.i ILP32 unknown +Hardness hardness/hardness_fillercode_normal_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-174.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-186.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-192.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-199.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-30.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-42.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-54.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-60.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-67.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-79.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-90.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-96.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-100.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-107.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-113.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-119.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-125.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-130.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-137.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-142.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-149.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-155.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-161.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-167.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-173.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-179.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-185.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-190.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-197.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-23.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-3.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-35.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-41.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-48.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-54.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-6.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-66.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-72.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-79.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-84.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-90.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-96.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-100.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-106.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-112.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-119.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-125.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-130.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-137.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-142.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-149.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-154.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-160.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-167.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-173.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-179.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-185.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-190.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-197.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-22.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-29.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-35.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-41.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-47.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-53.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-59.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-65.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-70.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-77.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-83.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-9.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-95.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-10.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-105.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-111.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-117.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-123.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-13.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-136.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-141.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-148.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-153.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-16.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-165.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-171.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-178.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-184.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-19.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-196.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-21.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-28.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-33.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-4.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-46.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-52.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-58.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-64.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-70.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-77.i ILP32 unknown +Hardness hardness/hardness_kloop_100_1loop_file-82.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-89.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-95.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-10.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-105.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-111.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-117.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-123.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-129.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-135.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-141.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-148.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-153.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-16.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-165.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-171.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-177.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-183.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-19.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-196.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-21.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-28.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-33.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-4.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-45.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-51.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-58.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-64.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-7.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-76.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-81.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-88.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-93.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-0.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-104.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-110.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-116.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-122.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-128.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-134.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-14.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-146.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-152.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-159.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-164.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-170.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-176.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-182.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-188.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-194.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-20.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-27.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-32.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-39.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-44.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-50.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-56.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-62.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-69.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-75.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-80.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-87.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-93.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-0.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-103.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-11.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-116.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-122.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-128.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-134.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-14.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-146.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-151.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-158.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-164.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-170.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-176.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-182.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-188.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-194.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-2.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-26.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-32.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-39.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-44.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-50.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-56.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-62.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-68.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-74.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-80.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-87.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-92.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-99.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-102.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-109.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-114.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-120.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-127.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-133.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-139.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-145.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-150.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-157.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-162.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-169.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-175.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-181.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-187.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-193.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-199.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-25.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-30.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-37.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-43.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-5.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-55.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-61.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-67.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-73.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-79.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-85.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-91.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-98.i ILP32 true diff --git a/tests/testcomp/corpus/cover-branches-q40.tsv b/tests/testcomp/corpus/cover-branches-q40.tsv new file mode 100644 index 000000000..322cd03fb --- /dev/null +++ b/tests/testcomp/corpus/cover-branches-q40.tsv @@ -0,0 +1,481 @@ +# category program data_model expected_unreach +Arrays array-fpi/s52iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1a.cil.c ILP32 unknown +Heap memory-alloca/c.03-alloca-2.i ILP32 unknown +Loops nla-digbench-scaling/fermat1-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_lcm2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.ufo.BOUNDED-12.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_79_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label22.c ILP32 true +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +XCSP xcsp/Haystacks-08.c ILP32 true +LinkedLists heap-manipulation/tree-3.i ILP32 true +Arrays array-examples/standard_two_index_08.i ILP32 true +BitVectors bitvector/jain_2-2.c ILP32 unknown +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +Heap ldv-memsafety/memleaks_test7-1.i ILP32 unknown +Loops loops/array-1.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohendiv-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-esbmc-regression/ceil_nondet.i ILP32 true +ECA eca-rers2012/Problem05_label57.c ILP32 false +ProductLines product-lines/elevator_spec3_product25.cil.c ILP32 true +XCSP xcsp/Dubois-017.c ILP32 true +LinkedLists forester-heap/sll-optional-1.i ILP32 true +Arrays array-multidimensional/copy-partial-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_1-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.07.i.cil-1.c ILP32 unknown +Heap memsafety-cve/picotcp.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_valuebound2.c ILP32 true +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_256_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label48.c ILP32 false +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +LinkedLists memsafety-broom/dll-lst-shared.i LP64 unknown +Arrays array-examples/sanfoundry_24-1.i ILP32 true +BitVectors bitvector/byte_add_1-2.i ILP32 unknown +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test17_2-2.i ILP32 unknown +Loops loop-simple/nested_1b.c ILP32 false +Recursive recursified_loop-crafted/recursified_simple_array_index_value_2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_1231b.c ILP32 true +ECA eca-rers2012/Problem03_label25.c ILP32 true +ProductLines product-lines/elevator_spec2_product01.cil.c ILP32 true +XCSP xcsp/AllInterval-019.c ILP32 false +LinkedLists forester-heap/dll-reverse.i ILP32 true +Arrays array-fpi/modpf.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_2.cil-2.c ILP32 unknown +Heap ldv-regression/test28-1.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/cartpole_7_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label09.c ILP32 true +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +XCSP xcsp/Dubois-040.c ILP32 true +LinkedLists forester-heap/sll-token-1.i ILP32 false +Arrays array-memsafety/count_down-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_2.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.02.i.cil-2.c ILP32 unknown +Heap memsafety-cve/json-parser.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_sqrt1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label34.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +LinkedLists list-properties/list-1.i ILP32 true +Arrays array-programs/partial_mod_count_limited_5.c ILP32 true +BitVectors bitvector/soft_float_4-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.13.i.cil-1.c ILP32 unknown +Heap memsafety-ext2/length_test03-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +Recursive recursive/EvenOdd01-1.c ILP32 true +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +Floats neural-networks/softsign_w16_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label00.c ILP32 false +ProductLines product-lines/email_spec8_product14.cil.c ILP32 true +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/sll-lst-shared.i LP64 unknown +Arrays array-crafted/xor1.i ILP32 true +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow infeasible-control-flow/unreach_branch3.c ILP32 true +Heap ldv-memsafety/memleaks_test11_2.i ILP32 unknown +Loops loop-invgen/half_2.i ILP32 true +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/sin_interpolated_negation.c ILP32 true +ECA eca-programs/Problem102_label41.c ILP32 true +ProductLines product-lines/elevator_spec1_product17.cil.c ILP32 true +XCSP xcsp/AllInterval-011.c ILP32 false +LinkedLists forester-heap/dll-optional-2.i ILP32 false +Arrays array-examples/standard_copy9_ground-2.i ILP32 true +BitVectors bitvector/gcd_2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl1.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_3-2.i ILP32 unknown +Loops loop-zilu/benchmark39_conjunctive.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cbmc-regression/float-flags-simp1.i ILP32 true +ECA eca-rers2012/Problem04_label47.c ILP32 true +ProductLines product-lines/elevator_spec2_product29.cil.c ILP32 true +XCSP xcsp/CostasArray-12.c ILP32 false +LinkedLists forester-heap/dll-token-2.i ILP32 false +Arrays array-fpi/eqn4.c ILP32 true +BitVectors bitvector/modulus-1.i ILP32 unknown +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Heap ldv-regression/test10.c ILP32 true +Loops loops/trex03-2.c ILP32 true +Recursive recursified_nla-digbench/recursified_egcd2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/cartpole_31_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label03.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +XCSP xcsp/Dubois-024.c ILP32 true +LinkedLists forester-heap/sll-rb-sentinel-1.i ILP32 true +Arrays array-fpi/s12iff.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1.cil-1.c ILP32 unknown +Heap list-ext-properties/list-ext_2.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label15.c ILP32 false +ProductLines product-lines/email_spec11_product23.cil.c ILP32 true +XCSP xcsp/Dubois-075.c ILP32 true +LinkedLists heap-manipulation/dll_of_dll-2.i ILP32 false +Arrays array-fpi/ss4f.c ILP32 false +BitVectors bitvector/s3_srvr_1.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_6.cil-2.c ILP32 unknown +Heap memsafety-cve/gpac_15.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.ufo.BOUNDED-16.pals.c ILP32 true +Floats neural-networks/gelu_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label28.c ILP32 true +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +XCSP xcsp/Haystacks-15.c ILP32 true +LinkedLists list-ext3-properties/sll_length_check-2.i ILP32 true +Arrays array-memsafety/openbsd_cmemset-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.01.i.cil-2.c ILP32 unknown +Heap memsafety-cve/minizip-ng_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_unwindbound100.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/lunarlander_88_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label40.c ILP32 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +LinkedLists list-properties/simple_built_from_end.i ILP32 true +Arrays array-patterns/array22_pattern.c ILP32 true +BitVectors bitvector/soft_float_2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.10.i.cil-1.c ILP32 unknown +Heap memsafety-cve/stb.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_valuebound100.c ILP32 true +Recursive recursive/Ackermann03.c ILP32 true +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +Floats neural-networks/poly_8_8_8_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label54.c ILP32 false +ProductLines product-lines/email_spec7_product17.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +LinkedLists memsafety-broom/linux-hlist-middle-data.i LP64 unknown +Arrays array-tiling/tcpy.c ILP32 true +BitVectors bitvector/soft_float_5.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.16.i.cil-1.c ILP32 unknown +Heap memsafety/test-0102-2.i ILP32 unknown +Loops nla-digbench/dijkstra.c ILP32 unknown +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-pthread/cs_sync.i ILP32 true +Floats neural-networks/tanh_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label06.c ILP32 true +ProductLines product-lines/email_spec9_product12.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-nested-sll.i LP64 unknown +Arrays array-crafted/bor1.i ILP32 true +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow infeasible-control-flow/conflict_branch3.c ILP32 true +Heap heap-data/shared_mem1.i ILP32 true +Loops loop-industry-pattern/aiob_2.c ILP32 true +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/interpolation.c ILP32 true +ECA eca-programs/Problem102_label08.c ILP32 true +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +LinkedLists forester-heap/dll-circular-1.i ILP32 false +Arrays array-crafted/zero_sum_const_m2.c ILP32 true +BitVectors bitvector/byte_add-2.i ILP32 unknown +ControlFlow memory-model/2SB.i ILP32 false +Heap ldv-memsafety/memleaks_test14_3.i ILP32 unknown +Loops loop-lit/gj2007.i ILP32 true +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/double_req_bl_0670.c ILP32 true +ECA eca-programs/Problem103_label52.c ILP32 true +ProductLines product-lines/elevator_spec1_product25.cil.c ILP32 true +XCSP xcsp/AllInterval-015.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-1.i ILP32 true +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +BitVectors bitvector/byte_add_2-2.i ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test20-1.i ILP32 unknown +Loops loop-zilu/benchmark17_conjunctive.i ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-a.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/float_req_bl_0875.c ILP32 true +ECA eca-rers2012/Problem03_label58.c ILP32 true +ProductLines product-lines/elevator_spec2_product21.cil.c ILP32 true +XCSP xcsp/AllInterval-030.c ILP32 false +LinkedLists forester-heap/dll-sorted-1.i ILP32 false +Arrays array-examples/standard_running-2.i ILP32 true +BitVectors bitvector/interleave_bits.i ILP32 true +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Heap ldv-memsafety/memleaks_test4-1.i ILP32 unknown +Loops loops-crafted-1/in-de52.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_6.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats floats-cdfpl/newton_2_6.i ILP32 false +ECA eca-rers2012/Problem05_label23.c ILP32 true +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +LinkedLists forester-heap/sll-buckets-1.i ILP32 true +Arrays array-fpi/brs5f_overflow.c ILP32 unknown +BitVectors bitvector/jain_6-2.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-3.c ILP32 true +Heap ldv-regression/alias_of_return_2.c_1.i ILP32 true +Loops loops/s3.i ILP32 unknown +Recursive recursified_nla-digbench/recursified_divbin.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats loop-floats-scientific-comp/loop3.c ILP32 true +ECA eca-rers2012/Problem06_label30.c ILP32 true +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +XCSP xcsp/Dubois-020.c ILP32 true +LinkedLists forester-heap/sll-queue-2.i ILP32 false +Arrays array-fpi/ifeqn5f.c ILP32 false +BitVectors bitvector/num_conversion_2.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_1.cil-1.c ILP32 unknown +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_fermat1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/cartpole_55_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label36.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +XCSP xcsp/Dubois-028.c ILP32 true +LinkedLists forester-heap/sll-simple-white-blue-1.i ILP32 true +Arrays array-fpi/nsqm-if.c ILP32 true +BitVectors bitvector/s3_clnt_1.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-3.c ILP32 unknown +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/divbin2_valuebound10.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.ufo.BOUNDED-12.pals.c ILP32 true +Floats neural-networks/cos_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem08_label42.c ILP32 true +ProductLines product-lines/email_spec11_product03.cil.c ILP32 true +XCSP xcsp/Dubois-055.c ILP32 true +LinkedLists heap-manipulation/bubble_sort_linux-2.i ILP32 false +Arrays array-fpi/s3lif.c ILP32 true +BitVectors bitvector/s3_clnt_2.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_11.cil.c ILP32 unknown +Heap list-ext-properties/test-0217_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +Recursive recursified_nla-digbench/recursified_hard-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_54_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label48.c ILP32 true +ProductLines product-lines/email_spec11_product36.cil.c ILP32 true +XCSP xcsp/Dubois-095.c ILP32 true +LinkedLists heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Arrays array-fpi/sina4.c ILP32 true +BitVectors bitvector/s3_clnt_3.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_3.cil.c ILP32 unknown +Heap memsafety-cve/dlt-daemon.i ILP32 unknown +Loops nla-digbench-scaling/freire1_valuebound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_prodbin-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.ufo.BOUNDED-14.pals.c ILP32 true +Floats neural-networks/erf_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label55.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +XCSP xcsp/Haystacks-11.c ILP32 true +LinkedLists list-ext3-properties/dll_nondet_free_order-2.i ILP32 unknown +Arrays array-lopstr16/base_case.i ILP32 true +BitVectors bitvector/s3_srvr_1a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_clnt.blast.01.i.cil-1.c ILP32 unknown +Heap memsafety-cve/gpac_5.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_unwindbound50.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps5-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_16_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label01.c ILP32 true +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +XCSP xcsp/Haystacks-19.c ILP32 true +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-1.i ILP32 true +Arrays array-memsafety/cstrpbrk-alloca-2.i ILP32 unknown +BitVectors bitvector/s3_srvr_3.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.04.i.cil-1.c ILP32 unknown +Heap memsafety-cve/libpe.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_unwindbound50.c ILP32 true +Recursive recursive-simple/id2_b3_o5.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/lunarlander_63_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label07.c ILP32 false +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-3.c ILP32 true +LinkedLists list-properties/list_flag-2.i ILP32 true +Arrays array-memsafety/openbsd_cstrstr-alloca-2.i ILP32 unknown +BitVectors bitvector/soft_float_1-1.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.03.i.cil.c ILP32 unknown +Heap memsafety-cve/openNDS_1.i ILP32 unknown +Loops nla-digbench-scaling/hard2_valuebound5.c ILP32 true +Recursive recursive-simple/id_b5_o10-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/poly_128_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label13.c ILP32 true +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-3.c ILP32 true +LinkedLists memsafety-broom/dll-backwards.i LP64 unknown +Arrays array-multidimensional/transpose-u.c ILP32 true +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow openssl/s3_srvr.blast.08.i.cil-2.c ILP32 unknown +Heap memsafety-cve/radare2_2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +Recursive recursive-simple/sum_non_eq-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/poly_4_4_4_4_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label21.c ILP32 true +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/dll.i LP64 unknown +Arrays array-patterns/array5_pattern.c ILP32 true +BitVectors bitvector/soft_float_3a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.11.i.cil-2.c ILP32 unknown +Heap memsafety-ext/dll_extends_pointer.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_unwindbound5.c ILP32 true +Recursive recursive/Addition02WithOverflowBug.c ILP32 unknown +Sequentialized seq-pthread/cs_lamport.i ILP32 true +Floats neural-networks/softmax_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label27.c ILP32 true +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-2.c ILP32 true +LinkedLists memsafety-broom/linux-list-middle-data.i LP64 unknown +Arrays array-tiling/pnr4.c ILP32 true +BitVectors bitvector/soft_float_4-3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.14.i.cil-2.c ILP32 unknown +Heap memsafety/global-atexit-2.i ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_valuebound20.c ILP32 true +Recursive recursive/Fibonacci03.c ILP32 true +Sequentialized seq-pthread/cs_stack-1.i ILP32 true +Floats neural-networks/softsign_w64_r3_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label33.c ILP32 false +ProductLines product-lines/email_spec8_product29.cil.c ILP32 true +XCSP xcsp/aim-200-2-0-unsat-1.c ILP32 true +LinkedLists memsafety-broom/sll-nested-linux-list.i LP64 unknown +Arrays reducercommutativity/rangesum10.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/cancel_var_through_overflow.i ILP32 true +Heap memsafety/test-0234-2.i ILP32 unknown +Loops nla-digbench/hard-ll.c ILP32 true +Recursive recursive/gcd01-1.c ILP32 true +Sequentialized systemc/token_ring.01.cil-1.c ILP32 unknown +Floats neural-networks/tanh_w64_r1_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label39.c ILP32 true +ProductLines product-lines/email_spec9_product28.cil.c ILP32 true +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-shared-sll-after.i LP64 unknown +Arrays array-cav19/array_min_and_copy_shift_sum_add.c ILP32 true +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow infeasible-control-flow/conflict_branch1.c ILP32 true +Heap heap-data/min_max.i ILP32 true +Loops loop-acceleration/multivar_1-2.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/filter1.c.v+lhb-reducer.c ILP32 true +ECA eca-programs/Problem101_label15.c ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +LinkedLists forester-heap/dll-01-1.i ILP32 false +Arrays array-crafted/mapavg3.i ILP32 true +BitVectors bitvector/byte_add-1.i ILP32 false +ControlFlow infeasible-control-flow/unreach_branch1.c ILP32 true +Heap ldv-memsafety/memleaks_test1-3.i ILP32 unknown +Loops loop-invgen/NetBSD_loop.i ILP32 true +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/mea8000.c ILP32 true +ECA eca-programs/Problem102_label24.c ILP32 false +ProductLines product-lines/elevator_spec1_product01.cil.c ILP32 true +XCSP xcsp/AllInterval-009.c ILP32 false +LinkedLists forester-heap/dll-circular-2.i ILP32 true +Arrays array-crafted/zero_sum3.c ILP32 true +BitVectors bitvector/byte_add_1-1.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch4.c ILP32 true +Heap ldv-memsafety/memleaks_test13_1.i ILP32 unknown +Loops loop-invgen/seq-3.i ILP32 true +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/zonotope_loose.c ILP32 true +ECA eca-programs/Problem102_label57.c ILP32 true +ProductLines product-lines/elevator_spec1_product21.cil.c ILP32 true +XCSP xcsp/AllInterval-013.c ILP32 false +LinkedLists forester-heap/dll-queue-1.i ILP32 true +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +BitVectors bitvector/byte_add_2-1.i ILP32 unknown +ControlFlow memory-model/4SB.i ILP32 false +Heap ldv-memsafety/memleaks_test16_1.i ILP32 unknown +Loops loop-new/count_by_1.i ILP32 true +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_0876.c ILP32 true +ECA eca-rers2012/Problem03_label08.c ILP32 true +ProductLines product-lines/elevator_spec1_product29.cil.c ILP32 true +XCSP xcsp/AllInterval-017.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-1.i ILP32 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +BitVectors bitvector/gcd_1.c ILP32 true +ControlFlow ntdrivers-simplified/diskperf_simpl1.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test18_2.i ILP32 unknown +Loops loop-zilu/benchmark06_conjunctive.i ILP32 unknown +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+nlh-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/float_req_bl_0670.c ILP32 true +ECA eca-rers2012/Problem03_label41.c ILP32 true +ProductLines product-lines/elevator_spec2_product17.cil.c ILP32 true +XCSP xcsp/AllInterval-020.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-1.i ILP32 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +BitVectors bitvector/gcd_3.c ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl4.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_1-1.i ILP32 unknown +Loops loop-zilu/benchmark27_linear.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/float_req_bl_1130b.c ILP32 true +ECA eca-rers2012/Problem04_label18.c ILP32 false +ProductLines product-lines/elevator_spec2_product25.cil.c ILP32 true +XCSP xcsp/CostasArray-10.c ILP32 false +LinkedLists forester-heap/dll-sorted-2.i ILP32 true +Arrays array-examples/standard_palindrome_ground.i ILP32 true +BitVectors bitvector/jain_1-2.c ILP32 unknown +ControlFlow ntdrivers-simplified/kbfiltr_simpl2.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test23_2.i ILP32 unknown +Loops loop-zilu/benchmark50_linear.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_4.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cbmc-regression/float8.i ILP32 true +ECA eca-rers2012/Problem05_label06.c ILP32 true +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +LinkedLists forester-heap/sll-01-1.i ILP32 true +Arrays array-examples/standard_strcpy_original-2.i ILP32 true +BitVectors bitvector/jain_4-1.c ILP32 unknown +ControlFlow ntdrivers/cdaudio.i.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test5_2.i ILP32 unknown +Loops loops-crafted-1/sumt2.c ILP32 true +Recursive recursified_nla-digbench/recursified_bresenham.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +ECA eca-rers2012/Problem05_label40.c ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +XCSP xcsp/Dubois-015.c ILP32 true +LinkedLists forester-heap/sll-circular-1.i ILP32 true +Arrays array-fpi/brs2f.c ILP32 false +BitVectors bitvector/jain_7-1.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +Heap ldv-memsafety/memleaks_test8_2.i ILP32 unknown +Loops loops/invert_string-1.c ILP32 false +Recursive recursified_nla-digbench/recursified_dijkstra-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-nonlinear/coral-benchmark01.c ILP32 false +ECA eca-rers2012/Problem06_label13.c ILP32 true +ProductLines product-lines/elevator_spec3_product29.cil.c ILP32 true +XCSP xcsp/Dubois-018.c ILP32 true +LinkedLists forester-heap/sll-optional-2.i ILP32 false diff --git a/tests/testcomp/corpus/cover-branches-q400.tsv b/tests/testcomp/corpus/cover-branches-q400.tsv new file mode 100644 index 000000000..095c15aa4 --- /dev/null +++ b/tests/testcomp/corpus/cover-branches-q400.tsv @@ -0,0 +1,2766 @@ +# category program data_model expected_unreach +Arrays array-fpi/s52iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1a.cil.c ILP32 unknown +Heap memory-alloca/c.03-alloca-2.i ILP32 unknown +Loops nla-digbench-scaling/fermat1-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_lcm2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.ufo.BOUNDED-12.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_79_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label22.c ILP32 true +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +XCSP xcsp/Haystacks-08.c ILP32 true +LinkedLists heap-manipulation/tree-3.i ILP32 true +Arrays array-examples/standard_two_index_08.i ILP32 true +BitVectors bitvector/jain_2-2.c ILP32 unknown +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +Heap ldv-memsafety/memleaks_test7-1.i ILP32 unknown +Loops loops/array-1.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohendiv-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-esbmc-regression/ceil_nondet.i ILP32 true +ECA eca-rers2012/Problem05_label57.c ILP32 false +ProductLines product-lines/elevator_spec3_product25.cil.c ILP32 true +XCSP xcsp/Dubois-017.c ILP32 true +LinkedLists forester-heap/sll-optional-1.i ILP32 true +Arrays array-multidimensional/copy-partial-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_1-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.07.i.cil-1.c ILP32 unknown +Heap memsafety-cve/picotcp.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_valuebound2.c ILP32 true +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_256_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label48.c ILP32 false +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +LinkedLists memsafety-broom/dll-lst-shared.i LP64 unknown +Arrays array-examples/sanfoundry_24-1.i ILP32 true +BitVectors bitvector/byte_add_1-2.i ILP32 unknown +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test17_2-2.i ILP32 unknown +Loops loop-simple/nested_1b.c ILP32 false +Recursive recursified_loop-crafted/recursified_simple_array_index_value_2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_1231b.c ILP32 true +ECA eca-rers2012/Problem03_label25.c ILP32 true +ProductLines product-lines/elevator_spec2_product01.cil.c ILP32 true +XCSP xcsp/AllInterval-019.c ILP32 false +LinkedLists forester-heap/dll-reverse.i ILP32 true +Arrays array-fpi/modpf.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_2.cil-2.c ILP32 unknown +Heap ldv-regression/test28-1.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/cartpole_7_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label09.c ILP32 true +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +XCSP xcsp/Dubois-040.c ILP32 true +LinkedLists forester-heap/sll-token-1.i ILP32 false +Arrays array-memsafety/count_down-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_2.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.02.i.cil-2.c ILP32 unknown +Heap memsafety-cve/json-parser.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_sqrt1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label34.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +LinkedLists list-properties/list-1.i ILP32 true +Arrays array-programs/partial_mod_count_limited_5.c ILP32 true +BitVectors bitvector/soft_float_4-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.13.i.cil-1.c ILP32 unknown +Heap memsafety-ext2/length_test03-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +Recursive recursive/EvenOdd01-1.c ILP32 true +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +Floats neural-networks/softsign_w16_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label00.c ILP32 false +ProductLines product-lines/email_spec8_product14.cil.c ILP32 true +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/sll-lst-shared.i LP64 unknown +Arrays array-crafted/xor1.i ILP32 true +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow infeasible-control-flow/unreach_branch3.c ILP32 true +Heap ldv-memsafety/memleaks_test11_2.i ILP32 unknown +Loops loop-invgen/half_2.i ILP32 true +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/sin_interpolated_negation.c ILP32 true +ECA eca-programs/Problem102_label41.c ILP32 true +ProductLines product-lines/elevator_spec1_product17.cil.c ILP32 true +XCSP xcsp/AllInterval-011.c ILP32 false +LinkedLists forester-heap/dll-optional-2.i ILP32 false +Arrays array-examples/standard_copy9_ground-2.i ILP32 true +BitVectors bitvector/gcd_2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl1.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_3-2.i ILP32 unknown +Loops loop-zilu/benchmark39_conjunctive.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cbmc-regression/float-flags-simp1.i ILP32 true +ECA eca-rers2012/Problem04_label47.c ILP32 true +ProductLines product-lines/elevator_spec2_product29.cil.c ILP32 true +XCSP xcsp/CostasArray-12.c ILP32 false +LinkedLists forester-heap/dll-token-2.i ILP32 false +Arrays array-fpi/eqn4.c ILP32 true +BitVectors bitvector/modulus-1.i ILP32 unknown +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Heap ldv-regression/test10.c ILP32 true +Loops loops/trex03-2.c ILP32 true +Recursive recursified_nla-digbench/recursified_egcd2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/cartpole_31_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label03.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +XCSP xcsp/Dubois-024.c ILP32 true +LinkedLists forester-heap/sll-rb-sentinel-1.i ILP32 true +Arrays array-fpi/s12iff.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1.cil-1.c ILP32 unknown +Heap list-ext-properties/list-ext_2.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label15.c ILP32 false +ProductLines product-lines/email_spec11_product23.cil.c ILP32 true +XCSP xcsp/Dubois-075.c ILP32 true +LinkedLists heap-manipulation/dll_of_dll-2.i ILP32 false +Arrays array-fpi/ss4f.c ILP32 false +BitVectors bitvector/s3_srvr_1.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_6.cil-2.c ILP32 unknown +Heap memsafety-cve/gpac_15.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.ufo.BOUNDED-16.pals.c ILP32 true +Floats neural-networks/gelu_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label28.c ILP32 true +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +XCSP xcsp/Haystacks-15.c ILP32 true +LinkedLists list-ext3-properties/sll_length_check-2.i ILP32 true +Arrays array-memsafety/openbsd_cmemset-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.01.i.cil-2.c ILP32 unknown +Heap memsafety-cve/minizip-ng_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_unwindbound100.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/lunarlander_88_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label40.c ILP32 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +LinkedLists list-properties/simple_built_from_end.i ILP32 true +Arrays array-patterns/array22_pattern.c ILP32 true +BitVectors bitvector/soft_float_2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.10.i.cil-1.c ILP32 unknown +Heap memsafety-cve/stb.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_valuebound100.c ILP32 true +Recursive recursive/Ackermann03.c ILP32 true +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +Floats neural-networks/poly_8_8_8_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label54.c ILP32 false +ProductLines product-lines/email_spec7_product17.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +LinkedLists memsafety-broom/linux-hlist-middle-data.i LP64 unknown +Arrays array-tiling/tcpy.c ILP32 true +BitVectors bitvector/soft_float_5.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.16.i.cil-1.c ILP32 unknown +Heap memsafety/test-0102-2.i ILP32 unknown +Loops nla-digbench/dijkstra.c ILP32 unknown +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-pthread/cs_sync.i ILP32 true +Floats neural-networks/tanh_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label06.c ILP32 true +ProductLines product-lines/email_spec9_product12.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-nested-sll.i LP64 unknown +Arrays array-crafted/bor1.i ILP32 true +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow infeasible-control-flow/conflict_branch3.c ILP32 true +Heap heap-data/shared_mem1.i ILP32 true +Loops loop-industry-pattern/aiob_2.c ILP32 true +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/interpolation.c ILP32 true +ECA eca-programs/Problem102_label08.c ILP32 true +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +LinkedLists forester-heap/dll-circular-1.i ILP32 false +Arrays array-crafted/zero_sum_const_m2.c ILP32 true +BitVectors bitvector/byte_add-2.i ILP32 unknown +ControlFlow memory-model/2SB.i ILP32 false +Heap ldv-memsafety/memleaks_test14_3.i ILP32 unknown +Loops loop-lit/gj2007.i ILP32 true +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/double_req_bl_0670.c ILP32 true +ECA eca-programs/Problem103_label52.c ILP32 true +ProductLines product-lines/elevator_spec1_product25.cil.c ILP32 true +XCSP xcsp/AllInterval-015.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-1.i ILP32 true +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +BitVectors bitvector/byte_add_2-2.i ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test20-1.i ILP32 unknown +Loops loop-zilu/benchmark17_conjunctive.i ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-a.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/float_req_bl_0875.c ILP32 true +ECA eca-rers2012/Problem03_label58.c ILP32 true +ProductLines product-lines/elevator_spec2_product21.cil.c ILP32 true +XCSP xcsp/AllInterval-030.c ILP32 false +LinkedLists forester-heap/dll-sorted-1.i ILP32 false +Arrays array-examples/standard_running-2.i ILP32 true +BitVectors bitvector/interleave_bits.i ILP32 true +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Heap ldv-memsafety/memleaks_test4-1.i ILP32 unknown +Loops loops-crafted-1/in-de52.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_6.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats floats-cdfpl/newton_2_6.i ILP32 false +ECA eca-rers2012/Problem05_label23.c ILP32 true +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +LinkedLists forester-heap/sll-buckets-1.i ILP32 true +Arrays array-fpi/brs5f_overflow.c ILP32 unknown +BitVectors bitvector/jain_6-2.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-3.c ILP32 true +Heap ldv-regression/alias_of_return_2.c_1.i ILP32 true +Loops loops/s3.i ILP32 unknown +Recursive recursified_nla-digbench/recursified_divbin.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats loop-floats-scientific-comp/loop3.c ILP32 true +ECA eca-rers2012/Problem06_label30.c ILP32 true +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +XCSP xcsp/Dubois-020.c ILP32 true +LinkedLists forester-heap/sll-queue-2.i ILP32 false +Arrays array-fpi/ifeqn5f.c ILP32 false +BitVectors bitvector/num_conversion_2.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_1.cil-1.c ILP32 unknown +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_fermat1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/cartpole_55_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label36.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +XCSP xcsp/Dubois-028.c ILP32 true +LinkedLists forester-heap/sll-simple-white-blue-1.i ILP32 true +Arrays array-fpi/nsqm-if.c ILP32 true +BitVectors bitvector/s3_clnt_1.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-3.c ILP32 unknown +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/divbin2_valuebound10.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.ufo.BOUNDED-12.pals.c ILP32 true +Floats neural-networks/cos_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem08_label42.c ILP32 true +ProductLines product-lines/email_spec11_product03.cil.c ILP32 true +XCSP xcsp/Dubois-055.c ILP32 true +LinkedLists heap-manipulation/bubble_sort_linux-2.i ILP32 false +Arrays array-fpi/s3lif.c ILP32 true +BitVectors bitvector/s3_clnt_2.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_11.cil.c ILP32 unknown +Heap list-ext-properties/test-0217_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +Recursive recursified_nla-digbench/recursified_hard-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_54_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label48.c ILP32 true +ProductLines product-lines/email_spec11_product36.cil.c ILP32 true +XCSP xcsp/Dubois-095.c ILP32 true +LinkedLists heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Arrays array-fpi/sina4.c ILP32 true +BitVectors bitvector/s3_clnt_3.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_3.cil.c ILP32 unknown +Heap memsafety-cve/dlt-daemon.i ILP32 unknown +Loops nla-digbench-scaling/freire1_valuebound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_prodbin-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.ufo.BOUNDED-14.pals.c ILP32 true +Floats neural-networks/erf_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label55.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +XCSP xcsp/Haystacks-11.c ILP32 true +LinkedLists list-ext3-properties/dll_nondet_free_order-2.i ILP32 unknown +Arrays array-lopstr16/base_case.i ILP32 true +BitVectors bitvector/s3_srvr_1a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_clnt.blast.01.i.cil-1.c ILP32 unknown +Heap memsafety-cve/gpac_5.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_unwindbound50.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps5-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_16_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label01.c ILP32 true +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +XCSP xcsp/Haystacks-19.c ILP32 true +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-1.i ILP32 true +Arrays array-memsafety/cstrpbrk-alloca-2.i ILP32 unknown +BitVectors bitvector/s3_srvr_3.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.04.i.cil-1.c ILP32 unknown +Heap memsafety-cve/libpe.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_unwindbound50.c ILP32 true +Recursive recursive-simple/id2_b3_o5.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/lunarlander_63_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label07.c ILP32 false +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-3.c ILP32 true +LinkedLists list-properties/list_flag-2.i ILP32 true +Arrays array-memsafety/openbsd_cstrstr-alloca-2.i ILP32 unknown +BitVectors bitvector/soft_float_1-1.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.03.i.cil.c ILP32 unknown +Heap memsafety-cve/openNDS_1.i ILP32 unknown +Loops nla-digbench-scaling/hard2_valuebound5.c ILP32 true +Recursive recursive-simple/id_b5_o10-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/poly_128_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label13.c ILP32 true +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-3.c ILP32 true +LinkedLists memsafety-broom/dll-backwards.i LP64 unknown +Arrays array-multidimensional/transpose-u.c ILP32 true +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow openssl/s3_srvr.blast.08.i.cil-2.c ILP32 unknown +Heap memsafety-cve/radare2_2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +Recursive recursive-simple/sum_non_eq-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/poly_4_4_4_4_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label21.c ILP32 true +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/dll.i LP64 unknown +Arrays array-patterns/array5_pattern.c ILP32 true +BitVectors bitvector/soft_float_3a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.11.i.cil-2.c ILP32 unknown +Heap memsafety-ext/dll_extends_pointer.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_unwindbound5.c ILP32 true +Recursive recursive/Addition02WithOverflowBug.c ILP32 unknown +Sequentialized seq-pthread/cs_lamport.i ILP32 true +Floats neural-networks/softmax_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label27.c ILP32 true +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-2.c ILP32 true +LinkedLists memsafety-broom/linux-list-middle-data.i LP64 unknown +Arrays array-tiling/pnr4.c ILP32 true +BitVectors bitvector/soft_float_4-3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.14.i.cil-2.c ILP32 unknown +Heap memsafety/global-atexit-2.i ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_valuebound20.c ILP32 true +Recursive recursive/Fibonacci03.c ILP32 true +Sequentialized seq-pthread/cs_stack-1.i ILP32 true +Floats neural-networks/softsign_w64_r3_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label33.c ILP32 false +ProductLines product-lines/email_spec8_product29.cil.c ILP32 true +XCSP xcsp/aim-200-2-0-unsat-1.c ILP32 true +LinkedLists memsafety-broom/sll-nested-linux-list.i LP64 unknown +Arrays reducercommutativity/rangesum10.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/cancel_var_through_overflow.i ILP32 true +Heap memsafety/test-0234-2.i ILP32 unknown +Loops nla-digbench/hard-ll.c ILP32 true +Recursive recursive/gcd01-1.c ILP32 true +Sequentialized systemc/token_ring.01.cil-1.c ILP32 unknown +Floats neural-networks/tanh_w64_r1_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label39.c ILP32 true +ProductLines product-lines/email_spec9_product28.cil.c ILP32 true +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-shared-sll-after.i LP64 unknown +Arrays array-cav19/array_min_and_copy_shift_sum_add.c ILP32 true +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow infeasible-control-flow/conflict_branch1.c ILP32 true +Heap heap-data/min_max.i ILP32 true +Loops loop-acceleration/multivar_1-2.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/filter1.c.v+lhb-reducer.c ILP32 true +ECA eca-programs/Problem101_label15.c ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +LinkedLists forester-heap/dll-01-1.i ILP32 false +Arrays array-crafted/mapavg3.i ILP32 true +BitVectors bitvector/byte_add-1.i ILP32 false +ControlFlow infeasible-control-flow/unreach_branch1.c ILP32 true +Heap ldv-memsafety/memleaks_test1-3.i ILP32 unknown +Loops loop-invgen/NetBSD_loop.i ILP32 true +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/mea8000.c ILP32 true +ECA eca-programs/Problem102_label24.c ILP32 false +ProductLines product-lines/elevator_spec1_product01.cil.c ILP32 true +XCSP xcsp/AllInterval-009.c ILP32 false +LinkedLists forester-heap/dll-circular-2.i ILP32 true +Arrays array-crafted/zero_sum3.c ILP32 true +BitVectors bitvector/byte_add_1-1.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch4.c ILP32 true +Heap ldv-memsafety/memleaks_test13_1.i ILP32 unknown +Loops loop-invgen/seq-3.i ILP32 true +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/zonotope_loose.c ILP32 true +ECA eca-programs/Problem102_label57.c ILP32 true +ProductLines product-lines/elevator_spec1_product21.cil.c ILP32 true +XCSP xcsp/AllInterval-013.c ILP32 false +LinkedLists forester-heap/dll-queue-1.i ILP32 true +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +BitVectors bitvector/byte_add_2-1.i ILP32 unknown +ControlFlow memory-model/4SB.i ILP32 false +Heap ldv-memsafety/memleaks_test16_1.i ILP32 unknown +Loops loop-new/count_by_1.i ILP32 true +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_0876.c ILP32 true +ECA eca-rers2012/Problem03_label08.c ILP32 true +ProductLines product-lines/elevator_spec1_product29.cil.c ILP32 true +XCSP xcsp/AllInterval-017.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-1.i ILP32 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +BitVectors bitvector/gcd_1.c ILP32 true +ControlFlow ntdrivers-simplified/diskperf_simpl1.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test18_2.i ILP32 unknown +Loops loop-zilu/benchmark06_conjunctive.i ILP32 unknown +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+nlh-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/float_req_bl_0670.c ILP32 true +ECA eca-rers2012/Problem03_label41.c ILP32 true +ProductLines product-lines/elevator_spec2_product17.cil.c ILP32 true +XCSP xcsp/AllInterval-020.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-1.i ILP32 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +BitVectors bitvector/gcd_3.c ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl4.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_1-1.i ILP32 unknown +Loops loop-zilu/benchmark27_linear.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/float_req_bl_1130b.c ILP32 true +ECA eca-rers2012/Problem04_label18.c ILP32 false +ProductLines product-lines/elevator_spec2_product25.cil.c ILP32 true +XCSP xcsp/CostasArray-10.c ILP32 false +LinkedLists forester-heap/dll-sorted-2.i ILP32 true +Arrays array-examples/standard_palindrome_ground.i ILP32 true +BitVectors bitvector/jain_1-2.c ILP32 unknown +ControlFlow ntdrivers-simplified/kbfiltr_simpl2.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test23_2.i ILP32 unknown +Loops loop-zilu/benchmark50_linear.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_4.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cbmc-regression/float8.i ILP32 true +ECA eca-rers2012/Problem05_label06.c ILP32 true +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +LinkedLists forester-heap/sll-01-1.i ILP32 true +Arrays array-examples/standard_strcpy_original-2.i ILP32 true +BitVectors bitvector/jain_4-1.c ILP32 unknown +ControlFlow ntdrivers/cdaudio.i.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test5_2.i ILP32 unknown +Loops loops-crafted-1/sumt2.c ILP32 true +Recursive recursified_nla-digbench/recursified_bresenham.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +ECA eca-rers2012/Problem05_label40.c ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +XCSP xcsp/Dubois-015.c ILP32 true +LinkedLists forester-heap/sll-circular-1.i ILP32 true +Arrays array-fpi/brs2f.c ILP32 false +BitVectors bitvector/jain_7-1.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +Heap ldv-memsafety/memleaks_test8_2.i ILP32 unknown +Loops loops/invert_string-1.c ILP32 false +Recursive recursified_nla-digbench/recursified_dijkstra-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-nonlinear/coral-benchmark01.c ILP32 false +ECA eca-rers2012/Problem06_label13.c ILP32 true +ProductLines product-lines/elevator_spec3_product29.cil.c ILP32 true +XCSP xcsp/Dubois-018.c ILP32 true +LinkedLists forester-heap/sll-optional-2.i ILP32 false +Arrays array-fpi/condn.c ILP32 true +BitVectors bitvector/modulus-2.i ILP32 true +ControlFlow ntdrivers/floppy2.i.cil.c ILP32 unknown +Heap ldv-regression/rule57_ebda_blast.i ILP32 true +Loops loops/terminator_01.c ILP32 false +Recursive recursified_nla-digbench/recursified_egcd-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_19_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label46.c ILP32 true +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +XCSP xcsp/Dubois-022.c ILP32 true +LinkedLists forester-heap/sll-rb-cnstr_1-1.i ILP32 true +Arrays array-fpi/ifeqn1f.c ILP32 false +BitVectors bitvector/parity.i ILP32 true +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +Heap ldv-regression/test19.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_egcd3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats neural-networks/cartpole_43_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label19.c ILP32 false +ProductLines product-lines/email_spec0_product05.cil.c ILP32 true +XCSP xcsp/Dubois-026.c ILP32 true +LinkedLists forester-heap/sll-rb-sentinel-2.i ILP32 false +Arrays array-fpi/indp3f.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1a.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_1.cil-2.c ILP32 unknown +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_fermat2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/cartpole_67_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label52.c ILP32 true +ProductLines product-lines/email_spec0_product24.cil.c ILP32 true +XCSP xcsp/Dubois-030.c ILP32 true +LinkedLists forester-heap/sll-sorted-1.i ILP32 false +Arrays array-fpi/ms3.c ILP32 true +BitVectors bitvector/s3_clnt_1.BV.c.cil-2a.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-1.c ILP32 unknown +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/dijkstra-u_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Floats neural-networks/cartpole_91_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label25.c ILP32 false +ProductLines product-lines/email_spec0_product37.cil.c ILP32 true +XCSP xcsp/Dubois-045.c ILP32 true +LinkedLists forester-heap/sll-token-2.i ILP32 true +Arrays array-fpi/res1f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1a.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_4.cil-1.c ILP32 unknown +Heap list-ext-properties/960521-1_1-1.i ILP32 unknown +Loops nla-digbench-scaling/divbin_unwindbound50.i ILP32 false +Recursive recursified_nla-digbench/recursified_geo2-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_17_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label58.c ILP32 true +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +XCSP xcsp/Dubois-065.c ILP32 true +LinkedLists heap-manipulation/dancing.i ILP32 true +Arrays array-fpi/s2if.c ILP32 true +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow openssl-simplified/s3_srvr_1.cil-2.c ILP32 unknown +Heap list-ext-properties/simple-ext_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_41_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label31.c ILP32 true +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +XCSP xcsp/Dubois-085.c ILP32 true +LinkedLists heap-manipulation/merge_sort-1.i ILP32 false +Arrays array-fpi/s4iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1a.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_13.cil.c ILP32 unknown +Heap list-ext-properties/test-0513_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_hard2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_66_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label05.c ILP32 true +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +XCSP xcsp/Haystacks-06.c ILP32 true +LinkedLists heap-manipulation/tree-1.i ILP32 unknown +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +ControlFlow openssl-simplified/s3_srvr_2.cil-1.c ILP32 unknown +Heap memsafety-cve/asterisk.i ILP32 unknown +Loops nla-digbench-scaling/fermat2-ll_valuebound10.c ILP32 true +Recursive recursified_nla-digbench/recursified_prod4br-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_90_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label38.c ILP32 true +ProductLines product-lines/email_spec1_product28.cil.c ILP32 true +XCSP xcsp/Haystacks-09.c ILP32 true +LinkedLists heap-manipulation/tree-4.i ILP32 false +Arrays array-fpi/sqmf.c ILP32 false +BitVectors bitvector/s3_srvr_1_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_4.cil.c ILP32 unknown +Heap memsafety-cve/frrFixed.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll2_unwindbound20.c ILP32 unknown +Recursive recursified_nla-digbench/recursified_ps2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/gcas_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label11.c ILP32 true +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +XCSP xcsp/Haystacks-13.c ILP32 true +LinkedLists list-ext3-properties/dll_nullified-1.i ILP32 false +Arrays array-industry-pattern/array_of_struct_ptr_monotonic.i ILP32 true +BitVectors bitvector/s3_srvr_1a_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_7.cil.c ILP32 unknown +Heap memsafety-cve/gpac_17.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u2_unwindbound20.c ILP32 unknown +Recursive recursified_nla-digbench/recursified_ps4-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/logistic_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label44.c ILP32 true +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +XCSP xcsp/Haystacks-17.c ILP32 true +LinkedLists list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Arrays array-memsafety-realloc/array-realloc-3.i ILP32 unknown +BitVectors bitvector/s3_srvr_2_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.01.i.cil-2.c ILP32 unknown +Heap memsafety-cve/hyperkit_1.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll2_unwindbound20.c ILP32 unknown +Recursive recursified_nla-digbench/recursified_ps6-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_27_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label17.c ILP32 true +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-2.c ILP32 false +LinkedLists list-properties/alternating_list-1.i ILP32 true +Arrays array-memsafety/cstrcspn-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.03.i.cil-1.c ILP32 unknown +Heap memsafety-cve/krb5Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll2_unwindbound20.c ILP32 unknown +Recursive recursive-simple/id2_b2_o3.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats neural-networks/lunarlander_51_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label50.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-1.c ILP32 true +LinkedLists list-properties/list-2.i ILP32 false +Arrays array-memsafety/knapsack_alloca_unsafe.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a_alt.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_clnt.blast.04.i.cil-2.c ILP32 unknown +Heap memsafety-cve/libsndfile.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_unwindbound20.c ILP32 false +Recursive recursive-simple/id_b2_o3.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/lunarlander_75_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem13_label23.c ILP32 false +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-1.c ILP32 false +LinkedLists list-properties/simple-1.i ILP32 false +Arrays array-memsafety/openbsd_cstrlcpy-alloca-1.i ILP32 unknown +BitVectors bitvector/soft_float_1-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.02.i.cil-1.c ILP32 unknown +Heap memsafety-cve/mujs.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound1.c ILP32 false +Recursive recursive-simple/id_b3_o5-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/lunarlander_99_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label56.c ILP32 true +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-1.c ILP32 true +LinkedLists list-properties/splice-1.i ILP32 false +Arrays array-memsafety/stroeder2-alloca-1.i ILP32 unknown +BitVectors bitvector/soft_float_1-3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.06.i.cil-1.c ILP32 unknown +Heap memsafety-cve/openrazer.i ILP32 unknown +Loops nla-digbench-scaling/knuth_valuebound5.i ILP32 true +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_16_16_16_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label31.c ILP32 true +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-1.c ILP32 false +LinkedLists memsafety-broom/dll-fst-shared.i LP64 unknown +Arrays array-multidimensional/init-non-constant-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.07.i.cil-2.c ILP32 unknown +Heap memsafety-cve/radare2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_valuebound10.c ILP32 true +Recursive recursive-simple/sum_non.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_32_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label04.c ILP32 false +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +LinkedLists memsafety-broom/dll-middle-data.i LP64 unknown +Arrays array-patterns/array16_pattern.c ILP32 true +BitVectors bitvector/soft_float_3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.09.i.cil-1.c ILP32 unknown +Heap memsafety-cve/sniproxyFixed.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_valuebound20.c ILP32 true +Recursive recursive/Ackermann01-2.c ILP32 true +Sequentialized seq-pthread/cs_dekker_unfair.i ILP32 true +Floats neural-networks/poly_64_64_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label37.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +LinkedLists memsafety-broom/linux-hlist-fst-data.i LP64 unknown +Arrays array-patterns/array29_pattern.c ILP32 true +BitVectors bitvector/soft_float_4-1.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.10.i.cil-2.c ILP32 unknown +Heap memsafety-cve/zchunk.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound1.c ILP32 true +Recursive recursive/Addition01-2.c ILP32 true +Sequentialized seq-pthread/cs_fib_longer-1.i ILP32 true +Floats neural-networks/robot_5_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label10.c ILP32 true +ProductLines product-lines/email_spec7_product24.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-4.c ILP32 false +LinkedLists memsafety-broom/linux-list-fst-data.i LP64 unknown +Arrays array-programs/copysome1-1.i ILP32 true +BitVectors bitvector/soft_float_4-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.12.i.cil-1.c ILP32 unknown +Heap memsafety-ext2/complex_data_creation_test01-1.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_unwindbound2.c ILP32 false +Recursive recursive/Addition03-2.c ILP32 unknown +Sequentialized seq-pthread/cs_peterson.i ILP32 true +Floats neural-networks/softplus_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label43.c ILP32 true +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-4.c ILP32 true +LinkedLists memsafety-broom/sll-fst-shared.i LP64 unknown +Arrays array-tiling/mlceu.c ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +ControlFlow openssl/s3_srvr.blast.13.i.cil-2.c ILP32 unknown +Heap memsafety-ext2/split_list_test05-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound50.c ILP32 true +Recursive recursive/EvenOdd03WithOverflowBug.c ILP32 unknown +Sequentialized seq-pthread/cs_read_write_lock-1.i ILP32 true +Floats neural-networks/softsign_w32_r4_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label16.c ILP32 true +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-middle-data.i LP64 unknown +Arrays array-tiling/revcpyswp2.c ILP32 true +BitVectors bitvector/soft_float_5a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.15.i.cil-1.c ILP32 unknown +Heap memsafety/lockfree-3.0.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_valuebound100.c ILP32 true +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-pthread/cs_stateful-1.i ILP32 false +Floats neural-networks/sqrt_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label49.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-unsat-3.c ILP32 true +LinkedLists memsafety-broom/sll-nested-sll-lst-data.i LP64 unknown +Arrays reducercommutativity/max.i ILP32 true +BitVectors bitvector/sum02-2.c ILP32 true +ControlFlow openssl/s3_srvr.blast.16.i.cil-2.c ILP32 unknown +Heap memsafety/test-0220.i ILP32 unknown +Loops nla-digbench/fermat2.c ILP32 unknown +Recursive recursive/McCarthy91-2.c ILP32 true +Sequentialized seq-pthread/cs_szymanski.i ILP32 true +Floats neural-networks/tanh_w32_r2_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem19_label22.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-shared-after.i LP64 unknown +Arrays reducercommutativity/sep40-1.i ILP32 true +ControlFlow unsignedintegeroverflow-sas23/linear_interpolation.i ILP32 true +Heap memsafety/test-0236.i ILP32 unknown +Loops nla-digbench/ps2-ll.c ILP32 true +Recursive recursive/recHanoi01.c ILP32 true +Sequentialized systemc/token_ring.02.cil-1.c ILP32 unknown +Floats neural-networks/tanh_w8_r4_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label56.c ILP32 true +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-shared-sll.i LP64 unknown +Arrays array-cav19/array_init_pair_symmetr2.c ILP32 true +ControlFlow infeasible-control-flow/conflict_branch2.c ILP32 true +Heap heap-data/cart.i ILP32 true +Loops loop-acceleration/array_3-2.i ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +ECA eca-programs/Problem101_label07.c ILP32 false +ProductLines product-lines/elevator_spec14_product11.cil.c ILP32 true +XCSP xcsp/AllInterval-006.c ILP32 false +LinkedLists forester-heap/dll-01-2.i ILP32 true +Arrays array-crafted/bAnd2.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch2.c ILP32 true +Heap heap-data/quick_sort_split.i ILP32 true +Loops loop-acceleration/simple_4-2_abstracted.c ILP32 true +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.ufo.BOUNDED-10.pals.c ILP32 true +Floats float-benchs/filter2_set.c ILP32 true +ECA eca-programs/Problem101_label23.c ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +LinkedLists forester-heap/dll-optional-1.i ILP32 true +Arrays array-crafted/bor4.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch5.c ILP32 true +Heap ldv-memsafety/memleaks_test1-1.i ILP32 unknown +Loops loop-industry-pattern/nested-3.c ILP32 unknown +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.ufo.BOUNDED-10.pals.c ILP32 true +Floats float-benchs/inv_Newton-2.c ILP32 false +ECA eca-programs/Problem102_label16.c ILP32 true +ProductLines product-lines/elevator_spec14_product32.cil.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +LinkedLists forester-heap/dll-queue-2.i ILP32 false +Arrays array-crafted/mapsum2.i ILP32 true +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test10-2.i ILP32 unknown +Loops loop-invgen/apache-get-tag.i.p+sep-reducer.c ILP32 true +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/rlim_invariant.c.v+lhb-reducer.c ILP32 true +ECA eca-programs/Problem102_label32.c ILP32 true +ProductLines product-lines/elevator_spec1_product09.cil.c ILP32 true +XCSP xcsp/AllInterval-012.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Arrays array-crafted/xor4.i ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test12-2.i ILP32 unknown +Loops loop-invgen/id_trans.i ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/sqrt_biNewton_pseudoconstant.c ILP32 true +ECA eca-programs/Problem102_label49.c ILP32 false +ProductLines product-lines/elevator_spec1_product19.cil.c ILP32 true +XCSP xcsp/AllInterval-014.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-2.i ILP32 true +Arrays array-crafted/zero_sum_const2.c ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl4.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test14.i ILP32 unknown +Loops loop-lit/cggmp2005b.i ILP32 true +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats float-newlib/double_req_bl_0660b.c ILP32 true +ECA eca-programs/Problem103_label43.c ILP32 true +ProductLines product-lines/elevator_spec1_product23.cil.c ILP32 true +XCSP xcsp/AllInterval-016.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-2.i ILP32 true +Arrays array-crafted/zero_sum_m2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl2.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test15-2.i ILP32 unknown +Loops loop-lit/gsv2008.i ILP32 true +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/double_req_bl_0684b.c ILP32 true +ECA eca-rers2012/Problem03_label00.c ILP32 true +ProductLines product-lines/elevator_spec1_product27.cil.c ILP32 true +XCSP xcsp/AllInterval-018.c ILP32 false +LinkedLists forester-heap/dll-token-1.i ILP32 true +Arrays array-examples/relax-2-2.i ILP32 true +ControlFlow ntdrivers/diskperf.i.cil-1.c ILP32 true +Heap ldv-memsafety/memleaks_test17_1-1.i ILP32 unknown +Loops loop-new/gauss_sum.i.p+lhb-reducer.c ILP32 true +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_1122a.c ILP32 true +ECA eca-rers2012/Problem03_label16.c ILP32 true +ProductLines product-lines/elevator_spec1_product31.cil.c ILP32 true +XCSP xcsp/AllInterval-025.c ILP32 false +LinkedLists forester-heap/sll-01-2.i ILP32 false +Arrays array-examples/sanfoundry_43_ground.i ILP32 true +ControlFlow ntdrivers/floppy.i.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test18.i ILP32 unknown +Loops loop-zilu/benchmark01_conjunctive.i ILP32 unknown +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+lhb-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/float_req_bl_0660b.c ILP32 true +ECA eca-rers2012/Problem03_label33.c ILP32 true +ProductLines product-lines/elevator_spec2_product09.cil.c ILP32 true +XCSP xcsp/AllInterval-035.c ILP32 false +LinkedLists forester-heap/sll-buckets-2.i ILP32 false +Arrays array-examples/standard_compareModified_ground.i ILP32 true +ControlFlow ntdrivers/kbfiltr.i.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test19-1.i ILP32 unknown +Loops loop-zilu/benchmark11_linear_abstracted.i ILP32 true +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/float_req_bl_0684b.c ILP32 true +ECA eca-rers2012/Problem03_label49.c ILP32 true +ProductLines product-lines/elevator_spec2_product19.cil.c ILP32 true +XCSP xcsp/CostasArray-11.c ILP32 false +LinkedLists forester-heap/sll-circular-2.i ILP32 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +ControlFlow ntdrivers/parport.i.cil-2.c ILP32 true +Heap ldv-memsafety/memleaks_test21-1.i ILP32 unknown +Loops loop-zilu/benchmark23_conjunctive.i ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-newlib/float_req_bl_0920a.c ILP32 true +ECA eca-rers2012/Problem04_label06.c ILP32 false +ProductLines product-lines/elevator_spec2_product23.cil.c ILP32 true +XCSP xcsp/CostasArray-13.c ILP32 false +LinkedLists forester-heap/sll-queue-1.i ILP32 true +Arrays array-examples/standard_copy7_ground-2.i ILP32 true +ControlFlow openssl-simplified/s3_clnt_2.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_2-1.i ILP32 unknown +Loops loop-zilu/benchmark33_linear.i ILP32 true +Recursive recursified_loop-simple/recursified_nested_1b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-newlib/float_req_bl_1270a.c ILP32 true +ECA eca-rers2012/Problem04_label31.c ILP32 false +ProductLines product-lines/elevator_spec2_product27.cil.c ILP32 true +XCSP xcsp/CostasArray-15.c ILP32 false +LinkedLists forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Arrays array-examples/standard_find_ground-2.i ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_5.i ILP32 unknown +Loops loop-zilu/benchmark44_disjunctive.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cbmc-regression/float19.i ILP32 true +ECA eca-rers2012/Problem04_label56.c ILP32 true +ProductLines product-lines/elevator_spec2_product31.cil.c ILP32 true +XCSP xcsp/CostasArray-17.c ILP32 false +LinkedLists forester-heap/sll-reverse_simple.i ILP32 true +Arrays array-examples/standard_partition_original_ground.i ILP32 true +ControlFlow openssl-simplified/s3_clnt_4.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test23_4.i ILP32 unknown +Loops loops-crafted-1/in-de20.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_5.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +ECA eca-rers2012/Problem05_label14.c ILP32 true +ProductLines product-lines/elevator_spec3_product03.cil.c ILP32 false +XCSP xcsp/Dubois-016.c ILP32 true +LinkedLists forester-heap/sll-simple-white-blue-2.i ILP32 false +Arrays array-examples/standard_strcmp_ground.i ILP32 true +ControlFlow openssl-simplified/s3_srvr_10.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test5.i ILP32 unknown +Loops loops-crafted-1/nested3-1_abstracted.c ILP32 true +Recursive recursified_nla-digbench/recursified_bresenham-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats floats-cdfpl/newton_3_4.i ILP32 true +ECA eca-rers2012/Problem05_label31.c ILP32 true +ProductLines product-lines/elevator_spec3_product18.cil.c ILP32 true +XCSP xcsp/Dubois-019.c ILP32 true +LinkedLists forester-heap/sll-sorted-2.i ILP32 true +Arrays array-examples/standard_two_index_04.i ILP32 true +ControlFlow openssl-simplified/s3_srvr_12.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test6_1.i ILP32 unknown +Loops loops-crafted-1/sumt8.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohencu-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +ECA eca-rers2012/Problem05_label48.c ILP32 false +ProductLines product-lines/elevator_spec3_product22.cil.c ILP32 true +XCSP xcsp/Dubois-021.c ILP32 true +LinkedLists heap-manipulation/bubble_sort_linux-1.i ILP32 true +Arrays array-examples/standard_vector_difference_ground.i ILP32 true +ControlFlow openssl-simplified/s3_srvr_14.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test8.i ILP32 unknown +Loops loops/count_up_down-2.c ILP32 false +Recursive recursified_nla-digbench/recursified_cohendiv.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.BOUNDED-12.pals.c ILP32 false +Floats floats-esbmc-regression/trunc_nondet_2.i ILP32 true +ECA eca-rers2012/Problem06_label05.c ILP32 false +ProductLines product-lines/elevator_spec3_product27.cil.c ILP32 false +XCSP xcsp/Dubois-023.c ILP32 true +LinkedLists heap-manipulation/dll_of_dll-1.i ILP32 true +Arrays array-fpi/brs4f.c ILP32 false +ControlFlow openssl-simplified/s3_srvr_2.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test9_1.i ILP32 unknown +Loops loops/matrix-2-2.c ILP32 false +Recursive recursified_nla-digbench/recursified_dijkstra.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-nonlinear/coral-benchmark21.c ILP32 false +ECA eca-rers2012/Problem06_label21.c ILP32 false +ProductLines product-lines/elevator_spec3_product31.cil.c ILP32 false +XCSP xcsp/Dubois-025.c ILP32 true +LinkedLists heap-manipulation/merge_sort-2.i ILP32 true +Arrays array-fpi/condg.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_6.cil-1.c ILP32 unknown +Heap ldv-regression/fo_test.i ILP32 false +Loops loops/sum01_bug02_sum01_bug02_base.case.i ILP32 unknown +Recursive recursified_nla-digbench/recursified_divbin2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_12_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label38.c ILP32 false +ProductLines product-lines/elevator_spec9_product11.cil.c ILP32 true +XCSP xcsp/Dubois-027.c ILP32 true +LinkedLists heap-manipulation/sll_to_dll_rev-2.i ILP32 true +Arrays array-fpi/eqn2.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_8.cil.c ILP32 unknown +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops loops/terminator_03-2_abstracted.i ILP32 true +Recursive recursified_nla-digbench/recursified_egcd.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_25_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label54.c ILP32 true +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +XCSP xcsp/Dubois-029.c ILP32 true +LinkedLists heap-manipulation/tree-2.i ILP32 false +Arrays array-fpi/eqn5f.c ILP32 false +ControlFlow openssl/s3_clnt.blast.02.i.cil-1.c ILP32 unknown +Heap ldv-regression/test14.c ILP32 true +Loops loops/vogal-1.i ILP32 true +Recursive recursified_nla-digbench/recursified_egcd2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/cartpole_37_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label11.c ILP32 false +ProductLines product-lines/elevator_spec9_product32.cil.c ILP32 false +XCSP xcsp/Dubois-035.c ILP32 true +LinkedLists list-ext3-properties/dll_nondet_free_order-1.i ILP32 unknown +Arrays array-fpi/ifeqn3f.c ILP32 false +ControlFlow openssl/s3_clnt.blast.03.i.cil-2.c ILP32 unknown +Heap ldv-regression/test21-2.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_egcd3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Floats neural-networks/cartpole_49_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label27.c ILP32 true +ProductLines product-lines/email_spec0_product10.cil.c ILP32 true +XCSP xcsp/Dubois-050.c ILP32 true +LinkedLists list-ext3-properties/sll_length_check-1.i ILP32 false +Arrays array-fpi/indp1f.c ILP32 false +ControlFlow openssl/s3_srvr.blast.01.i.cil-1.c ILP32 unknown +Heap ldv-regression/test23-2.c ILP32 true +Loops nla-digbench-scaling/cohencu-ll_valuebound10.c ILP32 true +Recursive recursified_nla-digbench/recursified_fermat1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.BOUNDED-14.pals.c ILP32 false +Floats neural-networks/cartpole_60_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label44.c ILP32 false +ProductLines product-lines/email_spec0_product21.cil.c ILP32 false +XCSP xcsp/Dubois-060.c ILP32 true +LinkedLists list-ext3-properties/sll_nondet_insert-2.i ILP32 true +Arrays array-fpi/indp5f.c ILP32 false +ControlFlow openssl/s3_srvr.blast.02.i.cil-2.c ILP32 unknown +Heap ldv-regression/test25-2.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_fermat2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.BOUNDED-16.pals.c ILP32 false +Floats neural-networks/cartpole_73_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label00.c ILP32 true +ProductLines product-lines/email_spec0_product26.cil.c ILP32 false +XCSP xcsp/Dubois-070.c ILP32 true +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Arrays array-fpi/ms1.c ILP32 true +ControlFlow openssl/s3_srvr.blast.04.i.cil.c ILP32 unknown +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/dijkstra-u_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo1-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/cartpole_85_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label17.c ILP32 true +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +XCSP xcsp/Dubois-080.c ILP32 true +LinkedLists list-properties/alternating_list-2.i ILP32 false +Arrays array-fpi/ms5.c ILP32 true +ControlFlow openssl/s3_srvr.blast.06.i.cil-2.c ILP32 unknown +Heap ldv-sets/test_mutex.i ILP32 true +Loops nla-digbench-scaling/divbin2_unwindbound100.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-u2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_97_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label33.c ILP32 true +ProductLines product-lines/email_spec0_product40.cil.c ILP32 true +XCSP xcsp/Dubois-090.c ILP32 true +LinkedLists list-properties/list_flag-1.i ILP32 false +Arrays array-fpi/nsqmf.c ILP32 false +ControlFlow openssl/s3_srvr.blast.08.i.cil-1.c ILP32 unknown +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops nla-digbench-scaling/divbin_unwindbound1.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label50.c ILP32 false +ProductLines product-lines/email_spec11_product08.cil.c ILP32 true +XCSP xcsp/Dubois-100.c ILP32 true +LinkedLists list-properties/simple-2.i ILP32 true +Arrays array-fpi/res2f.c ILP32 false +ControlFlow openssl/s3_srvr.blast.09.i.cil-2.c ILP32 unknown +Heap list-ext-properties/960521-1_1-3.i ILP32 unknown +Loops nla-digbench-scaling/divbin_valuebound5.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_23_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label06.c ILP32 false +ProductLines product-lines/email_spec11_product20.cil.c ILP32 false +XCSP xcsp/Haystacks-07.c ILP32 true +LinkedLists list-properties/splice-2.i ILP32 true +Arrays array-fpi/s1lif.c ILP32 true +ControlFlow openssl/s3_srvr.blast.11.i.cil-1.c ILP32 unknown +Heap list-ext-properties/list-ext_flag_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo3-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_35_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label23.c ILP32 true +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +XCSP xcsp/Haystacks-10.c ILP32 true +LinkedLists memsafety-broom/dll-fst-data.i LP64 unknown +Arrays array-fpi/s32if.c ILP32 true +ControlFlow openssl/s3_srvr.blast.12.i.cil-2.c ILP32 unknown +Heap list-ext-properties/test-0158_1-2.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound10.c ILP32 true +Recursive recursified_nla-digbench/recursified_hard-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_48_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label39.c ILP32 true +ProductLines product-lines/email_spec11_product33.cil.c ILP32 false +XCSP xcsp/Haystacks-12.c ILP32 true +LinkedLists memsafety-broom/dll-lst-data.i LP64 unknown +Arrays array-fpi/s42iff.c ILP32 false +ControlFlow openssl/s3_srvr.blast.14.i.cil-1.c ILP32 unknown +Heap list-ext-properties/test-0232_1-2.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +Recursive recursified_nla-digbench/recursified_hard.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_5_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label56.c ILP32 false +ProductLines product-lines/email_spec11_product39.cil.c ILP32 true +XCSP xcsp/Haystacks-14.c ILP32 true +LinkedLists memsafety-broom/dll-middle-shared.i LP64 unknown +Arrays array-fpi/s4liff_overflow.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.15.i.cil-2.c ILP32 unknown +Heap list-ext2-properties/simple_and_skiplist_2lvl-2.i ILP32 true +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_knuth.i ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_72_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label13.c ILP32 true +ProductLines product-lines/email_spec1_product14.cil.c ILP32 false +XCSP xcsp/Haystacks-16.c ILP32 true +LinkedLists memsafety-broom/linux-hlist-lst-data.i LP64 unknown +Arrays array-fpi/s5iff.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/bilinear_interpolation.i ILP32 true +Heap memsafety-cve/NanoNNG.i ILP32 unknown +Loops nla-digbench-scaling/fermat2-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_mannadiv.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_84_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label30.c ILP32 true +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +XCSP xcsp/Haystacks-18.c ILP32 true +LinkedLists memsafety-broom/linux-list-lst-data.i LP64 unknown +Arrays array-fpi/sina2.c ILP32 true +ControlFlow unsignedintegeroverflow-sas23/distance_through_overflow.i ILP32 true +Heap memsafety-cve/bzip3Fixed.i ILP32 unknown +Loops nla-digbench-scaling/freire1_valuebound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_prod4br.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_9_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label46.c ILP32 false +ProductLines product-lines/email_spec1_product30.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-fst-data.i LP64 unknown +Arrays array-fpi/sina5f.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/linear_interpolation_2.i ILP32 true +Heap memsafety-cve/editorconfig-core-cFixed.i ILP32 unknown +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +Recursive recursified_nla-digbench/recursified_prodbin.c ILP32 unknown +Sequentialized seq-pthread/cs_dekker.i ILP32 true +Floats neural-networks/exp_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label03.c ILP32 true +ProductLines product-lines/email_spec1_product34.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-lst-data.i LP64 unknown +Arrays array-fpi/ss2f.c ILP32 false +Heap memsafety-cve/gpac_1.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps2.c ILP32 unknown +Sequentialized seq-pthread/cs_fib-1.i ILP32 true +Floats neural-networks/gcas_6_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label19.c ILP32 true +ProductLines product-lines/email_spec27_product17.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-2.c ILP32 true +LinkedLists memsafety-broom/sll-middle-shared.i LP64 unknown +Arrays array-industry-pattern/array_monotonic.i ILP32 true +Heap memsafety-cve/gpac_16Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps3.c ILP32 unknown +Sequentialized seq-pthread/cs_fib_longer-2.i ILP32 false +Floats neural-networks/log_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label36.c ILP32 false +ProductLines product-lines/email_spec27_product24.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-4.c ILP32 true +LinkedLists memsafety-broom/sll-nested-sll-inline.i LP64 unknown +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +Heap memsafety-cve/gpac_19.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_unwindbound1.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps4.c ILP32 unknown +Sequentialized seq-pthread/cs_lazy.i ILP32 unknown +Floats neural-networks/lunarlander_0_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label52.c ILP32 true +ProductLines product-lines/email_spec27_product29.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/sll-nested-sll-twice.i LP64 unknown +Arrays array-lopstr16/single_elem_safe.i ILP32 true +Heap memsafety-cve/gpac_6.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_valuebound5.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps5.c ILP32 unknown +Sequentialized seq-pthread/cs_queue-1.i ILP32 true +Floats neural-networks/lunarlander_21_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label09.c ILP32 true +ProductLines product-lines/email_spec27_product33.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +LinkedLists memsafety-broom/sll-shared-before.i LP64 unknown +Arrays array-memsafety/array02-alloca-2.i ILP32 unknown +Heap memsafety-cve/jhead.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_unwindbound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps6.c ILP32 unknown +Sequentialized seq-pthread/cs_read_write_lock-2.i ILP32 false +Floats neural-networks/lunarlander_33_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label25.c ILP32 false +ProductLines product-lines/email_spec3_product13.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-2.c ILP32 true +LinkedLists memsafety-broom/sll-shared-sll-before.i LP64 unknown +Arrays array-memsafety/cstrchr-alloca-2.i ILP32 unknown +Heap memsafety-cve/kilo.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_sqrt1.c ILP32 unknown +Sequentialized seq-pthread/cs_stack-2.i ILP32 false +Floats neural-networks/lunarlander_45_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label42.c ILP32 false +ProductLines product-lines/email_spec3_product24.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-4.c ILP32 true +LinkedLists memsafety-broom/sll.i LP64 unknown +Arrays array-memsafety/cstrncat_unsafe.c ILP32 unknown +Heap memsafety-cve/liblouis.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_unwindbound1.c ILP32 true +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-pthread/cs_stateful-2.i ILP32 true +Floats neural-networks/lunarlander_57_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label58.c ILP32 true +ProductLines product-lines/email_spec3_product29.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +Arrays array-memsafety/diff-alloca-2.i ILP32 unknown +Heap memsafety-cve/libredwg_1.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_valuebound5.c ILP32 true +Recursive recursive-simple/id2_b5_o10.c ILP32 true +Sequentialized seq-pthread/cs_time_var_mutex.i ILP32 true +Floats neural-networks/lunarlander_69_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label15.c ILP32 true +ProductLines product-lines/email_spec3_product33.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-1.c ILP32 false +Arrays array-memsafety/mult_array_unsafe.i ILP32 unknown +Heap memsafety-cve/minizip-ng.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_valuebound2.c ILP32 true +Recursive recursive-simple/id_b3_o2-1.c ILP32 unknown +Sequentialized systemc/token_ring.01.cil-2.c ILP32 unknown +Floats neural-networks/lunarlander_81_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label31.c ILP32 true +ProductLines product-lines/email_spec4_product13.cil.c ILP32 true +XCSP xcsp/aim-100-6-0-sat-3.c ILP32 false +Arrays array-memsafety/openbsd_cstrcat-alloca-2.i ILP32 unknown +Heap memsafety-cve/mongooseFixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_valuebound10.c ILP32 true +Recursive recursive-simple/id_b3_o5-1.c ILP32 unknown +Sequentialized systemc/token_ring.02.cil-2.c ILP32 unknown +Floats neural-networks/lunarlander_92_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem13_label48.c ILP32 false +ProductLines product-lines/email_spec4_product23.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-1.c ILP32 false +Arrays array-memsafety/openbsd_cstrncpy-alloca-2.i ILP32 unknown +Heap memsafety-cve/netatalk.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound50.c ILP32 unknown +Recursive recursive-simple/id_b5_o10-1.c ILP32 unknown +Floats neural-networks/poly_1024_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label04.c ILP32 true +ProductLines product-lines/email_spec4_product28.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +Arrays array-memsafety/selectionsort-alloca-1.i ILP32 unknown +Heap memsafety-cve/openSC.i ILP32 unknown +Loops nla-digbench-scaling/knuth_unwindbound20.i ILP32 true +Recursive recursive-simple/id_o10.c ILP32 false +Floats neural-networks/poly_16_16_16_16_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label22.c ILP32 false +ProductLines product-lines/email_spec4_product32.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-1.c ILP32 true +Arrays array-multidimensional/add-2-n-u.c ILP32 true +Heap memsafety-cve/openrazerFound.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_unwindbound20.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Floats neural-networks/poly_16_16_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label39.c ILP32 false +ProductLines product-lines/email_spec4_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-3.c ILP32 true +Arrays array-multidimensional/diff-3-n-u.c ILP32 true +Heap memsafety-cve/plutovg.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_unwindbound100.c ILP32 true +Recursive recursive-simple/id_o3.c ILP32 false +Floats neural-networks/poly_32_32_32_32_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label56.c ILP32 true +ProductLines product-lines/email_spec6_product20.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +Arrays array-multidimensional/min-2-u.c ILP32 true +Heap memsafety-cve/radare2_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/mannadiv_unwindbound1.c ILP32 false +Recursive recursive-simple/sum_non_eq-1.c ILP32 unknown +Floats neural-networks/poly_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label12.c ILP32 true +ProductLines product-lines/email_spec6_product28.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-4.c ILP32 false +Arrays array-patterns/array12_pattern.c ILP32 true +Heap memsafety-cve/smartdns.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Floats neural-networks/poly_512_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label29.c ILP32 true +ProductLines product-lines/email_spec6_product32.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-unsat-2.c ILP32 true +Arrays array-patterns/array1_pattern.c ILP32 true +Heap memsafety-cve/sofia-sipFixed.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Floats neural-networks/poly_8_8_8_8_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label45.c ILP32 true +ProductLines product-lines/email_spec6_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-unsat-4.c ILP32 true +Arrays array-patterns/array25_pattern.c ILP32 true +Heap memsafety-cve/wasm-micro-runtime.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_unwindbound10.c ILP32 true +Recursive recursive/Ackermann04.c ILP32 true +Floats neural-networks/relu_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label02.c ILP32 true +ProductLines product-lines/email_spec7_product19.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-2.c ILP32 false +Arrays array-patterns/array3_pattern.c ILP32 true +Heap memsafety-cve/zephyr.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound50.c ILP32 true +Recursive recursive/Addition02.c ILP32 false +Floats neural-networks/sin_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label18.c ILP32 true +ProductLines product-lines/email_spec7_product27.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-4.c ILP32 false +Arrays array-patterns/array7_pattern.c ILP32 true +Heap memsafety-ext/skiplist_3lvl.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_valuebound20.c ILP32 true +Recursive recursive/Addition03-1.c ILP32 true +Floats neural-networks/softmax_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem17_label35.c ILP32 false +ProductLines product-lines/email_spec7_product31.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-2.c ILP32 false +Arrays array-programs/partial_mod_count_limited_1.c ILP32 true +Heap memsafety-ext2/complex_data_creation_test02-1.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_valuebound100.c ILP32 true +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Floats neural-networks/softsign_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label51.c ILP32 true +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-4.c ILP32 false +Arrays array-tiling/mbpr2.c ILP32 true +Heap memsafety-ext2/optional_data_creation_test04-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound1.c ILP32 true +Recursive recursive/EvenOdd03.c ILP32 false +Floats neural-networks/softsign_w32_r1_case_0_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label08.c ILP32 false +ProductLines product-lines/email_spec8_product16.cil.c ILP32 false +Arrays array-tiling/nr4.c ILP32 true +Heap memsafety-ext3/realloc1.c ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +Recursive recursive/Fibonacci01-1.c ILP32 true +Floats neural-networks/softsign_w4_r3_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label24.c ILP32 true +ProductLines product-lines/email_spec8_product26.cil.c ILP32 false +Arrays array-tiling/pr2.c ILP32 true +Heap memsafety/global-atexit-5.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_unwindbound2.c ILP32 true +Recursive recursive/Fibonacci04-overflow.c ILP32 unknown +Floats neural-networks/softsign_w8_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label41.c ILP32 true +ProductLines product-lines/email_spec8_product31.cil.c ILP32 false +Arrays array-tiling/rewnifrev2.c ILP32 true +Heap memsafety/lockfree-3.2.i ILP32 unknown +Loops nla-digbench/bresenham.c ILP32 unknown +Recursive recursive/Fibonacci05-overflow.c ILP32 unknown +Floats neural-networks/tanh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label57.c ILP32 false +ProductLines product-lines/email_spec8_product35.cil.c ILP32 false +Arrays reducercommutativity/avg10-2.i ILP32 true +Heap memsafety/test-0137.i ILP32 unknown +Loops nla-digbench/egcd2.c ILP32 unknown +Recursive recursive/McCarthy91-1.c ILP32 false +Floats neural-networks/tanh_w16_r3_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label14.c ILP32 false +ProductLines product-lines/email_spec9_product15.cil.c ILP32 false +Arrays reducercommutativity/max40-1.i ILP32 true +Heap memsafety/test-0232-2.i ILP32 unknown +Loops nla-digbench/geo2-ll.c ILP32 true +Recursive recursive/MultCommutative-2.c ILP32 true +Floats neural-networks/tanh_w4_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label30.c ILP32 true +ProductLines product-lines/email_spec9_product22.cil.c ILP32 false +Arrays reducercommutativity/sep.i ILP32 true +Heap memsafety/test-0235-2.i ILP32 unknown +Loops nla-digbench/lcm2.c ILP32 true +Recursive recursive/gcd02.c ILP32 true +Floats neural-networks/tanh_w64_r4_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label47.c ILP32 false +ProductLines product-lines/email_spec9_product30.cil.c ILP32 false +Arrays reducercommutativity/sum10-1.i ILP32 true +Heap memsafety/test-0504.i ILP32 unknown +Loops nla-digbench/ps5-ll.c ILP32 true +Recursive recursive/recHanoi02-2.c ILP32 true +Floats neural-networks/vdp_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2018/Problem14.c ILP32 false +ProductLines product-lines/email_spec9_product34.cil.c ILP32 false +Arrays array-cav19/array_init_nondet_vars.c ILP32 true +Heap heap-data/calendar.i ILP32 true +Loops loop-acceleration/array_2-1.i ILP32 false +Recursive recursified_nla-digbench/recursified_cohencu.c ILP32 unknown +Floats float-benchs/cast_float_ptr.c ILP32 false +ECA eca-programs/Problem101_label03.c ILP32 false +ProductLines product-lines/elevator_spec14_product03.cil.c ILP32 true +Arrays array-cav19/array_init_var_plus_ind2.c ILP32 true +Heap heap-data/hash_fun.i ILP32 true +Loops loop-acceleration/diamond_1-2.c ILP32 false +Recursive recursified_nla-digbench/recursified_lcm1.c ILP32 unknown +Floats float-benchs/divmul_diverge.c ILP32 true +ECA eca-programs/Problem101_label11.c ILP32 false +ProductLines product-lines/elevator_spec14_product19.cil.c ILP32 true +Arrays array-cav19/array_tiling_tcpy.c ILP32 true +Heap heap-data/process_queue.i ILP32 true +Loops loop-acceleration/simple_2-2.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Floats float-benchs/filter2.c ILP32 true +ECA eca-programs/Problem101_label19.c ILP32 false +ProductLines product-lines/elevator_spec14_product23.cil.c ILP32 true +Arrays array-crafted/bAnd4.i ILP32 true +Heap heap-data/running_example.i ILP32 true +Loops loop-crafted/simple_array_index_value_4.i.v+nlh-reducer.c ILP32 true +Recursive recursive/recHanoi03-2.c ILP32 true +Floats float-benchs/image_filter.c ILP32 true +ECA eca-programs/Problem102_label03.c ILP32 true +ProductLines product-lines/elevator_spec14_product27.cil.c ILP32 true +Arrays array-crafted/bor2.i ILP32 true +Heap heap-data/shared_mem2.i ILP32 true +Loops loop-industry-pattern/mod3.c.v+lhb-reducer.c ILP32 true +Floats float-benchs/interpolation2.c.v+nlh-reducer.c ILP32 true +ECA eca-programs/Problem102_label12.c ILP32 true +ProductLines product-lines/elevator_spec14_product31.cil.c ILP32 true +Arrays array-crafted/mapavg1.i ILP32 true +Heap ldv-memsafety/memleaks_test1-2.i ILP32 unknown +Loops loop-invariants/linear-inequality-inv-c.c ILP32 true +Floats float-benchs/inv_sqrt_Quake.c ILP32 true +ECA eca-programs/Problem102_label20.c ILP32 true +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +Arrays array-crafted/mapavg5.i ILP32 true +Heap ldv-memsafety/memleaks_test10-1.i ILP32 unknown +Loops loop-invgen/apache-escape-absolute.i ILP32 true +Floats float-benchs/nan_float.c ILP32 false +ECA eca-programs/Problem102_label28.c ILP32 false +ProductLines product-lines/elevator_spec1_product03.cil.c ILP32 true +Arrays array-crafted/mapsum4.i ILP32 true +Heap ldv-memsafety/memleaks_test11.i ILP32 unknown +Loops loop-invgen/apache-get-tag.i ILP32 true +Floats float-benchs/sin_interpolated_bigrange_loose.c ILP32 true +ECA eca-programs/Problem102_label36.c ILP32 true +ProductLines product-lines/elevator_spec1_product11.cil.c ILP32 true +Arrays array-crafted/xor2.i ILP32 true +Heap ldv-memsafety/memleaks_test12-1.i ILP32 unknown +Loops loop-invgen/id_build.i.p+sep-reducer.c ILP32 true +Floats float-benchs/sqrt_Householder_interval.c ILP32 true +ECA eca-programs/Problem102_label45.c ILP32 true +ProductLines product-lines/elevator_spec1_product18.cil.c ILP32 false +Arrays array-crafted/zero_sum1.c ILP32 true +Heap ldv-memsafety/memleaks_test13.i ILP32 unknown +Loops loop-invgen/nested6.i ILP32 true +Floats float-benchs/zonotope_3.c.p+cfa-reducer.c ILP32 true +ECA eca-programs/Problem102_label53.c ILP32 true +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +Arrays array-crafted/zero_sum5.c ILP32 true +Heap ldv-memsafety/memleaks_test13_2.i ILP32 unknown +Loops loop-lit/bhmr2007.i ILP32 true +Floats float-newlib/double_req_bl_0320.c ILP32 true +ECA eca-programs/Problem103_label35.c ILP32 false +ProductLines product-lines/elevator_spec1_product22.cil.c ILP32 false +Arrays array-crafted/zero_sum_const4.c ILP32 true +Heap ldv-memsafety/memleaks_test14_1.i ILP32 unknown +Loops loop-lit/gcnr2008.i ILP32 unknown +Floats float-newlib/double_req_bl_0662a.c ILP32 true +ECA eca-programs/Problem103_label47.c ILP32 false +ProductLines product-lines/elevator_spec1_product24.cil.c ILP32 false +Arrays array-crafted/zero_sum_const_m4.c ILP32 true +Heap ldv-memsafety/memleaks_test15-1.i ILP32 unknown +Loops loop-lit/gsv2008.c.i.p+cfa-reducer.c ILP32 true +Floats float-newlib/double_req_bl_0683a.c ILP32 true +ECA eca-programs/Problem103_label56.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +Arrays array-crafted/zero_sum_m4.c ILP32 true +Heap ldv-memsafety/memleaks_test16.i ILP32 unknown +Loops loop-lit/jm2006.i ILP32 true +Floats float-newlib/double_req_bl_0870b.c ILP32 true +ECA eca-rers2012/Problem03_label04.c ILP32 true +ProductLines product-lines/elevator_spec1_product28.cil.c ILP32 false +Arrays array-examples/data_structures_set_multi_proc_trivial_ground.i ILP32 true +Heap ldv-memsafety/memleaks_test16_2.i ILP32 unknown +Loops loop-new/count_by_k.i ILP32 true +Floats float-newlib/double_req_bl_0920a.c ILP32 true +ECA eca-rers2012/Problem03_label12.c ILP32 true +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +Arrays array-examples/sanfoundry_02_ground.i ILP32 true +Heap ldv-memsafety/memleaks_test17_1-2.i ILP32 unknown +Loops loop-new/half.i ILP32 true +Floats float-newlib/double_req_bl_1131a.c ILP32 true +ECA eca-rers2012/Problem03_label20.c ILP32 true +ProductLines product-lines/elevator_spec1_product32.cil.c ILP32 false +Arrays array-examples/sanfoundry_24-2.i ILP32 unknown +Heap ldv-memsafety/memleaks_test17_3.i ILP32 unknown +Loops loop-simple/nested_4.c ILP32 true +Floats float-newlib/float_req_bl_0281.c ILP32 true +ECA eca-rers2012/Problem03_label29.c ILP32 true +ProductLines product-lines/elevator_spec2_product03.cil.c ILP32 true +Arrays array-examples/sorting_bubblesort_ground-1.i ILP32 true +Heap ldv-memsafety/memleaks_test18_1.i ILP32 unknown +Loops loop-zilu/benchmark03_linear.i ILP32 unknown +Floats float-newlib/float_req_bl_0662a.c ILP32 true +ECA eca-rers2012/Problem03_label37.c ILP32 false +ProductLines product-lines/elevator_spec2_product11.cil.c ILP32 true +Arrays array-examples/sorting_selectionsort_ground-2.i ILP32 true +Heap ldv-memsafety/memleaks_test18_3.i ILP32 unknown +Loops loop-zilu/benchmark09_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0683a.c ILP32 true +ECA eca-rers2012/Problem03_label45.c ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +Arrays array-examples/standard_copy1_ground-1.i ILP32 true +Heap ldv-memsafety/memleaks_test19-2.i ILP32 unknown +Loops loop-zilu/benchmark14_linear.i ILP32 true +Floats float-newlib/float_req_bl_0870b.c ILP32 true +ECA eca-rers2012/Problem03_label53.c ILP32 true +ProductLines product-lines/elevator_spec2_product20.cil.c ILP32 false +Arrays array-examples/standard_copy2_ground-2.i ILP32 true +Heap ldv-memsafety/memleaks_test20-2.i ILP32 unknown +Loops loop-zilu/benchmark20_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0880.c ILP32 true +ECA eca-rers2012/Problem04_label02.c ILP32 true +ProductLines product-lines/elevator_spec2_product22.cil.c ILP32 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Heap ldv-memsafety/memleaks_test21-2.i ILP32 unknown +Loops loop-zilu/benchmark25_linear_abstracted.i ILP32 true +Floats float-newlib/float_req_bl_1121b.c ILP32 true +ECA eca-rers2012/Problem04_label10.c ILP32 true +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +Arrays array-examples/standard_copy6_ground-2.i ILP32 true +Heap ldv-memsafety/memleaks_test22_1-2.i ILP32 unknown +Loops loop-zilu/benchmark30_conjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_1211a.c ILP32 true +ECA eca-rers2012/Problem04_label25.c ILP32 true +ProductLines product-lines/elevator_spec2_product26.cil.c ILP32 false +Arrays array-examples/standard_copy8_ground-2.i ILP32 false +Heap ldv-memsafety/memleaks_test22_2-2.i ILP32 unknown +Loops loop-zilu/benchmark36_conjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_1270d.c ILP32 true +ECA eca-rers2012/Problem04_label35.c ILP32 false +ProductLines product-lines/elevator_spec2_product28.cil.c ILP32 false +Arrays array-examples/standard_copyInitSum_ground.i ILP32 true +Heap ldv-memsafety/memleaks_test22_4.i ILP32 unknown +Loops loop-zilu/benchmark42_conjunctive.i ILP32 unknown +Floats floats-cbmc-regression/float-rounding1.i ILP32 true +ECA eca-rers2012/Problem04_label52.c ILP32 false +ProductLines product-lines/elevator_spec2_product30.cil.c ILP32 false +Arrays array-examples/standard_minInArray_ground-1.i ILP32 false +Heap ldv-memsafety/memleaks_test23_1.i ILP32 unknown +Loops loop-zilu/benchmark47_linear.i ILP32 unknown +Floats floats-cbmc-regression/float3.c ILP32 true +ECA eca-rers2012/Problem05_label02.c ILP32 true +ProductLines product-lines/elevator_spec2_product32.cil.c ILP32 false +Arrays array-examples/standard_partition_ground-1.i ILP32 false +Heap ldv-memsafety/memleaks_test23_3.i ILP32 unknown +Loops loop-zilu/benchmark53_polynomial.i ILP32 unknown +Floats floats-cdfpl/newton_1_3.i ILP32 true +ECA eca-rers2012/Problem05_label10.c ILP32 true +ProductLines product-lines/elevator_spec3_product01.cil.c ILP32 true +Arrays array-examples/standard_reverse_ground.i ILP32 true +Heap ldv-memsafety/memleaks_test3-1.i ILP32 unknown +Loops loops-crafted-1/in-de41.c ILP32 true +Floats floats-cdfpl/newton_2_2.i ILP32 true +ECA eca-rers2012/Problem05_label18.c ILP32 false +ProductLines product-lines/elevator_spec3_product09.cil.c ILP32 true +Arrays array-examples/standard_sentinel-2.i ILP32 true +Heap ldv-memsafety/memleaks_test4-2.i ILP32 unknown +Loops loops-crafted-1/loopv1.c ILP32 true +Floats floats-cdfpl/newton_3_1.i ILP32 true +ECA eca-rers2012/Problem05_label27.c ILP32 true +ProductLines product-lines/elevator_spec3_product17.cil.c ILP32 true +Arrays array-examples/standard_strcpy_ground-2.i ILP32 unknown +Heap ldv-memsafety/memleaks_test5_1.i ILP32 unknown +Loops loops-crafted-1/sum_by_3.c ILP32 true +Floats floats-cdfpl/newton_3_7.i ILP32 false +ECA eca-rers2012/Problem05_label35.c ILP32 true +ProductLines product-lines/elevator_spec3_product19.cil.c ILP32 false +Arrays array-examples/standard_two_index_02.i ILP32 true +Heap ldv-memsafety/memleaks_test6.i ILP32 unknown +Loops loops-crafted-1/sumt5.c ILP32 true +Floats floats-cdfpl/sine_6.i ILP32 true +ECA eca-rers2012/Problem05_label44.c ILP32 false +ProductLines product-lines/elevator_spec3_product21.cil.c ILP32 true +Arrays array-examples/standard_two_index_06.i ILP32 true +Heap ldv-memsafety/memleaks_test6_2.i ILP32 unknown +Loops loops-crafted-1/vnew1.c ILP32 true +Floats floats-cdfpl/square_5.i ILP32 true +ECA eca-rers2012/Problem05_label52.c ILP32 true +ProductLines product-lines/elevator_spec3_product23.cil.c ILP32 false +Arrays array-examples/standard_two_index_09.i ILP32 true +Heap ldv-memsafety/memleaks_test7-2.i ILP32 unknown +Loops loops/bubble_sort-2.i ILP32 false +Floats floats-esbmc-regression/fmod3.i ILP32 true +ECA eca-rers2012/Problem06_label01.c ILP32 false +ProductLines product-lines/elevator_spec3_product26.cil.c ILP32 true +Arrays array-fpi/brs1f.c ILP32 false +Heap ldv-memsafety/memleaks_test8_1.i ILP32 unknown +Loops loops/insertion_sort-1.c ILP32 unknown +Floats floats-nonlinear/bound-unconstrained.c ILP32 true +ECA eca-rers2012/Problem06_label09.c ILP32 false +ProductLines product-lines/elevator_spec3_product28.cil.c ILP32 false +Arrays array-fpi/brs3f.c ILP32 false +Heap ldv-memsafety/memleaks_test9.i ILP32 unknown +Loops loops/linear_sea.ch.c ILP32 true +Floats floats-nonlinear/coral-benchmark09.c ILP32 false +ECA eca-rers2012/Problem06_label17.c ILP32 true +ProductLines product-lines/elevator_spec3_product30.cil.c ILP32 true +Arrays array-fpi/brs5_overflow.c ILP32 unknown +Heap ldv-memsafety/memleaks_test9_2.i ILP32 unknown +Loops loops/n.c40.c ILP32 true +Floats loop-floats-scientific-comp/loop1-1.c ILP32 true +ECA eca-rers2012/Problem06_label25.c ILP32 true +ProductLines product-lines/elevator_spec3_product32.cil.c ILP32 false +Arrays array-fpi/conda.c ILP32 true +Heap ldv-regression/alias_of_return_2.i ILP32 true +Loops loops/sum01-1.i ILP32 unknown +Floats neural-networks/cartpole_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label34.c ILP32 true +ProductLines product-lines/elevator_spec9_product09.cil.c ILP32 true +Arrays array-fpi/condm.c ILP32 true +Heap ldv-regression/rule57_ebda_blast.c_1.i ILP32 true +Loops loops/sum_array-2-1.i ILP32 unknown +Floats neural-networks/cartpole_15_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label42.c ILP32 true +ProductLines product-lines/elevator_spec9_product25.cil.c ILP32 true +Arrays array-fpi/eqn1.c ILP32 true +Heap ldv-regression/rule57_ebda_blast_2.i ILP32 false +Loops loops/terminator_02-2_abstracted.c ILP32 true +Floats neural-networks/cartpole_21_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label50.c ILP32 true +ProductLines product-lines/elevator_spec9_product27.cil.c ILP32 true +Arrays array-fpi/eqn3.c ILP32 true +Heap ldv-regression/rule60_list2.i ILP32 true +Loops loops/trex02-1.c ILP32 true +Floats neural-networks/cartpole_28_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label58.c ILP32 false +ProductLines product-lines/elevator_spec9_product29.cil.c ILP32 true +Arrays array-fpi/eqn4f.c ILP32 false +Heap ldv-regression/test11.c ILP32 true +Loops loops/veris.c_OpenSER_cases1_stripFullBoth_arr.i ILP32 true +Floats neural-networks/cartpole_34_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label07.c ILP32 false +ProductLines product-lines/elevator_spec9_product31.cil.c ILP32 true +Arrays array-fpi/ifcompf.c ILP32 false +Heap ldv-regression/test15.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound10.c ILP32 false +Floats neural-networks/cartpole_3_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label15.c ILP32 false +ProductLines product-lines/elevator_spec9_productSimulator.cil.c ILP32 false +Arrays array-fpi/ifeqn2f.c ILP32 false +Heap ldv-regression/test21-1.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_valuebound1.c ILP32 true +Floats neural-networks/cartpole_46_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label23.c ILP32 false +ProductLines product-lines/email_spec0_product09.cil.c ILP32 true +Arrays array-fpi/ifeqn4f.c ILP32 false +Heap ldv-regression/test22-1.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_valuebound50.c ILP32 true +Floats neural-networks/cartpole_51_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label31.c ILP32 false +ProductLines product-lines/email_spec0_product11.cil.c ILP32 true +Arrays array-fpi/ifncompf.c ILP32 false +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound5.c ILP32 false +Floats neural-networks/cartpole_58_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label40.c ILP32 false +ProductLines product-lines/email_spec0_product19.cil.c ILP32 true +Arrays array-fpi/indp2f.c ILP32 false +Heap ldv-regression/test24-1.c ILP32 true +Loops nla-digbench-scaling/cohencu-ll_valuebound20.c ILP32 true +Floats neural-networks/cartpole_63_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label48.c ILP32 false +ProductLines product-lines/email_spec0_product22.cil.c ILP32 false +Arrays array-fpi/indp4f.c ILP32 false +Heap ldv-regression/test25-1.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound2.c ILP32 true +Floats neural-networks/cartpole_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label56.c ILP32 true +ProductLines product-lines/email_spec0_product25.cil.c ILP32 true +Arrays array-fpi/modnf.c ILP32 false +Heap ldv-regression/test27-1.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_valuebound100.c ILP32 true +Floats neural-networks/cartpole_76_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label04.c ILP32 false +ProductLines product-lines/email_spec0_product27.cil.c ILP32 true +Arrays array-fpi/mods.c ILP32 true +Heap ldv-regression/test28-2.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_unwindbound10.c ILP32 false +Floats neural-networks/cartpole_82_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label13.c ILP32 false +ProductLines product-lines/email_spec0_product34.cil.c ILP32 false +Arrays array-fpi/ms2.c ILP32 true +Heap ldv-regression/test29-2.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_valuebound1.c ILP32 true +Floats neural-networks/cartpole_88_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label21.c ILP32 true +ProductLines product-lines/email_spec0_product36.cil.c ILP32 true +Arrays array-fpi/ms4.c ILP32 true +Heap ldv-sets/test_add-2.i ILP32 true +Loops nla-digbench-scaling/dijkstra-u_valuebound50.c ILP32 true +Floats neural-networks/cartpole_94_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label29.c ILP32 false +ProductLines product-lines/email_spec0_product38.cil.c ILP32 true +Arrays array-fpi/ncomp.c ILP32 true +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/divbin2_unwindbound5.i ILP32 true +Floats neural-networks/cartpole_9_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label37.c ILP32 false +ProductLines product-lines/email_spec0_productSimulator.cil.c ILP32 false +Arrays array-fpi/nsqm-iff.c ILP32 false +Heap ldv-sets/test_mutex_unbounded-1.i ILP32 true +Loops nla-digbench-scaling/divbin2_valuebound20.i ILP32 true +Floats neural-networks/cos_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label46.c ILP32 false +ProductLines product-lines/email_spec11_product07.cil.c ILP32 true +Arrays array-fpi/pcompf.c ILP32 false +Heap ldv-sets/test_mutex_unlock_at_exit.i ILP32 false +Loops nla-digbench-scaling/divbin_unwindbound2.i ILP32 true +Floats neural-networks/dubinsrejoin_13_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label54.c ILP32 true +ProductLines product-lines/email_spec11_product10.cil.c ILP32 true +Arrays array-fpi/res1of.c ILP32 false +Heap list-ext-properties/960521-1_1-2.i ILP32 unknown +Loops nla-digbench-scaling/divbin_valuebound100.i ILP32 true +Floats neural-networks/dubinsrejoin_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label02.c ILP32 false +ProductLines product-lines/email_spec11_product18.cil.c ILP32 true +Arrays array-fpi/res2of.c ILP32 false +Heap list-ext-properties/list-ext.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +Floats neural-networks/dubinsrejoin_26_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label10.c ILP32 false +ProductLines product-lines/email_spec11_product22.cil.c ILP32 false +Arrays array-fpi/s1if.c ILP32 true +Heap list-ext-properties/list-ext_flag.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_valuebound1.c ILP32 true +Floats neural-networks/dubinsrejoin_32_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label19.c ILP32 false +ProductLines product-lines/email_spec11_product24.cil.c ILP32 true +Arrays array-fpi/s22if.c ILP32 true +Heap list-ext-properties/simple-ext.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_valuebound50.c ILP32 true +Floats neural-networks/dubinsrejoin_38_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label27.c ILP32 true +ProductLines product-lines/email_spec11_product27.cil.c ILP32 true +Arrays array-fpi/s2lif.c ILP32 true +Heap list-ext-properties/test-0158_1-1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +Floats neural-networks/dubinsrejoin_44_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label35.c ILP32 false +ProductLines product-lines/email_spec11_product32.cil.c ILP32 false +Arrays array-fpi/s3if.c ILP32 true +Heap list-ext-properties/test-0158_1-3.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound20.c ILP32 true +Floats neural-networks/dubinsrejoin_50_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label43.c ILP32 true +ProductLines product-lines/email_spec11_product35.cil.c ILP32 false +Arrays array-fpi/s42if.c ILP32 true +Heap list-ext-properties/test-0232_1-1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +Floats neural-networks/dubinsrejoin_57_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label52.c ILP32 true +ProductLines product-lines/email_spec11_product37.cil.c ILP32 true +Arrays array-fpi/s4if.c ILP32 true +Heap list-ext-properties/test-0504_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_valuebound100.c ILP32 true +Floats neural-networks/dubinsrejoin_62_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label00.c ILP32 true +ProductLines product-lines/email_spec11_product40.cil.c ILP32 true +Arrays array-fpi/s4lif_overflow.c ILP32 unknown +Heap list-ext2-properties/simple_and_skiplist_2lvl-1.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +Floats neural-networks/dubinsrejoin_69_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label09.c ILP32 true +ProductLines product-lines/email_spec1_product12.cil.c ILP32 true +Arrays array-fpi/s52if_overflow.c ILP32 unknown +Heap list-ext2-properties/simple_search_value-1.i ILP32 true +Loops nla-digbench-scaling/fermat1-ll_valuebound1.c ILP32 true +Floats neural-networks/dubinsrejoin_75_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label17.c ILP32 true +ProductLines product-lines/email_spec1_product15.cil.c ILP32 false +Arrays array-fpi/s5if.c ILP32 true +Heap memsafety-cve/MojoJson.i ILP32 unknown +Loops nla-digbench-scaling/fermat1-ll_valuebound50.c ILP32 true +Floats neural-networks/dubinsrejoin_81_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label26.c ILP32 false +ProductLines product-lines/email_spec1_product21.cil.c ILP32 false +Arrays array-fpi/s5lif.c ILP32 true +Heap memsafety-cve/NanoNNGFixed.i ILP32 unknown +Loops nla-digbench-scaling/fermat2-ll_unwindbound5.c ILP32 false +Floats neural-networks/dubinsrejoin_87_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label34.c ILP32 true +ProductLines product-lines/email_spec1_product26.cil.c ILP32 false +Arrays array-fpi/sina1.c ILP32 true +Heap memsafety-cve/bzip3.i ILP32 unknown +Loops nla-digbench-scaling/fermat2-ll_valuebound20.c ILP32 true +Floats neural-networks/dubinsrejoin_93_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label42.c ILP32 false +ProductLines product-lines/email_spec1_product29.cil.c ILP32 false +Arrays array-fpi/sina3.c ILP32 true +Heap memsafety-cve/cups.i ILP32 unknown +Loops nla-digbench-scaling/freire1_valuebound2.c ILP32 true +Floats neural-networks/elu_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label50.c ILP32 false +ProductLines product-lines/email_spec1_product31.cil.c ILP32 false +Arrays array-fpi/sina4f.c ILP32 false +Heap memsafety-cve/editorconfig-core-c.i ILP32 unknown +Loops nla-digbench-scaling/freire2_valuebound100.c ILP32 false +Floats neural-networks/erf_4_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label59.c ILP32 true +ProductLines product-lines/email_spec1_product33.cil.c ILP32 false +Arrays array-fpi/sqm-iff.c ILP32 false +Heap memsafety-cve/frr.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll2_unwindbound10.c ILP32 unknown +Floats neural-networks/exp_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label07.c ILP32 true +ProductLines product-lines/email_spec1_product35.cil.c ILP32 false +Arrays array-fpi/ss1f.c ILP32 false +Heap memsafety-cve/gpac.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll2_valuebound100.c ILP32 unknown +Floats neural-networks/gcas_2_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label15.c ILP32 false +ProductLines product-lines/email_spec27_product13.cil.c ILP32 true +Arrays array-fpi/ss3f.c ILP32 false +Heap memsafety-cve/gpac_10.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound2.c ILP32 true +Floats neural-networks/gcas_9_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label23.c ILP32 true +ProductLines product-lines/email_spec27_product18.cil.c ILP32 false +Arrays array-fpi/ssina.c ILP32 true +Heap memsafety-cve/gpac_16.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_valuebound100.c ILP32 true +Floats neural-networks/log_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label32.c ILP32 true +ProductLines product-lines/email_spec27_product23.cil.c ILP32 false +Arrays array-industry-pattern/array_of_struct_break.i ILP32 true +Heap memsafety-cve/gpac_16Found.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u2_unwindbound10.c ILP32 unknown +Floats neural-networks/log_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label40.c ILP32 true +ProductLines product-lines/email_spec27_product25.cil.c ILP32 false +Arrays array-industry-pattern/array_of_struct_single_elem_init.i ILP32 true +Heap memsafety-cve/gpac_18.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u2_valuebound100.c ILP32 unknown +Floats neural-networks/logistic_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label48.c ILP32 true +ProductLines product-lines/email_spec27_product28.cil.c ILP32 true +Arrays array-industry-pattern/array_single_elem_init.i ILP32 false +Heap memsafety-cve/gpac_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_unwindbound2.c ILP32 false +Floats neural-networks/lunarlander_12_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label56.c ILP32 true +ProductLines product-lines/email_spec27_product30.cil.c ILP32 false +Arrays array-lopstr16/flag_loopdep_simple.i ILP32 true +Heap memsafety-cve/gpac_5Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_valuebound100.c ILP32 false +Floats neural-networks/lunarlander_19_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem12_label05.c ILP32 true +ProductLines product-lines/email_spec27_product32.cil.c ILP32 false +Arrays array-memsafety-realloc/array-realloc-1.i ILP32 unknown +Heap memsafety-cve/gpac_8.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll2_unwindbound10.c ILP32 unknown +Floats neural-networks/lunarlander_24_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label13.c ILP32 false +ProductLines product-lines/email_spec27_product34.cil.c ILP32 false +Arrays array-memsafety/add_last_unsafe.i ILP32 unknown +Heap memsafety-cve/hyperkit_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll2_valuebound100.c ILP32 unknown +Floats neural-networks/lunarlander_2_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label21.c ILP32 false +ProductLines product-lines/email_spec27_productSimulator.cil.c ILP32 false +Arrays array-memsafety/bubblesort-alloca-2.i ILP32 unknown +Heap memsafety-cve/jhead_1.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_unwindbound2.c ILP32 true +Floats neural-networks/lunarlander_36_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label29.c ILP32 true +ProductLines product-lines/email_spec3_product17.cil.c ILP32 false +Arrays array-memsafety/count_down_unsafe.i ILP32 unknown +Heap memsafety-cve/json-parserFixed.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_valuebound100.c ILP32 true +Floats neural-networks/lunarlander_42_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label38.c ILP32 false +ProductLines product-lines/email_spec3_product23.cil.c ILP32 false +Arrays array-memsafety/cstrcmp-alloca-2.i ILP32 unknown +Heap memsafety-cve/krb5.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll2_unwindbound10.c ILP32 unknown +Floats neural-networks/lunarlander_48_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label46.c ILP32 true +ProductLines product-lines/email_spec3_product25.cil.c ILP32 false +Arrays array-memsafety/cstrlen_unsafe.i ILP32 unknown +Heap memsafety-cve/libeconf.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll2_valuebound100.c ILP32 unknown +Floats neural-networks/lunarlander_54_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem12_label54.c ILP32 true +ProductLines product-lines/email_spec3_product28.cil.c ILP32 false +Arrays array-memsafety/cstrncpy-alloca-2.i ILP32 unknown +Heap memsafety-cve/libming_1.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_unwindbound2.c ILP32 true +Floats neural-networks/lunarlander_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label02.c ILP32 true +ProductLines product-lines/email_spec3_product30.cil.c ILP32 false +Arrays array-memsafety/cstrpbrk_unsafe.i ILP32 unknown +Heap memsafety-cve/libredwg.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_valuebound100.c ILP32 true +Floats neural-networks/lunarlander_66_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label11.c ILP32 false +ProductLines product-lines/email_spec3_product32.cil.c ILP32 false +Arrays array-memsafety/insertionsort-alloca-1.i ILP32 unknown +Heap memsafety-cve/libredwg_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_unwindbound10.c ILP32 false +Floats neural-networks/lunarlander_71_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label19.c ILP32 false +ProductLines product-lines/email_spec3_product34.cil.c ILP32 false +Arrays array-memsafety/lis_unsafe.i ILP32 unknown +Heap memsafety-cve/memcached.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_valuebound1.c ILP32 true +Floats neural-networks/lunarlander_78_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem13_label27.c ILP32 true +ProductLines product-lines/email_spec3_productSimulator.cil.c ILP32 false +Arrays array-memsafety/openbsd_cmemchr-alloca-2.i ILP32 unknown +Heap memsafety-cve/minizip-ngFixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_valuebound50.c ILP32 true +Floats neural-networks/lunarlander_84_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label35.c ILP32 false +ProductLines product-lines/email_spec4_product17.cil.c ILP32 true +Arrays array-memsafety/openbsd_cstpcpy-alloca-1.i ILP32 unknown +Heap memsafety-cve/mongoose.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_unwindbound5.c ILP32 false +Floats neural-networks/lunarlander_90_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem13_label44.c ILP32 false +ProductLines product-lines/email_spec4_product19.cil.c ILP32 false +Arrays array-memsafety/openbsd_cstrcpy-alloca-2.i ILP32 unknown +Heap memsafety-cve/moonlight-common-c.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_valuebound20.c ILP32 true +Floats neural-networks/lunarlander_95_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label52.c ILP32 true +ProductLines product-lines/email_spec4_product24.cil.c ILP32 false +Arrays array-memsafety/openbsd_cstrncat-alloca-2.i ILP32 unknown +Heap memsafety-cve/nanopb.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound2.c ILP32 false +Floats neural-networks/poly_1024_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label00.c ILP32 false +ProductLines product-lines/email_spec4_product27.cil.c ILP32 false +Arrays array-memsafety/openbsd_cstrpbrk-alloca-2.i ILP32 unknown +Heap memsafety-cve/netatalkFixed.i ILP32 unknown +Loops nla-digbench-scaling/hard2_valuebound100.c ILP32 true +Floats neural-networks/poly_128_128_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label08.c ILP32 true +ProductLines product-lines/email_spec4_product29.cil.c ILP32 true +Arrays array-memsafety/reverse_array_alloca_unsafe.i ILP32 unknown +Heap memsafety-cve/openNDS_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/knuth_unwindbound10.i ILP32 true +Floats neural-networks/poly_128_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label17.c ILP32 true +ProductLines product-lines/email_spec4_product31.cil.c ILP32 false +Arrays array-memsafety/stroeder1-alloca-1.i ILP32 unknown +Heap memsafety-cve/openSCFixed.i ILP32 unknown +Loops nla-digbench-scaling/knuth_valuebound10.i ILP32 true +Floats neural-networks/poly_16_16_16_16_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label26.c ILP32 true +ProductLines product-lines/email_spec4_product33.cil.c ILP32 false +Arrays array-memsafety/subseq-alloca-2.i ILP32 unknown +Heap memsafety-cve/openrazerFixed.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_unwindbound10.c ILP32 false +Floats neural-networks/poly_16_16_16_thresh_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label35.c ILP32 true +ProductLines product-lines/email_spec4_product35.cil.c ILP32 false +Arrays array-multidimensional/copy-2-u.c ILP32 true +Heap memsafety-cve/pacparser.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_valuebound1.c ILP32 true +Floats neural-networks/poly_16_16_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label43.c ILP32 true +ProductLines product-lines/email_spec6_product12.cil.c ILP32 false +Arrays array-multidimensional/copy-partial-3-u.c ILP32 true +Heap memsafety-cve/picotcpFixed.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_valuebound50.c ILP32 true +Floats neural-networks/poly_32_32_32_32_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label52.c ILP32 true +ProductLines product-lines/email_spec6_product16.cil.c ILP32 false +Arrays array-multidimensional/init-3-u.c ILP32 true +Heap memsafety-cve/ppp.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_unwindbound5.c ILP32 true +Floats neural-networks/poly_32_32_32_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label00.c ILP32 false +ProductLines product-lines/email_spec6_product21.cil.c ILP32 false +Arrays array-multidimensional/max-2-u.c ILP32 true +Heap memsafety-cve/radare2_1.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_valuebound20.c ILP32 true +Floats neural-networks/poly_32_32_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label08.c ILP32 false +ProductLines product-lines/email_spec6_product26.cil.c ILP32 false +Arrays array-multidimensional/rev-2-n-u.c ILP32 true +Heap memsafety-cve/radare2_2.i ILP32 unknown +Loops nla-digbench-scaling/mannadiv_unwindbound2.c ILP32 false +Floats neural-networks/poly_4_4_4_4_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label16.c ILP32 true +ProductLines product-lines/email_spec6_product29.cil.c ILP32 false +Arrays array-patterns/array10_pattern.c ILP32 true +Heap memsafety-cve/rizin.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_unwindbound100.c ILP32 false +Floats neural-networks/poly_512_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label25.c ILP32 true +ProductLines product-lines/email_spec6_product31.cil.c ILP32 false +Arrays array-patterns/array14_pattern.c ILP32 true +Heap memsafety-cve/sniproxy.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_valuebound10.c ILP32 true +Floats neural-networks/poly_64_64_64_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label33.c ILP32 false +ProductLines product-lines/email_spec6_product33.cil.c ILP32 false +Arrays array-patterns/array18_pattern.c ILP32 true +Heap memsafety-cve/sofia-sip.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_unwindbound1.c ILP32 false +Floats neural-networks/poly_64_64_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label41.c ILP32 false +ProductLines product-lines/email_spec6_product35.cil.c ILP32 false +Arrays array-patterns/array20_pattern.c ILP32 true +Heap memsafety-cve/sofia-sip_1.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_unwindbound50.c ILP32 true +Floats neural-networks/poly_8_8_8_8_thresh_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label49.c ILP32 true +ProductLines product-lines/email_spec7_product13.cil.c ILP32 true +Arrays array-patterns/array23_pattern.c ILP32 true +Heap memsafety-cve/stb_1.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_valuebound5.c ILP32 true +Floats neural-networks/poly_8_8_8_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label58.c ILP32 true +ProductLines product-lines/email_spec7_product18.cil.c ILP32 true +Arrays array-patterns/array27_pattern.c ILP32 true +Heap memsafety-cve/wasm-micro-runtimeFixed.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_unwindbound20.c ILP32 true +Floats neural-networks/robot_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem17_label06.c ILP32 true +ProductLines product-lines/email_spec7_product23.cil.c ILP32 true +Arrays array-patterns/array2_pattern_buggy.c ILP32 false +Heap memsafety-cve/zchunkFixed.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound2.c ILP32 true +Floats neural-networks/robot_8_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label14.c ILP32 true +ProductLines product-lines/email_spec7_product25.cil.c ILP32 true +Arrays array-patterns/array4_pattern.c ILP32 true +Heap memsafety-cve/zstd.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_unwindbound100.c ILP32 true +Floats neural-networks/sin_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem17_label22.c ILP32 true +ProductLines product-lines/email_spec7_product28.cil.c ILP32 false +Arrays array-patterns/array6_pattern.c ILP32 true +Heap memsafety-ext/skiplist_2lvl.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_valuebound10.c ILP32 true +Floats neural-networks/softmax_13_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem17_label31.c ILP32 false +ProductLines product-lines/email_spec7_product30.cil.c ILP32 false +Arrays array-patterns/array8_pattern.c ILP32 true +Heap memsafety-ext/tree_of_cslls.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_unwindbound1.c ILP32 false +Floats neural-networks/softmax_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label39.c ILP32 true +ProductLines product-lines/email_spec7_product32.cil.c ILP32 false +Arrays array-programs/copysome2-1.i ILP32 true +Heap memsafety-ext2/complex_data_creation_test01-2.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_unwindbound50.c ILP32 false +Floats neural-networks/softplus_3_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label47.c ILP32 true +ProductLines product-lines/email_spec7_product34.cil.c ILP32 false +Arrays array-programs/partial_mod_count_limited_3.c ILP32 true +Heap memsafety-ext2/complex_data_creation_test02-2.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_valuebound5.c ILP32 true +Floats neural-networks/softsign_4_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label55.c ILP32 false +ProductLines product-lines/email_spec7_productSimulator.cil.c ILP32 false +Arrays array-programs/partial_mod_count_limited_base.c ILP32 true +Heap memsafety-ext2/optional_data_creation_test04-1.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_unwindbound20.c ILP32 false +Floats neural-networks/softsign_w16_r3_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label04.c ILP32 true +ProductLines product-lines/email_spec8_product15.cil.c ILP32 false +Arrays array-tiling/mbpr4.c ILP32 true +Heap memsafety-ext2/split_list_test05-1.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound2.c ILP32 true +Floats neural-networks/softsign_w32_r2_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label12.c ILP32 false +ProductLines product-lines/email_spec8_product20.cil.c ILP32 false +Arrays array-tiling/nr2.c ILP32 true +Heap memsafety-ext3/freeAlloca.c ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_unwindbound100.c ILP32 false +Floats neural-networks/softsign_w4_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label20.c ILP32 false +ProductLines product-lines/email_spec8_product22.cil.c ILP32 false +Arrays array-tiling/pnr2.c ILP32 true +Heap memsafety-ext3/scopes2.c ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_valuebound10.c ILP32 true +Floats neural-networks/softsign_w64_r1_case_0_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label28.c ILP32 true +ProductLines product-lines/email_spec8_product28.cil.c ILP32 true +Arrays array-tiling/poly1.c ILP32 true +Heap memsafety/global-atexit-3.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_unwindbound1.c ILP32 true +Floats neural-networks/softsign_w64_r4_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label37.c ILP32 true +ProductLines product-lines/email_spec8_product30.cil.c ILP32 false +Arrays array-tiling/pr4.c ILP32 true +Heap memsafety/global-atexit.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_unwindbound50.c ILP32 true +Floats neural-networks/softsign_w8_r3_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label45.c ILP32 false +ProductLines product-lines/email_spec8_product32.cil.c ILP32 false +Arrays array-tiling/rewnif.c ILP32 true +Heap memsafety/lockfree-3.1.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_valuebound5.c ILP32 true +Floats neural-networks/sqrt_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label53.c ILP32 true +ProductLines product-lines/email_spec8_product34.cil.c ILP32 false +Arrays array-tiling/skipped.c ILP32 true +Heap memsafety/lockfree-3.3.i ILP32 unknown +Loops nla-digbench/cohendiv-ll.c ILP32 true +Floats neural-networks/tanh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label01.c ILP32 true +ProductLines product-lines/email_spec8_productSimulator.cil.c ILP32 false +Arrays reducercommutativity/avg.i ILP32 unknown +Heap memsafety/test-0134.i ILP32 unknown +Loops nla-digbench/egcd-ll.c ILP32 true +Floats neural-networks/tanh_w16_r1_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label10.c ILP32 false +ProductLines product-lines/email_spec9_product14.cil.c ILP32 true +Arrays reducercommutativity/avg40-2.i ILP32 true +Heap memsafety/test-0219.i ILP32 unknown +Loops nla-digbench/fermat1-ll.c ILP32 true +Floats neural-networks/tanh_w16_r4_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label18.c ILP32 false +ProductLines product-lines/email_spec9_product16.cil.c ILP32 false +Arrays reducercommutativity/max10-1.i ILP32 true +Heap memsafety/test-0232-1.i ILP32 unknown +Loops nla-digbench/geo1-u.c ILP32 false +Floats neural-networks/tanh_w32_r4_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label26.c ILP32 false +ProductLines product-lines/email_spec9_product21.cil.c ILP32 false +Arrays reducercommutativity/rangesum.i ILP32 false +Heap memsafety/test-0232-3.i ILP32 unknown +Loops nla-digbench/geo3-ll.c ILP32 true +Floats neural-networks/tanh_w4_r3_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem19_label34.c ILP32 true +ProductLines product-lines/email_spec9_product26.cil.c ILP32 false +Arrays reducercommutativity/rangesum40.i ILP32 false +Heap memsafety/test-0235-1.i ILP32 unknown +Loops nla-digbench/hard2.c ILP32 unknown +Floats neural-networks/tanh_w64_r3_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label43.c ILP32 false +ProductLines product-lines/email_spec9_product29.cil.c ILP32 true +Arrays reducercommutativity/sep10-2.i ILP32 true +Heap memsafety/test-0235-3.i ILP32 unknown +Loops nla-digbench/prod4br.c ILP32 unknown +Floats neural-networks/tanh_w8_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label51.c ILP32 false +ProductLines product-lines/email_spec9_product31.cil.c ILP32 false +Arrays reducercommutativity/sum.i ILP32 unknown +Heap memsafety/test-0237.i ILP32 unknown +Loops nla-digbench/ps3.c ILP32 unknown +Floats neural-networks/vdp_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2018/Problem10.c ILP32 false +ProductLines product-lines/email_spec9_product33.cil.c ILP32 false +Arrays reducercommutativity/sum40-2.i ILP32 true +Heap memsafety/test-0513.i ILP32 unknown +Loops nla-digbench/ps6.c ILP32 unknown +Floats neural-networks/vdp_6_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2018/Problem18.c ILP32 false +ProductLines product-lines/email_spec9_product35.cil.c ILP32 false +Arrays array-cav19/array_init_pair_symmetr.c ILP32 true +Heap ldv-memsafety/memleaks_test11_1.i ILP32 unknown +Loops loop-acceleration/array3.i ILP32 unknown +Floats float-benchs/arctan_Pade.c ILP32 true +ECA eca-programs/Problem101_label01.c ILP32 false +ProductLines product-lines/elevator_spec1_productSimulator.cil.c ILP32 false +Arrays array-cav19/array_init_var_plus_ind.c ILP32 true +Heap ldv-memsafety/memleaks_test14_2.i ILP32 unknown +Loops loop-acceleration/array_2-2.i ILP32 true +Floats float-benchs/cast_float_union.c ILP32 true +ECA eca-programs/Problem101_label05.c ILP32 false +ProductLines product-lines/elevator_spec3_product24.cil.c ILP32 false +Arrays array-cav19/array_init_var_plus_ind3.c ILP32 true +Heap ldv-memsafety/memleaks_test17_2-1.i ILP32 unknown +Loops loop-acceleration/array_4.i ILP32 true +Floats float-benchs/cos_polynomial.c ILP32 true +ECA eca-programs/Problem101_label09.c ILP32 false +ProductLines product-lines/email_spec0_product31.cil.c ILP32 false +Arrays array-cav19/array_tiling_poly6.c ILP32 true +Heap ldv-memsafety/memleaks_test22_3-1.i ILP32 unknown +Loops loop-acceleration/diamond_2-2.c ILP32 true +Floats float-benchs/feedback_diverge.c ILP32 true +ECA eca-programs/Problem101_label13.c ILP32 false +ProductLines product-lines/email_spec1_product16.cil.c ILP32 false +Arrays array-crafted/bAnd1.i ILP32 true +Heap ldv-memsafety/memleaks_test3-2.i ILP32 unknown +Loops loop-acceleration/simple_2-1.c ILP32 true +Floats float-benchs/filter1.c.v+nlh-reducer.c ILP32 true +ECA eca-programs/Problem101_label17.c ILP32 false +ProductLines product-lines/email_spec3_product18.cil.c ILP32 false +Arrays array-crafted/bAnd3.i ILP32 true +Heap ldv-memsafety/memleaks_test6_3.i ILP32 unknown +Loops loop-acceleration/simple_3-1.c ILP32 false +Floats float-benchs/filter2_alt.c ILP32 true +ECA eca-programs/Problem101_label21.c ILP32 false +ProductLines product-lines/email_spec6_product14.cil.c ILP32 false +Arrays array-crafted/bAnd5.i ILP32 true +Heap ldv-regression/sizeofparameters_test.c ILP32 true +Loops loop-crafted/simple_array_index_value_2.i ILP32 true +Floats float-benchs/filter_iir.c ILP32 true +ECA eca-programs/Problem102_label01.c ILP32 false +ProductLines product-lines/email_spec8_product12.cil.c ILP32 true +Arrays array-crafted/bor3.i ILP32 true +Heap ldv-regression/test22-2.c ILP32 unknown +Loops loop-crafted/simple_array_index_value_4.i ILP32 true +Floats float-benchs/interpolation.c.v+cfa-reducer.c ILP32 true +ECA eca-programs/Problem102_label05.c ILP32 false +ProductLines product-lines/email_spec9_productSimulator.cil.c ILP32 false +Arrays array-crafted/bor5.i ILP32 true +Heap ldv-regression/test27-2.c ILP32 unknown +Loops loop-industry-pattern/aiob_3.c ILP32 true +Floats float-benchs/interpolation2.c.p+cfa-reducer.c ILP32 true +ECA eca-programs/Problem102_label10.c ILP32 false +Arrays array-crafted/mapavg2.i ILP32 true +Heap list-ext-properties/list-ext_1.i ILP32 unknown +Loops loop-industry-pattern/mod3.c.v+sep-reducer.c ILP32 true +Floats float-benchs/interpolation2.c ILP32 true +ECA eca-programs/Problem102_label14.c ILP32 true +Arrays array-crafted/mapavg4.i ILP32 true +Heap list-ext-properties/test-0214_1.i ILP32 unknown +Loops loop-invariants/linear-inequality-inv-a.c ILP32 true +Floats float-benchs/inv_Newton.c.p+cfa-reducer.c ILP32 false +ECA eca-programs/Problem102_label18.c ILP32 true +Arrays array-crafted/mapsum1.i ILP32 true +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops loop-invariants64/linear-inequality-inv-d.c LP64 true +Floats float-benchs/inv_square-2.c ILP32 true +ECA eca-programs/Problem102_label22.c ILP32 true +Arrays array-crafted/mapsum3.i ILP32 true +Heap memsafety-cve/gpac_11.i ILP32 unknown +Loops loop-invgen/SpamAssassin-loop.i.v+cfa-reducer.c ILP32 true +Floats float-benchs/nan_double.c ILP32 false +ECA eca-programs/Problem102_label26.c ILP32 false +Arrays array-crafted/mapsum5.i ILP32 true +Heap memsafety-cve/gpac_3.i ILP32 unknown +Loops loop-invgen/apache-get-tag.i.p+lhb-reducer.c ILP32 true +Floats float-benchs/rlim_exit.c ILP32 true +ECA eca-programs/Problem102_label30.c ILP32 true +Arrays array-crafted/xor3.i ILP32 true +Heap memsafety-cve/jq.i ILP32 unknown +Loops loop-invgen/apache-get-tag.i.v+lhb-reducer.c ILP32 true +Floats float-benchs/rlim_invariant.c.v+nlh-reducer.c ILP32 true +ECA eca-programs/Problem102_label34.c ILP32 false +Arrays array-crafted/xor5.i ILP32 true +Heap memsafety-cve/minizip-ng_1.i ILP32 unknown +Loops loop-invgen/down.i ILP32 true +Floats float-benchs/sin_interpolated_index-1.c ILP32 false +ECA eca-programs/Problem102_label38.c ILP32 true +Arrays array-crafted/zero_sum2.c ILP32 true +Heap memsafety-cve/netconsd.i ILP32 unknown +Loops loop-invgen/heapsort.i ILP32 true +Floats float-benchs/sin_interpolated_smallrange.c ILP32 true +ECA eca-programs/Problem102_label43.c ILP32 false +Arrays array-crafted/zero_sum4.c ILP32 true +Heap memsafety-cve/pacparserFixed.i ILP32 unknown +Loops loop-invgen/id_build.i.v+lhb-reducer.c ILP32 true +Floats float-benchs/sqrt_Householder_pseudoconstant.c ILP32 true +ECA eca-programs/Problem102_label47.c ILP32 true +Arrays array-crafted/zero_sum_const1.c ILP32 true +Heap memsafety-cve/sofia-sip_2.i ILP32 unknown +Loops loop-invgen/large_const.i ILP32 true +Floats float-benchs/sqrt_poly.c ILP32 true +ECA eca-programs/Problem102_label51.c ILP32 false +Arrays array-crafted/zero_sum_const3.c ILP32 true +Heap memsafety-cve/zstdFixed.i ILP32 unknown +Loops loop-invgen/nested9.i ILP32 true +Floats float-benchs/zonotope_3.c ILP32 true +ECA eca-programs/Problem102_label55.c ILP32 false +Arrays array-crafted/zero_sum_const5.c ILP32 true +Heap memsafety-ext2/length_test03-1.i ILP32 unknown +Loops loop-invgen/up.i ILP32 true +Floats float-benchs/zonotope_tight.c ILP32 true +ECA eca-programs/Problem102_label59.c ILP32 false +Arrays array-crafted/zero_sum_const_m3.c ILP32 true +Heap memsafety/global-atexit-1.i ILP32 unknown +Loops loop-lit/cggmp2005.i ILP32 true +Floats float-newlib/double_req_bl_0460.c ILP32 true +ECA eca-programs/Problem103_label41.c ILP32 false +Arrays array-crafted/zero_sum_const_m5.c ILP32 true +Heap memsafety/test-0102-1.i ILP32 unknown +Loops loop-lit/css2003.i ILP32 true +Floats float-newlib/double_req_bl_0661a.c ILP32 true +ECA eca-programs/Problem103_label45.c ILP32 true +Arrays array-crafted/zero_sum_m3.c ILP32 true +Heap memsafety/test-0234-1.i ILP32 unknown +Loops loop-lit/gj2007.c.i.p+lhb-reducer.c ILP32 true +Floats float-newlib/double_req_bl_0663a.c ILP32 true +ECA eca-programs/Problem103_label49.c ILP32 true +Arrays array-crafted/zero_sum_m5.c ILP32 true +Heap memsafety/test-0521.i ILP32 unknown +Loops loop-lit/gj2007b.i ILP32 true +Floats float-newlib/double_req_bl_0682a.c ILP32 true +ECA eca-programs/Problem103_label54.c ILP32 false +Arrays array-examples/data_structures_set_multi_proc_ground-2.i ILP32 true +Loops loop-lit/gsv2008.c.i.v+cfa-reducer.c ILP32 true +Floats float-newlib/double_req_bl_0683b.c ILP32 true +ECA eca-programs/Problem103_label58.c ILP32 true +Arrays array-examples/relax-1.i ILP32 unknown +Loops loop-lit/hhk2008.i ILP32 true +Floats float-newlib/double_req_bl_0832.c ILP32 true +ECA eca-rers2012/Problem03_label02.c ILP32 true +Arrays array-examples/relax-2.i ILP32 unknown +Loops loop-lit/jm2006_variant.i ILP32 true +Floats float-newlib/double_req_bl_0872b.c ILP32 true +ECA eca-rers2012/Problem03_label06.c ILP32 true +Arrays array-examples/sanfoundry_10_ground.c ILP32 true +Loops loop-new/count_by_1_variant.i ILP32 true +Floats float-newlib/double_req_bl_0882.c ILP32 true +ECA eca-rers2012/Problem03_label10.c ILP32 true +Arrays array-examples/sanfoundry_27_ground.i ILP32 true +Loops loop-new/count_by_nondet.i ILP32 true +Floats float-newlib/double_req_bl_1121a.c ILP32 true +ECA eca-rers2012/Problem03_label14.c ILP32 true +Arrays array-examples/sorting_bubblesort_2_ground.i ILP32 false +Loops loop-new/gauss_sum.i.v+cfa-reducer.c ILP32 true +Floats float-newlib/double_req_bl_1122b.c ILP32 true +ECA eca-rers2012/Problem03_label18.c ILP32 true +Arrays array-examples/sorting_bubblesort_ground-2.i ILP32 false +Loops loop-new/nested-1.i ILP32 true +Floats float-newlib/double_req_bl_1211a.c ILP32 true +ECA eca-rers2012/Problem03_label22.c ILP32 true +Arrays array-examples/sorting_selectionsort_ground-1.i ILP32 false +Loops loop-simple/nested_2.c ILP32 true +Floats float-newlib/double_req_bl_1251b.c ILP32 true +ECA eca-rers2012/Problem03_label27.c ILP32 false +Arrays array-examples/standard_allDiff2_ground.i ILP32 false +Loops loop-simple/nested_5.c ILP32 true +Floats float-newlib/float_req_bl_0460.c ILP32 true +ECA eca-rers2012/Problem03_label31.c ILP32 false +Arrays array-examples/standard_compare_ground.i ILP32 true +Loops loop-zilu/benchmark02_linear.i ILP32 true +Floats float-newlib/float_req_bl_0661a.c ILP32 true +ECA eca-rers2012/Problem03_label35.c ILP32 false +Arrays array-examples/standard_copy1_ground-2.i ILP32 false +Loops loop-zilu/benchmark04_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0663a.c ILP32 true +ECA eca-rers2012/Problem03_label39.c ILP32 false +Arrays array-examples/standard_copy3_ground-1.i ILP32 true +Loops loop-zilu/benchmark07_linear.i ILP32 unknown +Floats float-newlib/float_req_bl_0682a.c ILP32 true +ECA eca-rers2012/Problem03_label43.c ILP32 false +Arrays array-examples/standard_copy4_ground-1.i ILP32 true +Loops loop-zilu/benchmark10_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0683b.c ILP32 true +ECA eca-rers2012/Problem03_label47.c ILP32 true +Arrays array-examples/standard_copy5_ground-1.i ILP32 true +Loops loop-zilu/benchmark12_linear.i ILP32 unknown +Floats float-newlib/float_req_bl_0710.c ILP32 true +ECA eca-rers2012/Problem03_label51.c ILP32 true +Arrays array-examples/standard_copy6_ground-1.i ILP32 false +Loops loop-zilu/benchmark15_conjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_0872b.c ILP32 true +ECA eca-rers2012/Problem03_label55.c ILP32 true +Arrays array-examples/standard_copy7_ground-1.i ILP32 false +Loops loop-zilu/benchmark18_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0876.c ILP32 true +ECA eca-rers2012/Problem04_label00.c ILP32 true +Arrays array-examples/standard_copy8_ground-1.i ILP32 true +Loops loop-zilu/benchmark21_disjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_0881.c ILP32 true +ECA eca-rers2012/Problem04_label04.c ILP32 false +Arrays array-examples/standard_copy9_ground-1.i ILP32 false +Loops loop-zilu/benchmark24_conjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_0970a.c ILP32 true +ECA eca-rers2012/Problem04_label08.c ILP32 true +Arrays array-examples/standard_find_ground-1.i ILP32 true +Loops loop-zilu/benchmark26_linear.i ILP32 true +Floats float-newlib/float_req_bl_1122b.c ILP32 true +ECA eca-rers2012/Problem04_label15.c ILP32 false +Arrays array-examples/standard_maxInArray_ground.i ILP32 true +Loops loop-zilu/benchmark28_linear.i ILP32 unknown +Floats float-newlib/float_req_bl_1131a.c ILP32 true +ECA eca-rers2012/Problem04_label21.c ILP32 true +Arrays array-examples/standard_minInArray_ground-2.i ILP32 true +Loops loop-zilu/benchmark31_disjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_1231.c ILP32 true +ECA eca-rers2012/Problem04_label28.c ILP32 true +Arrays array-examples/standard_partial_init_ground.i ILP32 true +Loops loop-zilu/benchmark34_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_1270b.c ILP32 true +ECA eca-rers2012/Problem04_label33.c ILP32 true +Arrays array-examples/standard_partition_ground-2.i ILP32 true +Loops loop-zilu/benchmark37_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_1271b.c ILP32 true +ECA eca-rers2012/Problem04_label39.c ILP32 false +Arrays array-examples/standard_password_ground.i ILP32 true +Loops loop-zilu/benchmark40_polynomial.i ILP32 unknown +Floats floats-cbmc-regression/float-no-simp2.i ILP32 true +ECA eca-rers2012/Problem04_label50.c ILP32 true +Arrays array-examples/standard_running-1.i ILP32 false +Loops loop-zilu/benchmark43_conjunctive.i ILP32 true +Floats floats-cbmc-regression/float-to-double1.i ILP32 true +ECA eca-rers2012/Problem04_label54.c ILP32 true +Arrays array-examples/standard_sentinel-1.i ILP32 unknown +Loops loop-zilu/benchmark45_disjunctive.i ILP32 unknown +Floats floats-cbmc-regression/float20.i ILP32 true +ECA eca-rers2012/Problem05_label00.c ILP32 false +Arrays array-examples/standard_sentinel.i.v+cfa-reducer.c ILP32 true +Loops loop-zilu/benchmark48_linear.i ILP32 unknown +Floats floats-cbmc-regression/float5.c ILP32 true +ECA eca-rers2012/Problem05_label04.c ILP32 true +Arrays array-examples/standard_strcpy_ground-1.i ILP32 true +Loops loop-zilu/benchmark51_polynomial.i ILP32 true +Floats floats-cdfpl/newton_1_1.i ILP32 true +ECA eca-rers2012/Problem05_label08.c ILP32 true +Arrays array-examples/standard_strcpy_original-1.i ILP32 unknown +Loops loops-crafted-1/discover_list.c ILP32 true +Floats floats-cdfpl/newton_1_5.i ILP32 false +ECA eca-rers2012/Problem05_label12.c ILP32 true +Arrays array-examples/standard_two_index_01.i ILP32 true +Loops loops-crafted-1/in-de31.c ILP32 true +Floats floats-cdfpl/newton_1_8.i ILP32 false +ECA eca-rers2012/Problem05_label16.c ILP32 true +Arrays array-examples/standard_two_index_03.i ILP32 true +Loops loops-crafted-1/in-de42.c ILP32 true +Floats floats-cdfpl/newton_2_4.i ILP32 true +ECA eca-rers2012/Problem05_label20.c ILP32 true +Arrays array-examples/standard_two_index_05.i ILP32 true +Loops loops-crafted-1/in-de61.c ILP32 true +Floats floats-cdfpl/newton_2_7.i ILP32 false +ECA eca-rers2012/Problem05_label25.c ILP32 true +Arrays array-examples/standard_two_index_07.i ILP32 true +Loops loops-crafted-1/loopv2.c ILP32 true +Floats floats-cdfpl/newton_3_2.i ILP32 true +ECA eca-rers2012/Problem05_label29.c ILP32 true +Arrays array-examples/standard_vararg_ground.i ILP32 true +Loops loops-crafted-1/nested_delay_nd.c ILP32 true +Floats floats-cdfpl/newton_3_5.i ILP32 true +ECA eca-rers2012/Problem05_label33.c ILP32 false +Arrays array-fpi/brs1.c ILP32 true +Loops loops-crafted-1/sum_by_3_abstracted.c ILP32 true +Floats floats-cdfpl/sine_1.i ILP32 false +ECA eca-rers2012/Problem05_label37.c ILP32 false +Arrays array-fpi/brs2.c ILP32 true +Loops loops-crafted-1/sumt3.c ILP32 true +Floats floats-cdfpl/sine_4.i ILP32 true +ECA eca-rers2012/Problem05_label42.c ILP32 true +Arrays array-fpi/brs3.c ILP32 true +Loops loops-crafted-1/sumt6.c ILP32 true +Floats floats-cdfpl/sine_8.i ILP32 true +ECA eca-rers2012/Problem05_label46.c ILP32 true +Arrays array-fpi/brs4.c ILP32 true +Loops loops-crafted-1/sumt9.c ILP32 true +Floats floats-cdfpl/square_3.i ILP32 false +ECA eca-rers2012/Problem05_label50.c ILP32 true +Arrays array-fpi/brs5.c ILP32 true +Loops loops-crafted-1/vnew2.c ILP32 true +Floats floats-cdfpl/square_7.i ILP32 true +ECA eca-rers2012/Problem05_label54.c ILP32 true +Arrays array-fpi/brs5f.c ILP32 false +Loops loops/array-2.c ILP32 false +Floats floats-esbmc-regression/floor_nondet.i ILP32 true +ECA eca-rers2012/Problem05_label59.c ILP32 true +Arrays array-fpi/condaf.c ILP32 false +Loops loops/compact.c ILP32 false +Floats floats-esbmc-regression/round_nondet.i ILP32 true +ECA eca-rers2012/Problem06_label03.c ILP32 true +Arrays array-fpi/condgf.c ILP32 false +Loops loops/for_bounded_loop1.c ILP32 false +Floats floats-nonlinear/bound-grocery.c ILP32 false +ECA eca-rers2012/Problem06_label07.c ILP32 true +Arrays array-fpi/condmf.c ILP32 false +Loops loops/insertion_sort-2-2.c ILP32 true +Floats floats-nonlinear/color-magicseries2.c ILP32 false +ECA eca-rers2012/Problem06_label11.c ILP32 false +Arrays array-fpi/condnf.c ILP32 false +Loops loops/invert_string-2.c ILP32 unknown +Floats floats-nonlinear/coral-benchmark02.c ILP32 false +ECA eca-rers2012/Problem06_label15.c ILP32 false +Arrays array-fpi/eqn1f.c ILP32 false +Loops loops/linear_search.c ILP32 false +Floats floats-nonlinear/coral-benchmark10.c ILP32 false +ECA eca-rers2012/Problem06_label19.c ILP32 true +Arrays array-fpi/eqn2f.c ILP32 false +Loops loops/matrix-2.c ILP32 unknown +Floats floats-nonlinear/coral-benchmark27.c ILP32 false +ECA eca-rers2012/Problem06_label23.c ILP32 true +Arrays array-fpi/eqn3f.c ILP32 false +Loops loops/nec20.c ILP32 false +Floats loop-floats-scientific-comp/loop2-1.c ILP32 false +ECA eca-rers2012/Problem06_label27.c ILP32 false +Arrays array-fpi/eqn5.c ILP32 true +Loops loops/string-1.i ILP32 true +Floats loop-floats-scientific-comp/loop4.i ILP32 false +ECA eca-rers2012/Problem06_label32.c ILP32 true +Arrays array-fpi/ifcomp.c ILP32 true +Loops loops/sum01-2.i ILP32 true +Floats neural-networks/cartpole_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label36.c ILP32 false +Arrays array-fpi/ifeqn1.c ILP32 true +Loops loops/sum03-1.i ILP32 false +Floats neural-networks/cartpole_13_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label40.c ILP32 true +Arrays array-fpi/ifeqn2.c ILP32 true +Loops loops/sum_array-2-2.i ILP32 true +Floats neural-networks/cartpole_17_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label44.c ILP32 false +Arrays array-fpi/ifeqn3.c ILP32 true +Loops loops/terminator_02-1.c ILP32 unknown +Floats neural-networks/cartpole_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label48.c ILP32 false +Arrays array-fpi/ifeqn4.c ILP32 true +Loops loops/terminator_03-1.c ILP32 unknown +Floats neural-networks/cartpole_23_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label52.c ILP32 true +Arrays array-fpi/ifeqn5.c ILP32 true +Loops loops/trex01-1.c ILP32 false +Floats neural-networks/cartpole_26_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label56.c ILP32 false +Arrays array-fpi/ifncomp.c ILP32 true +Loops loops/trex02-2.c ILP32 false +Floats neural-networks/cartpole_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label00.c ILP32 true +Arrays array-fpi/indp1.c ILP32 unknown +Loops loops/trex03-2_abstracted.c ILP32 true +Floats neural-networks/cartpole_32_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label05.c ILP32 false +Arrays array-fpi/indp2.c ILP32 true +Loops loops/veris.c_sendmail_tTflag_arr_one_loop.c ILP32 true +Floats neural-networks/cartpole_35_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label09.c ILP32 false +Arrays array-fpi/indp3.c ILP32 true +Loops loops/vogal-2.i ILP32 false +Floats neural-networks/cartpole_38_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label13.c ILP32 true +Arrays array-fpi/indp4.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound100.c ILP32 false +Floats neural-networks/cartpole_41_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label17.c ILP32 true +Arrays array-fpi/indp5.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound5.c ILP32 false +Floats neural-networks/cartpole_44_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem07_label21.c ILP32 true +Arrays array-fpi/modn.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_valuebound10.c ILP32 true +Floats neural-networks/cartpole_47_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label25.c ILP32 true +Arrays array-fpi/modp.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_valuebound20.c ILP32 true +Floats neural-networks/cartpole_4_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label29.c ILP32 true +Arrays array-fpi/modsf.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound1.c ILP32 false +Floats neural-networks/cartpole_53_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label33.c ILP32 true +Arrays array-fpi/ms1f.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound2.c ILP32 false +Floats neural-networks/cartpole_56_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label38.c ILP32 true +Arrays array-fpi/ms2f.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound50.c ILP32 false +Floats neural-networks/cartpole_59_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label42.c ILP32 false +Arrays array-fpi/ms3f.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_valuebound100.c ILP32 true +Floats neural-networks/cartpole_61_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label46.c ILP32 false +Arrays array-fpi/ms4f.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_valuebound5.c ILP32 true +Floats neural-networks/cartpole_65_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label50.c ILP32 true +Arrays array-fpi/ms5f.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound10.c ILP32 true +Floats neural-networks/cartpole_68_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label54.c ILP32 true +Arrays array-fpi/ncompf.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound20.c ILP32 true +Floats neural-networks/cartpole_71_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label58.c ILP32 false +Arrays array-fpi/nsqm.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_valuebound1.c ILP32 true +Floats neural-networks/cartpole_74_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label02.c ILP32 false +Arrays array-fpi/pcomp.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_valuebound2.c ILP32 true +Floats neural-networks/cartpole_78_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label06.c ILP32 false +Arrays array-fpi/res1.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_valuebound50.c ILP32 true +Floats neural-networks/cartpole_80_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label11.c ILP32 true +Arrays array-fpi/res1o.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_unwindbound100.c ILP32 false +Floats neural-networks/cartpole_83_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label15.c ILP32 false +Arrays array-fpi/res2.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_unwindbound5.c ILP32 false +Floats neural-networks/cartpole_86_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label19.c ILP32 true +Arrays array-fpi/res2o.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_valuebound10.c ILP32 true +Floats neural-networks/cartpole_8_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label23.c ILP32 true +Arrays array-fpi/s12if.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_valuebound20.c ILP32 true +Floats neural-networks/cartpole_92_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label27.c ILP32 true +Arrays array-fpi/s1iff.c ILP32 false +Loops nla-digbench-scaling/divbin2_unwindbound1.i ILP32 true +Floats neural-networks/cartpole_95_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label31.c ILP32 true +Arrays array-fpi/s1liff.c ILP32 false +Loops nla-digbench-scaling/divbin2_unwindbound2.i ILP32 true +Floats neural-networks/cartpole_98_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label35.c ILP32 true +Arrays array-fpi/s22iff.c ILP32 false +Loops nla-digbench-scaling/divbin2_unwindbound50.i ILP32 true +Floats neural-networks/cos_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label39.c ILP32 true +Arrays array-fpi/s2iff.c ILP32 false +Loops nla-digbench-scaling/divbin2_valuebound100.i ILP32 true +Floats neural-networks/cos_4_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label44.c ILP32 true +Arrays array-fpi/s2liff.c ILP32 false +Loops nla-digbench-scaling/divbin2_valuebound5.i ILP32 true +Floats neural-networks/cos_7_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label48.c ILP32 false +Arrays array-fpi/s32iff.c ILP32 false +Loops nla-digbench-scaling/divbin_unwindbound10.i ILP32 false +Floats neural-networks/dubinsrejoin_11_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label52.c ILP32 true +Arrays array-fpi/s3iff.c ILP32 false +Loops nla-digbench-scaling/divbin_unwindbound20.i ILP32 false +Floats neural-networks/dubinsrejoin_15_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label56.c ILP32 true +Arrays array-fpi/s3liff.c ILP32 false +Loops nla-digbench-scaling/divbin_valuebound1.i ILP32 true +Floats neural-networks/dubinsrejoin_18_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label00.c ILP32 true +Arrays array-fpi/s42if_overflow.c ILP32 unknown +Loops nla-digbench-scaling/divbin_valuebound2.i ILP32 true +Floats neural-networks/dubinsrejoin_21_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label04.c ILP32 true +Arrays array-fpi/s42iff_overflow.c ILP32 unknown +Loops nla-digbench-scaling/divbin_valuebound50.i ILP32 true +Floats neural-networks/dubinsrejoin_24_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label08.c ILP32 false +Arrays array-fpi/s4iff.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound100.c ILP32 false +Floats neural-networks/dubinsrejoin_28_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label12.c ILP32 true +Arrays array-fpi/s4lif.c ILP32 true +Loops nla-digbench-scaling/egcd-ll_unwindbound5.c ILP32 false +Floats neural-networks/dubinsrejoin_30_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label17.c ILP32 true +Arrays array-fpi/s4liff.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_valuebound10.c ILP32 true +Floats neural-networks/dubinsrejoin_33_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label21.c ILP32 true +Arrays array-fpi/s52if.c ILP32 true +Loops nla-digbench-scaling/egcd-ll_valuebound20.c ILP32 true +Floats neural-networks/dubinsrejoin_36_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label25.c ILP32 true +Arrays array-fpi/s52iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound1.c ILP32 false +Floats neural-networks/dubinsrejoin_3_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label29.c ILP32 true +Arrays array-fpi/s5if_overflow.c ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound2.c ILP32 false +Floats neural-networks/dubinsrejoin_42_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label33.c ILP32 true +Arrays array-fpi/s5iff_overflow.c ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound50.c ILP32 false +Floats neural-networks/dubinsrejoin_46_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label37.c ILP32 true +Arrays array-fpi/s5lif_overflow.c ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound100.c ILP32 true +Floats neural-networks/dubinsrejoin_49_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label41.c ILP32 false +Arrays array-fpi/s5liff_overflow.c ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound5.c ILP32 true +Floats neural-networks/dubinsrejoin_52_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label45.c ILP32 true +Arrays array-fpi/sina1f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound10.c ILP32 false +Floats neural-networks/dubinsrejoin_55_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label50.c ILP32 true +Arrays array-fpi/sina2f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound20.c ILP32 false +Floats neural-networks/dubinsrejoin_58_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label54.c ILP32 false +Arrays array-fpi/sina3f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_valuebound1.c ILP32 true +Floats neural-networks/dubinsrejoin_60_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label58.c ILP32 true +Arrays array-fpi/sina5.c ILP32 true +Loops nla-digbench-scaling/egcd3-ll_valuebound2.c ILP32 true +Floats neural-networks/dubinsrejoin_64_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label02.c ILP32 true +Arrays array-fpi/sqm-if.c ILP32 true +Loops nla-digbench-scaling/egcd3-ll_valuebound50.c ILP32 true +Floats neural-networks/dubinsrejoin_67_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label07.c ILP32 true +Arrays array-fpi/sqm.c ILP32 true +Loops nla-digbench-scaling/fermat1-ll_unwindbound100.c ILP32 false +Floats neural-networks/dubinsrejoin_70_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label11.c ILP32 true +Arrays array-fpi/ss1.c ILP32 true +Loops nla-digbench-scaling/fermat1-ll_unwindbound5.c ILP32 false +Floats neural-networks/dubinsrejoin_73_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label15.c ILP32 false +Arrays array-fpi/ss2.c ILP32 true +Loops nla-digbench-scaling/fermat1-ll_valuebound10.c ILP32 true +Floats neural-networks/dubinsrejoin_77_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label19.c ILP32 true +Arrays array-fpi/ss3.c ILP32 true +Loops nla-digbench-scaling/fermat1-ll_valuebound20.c ILP32 true +Floats neural-networks/dubinsrejoin_7_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label24.c ILP32 false +Arrays array-fpi/ss4.c ILP32 true +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +Floats neural-networks/dubinsrejoin_82_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label28.c ILP32 false +Arrays array-fpi/ssinaf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound2.c ILP32 false +Floats neural-networks/dubinsrejoin_85_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label32.c ILP32 true +Arrays array-industry-pattern/array_mul_init.i ILP32 true +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +Floats neural-networks/dubinsrejoin_89_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label36.c ILP32 true +Arrays array-industry-pattern/array_of_struct_ptr_cond_init.i ILP32 true +Loops nla-digbench-scaling/fermat2-ll_valuebound100.c ILP32 true +Floats neural-networks/dubinsrejoin_91_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label40.c ILP32 true +Arrays array-industry-pattern/array_of_struct_ptr_mul_init.i ILP32 true +Loops nla-digbench-scaling/fermat2-ll_valuebound5.c ILP32 true +Floats neural-networks/dubinsrejoin_94_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label44.c ILP32 true +Arrays array-industry-pattern/array_ptr_single_elem_init-1.i ILP32 true +Loops nla-digbench-scaling/freire1_valuebound10.c ILP32 true +Floats neural-networks/elu_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label48.c ILP32 false +Arrays array-industry-pattern/array_shadowinit.i ILP32 true +Loops nla-digbench-scaling/freire1_valuebound20.c ILP32 true +Floats neural-networks/elu_4_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label52.c ILP32 true +Arrays array-industry-pattern/check_removal_from_set_after_insertion.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound1.c ILP32 false +Floats neural-networks/erf_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label57.c ILP32 false +Arrays array-lopstr16/break-1.i ILP32 true +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +Floats neural-networks/erf_5_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label01.c ILP32 true +Arrays array-lopstr16/motivex.i ILP32 true +Loops nla-digbench-scaling/freire2_valuebound50.c ILP32 false +Floats neural-networks/exp_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label05.c ILP32 true +Arrays array-lopstr16/sum_multi_array.i ILP32 true +Loops nla-digbench-scaling/geo1-ll2_unwindbound100.c ILP32 unknown +Floats neural-networks/exp_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label09.c ILP32 true +Arrays array-memsafety-realloc/array-realloc-2.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll2_unwindbound5.c ILP32 unknown +Floats neural-networks/gcas_11_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label13.c ILP32 true +Arrays array-memsafety/add_last-alloca-1.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll2_valuebound20.c ILP32 unknown +Floats neural-networks/gcas_4_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label17.c ILP32 true +Arrays array-memsafety/array01-alloca-2.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound10.c ILP32 true +Floats neural-networks/gcas_7_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label21.c ILP32 true +Arrays array-memsafety/array03-alloca-2.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound20.c ILP32 true +Floats neural-networks/gelu_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label25.c ILP32 true +Arrays array-memsafety/bubblesort_unsafe.c ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_valuebound1.c ILP32 true +Floats neural-networks/gelu_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label30.c ILP32 true diff --git a/tests/testcomp/corpus/cover-branches.tsv b/tests/testcomp/corpus/cover-branches.tsv new file mode 100644 index 000000000..6d2ab1e63 --- /dev/null +++ b/tests/testcomp/corpus/cover-branches.tsv @@ -0,0 +1,1523 @@ +# category program data_model expected_unreach +Arrays array-fpi/s52iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1a.cil.c ILP32 unknown +Heap memory-alloca/c.03-alloca-2.i ILP32 unknown +Loops nla-digbench-scaling/fermat1-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_lcm2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.ufo.BOUNDED-12.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_79_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label22.c ILP32 true +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +XCSP xcsp/Haystacks-08.c ILP32 true +LinkedLists heap-manipulation/tree-3.i ILP32 true +Arrays array-examples/standard_two_index_08.i ILP32 true +BitVectors bitvector/jain_2-2.c ILP32 unknown +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +Heap ldv-memsafety/memleaks_test7-1.i ILP32 unknown +Loops loops/array-1.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohendiv-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-esbmc-regression/ceil_nondet.i ILP32 true +ECA eca-rers2012/Problem05_label57.c ILP32 false +ProductLines product-lines/elevator_spec3_product25.cil.c ILP32 true +XCSP xcsp/Dubois-017.c ILP32 true +LinkedLists forester-heap/sll-optional-1.i ILP32 true +Arrays array-multidimensional/copy-partial-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_1-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.07.i.cil-1.c ILP32 unknown +Heap memsafety-cve/picotcp.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_valuebound2.c ILP32 true +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_256_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label48.c ILP32 false +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +LinkedLists memsafety-broom/dll-lst-shared.i LP64 unknown +Arrays array-examples/sanfoundry_24-1.i ILP32 true +BitVectors bitvector/byte_add_1-2.i ILP32 unknown +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test17_2-2.i ILP32 unknown +Loops loop-simple/nested_1b.c ILP32 false +Recursive recursified_loop-crafted/recursified_simple_array_index_value_2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_1231b.c ILP32 true +ECA eca-rers2012/Problem03_label25.c ILP32 true +ProductLines product-lines/elevator_spec2_product01.cil.c ILP32 true +XCSP xcsp/AllInterval-019.c ILP32 false +LinkedLists forester-heap/dll-reverse.i ILP32 true +Arrays array-fpi/modpf.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_2.cil-2.c ILP32 unknown +Heap ldv-regression/test28-1.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/cartpole_7_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label09.c ILP32 true +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +XCSP xcsp/Dubois-040.c ILP32 true +LinkedLists forester-heap/sll-token-1.i ILP32 false +Arrays array-memsafety/count_down-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_2.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.02.i.cil-2.c ILP32 unknown +Heap memsafety-cve/json-parser.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_sqrt1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label34.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +LinkedLists list-properties/list-1.i ILP32 true +Arrays array-programs/partial_mod_count_limited_5.c ILP32 true +BitVectors bitvector/soft_float_4-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.13.i.cil-1.c ILP32 unknown +Heap memsafety-ext2/length_test03-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +Recursive recursive/EvenOdd01-1.c ILP32 true +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +Floats neural-networks/softsign_w16_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label00.c ILP32 false +ProductLines product-lines/email_spec8_product14.cil.c ILP32 true +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/sll-lst-shared.i LP64 unknown +Arrays array-crafted/xor1.i ILP32 true +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow infeasible-control-flow/unreach_branch3.c ILP32 true +Heap ldv-memsafety/memleaks_test11_2.i ILP32 unknown +Loops loop-invgen/half_2.i ILP32 true +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/sin_interpolated_negation.c ILP32 true +ECA eca-programs/Problem102_label41.c ILP32 true +ProductLines product-lines/elevator_spec1_product17.cil.c ILP32 true +XCSP xcsp/AllInterval-011.c ILP32 false +LinkedLists forester-heap/dll-optional-2.i ILP32 false +Arrays array-examples/standard_copy9_ground-2.i ILP32 true +BitVectors bitvector/gcd_2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl1.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_3-2.i ILP32 unknown +Loops loop-zilu/benchmark39_conjunctive.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cbmc-regression/float-flags-simp1.i ILP32 true +ECA eca-rers2012/Problem04_label47.c ILP32 true +ProductLines product-lines/elevator_spec2_product29.cil.c ILP32 true +XCSP xcsp/CostasArray-12.c ILP32 false +LinkedLists forester-heap/dll-token-2.i ILP32 false +Arrays array-fpi/eqn4.c ILP32 true +BitVectors bitvector/modulus-1.i ILP32 unknown +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Heap ldv-regression/test10.c ILP32 true +Loops loops/trex03-2.c ILP32 true +Recursive recursified_nla-digbench/recursified_egcd2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/cartpole_31_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label03.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +XCSP xcsp/Dubois-024.c ILP32 true +LinkedLists forester-heap/sll-rb-sentinel-1.i ILP32 true +Arrays array-fpi/s12iff.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1.cil-1.c ILP32 unknown +Heap list-ext-properties/list-ext_2.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label15.c ILP32 false +ProductLines product-lines/email_spec11_product23.cil.c ILP32 true +XCSP xcsp/Dubois-075.c ILP32 true +LinkedLists heap-manipulation/dll_of_dll-2.i ILP32 false +Arrays array-fpi/ss4f.c ILP32 false +BitVectors bitvector/s3_srvr_1.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_6.cil-2.c ILP32 unknown +Heap memsafety-cve/gpac_15.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.ufo.BOUNDED-16.pals.c ILP32 true +Floats neural-networks/gelu_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label28.c ILP32 true +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +XCSP xcsp/Haystacks-15.c ILP32 true +LinkedLists list-ext3-properties/sll_length_check-2.i ILP32 true +Arrays array-memsafety/openbsd_cmemset-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.01.i.cil-2.c ILP32 unknown +Heap memsafety-cve/minizip-ng_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_unwindbound100.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/lunarlander_88_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label40.c ILP32 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +LinkedLists list-properties/simple_built_from_end.i ILP32 true +Arrays array-patterns/array22_pattern.c ILP32 true +BitVectors bitvector/soft_float_2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.10.i.cil-1.c ILP32 unknown +Heap memsafety-cve/stb.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_valuebound100.c ILP32 true +Recursive recursive/Ackermann03.c ILP32 true +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +Floats neural-networks/poly_8_8_8_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label54.c ILP32 false +ProductLines product-lines/email_spec7_product17.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +LinkedLists memsafety-broom/linux-hlist-middle-data.i LP64 unknown +Arrays array-tiling/tcpy.c ILP32 true +BitVectors bitvector/soft_float_5.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.16.i.cil-1.c ILP32 unknown +Heap memsafety/test-0102-2.i ILP32 unknown +Loops nla-digbench/dijkstra.c ILP32 unknown +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-pthread/cs_sync.i ILP32 true +Floats neural-networks/tanh_6_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label06.c ILP32 true +ProductLines product-lines/email_spec9_product12.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-nested-sll.i LP64 unknown +Arrays array-crafted/bor1.i ILP32 true +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow infeasible-control-flow/conflict_branch3.c ILP32 true +Heap heap-data/shared_mem1.i ILP32 true +Loops loop-industry-pattern/aiob_2.c ILP32 true +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/interpolation.c ILP32 true +ECA eca-programs/Problem102_label08.c ILP32 true +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +LinkedLists forester-heap/dll-circular-1.i ILP32 false +Arrays array-crafted/zero_sum_const_m2.c ILP32 true +BitVectors bitvector/byte_add-2.i ILP32 unknown +ControlFlow memory-model/2SB.i ILP32 false +Heap ldv-memsafety/memleaks_test14_3.i ILP32 unknown +Loops loop-lit/gj2007.i ILP32 true +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/double_req_bl_0670.c ILP32 true +ECA eca-programs/Problem103_label52.c ILP32 true +ProductLines product-lines/elevator_spec1_product25.cil.c ILP32 true +XCSP xcsp/AllInterval-015.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-1.i ILP32 true +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +BitVectors bitvector/byte_add_2-2.i ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test20-1.i ILP32 unknown +Loops loop-zilu/benchmark17_conjunctive.i ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-a.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/float_req_bl_0875.c ILP32 true +ECA eca-rers2012/Problem03_label58.c ILP32 true +ProductLines product-lines/elevator_spec2_product21.cil.c ILP32 true +XCSP xcsp/AllInterval-030.c ILP32 false +LinkedLists forester-heap/dll-sorted-1.i ILP32 false +Arrays array-examples/standard_running-2.i ILP32 true +BitVectors bitvector/interleave_bits.i ILP32 true +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Heap ldv-memsafety/memleaks_test4-1.i ILP32 unknown +Loops loops-crafted-1/in-de52.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_6.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats floats-cdfpl/newton_2_6.i ILP32 false +ECA eca-rers2012/Problem05_label23.c ILP32 true +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +LinkedLists forester-heap/sll-buckets-1.i ILP32 true +Arrays array-fpi/brs5f_overflow.c ILP32 unknown +BitVectors bitvector/jain_6-2.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-3.c ILP32 true +Heap ldv-regression/alias_of_return_2.c_1.i ILP32 true +Loops loops/s3.i ILP32 unknown +Recursive recursified_nla-digbench/recursified_divbin.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats loop-floats-scientific-comp/loop3.c ILP32 true +ECA eca-rers2012/Problem06_label30.c ILP32 true +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +XCSP xcsp/Dubois-020.c ILP32 true +LinkedLists forester-heap/sll-queue-2.i ILP32 false +Arrays array-fpi/ifeqn5f.c ILP32 false +BitVectors bitvector/num_conversion_2.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_1.cil-1.c ILP32 unknown +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/cohencu-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_fermat1-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/cartpole_55_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label36.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +XCSP xcsp/Dubois-028.c ILP32 true +LinkedLists forester-heap/sll-simple-white-blue-1.i ILP32 true +Arrays array-fpi/nsqm-if.c ILP32 true +BitVectors bitvector/s3_clnt_1.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-3.c ILP32 unknown +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/divbin2_valuebound10.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.ufo.BOUNDED-12.pals.c ILP32 true +Floats neural-networks/cos_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem08_label42.c ILP32 true +ProductLines product-lines/email_spec11_product03.cil.c ILP32 true +XCSP xcsp/Dubois-055.c ILP32 true +LinkedLists heap-manipulation/bubble_sort_linux-2.i ILP32 false +Arrays array-fpi/s3lif.c ILP32 true +BitVectors bitvector/s3_clnt_2.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_11.cil.c ILP32 unknown +Heap list-ext-properties/test-0217_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +Recursive recursified_nla-digbench/recursified_hard-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_54_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label48.c ILP32 true +ProductLines product-lines/email_spec11_product36.cil.c ILP32 true +XCSP xcsp/Dubois-095.c ILP32 true +LinkedLists heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Arrays array-fpi/sina4.c ILP32 true +BitVectors bitvector/s3_clnt_3.BV.c.cil-2.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_3.cil.c ILP32 unknown +Heap memsafety-cve/dlt-daemon.i ILP32 unknown +Loops nla-digbench-scaling/freire1_valuebound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_prodbin-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.ufo.BOUNDED-14.pals.c ILP32 true +Floats neural-networks/erf_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label55.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +XCSP xcsp/Haystacks-11.c ILP32 true +LinkedLists list-ext3-properties/dll_nondet_free_order-2.i ILP32 unknown +Arrays array-lopstr16/base_case.i ILP32 true +BitVectors bitvector/s3_srvr_1a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_clnt.blast.01.i.cil-1.c ILP32 unknown +Heap memsafety-cve/gpac_5.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_unwindbound50.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps5-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_16_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label01.c ILP32 true +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +XCSP xcsp/Haystacks-19.c ILP32 true +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-1.i ILP32 true +Arrays array-memsafety/cstrpbrk-alloca-2.i ILP32 unknown +BitVectors bitvector/s3_srvr_3.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.04.i.cil-1.c ILP32 unknown +Heap memsafety-cve/libpe.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_unwindbound50.c ILP32 true +Recursive recursive-simple/id2_b3_o5.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/lunarlander_63_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label07.c ILP32 false +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-3.c ILP32 true +LinkedLists list-properties/list_flag-2.i ILP32 true +Arrays array-memsafety/openbsd_cstrstr-alloca-2.i ILP32 unknown +BitVectors bitvector/soft_float_1-1.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.03.i.cil.c ILP32 unknown +Heap memsafety-cve/openNDS_1.i ILP32 unknown +Loops nla-digbench-scaling/hard2_valuebound5.c ILP32 true +Recursive recursive-simple/id_b5_o10-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/poly_128_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label13.c ILP32 true +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-3.c ILP32 true +LinkedLists memsafety-broom/dll-backwards.i LP64 unknown +Arrays array-multidimensional/transpose-u.c ILP32 true +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow openssl/s3_srvr.blast.08.i.cil-2.c ILP32 unknown +Heap memsafety-cve/radare2_2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +Recursive recursive-simple/sum_non_eq-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/poly_4_4_4_4_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label21.c ILP32 true +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/dll.i LP64 unknown +Arrays array-patterns/array5_pattern.c ILP32 true +BitVectors bitvector/soft_float_3a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.11.i.cil-2.c ILP32 unknown +Heap memsafety-ext/dll_extends_pointer.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_unwindbound5.c ILP32 true +Recursive recursive/Addition02WithOverflowBug.c ILP32 unknown +Sequentialized seq-pthread/cs_lamport.i ILP32 true +Floats neural-networks/softmax_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label27.c ILP32 true +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-2.c ILP32 true +LinkedLists memsafety-broom/linux-list-middle-data.i LP64 unknown +Arrays array-tiling/pnr4.c ILP32 true +BitVectors bitvector/soft_float_4-3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.14.i.cil-2.c ILP32 unknown +Heap memsafety/global-atexit-2.i ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_valuebound20.c ILP32 true +Recursive recursive/Fibonacci03.c ILP32 true +Sequentialized seq-pthread/cs_stack-1.i ILP32 true +Floats neural-networks/softsign_w64_r3_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label33.c ILP32 false +ProductLines product-lines/email_spec8_product29.cil.c ILP32 true +XCSP xcsp/aim-200-2-0-unsat-1.c ILP32 true +LinkedLists memsafety-broom/sll-nested-linux-list.i LP64 unknown +Arrays reducercommutativity/rangesum10.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/cancel_var_through_overflow.i ILP32 true +Heap memsafety/test-0234-2.i ILP32 unknown +Loops nla-digbench/hard-ll.c ILP32 true +Recursive recursive/gcd01-1.c ILP32 true +Sequentialized systemc/token_ring.01.cil-1.c ILP32 unknown +Floats neural-networks/tanh_w64_r1_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label39.c ILP32 true +ProductLines product-lines/email_spec9_product28.cil.c ILP32 true +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-shared-sll-after.i LP64 unknown +Arrays array-cav19/array_min_and_copy_shift_sum_add.c ILP32 true +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow infeasible-control-flow/conflict_branch1.c ILP32 true +Heap heap-data/min_max.i ILP32 true +Loops loop-acceleration/multivar_1-2.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/filter1.c.v+lhb-reducer.c ILP32 true +ECA eca-programs/Problem101_label15.c ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +LinkedLists forester-heap/dll-01-1.i ILP32 false +Arrays array-crafted/mapavg3.i ILP32 true +BitVectors bitvector/byte_add-1.i ILP32 false +ControlFlow infeasible-control-flow/unreach_branch1.c ILP32 true +Heap ldv-memsafety/memleaks_test1-3.i ILP32 unknown +Loops loop-invgen/NetBSD_loop.i ILP32 true +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/mea8000.c ILP32 true +ECA eca-programs/Problem102_label24.c ILP32 false +ProductLines product-lines/elevator_spec1_product01.cil.c ILP32 true +XCSP xcsp/AllInterval-009.c ILP32 false +LinkedLists forester-heap/dll-circular-2.i ILP32 true +Arrays array-crafted/zero_sum3.c ILP32 true +BitVectors bitvector/byte_add_1-1.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch4.c ILP32 true +Heap ldv-memsafety/memleaks_test13_1.i ILP32 unknown +Loops loop-invgen/seq-3.i ILP32 true +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/zonotope_loose.c ILP32 true +ECA eca-programs/Problem102_label57.c ILP32 true +ProductLines product-lines/elevator_spec1_product21.cil.c ILP32 true +XCSP xcsp/AllInterval-013.c ILP32 false +LinkedLists forester-heap/dll-queue-1.i ILP32 true +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +BitVectors bitvector/byte_add_2-1.i ILP32 unknown +ControlFlow memory-model/4SB.i ILP32 false +Heap ldv-memsafety/memleaks_test16_1.i ILP32 unknown +Loops loop-new/count_by_1.i ILP32 true +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_0876.c ILP32 true +ECA eca-rers2012/Problem03_label08.c ILP32 true +ProductLines product-lines/elevator_spec1_product29.cil.c ILP32 true +XCSP xcsp/AllInterval-017.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-1.i ILP32 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +BitVectors bitvector/gcd_1.c ILP32 true +ControlFlow ntdrivers-simplified/diskperf_simpl1.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test18_2.i ILP32 unknown +Loops loop-zilu/benchmark06_conjunctive.i ILP32 unknown +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+nlh-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/float_req_bl_0670.c ILP32 true +ECA eca-rers2012/Problem03_label41.c ILP32 true +ProductLines product-lines/elevator_spec2_product17.cil.c ILP32 true +XCSP xcsp/AllInterval-020.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-1.i ILP32 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +BitVectors bitvector/gcd_3.c ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl4.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_1-1.i ILP32 unknown +Loops loop-zilu/benchmark27_linear.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/float_req_bl_1130b.c ILP32 true +ECA eca-rers2012/Problem04_label18.c ILP32 false +ProductLines product-lines/elevator_spec2_product25.cil.c ILP32 true +XCSP xcsp/CostasArray-10.c ILP32 false +LinkedLists forester-heap/dll-sorted-2.i ILP32 true +Arrays array-examples/standard_palindrome_ground.i ILP32 true +BitVectors bitvector/jain_1-2.c ILP32 unknown +ControlFlow ntdrivers-simplified/kbfiltr_simpl2.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test23_2.i ILP32 unknown +Loops loop-zilu/benchmark50_linear.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_4.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cbmc-regression/float8.i ILP32 true +ECA eca-rers2012/Problem05_label06.c ILP32 true +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +LinkedLists forester-heap/sll-01-1.i ILP32 true +Arrays array-examples/standard_strcpy_original-2.i ILP32 true +BitVectors bitvector/jain_4-1.c ILP32 unknown +ControlFlow ntdrivers/cdaudio.i.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test5_2.i ILP32 unknown +Loops loops-crafted-1/sumt2.c ILP32 true +Recursive recursified_nla-digbench/recursified_bresenham.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +ECA eca-rers2012/Problem05_label40.c ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +XCSP xcsp/Dubois-015.c ILP32 true +LinkedLists forester-heap/sll-circular-1.i ILP32 true +Arrays array-fpi/brs2f.c ILP32 false +BitVectors bitvector/jain_7-1.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +Heap ldv-memsafety/memleaks_test8_2.i ILP32 unknown +Loops loops/invert_string-1.c ILP32 false +Recursive recursified_nla-digbench/recursified_dijkstra-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-nonlinear/coral-benchmark01.c ILP32 false +ECA eca-rers2012/Problem06_label13.c ILP32 true +ProductLines product-lines/elevator_spec3_product29.cil.c ILP32 true +XCSP xcsp/Dubois-018.c ILP32 true +LinkedLists forester-heap/sll-optional-2.i ILP32 false +Arrays array-fpi/condn.c ILP32 true +BitVectors bitvector/modulus-2.i ILP32 true +ControlFlow ntdrivers/floppy2.i.cil.c ILP32 unknown +Heap ldv-regression/rule57_ebda_blast.i ILP32 true +Loops loops/terminator_01.c ILP32 false +Recursive recursified_nla-digbench/recursified_egcd-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_19_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label46.c ILP32 true +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +XCSP xcsp/Dubois-022.c ILP32 true +LinkedLists forester-heap/sll-rb-cnstr_1-1.i ILP32 true +Arrays array-fpi/ifeqn1f.c ILP32 false +BitVectors bitvector/parity.i ILP32 true +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +Heap ldv-regression/test19.c ILP32 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_egcd3-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats neural-networks/cartpole_43_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label19.c ILP32 false +ProductLines product-lines/email_spec0_product05.cil.c ILP32 true +XCSP xcsp/Dubois-026.c ILP32 true +LinkedLists forester-heap/sll-rb-sentinel-2.i ILP32 false +Arrays array-fpi/indp3f.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1a.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_1.cil-2.c ILP32 unknown +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_fermat2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/cartpole_67_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label52.c ILP32 true +ProductLines product-lines/email_spec0_product24.cil.c ILP32 true +XCSP xcsp/Dubois-030.c ILP32 true +LinkedLists forester-heap/sll-sorted-1.i ILP32 false +Arrays array-fpi/ms3.c ILP32 true +BitVectors bitvector/s3_clnt_1.BV.c.cil-2a.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-1.c ILP32 unknown +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/dijkstra-u_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Floats neural-networks/cartpole_91_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label25.c ILP32 false +ProductLines product-lines/email_spec0_product37.cil.c ILP32 true +XCSP xcsp/Dubois-045.c ILP32 true +LinkedLists forester-heap/sll-token-2.i ILP32 true +Arrays array-fpi/res1f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1a.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_4.cil-1.c ILP32 unknown +Heap list-ext-properties/960521-1_1-1.i ILP32 unknown +Loops nla-digbench-scaling/divbin_unwindbound50.i ILP32 false +Recursive recursified_nla-digbench/recursified_geo2-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_17_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label58.c ILP32 true +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +XCSP xcsp/Dubois-065.c ILP32 true +LinkedLists heap-manipulation/dancing.i ILP32 true +Arrays array-fpi/s2if.c ILP32 true +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow openssl-simplified/s3_srvr_1.cil-2.c ILP32 unknown +Heap list-ext-properties/simple-ext_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_41_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label31.c ILP32 true +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +XCSP xcsp/Dubois-085.c ILP32 true +LinkedLists heap-manipulation/merge_sort-1.i ILP32 false +Arrays array-fpi/s4iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1a.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_13.cil.c ILP32 unknown +Heap list-ext-properties/test-0513_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_hard2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_66_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label05.c ILP32 true +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +XCSP xcsp/Haystacks-06.c ILP32 true +LinkedLists heap-manipulation/tree-1.i ILP32 unknown +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +ControlFlow openssl-simplified/s3_srvr_2.cil-1.c ILP32 unknown +Heap memsafety-cve/asterisk.i ILP32 unknown +Loops nla-digbench-scaling/fermat2-ll_valuebound10.c ILP32 true +Recursive recursified_nla-digbench/recursified_prod4br-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_90_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label38.c ILP32 true +ProductLines product-lines/email_spec1_product28.cil.c ILP32 true +XCSP xcsp/Haystacks-09.c ILP32 true +LinkedLists heap-manipulation/tree-4.i ILP32 false +Arrays array-fpi/sqmf.c ILP32 false +BitVectors bitvector/s3_srvr_1_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_4.cil.c ILP32 unknown +Heap memsafety-cve/frrFixed.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll2_unwindbound20.c ILP32 unknown +Recursive recursified_nla-digbench/recursified_ps2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/gcas_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label11.c ILP32 true +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +XCSP xcsp/Haystacks-13.c ILP32 true +LinkedLists list-ext3-properties/dll_nullified-1.i ILP32 false +Arrays array-industry-pattern/array_of_struct_ptr_monotonic.i ILP32 true +BitVectors bitvector/s3_srvr_1a_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_7.cil.c ILP32 unknown +Heap memsafety-cve/gpac_17.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u2_unwindbound20.c ILP32 unknown +Recursive recursified_nla-digbench/recursified_ps4-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/logistic_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label44.c ILP32 true +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +XCSP xcsp/Haystacks-17.c ILP32 true +LinkedLists list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Arrays array-memsafety-realloc/array-realloc-3.i ILP32 unknown +BitVectors bitvector/s3_srvr_2_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.01.i.cil-2.c ILP32 unknown +Heap memsafety-cve/hyperkit_1.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll2_unwindbound20.c ILP32 unknown +Recursive recursified_nla-digbench/recursified_ps6-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/lunarlander_27_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label17.c ILP32 true +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-2.c ILP32 false +LinkedLists list-properties/alternating_list-1.i ILP32 true +Arrays array-memsafety/cstrcspn-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3_alt.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.03.i.cil-1.c ILP32 unknown +Heap memsafety-cve/krb5Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll2_unwindbound20.c ILP32 unknown +Recursive recursive-simple/id2_b2_o3.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats neural-networks/lunarlander_51_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label50.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-1.c ILP32 true +LinkedLists list-properties/list-2.i ILP32 false +Arrays array-memsafety/knapsack_alloca_unsafe.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a_alt.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_clnt.blast.04.i.cil-2.c ILP32 unknown +Heap memsafety-cve/libsndfile.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_unwindbound20.c ILP32 false +Recursive recursive-simple/id_b2_o3.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/lunarlander_75_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem13_label23.c ILP32 false +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-1.c ILP32 false +LinkedLists list-properties/simple-1.i ILP32 false +Arrays array-memsafety/openbsd_cstrlcpy-alloca-1.i ILP32 unknown +BitVectors bitvector/soft_float_1-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.02.i.cil-1.c ILP32 unknown +Heap memsafety-cve/mujs.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound1.c ILP32 false +Recursive recursive-simple/id_b3_o5-2.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/lunarlander_99_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label56.c ILP32 true +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-1.c ILP32 true +LinkedLists list-properties/splice-1.i ILP32 false +Arrays array-memsafety/stroeder2-alloca-1.i ILP32 unknown +BitVectors bitvector/soft_float_1-3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.06.i.cil-1.c ILP32 unknown +Heap memsafety-cve/openrazer.i ILP32 unknown +Loops nla-digbench-scaling/knuth_valuebound5.i ILP32 true +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_16_16_16_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label31.c ILP32 true +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-1.c ILP32 false +LinkedLists memsafety-broom/dll-fst-shared.i LP64 unknown +Arrays array-multidimensional/init-non-constant-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.07.i.cil-2.c ILP32 unknown +Heap memsafety-cve/radare2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_valuebound10.c ILP32 true +Recursive recursive-simple/sum_non.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/poly_32_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label04.c ILP32 false +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +LinkedLists memsafety-broom/dll-middle-data.i LP64 unknown +Arrays array-patterns/array16_pattern.c ILP32 true +BitVectors bitvector/soft_float_3.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.09.i.cil-1.c ILP32 unknown +Heap memsafety-cve/sniproxyFixed.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_valuebound20.c ILP32 true +Recursive recursive/Ackermann01-2.c ILP32 true +Sequentialized seq-pthread/cs_dekker_unfair.i ILP32 true +Floats neural-networks/poly_64_64_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label37.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +LinkedLists memsafety-broom/linux-hlist-fst-data.i LP64 unknown +Arrays array-patterns/array29_pattern.c ILP32 true +BitVectors bitvector/soft_float_4-1.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.10.i.cil-2.c ILP32 unknown +Heap memsafety-cve/zchunk.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound1.c ILP32 true +Recursive recursive/Addition01-2.c ILP32 true +Sequentialized seq-pthread/cs_fib_longer-1.i ILP32 true +Floats neural-networks/robot_5_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label10.c ILP32 true +ProductLines product-lines/email_spec7_product24.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-4.c ILP32 false +LinkedLists memsafety-broom/linux-list-fst-data.i LP64 unknown +Arrays array-programs/copysome1-1.i ILP32 true +BitVectors bitvector/soft_float_4-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.12.i.cil-1.c ILP32 unknown +Heap memsafety-ext2/complex_data_creation_test01-1.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_unwindbound2.c ILP32 false +Recursive recursive/Addition03-2.c ILP32 unknown +Sequentialized seq-pthread/cs_peterson.i ILP32 true +Floats neural-networks/softplus_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label43.c ILP32 true +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-4.c ILP32 true +LinkedLists memsafety-broom/sll-fst-shared.i LP64 unknown +Arrays array-tiling/mlceu.c ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +ControlFlow openssl/s3_srvr.blast.13.i.cil-2.c ILP32 unknown +Heap memsafety-ext2/split_list_test05-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound50.c ILP32 true +Recursive recursive/EvenOdd03WithOverflowBug.c ILP32 unknown +Sequentialized seq-pthread/cs_read_write_lock-1.i ILP32 true +Floats neural-networks/softsign_w32_r4_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label16.c ILP32 true +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-middle-data.i LP64 unknown +Arrays array-tiling/revcpyswp2.c ILP32 true +BitVectors bitvector/soft_float_5a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.15.i.cil-1.c ILP32 unknown +Heap memsafety/lockfree-3.0.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_valuebound100.c ILP32 true +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-pthread/cs_stateful-1.i ILP32 false +Floats neural-networks/sqrt_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label49.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-unsat-3.c ILP32 true +LinkedLists memsafety-broom/sll-nested-sll-lst-data.i LP64 unknown +Arrays reducercommutativity/max.i ILP32 true +BitVectors bitvector/sum02-2.c ILP32 true +ControlFlow openssl/s3_srvr.blast.16.i.cil-2.c ILP32 unknown +Heap memsafety/test-0220.i ILP32 unknown +Loops nla-digbench/fermat2.c ILP32 unknown +Recursive recursive/McCarthy91-2.c ILP32 true +Sequentialized seq-pthread/cs_szymanski.i ILP32 true +Floats neural-networks/tanh_w32_r2_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem19_label22.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-shared-after.i LP64 unknown +Arrays reducercommutativity/sep40-1.i ILP32 true +ControlFlow unsignedintegeroverflow-sas23/linear_interpolation.i ILP32 true +Heap memsafety/test-0236.i ILP32 unknown +Loops nla-digbench/ps2-ll.c ILP32 true +Recursive recursive/recHanoi01.c ILP32 true +Sequentialized systemc/token_ring.02.cil-1.c ILP32 unknown +Floats neural-networks/tanh_w8_r4_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label56.c ILP32 true +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-shared-sll.i LP64 unknown +Arrays array-cav19/array_init_pair_symmetr2.c ILP32 true +ControlFlow infeasible-control-flow/conflict_branch2.c ILP32 true +Heap heap-data/cart.i ILP32 true +Loops loop-acceleration/array_3-2.i ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +ECA eca-programs/Problem101_label07.c ILP32 false +ProductLines product-lines/elevator_spec14_product11.cil.c ILP32 true +XCSP xcsp/AllInterval-006.c ILP32 false +LinkedLists forester-heap/dll-01-2.i ILP32 true +Arrays array-crafted/bAnd2.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch2.c ILP32 true +Heap heap-data/quick_sort_split.i ILP32 true +Loops loop-acceleration/simple_4-2_abstracted.c ILP32 true +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.ufo.BOUNDED-10.pals.c ILP32 true +Floats float-benchs/filter2_set.c ILP32 true +ECA eca-programs/Problem101_label23.c ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +LinkedLists forester-heap/dll-optional-1.i ILP32 true +Arrays array-crafted/bor4.i ILP32 true +ControlFlow infeasible-control-flow/unreach_branch5.c ILP32 true +Heap ldv-memsafety/memleaks_test1-1.i ILP32 unknown +Loops loop-industry-pattern/nested-3.c ILP32 unknown +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.ufo.BOUNDED-10.pals.c ILP32 true +Floats float-benchs/inv_Newton-2.c ILP32 false +ECA eca-programs/Problem102_label16.c ILP32 true +ProductLines product-lines/elevator_spec14_product32.cil.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +LinkedLists forester-heap/dll-queue-2.i ILP32 false +Arrays array-crafted/mapsum2.i ILP32 true +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test10-2.i ILP32 unknown +Loops loop-invgen/apache-get-tag.i.p+sep-reducer.c ILP32 true +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/rlim_invariant.c.v+lhb-reducer.c ILP32 true +ECA eca-programs/Problem102_label32.c ILP32 true +ProductLines product-lines/elevator_spec1_product09.cil.c ILP32 true +XCSP xcsp/AllInterval-012.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Arrays array-crafted/xor4.i ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test12-2.i ILP32 unknown +Loops loop-invgen/id_trans.i ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/sqrt_biNewton_pseudoconstant.c ILP32 true +ECA eca-programs/Problem102_label49.c ILP32 false +ProductLines product-lines/elevator_spec1_product19.cil.c ILP32 true +XCSP xcsp/AllInterval-014.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-2.i ILP32 true +Arrays array-crafted/zero_sum_const2.c ILP32 true +ControlFlow ntdrivers-simplified/floppy_simpl4.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test14.i ILP32 unknown +Loops loop-lit/cggmp2005b.i ILP32 true +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.ufo.BOUNDED-6.pals.c ILP32 true +Floats float-newlib/double_req_bl_0660b.c ILP32 true +ECA eca-programs/Problem103_label43.c ILP32 true +ProductLines product-lines/elevator_spec1_product23.cil.c ILP32 true +XCSP xcsp/AllInterval-016.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-2.i ILP32 true +Arrays array-crafted/zero_sum_m2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl2.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test15-2.i ILP32 unknown +Loops loop-lit/gsv2008.i ILP32 true +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/double_req_bl_0684b.c ILP32 true +ECA eca-rers2012/Problem03_label00.c ILP32 true +ProductLines product-lines/elevator_spec1_product27.cil.c ILP32 true +XCSP xcsp/AllInterval-018.c ILP32 false +LinkedLists forester-heap/dll-token-1.i ILP32 true +Arrays array-examples/relax-2-2.i ILP32 true +ControlFlow ntdrivers/diskperf.i.cil-1.c ILP32 true +Heap ldv-memsafety/memleaks_test17_1-1.i ILP32 unknown +Loops loop-new/gauss_sum.i.p+lhb-reducer.c ILP32 true +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_1122a.c ILP32 true +ECA eca-rers2012/Problem03_label16.c ILP32 true +ProductLines product-lines/elevator_spec1_product31.cil.c ILP32 true +XCSP xcsp/AllInterval-025.c ILP32 false +LinkedLists forester-heap/sll-01-2.i ILP32 false +Arrays array-examples/sanfoundry_43_ground.i ILP32 true +ControlFlow ntdrivers/floppy.i.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test18.i ILP32 unknown +Loops loop-zilu/benchmark01_conjunctive.i ILP32 unknown +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+lhb-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-newlib/float_req_bl_0660b.c ILP32 true +ECA eca-rers2012/Problem03_label33.c ILP32 true +ProductLines product-lines/elevator_spec2_product09.cil.c ILP32 true +XCSP xcsp/AllInterval-035.c ILP32 false +LinkedLists forester-heap/sll-buckets-2.i ILP32 false +Arrays array-examples/standard_compareModified_ground.i ILP32 true +ControlFlow ntdrivers/kbfiltr.i.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test19-1.i ILP32 unknown +Loops loop-zilu/benchmark11_linear_abstracted.i ILP32 true +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/float_req_bl_0684b.c ILP32 true +ECA eca-rers2012/Problem03_label49.c ILP32 true +ProductLines product-lines/elevator_spec2_product19.cil.c ILP32 true +XCSP xcsp/CostasArray-11.c ILP32 false +LinkedLists forester-heap/sll-circular-2.i ILP32 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +ControlFlow ntdrivers/parport.i.cil-2.c ILP32 true +Heap ldv-memsafety/memleaks_test21-1.i ILP32 unknown +Loops loop-zilu/benchmark23_conjunctive.i ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-newlib/float_req_bl_0920a.c ILP32 true +ECA eca-rers2012/Problem04_label06.c ILP32 false +ProductLines product-lines/elevator_spec2_product23.cil.c ILP32 true +XCSP xcsp/CostasArray-13.c ILP32 false +LinkedLists forester-heap/sll-queue-1.i ILP32 true +Arrays array-examples/standard_copy7_ground-2.i ILP32 true +ControlFlow openssl-simplified/s3_clnt_2.cil-1.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_2-1.i ILP32 unknown +Loops loop-zilu/benchmark33_linear.i ILP32 true +Recursive recursified_loop-simple/recursified_nested_1b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-newlib/float_req_bl_1270a.c ILP32 true +ECA eca-rers2012/Problem04_label31.c ILP32 false +ProductLines product-lines/elevator_spec2_product27.cil.c ILP32 true +XCSP xcsp/CostasArray-15.c ILP32 false +LinkedLists forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Arrays array-examples/standard_find_ground-2.i ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_3.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test22_5.i ILP32 unknown +Loops loop-zilu/benchmark44_disjunctive.i ILP32 unknown +Recursive recursified_loop-simple/recursified_nested_3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cbmc-regression/float19.i ILP32 true +ECA eca-rers2012/Problem04_label56.c ILP32 true +ProductLines product-lines/elevator_spec2_product31.cil.c ILP32 true +XCSP xcsp/CostasArray-17.c ILP32 false +LinkedLists forester-heap/sll-reverse_simple.i ILP32 true +Arrays array-examples/standard_partition_original_ground.i ILP32 true +ControlFlow openssl-simplified/s3_clnt_4.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test23_4.i ILP32 unknown +Loops loops-crafted-1/in-de20.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_5.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +ECA eca-rers2012/Problem05_label14.c ILP32 true +ProductLines product-lines/elevator_spec3_product03.cil.c ILP32 false +XCSP xcsp/Dubois-016.c ILP32 true +LinkedLists forester-heap/sll-simple-white-blue-2.i ILP32 false +Arrays array-examples/standard_strcmp_ground.i ILP32 true +ControlFlow openssl-simplified/s3_srvr_10.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test5.i ILP32 unknown +Loops loops-crafted-1/nested3-1_abstracted.c ILP32 true +Recursive recursified_nla-digbench/recursified_bresenham-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats floats-cdfpl/newton_3_4.i ILP32 true +ECA eca-rers2012/Problem05_label31.c ILP32 true +ProductLines product-lines/elevator_spec3_product18.cil.c ILP32 true +XCSP xcsp/Dubois-019.c ILP32 true +LinkedLists forester-heap/sll-sorted-2.i ILP32 true +Arrays array-examples/standard_two_index_04.i ILP32 true +ControlFlow openssl-simplified/s3_srvr_12.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test6_1.i ILP32 unknown +Loops loops-crafted-1/sumt8.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohencu-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +ECA eca-rers2012/Problem05_label48.c ILP32 false +ProductLines product-lines/elevator_spec3_product22.cil.c ILP32 true +XCSP xcsp/Dubois-021.c ILP32 true +LinkedLists heap-manipulation/bubble_sort_linux-1.i ILP32 true +Arrays array-examples/standard_vector_difference_ground.i ILP32 true +ControlFlow openssl-simplified/s3_srvr_14.cil.c ILP32 unknown +Heap ldv-memsafety/memleaks_test8.i ILP32 unknown +Loops loops/count_up_down-2.c ILP32 false +Recursive recursified_nla-digbench/recursified_cohendiv.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.BOUNDED-12.pals.c ILP32 false +Floats floats-esbmc-regression/trunc_nondet_2.i ILP32 true +ECA eca-rers2012/Problem06_label05.c ILP32 false +ProductLines product-lines/elevator_spec3_product27.cil.c ILP32 false +XCSP xcsp/Dubois-023.c ILP32 true +LinkedLists heap-manipulation/dll_of_dll-1.i ILP32 true +Arrays array-fpi/brs4f.c ILP32 false +ControlFlow openssl-simplified/s3_srvr_2.cil-2.c ILP32 unknown +Heap ldv-memsafety/memleaks_test9_1.i ILP32 unknown +Loops loops/matrix-2-2.c ILP32 false +Recursive recursified_nla-digbench/recursified_dijkstra.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-nonlinear/coral-benchmark21.c ILP32 false +ECA eca-rers2012/Problem06_label21.c ILP32 false +ProductLines product-lines/elevator_spec3_product31.cil.c ILP32 false +XCSP xcsp/Dubois-025.c ILP32 true +LinkedLists heap-manipulation/merge_sort-2.i ILP32 true +Arrays array-fpi/condg.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_6.cil-1.c ILP32 unknown +Heap ldv-regression/fo_test.i ILP32 false +Loops loops/sum01_bug02_sum01_bug02_base.case.i ILP32 unknown +Recursive recursified_nla-digbench/recursified_divbin2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_12_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label38.c ILP32 false +ProductLines product-lines/elevator_spec9_product11.cil.c ILP32 true +XCSP xcsp/Dubois-027.c ILP32 true +LinkedLists heap-manipulation/sll_to_dll_rev-2.i ILP32 true +Arrays array-fpi/eqn2.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_8.cil.c ILP32 unknown +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops loops/terminator_03-2_abstracted.i ILP32 true +Recursive recursified_nla-digbench/recursified_egcd.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_25_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem06_label54.c ILP32 true +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +XCSP xcsp/Dubois-029.c ILP32 true +LinkedLists heap-manipulation/tree-2.i ILP32 false +Arrays array-fpi/eqn5f.c ILP32 false +ControlFlow openssl/s3_clnt.blast.02.i.cil-1.c ILP32 unknown +Heap ldv-regression/test14.c ILP32 true +Loops loops/vogal-1.i ILP32 true +Recursive recursified_nla-digbench/recursified_egcd2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/cartpole_37_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label11.c ILP32 false +ProductLines product-lines/elevator_spec9_product32.cil.c ILP32 false +XCSP xcsp/Dubois-035.c ILP32 true +LinkedLists list-ext3-properties/dll_nondet_free_order-1.i ILP32 unknown +Arrays array-fpi/ifeqn3f.c ILP32 false +ControlFlow openssl/s3_clnt.blast.03.i.cil-2.c ILP32 unknown +Heap ldv-regression/test21-2.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_egcd3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Floats neural-networks/cartpole_49_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label27.c ILP32 true +ProductLines product-lines/email_spec0_product10.cil.c ILP32 true +XCSP xcsp/Dubois-050.c ILP32 true +LinkedLists list-ext3-properties/sll_length_check-1.i ILP32 false +Arrays array-fpi/indp1f.c ILP32 false +ControlFlow openssl/s3_srvr.blast.01.i.cil-1.c ILP32 unknown +Heap ldv-regression/test23-2.c ILP32 true +Loops nla-digbench-scaling/cohencu-ll_valuebound10.c ILP32 true +Recursive recursified_nla-digbench/recursified_fermat1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.BOUNDED-14.pals.c ILP32 false +Floats neural-networks/cartpole_60_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem07_label44.c ILP32 false +ProductLines product-lines/email_spec0_product21.cil.c ILP32 false +XCSP xcsp/Dubois-060.c ILP32 true +LinkedLists list-ext3-properties/sll_nondet_insert-2.i ILP32 true +Arrays array-fpi/indp5f.c ILP32 false +ControlFlow openssl/s3_srvr.blast.02.i.cil-2.c ILP32 unknown +Heap ldv-regression/test25-2.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_unwindbound50.c ILP32 true +Recursive recursified_nla-digbench/recursified_fermat2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.BOUNDED-16.pals.c ILP32 false +Floats neural-networks/cartpole_73_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label00.c ILP32 true +ProductLines product-lines/email_spec0_product26.cil.c ILP32 false +XCSP xcsp/Dubois-070.c ILP32 true +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Arrays array-fpi/ms1.c ILP32 true +ControlFlow openssl/s3_srvr.blast.04.i.cil.c ILP32 unknown +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/dijkstra-u_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo1-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats neural-networks/cartpole_85_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label17.c ILP32 true +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +XCSP xcsp/Dubois-080.c ILP32 true +LinkedLists list-properties/alternating_list-2.i ILP32 false +Arrays array-fpi/ms5.c ILP32 true +ControlFlow openssl/s3_srvr.blast.06.i.cil-2.c ILP32 unknown +Heap ldv-sets/test_mutex.i ILP32 true +Loops nla-digbench-scaling/divbin2_unwindbound100.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo1-u2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/cartpole_97_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label33.c ILP32 true +ProductLines product-lines/email_spec0_product40.cil.c ILP32 true +XCSP xcsp/Dubois-090.c ILP32 true +LinkedLists list-properties/list_flag-1.i ILP32 false +Arrays array-fpi/nsqmf.c ILP32 false +ControlFlow openssl/s3_srvr.blast.08.i.cil-1.c ILP32 unknown +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops nla-digbench-scaling/divbin_unwindbound1.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo2-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_10_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem08_label50.c ILP32 false +ProductLines product-lines/email_spec11_product08.cil.c ILP32 true +XCSP xcsp/Dubois-100.c ILP32 true +LinkedLists list-properties/simple-2.i ILP32 true +Arrays array-fpi/res2f.c ILP32 false +ControlFlow openssl/s3_srvr.blast.09.i.cil-2.c ILP32 unknown +Heap list-ext-properties/960521-1_1-3.i ILP32 unknown +Loops nla-digbench-scaling/divbin_valuebound5.i ILP32 true +Recursive recursified_nla-digbench/recursified_geo2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_23_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label06.c ILP32 false +ProductLines product-lines/email_spec11_product20.cil.c ILP32 false +XCSP xcsp/Haystacks-07.c ILP32 true +LinkedLists list-properties/splice-2.i ILP32 true +Arrays array-fpi/s1lif.c ILP32 true +ControlFlow openssl/s3_srvr.blast.11.i.cil-1.c ILP32 unknown +Heap list-ext-properties/list-ext_flag_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_valuebound2.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo3-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_35_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label23.c ILP32 true +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +XCSP xcsp/Haystacks-10.c ILP32 true +LinkedLists memsafety-broom/dll-fst-data.i LP64 unknown +Arrays array-fpi/s32if.c ILP32 true +ControlFlow openssl/s3_srvr.blast.12.i.cil-2.c ILP32 unknown +Heap list-ext-properties/test-0158_1-2.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound10.c ILP32 true +Recursive recursified_nla-digbench/recursified_hard-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_48_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label39.c ILP32 true +ProductLines product-lines/email_spec11_product33.cil.c ILP32 false +XCSP xcsp/Haystacks-12.c ILP32 true +LinkedLists memsafety-broom/dll-lst-data.i LP64 unknown +Arrays array-fpi/s42iff.c ILP32 false +ControlFlow openssl/s3_srvr.blast.14.i.cil-1.c ILP32 unknown +Heap list-ext-properties/test-0232_1-2.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +Recursive recursified_nla-digbench/recursified_hard.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_5_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem09_label56.c ILP32 false +ProductLines product-lines/email_spec11_product39.cil.c ILP32 true +XCSP xcsp/Haystacks-14.c ILP32 true +LinkedLists memsafety-broom/dll-middle-shared.i LP64 unknown +Arrays array-fpi/s4liff_overflow.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.15.i.cil-2.c ILP32 unknown +Heap list-ext2-properties/simple_and_skiplist_2lvl-2.i ILP32 true +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +Recursive recursified_nla-digbench/recursified_knuth.i ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_72_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label13.c ILP32 true +ProductLines product-lines/email_spec1_product14.cil.c ILP32 false +XCSP xcsp/Haystacks-16.c ILP32 true +LinkedLists memsafety-broom/linux-hlist-lst-data.i LP64 unknown +Arrays array-fpi/s5iff.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/bilinear_interpolation.i ILP32 true +Heap memsafety-cve/NanoNNG.i ILP32 unknown +Loops nla-digbench-scaling/fermat2-ll_unwindbound100.c ILP32 false +Recursive recursified_nla-digbench/recursified_mannadiv.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats neural-networks/dubinsrejoin_84_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem10_label30.c ILP32 true +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +XCSP xcsp/Haystacks-18.c ILP32 true +LinkedLists memsafety-broom/linux-list-lst-data.i LP64 unknown +Arrays array-fpi/sina2.c ILP32 true +ControlFlow unsignedintegeroverflow-sas23/distance_through_overflow.i ILP32 true +Heap memsafety-cve/bzip3Fixed.i ILP32 unknown +Loops nla-digbench-scaling/freire1_valuebound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_prod4br.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +Floats neural-networks/dubinsrejoin_9_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem10_label46.c ILP32 false +ProductLines product-lines/email_spec1_product30.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +LinkedLists memsafety-broom/sll-fst-data.i LP64 unknown +Arrays array-fpi/sina5f.c ILP32 false +ControlFlow unsignedintegeroverflow-sas23/linear_interpolation_2.i ILP32 true +Heap memsafety-cve/editorconfig-core-cFixed.i ILP32 unknown +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +Recursive recursified_nla-digbench/recursified_prodbin.c ILP32 unknown +Sequentialized seq-pthread/cs_dekker.i ILP32 true +Floats neural-networks/exp_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem11_label03.c ILP32 true +ProductLines product-lines/email_spec1_product34.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +LinkedLists memsafety-broom/sll-lst-data.i LP64 unknown +Arrays array-fpi/ss2f.c ILP32 false +Heap memsafety-cve/gpac_1.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_unwindbound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps2.c ILP32 unknown +Sequentialized seq-pthread/cs_fib-1.i ILP32 true +Floats neural-networks/gcas_6_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label19.c ILP32 true +ProductLines product-lines/email_spec27_product17.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-2.c ILP32 true +LinkedLists memsafety-broom/sll-middle-shared.i LP64 unknown +Arrays array-industry-pattern/array_monotonic.i ILP32 true +Heap memsafety-cve/gpac_16Fixed.i ILP32 unknown +Loops nla-digbench-scaling/geo1-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps3.c ILP32 unknown +Sequentialized seq-pthread/cs_fib_longer-2.i ILP32 false +Floats neural-networks/log_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label36.c ILP32 false +ProductLines product-lines/email_spec27_product24.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-4.c ILP32 true +LinkedLists memsafety-broom/sll-nested-sll-inline.i LP64 unknown +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +Heap memsafety-cve/gpac_19.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_unwindbound1.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps4.c ILP32 unknown +Sequentialized seq-pthread/cs_lazy.i ILP32 unknown +Floats neural-networks/lunarlander_0_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem11_label52.c ILP32 true +ProductLines product-lines/email_spec27_product29.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +LinkedLists memsafety-broom/sll-nested-sll-twice.i LP64 unknown +Arrays array-lopstr16/single_elem_safe.i ILP32 true +Heap memsafety-cve/gpac_6.i ILP32 unknown +Loops nla-digbench-scaling/geo1-u_valuebound5.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps5.c ILP32 unknown +Sequentialized seq-pthread/cs_queue-1.i ILP32 true +Floats neural-networks/lunarlander_21_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label09.c ILP32 true +ProductLines product-lines/email_spec27_product33.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +LinkedLists memsafety-broom/sll-shared-before.i LP64 unknown +Arrays array-memsafety/array02-alloca-2.i ILP32 unknown +Heap memsafety-cve/jhead.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_unwindbound1.c ILP32 true +Recursive recursified_nla-digbench/recursified_ps6.c ILP32 unknown +Sequentialized seq-pthread/cs_read_write_lock-2.i ILP32 false +Floats neural-networks/lunarlander_33_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label25.c ILP32 false +ProductLines product-lines/email_spec3_product13.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-2.c ILP32 true +LinkedLists memsafety-broom/sll-shared-sll-before.i LP64 unknown +Arrays array-memsafety/cstrchr-alloca-2.i ILP32 unknown +Heap memsafety-cve/kilo.i ILP32 unknown +Loops nla-digbench-scaling/geo2-ll_valuebound5.c ILP32 true +Recursive recursified_nla-digbench/recursified_sqrt1.c ILP32 unknown +Sequentialized seq-pthread/cs_stack-2.i ILP32 false +Floats neural-networks/lunarlander_45_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label42.c ILP32 false +ProductLines product-lines/email_spec3_product24.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-4.c ILP32 true +LinkedLists memsafety-broom/sll.i LP64 unknown +Arrays array-memsafety/cstrncat_unsafe.c ILP32 unknown +Heap memsafety-cve/liblouis.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_unwindbound1.c ILP32 true +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-pthread/cs_stateful-2.i ILP32 true +Floats neural-networks/lunarlander_57_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem12_label58.c ILP32 true +ProductLines product-lines/email_spec3_product29.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +Arrays array-memsafety/diff-alloca-2.i ILP32 unknown +Heap memsafety-cve/libredwg_1.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_valuebound5.c ILP32 true +Recursive recursive-simple/id2_b5_o10.c ILP32 true +Sequentialized seq-pthread/cs_time_var_mutex.i ILP32 true +Floats neural-networks/lunarlander_69_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label15.c ILP32 true +ProductLines product-lines/email_spec3_product33.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-1.c ILP32 false +Arrays array-memsafety/mult_array_unsafe.i ILP32 unknown +Heap memsafety-cve/minizip-ng.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_valuebound2.c ILP32 true +Recursive recursive-simple/id_b3_o2-1.c ILP32 unknown +Sequentialized systemc/token_ring.01.cil-2.c ILP32 unknown +Floats neural-networks/lunarlander_81_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem13_label31.c ILP32 true +ProductLines product-lines/email_spec4_product13.cil.c ILP32 true +XCSP xcsp/aim-100-6-0-sat-3.c ILP32 false +Arrays array-memsafety/openbsd_cstrcat-alloca-2.i ILP32 unknown +Heap memsafety-cve/mongooseFixed.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_valuebound10.c ILP32 true +Recursive recursive-simple/id_b3_o5-1.c ILP32 unknown +Sequentialized systemc/token_ring.02.cil-2.c ILP32 unknown +Floats neural-networks/lunarlander_92_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem13_label48.c ILP32 false +ProductLines product-lines/email_spec4_product23.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-1.c ILP32 false +Arrays array-memsafety/openbsd_cstrncpy-alloca-2.i ILP32 unknown +Heap memsafety-cve/netatalk.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound50.c ILP32 unknown +Recursive recursive-simple/id_b5_o10-1.c ILP32 unknown +Floats neural-networks/poly_1024_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label04.c ILP32 true +ProductLines product-lines/email_spec4_product28.cil.c ILP32 true +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +Arrays array-memsafety/selectionsort-alloca-1.i ILP32 unknown +Heap memsafety-cve/openSC.i ILP32 unknown +Loops nla-digbench-scaling/knuth_unwindbound20.i ILP32 true +Recursive recursive-simple/id_o10.c ILP32 false +Floats neural-networks/poly_16_16_16_16_thresh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label22.c ILP32 false +ProductLines product-lines/email_spec4_product32.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-1.c ILP32 true +Arrays array-multidimensional/add-2-n-u.c ILP32 true +Heap memsafety-cve/openrazerFound.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_unwindbound20.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Floats neural-networks/poly_16_16_thresh_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem15_label39.c ILP32 false +ProductLines product-lines/email_spec4_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-3.c ILP32 true +Arrays array-multidimensional/diff-3-n-u.c ILP32 true +Heap memsafety-cve/plutovg.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_unwindbound100.c ILP32 true +Recursive recursive-simple/id_o3.c ILP32 false +Floats neural-networks/poly_32_32_32_32_thresh_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem15_label56.c ILP32 true +ProductLines product-lines/email_spec6_product20.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +Arrays array-multidimensional/min-2-u.c ILP32 true +Heap memsafety-cve/radare2_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/mannadiv_unwindbound1.c ILP32 false +Recursive recursive-simple/sum_non_eq-1.c ILP32 unknown +Floats neural-networks/poly_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label12.c ILP32 true +ProductLines product-lines/email_spec6_product28.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-4.c ILP32 false +Arrays array-patterns/array12_pattern.c ILP32 true +Heap memsafety-cve/smartdns.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Floats neural-networks/poly_512_thresh_5_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem16_label29.c ILP32 true +ProductLines product-lines/email_spec6_product32.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-unsat-2.c ILP32 true +Arrays array-patterns/array1_pattern.c ILP32 true +Heap memsafety-cve/sofia-sipFixed.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Floats neural-networks/poly_8_8_8_8_thresh_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem16_label45.c ILP32 true +ProductLines product-lines/email_spec6_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-unsat-4.c ILP32 true +Arrays array-patterns/array25_pattern.c ILP32 true +Heap memsafety-cve/wasm-micro-runtime.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_unwindbound10.c ILP32 true +Recursive recursive/Ackermann04.c ILP32 true +Floats neural-networks/relu_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label02.c ILP32 true +ProductLines product-lines/email_spec7_product19.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-2.c ILP32 false +Arrays array-patterns/array3_pattern.c ILP32 true +Heap memsafety-cve/zephyr.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound50.c ILP32 true +Recursive recursive/Addition02.c ILP32 false +Floats neural-networks/sin_2_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label18.c ILP32 true +ProductLines product-lines/email_spec7_product27.cil.c ILP32 true +XCSP xcsp/aim-200-3-4-sat-4.c ILP32 false +Arrays array-patterns/array7_pattern.c ILP32 true +Heap memsafety-ext/skiplist_3lvl.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_valuebound20.c ILP32 true +Recursive recursive/Addition03-1.c ILP32 true +Floats neural-networks/softmax_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem17_label35.c ILP32 false +ProductLines product-lines/email_spec7_product31.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-2.c ILP32 false +Arrays array-programs/partial_mod_count_limited_1.c ILP32 true +Heap memsafety-ext2/complex_data_creation_test02-1.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_valuebound100.c ILP32 true +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Floats neural-networks/softsign_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem17_label51.c ILP32 true +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-4.c ILP32 false +Arrays array-tiling/mbpr2.c ILP32 true +Heap memsafety-ext2/optional_data_creation_test04-2.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound1.c ILP32 true +Recursive recursive/EvenOdd03.c ILP32 false +Floats neural-networks/softsign_w32_r1_case_0_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label08.c ILP32 false +ProductLines product-lines/email_spec8_product16.cil.c ILP32 false +Arrays array-tiling/nr4.c ILP32 true +Heap memsafety-ext3/realloc1.c ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +Recursive recursive/Fibonacci01-1.c ILP32 true +Floats neural-networks/softsign_w4_r3_case_1_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2012/Problem18_label24.c ILP32 true +ProductLines product-lines/email_spec8_product26.cil.c ILP32 false +Arrays array-tiling/pr2.c ILP32 true +Heap memsafety/global-atexit-5.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_unwindbound2.c ILP32 true +Recursive recursive/Fibonacci04-overflow.c ILP32 unknown +Floats neural-networks/softsign_w8_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label41.c ILP32 true +ProductLines product-lines/email_spec8_product31.cil.c ILP32 false +Arrays array-tiling/rewnifrev2.c ILP32 true +Heap memsafety/lockfree-3.2.i ILP32 unknown +Loops nla-digbench/bresenham.c ILP32 unknown +Recursive recursive/Fibonacci05-overflow.c ILP32 unknown +Floats neural-networks/tanh_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem18_label57.c ILP32 false +ProductLines product-lines/email_spec8_product35.cil.c ILP32 false +Arrays reducercommutativity/avg10-2.i ILP32 true +Heap memsafety/test-0137.i ILP32 unknown +Loops nla-digbench/egcd2.c ILP32 unknown +Recursive recursive/McCarthy91-1.c ILP32 false +Floats neural-networks/tanh_w16_r3_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label14.c ILP32 false +ProductLines product-lines/email_spec9_product15.cil.c ILP32 false +Arrays reducercommutativity/max40-1.i ILP32 true +Heap memsafety/test-0232-2.i ILP32 unknown +Loops nla-digbench/geo2-ll.c ILP32 true +Recursive recursive/MultCommutative-2.c ILP32 true +Floats neural-networks/tanh_w4_r2_case_0_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label30.c ILP32 true +ProductLines product-lines/email_spec9_product22.cil.c ILP32 false +Arrays reducercommutativity/sep.i ILP32 true +Heap memsafety/test-0235-2.i ILP32 unknown +Loops nla-digbench/lcm2.c ILP32 true +Recursive recursive/gcd02.c ILP32 true +Floats neural-networks/tanh_w64_r4_case_1_safe.c-amalgamation.i ILP32 true +ECA eca-rers2012/Problem19_label47.c ILP32 false +ProductLines product-lines/email_spec9_product30.cil.c ILP32 false +Arrays reducercommutativity/sum10-1.i ILP32 true +Heap memsafety/test-0504.i ILP32 unknown +Loops nla-digbench/ps5-ll.c ILP32 true +Recursive recursive/recHanoi02-2.c ILP32 true +Floats neural-networks/vdp_3_unsafe.c-amalgamation.i ILP32 false +ECA eca-rers2018/Problem14.c ILP32 false +ProductLines product-lines/email_spec9_product34.cil.c ILP32 false +Arrays array-cav19/array_init_nondet_vars.c ILP32 true +Heap heap-data/calendar.i ILP32 true +Loops loop-acceleration/array_2-1.i ILP32 false +Recursive recursified_nla-digbench/recursified_cohencu.c ILP32 unknown +Floats float-benchs/cast_float_ptr.c ILP32 false +ECA eca-programs/Problem101_label03.c ILP32 false +ProductLines product-lines/elevator_spec14_product03.cil.c ILP32 true +Arrays array-cav19/array_init_var_plus_ind2.c ILP32 true +Heap heap-data/hash_fun.i ILP32 true +Loops loop-acceleration/diamond_1-2.c ILP32 false +Recursive recursified_nla-digbench/recursified_lcm1.c ILP32 unknown +Floats float-benchs/divmul_diverge.c ILP32 true +ECA eca-programs/Problem101_label11.c ILP32 false +ProductLines product-lines/elevator_spec14_product19.cil.c ILP32 true +Arrays array-cav19/array_tiling_tcpy.c ILP32 true +Heap heap-data/process_queue.i ILP32 true +Loops loop-acceleration/simple_2-2.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Floats float-benchs/filter2.c ILP32 true +ECA eca-programs/Problem101_label19.c ILP32 false +ProductLines product-lines/elevator_spec14_product23.cil.c ILP32 true +Arrays array-crafted/bAnd4.i ILP32 true +Heap heap-data/running_example.i ILP32 true +Loops loop-crafted/simple_array_index_value_4.i.v+nlh-reducer.c ILP32 true +Recursive recursive/recHanoi03-2.c ILP32 true +Floats float-benchs/image_filter.c ILP32 true +ECA eca-programs/Problem102_label03.c ILP32 true +ProductLines product-lines/elevator_spec14_product27.cil.c ILP32 true +Arrays array-crafted/bor2.i ILP32 true +Heap heap-data/shared_mem2.i ILP32 true +Loops loop-industry-pattern/mod3.c.v+lhb-reducer.c ILP32 true +Floats float-benchs/interpolation2.c.v+nlh-reducer.c ILP32 true +ECA eca-programs/Problem102_label12.c ILP32 true +ProductLines product-lines/elevator_spec14_product31.cil.c ILP32 true +Arrays array-crafted/mapavg1.i ILP32 true +Heap ldv-memsafety/memleaks_test1-2.i ILP32 unknown +Loops loop-invariants/linear-inequality-inv-c.c ILP32 true +Floats float-benchs/inv_sqrt_Quake.c ILP32 true +ECA eca-programs/Problem102_label20.c ILP32 true +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +Arrays array-crafted/mapavg5.i ILP32 true +Heap ldv-memsafety/memleaks_test10-1.i ILP32 unknown +Loops loop-invgen/apache-escape-absolute.i ILP32 true +Floats float-benchs/nan_float.c ILP32 false +ECA eca-programs/Problem102_label28.c ILP32 false +ProductLines product-lines/elevator_spec1_product03.cil.c ILP32 true +Arrays array-crafted/mapsum4.i ILP32 true +Heap ldv-memsafety/memleaks_test11.i ILP32 unknown +Loops loop-invgen/apache-get-tag.i ILP32 true +Floats float-benchs/sin_interpolated_bigrange_loose.c ILP32 true +ECA eca-programs/Problem102_label36.c ILP32 true +ProductLines product-lines/elevator_spec1_product11.cil.c ILP32 true +Arrays array-crafted/xor2.i ILP32 true +Heap ldv-memsafety/memleaks_test12-1.i ILP32 unknown +Loops loop-invgen/id_build.i.p+sep-reducer.c ILP32 true +Floats float-benchs/sqrt_Householder_interval.c ILP32 true +ECA eca-programs/Problem102_label45.c ILP32 true +ProductLines product-lines/elevator_spec1_product18.cil.c ILP32 false +Arrays array-crafted/zero_sum1.c ILP32 true +Heap ldv-memsafety/memleaks_test13.i ILP32 unknown +Loops loop-invgen/nested6.i ILP32 true +Floats float-benchs/zonotope_3.c.p+cfa-reducer.c ILP32 true +ECA eca-programs/Problem102_label53.c ILP32 true +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +Arrays array-crafted/zero_sum5.c ILP32 true +Heap ldv-memsafety/memleaks_test13_2.i ILP32 unknown +Loops loop-lit/bhmr2007.i ILP32 true +Floats float-newlib/double_req_bl_0320.c ILP32 true +ECA eca-programs/Problem103_label35.c ILP32 false +ProductLines product-lines/elevator_spec1_product22.cil.c ILP32 false +Arrays array-crafted/zero_sum_const4.c ILP32 true +Heap ldv-memsafety/memleaks_test14_1.i ILP32 unknown +Loops loop-lit/gcnr2008.i ILP32 unknown +Floats float-newlib/double_req_bl_0662a.c ILP32 true +ECA eca-programs/Problem103_label47.c ILP32 false +ProductLines product-lines/elevator_spec1_product24.cil.c ILP32 false +Arrays array-crafted/zero_sum_const_m4.c ILP32 true +Heap ldv-memsafety/memleaks_test15-1.i ILP32 unknown +Loops loop-lit/gsv2008.c.i.p+cfa-reducer.c ILP32 true +Floats float-newlib/double_req_bl_0683a.c ILP32 true +ECA eca-programs/Problem103_label56.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +Arrays array-crafted/zero_sum_m4.c ILP32 true +Heap ldv-memsafety/memleaks_test16.i ILP32 unknown +Loops loop-lit/jm2006.i ILP32 true +Floats float-newlib/double_req_bl_0870b.c ILP32 true +ECA eca-rers2012/Problem03_label04.c ILP32 true +ProductLines product-lines/elevator_spec1_product28.cil.c ILP32 false +Arrays array-examples/data_structures_set_multi_proc_trivial_ground.i ILP32 true +Heap ldv-memsafety/memleaks_test16_2.i ILP32 unknown +Loops loop-new/count_by_k.i ILP32 true +Floats float-newlib/double_req_bl_0920a.c ILP32 true +ECA eca-rers2012/Problem03_label12.c ILP32 true +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +Arrays array-examples/sanfoundry_02_ground.i ILP32 true +Heap ldv-memsafety/memleaks_test17_1-2.i ILP32 unknown +Loops loop-new/half.i ILP32 true +Floats float-newlib/double_req_bl_1131a.c ILP32 true +ECA eca-rers2012/Problem03_label20.c ILP32 true +ProductLines product-lines/elevator_spec1_product32.cil.c ILP32 false +Arrays array-examples/sanfoundry_24-2.i ILP32 unknown +Heap ldv-memsafety/memleaks_test17_3.i ILP32 unknown +Loops loop-simple/nested_4.c ILP32 true +Floats float-newlib/float_req_bl_0281.c ILP32 true +ECA eca-rers2012/Problem03_label29.c ILP32 true +ProductLines product-lines/elevator_spec2_product03.cil.c ILP32 true +Arrays array-examples/sorting_bubblesort_ground-1.i ILP32 true +Heap ldv-memsafety/memleaks_test18_1.i ILP32 unknown +Loops loop-zilu/benchmark03_linear.i ILP32 unknown +Floats float-newlib/float_req_bl_0662a.c ILP32 true +ECA eca-rers2012/Problem03_label37.c ILP32 false +ProductLines product-lines/elevator_spec2_product11.cil.c ILP32 true +Arrays array-examples/sorting_selectionsort_ground-2.i ILP32 true +Heap ldv-memsafety/memleaks_test18_3.i ILP32 unknown +Loops loop-zilu/benchmark09_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0683a.c ILP32 true +ECA eca-rers2012/Problem03_label45.c ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +Arrays array-examples/standard_copy1_ground-1.i ILP32 true +Heap ldv-memsafety/memleaks_test19-2.i ILP32 unknown +Loops loop-zilu/benchmark14_linear.i ILP32 true +Floats float-newlib/float_req_bl_0870b.c ILP32 true +ECA eca-rers2012/Problem03_label53.c ILP32 true +ProductLines product-lines/elevator_spec2_product20.cil.c ILP32 false +Arrays array-examples/standard_copy2_ground-2.i ILP32 true +Heap ldv-memsafety/memleaks_test20-2.i ILP32 unknown +Loops loop-zilu/benchmark20_conjunctive.i ILP32 true +Floats float-newlib/float_req_bl_0880.c ILP32 true +ECA eca-rers2012/Problem04_label02.c ILP32 true +ProductLines product-lines/elevator_spec2_product22.cil.c ILP32 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Heap ldv-memsafety/memleaks_test21-2.i ILP32 unknown +Loops loop-zilu/benchmark25_linear_abstracted.i ILP32 true +Floats float-newlib/float_req_bl_1121b.c ILP32 true +ECA eca-rers2012/Problem04_label10.c ILP32 true +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +Arrays array-examples/standard_copy6_ground-2.i ILP32 true +Heap ldv-memsafety/memleaks_test22_1-2.i ILP32 unknown +Loops loop-zilu/benchmark30_conjunctive.i ILP32 unknown +Floats float-newlib/float_req_bl_1211a.c ILP32 true +ECA eca-rers2012/Problem04_label25.c ILP32 true +ProductLines product-lines/elevator_spec2_product26.cil.c ILP32 false diff --git a/tests/testcomp/corpus/cover-error-official.tsv b/tests/testcomp/corpus/cover-error-official.tsv new file mode 100644 index 000000000..75f1e539c --- /dev/null +++ b/tests/testcomp/corpus/cover-error-official.tsv @@ -0,0 +1,1903 @@ +# category program data_model expected_unreach +Arrays array-fpi/ms3f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +ECA eca-rers2012/Problem18_label00.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +Heap ldv-regression/rule57_ebda_blast_2.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec27_product34.cil.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.3.prop1-back-serstep.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/od-3.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_symmetry_cover_proof.i LP64 false +SoftwareSystems-OpenBSD openbsd-6.2/if_etherip-unreach-call.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-consumption/32_7a_cilled_linux-3.8-rc1-32_7a-drivers--media--dvb-frontends--stv090x.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/condgf.c ILP32 false +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +ECA eca-rers2012/Problem06_label00.c ILP32 false +Floats float-benchs/nan_double.c ILP32 false +Heap forester-heap/sll-optional-2.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec0_product22.cil.c ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop1-back-serstep.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/ls-incomplete-2.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_all_nines_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.7.3/main0_drivers--media--dvb-frontends--stv090x-ko---32_7a--linux-3.7.3.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +ECA eca-rers2018/Problem14.c ILP32 false +Floats floats-cdfpl/sine_1.i ILP32 false +Heap ldv-sets/test_mutex_unlock_at_exit.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product29.cil.c ILP32 false +Recursive recursive/Addition02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.5.prop1-back-serstep.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/printf-2.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_identical_paths_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +Arrays array-examples/standard_copy6_ground-1.i ILP32 false +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +ECA eca-programs/Problem103_label32.c ILP32 false +Floats float-benchs/float_int_inv_square.c ILP32 false +Heap forester-heap/dll-rb-sentinel-1.i ILP32 false +Loops loops/insertion_sort-1-2.c ILP32 false +ProductLines product-lines/elevator_spec2_product30.cil.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d64_e0.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/test-incomplete-1.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_64bit_number_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ifeqn4f.c ILP32 false +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +ECA eca-rers2012/Problem12_label00.c ILP32 false +Floats float-newlib/double_req_bl_0870a.c ILP32 false +Heap heap-manipulation/bubble_sort_linux-2.i ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.1.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_positive_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s1iff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +ECA eca-rers2018/Problem11.c ILP32 false +Floats floats-cdfpl/newton_2_8.i ILP32 false +Heap ldv-regression/test25-1.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound50.c ILP32 false +ProductLines product-lines/email_spec4_product19.cil.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul9.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_valid_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +ECA eca-rers2018/Problem16.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +Heap list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec8_product22.cil.c ILP32 false +Recursive recursive/McCarthy91-1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.2.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_potential_buffer_overflow_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_entry_havoc_object.i LP64 false +Arrays array-examples/standard_allDiff2_ground.i ILP32 false +BitVectors bitvector/byte_add-1.i ILP32 false +ECA eca-programs/Problem101_label00.c ILP32 false +Floats float-benchs/cast_union_loose.c ILP32 false +Heap forester-heap/dll-optional-2.i ILP32 false +Loops loop-invariants/linear-inequality-inv-b.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d32_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_trivial_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-examples/standard_running-1.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +ECA eca-rers2012/Problem05_label00.c ILP32 false +Floats float-benchs/inv_Newton.c.p+cfa-reducer.c ILP32 false +Heap forester-heap/dll-token-2.i ILP32 false +Loops loops/sum03-1.i ILP32 false +ProductLines product-lines/elevator_spec3_product28.cil.c ILP32 false +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.4.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_numbers_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/eqn4f.c ILP32 false +ECA eca-rers2012/Problem11_label00.c ILP32 false +Floats float-benchs/sin_interpolated_index-1.c ILP32 false +Heap forester-heap/sll-rb-sentinel-2.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d64_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_negative_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/indp4f.c ILP32 false +ECA eca-rers2012/Problem15_label00.c ILP32 false +Floats floats-cdfpl/newton_1_4.i ILP32 false +Heap heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec27_product18.cil.c ILP32 false +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.3.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_identical_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/pcompf.c ILP32 false +ECA eca-rers2018/Problem10.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.6.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_symmetry_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s3iff.c ILP32 false +ECA eca-rers2018/Problem12.c ILP32 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec4_product35.cil.c ILP32 false +Recursive recursive-simple/id_o3.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.6.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_different_paths_output_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/sqm-iff.c ILP32 false +ECA eca-rers2018/Problem15.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +Heap list-ext2-properties/simple_and_skiplist_2lvl-1.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec7_product30.cil.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.2.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_matching_paths_output_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_entry_havoc_memory.i LP64 false +Arrays array-tiling/skippedu.c ILP32 false +ECA eca-rers2018/Problem17.c ILP32 false +Floats loop-floats-scientific-comp/loop1-2.c ILP32 false +Heap list-properties/list-2.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +Recursive verifythis/tree_del_rec_incorrect.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.twocount32.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/seq_cmp_antisymmetry_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_proof_havoc_memory.i LP64 false +Arrays array-examples/sorting_bubblesort_ground-2.i ILP32 false +ECA eca-rers2012/Problem16_label00.c ILP32 false +Floats float-benchs/cast_float_ptr.c ILP32 false +Heap forester-heap/dll-01-1.i ILP32 false +Loops loop-acceleration/diamond_1-2.c ILP32 false +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_trivial_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +ECA eca-rers2018/Problem13.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +Heap forester-heap/dll-queue-2.i ILP32 false +Loops loops/bubble_sort-2.i ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-009.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d32_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_64bit_number_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_entry_havoc_memory.i LP64 false +Arrays array-examples/standard_copy9_ground-1.i ILP32 false +ECA eca-rers2018/Problem18.c ILP32 false +Floats float-benchs/inv_Newton-2.c ILP32 false +Heap forester-heap/dll-simple-white-blue-1.i ILP32 false +Loops loops/n.c24.i ILP32 false +ProductLines product-lines/elevator_spec3_product19.cil.c ILP32 false +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-013.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d64_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_numbers_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/brs3f.c ILP32 false +Floats float-benchs/inv_square-1.c ILP32 false +Heap forester-heap/sll-buckets-2.i ILP32 false +Loops loops/trex03-1.c ILP32 false +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/AllInterval-017.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.3.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_all_nines_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-fpi/eqn1f.c ILP32 false +Floats float-benchs/nan_float.c ILP32 false +Heap forester-heap/sll-queue-2.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-020.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d32_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_negative_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/ifeqn1f.c ILP32 false +Floats float-benchs/sqrt_poly2.c ILP32 false +Heap forester-heap/sll-sorted-1.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/CostasArray-10.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.2.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_positive_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/indp1f.c ILP32 false +Floats float-newlib/float_req_bl_0870a.c ILP32 false +Heap heap-manipulation/dll_of_dll-2.i ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.2.prop3-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_identical_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_success_havoc_object.i LP64 false +Arrays array-fpi/modpf.c ILP32 false +Floats floats-cdfpl/newton_1_5.i ILP32 false +Heap heap-manipulation/tree-4.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop3-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_valid_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ncompf.c ILP32 false +Floats floats-cdfpl/newton_1_8.i ILP32 false +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec3_product18.cil.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.3.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_different_paths_output_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/res2f.c ILP32 false +Floats floats-cdfpl/newton_2_7.i ILP32 false +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound100.c ILP32 false +ProductLines product-lines/email_spec3_product32.cil.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.6.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_identical_paths_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s2iff.c ILP32 false +Floats floats-cdfpl/newton_3_6.i ILP32 false +Heap ldv-regression/test28-1.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop4-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_matching_paths_output_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/s4iff.c ILP32 false +Floats floats-cdfpl/newton_3_8.i ILP32 false +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec6_product16.cil.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop5-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_potential_buffer_overflow_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/sina3f.c ILP32 false +Floats floats-cdfpl/sine_2.i ILP32 false +Heap list-ext-properties/list-ext.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.1.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/seq_cmp_antisymmetry_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ss2f.c ILP32 false +Floats floats-cdfpl/square_1.i ILP32 false +Heap list-ext3-properties/dll_nullified-1.i ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d16_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/seq_incr_no_carry_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_entry_havoc_memory.i LP64 false +Arrays array-programs/copysome1-2.i ILP32 false +Floats floats-cdfpl/square_3.i ILP32 false +Heap list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +Recursive verifythis/tree_del_rec.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_exit_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum10.i ILP32 false +Floats loop-floats-scientific-comp/loop2-1.c ILP32 false +Heap list-properties/simple-1.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec9_product31.cil.c ILP32 false +Recursive verifythis/tree_max.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_s1269b_p4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Floats floats-cdfpl/newton_1_6.i ILP32 false +Heap forester-heap/dll-circular-1.i ILP32 false +Loops loop-acceleration/array_2-1.i ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-006.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Floats loop-floats-scientific-comp/loop4.i ILP32 false +Heap forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Loops loop-acceleration/simple_2-2.c ILP32 false +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_copy1_ground-2.i ILP32 false +Heap forester-heap/dll-sorted-1.i ILP32 false +Loops loops-crafted-1/nested_delay_notd2.c ILP32 false +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Heap forester-heap/sll-01-2.i ILP32 false +Loops loops/count_up_down-2.c ILP32 false +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-012.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_entry_havoc_memory.i LP64 false +Arrays array-examples/standard_copy7_ground-1.i ILP32 false +Heap forester-heap/sll-circular-2.i ILP32 false +Loops loops/linear_search.c ILP32 false +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +Recursive verifythis/tree_max_incorrect.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-014.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_minInArray_ground-1.i ILP32 false +Heap forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Loops loops/string-2.i ILP32 false +ProductLines product-lines/elevator_spec3_product23.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-016.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/brs1f.c ILP32 false +Heap forester-heap/sll-simple-white-blue-2.i ILP32 false +Loops loops/trex01-1.c ILP32 false +ProductLines product-lines/elevator_spec3_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-018.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/brs5f.c ILP32 false +Heap forester-heap/sll-token-1.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound1.c ILP32 false +ProductLines product-lines/elevator_spec9_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/AllInterval-025.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/condmf.c ILP32 false +Heap heap-manipulation/merge_sort-1.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec0_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-035.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/eqn2f.c ILP32 false +Heap heap-manipulation/tree-2.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/CostasArray-11.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/eqn5f.c ILP32 false +Heap ldv-regression/fo_test.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec11_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/CostasArray-13.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ifeqn2f.c ILP32 false +Heap ldv-regression/test21-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec1_product16.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/CostasArray-15.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ifeqn5f.c ILP32 false +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec1_product29.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/CostasArray-17.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v7.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/indp2f.c ILP32 false +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec1_product35.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/indp5f.c ILP32 false +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec27_product23.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ms1f.c ILP32 false +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/ms4f.c ILP32 false +Heap list-ext-properties/simple-ext.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec27_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.BOUNDED-12.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/nsqm-iff.c ILP32 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec3_product23.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/res1f.c ILP32 false +Heap list-ext3-properties/sll_length_check-1.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound1.c ILP32 false +ProductLines product-lines/email_spec3_product29.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/res2of.c ILP32 false +Heap list-properties/alternating_list-2.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound20.c ILP32 false +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/s1liff.c ILP32 false +Heap list-properties/list_flag-1.i ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec4_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/s2liff.c ILP32 false +Heap list-properties/splice-1.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec4_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.BOUNDED-16.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/s3liff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec6_product12.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/s52iff.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/sina1f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec6_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/sina4f.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec6_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/sqmf.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec7_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ss4f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec8_product16.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_proof_havoc_memory.i LP64 false +Arrays array-industry-pattern/array_single_elem_init.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec8_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_proof_havoc_object.i LP64 false +Arrays array-programs/copysome2-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec8_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec9_product22.cil.c ILP32 false +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_Unidec.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays reducercommutativity/rangesum40.i ILP32 false +Loops verifythis/tree_del_iter.c ILP32 false +ProductLines product-lines/email_spec9_product34.cil.c ILP32 false +Sequentialized seq-pthread/cs_stack-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Arrays array-examples/sorting_bubblesort_2_ground.i ILP32 false +Loops loop-acceleration/array_3-2.i ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_ridecore_array.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_proof_havoc_memory.i LP64 false +Arrays array-examples/sorting_selectionsort_ground-1.i ILP32 false +Loops loop-acceleration/multivar_1-2.c ILP32 false +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_proof_havoc_memory.i LP64 false +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +Loops loop-acceleration/simple_3-1.c ILP32 false +ProductLines product-lines/elevator_spec1_product18.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +Loops loop-invgen/id_trans.i ILP32 false +ProductLines product-lines/elevator_spec1_product22.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-examples/standard_copy8_ground-2.i ILP32 false +Loops loops/array-2.c ILP32 false +ProductLines product-lines/elevator_spec1_product28.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_partition_ground-1.i ILP32 false +Loops loops/compact.c ILP32 false +ProductLines product-lines/elevator_spec1_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/brs2f.c ILP32 false +Loops loops/for_bounded_loop1.c ILP32 false +ProductLines product-lines/elevator_spec2_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/brs4f.c ILP32 false +Loops loops/invert_string-1.c ILP32 false +ProductLines product-lines/elevator_spec2_product26.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/condaf.c ILP32 false +Loops loops/matrix-2-2.c ILP32 false +ProductLines product-lines/elevator_spec2_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/condnf.c ILP32 false +Loops loops/nec20.c ILP32 false +ProductLines product-lines/elevator_spec3_product03.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-fpi/eqn3f.c ILP32 false +Loops loops/sum01_bug02.i ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ifcompf.c ILP32 false +Loops loops/terminator_01.c ILP32 false +ProductLines product-lines/elevator_spec3_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/ifeqn3f.c ILP32 false +Loops loops/trex02-2.c ILP32 false +ProductLines product-lines/elevator_spec3_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_success_havoc_object.i LP64 false +Arrays array-fpi/ifncompf.c ILP32 false +Loops loops/vogal-2.i ILP32 false +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/indp3f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound10.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/modnf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/modsf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec0_product26.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ms2f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ms5f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec0_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-fpi/nsqmf.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec11_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/res1of.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/s12iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec11_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.count2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s22iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec1_product14.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/s32iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s42iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec1_product26.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/s4liff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec1_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/s5iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec1_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.BOUNDED-14.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/sina2f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/sina5f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ss1f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec27_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Arrays array-fpi/ss3f.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec27_product29.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.h_FIFO.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ssinaf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec27_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Arrays array-industry-pattern/check_removal_from_set_after_insertion.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Arrays array-tiling/mlceu.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec3_product13.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_exit_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum05.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound10.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum20.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +ProductLines product-lines/email_spec3_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum60.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +ProductLines product-lines/email_spec3_product28.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_exit_havoc_memory.i LP64 false +Loops nla-digbench-scaling/hard2_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec3_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/hard2_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec3_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec3_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul11.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec4_product23.cil.c ILP32 false +Sequentialized seq-pthread/cs_fib_longer-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop2-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_success_havoc_object.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +Sequentialized seq-pthread/cs_read_write_lock-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_entry_havoc_object.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec4_product31.cil.c ILP32 false +Sequentialized seq-pthread/cs_stateful-1.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec4_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec4_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec6_product14.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.3.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_exit_havoc_memory.i LP64 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec6_product20.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_entry_havoc_object.i LP64 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec6_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec7_product28.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec7_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_entry_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec7_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec8_product20.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_exit_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec8_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.sw_sym_ex_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec8_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec8_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_exit_havoc_memory.i LP64 false +Loops verifythis/tree_del_iter_incorrect.c ILP32 false +ProductLines product-lines/email_spec9_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.unsafe_intersymbol_analog_estimation_convergence.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_am2901.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p6.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec14_product32.cil.c ILP32 false +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_arbitrated_fifos_n2d8w8.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec1_product24.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_success_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec1_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec2_product22.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec2_product28.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec3_product27.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec9_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec0_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec0_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec11_product22.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_exit_havoc_object.i LP64 false +ProductLines product-lines/email_spec11_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec1_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_success_havoc_object.i LP64 false +ProductLines product-lines/email_spec1_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec1_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec1_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/email_spec27_product17.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec27_product25.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec27_product30.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec27_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec3_product17.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec3_product25.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec3_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +ProductLines product-lines/email_spec4_product27.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_exit_havoc_object.i LP64 false +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec6_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec6_product28.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec6_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_exit_havoc_object.i LP64 false +ProductLines product-lines/email_spec7_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec8_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec8_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec8_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_product16.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product30.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.counter_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.dyn_partition.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v3.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.exit.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.factorial4even.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.4.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop2-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop2-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul6.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.noninitstate.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.twocount2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.unsafe_analog_estimation_convergence.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_DAIO.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_usb_phy_1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p3.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_vMiim_p2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_palu.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p8.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_linked_list_fifo_n2d4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_success_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cav14_example_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.count4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.diagonal_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v5.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.ethernet.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.exit.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.2.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.4.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop2-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop2-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.h_CRC.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.h_b05.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_success_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.itc99_b12.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul10.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul5.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul8.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop2-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.3.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.recount4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sw_loop_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synabs2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.twocount2c.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.unknown_ridecore.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.unsafe_buggy_ridecore.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.usb_phy.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_FIFO.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_non-pipelined-microprocessor.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_arrays_itc99_b12_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_rotate32.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_spinner32.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_FIFOs.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p3.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_buf_bug.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_two_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p7.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p01.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_success_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_success_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_success_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_proof_havoc_object.i LP64 false diff --git a/tests/testcomp/corpus/cover-error-q40.tsv b/tests/testcomp/corpus/cover-error-q40.tsv new file mode 100644 index 000000000..91281f04d --- /dev/null +++ b/tests/testcomp/corpus/cover-error-q40.tsv @@ -0,0 +1,373 @@ +# category program data_model expected_unreach +Arrays array-fpi/ms3f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +ECA eca-rers2012/Problem10_label12.c ILP32 false +ProductLines product-lines/email_spec27_product34.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +LinkedLists forester-heap/sll-simple-white-blue-2.i ILP32 false +Arrays array-fpi/condgf.c ILP32 false +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound10.c ILP32 false +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-benchs/nan_double.c ILP32 false +ECA eca-rers2012/Problem05_label40.c ILP32 false +ProductLines product-lines/email_spec0_product22.cil.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +LinkedLists forester-heap/dll-sorted-1.i ILP32 false +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Heap ldv-sets/test_mutex_unlock_at_exit.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound100.c ILP32 false +Recursive recursive-simple/id_o3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/sine_1.i ILP32 false +ECA eca-rers2012/Problem16_label01.c ILP32 false +ProductLines product-lines/email_spec6_product29.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +LinkedLists list-ext3-properties/dll_nullified-1.i ILP32 false +Arrays array-examples/standard_copy6_ground-1.i ILP32 false +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +Heap ldv-regression/rule57_ebda_blast_2.i ILP32 false +Loops loops/insertion_sort-1-2.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/float_int_inv_square.c ILP32 false +ECA eca-programs/Problem103_label44.c ILP32 false +ProductLines product-lines/elevator_spec2_product30.cil.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +LinkedLists forester-heap/dll-queue-2.i ILP32 false +Arrays array-fpi/ifeqn4f.c ILP32 false +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_0870a.c ILP32 false +ECA eca-rers2012/Problem07_label44.c ILP32 false +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +LinkedLists forester-heap/sll-circular-2.i ILP32 false +Arrays array-fpi/s1iff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_2_8.i ILP32 false +ECA eca-rers2012/Problem12_label51.c ILP32 false +ProductLines product-lines/email_spec4_product19.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +LinkedLists heap-manipulation/dll_of_dll-2.i ILP32 false +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +Heap list-ext-properties/simple-ext.i ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound5.c ILP32 false +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +ECA eca-rers2012/Problem18_label09.c ILP32 false +ProductLines product-lines/email_spec8_product22.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +LinkedLists list-properties/alternating_list-2.i ILP32 false +Arrays array-examples/standard_allDiff2_ground.i ILP32 false +BitVectors bitvector/byte_add-1.i ILP32 false +Heap ldv-regression/fo_test.i ILP32 false +Loops loop-invariants/linear-inequality-inv-b.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/cast_union_loose.c ILP32 false +ECA eca-programs/Problem102_label02.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +LinkedLists forester-heap/dll-circular-1.i ILP32 false +Arrays array-examples/standard_running-1.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops loops/sum01_bug02.i ILP32 false +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/inv_Newton.c.p+cfa-reducer.c ILP32 false +ECA eca-rers2012/Problem04_label15.c ILP32 false +ProductLines product-lines/elevator_spec3_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-1.i ILP32 false +Arrays array-fpi/eqn4f.c ILP32 false +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/sin_interpolated_index-1.c ILP32 false +ECA eca-rers2012/Problem06_label37.c ILP32 false +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +LinkedLists forester-heap/sll-01-2.i ILP32 false +Arrays array-fpi/indp4f.c ILP32 false +Heap ldv-regression/test25-1.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_1_4.i ILP32 false +ECA eca-rers2012/Problem08_label51.c ILP32 false +ProductLines product-lines/email_spec27_product18.cil.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +LinkedLists forester-heap/sll-queue-2.i ILP32 false +Arrays array-fpi/pcompf.c ILP32 false +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound20.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +ECA eca-rers2012/Problem11_label43.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +LinkedLists forester-heap/sll-token-1.i ILP32 false +Arrays array-fpi/s3iff.c ILP32 false +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound10.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +ECA eca-rers2012/Problem13_label54.c ILP32 false +ProductLines product-lines/email_spec4_product35.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +LinkedLists heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Arrays array-fpi/sqm-iff.c ILP32 false +Heap list-ext-properties/list-ext.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +ECA eca-rers2012/Problem17_label09.c ILP32 false +ProductLines product-lines/email_spec7_product30.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +LinkedLists list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Arrays array-tiling/skippedu.c ILP32 false +Heap list-ext2-properties/simple_and_skiplist_2lvl-1.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound50.c ILP32 false +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats loop-floats-scientific-comp/loop1-2.c ILP32 false +ECA eca-rers2012/Problem19_label21.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +LinkedLists list-properties/list_flag-1.i ILP32 false +Arrays array-examples/sorting_bubblesort_ground-2.i ILP32 false +Heap ldv-regression/test21-2.c ILP32 false +Loops loop-acceleration/diamond_1-2.c ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_float_ptr.c ILP32 false +ECA eca-programs/Problem101_label12.c ILP32 false +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +LinkedLists forester-heap/dll-01-1.i ILP32 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +Heap ldv-regression/test28-1.c ILP32 false +Loops loops/bubble_sort-2.i ILP32 false +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +ECA eca-programs/Problem102_label34.c ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +XCSP xcsp/AllInterval-009.c ILP32 false +LinkedLists forester-heap/dll-optional-2.i ILP32 false +Arrays array-examples/standard_copy9_ground-1.i ILP32 false +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops loops/matrix-2-2.c ILP32 false +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/inv_Newton-2.c ILP32 false +ECA eca-rers2012/Problem03_label28.c ILP32 false +ProductLines product-lines/elevator_spec3_product19.cil.c ILP32 false +XCSP xcsp/AllInterval-013.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Arrays array-fpi/brs3f.c ILP32 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops loops/trex02-2.c ILP32 false +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-benchs/inv_square-1.c ILP32 false +ECA eca-rers2012/Problem05_label01.c ILP32 false +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-017.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-1.i ILP32 false +Arrays array-fpi/eqn1f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/nan_float.c ILP32 false +ECA eca-rers2012/Problem06_label05.c ILP32 false +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +XCSP xcsp/AllInterval-020.c ILP32 false +LinkedLists forester-heap/dll-token-2.i ILP32 false +Arrays array-fpi/ifeqn1f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound5.c ILP32 false +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/sqrt_poly2.c ILP32 false +ECA eca-rers2012/Problem07_label11.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +XCSP xcsp/CostasArray-10.c ILP32 false +LinkedLists forester-heap/sll-buckets-2.i ILP32 false +Arrays array-fpi/indp1f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound50.c ILP32 false +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/float_req_bl_0870a.c ILP32 false +ECA eca-rers2012/Problem08_label15.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +LinkedLists forester-heap/sll-optional-2.i ILP32 false +Arrays array-fpi/modpf.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound1.c ILP32 false +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_1_5.i ILP32 false +ECA eca-rers2012/Problem09_label34.c ILP32 false +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +LinkedLists forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Arrays array-fpi/ncompf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/newton_1_8.i ILP32 false +ECA eca-rers2012/Problem10_label57.c ILP32 false +ProductLines product-lines/email_spec3_product18.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +LinkedLists forester-heap/sll-sorted-1.i ILP32 false +Arrays array-fpi/res2f.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound10.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/newton_2_7.i ILP32 false +ECA eca-rers2012/Problem12_label21.c ILP32 false +ProductLines product-lines/email_spec3_product32.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +LinkedLists heap-manipulation/bubble_sort_linux-2.i ILP32 false +Arrays array-fpi/s2iff.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound10.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_3_6.i ILP32 false +ECA eca-rers2012/Problem13_label25.c ILP32 false +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +LinkedLists heap-manipulation/merge_sort-1.i ILP32 false +Arrays array-fpi/s4iff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/newton_3_8.i ILP32 false +ECA eca-rers2012/Problem15_label30.c ILP32 false +ProductLines product-lines/email_spec6_product16.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +LinkedLists heap-manipulation/tree-2.i ILP32 false +Arrays array-fpi/sina3f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/sine_2.i ILP32 false +ECA eca-rers2012/Problem16_label31.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +LinkedLists list-ext3-properties/sll_length_check-1.i ILP32 false +Arrays array-fpi/ss2f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound10.c ILP32 false +Recursive recursive/Addition02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/square_1.i ILP32 false +ECA eca-rers2012/Problem17_label40.c ILP32 false +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Arrays array-programs/copysome1-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound100.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/square_3.i ILP32 false +ECA eca-rers2012/Problem18_label38.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +LinkedLists list-properties/list-2.i ILP32 false +Arrays reducercommutativity/rangesum10.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound2.c ILP32 false +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +Floats loop-floats-scientific-comp/loop2-1.c ILP32 false +ECA eca-rers2012/Problem19_label51.c ILP32 false +ProductLines product-lines/email_spec9_product31.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +LinkedLists list-properties/simple-1.i ILP32 false +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Loops loop-acceleration/array_2-1.i ILP32 false +Recursive recursive/McCarthy91-1.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/newton_1_6.i ILP32 false +ECA eca-programs/Problem101_label05.c ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-006.c ILP32 false +LinkedLists forester-heap/sll-rb-sentinel-2.i ILP32 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Loops loop-acceleration/simple_2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.UNBOUNDED.pals.c ILP32 false +Floats loop-floats-scientific-comp/loop4.i ILP32 false +ECA eca-programs/Problem101_label18.c ILP32 false +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +LinkedLists heap-manipulation/tree-4.i ILP32 false +Arrays array-examples/standard_copy1_ground-2.i ILP32 false +Loops loops-crafted-1/nested_delay_notd2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem102_label13.c ILP32 false +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +LinkedLists list-properties/splice-1.i ILP32 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Loops loops/count_up_down-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem102_label50.c ILP32 false +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-012.c ILP32 false +Arrays array-examples/standard_copy7_ground-1.i ILP32 false +Loops loops/invert_string-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem103_label56.c ILP32 false +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-014.c ILP32 false +Arrays array-examples/standard_minInArray_ground-1.i ILP32 false +Loops loops/nec20.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem03_label45.c ILP32 false +ProductLines product-lines/elevator_spec3_product23.cil.c ILP32 false +XCSP xcsp/AllInterval-016.c ILP32 false +Arrays array-fpi/brs1f.c ILP32 false +Loops loops/terminator_01.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label35.c ILP32 false +ProductLines product-lines/elevator_spec3_product32.cil.c ILP32 false +XCSP xcsp/AllInterval-018.c ILP32 false +Arrays array-fpi/brs5f.c ILP32 false +Loops loops/vogal-2.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem05_label30.c ILP32 false +ProductLines product-lines/elevator_spec9_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-025.c ILP32 false +Arrays array-fpi/condmf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label55.c ILP32 false +ProductLines product-lines/email_spec0_product31.cil.c ILP32 false +XCSP xcsp/AllInterval-035.c ILP32 false diff --git a/tests/testcomp/corpus/cover-error-q400.tsv b/tests/testcomp/corpus/cover-error-q400.tsv new file mode 100644 index 000000000..0260e4131 --- /dev/null +++ b/tests/testcomp/corpus/cover-error-q400.tsv @@ -0,0 +1,1088 @@ +# category program data_model expected_unreach +Arrays array-fpi/ms3f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +ECA eca-rers2012/Problem10_label12.c ILP32 false +ProductLines product-lines/email_spec27_product34.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +LinkedLists forester-heap/sll-simple-white-blue-2.i ILP32 false +Arrays array-fpi/condgf.c ILP32 false +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound10.c ILP32 false +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-benchs/nan_double.c ILP32 false +ECA eca-rers2012/Problem05_label40.c ILP32 false +ProductLines product-lines/email_spec0_product22.cil.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +LinkedLists forester-heap/dll-sorted-1.i ILP32 false +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Heap ldv-sets/test_mutex_unlock_at_exit.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound100.c ILP32 false +Recursive recursive-simple/id_o3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/sine_1.i ILP32 false +ECA eca-rers2012/Problem16_label01.c ILP32 false +ProductLines product-lines/email_spec6_product29.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +LinkedLists list-ext3-properties/dll_nullified-1.i ILP32 false +Arrays array-examples/standard_copy6_ground-1.i ILP32 false +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +Heap ldv-regression/rule57_ebda_blast_2.i ILP32 false +Loops loops/insertion_sort-1-2.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/float_int_inv_square.c ILP32 false +ECA eca-programs/Problem103_label44.c ILP32 false +ProductLines product-lines/elevator_spec2_product30.cil.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +LinkedLists forester-heap/dll-queue-2.i ILP32 false +Arrays array-fpi/ifeqn4f.c ILP32 false +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_0870a.c ILP32 false +ECA eca-rers2012/Problem07_label44.c ILP32 false +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +LinkedLists forester-heap/sll-circular-2.i ILP32 false +Arrays array-fpi/s1iff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_2_8.i ILP32 false +ECA eca-rers2012/Problem12_label51.c ILP32 false +ProductLines product-lines/email_spec4_product19.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +LinkedLists heap-manipulation/dll_of_dll-2.i ILP32 false +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +Heap list-ext-properties/simple-ext.i ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound5.c ILP32 false +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +ECA eca-rers2012/Problem18_label09.c ILP32 false +ProductLines product-lines/email_spec8_product22.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +LinkedLists list-properties/alternating_list-2.i ILP32 false +Arrays array-examples/standard_allDiff2_ground.i ILP32 false +BitVectors bitvector/byte_add-1.i ILP32 false +Heap ldv-regression/fo_test.i ILP32 false +Loops loop-invariants/linear-inequality-inv-b.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/cast_union_loose.c ILP32 false +ECA eca-programs/Problem102_label02.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +LinkedLists forester-heap/dll-circular-1.i ILP32 false +Arrays array-examples/standard_running-1.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops loops/sum01_bug02.i ILP32 false +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/inv_Newton.c.p+cfa-reducer.c ILP32 false +ECA eca-rers2012/Problem04_label15.c ILP32 false +ProductLines product-lines/elevator_spec3_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-1.i ILP32 false +Arrays array-fpi/eqn4f.c ILP32 false +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/sin_interpolated_index-1.c ILP32 false +ECA eca-rers2012/Problem06_label37.c ILP32 false +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +LinkedLists forester-heap/sll-01-2.i ILP32 false +Arrays array-fpi/indp4f.c ILP32 false +Heap ldv-regression/test25-1.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_1_4.i ILP32 false +ECA eca-rers2012/Problem08_label51.c ILP32 false +ProductLines product-lines/email_spec27_product18.cil.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +LinkedLists forester-heap/sll-queue-2.i ILP32 false +Arrays array-fpi/pcompf.c ILP32 false +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound20.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +ECA eca-rers2012/Problem11_label43.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +LinkedLists forester-heap/sll-token-1.i ILP32 false +Arrays array-fpi/s3iff.c ILP32 false +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound10.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +ECA eca-rers2012/Problem13_label54.c ILP32 false +ProductLines product-lines/email_spec4_product35.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +LinkedLists heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Arrays array-fpi/sqm-iff.c ILP32 false +Heap list-ext-properties/list-ext.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +ECA eca-rers2012/Problem17_label09.c ILP32 false +ProductLines product-lines/email_spec7_product30.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +LinkedLists list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Arrays array-tiling/skippedu.c ILP32 false +Heap list-ext2-properties/simple_and_skiplist_2lvl-1.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound50.c ILP32 false +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats loop-floats-scientific-comp/loop1-2.c ILP32 false +ECA eca-rers2012/Problem19_label21.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +LinkedLists list-properties/list_flag-1.i ILP32 false +Arrays array-examples/sorting_bubblesort_ground-2.i ILP32 false +Heap ldv-regression/test21-2.c ILP32 false +Loops loop-acceleration/diamond_1-2.c ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_float_ptr.c ILP32 false +ECA eca-programs/Problem101_label12.c ILP32 false +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +LinkedLists forester-heap/dll-01-1.i ILP32 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +Heap ldv-regression/test28-1.c ILP32 false +Loops loops/bubble_sort-2.i ILP32 false +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +ECA eca-programs/Problem102_label34.c ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +XCSP xcsp/AllInterval-009.c ILP32 false +LinkedLists forester-heap/dll-optional-2.i ILP32 false +Arrays array-examples/standard_copy9_ground-1.i ILP32 false +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops loops/matrix-2-2.c ILP32 false +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/inv_Newton-2.c ILP32 false +ECA eca-rers2012/Problem03_label28.c ILP32 false +ProductLines product-lines/elevator_spec3_product19.cil.c ILP32 false +XCSP xcsp/AllInterval-013.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Arrays array-fpi/brs3f.c ILP32 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops loops/trex02-2.c ILP32 false +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-benchs/inv_square-1.c ILP32 false +ECA eca-rers2012/Problem05_label01.c ILP32 false +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-017.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-1.i ILP32 false +Arrays array-fpi/eqn1f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/nan_float.c ILP32 false +ECA eca-rers2012/Problem06_label05.c ILP32 false +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +XCSP xcsp/AllInterval-020.c ILP32 false +LinkedLists forester-heap/dll-token-2.i ILP32 false +Arrays array-fpi/ifeqn1f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound5.c ILP32 false +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/sqrt_poly2.c ILP32 false +ECA eca-rers2012/Problem07_label11.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +XCSP xcsp/CostasArray-10.c ILP32 false +LinkedLists forester-heap/sll-buckets-2.i ILP32 false +Arrays array-fpi/indp1f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound50.c ILP32 false +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/float_req_bl_0870a.c ILP32 false +ECA eca-rers2012/Problem08_label15.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +LinkedLists forester-heap/sll-optional-2.i ILP32 false +Arrays array-fpi/modpf.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound1.c ILP32 false +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_1_5.i ILP32 false +ECA eca-rers2012/Problem09_label34.c ILP32 false +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +LinkedLists forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Arrays array-fpi/ncompf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/newton_1_8.i ILP32 false +ECA eca-rers2012/Problem10_label57.c ILP32 false +ProductLines product-lines/email_spec3_product18.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +LinkedLists forester-heap/sll-sorted-1.i ILP32 false +Arrays array-fpi/res2f.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound10.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/newton_2_7.i ILP32 false +ECA eca-rers2012/Problem12_label21.c ILP32 false +ProductLines product-lines/email_spec3_product32.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +LinkedLists heap-manipulation/bubble_sort_linux-2.i ILP32 false +Arrays array-fpi/s2iff.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound10.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_3_6.i ILP32 false +ECA eca-rers2012/Problem13_label25.c ILP32 false +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +LinkedLists heap-manipulation/merge_sort-1.i ILP32 false +Arrays array-fpi/s4iff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/newton_3_8.i ILP32 false +ECA eca-rers2012/Problem15_label30.c ILP32 false +ProductLines product-lines/email_spec6_product16.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +LinkedLists heap-manipulation/tree-2.i ILP32 false +Arrays array-fpi/sina3f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/sine_2.i ILP32 false +ECA eca-rers2012/Problem16_label31.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +LinkedLists list-ext3-properties/sll_length_check-1.i ILP32 false +Arrays array-fpi/ss2f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound10.c ILP32 false +Recursive recursive/Addition02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/square_1.i ILP32 false +ECA eca-rers2012/Problem17_label40.c ILP32 false +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Arrays array-programs/copysome1-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound100.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/square_3.i ILP32 false +ECA eca-rers2012/Problem18_label38.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +LinkedLists list-properties/list-2.i ILP32 false +Arrays reducercommutativity/rangesum10.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound2.c ILP32 false +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +Floats loop-floats-scientific-comp/loop2-1.c ILP32 false +ECA eca-rers2012/Problem19_label51.c ILP32 false +ProductLines product-lines/email_spec9_product31.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +LinkedLists list-properties/simple-1.i ILP32 false +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Loops loop-acceleration/array_2-1.i ILP32 false +Recursive recursive/McCarthy91-1.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/newton_1_6.i ILP32 false +ECA eca-programs/Problem101_label05.c ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-006.c ILP32 false +LinkedLists forester-heap/sll-rb-sentinel-2.i ILP32 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Loops loop-acceleration/simple_2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.UNBOUNDED.pals.c ILP32 false +Floats loop-floats-scientific-comp/loop4.i ILP32 false +ECA eca-programs/Problem101_label18.c ILP32 false +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +LinkedLists heap-manipulation/tree-4.i ILP32 false +Arrays array-examples/standard_copy1_ground-2.i ILP32 false +Loops loops-crafted-1/nested_delay_notd2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem102_label13.c ILP32 false +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +LinkedLists list-properties/splice-1.i ILP32 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Loops loops/count_up_down-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem102_label50.c ILP32 false +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-012.c ILP32 false +Arrays array-examples/standard_copy7_ground-1.i ILP32 false +Loops loops/invert_string-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem103_label56.c ILP32 false +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-014.c ILP32 false +Arrays array-examples/standard_minInArray_ground-1.i ILP32 false +Loops loops/nec20.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem03_label45.c ILP32 false +ProductLines product-lines/elevator_spec3_product23.cil.c ILP32 false +XCSP xcsp/AllInterval-016.c ILP32 false +Arrays array-fpi/brs1f.c ILP32 false +Loops loops/terminator_01.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label35.c ILP32 false +ProductLines product-lines/elevator_spec3_product32.cil.c ILP32 false +XCSP xcsp/AllInterval-018.c ILP32 false +Arrays array-fpi/brs5f.c ILP32 false +Loops loops/vogal-2.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem05_label30.c ILP32 false +ProductLines product-lines/elevator_spec9_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-025.c ILP32 false +Arrays array-fpi/condmf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label55.c ILP32 false +ProductLines product-lines/email_spec0_product31.cil.c ILP32 false +XCSP xcsp/AllInterval-035.c ILP32 false +Arrays array-fpi/eqn2f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem06_label20.c ILP32 false +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +XCSP xcsp/CostasArray-11.c ILP32 false +Arrays array-fpi/eqn5f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem06_label58.c ILP32 false +ProductLines product-lines/email_spec11_product32.cil.c ILP32 false +XCSP xcsp/CostasArray-13.c ILP32 false +Arrays array-fpi/ifeqn2f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem07_label31.c ILP32 false +ProductLines product-lines/email_spec1_product16.cil.c ILP32 false +XCSP xcsp/CostasArray-15.c ILP32 false +Arrays array-fpi/ifeqn5f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem08_label02.c ILP32 false +ProductLines product-lines/email_spec1_product29.cil.c ILP32 false +XCSP xcsp/CostasArray-17.c ILP32 false +Arrays array-fpi/indp2f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem08_label34.c ILP32 false +ProductLines product-lines/email_spec1_product35.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-2.c ILP32 false +Arrays array-fpi/indp5f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label08.c ILP32 false +ProductLines product-lines/email_spec27_product23.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-1.c ILP32 false +Arrays array-fpi/ms1f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label47.c ILP32 false +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +Arrays array-fpi/ms4f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.BOUNDED-12.pals.c ILP32 false +ECA eca-rers2012/Problem10_label41.c ILP32 false +ProductLines product-lines/email_spec27_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-1.c ILP32 false +Arrays array-fpi/nsqm-iff.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem11_label20.c ILP32 false +ProductLines product-lines/email_spec3_product23.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +Arrays array-fpi/res1f.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label06.c ILP32 false +ProductLines product-lines/email_spec3_product29.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-1.c ILP32 false +Arrays array-fpi/res2of.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label37.c ILP32 false +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-3.c ILP32 false +Arrays array-fpi/s1liff.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem13_label11.c ILP32 false +ProductLines product-lines/email_spec4_product24.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-1.c ILP32 false +Arrays array-fpi/s2liff.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.BOUNDED-16.pals.c ILP32 false +ECA eca-rers2012/Problem13_label36.c ILP32 false +ProductLines product-lines/email_spec4_product32.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-4.c ILP32 false +Arrays array-fpi/s3liff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem15_label09.c ILP32 false +ProductLines product-lines/email_spec6_product12.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +Arrays array-fpi/s52iff.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem15_label41.c ILP32 false +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-4.c ILP32 false +Arrays array-fpi/sina1f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem16_label14.c ILP32 false +ProductLines product-lines/email_spec6_product31.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-2.c ILP32 false +Arrays array-fpi/sina4f.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem16_label44.c ILP32 false +ProductLines product-lines/email_spec6_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-4.c ILP32 false +Arrays array-fpi/sqmf.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem17_label26.c ILP32 false +ProductLines product-lines/email_spec7_product32.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-2.c ILP32 false +Arrays array-fpi/ss4f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem17_label55.c ILP32 false +ProductLines product-lines/email_spec8_product16.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-4.c ILP32 false +Arrays array-industry-pattern/array_single_elem_init.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem18_label27.c ILP32 false +ProductLines product-lines/email_spec8_product30.cil.c ILP32 false +Arrays array-programs/copysome2-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem18_label57.c ILP32 false +ProductLines product-lines/email_spec8_productSimulator.cil.c ILP32 false +Arrays reducercommutativity/rangesum.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound10.c ILP32 false +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +ECA eca-rers2012/Problem19_label31.c ILP32 false +ProductLines product-lines/email_spec9_product22.cil.c ILP32 false +Arrays reducercommutativity/rangesum40.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +Sequentialized seq-pthread/cs_stack-2.i ILP32 false +ECA eca-rers2018/Problem12.c ILP32 false +ProductLines product-lines/email_spec9_product34.cil.c ILP32 false +Arrays array-examples/sorting_bubblesort_2_ground.i ILP32 false +Loops loop-acceleration/array_3-2.i ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem101_label02.c ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +Arrays array-examples/sorting_selectionsort_ground-1.i ILP32 false +Loops loop-acceleration/multivar_1-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem101_label08.c ILP32 false +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +Loops loop-acceleration/simple_3-1.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem101_label15.c ILP32 false +ProductLines product-lines/elevator_spec1_product18.cil.c ILP32 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +Loops loop-invgen/id_trans.i ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem101_label21.c ILP32 false +ProductLines product-lines/elevator_spec1_product22.cil.c ILP32 false +Arrays array-examples/standard_copy8_ground-2.i ILP32 false +Loops loops/array-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem102_label06.c ILP32 false +ProductLines product-lines/elevator_spec1_product28.cil.c ILP32 false +Arrays array-examples/standard_partition_ground-1.i ILP32 false +Loops loops/compact.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-programs/Problem102_label25.c ILP32 false +ProductLines product-lines/elevator_spec1_product32.cil.c ILP32 false +Arrays array-fpi/brs2f.c ILP32 false +Loops loops/for_bounded_loop1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem102_label46.c ILP32 false +ProductLines product-lines/elevator_spec2_product20.cil.c ILP32 false +Arrays array-fpi/brs4f.c ILP32 false +Loops loops/linear_search.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem102_label59.c ILP32 false +ProductLines product-lines/elevator_spec2_product26.cil.c ILP32 false +Arrays array-fpi/condaf.c ILP32 false +Loops loops/n.c24.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem103_label51.c ILP32 false +ProductLines product-lines/elevator_spec2_product32.cil.c ILP32 false +Arrays array-fpi/condnf.c ILP32 false +Loops loops/string-2.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem03_label09.c ILP32 false +ProductLines product-lines/elevator_spec3_product03.cil.c ILP32 false +Arrays array-fpi/eqn3f.c ILP32 false +Loops loops/sum03-1.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem03_label37.c ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +Arrays array-fpi/ifcompf.c ILP32 false +Loops loops/trex01-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem04_label04.c ILP32 false +ProductLines product-lines/elevator_spec3_product24.cil.c ILP32 false +Arrays array-fpi/ifeqn3f.c ILP32 false +Loops loops/trex03-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label26.c ILP32 false +ProductLines product-lines/elevator_spec3_product31.cil.c ILP32 false +Arrays array-fpi/ifncompf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label45.c ILP32 false +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +Arrays array-fpi/indp3f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label15.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +Arrays array-fpi/modnf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label36.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +Arrays array-fpi/modsf.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label47.c ILP32 false +ProductLines product-lines/email_spec0_product26.cil.c ILP32 false +Arrays array-fpi/ms2f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem06_label00.c ILP32 false +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +Arrays array-fpi/ms5f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem06_label11.c ILP32 false +ProductLines product-lines/email_spec0_productSimulator.cil.c ILP32 false +Arrays array-fpi/nsqmf.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem06_label27.c ILP32 false +ProductLines product-lines/email_spec11_product20.cil.c ILP32 false +Arrays array-fpi/res1of.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.BOUNDED-12.pals.c ILP32 false +ECA eca-rers2012/Problem06_label47.c ILP32 false +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +Arrays array-fpi/s12iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label05.c ILP32 false +ProductLines product-lines/email_spec11_product33.cil.c ILP32 false +Arrays array-fpi/s22iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label19.c ILP32 false +ProductLines product-lines/email_spec1_product14.cil.c ILP32 false +Arrays array-fpi/s32iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label37.c ILP32 false +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +Arrays array-fpi/s42iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label48.c ILP32 false +ProductLines product-lines/email_spec1_product26.cil.c ILP32 false +Arrays array-fpi/s4liff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.BOUNDED-12.pals.c ILP32 false +ECA eca-rers2012/Problem08_label06.c ILP32 false +ProductLines product-lines/email_spec1_product30.cil.c ILP32 false +Arrays array-fpi/s5iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.BOUNDED-14.pals.c ILP32 false +ECA eca-rers2012/Problem08_label26.c ILP32 false +ProductLines product-lines/email_spec1_product33.cil.c ILP32 false +Arrays array-fpi/sina2f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem08_label46.c ILP32 false +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +Arrays array-fpi/sina5f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label02.c ILP32 false +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +Arrays array-fpi/ss1f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label15.c ILP32 false +ProductLines product-lines/email_spec27_product24.cil.c ILP32 false +Arrays array-fpi/ss3f.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label38.c ILP32 false +ProductLines product-lines/email_spec27_product29.cil.c ILP32 false +Arrays array-fpi/ssinaf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label54.c ILP32 false +ProductLines product-lines/email_spec27_product32.cil.c ILP32 false +Arrays array-industry-pattern/check_removal_from_set_after_insertion.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem10_label26.c ILP32 false +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +Arrays array-tiling/mlceu.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem10_label47.c ILP32 false +ProductLines product-lines/email_spec3_product13.cil.c ILP32 false +Arrays reducercommutativity/rangesum05.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound100.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem11_label08.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +Arrays reducercommutativity/rangesum20.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound20.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem11_label34.c ILP32 false +ProductLines product-lines/email_spec3_product24.cil.c ILP32 false +Arrays reducercommutativity/rangesum60.i ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem11_label58.c ILP32 false +ProductLines product-lines/email_spec3_product28.cil.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label10.c ILP32 false +ProductLines product-lines/email_spec3_product30.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label30.c ILP32 false +ProductLines product-lines/email_spec3_product33.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label40.c ILP32 false +ProductLines product-lines/email_spec3_productSimulator.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound20.c ILP32 false +Sequentialized seq-pthread/cs_fib_longer-2.i ILP32 false +ECA eca-rers2012/Problem13_label04.c ILP32 false +ProductLines product-lines/email_spec4_product23.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +Sequentialized seq-pthread/cs_read_write_lock-2.i ILP32 false +ECA eca-rers2012/Problem13_label19.c ILP32 false +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound10.c ILP32 false +Sequentialized seq-pthread/cs_stateful-1.i ILP32 false +ECA eca-rers2012/Problem13_label30.c ILP32 false +ProductLines product-lines/email_spec4_product31.cil.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem13_label44.c ILP32 false +ProductLines product-lines/email_spec4_product33.cil.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound50.c ILP32 false +ECA eca-rers2012/Problem15_label02.c ILP32 false +ProductLines product-lines/email_spec4_productSimulator.cil.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound10.c ILP32 false +ECA eca-rers2012/Problem15_label22.c ILP32 false +ProductLines product-lines/email_spec6_product14.cil.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem15_label37.c ILP32 false +ProductLines product-lines/email_spec6_product20.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound1.c ILP32 false +ECA eca-rers2012/Problem15_label48.c ILP32 false +ProductLines product-lines/email_spec6_product26.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound100.c ILP32 false +ECA eca-rers2012/Problem16_label05.c ILP32 false +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem16_label20.c ILP32 false +ProductLines product-lines/email_spec6_product32.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound50.c ILP32 false +ECA eca-rers2012/Problem16_label38.c ILP32 false +ProductLines product-lines/email_spec6_product35.cil.c ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +ECA eca-rers2012/Problem16_label52.c ILP32 false +ProductLines product-lines/email_spec7_product28.cil.c ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound2.c ILP32 false +ECA eca-rers2012/Problem17_label20.c ILP32 false +ProductLines product-lines/email_spec7_product31.cil.c ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound5.c ILP32 false +ECA eca-rers2012/Problem17_label33.c ILP32 false +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound1.c ILP32 false +ECA eca-rers2012/Problem17_label50.c ILP32 false +ProductLines product-lines/email_spec7_productSimulator.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound100.c ILP32 false +ECA eca-rers2012/Problem18_label01.c ILP32 false +ProductLines product-lines/email_spec8_product20.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem18_label19.c ILP32 false +ProductLines product-lines/email_spec8_product26.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound50.c ILP32 false +ECA eca-rers2012/Problem18_label33.c ILP32 false +ProductLines product-lines/email_spec8_product31.cil.c ILP32 false +ECA eca-rers2012/Problem18_label49.c ILP32 false +ProductLines product-lines/email_spec8_product34.cil.c ILP32 false +ECA eca-rers2012/Problem19_label14.c ILP32 false +ProductLines product-lines/email_spec9_product15.cil.c ILP32 false +ECA eca-rers2012/Problem19_label27.c ILP32 false +ProductLines product-lines/email_spec9_product21.cil.c ILP32 false +ECA eca-rers2012/Problem19_label42.c ILP32 false +ProductLines product-lines/email_spec9_product26.cil.c ILP32 false +ECA eca-rers2012/Problem19_label58.c ILP32 false +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +ECA eca-rers2018/Problem15.c ILP32 false +ProductLines product-lines/email_spec9_product35.cil.c ILP32 false +ECA eca-programs/Problem101_label00.c ILP32 false +ProductLines product-lines/elevator_spec14_product32.cil.c ILP32 false +ECA eca-programs/Problem101_label03.c ILP32 false +ProductLines product-lines/elevator_spec1_product24.cil.c ILP32 false +ECA eca-programs/Problem101_label06.c ILP32 false +ProductLines product-lines/elevator_spec1_productSimulator.cil.c ILP32 false +ECA eca-programs/Problem101_label10.c ILP32 false +ProductLines product-lines/elevator_spec2_product22.cil.c ILP32 false +ECA eca-programs/Problem101_label13.c ILP32 false +ProductLines product-lines/elevator_spec2_product28.cil.c ILP32 false +ECA eca-programs/Problem101_label16.c ILP32 false +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +ECA eca-programs/Problem101_label19.c ILP32 false +ProductLines product-lines/elevator_spec3_product27.cil.c ILP32 false +ECA eca-programs/Problem101_label23.c ILP32 false +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +ECA eca-programs/Problem102_label04.c ILP32 false +ProductLines product-lines/elevator_spec9_product32.cil.c ILP32 false +ECA eca-programs/Problem102_label07.c ILP32 false +ProductLines product-lines/email_spec0_product21.cil.c ILP32 false +ECA eca-programs/Problem102_label15.c ILP32 false +ProductLines product-lines/email_spec0_product34.cil.c ILP32 false +ECA eca-programs/Problem102_label28.c ILP32 false +ProductLines product-lines/email_spec11_product22.cil.c ILP32 false +ECA eca-programs/Problem102_label37.c ILP32 false +ProductLines product-lines/email_spec11_product35.cil.c ILP32 false +ECA eca-programs/Problem102_label48.c ILP32 false +ProductLines product-lines/email_spec1_product15.cil.c ILP32 false +ECA eca-programs/Problem102_label51.c ILP32 false +ProductLines product-lines/email_spec1_product21.cil.c ILP32 false +ECA eca-programs/Problem103_label35.c ILP32 false +ProductLines product-lines/email_spec1_product31.cil.c ILP32 false +ECA eca-programs/Problem103_label46.c ILP32 false +ProductLines product-lines/email_spec1_product34.cil.c ILP32 false +ECA eca-programs/Problem103_label53.c ILP32 false +ProductLines product-lines/email_spec27_product17.cil.c ILP32 false +ECA eca-programs/Problem103_label57.c ILP32 false +ProductLines product-lines/email_spec27_product25.cil.c ILP32 false +ECA eca-rers2012/Problem03_label26.c ILP32 false +ProductLines product-lines/email_spec27_product30.cil.c ILP32 false +ECA eca-rers2012/Problem03_label31.c ILP32 false +ProductLines product-lines/email_spec27_product33.cil.c ILP32 false +ECA eca-rers2012/Problem03_label39.c ILP32 false +ProductLines product-lines/email_spec3_product17.cil.c ILP32 false +ECA eca-rers2012/Problem03_label50.c ILP32 false +ProductLines product-lines/email_spec3_product25.cil.c ILP32 false +ECA eca-rers2012/Problem04_label09.c ILP32 false +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +ECA eca-rers2012/Problem04_label18.c ILP32 false +ProductLines product-lines/email_spec3_product34.cil.c ILP32 false +ECA eca-rers2012/Problem04_label31.c ILP32 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +ECA eca-rers2012/Problem04_label38.c ILP32 false +ProductLines product-lines/email_spec4_product27.cil.c ILP32 false +ECA eca-rers2012/Problem04_label55.c ILP32 false +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +ECA eca-rers2012/Problem05_label11.c ILP32 false +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +ECA eca-rers2012/Problem05_label24.c ILP32 false +ProductLines product-lines/email_spec6_product21.cil.c ILP32 false +ECA eca-rers2012/Problem05_label32.c ILP32 false +ProductLines product-lines/email_spec6_product28.cil.c ILP32 false +ECA eca-rers2012/Problem05_label38.c ILP32 false +ProductLines product-lines/email_spec6_product33.cil.c ILP32 false +ECA eca-rers2012/Problem05_label41.c ILP32 false +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +ECA eca-rers2012/Problem05_label48.c ILP32 false +ProductLines product-lines/email_spec7_product34.cil.c ILP32 false +ECA eca-rers2012/Problem05_label57.c ILP32 false +ProductLines product-lines/email_spec8_product15.cil.c ILP32 false +ECA eca-rers2012/Problem06_label02.c ILP32 false +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +ECA eca-rers2012/Problem06_label09.c ILP32 false +ProductLines product-lines/email_spec8_product32.cil.c ILP32 false +ECA eca-rers2012/Problem06_label12.c ILP32 false +ProductLines product-lines/email_spec8_product35.cil.c ILP32 false +ECA eca-rers2012/Problem06_label21.c ILP32 false +ProductLines product-lines/email_spec9_product16.cil.c ILP32 false +ECA eca-rers2012/Problem06_label33.c ILP32 false +ProductLines product-lines/email_spec9_product30.cil.c ILP32 false +ECA eca-rers2012/Problem06_label38.c ILP32 false +ProductLines product-lines/email_spec9_product33.cil.c ILP32 false +ECA eca-rers2012/Problem06_label48.c ILP32 false +ProductLines product-lines/email_spec9_productSimulator.cil.c ILP32 false +ECA eca-rers2012/Problem06_label59.c ILP32 false +ECA eca-rers2012/Problem07_label07.c ILP32 false +ECA eca-rers2012/Problem07_label15.c ILP32 false +ECA eca-rers2012/Problem07_label23.c ILP32 false +ECA eca-rers2012/Problem07_label35.c ILP32 false +ECA eca-rers2012/Problem07_label40.c ILP32 false +ECA eca-rers2012/Problem07_label46.c ILP32 false +ECA eca-rers2012/Problem07_label58.c ILP32 false +ECA eca-rers2012/Problem08_label04.c ILP32 false +ECA eca-rers2012/Problem08_label10.c ILP32 false +ECA eca-rers2012/Problem08_label24.c ILP32 false +ECA eca-rers2012/Problem08_label28.c ILP32 false +ECA eca-rers2012/Problem08_label37.c ILP32 false +ECA eca-rers2012/Problem08_label49.c ILP32 false +ECA eca-rers2012/Problem08_label55.c ILP32 false +ECA eca-rers2012/Problem09_label03.c ILP32 false +ECA eca-rers2012/Problem09_label10.c ILP32 false +ECA eca-rers2012/Problem09_label20.c ILP32 false +ECA eca-rers2012/Problem09_label35.c ILP32 false +ECA eca-rers2012/Problem09_label44.c ILP32 false +ECA eca-rers2012/Problem09_label51.c ILP32 false +ECA eca-rers2012/Problem09_label57.c ILP32 false +ECA eca-rers2012/Problem10_label15.c ILP32 false +ECA eca-rers2012/Problem10_label28.c ILP32 false +ECA eca-rers2012/Problem10_label42.c ILP32 false +ECA eca-rers2012/Problem10_label50.c ILP32 false +ECA eca-rers2012/Problem10_label58.c ILP32 false +ECA eca-rers2012/Problem11_label14.c ILP32 false +ECA eca-rers2012/Problem11_label29.c ILP32 false +ECA eca-rers2012/Problem11_label39.c ILP32 false +ECA eca-rers2012/Problem11_label49.c ILP32 false +ECA eca-rers2012/Problem12_label00.c ILP32 false +ECA eca-rers2012/Problem12_label07.c ILP32 false +ECA eca-rers2012/Problem12_label19.c ILP32 false +ECA eca-rers2012/Problem12_label25.c ILP32 false +ECA eca-rers2012/Problem12_label34.c ILP32 false +ECA eca-rers2012/Problem12_label38.c ILP32 false +ECA eca-rers2012/Problem12_label48.c ILP32 false +ECA eca-rers2012/Problem12_label52.c ILP32 false +ECA eca-rers2012/Problem13_label06.c ILP32 false +ECA eca-rers2012/Problem13_label12.c ILP32 false +ECA eca-rers2012/Problem13_label23.c ILP32 false +ECA eca-rers2012/Problem13_label28.c ILP32 false +ECA eca-rers2012/Problem13_label32.c ILP32 false +ECA eca-rers2012/Problem13_label40.c ILP32 false +ECA eca-rers2012/Problem13_label48.c ILP32 false +ECA eca-rers2012/Problem13_label58.c ILP32 false +ECA eca-rers2012/Problem15_label03.c ILP32 false +ECA eca-rers2012/Problem15_label14.c ILP32 false +ECA eca-rers2012/Problem15_label25.c ILP32 false +ECA eca-rers2012/Problem15_label33.c ILP32 false +ECA eca-rers2012/Problem15_label39.c ILP32 false +ECA eca-rers2012/Problem15_label45.c ILP32 false +ECA eca-rers2012/Problem15_label51.c ILP32 false +ECA eca-rers2012/Problem16_label03.c ILP32 false +ECA eca-rers2012/Problem16_label06.c ILP32 false +ECA eca-rers2012/Problem16_label15.c ILP32 false +ECA eca-rers2012/Problem16_label27.c ILP32 false +ECA eca-rers2012/Problem16_label33.c ILP32 false +ECA eca-rers2012/Problem16_label41.c ILP32 false +ECA eca-rers2012/Problem16_label46.c ILP32 false +ECA eca-rers2012/Problem17_label04.c ILP32 false +ECA eca-rers2012/Problem17_label13.c ILP32 false +ECA eca-rers2012/Problem17_label23.c ILP32 false +ECA eca-rers2012/Problem17_label30.c ILP32 false +ECA eca-rers2012/Problem17_label35.c ILP32 false +ECA eca-rers2012/Problem17_label46.c ILP32 false +ECA eca-rers2012/Problem17_label53.c ILP32 false +ECA eca-rers2012/Problem17_label57.c ILP32 false +ECA eca-rers2012/Problem18_label06.c ILP32 false +ECA eca-rers2012/Problem18_label10.c ILP32 false +ECA eca-rers2012/Problem18_label20.c ILP32 false +ECA eca-rers2012/Problem18_label31.c ILP32 false +ECA eca-rers2012/Problem18_label35.c ILP32 false +ECA eca-rers2012/Problem18_label39.c ILP32 false +ECA eca-rers2012/Problem18_label52.c ILP32 false +ECA eca-rers2012/Problem19_label10.c ILP32 false +ECA eca-rers2012/Problem19_label18.c ILP32 false +ECA eca-rers2012/Problem19_label22.c ILP32 false +ECA eca-rers2012/Problem19_label28.c ILP32 false +ECA eca-rers2012/Problem19_label32.c ILP32 false +ECA eca-rers2012/Problem19_label47.c ILP32 false +ECA eca-rers2012/Problem19_label53.c ILP32 false +ECA eca-rers2018/Problem10.c ILP32 false +ECA eca-rers2018/Problem13.c ILP32 false +ECA eca-rers2018/Problem17.c ILP32 false +ECA eca-programs/Problem101_label01.c ILP32 false +ECA eca-programs/Problem101_label04.c ILP32 false +ECA eca-programs/Problem101_label07.c ILP32 false +ECA eca-programs/Problem101_label09.c ILP32 false +ECA eca-programs/Problem101_label11.c ILP32 false +ECA eca-programs/Problem101_label14.c ILP32 false +ECA eca-programs/Problem101_label17.c ILP32 false +ECA eca-programs/Problem101_label20.c ILP32 false +ECA eca-programs/Problem101_label22.c ILP32 false +ECA eca-programs/Problem102_label01.c ILP32 false +ECA eca-programs/Problem102_label05.c ILP32 false +ECA eca-programs/Problem102_label10.c ILP32 false +ECA eca-programs/Problem102_label24.c ILP32 false +ECA eca-programs/Problem102_label26.c ILP32 false +ECA eca-programs/Problem102_label29.c ILP32 false +ECA eca-programs/Problem102_label43.c ILP32 false +ECA eca-programs/Problem102_label49.c ILP32 false +ECA eca-programs/Problem102_label55.c ILP32 false +ECA eca-programs/Problem103_label32.c ILP32 false +ECA eca-programs/Problem103_label41.c ILP32 false +ECA eca-programs/Problem103_label47.c ILP32 false +ECA eca-programs/Problem103_label54.c ILP32 false +ECA eca-programs/Problem103_label59.c ILP32 false +ECA eca-rers2012/Problem03_label13.c ILP32 false +ECA eca-rers2012/Problem03_label27.c ILP32 false +ECA eca-rers2012/Problem03_label35.c ILP32 false +ECA eca-rers2012/Problem03_label43.c ILP32 false +ECA eca-rers2012/Problem03_label52.c ILP32 false +ECA eca-rers2012/Problem04_label06.c ILP32 false +ECA eca-rers2012/Problem04_label13.c ILP32 false +ECA eca-rers2012/Problem04_label19.c ILP32 false +ECA eca-rers2012/Problem04_label32.c ILP32 false +ECA eca-rers2012/Problem04_label39.c ILP32 false +ECA eca-rers2012/Problem04_label52.c ILP32 false +ECA eca-rers2012/Problem05_label00.c ILP32 false +ECA eca-rers2012/Problem05_label13.c ILP32 false +ECA eca-rers2012/Problem05_label18.c ILP32 false +ECA eca-rers2012/Problem05_label26.c ILP32 false +ECA eca-rers2012/Problem05_label33.c ILP32 false +ECA eca-rers2012/Problem05_label37.c ILP32 false +ECA eca-rers2012/Problem05_label39.c ILP32 false +ECA eca-rers2012/Problem05_label44.c ILP32 false +ECA eca-rers2012/Problem05_label51.c ILP32 false +ECA eca-rers2012/Problem05_label58.c ILP32 false +ECA eca-rers2012/Problem06_label01.c ILP32 false +ECA eca-rers2012/Problem06_label04.c ILP32 false +ECA eca-rers2012/Problem06_label10.c ILP32 false +ECA eca-rers2012/Problem06_label15.c ILP32 false +ECA eca-rers2012/Problem06_label24.c ILP32 false +ECA eca-rers2012/Problem06_label29.c ILP32 false +ECA eca-rers2012/Problem06_label36.c ILP32 false +ECA eca-rers2012/Problem06_label44.c ILP32 false +ECA eca-rers2012/Problem06_label56.c ILP32 false +ECA eca-rers2012/Problem07_label03.c ILP32 false +ECA eca-rers2012/Problem07_label06.c ILP32 false +ECA eca-rers2012/Problem07_label09.c ILP32 false +ECA eca-rers2012/Problem07_label18.c ILP32 false +ECA eca-rers2012/Problem07_label20.c ILP32 false +ECA eca-rers2012/Problem07_label30.c ILP32 false +ECA eca-rers2012/Problem07_label36.c ILP32 false +ECA eca-rers2012/Problem07_label39.c ILP32 false +ECA eca-rers2012/Problem07_label42.c ILP32 false +ECA eca-rers2012/Problem07_label47.c ILP32 false +ECA eca-rers2012/Problem08_label01.c ILP32 false +ECA eca-rers2012/Problem08_label05.c ILP32 false +ECA eca-rers2012/Problem08_label07.c ILP32 false +ECA eca-rers2012/Problem08_label13.c ILP32 false +ECA eca-rers2012/Problem08_label25.c ILP32 false +ECA eca-rers2012/Problem08_label29.c ILP32 false +ECA eca-rers2012/Problem08_label43.c ILP32 false +ECA eca-rers2012/Problem08_label48.c ILP32 false +ECA eca-rers2012/Problem08_label50.c ILP32 false +ECA eca-rers2012/Problem08_label59.c ILP32 false +ECA eca-rers2012/Problem09_label06.c ILP32 false +ECA eca-rers2012/Problem09_label11.c ILP32 false +ECA eca-rers2012/Problem09_label19.c ILP32 false +ECA eca-rers2012/Problem09_label32.c ILP32 false +ECA eca-rers2012/Problem09_label36.c ILP32 false +ECA eca-rers2012/Problem09_label41.c ILP32 false +ECA eca-rers2012/Problem09_label46.c ILP32 false +ECA eca-rers2012/Problem09_label53.c ILP32 false +ECA eca-rers2012/Problem09_label56.c ILP32 false +ECA eca-rers2012/Problem09_label59.c ILP32 false +ECA eca-rers2012/Problem10_label24.c ILP32 false +ECA eca-rers2012/Problem10_label29.c ILP32 false +ECA eca-rers2012/Problem10_label46.c ILP32 false +ECA eca-rers2012/Problem10_label48.c ILP32 false +ECA eca-rers2012/Problem10_label55.c ILP32 false +ECA eca-rers2012/Problem11_label00.c ILP32 false +ECA eca-rers2012/Problem11_label15.c ILP32 false +ECA eca-rers2012/Problem11_label31.c ILP32 false +ECA eca-rers2012/Problem11_label36.c ILP32 false +ECA eca-rers2012/Problem11_label42.c ILP32 false +ECA eca-rers2012/Problem11_label51.c ILP32 false +ECA eca-rers2012/Problem12_label03.c ILP32 false +ECA eca-rers2012/Problem12_label08.c ILP32 false +ECA eca-rers2012/Problem12_label13.c ILP32 false +ECA eca-rers2012/Problem12_label20.c ILP32 false +ECA eca-rers2012/Problem12_label28.c ILP32 false +ECA eca-rers2012/Problem12_label35.c ILP32 false +ECA eca-rers2012/Problem12_label39.c ILP32 false +ECA eca-rers2012/Problem12_label42.c ILP32 false +ECA eca-rers2012/Problem12_label50.c ILP32 false +ECA eca-rers2012/Problem12_label55.c ILP32 false +ECA eca-rers2012/Problem13_label07.c ILP32 false +ECA eca-rers2012/Problem13_label16.c ILP32 false +ECA eca-rers2012/Problem13_label21.c ILP32 false +ECA eca-rers2012/Problem13_label24.c ILP32 false +ECA eca-rers2012/Problem13_label29.c ILP32 false +ECA eca-rers2012/Problem13_label35.c ILP32 false +ECA eca-rers2012/Problem13_label43.c ILP32 false +ECA eca-rers2012/Problem13_label45.c ILP32 false +ECA eca-rers2012/Problem13_label51.c ILP32 false +ECA eca-rers2012/Problem15_label00.c ILP32 false +ECA eca-rers2012/Problem15_label07.c ILP32 false +ECA eca-rers2012/Problem15_label15.c ILP32 false +ECA eca-rers2012/Problem15_label23.c ILP32 false +ECA eca-rers2012/Problem15_label29.c ILP32 false +ECA eca-rers2012/Problem15_label34.c ILP32 false +ECA eca-rers2012/Problem15_label38.c ILP32 false +ECA eca-rers2012/Problem15_label40.c ILP32 false +ECA eca-rers2012/Problem15_label47.c ILP32 false +ECA eca-rers2012/Problem15_label50.c ILP32 false +ECA eca-rers2012/Problem16_label00.c ILP32 false +ECA eca-rers2012/Problem16_label04.c ILP32 false +ECA eca-rers2012/Problem16_label08.c ILP32 false +ECA eca-rers2012/Problem16_label18.c ILP32 false +ECA eca-rers2012/Problem16_label22.c ILP32 false +ECA eca-rers2012/Problem16_label30.c ILP32 false +ECA eca-rers2012/Problem16_label37.c ILP32 false +ECA eca-rers2012/Problem16_label43.c ILP32 false +ECA eca-rers2012/Problem16_label51.c ILP32 false +ECA eca-rers2012/Problem16_label54.c ILP32 false +ECA eca-rers2012/Problem17_label07.c ILP32 false +ECA eca-rers2012/Problem17_label16.c ILP32 false +ECA eca-rers2012/Problem17_label25.c ILP32 false +ECA eca-rers2012/Problem17_label31.c ILP32 false +ECA eca-rers2012/Problem17_label34.c ILP32 false +ECA eca-rers2012/Problem17_label37.c ILP32 false +ECA eca-rers2012/Problem17_label49.c ILP32 false +ECA eca-rers2012/Problem17_label52.c ILP32 false +ECA eca-rers2012/Problem17_label54.c ILP32 false +ECA eca-rers2012/Problem18_label00.c ILP32 false +ECA eca-rers2012/Problem18_label03.c ILP32 false +ECA eca-rers2012/Problem18_label08.c ILP32 false diff --git a/tests/testcomp/corpus/cover-error.tsv b/tests/testcomp/corpus/cover-error.tsv new file mode 100644 index 000000000..c6666ecb9 --- /dev/null +++ b/tests/testcomp/corpus/cover-error.tsv @@ -0,0 +1,819 @@ +# category program data_model expected_unreach +Arrays array-fpi/ms3f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +ECA eca-rers2012/Problem10_label12.c ILP32 false +ProductLines product-lines/email_spec27_product34.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +LinkedLists forester-heap/sll-simple-white-blue-2.i ILP32 false +Arrays array-fpi/condgf.c ILP32 false +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound10.c ILP32 false +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-benchs/nan_double.c ILP32 false +ECA eca-rers2012/Problem05_label40.c ILP32 false +ProductLines product-lines/email_spec0_product22.cil.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +LinkedLists forester-heap/dll-sorted-1.i ILP32 false +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Heap ldv-sets/test_mutex_unlock_at_exit.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound100.c ILP32 false +Recursive recursive-simple/id_o3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/sine_1.i ILP32 false +ECA eca-rers2012/Problem16_label01.c ILP32 false +ProductLines product-lines/email_spec6_product29.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +LinkedLists list-ext3-properties/dll_nullified-1.i ILP32 false +Arrays array-examples/standard_copy6_ground-1.i ILP32 false +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +Heap ldv-regression/rule57_ebda_blast_2.i ILP32 false +Loops loops/insertion_sort-1-2.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/float_int_inv_square.c ILP32 false +ECA eca-programs/Problem103_label44.c ILP32 false +ProductLines product-lines/elevator_spec2_product30.cil.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +LinkedLists forester-heap/dll-queue-2.i ILP32 false +Arrays array-fpi/ifeqn4f.c ILP32 false +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-newlib/double_req_bl_0870a.c ILP32 false +ECA eca-rers2012/Problem07_label44.c ILP32 false +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +LinkedLists forester-heap/sll-circular-2.i ILP32 false +Arrays array-fpi/s1iff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_2_8.i ILP32 false +ECA eca-rers2012/Problem12_label51.c ILP32 false +ProductLines product-lines/email_spec4_product19.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +LinkedLists heap-manipulation/dll_of_dll-2.i ILP32 false +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +Heap list-ext-properties/simple-ext.i ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound5.c ILP32 false +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +ECA eca-rers2012/Problem18_label09.c ILP32 false +ProductLines product-lines/email_spec8_product22.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +LinkedLists list-properties/alternating_list-2.i ILP32 false +Arrays array-examples/standard_allDiff2_ground.i ILP32 false +BitVectors bitvector/byte_add-1.i ILP32 false +Heap ldv-regression/fo_test.i ILP32 false +Loops loop-invariants/linear-inequality-inv-b.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/cast_union_loose.c ILP32 false +ECA eca-programs/Problem102_label02.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +LinkedLists forester-heap/dll-circular-1.i ILP32 false +Arrays array-examples/standard_running-1.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops loops/sum01_bug02.i ILP32 false +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-benchs/inv_Newton.c.p+cfa-reducer.c ILP32 false +ECA eca-rers2012/Problem04_label15.c ILP32 false +ProductLines product-lines/elevator_spec3_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +LinkedLists forester-heap/dll-rb-sentinel-1.i ILP32 false +Arrays array-fpi/eqn4f.c ILP32 false +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/sin_interpolated_index-1.c ILP32 false +ECA eca-rers2012/Problem06_label37.c ILP32 false +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +LinkedLists forester-heap/sll-01-2.i ILP32 false +Arrays array-fpi/indp4f.c ILP32 false +Heap ldv-regression/test25-1.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_1_4.i ILP32 false +ECA eca-rers2012/Problem08_label51.c ILP32 false +ProductLines product-lines/email_spec27_product18.cil.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +LinkedLists forester-heap/sll-queue-2.i ILP32 false +Arrays array-fpi/pcompf.c ILP32 false +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound20.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +ECA eca-rers2012/Problem11_label43.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +LinkedLists forester-heap/sll-token-1.i ILP32 false +Arrays array-fpi/s3iff.c ILP32 false +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound10.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +ECA eca-rers2012/Problem13_label54.c ILP32 false +ProductLines product-lines/email_spec4_product35.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +LinkedLists heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Arrays array-fpi/sqm-iff.c ILP32 false +Heap list-ext-properties/list-ext.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +ECA eca-rers2012/Problem17_label09.c ILP32 false +ProductLines product-lines/email_spec7_product30.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +LinkedLists list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Arrays array-tiling/skippedu.c ILP32 false +Heap list-ext2-properties/simple_and_skiplist_2lvl-1.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound50.c ILP32 false +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Floats loop-floats-scientific-comp/loop1-2.c ILP32 false +ECA eca-rers2012/Problem19_label21.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +LinkedLists list-properties/list_flag-1.i ILP32 false +Arrays array-examples/sorting_bubblesort_ground-2.i ILP32 false +Heap ldv-regression/test21-2.c ILP32 false +Loops loop-acceleration/diamond_1-2.c ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_float_ptr.c ILP32 false +ECA eca-programs/Problem101_label12.c ILP32 false +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +LinkedLists forester-heap/dll-01-1.i ILP32 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +Heap ldv-regression/test28-1.c ILP32 false +Loops loops/bubble_sort-2.i ILP32 false +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +ECA eca-programs/Problem102_label34.c ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +XCSP xcsp/AllInterval-009.c ILP32 false +LinkedLists forester-heap/dll-optional-2.i ILP32 false +Arrays array-examples/standard_copy9_ground-1.i ILP32 false +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops loops/matrix-2-2.c ILP32 false +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/inv_Newton-2.c ILP32 false +ECA eca-rers2012/Problem03_label28.c ILP32 false +ProductLines product-lines/elevator_spec3_product19.cil.c ILP32 false +XCSP xcsp/AllInterval-013.c ILP32 false +LinkedLists forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Arrays array-fpi/brs3f.c ILP32 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops loops/trex02-2.c ILP32 false +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats float-benchs/inv_square-1.c ILP32 false +ECA eca-rers2012/Problem05_label01.c ILP32 false +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +XCSP xcsp/AllInterval-017.c ILP32 false +LinkedLists forester-heap/dll-simple-white-blue-1.i ILP32 false +Arrays array-fpi/eqn1f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +Floats float-benchs/nan_float.c ILP32 false +ECA eca-rers2012/Problem06_label05.c ILP32 false +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +XCSP xcsp/AllInterval-020.c ILP32 false +LinkedLists forester-heap/dll-token-2.i ILP32 false +Arrays array-fpi/ifeqn1f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound5.c ILP32 false +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats float-benchs/sqrt_poly2.c ILP32 false +ECA eca-rers2012/Problem07_label11.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +XCSP xcsp/CostasArray-10.c ILP32 false +LinkedLists forester-heap/sll-buckets-2.i ILP32 false +Arrays array-fpi/indp1f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound50.c ILP32 false +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats float-newlib/float_req_bl_0870a.c ILP32 false +ECA eca-rers2012/Problem08_label15.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +LinkedLists forester-heap/sll-optional-2.i ILP32 false +Arrays array-fpi/modpf.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound1.c ILP32 false +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_1_5.i ILP32 false +ECA eca-rers2012/Problem09_label34.c ILP32 false +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +LinkedLists forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Arrays array-fpi/ncompf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/newton_1_8.i ILP32 false +ECA eca-rers2012/Problem10_label57.c ILP32 false +ProductLines product-lines/email_spec3_product18.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +LinkedLists forester-heap/sll-sorted-1.i ILP32 false +Arrays array-fpi/res2f.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound10.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/newton_2_7.i ILP32 false +ECA eca-rers2012/Problem12_label21.c ILP32 false +ProductLines product-lines/email_spec3_product32.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +LinkedLists heap-manipulation/bubble_sort_linux-2.i ILP32 false +Arrays array-fpi/s2iff.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound10.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.UNBOUNDED.pals.c ILP32 false +Floats floats-cdfpl/newton_3_6.i ILP32 false +ECA eca-rers2012/Problem13_label25.c ILP32 false +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +LinkedLists heap-manipulation/merge_sort-1.i ILP32 false +Arrays array-fpi/s4iff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Floats floats-cdfpl/newton_3_8.i ILP32 false +ECA eca-rers2012/Problem15_label30.c ILP32 false +ProductLines product-lines/email_spec6_product16.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +LinkedLists heap-manipulation/tree-2.i ILP32 false +Arrays array-fpi/sina3f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/sine_2.i ILP32 false +ECA eca-rers2012/Problem16_label31.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +LinkedLists list-ext3-properties/sll_length_check-1.i ILP32 false +Arrays array-fpi/ss2f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound10.c ILP32 false +Recursive recursive/Addition02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Floats floats-cdfpl/square_1.i ILP32 false +ECA eca-rers2012/Problem17_label40.c ILP32 false +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +LinkedLists list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Arrays array-programs/copysome1-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound100.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/square_3.i ILP32 false +ECA eca-rers2012/Problem18_label38.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +LinkedLists list-properties/list-2.i ILP32 false +Arrays reducercommutativity/rangesum10.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound2.c ILP32 false +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +Floats loop-floats-scientific-comp/loop2-1.c ILP32 false +ECA eca-rers2012/Problem19_label51.c ILP32 false +ProductLines product-lines/email_spec9_product31.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +LinkedLists list-properties/simple-1.i ILP32 false +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Loops loop-acceleration/array_2-1.i ILP32 false +Recursive recursive/McCarthy91-1.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +Floats floats-cdfpl/newton_1_6.i ILP32 false +ECA eca-programs/Problem101_label05.c ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-006.c ILP32 false +LinkedLists forester-heap/sll-rb-sentinel-2.i ILP32 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Loops loop-acceleration/simple_2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.UNBOUNDED.pals.c ILP32 false +Floats loop-floats-scientific-comp/loop4.i ILP32 false +ECA eca-programs/Problem101_label18.c ILP32 false +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +LinkedLists heap-manipulation/tree-4.i ILP32 false +Arrays array-examples/standard_copy1_ground-2.i ILP32 false +Loops loops-crafted-1/nested_delay_notd2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem102_label13.c ILP32 false +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +LinkedLists list-properties/splice-1.i ILP32 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Loops loops/count_up_down-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem102_label50.c ILP32 false +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +XCSP xcsp/AllInterval-012.c ILP32 false +Arrays array-examples/standard_copy7_ground-1.i ILP32 false +Loops loops/invert_string-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem103_label56.c ILP32 false +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-014.c ILP32 false +Arrays array-examples/standard_minInArray_ground-1.i ILP32 false +Loops loops/nec20.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem03_label45.c ILP32 false +ProductLines product-lines/elevator_spec3_product23.cil.c ILP32 false +XCSP xcsp/AllInterval-016.c ILP32 false +Arrays array-fpi/brs1f.c ILP32 false +Loops loops/terminator_01.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label35.c ILP32 false +ProductLines product-lines/elevator_spec3_product32.cil.c ILP32 false +XCSP xcsp/AllInterval-018.c ILP32 false +Arrays array-fpi/brs5f.c ILP32 false +Loops loops/vogal-2.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem05_label30.c ILP32 false +ProductLines product-lines/elevator_spec9_productSimulator.cil.c ILP32 false +XCSP xcsp/AllInterval-025.c ILP32 false +Arrays array-fpi/condmf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label55.c ILP32 false +ProductLines product-lines/email_spec0_product31.cil.c ILP32 false +XCSP xcsp/AllInterval-035.c ILP32 false +Arrays array-fpi/eqn2f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem06_label20.c ILP32 false +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +XCSP xcsp/CostasArray-11.c ILP32 false +Arrays array-fpi/eqn5f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem06_label58.c ILP32 false +ProductLines product-lines/email_spec11_product32.cil.c ILP32 false +XCSP xcsp/CostasArray-13.c ILP32 false +Arrays array-fpi/ifeqn2f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem07_label31.c ILP32 false +ProductLines product-lines/email_spec1_product16.cil.c ILP32 false +XCSP xcsp/CostasArray-15.c ILP32 false +Arrays array-fpi/ifeqn5f.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem08_label02.c ILP32 false +ProductLines product-lines/email_spec1_product29.cil.c ILP32 false +XCSP xcsp/CostasArray-17.c ILP32 false +Arrays array-fpi/indp2f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem08_label34.c ILP32 false +ProductLines product-lines/email_spec1_product35.cil.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-2.c ILP32 false +Arrays array-fpi/indp5f.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label08.c ILP32 false +ProductLines product-lines/email_spec27_product23.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-1.c ILP32 false +Arrays array-fpi/ms1f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label47.c ILP32 false +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +Arrays array-fpi/ms4f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.BOUNDED-12.pals.c ILP32 false +ECA eca-rers2012/Problem10_label41.c ILP32 false +ProductLines product-lines/email_spec27_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-1.c ILP32 false +Arrays array-fpi/nsqm-iff.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem11_label20.c ILP32 false +ProductLines product-lines/email_spec3_product23.cil.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +Arrays array-fpi/res1f.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label06.c ILP32 false +ProductLines product-lines/email_spec3_product29.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-1.c ILP32 false +Arrays array-fpi/res2of.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label37.c ILP32 false +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-3.c ILP32 false +Arrays array-fpi/s1liff.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem13_label11.c ILP32 false +ProductLines product-lines/email_spec4_product24.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-1.c ILP32 false +Arrays array-fpi/s2liff.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.BOUNDED-16.pals.c ILP32 false +ECA eca-rers2012/Problem13_label36.c ILP32 false +ProductLines product-lines/email_spec4_product32.cil.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-4.c ILP32 false +Arrays array-fpi/s3liff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem15_label09.c ILP32 false +ProductLines product-lines/email_spec6_product12.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +Arrays array-fpi/s52iff.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-rers2012/Problem15_label41.c ILP32 false +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-4.c ILP32 false +Arrays array-fpi/sina1f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem16_label14.c ILP32 false +ProductLines product-lines/email_spec6_product31.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-2.c ILP32 false +Arrays array-fpi/sina4f.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem16_label44.c ILP32 false +ProductLines product-lines/email_spec6_productSimulator.cil.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-4.c ILP32 false +Arrays array-fpi/sqmf.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem17_label26.c ILP32 false +ProductLines product-lines/email_spec7_product32.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-2.c ILP32 false +Arrays array-fpi/ss4f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem17_label55.c ILP32 false +ProductLines product-lines/email_spec8_product16.cil.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-4.c ILP32 false +Arrays array-industry-pattern/array_single_elem_init.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem18_label27.c ILP32 false +ProductLines product-lines/email_spec8_product30.cil.c ILP32 false +Arrays array-programs/copysome2-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem18_label57.c ILP32 false +ProductLines product-lines/email_spec8_productSimulator.cil.c ILP32 false +Arrays reducercommutativity/rangesum.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound10.c ILP32 false +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +ECA eca-rers2012/Problem19_label31.c ILP32 false +ProductLines product-lines/email_spec9_product22.cil.c ILP32 false +Arrays reducercommutativity/rangesum40.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +Sequentialized seq-pthread/cs_stack-2.i ILP32 false +ECA eca-rers2018/Problem12.c ILP32 false +ProductLines product-lines/email_spec9_product34.cil.c ILP32 false +Arrays array-examples/sorting_bubblesort_2_ground.i ILP32 false +Loops loop-acceleration/array_3-2.i ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem101_label02.c ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +Arrays array-examples/sorting_selectionsort_ground-1.i ILP32 false +Loops loop-acceleration/multivar_1-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-programs/Problem101_label08.c ILP32 false +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +Loops loop-acceleration/simple_3-1.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem101_label15.c ILP32 false +ProductLines product-lines/elevator_spec1_product18.cil.c ILP32 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +Loops loop-invgen/id_trans.i ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem101_label21.c ILP32 false +ProductLines product-lines/elevator_spec1_product22.cil.c ILP32 false +Arrays array-examples/standard_copy8_ground-2.i ILP32 false +Loops loops/array-2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem102_label06.c ILP32 false +ProductLines product-lines/elevator_spec1_product28.cil.c ILP32 false +Arrays array-examples/standard_partition_ground-1.i ILP32 false +Loops loops/compact.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +ECA eca-programs/Problem102_label25.c ILP32 false +ProductLines product-lines/elevator_spec1_product32.cil.c ILP32 false +Arrays array-fpi/brs2f.c ILP32 false +Loops loops/for_bounded_loop1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem102_label46.c ILP32 false +ProductLines product-lines/elevator_spec2_product20.cil.c ILP32 false +Arrays array-fpi/brs4f.c ILP32 false +Loops loops/linear_search.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem102_label59.c ILP32 false +ProductLines product-lines/elevator_spec2_product26.cil.c ILP32 false +Arrays array-fpi/condaf.c ILP32 false +Loops loops/n.c24.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-programs/Problem103_label51.c ILP32 false +ProductLines product-lines/elevator_spec2_product32.cil.c ILP32 false +Arrays array-fpi/condnf.c ILP32 false +Loops loops/string-2.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem03_label09.c ILP32 false +ProductLines product-lines/elevator_spec3_product03.cil.c ILP32 false +Arrays array-fpi/eqn3f.c ILP32 false +Loops loops/sum03-1.i ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem03_label37.c ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +Arrays array-fpi/ifcompf.c ILP32 false +Loops loops/trex01-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem04_label04.c ILP32 false +ProductLines product-lines/elevator_spec3_product24.cil.c ILP32 false +Arrays array-fpi/ifeqn3f.c ILP32 false +Loops loops/trex03-1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label26.c ILP32 false +ProductLines product-lines/elevator_spec3_product31.cil.c ILP32 false +Arrays array-fpi/ifncompf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem04_label45.c ILP32 false +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +Arrays array-fpi/indp3f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label15.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +Arrays array-fpi/modnf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label36.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +Arrays array-fpi/modsf.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem05_label47.c ILP32 false +ProductLines product-lines/email_spec0_product26.cil.c ILP32 false +Arrays array-fpi/ms2f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem06_label00.c ILP32 false +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +Arrays array-fpi/ms5f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem06_label11.c ILP32 false +ProductLines product-lines/email_spec0_productSimulator.cil.c ILP32 false +Arrays array-fpi/nsqmf.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem06_label27.c ILP32 false +ProductLines product-lines/email_spec11_product20.cil.c ILP32 false +Arrays array-fpi/res1of.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.BOUNDED-12.pals.c ILP32 false +ECA eca-rers2012/Problem06_label47.c ILP32 false +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +Arrays array-fpi/s12iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label05.c ILP32 false +ProductLines product-lines/email_spec11_product33.cil.c ILP32 false +Arrays array-fpi/s22iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label19.c ILP32 false +ProductLines product-lines/email_spec1_product14.cil.c ILP32 false +Arrays array-fpi/s32iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label37.c ILP32 false +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +Arrays array-fpi/s42iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem07_label48.c ILP32 false +ProductLines product-lines/email_spec1_product26.cil.c ILP32 false +Arrays array-fpi/s4liff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.BOUNDED-12.pals.c ILP32 false +ECA eca-rers2012/Problem08_label06.c ILP32 false +ProductLines product-lines/email_spec1_product30.cil.c ILP32 false +Arrays array-fpi/s5iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.BOUNDED-14.pals.c ILP32 false +ECA eca-rers2012/Problem08_label26.c ILP32 false +ProductLines product-lines/email_spec1_product33.cil.c ILP32 false +Arrays array-fpi/sina2f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem08_label46.c ILP32 false +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +Arrays array-fpi/sina5f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label02.c ILP32 false +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +Arrays array-fpi/ss1f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound50.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label15.c ILP32 false +ProductLines product-lines/email_spec27_product24.cil.c ILP32 false +Arrays array-fpi/ss3f.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound10.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label38.c ILP32 false +ProductLines product-lines/email_spec27_product29.cil.c ILP32 false +Arrays array-fpi/ssinaf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem09_label54.c ILP32 false +ProductLines product-lines/email_spec27_product32.cil.c ILP32 false +Arrays array-industry-pattern/check_removal_from_set_after_insertion.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound5.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem10_label26.c ILP32 false +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +Arrays array-tiling/mlceu.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +ECA eca-rers2012/Problem10_label47.c ILP32 false +ProductLines product-lines/email_spec3_product13.cil.c ILP32 false +Arrays reducercommutativity/rangesum05.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound100.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem11_label08.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +Arrays reducercommutativity/rangesum20.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound20.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem11_label34.c ILP32 false +ProductLines product-lines/email_spec3_product24.cil.c ILP32 false +Arrays reducercommutativity/rangesum60.i ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +ECA eca-rers2012/Problem11_label58.c ILP32 false +ProductLines product-lines/email_spec3_product28.cil.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label10.c ILP32 false +ProductLines product-lines/email_spec3_product30.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label30.c ILP32 false +ProductLines product-lines/email_spec3_product33.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound100.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +ECA eca-rers2012/Problem12_label40.c ILP32 false +ProductLines product-lines/email_spec3_productSimulator.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound20.c ILP32 false +Sequentialized seq-pthread/cs_fib_longer-2.i ILP32 false +ECA eca-rers2012/Problem13_label04.c ILP32 false +ProductLines product-lines/email_spec4_product23.cil.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +Sequentialized seq-pthread/cs_read_write_lock-2.i ILP32 false +ECA eca-rers2012/Problem13_label19.c ILP32 false +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound10.c ILP32 false +Sequentialized seq-pthread/cs_stateful-1.i ILP32 false +ECA eca-rers2012/Problem13_label30.c ILP32 false +ProductLines product-lines/email_spec4_product31.cil.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem13_label44.c ILP32 false +ProductLines product-lines/email_spec4_product33.cil.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound50.c ILP32 false +ECA eca-rers2012/Problem15_label02.c ILP32 false +ProductLines product-lines/email_spec4_productSimulator.cil.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound10.c ILP32 false +ECA eca-rers2012/Problem15_label22.c ILP32 false +ProductLines product-lines/email_spec6_product14.cil.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem15_label37.c ILP32 false +ProductLines product-lines/email_spec6_product20.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound1.c ILP32 false +ECA eca-rers2012/Problem15_label48.c ILP32 false +ProductLines product-lines/email_spec6_product26.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound100.c ILP32 false +ECA eca-rers2012/Problem16_label05.c ILP32 false +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem16_label20.c ILP32 false +ProductLines product-lines/email_spec6_product32.cil.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound50.c ILP32 false +ECA eca-rers2012/Problem16_label38.c ILP32 false +ProductLines product-lines/email_spec6_product35.cil.c ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +ECA eca-rers2012/Problem16_label52.c ILP32 false +ProductLines product-lines/email_spec7_product28.cil.c ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound2.c ILP32 false +ECA eca-rers2012/Problem17_label20.c ILP32 false +ProductLines product-lines/email_spec7_product31.cil.c ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound5.c ILP32 false +ECA eca-rers2012/Problem17_label33.c ILP32 false +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound1.c ILP32 false +ECA eca-rers2012/Problem17_label50.c ILP32 false +ProductLines product-lines/email_spec7_productSimulator.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound100.c ILP32 false +ECA eca-rers2012/Problem18_label01.c ILP32 false +ProductLines product-lines/email_spec8_product20.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound20.c ILP32 false +ECA eca-rers2012/Problem18_label19.c ILP32 false +ProductLines product-lines/email_spec8_product26.cil.c ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound50.c ILP32 false +ECA eca-rers2012/Problem18_label33.c ILP32 false +ProductLines product-lines/email_spec8_product31.cil.c ILP32 false +ECA eca-rers2012/Problem18_label49.c ILP32 false +ProductLines product-lines/email_spec8_product34.cil.c ILP32 false +ECA eca-rers2012/Problem19_label14.c ILP32 false +ProductLines product-lines/email_spec9_product15.cil.c ILP32 false +ECA eca-rers2012/Problem19_label27.c ILP32 false +ProductLines product-lines/email_spec9_product21.cil.c ILP32 false +ECA eca-rers2012/Problem19_label42.c ILP32 false +ProductLines product-lines/email_spec9_product26.cil.c ILP32 false +ECA eca-rers2012/Problem19_label58.c ILP32 false +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +ECA eca-rers2018/Problem15.c ILP32 false +ProductLines product-lines/email_spec9_product35.cil.c ILP32 false +ECA eca-programs/Problem101_label00.c ILP32 false +ProductLines product-lines/elevator_spec14_product32.cil.c ILP32 false +ECA eca-programs/Problem101_label03.c ILP32 false +ProductLines product-lines/elevator_spec1_product24.cil.c ILP32 false +ECA eca-programs/Problem101_label06.c ILP32 false +ProductLines product-lines/elevator_spec1_productSimulator.cil.c ILP32 false +ECA eca-programs/Problem101_label10.c ILP32 false +ProductLines product-lines/elevator_spec2_product22.cil.c ILP32 false +ECA eca-programs/Problem101_label13.c ILP32 false +ProductLines product-lines/elevator_spec2_product28.cil.c ILP32 false +ECA eca-programs/Problem101_label16.c ILP32 false +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +ECA eca-programs/Problem101_label19.c ILP32 false +ProductLines product-lines/elevator_spec3_product27.cil.c ILP32 false +ECA eca-programs/Problem101_label23.c ILP32 false +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +ECA eca-programs/Problem102_label04.c ILP32 false +ProductLines product-lines/elevator_spec9_product32.cil.c ILP32 false +ECA eca-programs/Problem102_label07.c ILP32 false +ProductLines product-lines/email_spec0_product21.cil.c ILP32 false +ECA eca-programs/Problem102_label15.c ILP32 false +ProductLines product-lines/email_spec0_product34.cil.c ILP32 false +ECA eca-programs/Problem102_label28.c ILP32 false +ProductLines product-lines/email_spec11_product22.cil.c ILP32 false +ECA eca-programs/Problem102_label37.c ILP32 false +ProductLines product-lines/email_spec11_product35.cil.c ILP32 false +ECA eca-programs/Problem102_label48.c ILP32 false +ProductLines product-lines/email_spec1_product15.cil.c ILP32 false +ECA eca-programs/Problem102_label51.c ILP32 false +ProductLines product-lines/email_spec1_product21.cil.c ILP32 false +ECA eca-programs/Problem103_label35.c ILP32 false +ProductLines product-lines/email_spec1_product31.cil.c ILP32 false +ECA eca-programs/Problem103_label46.c ILP32 false +ProductLines product-lines/email_spec1_product34.cil.c ILP32 false +ECA eca-programs/Problem103_label53.c ILP32 false +ProductLines product-lines/email_spec27_product17.cil.c ILP32 false +ECA eca-programs/Problem103_label57.c ILP32 false +ProductLines product-lines/email_spec27_product25.cil.c ILP32 false +ECA eca-rers2012/Problem03_label26.c ILP32 false +ProductLines product-lines/email_spec27_product30.cil.c ILP32 false +ECA eca-rers2012/Problem03_label31.c ILP32 false +ProductLines product-lines/email_spec27_product33.cil.c ILP32 false +ECA eca-rers2012/Problem03_label39.c ILP32 false +ProductLines product-lines/email_spec3_product17.cil.c ILP32 false +ECA eca-rers2012/Problem03_label50.c ILP32 false +ProductLines product-lines/email_spec3_product25.cil.c ILP32 false diff --git a/test-comp2026/simulation/coverage-error-call.prp b/tests/testcomp/cover-error-call.prp similarity index 100% rename from test-comp2026/simulation/coverage-error-call.prp rename to tests/testcomp/cover-error-call.prp diff --git a/tests/testcomp/expected.txt b/tests/testcomp/expected.txt new file mode 100644 index 000000000..4249c1712 --- /dev/null +++ b/tests/testcomp/expected.txt @@ -0,0 +1,29 @@ +# Expected TestCov verdict per program. Format: <program> <verdict> +# +# Legal verdicts: COVERED, NOT_COVERED, ERROR. +# +# This file makes the gate bidirectional. A program that stops being COVERED is +# a regression. A program that STARTS being COVERED when this file says +# otherwise is also a failure -- it means the tool improved and nobody recorded +# it, and an unrecorded improvement is indistinguishable from a broken harness. +# Change a line here deliberately, in the commit that causes the change. +# +# Every verdict below was measured, not assumed, at BUDGET=120 against the +# build of 2026-08-16. + +single_int.c COVERED +two_guards.c COVERED +no_input.c COVERED +char_input.c COVERED +unreachable.c NOT_COVERED + +# loop_reads.c -- COVERED since issue #75 (commit 8da579488). +# +# It was NOT_COVERED from finding K until then: KLEE reached the target but +# forked on every symbolic value written to the nondet log (vfprintf), so the +# run ran out of budget before a test vector came out. Concretizing the log +# before writing it removed the explosion. +# Measured at BUDGET=120: install_v99b NOT_COVERED, install_v99c COVERED (2/2). +# See docs/reports/2026-08-12-castle-juliet-findings.md (finding K) and the +# issue #75 entry in docs/reports/tacas-experiment-log.md. +loop_reads.c COVERED diff --git a/tests/testcomp/fetch-benchmarks.sh b/tests/testcomp/fetch-benchmarks.sh new file mode 100755 index 000000000..4f79671e8 --- /dev/null +++ b/tests/testcomp/fetch-benchmarks.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# fetch-benchmarks.sh -- clones sv-benchmarks for the stratified Test-Comp runs. +# +# Not a submodule and not committed: the checkout is ~13 GB, it is needed only +# for evaluation runs, and pinning it as a submodule would put that weight on +# every clone of Map2Check including CI, which does not use it. +# +# --depth 1 on purpose. The corpus is used as a snapshot of programs, never for +# its history, and the full history is several times the size again. + +set -eu + +HERE="$(cd "$(dirname "$0")" && pwd)" +DEST="$HERE/bench/sv-benchmarks" +REPO="${SV_BENCHMARKS_REPO:-https://gitlab.com/sosy-lab/benchmarking/sv-benchmarks.git}" + +if [ -d "$DEST/c" ]; then + echo "sv-benchmarks already present at $DEST" + exit 0 +fi + +mkdir -p "$HERE/bench" +echo "Cloning sv-benchmarks (~13 GB, shallow) into $DEST ..." +git clone --depth 1 "$REPO" "$DEST" +echo "Done. Build a corpus with:" +echo " python3 $HERE/build_corpus.py --property cover-error --per-category 40 \\" +echo " --out $HERE/corpus/cover-error.tsv" diff --git a/tests/testcomp/launch-v11-when-ready.sh b/tests/testcomp/launch-v11-when-ready.sh new file mode 100755 index 000000000..113ce40ad --- /dev/null +++ b/tests/testcomp/launch-v11-when-ready.sh @@ -0,0 +1,96 @@ +#!/bin/bash +# launch-v11-when-ready.sh -- chains the v11 measurement behind two conditions. +# +# Not run in parallel with v10, deliberately. v11 exists to answer "what do +# slicing and seed exchange buy", which is a COMPARISON against v10 -- and two +# campaigns sharing a machine experience different contention, so a difference +# between them would not be attributable to the features. The tool's LibFuzzer +# phase runs with -jobs=8, so ten containers already put this machine at twice +# its core count; adding ten more would make both numbers meaningless. +# +# Waits for: +# 1. every v10 container to finish +# 2. the republished image to actually carry the slicer +# +# The second is not a formality. --slice degrades gracefully when sbt-slicer is +# absent -- it warns and analyses the whole program -- so launching against an +# image without it would produce a full campaign that silently measures +# nothing. Checking is the difference between an answer and a wasted night. + +set -u + +REPO="$(cd "$(dirname "$0")/../.." && pwd)" +IMAGE_SRC="${IMAGE_SRC:-ghcr.io/hbgit/map2check-dev:latest}" +IMAGE="${IMAGE:-map2check-testcov:latest}" +LOG="$REPO/tests/baseline-logs/v11-launcher.log" +POLL="${POLL:-300}" + +say() { echo "[$(date +%H:%M)] $*" | tee -a "$LOG"; } + +say "waiting for the v10 campaign to finish" +while [ "$(docker ps -q --filter 'name=m2c-v10-' | wc -l)" -gt 0 ]; do + sleep "$POLL" +done +say "v10 finished" + +say "waiting for an image that carries the slicer" +while true; do + docker pull -q "$IMAGE_SRC" >/dev/null 2>&1 || true + if docker run --rm "$IMAGE_SRC" test -x /opt/sbt-slicer/bin/sbt-slicer >/dev/null 2>&1; then + say "the published image has sbt-slicer" + break + fi + say " not yet -- the PR has to merge and Publish Docker Image has to run" + sleep "$POLL" +done + +# The testcov derivative has to be rebuilt on top of the new base, or the runs +# would use the old one and the wait above would have been pointless. +say "rebuilding $IMAGE on top of the new base" +docker build -q -t "$IMAGE" -f - "$REPO" >>"$LOG" 2>&1 <<EOF +FROM $IMAGE_SRC +USER root +RUN apt-get update -qq && \ + apt-get install -y -qq python3-pip zip gcc gcc-multilib lcov && \ + pip3 install --quiet testcov && rm -rf /var/lib/apt/lists/* +EOF +docker run --rm "$IMAGE" test -x /opt/sbt-slicer/bin/sbt-slicer || { + say "FATAL: the rebuilt image lost the slicer"; exit 1; } +say "image ready" + +COMMON="--restart=on-failure:100 --memory=4g -u 0 -v $REPO:/workspace -w /workspace" +COMMON="$COMMON -e MAP2CHECK_PATH=/workspace/install_v9" + +# A 2x2 factorial, control included, and both parts of that matter. +# +# Two arms would have measured the exchange only in the PRESENCE of slicing. +# If it helps alone and hurts combined -- or the reverse -- that design cannot +# see it. Four cells separate each feature AND their interaction. +# +# The control cell runs here rather than reusing v10, even though v10 measures +# the same thing on the same corpus. v10 ran with ten containers on a host at +# twice its core count; v11 will run with twelve. Comparing across that carries +# the contention difference into the result, which is the confound this whole +# chaining exists to avoid. An internal control costs one more arm and removes +# the question. +launch() { + local arm="$1" flags="$2" prop="$3" shard="$4" shards="$5" + docker rm -f "m2c-v11-${arm}-${prop}-s${shard}" >/dev/null 2>&1 + docker run -d --name "m2c-v11-${arm}-${prop}-s${shard}" $COMMON --cpus=1.5 \ + -e MANIFEST="/workspace/tests/testcomp/corpus/${prop}.tsv" \ + -e PROPERTY="$prop" -e GENERATOR=hybrid -e EXTRA_FLAGS="$flags" \ + -e RESULTS_DIR="/workspace/tests/testcomp/results_v11_${arm}_${prop}_s${shard}" \ + -e SHARD="$shard" -e SHARDS="$shards" \ + -e BUDGET=60 -e TESTCOV_S=90 -e DEADLINE_S=28800 \ + "$IMAGE" bash tests/testcomp/run_testcomp_evaluation.sh >/dev/null +} + +# cover-error only. Slicing needs a criterion to slice towards, and +# Cover-Branches has none -- every branch is the goal. +for i in 0 1 2; do launch control "" cover-error "$i" 3; done +for i in 0 1 2; do launch slice "--slice" cover-error "$i" 3; done +for i in 0 1 2; do launch seed "--seed-exchange" cover-error "$i" 3; done +for i in 0 1 2; do launch slice-seed "--slice --seed-exchange" cover-error "$i" 3; done + +sleep 5 +say "v11 launched: $(docker ps -q --filter 'name=m2c-v11-' | wc -l) containers" diff --git a/tests/testcomp/launch-v12.sh b/tests/testcomp/launch-v12.sh new file mode 100755 index 000000000..7ee1bea4b --- /dev/null +++ b/tests/testcomp/launch-v12.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# launch-v12.sh -- remeasures slicing after the weak-stub fix. +# +# v11 measured --slice at 24.4% against a 44.6% control and the cause turned +# out to be mundane: sbt-slicer drops the BODY of the criterion function, the +# native LibFuzzer link then fails with "undefined reference to reach_error", +# no fuzzed binary is produced, and the fuzzer stage silently does nothing. +# caller.cpp now links a weak definition back in after slicing. +# +# The control cell is re-run rather than reusing v11's, for the reason v11's +# own launcher gives: v11 ran twelve containers, v12 runs six, and comparing +# across that contention difference would carry the confound the internal +# control exists to remove. +set -u +REPO="$(cd "$(dirname "$0")/../.." && pwd)" +IMAGE="${IMAGE:-map2check-testcov:latest}" + +COMMON="--restart=on-failure:100 --memory=4g -u 0 -v $REPO:/workspace -w /workspace" +COMMON="$COMMON -e MAP2CHECK_PATH=/workspace/install_v12" + +launch() { + local arm="$1" flags="$2" shard="$3" shards="$4" + docker rm -f "m2c-v12-${arm}-s${shard}" >/dev/null 2>&1 + docker run -d --name "m2c-v12-${arm}-s${shard}" $COMMON --cpus=2 \ + -e MANIFEST="/workspace/tests/testcomp/corpus/cover-error.tsv" \ + -e PROPERTY="cover-error" -e GENERATOR=hybrid -e EXTRA_FLAGS="$flags" \ + -e RESULTS_DIR="/workspace/tests/testcomp/results_v12_${arm}_s${shard}" \ + -e SHARD="$shard" -e SHARDS="$shards" \ + -e BUDGET=60 -e TESTCOV_S=90 -e DEADLINE_S=28800 \ + "$IMAGE" bash tests/testcomp/run_testcomp_evaluation.sh >/dev/null +} + +for i in 0 1 2; do launch control "" "$i" 3; done +for i in 0 1 2; do launch slice "--slice" "$i" 3; done +sleep 5 +echo "v12 launched: $(docker ps -q --filter 'name=m2c-v12-' | wc -l) containers" diff --git a/tests/testcomp/launch-v15-paper.sh b/tests/testcomp/launch-v15-paper.sh new file mode 100755 index 000000000..ca4eba7fe --- /dev/null +++ b/tests/testcomp/launch-v15-paper.sh @@ -0,0 +1,76 @@ +#!/bin/bash +# launch-v15-paper.sh -- the run the paper reports. +# +# Shape, and the reasoning for each part: +# +# cover-error control + slice, 1087 tasks +# 1087 is the ENTIRE applicable pool, not a sample -- quota 400 caps only +# ECA (421 applicable). Slicing runs here because here it has a criterion. +# +# cover-branches control only, 2765 tasks +# Slicing needs something to slice TOWARDS and Cover-Branches has nothing: +# every branch is the goal. Paying for a slice arm here would measure the +# absence of a feature. +# +# Juliet PER_FAMILY=10, CASTLE full +# Non-regression, on the same binary, at THEIR budgets rather than 300s -- +# this run answers "did the four fixes break anything", and moving two +# variables at once would stop it answering that. +# +# 4939 Test-Comp tasks. BUDGET=300 is the competition figure; three of the four +# fixes this binary carries are about what happens at the deadline, so the +# deadline has to be the real one. +# +# The corpus is nested: quota 400 is a SUPERSET of the 40 and 150 used before, +# in the same order, and the manifest is round-robin across categories. A run +# truncated by its deadline therefore stays stratified -- partial results are +# read without bias, which matters because this one will be read before it ends. +set -u +REPO="$(cd "$(dirname "$0")/../.." && pwd)" +IMAGE="${IMAGE:-map2check-testcov:latest}" +POLL="${POLL:-300}" +LOG="$REPO/tests/baseline-logs/v15-paper.log" +say() { echo "[$(date +%H:%M)] $*" | tee -a "$LOG"; } + +say "waiting for the validation sweep to finish" +while [ "$(docker ps -q --filter 'name=m2c-validate' | wc -l)" -gt 0 ]; do sleep 30; done +say "validation done" + +COMMON="--restart=on-failure:100 --memory=4g -u 0 -v $REPO:/workspace -w /workspace" +COMMON="$COMMON -e MAP2CHECK_PATH=/workspace/install_v15" + +launch() { # arm flags property manifest shard shards + local arm="$1" flags="$2" prop="$3" man="$4" shard="$5" shards="${6:-3}" + docker rm -f "m2c-v15-${arm}-s${shard}" >/dev/null 2>&1 + docker run -d --name "m2c-v15-${arm}-s${shard}" $COMMON --cpus=2 \ + -e MANIFEST="/workspace/tests/testcomp/corpus/${man}" \ + -e PROPERTY="$prop" -e GENERATOR=hybrid -e EXTRA_FLAGS="$flags" \ + -e RESULTS_DIR="/workspace/tests/testcomp/results_v15_${arm}_s${shard}" \ + -e SHARD="$shard" -e SHARDS="$shards" \ + -e BUDGET=300 -e TESTCOV_S=300 -e DEADLINE_S=259200 \ + "$IMAGE" bash tests/testcomp/run_testcomp_evaluation.sh >/dev/null +} + +# Phase 1: cover-error, both arms. The smaller half, and the one carrying the +# ablation, so it lands first and can be read while the rest runs. +for i in 0 1 2; do launch ce-control "" cover-error cover-error-q400.tsv "$i"; done +for i in 0 1 2; do launch ce-slice "--slice" cover-error cover-error-q400.tsv "$i"; done +say "phase 1 launched: cover-error control+slice, 1087 tasks" + +while [ "$(docker ps -q --filter 'name=m2c-v15-ce-' | wc -l)" -gt 0 ]; do sleep "$POLL"; done +say "phase 1 done" + +# Phase 2: cover-branches, control only, SIX shards -- phase 1 has released +# its cores and this is the half that has to fit. +# +# It is also the expensive half per task, and for a structural reason: a +# Cover-Branches run has no early exit. Cover-Error stops at the first +# violating path, so its median task takes 18s of a 300s budget; branch +# harvesting runs KLEE to the deadline every time, and then TestCov validates +# a suite of up to 50 vectors. Budget the pair at up to 600s per task, not 300. +# +# 2765 tasks over six shards at up to 600s is ~77h worst case and far less in +# the mean, inside the 72h deadline with the tail truncating rather than the +# body. The manifest is round-robin, so what truncates stays stratified. +for i in 0 1 2 3 4 5; do launch cb-control "" cover-branches cover-branches-q400.tsv "$i" 6; done +say "phase 2 launched: cover-branches control, 2765 tasks over 6 shards" diff --git a/tests/testcomp/official/Dockerfile b/tests/testcomp/official/Dockerfile new file mode 100644 index 000000000..84c1e82c9 --- /dev/null +++ b/tests/testcomp/official/Dockerfile @@ -0,0 +1,43 @@ +# Test-Comp 2026 reproduction environment. +# +# The base is the image the competition publishes as "mostly the same packages +# as the competition machines" (Ubuntu 24.04; competition-scripts +# test/Dockerfile.user.2026). On top of it, the two components the +# testcomp26 tag of gitlab.com/sosy-lab/test-comp/bench-defs pins: +# - BenchExec 3.34 (submodule benchexec @ 829bf7a4583e), which runs both the +# test generator and the validator under the official limits; +# - TestCov 3.11.post3 (fm-tools testcov.yml, Zenodo 10.5281/zenodo.17698774) +# and TestCoCa testcomp26 (fm-tools testcoca.yml, Zenodo +# 10.5281/zenodo.17819536): the five validators of the category structure +# (TestCov x {gcc, clang} x {formatted, unformatted}, plus TestCoCa). A +# task's score is the best coverage any of them measures. +# See docs/reports/2026-10-06-ambiente-testcomp-oficial.md. +# +# Run it privileged, as BenchExec needs to manage cgroups: +# docker run --privileged --cap-drop=all ... map2check-testcomp-env <cmd> +FROM registry.gitlab.com/sosy-lab/benchmarking/competition-scripts/user@sha256:2a38216dfc6ceb6ebbb80f07dae8abd4b87b4c619d7c6db2256dc98e608ebc47 + +RUN apt-get update \ + && apt-get install -y --no-install-recommends python3-pip zip unzip xmlstarlet ca-certificates curl fuse-overlayfs \ + && rm -rf /var/lib/apt/lists/* + +RUN pip install --break-system-packages --no-cache-dir benchexec==3.34 + +ARG TESTCOV_URL=https://zenodo.org/api/records/17698774/files/testcov-3.11.post3.zip/content +ARG TESTCOV_SHA256=604c234cb2ef6f8aa46bc0dd8fa146104d7d368b7285d0d8e9cd8bc99a7813b1 +RUN curl -sSL -o /tmp/testcov.zip "$TESTCOV_URL" \ + && echo "$TESTCOV_SHA256 /tmp/testcov.zip" | sha256sum -c - \ + && unzip -q /tmp/testcov.zip -d /opt \ + && rm /tmp/testcov.zip \ + && /opt/testcov/bin/testcov --version + +ARG TESTCOCA_URL=https://zenodo.org/api/records/17819536/files/testcoca.zip/content +ARG TESTCOCA_SHA256=14e57b70ee8ccb72899daa14ec7132cca217d8c334bf8b29940ca703ff32036f +RUN curl -sSL -o /tmp/testcoca.zip "$TESTCOCA_URL" \ + && echo "$TESTCOCA_SHA256 /tmp/testcoca.zip" | sha256sum -c - \ + && unzip -q /tmp/testcoca.zip -d /opt \ + && rm /tmp/testcoca.zip + +COPY init.sh /init.sh +ENTRYPOINT ["/init.sh"] +CMD ["bash"] diff --git a/tests/testcomp/official/bench-defs/excludes/ECA-excludes.set b/tests/testcomp/official/bench-defs/excludes/ECA-excludes.set new file mode 100644 index 000000000..3252e5878 --- /dev/null +++ b/tests/testcomp/official/bench-defs/excludes/ECA-excludes.set @@ -0,0 +1,1027 @@ +../../sv-benchmarks/c/eca-programs/Problem101_label01.yml +../../sv-benchmarks/c/eca-programs/Problem101_label02.yml +../../sv-benchmarks/c/eca-programs/Problem101_label03.yml +../../sv-benchmarks/c/eca-programs/Problem101_label04.yml +../../sv-benchmarks/c/eca-programs/Problem101_label05.yml +../../sv-benchmarks/c/eca-programs/Problem101_label06.yml +../../sv-benchmarks/c/eca-programs/Problem101_label07.yml +../../sv-benchmarks/c/eca-programs/Problem101_label08.yml +../../sv-benchmarks/c/eca-programs/Problem101_label09.yml +../../sv-benchmarks/c/eca-programs/Problem101_label10.yml +../../sv-benchmarks/c/eca-programs/Problem101_label11.yml +../../sv-benchmarks/c/eca-programs/Problem101_label12.yml +../../sv-benchmarks/c/eca-programs/Problem101_label13.yml +../../sv-benchmarks/c/eca-programs/Problem101_label14.yml +../../sv-benchmarks/c/eca-programs/Problem101_label15.yml +../../sv-benchmarks/c/eca-programs/Problem101_label16.yml +../../sv-benchmarks/c/eca-programs/Problem101_label17.yml +../../sv-benchmarks/c/eca-programs/Problem101_label18.yml +../../sv-benchmarks/c/eca-programs/Problem101_label19.yml +../../sv-benchmarks/c/eca-programs/Problem101_label20.yml +../../sv-benchmarks/c/eca-programs/Problem101_label21.yml +../../sv-benchmarks/c/eca-programs/Problem101_label22.yml +../../sv-benchmarks/c/eca-programs/Problem101_label23.yml +../../sv-benchmarks/c/eca-programs/Problem102_label01.yml +../../sv-benchmarks/c/eca-programs/Problem102_label02.yml +../../sv-benchmarks/c/eca-programs/Problem102_label03.yml +../../sv-benchmarks/c/eca-programs/Problem102_label04.yml +../../sv-benchmarks/c/eca-programs/Problem102_label05.yml +../../sv-benchmarks/c/eca-programs/Problem102_label06.yml +../../sv-benchmarks/c/eca-programs/Problem102_label07.yml +../../sv-benchmarks/c/eca-programs/Problem102_label08.yml +../../sv-benchmarks/c/eca-programs/Problem102_label09.yml +../../sv-benchmarks/c/eca-programs/Problem102_label10.yml +../../sv-benchmarks/c/eca-programs/Problem102_label11.yml +../../sv-benchmarks/c/eca-programs/Problem102_label12.yml +../../sv-benchmarks/c/eca-programs/Problem102_label13.yml +../../sv-benchmarks/c/eca-programs/Problem102_label14.yml +../../sv-benchmarks/c/eca-programs/Problem102_label15.yml +../../sv-benchmarks/c/eca-programs/Problem102_label16.yml +../../sv-benchmarks/c/eca-programs/Problem102_label17.yml +../../sv-benchmarks/c/eca-programs/Problem102_label18.yml +../../sv-benchmarks/c/eca-programs/Problem102_label19.yml +../../sv-benchmarks/c/eca-programs/Problem102_label20.yml +../../sv-benchmarks/c/eca-programs/Problem102_label21.yml +../../sv-benchmarks/c/eca-programs/Problem102_label22.yml +../../sv-benchmarks/c/eca-programs/Problem102_label23.yml +../../sv-benchmarks/c/eca-programs/Problem102_label24.yml +../../sv-benchmarks/c/eca-programs/Problem102_label25.yml +../../sv-benchmarks/c/eca-programs/Problem102_label26.yml +../../sv-benchmarks/c/eca-programs/Problem102_label27.yml +../../sv-benchmarks/c/eca-programs/Problem102_label28.yml +../../sv-benchmarks/c/eca-programs/Problem102_label29.yml +../../sv-benchmarks/c/eca-programs/Problem102_label30.yml +../../sv-benchmarks/c/eca-programs/Problem102_label31.yml +../../sv-benchmarks/c/eca-programs/Problem102_label32.yml +../../sv-benchmarks/c/eca-programs/Problem102_label33.yml +../../sv-benchmarks/c/eca-programs/Problem102_label34.yml +../../sv-benchmarks/c/eca-programs/Problem102_label35.yml +../../sv-benchmarks/c/eca-programs/Problem102_label36.yml +../../sv-benchmarks/c/eca-programs/Problem102_label37.yml +../../sv-benchmarks/c/eca-programs/Problem102_label38.yml +../../sv-benchmarks/c/eca-programs/Problem102_label39.yml +../../sv-benchmarks/c/eca-programs/Problem102_label40.yml +../../sv-benchmarks/c/eca-programs/Problem102_label41.yml +../../sv-benchmarks/c/eca-programs/Problem102_label42.yml +../../sv-benchmarks/c/eca-programs/Problem102_label43.yml +../../sv-benchmarks/c/eca-programs/Problem102_label44.yml +../../sv-benchmarks/c/eca-programs/Problem102_label45.yml +../../sv-benchmarks/c/eca-programs/Problem102_label46.yml +../../sv-benchmarks/c/eca-programs/Problem102_label47.yml +../../sv-benchmarks/c/eca-programs/Problem102_label48.yml +../../sv-benchmarks/c/eca-programs/Problem102_label49.yml +../../sv-benchmarks/c/eca-programs/Problem102_label50.yml +../../sv-benchmarks/c/eca-programs/Problem102_label51.yml +../../sv-benchmarks/c/eca-programs/Problem102_label52.yml +../../sv-benchmarks/c/eca-programs/Problem102_label53.yml +../../sv-benchmarks/c/eca-programs/Problem102_label54.yml +../../sv-benchmarks/c/eca-programs/Problem102_label55.yml +../../sv-benchmarks/c/eca-programs/Problem102_label56.yml +../../sv-benchmarks/c/eca-programs/Problem102_label57.yml +../../sv-benchmarks/c/eca-programs/Problem102_label58.yml +../../sv-benchmarks/c/eca-programs/Problem102_label59.yml +../../sv-benchmarks/c/eca-programs/Problem103_label35.yml +../../sv-benchmarks/c/eca-programs/Problem103_label40.yml +../../sv-benchmarks/c/eca-programs/Problem103_label41.yml +../../sv-benchmarks/c/eca-programs/Problem103_label42.yml +../../sv-benchmarks/c/eca-programs/Problem103_label43.yml +../../sv-benchmarks/c/eca-programs/Problem103_label44.yml +../../sv-benchmarks/c/eca-programs/Problem103_label45.yml +../../sv-benchmarks/c/eca-programs/Problem103_label46.yml +../../sv-benchmarks/c/eca-programs/Problem103_label47.yml +../../sv-benchmarks/c/eca-programs/Problem103_label48.yml +../../sv-benchmarks/c/eca-programs/Problem103_label49.yml +../../sv-benchmarks/c/eca-programs/Problem103_label50.yml +../../sv-benchmarks/c/eca-programs/Problem103_label51.yml +../../sv-benchmarks/c/eca-programs/Problem103_label52.yml +../../sv-benchmarks/c/eca-programs/Problem103_label53.yml +../../sv-benchmarks/c/eca-programs/Problem103_label54.yml +../../sv-benchmarks/c/eca-programs/Problem103_label55.yml +../../sv-benchmarks/c/eca-programs/Problem103_label56.yml +../../sv-benchmarks/c/eca-programs/Problem103_label57.yml +../../sv-benchmarks/c/eca-programs/Problem103_label58.yml +../../sv-benchmarks/c/eca-programs/Problem103_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label59.yml diff --git a/tests/testcomp/official/bench-defs/map2check.xml b/tests/testcomp/official/bench-defs/map2check.xml new file mode 100644 index 000000000..5eaacd1c1 --- /dev/null +++ b/tests/testcomp/official/bench-defs/map2check.xml @@ -0,0 +1,28 @@ +<?xml version="1.0"?> +<!DOCTYPE benchmark PUBLIC "+//IDN sosy-lab.org//DTD BenchExec benchmark 2.3//EN" "https://www.sosy-lab.org/benchexec/benchmark-2.3.dtd"> +<!-- Map2Check as a Test-Comp 2026 test generator. Not an official file: there + is no map2check.xml in the testcomp26 tag. Modelled on the definitions of + the tools that are there (klee.xml, fusebmc.xml, symbiotic.xml): the same + limits, the same result files and the same run definitions. The tool-info + module is utils/moduleBenchExec/map2check.py. --> +<benchmark tool="moduleBenchExec.map2check" displayName="Map2Check" timelimit="15 min" memlimit="15 GB" cpuCores="4"> + + <require cpuModel="Intel Xeon E3-1230 v5 @ 3.40 GHz" /> + + <resultfiles>**/test-suite</resultfiles> + + <rundefinition name="Test-Comp26_coverage-error-call"> + <propertyfile>../sv-benchmarks/c/properties/coverage-error-call.prp</propertyfile> + <tasks name="replaced-by-testcomp.py"> + <includesfile>../sv-benchmarks/c/ReachSafety-ControlFlow.set</includesfile> + </tasks> + </rundefinition> + + <rundefinition name="Test-Comp26_coverage-branches"> + <propertyfile>../sv-benchmarks/c/properties/coverage-branches.prp</propertyfile> + <tasks name="replaced-by-testcomp.py"> + <includesfile>../sv-benchmarks/c/ReachSafety-ControlFlow.set</includesfile> + </tasks> + </rundefinition> + +</benchmark> diff --git a/tests/testcomp/official/bench-defs/testcoca-validate-test-suites-clang-formatted.xml b/tests/testcomp/official/bench-defs/testcoca-validate-test-suites-clang-formatted.xml new file mode 100644 index 000000000..2f9257102 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcoca-validate-test-suites-clang-formatted.xml @@ -0,0 +1,171 @@ +<?xml version="1.0"?> +<!DOCTYPE benchmark PUBLIC "+//IDN sosy-lab.org//DTD BenchExec benchmark 2.3//EN" "https://www.sosy-lab.org/benchexec/benchmark-2.3.dtd"> +<benchmark tool="testcoca" displayName="TestCoCa" timelimit="10 min" hardtimelimit="11 min" memlimit="7 GB" cpuCores="2"> + + <require cpuModel="Intel Xeon E3-1230 v5 @ 3.40 GHz" /> + + <resultfiles>**output/**</resultfiles> + + <option name="--max_exec_megabytes" /> + <option name="512" /> + <option name="--max_exec_milliseconds" /> + <option name="600000" /> + <option name="--testcomp" /> + <option name="--format" /> + + <rundefinition name="Test-Comp26_coverage-error-call"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test_suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-error-call.prp</propertyfile> + + <tasks name="C.coverage-error-call.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + </rundefinition> + + <rundefinition name="Test-Comp26_coverage-branches"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test_suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-branches.prp</propertyfile> + + <tasks name="C.coverage-branches.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardness"> + <includesfile>../sv-benchmarks/c/Hardness.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Combinations"> + <includesfile>../sv-benchmarks/c/Combinations.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-AWS-C-Common"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-AWS-C-Common.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-uthash"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-uthash.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-SQLite"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-SQLite.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainHeap"> + <includesfile>../sv-benchmarks/c/Heap-Termination.set</includesfile> + </tasks> + </rundefinition> + + <columns> + <column title="branches_covered">Coverage</column> + <column title="branches_total">Total</column> + </columns> + +</benchmark> \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-formatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-formatted.xml new file mode 100644 index 000000000..73cb97758 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-formatted.xml @@ -0,0 +1,182 @@ +<?xml version="1.0"?> +<!DOCTYPE benchmark PUBLIC "+//IDN sosy-lab.org//DTD BenchExec benchmark 2.3//EN" "https://www.sosy-lab.org/benchexec/benchmark-2.3.dtd"> +<benchmark tool="testcov" displayName="TestCov" timelimit="10 min" hardtimelimit="11 min" memlimit="7 GB" cpuCores="2"> + + <require cpuModel="Intel Xeon E3-1230 v5 @ 3.40 GHz" /> + + <resultfiles>**output/**</resultfiles> + + <option name="--memlimit" /> + <option name="6GB" /> + <option name="--timelimit-per-run" /> + <option name="50" /> + <option name="--format" /> + <option name="--verbose" /> + <option name="--no-plots" /> + <option name="--prep-cgroup" /> + <option name="--disable-info-files" /> + <option name="--compiler" /> + <option name="clang" /> + <option name="--cov-tool" /> + <option name="llvm-cov" /> + <option name="--reduction" /> + <option name="BY_ORDER" /> + <option name="--reduction-output" /> + <option name="test-suite" /> + + <rundefinition name="Test-Comp26_coverage-error-call"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-error-call.prp</propertyfile> + + <tasks name="C.coverage-error-call.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + </rundefinition> + + <rundefinition name="Test-Comp26_coverage-branches"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-branches.prp</propertyfile> + + <tasks name="C.coverage-branches.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardness"> + <includesfile>../sv-benchmarks/c/Hardness.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Combinations"> + <includesfile>../sv-benchmarks/c/Combinations.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-AWS-C-Common"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-AWS-C-Common.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-uthash"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-uthash.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-SQLite"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-SQLite.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainHeap"> + <includesfile>../sv-benchmarks/c/Heap-Termination.set</includesfile> + </tasks> + </rundefinition> + + <columns> + <column title="branches_covered">DEBUG:suite_validation:Accumulated coverage:</column> + <column title="branches_total">Number of goals</column> + </columns> + +</benchmark> \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-unformatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-unformatted.xml new file mode 100644 index 000000000..5591bb122 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-unformatted.xml @@ -0,0 +1,181 @@ +<?xml version="1.0"?> +<!DOCTYPE benchmark PUBLIC "+//IDN sosy-lab.org//DTD BenchExec benchmark 2.3//EN" "https://www.sosy-lab.org/benchexec/benchmark-2.3.dtd"> +<benchmark tool="testcov" displayName="TestCov" timelimit="10 min" hardtimelimit="11 min" memlimit="7 GB" cpuCores="2"> + + <require cpuModel="Intel Xeon E3-1230 v5 @ 3.40 GHz" /> + + <resultfiles>**output/**</resultfiles> + + <option name="--memlimit" /> + <option name="6GB" /> + <option name="--timelimit-per-run" /> + <option name="50" /> + <option name="--verbose" /> + <option name="--no-plots" /> + <option name="--prep-cgroup" /> + <option name="--disable-info-files" /> + <option name="--compiler" /> + <option name="clang" /> + <option name="--cov-tool" /> + <option name="llvm-cov" /> + <option name="--reduction" /> + <option name="BY_ORDER" /> + <option name="--reduction-output" /> + <option name="test-suite" /> + + <rundefinition name="Test-Comp26_coverage-error-call"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-error-call.prp</propertyfile> + + <tasks name="C.coverage-error-call.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + </rundefinition> + + <rundefinition name="Test-Comp26_coverage-branches"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-branches.prp</propertyfile> + + <tasks name="C.coverage-branches.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardness"> + <includesfile>../sv-benchmarks/c/Hardness.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Combinations"> + <includesfile>../sv-benchmarks/c/Combinations.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-AWS-C-Common"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-AWS-C-Common.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-uthash"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-uthash.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-SQLite"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-SQLite.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainHeap"> + <includesfile>../sv-benchmarks/c/Heap-Termination.set</includesfile> + </tasks> + </rundefinition> + + <columns> + <column title="branches_covered">DEBUG:suite_validation:Accumulated coverage:</column> + <column title="branches_total">Number of goals</column> + </columns> + +</benchmark> \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-formatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-formatted.xml new file mode 100644 index 000000000..d6ca78924 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-formatted.xml @@ -0,0 +1,178 @@ +<?xml version="1.0"?> +<!DOCTYPE benchmark PUBLIC "+//IDN sosy-lab.org//DTD BenchExec benchmark 2.3//EN" "https://www.sosy-lab.org/benchexec/benchmark-2.3.dtd"> +<benchmark tool="testcov" displayName="TestCov" timelimit="10 min" hardtimelimit="11 min" memlimit="7 GB" cpuCores="2"> + + <require cpuModel="Intel Xeon E3-1230 v5 @ 3.40 GHz" /> + + <resultfiles>**output/**</resultfiles> + + <option name="--memlimit" /> + <option name="6GB" /> + <option name="--timelimit-per-run" /> + <option name="50" /> + <option name="--format" /> + <option name="--verbose" /> + <option name="--no-plots" /> + <option name="--prep-cgroup" /> + <option name="--disable-info-files" /> + <option name="--reduction" /> + <option name="BY_ORDER" /> + <option name="--reduction-output" /> + <option name="test-suite" /> + + <rundefinition name="Test-Comp26_coverage-error-call"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-error-call.prp</propertyfile> + + <tasks name="C.coverage-error-call.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + </rundefinition> + + <rundefinition name="Test-Comp26_coverage-branches"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-branches.prp</propertyfile> + + <tasks name="C.coverage-branches.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardness"> + <includesfile>../sv-benchmarks/c/Hardness.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Combinations"> + <includesfile>../sv-benchmarks/c/Combinations.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-AWS-C-Common"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-AWS-C-Common.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-uthash"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-uthash.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-SQLite"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-SQLite.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainHeap"> + <includesfile>../sv-benchmarks/c/Heap-Termination.set</includesfile> + </tasks> + </rundefinition> + + <columns> + <column title="branches_covered">DEBUG:suite_validation:Accumulated coverage:</column> + <column title="branches_total">Number of goals</column> + </columns> + +</benchmark> \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml new file mode 100644 index 000000000..4d2e17c75 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml @@ -0,0 +1,177 @@ +<?xml version="1.0"?> +<!DOCTYPE benchmark PUBLIC "+//IDN sosy-lab.org//DTD BenchExec benchmark 2.3//EN" "https://www.sosy-lab.org/benchexec/benchmark-2.3.dtd"> +<benchmark tool="testcov" displayName="TestCov" timelimit="10 min" hardtimelimit="11 min" memlimit="7 GB" cpuCores="2"> + + <require cpuModel="Intel Xeon E3-1230 v5 @ 3.40 GHz" /> + + <resultfiles>**output/**</resultfiles> + + <option name="--memlimit" /> + <option name="6GB" /> + <option name="--timelimit-per-run" /> + <option name="50" /> + <option name="--verbose" /> + <option name="--no-plots" /> + <option name="--prep-cgroup" /> + <option name="--disable-info-files" /> + <option name="--reduction" /> + <option name="BY_ORDER" /> + <option name="--reduction-output" /> + <option name="test-suite" /> + + <rundefinition name="Test-Comp26_coverage-error-call"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-error-call.prp</propertyfile> + + <tasks name="C.coverage-error-call.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-error-call.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + </rundefinition> + + <rundefinition name="Test-Comp26_coverage-branches"> + <requiredfiles>../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</requiredfiles> + <option name="--test-suite">../../results-verified/LOGDIR/${rundefinition_name}/${taskdef_name}/test-suite.zip</option> + <propertyfile>../sv-benchmarks/c/properties/coverage-branches.prp</propertyfile> + + <tasks name="C.coverage-branches.Arrays"> + <includesfile>../sv-benchmarks/c/Arrays.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ECA"> + <includesfile>../sv-benchmarks/c/ECA.set</includesfile> + <excludesfile>excludes/ECA-excludes.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.Floats"> + <includesfile>../sv-benchmarks/c/Floats.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardness"> + <includesfile>../sv-benchmarks/c/Hardness.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Hardware"> + <includesfile>../sv-benchmarks/c/Hardware.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Heap"> + <includesfile>../sv-benchmarks/c/Heap.set</includesfile> + <includesfile>../sv-benchmarks/c/LinkedLists.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Loops"> + <includesfile>../sv-benchmarks/c/Loops.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Loops.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.ProductLines"> + <includesfile>../sv-benchmarks/c/ProductLines.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Recursive"> + <includesfile>../sv-benchmarks/c/Recursive.set</includesfile> + <includesfile>../sv-benchmarks/c/VerifyThis-Recursive.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Sequentialized"> + <includesfile>../sv-benchmarks/c/Sequentialized.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.XCSP"> + <includesfile>../sv-benchmarks/c/XCSP.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Combinations"> + <includesfile>../sv-benchmarks/c/Combinations.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-AWS-C-Common"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-AWS-C-Common.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-BusyBox"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-BusyBox.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-coreutils"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-coreutils.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-OpenBSD"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-OpenBSD.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-DeviceDriversLinux64"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64.set</includesfile> + <excludesfile>../sv-benchmarks/c/SoftwareSystems-DeviceDriversLinux64Large.set</excludesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-Intel-TDX-Module"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-Intel-TDX-Module.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-uthash"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-uthash.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.SoftwareSystems-SQLite"> + <includesfile>../sv-benchmarks/c/SoftwareSystems-SQLite.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-BitVectors"> + <includesfile>../sv-benchmarks/c/BitVectors-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainControlFlow"> + <includesfile>../sv-benchmarks/c/ControlFlow-Termination.set</includesfile> + </tasks> + <tasks name="C.coverage-branches.Termination-MainHeap"> + <includesfile>../sv-benchmarks/c/Heap-Termination.set</includesfile> + </tasks> + </rundefinition> + + <columns> + <column title="branches_covered">DEBUG:suite_validation:Accumulated coverage:</column> + <column title="branches_total">Number of goals</column> + </columns> + +</benchmark> \ No newline at end of file diff --git a/tests/testcomp/official/init.sh b/tests/testcomp/official/init.sh new file mode 100755 index 000000000..c0b592e96 --- /dev/null +++ b/tests/testcomp/official/init.sh @@ -0,0 +1,12 @@ +#!/bin/sh +# Entry point of the Test-Comp reproduction image: a separate cgroup for +# BenchExec, as its doc/benchexec-in-container.md prescribes for cgroups v2. +# Without it BenchExec cannot limit or measure the runs it starts. +set -eu +mkdir -p /sys/fs/cgroup/init /sys/fs/cgroup/benchexec +echo $$ > /sys/fs/cgroup/init/cgroup.procs +for controller in $(cat /sys/fs/cgroup/cgroup.controllers); do + echo "+$controller" > /sys/fs/cgroup/cgroup.subtree_control + echo "+$controller" > /sys/fs/cgroup/benchexec/cgroup.subtree_control +done +exec "$@" diff --git a/tests/testcomp/official/run.sh b/tests/testcomp/official/run.sh new file mode 100755 index 000000000..e9359d29f --- /dev/null +++ b/tests/testcomp/official/run.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# Runs a Test-Comp 2026 step (testcomp.py generate | validate) in the +# reproduction image. +# +# tests/testcomp/official/run.sh generate --property cover-branches \ +# --tasks tests/testcomp/corpus/cover-branches-q400.tsv \ +# --archive map2check-testcomp.zip --suites OUT/suites --out OUT/gen +# tests/testcomp/official/run.sh validate --property cover-branches \ +# --tasks tests/testcomp/corpus/cover-branches-q400.tsv \ +# --suites OUT/suites --out OUT/val +# +# Anything after -- goes to BenchExec (e.g. -- --timelimit 300s for a run +# deliberately shorter than the competition's). +# +# The image is map2check-testcomp-env (docker build -t map2check-testcomp-env +# tests/testcomp/official). BenchExec needs --privileged to manage cgroups and +# /dev/fuse for the overlays it creates. +# +# The repository is mounted at /m2c and $DATA_DIR (default: the repository's +# parent) at /data, and the paths given on the command line are translated: the +# container's /home must stay free, because BenchExec overlays it, and an +# overlay over a bind mount below it fails ("Failed to create overlay mount"). +set -euo pipefail +REPO=$(cd "$(dirname "$0")/../../.." && pwd) +DATA_DIR=$(cd "${DATA_DIR:-$REPO/..}" && pwd) +IMAGE=${IMAGE:-map2check-testcomp-env} +SV=${SV_BENCHMARKS:-$REPO/tests/testcomp/bench/sv-benchmarks/c} + +inside() { + local path + path=$(realpath -m "$1") + case "$path" in + "$REPO"|"$REPO"/*) echo "/m2c${path#"$REPO"}" ;; + "$DATA_DIR"/*) echo "/data${path#"$DATA_DIR"}" ;; + *) echo "path outside the repository and DATA_DIR: $1" >&2; exit 2 ;; + esac +} + +args=() +expect_path=0 +for arg in "$@"; do + if [ "$expect_path" = 1 ]; then args+=("$(inside "$arg")"); expect_path=0; continue; fi + case "$arg" in + --tasks|--suites|--out|--archive) args+=("$arg"); expect_path=1 ;; + *) args+=("$arg") ;; + esac +done +step=${args[0]:?generate or validate} + +exec docker run --rm --privileged --cap-drop=all --device /dev/fuse \ + -v "$REPO:/m2c" -v "$DATA_DIR:/data" -w /m2c -e HOST_OWNER="$(id -u):$(id -g)" \ + ${DOCKER_ARGS:-} "$IMAGE" \ + python3 /m2c/tests/testcomp/official/testcomp.py "$step" \ + --sv-benchmarks "$(inside "$SV")" "${args[@]:1}" diff --git a/tests/testcomp/official/testcomp.py b/tests/testcomp/official/testcomp.py new file mode 100755 index 000000000..90725394d --- /dev/null +++ b/tests/testcomp/official/testcomp.py @@ -0,0 +1,319 @@ +#!/usr/bin/env python3 +"""Runs Map2Check through Test-Comp 2026 the way the competition does. + +Runs inside the reproduction image (Dockerfile; run.sh starts it). Two steps, +each one a BenchExec run of an official-style benchmark definition: + + generate the Map2Check tool archive (utils/testcomp-archive/make-archive.sh) + under bench-defs/map2check.xml: 15 min of CPU time, 15 GB, 4 cores, + like every Test-Comp 2026 test generator. Each task's test-suite/ + is then zipped into the layout the validators read. + + validate the five validators of the testcomp26 category structure -- TestCov + with gcc and clang, formatted and unformatted, and TestCoCa -- from + their official definitions in bench-defs/, unchanged except for + the task set and the location of the suites. The scores are merged + as the competition merges them (competition-scripts, + prepare_tables/export_adjusted_csvs.py, update_score_tester): + coverage-branches the BEST coverage any validator measured; + coverage-error-call 1 point if ANY validator answers TRUE. + +What is rewritten in a definition, and why: + - the tasks, replaced by --tasks; + - ../sv-benchmarks/c/ and results-verified/LOGDIR/, replaced by our paths; + - <require cpuModel>, dropped: it pins the competition's hardware. + +As the competition scripts do (execute-runcollection.sh), BenchExec runs from +inside a fresh copy of the tool with --tool-directory . and the overlays +--read-only-dir / --overlay-dir /home/ --overlay-dir ./. Task inputs are +staged into a copy per step, because tools write beside the program (TestCov's +<program>.c.i), and on the competition's VerifierCloud the inputs sit in the +run's own writable directory. + +Suites live at <suites>/<rundefinition>/<taskdef_name>/test-suite.zip, e.g. +suites/Test-Comp26_coverage-branches/AllInterval-011.yml/test-suite.zip +(BenchExec's ${taskdef_name} keeps the .yml). +""" + +import argparse +import bz2 +import csv +import glob +import os +import shutil +import subprocess +import sys +import xml.etree.ElementTree as ET +import zipfile + +import yaml + +HERE = os.path.dirname(os.path.abspath(__file__)) +DEFS = os.path.join(HERE, "bench-defs") +REPO = os.path.dirname(os.path.dirname(os.path.dirname(HERE))) + +VALIDATORS = { + "testcov-validate-test-suites-gcc-unformatted": "/opt/testcov", + "testcov-validate-test-suites-gcc-formatted": "/opt/testcov", + "testcov-validate-test-suites-clang-unformatted": "/opt/testcov", + "testcov-validate-test-suites-clang-formatted": "/opt/testcov", + "testcoca-validate-test-suites-clang-formatted": "/opt/testcoca", +} + +PROPERTIES = { + "cover-branches": "Test-Comp26_coverage-branches", + "cover-error": "Test-Comp26_coverage-error-call", +} + +OFFICIAL_LOGDIRS = ("../../results-verified/LOGDIR/", "../results-verified/LOGDIR/") + + +# --- shared ------------------------------------------------------------------- + +def stage_tasks(task_list, sv_benchmarks, staging): + """Copies each task's inputs -- the .yml, the files it names, and the + property files -- into `staging`, keeping their paths relative to + sv-benchmarks. Returns the staged .yml paths. + + `task_list` holds manifest rows (category<TAB>program<TAB>...) or bare paths + to a .c, .i or .yml.""" + shutil.rmtree(staging, ignore_errors=True) + shutil.copytree(os.path.join(sv_benchmarks, "properties"), + os.path.join(staging, "properties")) + tasks = [] + with open(task_list) as listing: + for line in listing: + line = line.strip() + if not line or line.startswith("#"): + continue + path = line.split("\t")[1] if "\t" in line else line + stem, _ = os.path.splitext(path) + yml = os.path.join(sv_benchmarks, stem + ".yml") + if not os.path.isfile(yml): + sys.exit(f"no task definition for {path}: {yml}") + with open(yml) as handle: + inputs = yaml.safe_load(handle)["input_files"] + inputs = [inputs] if isinstance(inputs, str) else inputs + target_dir = os.path.join(staging, os.path.dirname(stem)) + os.makedirs(target_dir, exist_ok=True) + for name in [os.path.basename(yml)] + inputs: + shutil.copy2(os.path.join(os.path.dirname(yml), name), + os.path.join(target_dir, name)) + # Some tasks carry property files of their own (eca-rers2018/), named + # relative to the task definition. BenchExec resolves every property + # a definition lists, so one missing file aborts the whole run -- and + # with it every task's result. + local_properties = os.path.join(os.path.dirname(yml), "properties") + if os.path.isdir(local_properties): + shutil.copytree(local_properties, + os.path.join(target_dir, "properties"), + dirs_exist_ok=True) + tasks.append(os.path.join(target_dir, os.path.basename(yml))) + return tasks + + +def rewrite_definition(source, rundefinition, tasks, staging, suites, out_path): + """`source`, narrowed to one run definition, our tasks and our paths.""" + tree = ET.parse(source) + root = tree.getroot() + for require in root.findall("require"): + root.remove(require) + kept = False + for run in list(root.findall("rundefinition")): + if run.get("name") != rundefinition: + root.remove(run) + continue + kept = True + for element in run.iter(): + if element.text: + for logdir in OFFICIAL_LOGDIRS: + element.text = element.text.replace(logdir, suites + "/") + element.text = element.text.replace("../sv-benchmarks/c/", staging + "/") + for old in run.findall("tasks"): + run.remove(old) + group = ET.SubElement(run, "tasks", name="map2check") + for task in tasks: + ET.SubElement(group, "include").text = task + if not kept: + sys.exit(f"{source}: no rundefinition {rundefinition}") + os.makedirs(os.path.dirname(out_path), exist_ok=True) + tree.write(out_path, xml_declaration=True, encoding="utf-8") + return out_path + + +def run_benchexec(definition, tool_dir, out_dir, staging, args, env=None): + """BenchExec from inside `tool_dir`, with the competition's overlays.""" + command = [ + "benchexec", definition, + "--tool-directory", ".", + "--outputpath", out_dir + "/", + "--numOfThreads", str(args.threads), + # Results are read once and the whole output directory is removed after + # each validator (see validate); compression is BenchExec's default. + "--read-only-dir", "/", "--overlay-dir", "/home/", "--overlay-dir", "./", + # An overlay, not full access: what one run writes beside a program + # must not reach the next. + "--overlay-dir", staging, + ] + command += args.benchexec_args + print("+", " ".join(command), flush=True) + return subprocess.call(command, cwd=tool_dir, env=env) + + +def read_results(out_dir): + """task -> (status, coverage %) from the BenchExec result XMLs in out_dir.""" + found = {} + paths = glob.glob(os.path.join(out_dir, "*.results.*.xml")) + paths += glob.glob(os.path.join(out_dir, "*.results.*.xml.bz2")) + for path in paths: + opener = bz2.open if path.endswith(".bz2") else open + with opener(path, "rb") as handle: + root = ET.parse(handle).getroot() + for run in root.findall("run"): + values = {c.get("title"): c.get("value") for c in run.findall("column")} + coverage = (values.get("branches_covered") or "").replace("%", "").strip() + found[os.path.basename(run.get("name"))] = (values.get("status", ""), coverage) + return found + + +def hand_back(path): + """BenchExec runs as root in the container; give the results back.""" + owner = os.environ.get("HOST_OWNER") + if owner: + subprocess.call(["chown", "-R", owner, path]) + + +# --- generate ----------------------------------------------------------------- + +def generate(args): + rundefinition = PROPERTIES[args.property] + out = os.path.abspath(args.out) + os.makedirs(out, exist_ok=True) + staging = os.path.join(out, "sv-benchmarks") + tasks = stage_tasks(args.tasks, os.path.abspath(args.sv_benchmarks), staging) + print(f"{len(tasks)} tasks, {rundefinition}", flush=True) + + definition = rewrite_definition(os.path.join(DEFS, "map2check.xml"), rundefinition, + tasks, staging, "", os.path.join(out, "defs", "map2check.xml")) + + # A fresh copy of the tool, unpacked as the competition unpacks archives. + tool_root = os.path.join(out, "tool") + shutil.rmtree(tool_root, ignore_errors=True) + subprocess.check_call(["unzip", "-q", os.path.abspath(args.archive), "-d", tool_root]) + tool_dir = os.path.join(tool_root, "map2check") + + # The tool-info module lives in the repository, not in BenchExec. + env = dict(os.environ) + env["PYTHONPATH"] = os.path.join(REPO, "utils") + os.pathsep + env.get("PYTHONPATH", "") + result_dir = os.path.join(out, "results") + os.makedirs(result_dir, exist_ok=True) + code = run_benchexec(definition, tool_dir, result_dir, staging, args, env=env) + + # <result>/<benchmark>.<date>.files/<rundefinition>/<task>.yml/test-suite/ + suites = os.path.abspath(args.suites) + count = 0 + for suite_dir in glob.glob(os.path.join(result_dir, "*.files", rundefinition, "*", "test-suite")): + taskdef = os.path.basename(os.path.dirname(suite_dir)) + target = os.path.join(suites, rundefinition, taskdef) + os.makedirs(target, exist_ok=True) + with zipfile.ZipFile(os.path.join(target, "test-suite.zip"), "w", + zipfile.ZIP_DEFLATED) as archive: + for name in sorted(os.listdir(suite_dir)): + archive.write(os.path.join(suite_dir, name), name) + count += 1 + shutil.rmtree(tool_root, ignore_errors=True) + # The suites are zipped out; the tool tree, the staged sv-benchmarks and the + # BenchExec output (whose .files hold every test-suite) are scratch. + shutil.rmtree(result_dir, ignore_errors=True) + shutil.rmtree(staging, ignore_errors=True) + hand_back(out) + hand_back(suites) + print(f"{count} suites in {os.path.join(suites, rundefinition)}") + return code + + +# --- validate ----------------------------------------------------------------- + +def validate(args): + rundefinition = PROPERTIES[args.property] + suites = os.path.abspath(args.suites) + out = os.path.abspath(args.out) + staging = os.path.join(out, "sv-benchmarks") + tasks = stage_tasks(args.tasks, os.path.abspath(args.sv_benchmarks), staging) + print(f"{len(tasks)} tasks, {rundefinition}", flush=True) + + per_validator = {} + for name in args.validators.split(","): + definition = rewrite_definition(os.path.join(DEFS, name + ".xml"), rundefinition, + tasks, staging, suites, + os.path.join(out, "defs", name + ".xml")) + result_dir = os.path.join(out, "results", name) + os.makedirs(result_dir, exist_ok=True) + # A fresh copy of the validator: TestCov's --format writes beside itself. + work = os.path.join(out, "tool") + shutil.rmtree(work, ignore_errors=True) + shutil.copytree(VALIDATORS[name], work, symlinks=True) + if run_benchexec(definition, work, result_dir, staging, args) != 0: + print(f"warning: benchexec exited non-zero for {name}", flush=True) + shutil.rmtree(work, ignore_errors=True) + per_validator[name] = read_results(result_dir) + # Keep the scratch when debugging (MAP2CHECK_KEEP_RESULTS=1); otherwise + # drop it, or a few-thousand-task corpus fills the disk. + if not os.environ.get("MAP2CHECK_KEEP_RESULTS"): + shutil.rmtree(result_dir, ignore_errors=True) + if not os.environ.get("MAP2CHECK_KEEP_RESULTS"): + shutil.rmtree(staging, ignore_errors=True) + + names = list(per_validator) + with open(os.path.join(out, "scores.csv"), "w", newline="") as handle: + writer = csv.writer(handle) + writer.writerow(["task"] + [f"{n}:{c}" for n in names for c in ("status", "coverage")] + + ["score", "best_validator"]) + for task in tasks: + key = os.path.basename(task) + row, best, best_by = [key], 0.0, "" + for name in names: + status, coverage = per_validator[name].get(key, ("MISSING", "")) + row += [status, coverage] + if args.property == "cover-error": + value = 1.0 if status == "true" else 0.0 + else: + try: + value = float(coverage) / 100 + except ValueError: + value = 0.0 + if value > best: + best, best_by = value, name + writer.writerow(row + [f"{best:.4f}", best_by]) + hand_back(out) + print(f"scores: {os.path.join(out, 'scores.csv')}") + return 0 + + +def main(): + parser = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + sub = parser.add_subparsers(dest="step", required=True) + for step in ("generate", "validate"): + p = sub.add_parser(step) + p.add_argument("--property", choices=PROPERTIES, required=True) + p.add_argument("--tasks", required=True, + help="manifest TSV or list of task paths (.c/.i/.yml)") + p.add_argument("--suites", required=True) + p.add_argument("--sv-benchmarks", required=True, + help="the c/ directory of sv-benchmarks") + p.add_argument("--out", required=True) + p.add_argument("--threads", type=int, default=3) + p.add_argument("benchexec_args", nargs="*", + help="after --, extra BenchExec options " + "(e.g. --timelimit 300s, a deliberate deviation)") + if step == "generate": + p.add_argument("--archive", required=True, help="the Map2Check tool archive") + else: + p.add_argument("--validators", default=",".join(VALIDATORS)) + args = parser.parse_args() + sys.exit(generate(args) if args.step == "generate" else validate(args)) + + +if __name__ == "__main__": + main() diff --git a/tests/testcomp/programs/char_input.c b/tests/testcomp/programs/char_input.c new file mode 100644 index 000000000..dbe098964 --- /dev/null +++ b/tests/testcomp/programs/char_input.c @@ -0,0 +1,13 @@ +// A char-typed read. NonDetLog.c formats the logged value according to the +// nondet type, so a type other than int exercises a distinct branch of the +// serializer -- the same kind of branch where the double type tag was wrong. +extern char __VERIFIER_nondet_char(void); +extern void reach_error(void); + +int main(void) { + char c = __VERIFIER_nondet_char(); + if (c == 'A') { + reach_error(); + } + return 0; +} diff --git a/tests/testcomp/programs/loop_reads.c b/tests/testcomp/programs/loop_reads.c new file mode 100644 index 000000000..e88e47f16 --- /dev/null +++ b/tests/testcomp/programs/loop_reads.c @@ -0,0 +1,16 @@ +// Four reads inside a loop. A suite that recovers the values but drops one, or +// reorders them, cannot reach the error -- so this checks the ordering +// contract at a length where an off-by-one is visible. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int sum = 0; + for (int i = 0; i < 4; i++) { + sum += __VERIFIER_nondet_int(); + } + if (sum == 10) { + reach_error(); + } + return 0; +} diff --git a/tests/testcomp/programs/no_input.c b/tests/testcomp/programs/no_input.c new file mode 100644 index 000000000..93fe91ee0 --- /dev/null +++ b/tests/testcomp/programs/no_input.c @@ -0,0 +1,10 @@ +// No nondeterministic input at all. The suite must still carry one test case +// with zero <input> elements: emitting no test case would make the suite +// unscoreable even though the error is trivially reachable, and Test-Comp +// tasks with no input do exist. +extern void reach_error(void); + +int main(void) { + reach_error(); + return 0; +} diff --git a/tests/testcomp/programs/single_int.c b/tests/testcomp/programs/single_int.c new file mode 100644 index 000000000..874c99c54 --- /dev/null +++ b/tests/testcomp/programs/single_int.c @@ -0,0 +1,12 @@ +// One nondeterministic read, one guard: the simplest suite that can exist. +// A failure here means the mechanism is broken, not that an edge case is. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x == 99) { + reach_error(); + } + return 0; +} diff --git a/tests/testcomp/programs/two_guards.c b/tests/testcomp/programs/two_guards.c new file mode 100644 index 000000000..b48686b52 --- /dev/null +++ b/tests/testcomp/programs/two_guards.c @@ -0,0 +1,17 @@ +// Two independent nondeterministic reads guard one error call. A suite that +// recovers both values but emits them in the wrong order never reaches +// reach_error, so this program tests the ordering contract and not only value +// recovery. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a == 42) { + if (b == 7) { + reach_error(); + } + } + return 0; +} diff --git a/tests/testcomp/programs/unreachable.c b/tests/testcomp/programs/unreachable.c new file mode 100644 index 000000000..b40c25f53 --- /dev/null +++ b/tests/testcomp/programs/unreachable.c @@ -0,0 +1,14 @@ +// reach_error() is unreachable: the guard is unsatisfiable. No suite can cover +// it. This is the negative control -- if the harness ever reports this one as +// COVERED then the harness is lying, and every other PASS in this corpus is +// meaningless. A gate that cannot fail is not a gate. +extern int __VERIFIER_nondet_int(void); +extern void reach_error(void); + +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 0 && x < 0) { + reach_error(); + } + return 0; +} diff --git a/tests/testcomp/run_testcomp_evaluation.sh b/tests/testcomp/run_testcomp_evaluation.sh new file mode 100755 index 000000000..879dfba49 --- /dev/null +++ b/tests/testcomp/run_testcomp_evaluation.sh @@ -0,0 +1,242 @@ +#!/bin/bash +# run_testcomp_evaluation.sh -- Map2Check over a stratified Test-Comp corpus, +# with every suite handed to TestCov for validation. +# +# What this measures, and what it does not. The per-task budget here is a small +# fraction of Test-Comp's 900s, so the numbers are NOT competition scores and +# must never be quoted as such. What they are is a broad functional sweep: does +# the tool produce a well-formed suite across the whole shape of the benchmark, +# and does an independent validator agree the suite covers what it claims. +# +# Resumable by design. The CSV is the state: a task already in it is skipped, so +# a container that dies, a WSL restart, or a deadline hit can all be continued by +# re-running the same command. That is also why the deadline is checked between +# tasks rather than enforced with an outer timeout -- a killed run mid-write +# leaves a truncated row that the resume logic would then trust. +# +# Environment: +# MANIFEST tab-separated corpus from build_corpus.py (required) +# PROPERTY cover-error | cover-branches (required) +# RESULTS_DIR where the CSV and raw logs go (required) +# SHARD/SHARDS process every SHARDS-th task starting at SHARD (default 0/1) +# GENERATOR symex | fuzzer | hybrid | hybrid-seed (default hybrid) +# EXTRA_FLAGS passed verbatim to map2check (e.g. "--slice") +# BUDGET seconds given to map2check per task (default 60) +# TESTCOV_S seconds given to TestCov per task (default 90) +# DEADLINE_S stop starting new tasks after this many seconds (default 18000) +# SUITES_DIR if set, keep every suite as +# $SUITES_DIR/<rundefinition>/<task>.yml/test-suite.zip, the layout +# tests/testcomp/official/run.sh validate reads (the official +# validators need the suites, not this harness's verdict) +# +# The container needs gcc-multilib. Most sv-benchmarks tasks declare ILP32, and +# without it TestCov cannot compile the program for -32 and reports no Result +# line at all -- which looks like a tool error and is really a missing package. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +BENCH="$SCRIPT_DIR/bench/sv-benchmarks/c" + +MANIFEST="${MANIFEST:?set MANIFEST}" +PROPERTY="${PROPERTY:?set PROPERTY to cover-error or cover-branches}" +RESULTS_DIR="${RESULTS_DIR:?set RESULTS_DIR}" +SHARD="${SHARD:-0}" +SHARDS="${SHARDS:-1}" +BUDGET="${BUDGET:-60}" +TESTCOV_S="${TESTCOV_S:-90}" +DEADLINE_S="${DEADLINE_S:-18000}" + +# Which engine produces the inputs. Parameterised so the three arms can be +# compared on the SAME task list: +# +# symex KLEE only -- every Test-Comp measurement before 2026-08-23 +# afl AFL++ only (tacasv1 onwards; `fuzzer` was LibFuzzer and is +# refused -- the engine is gone, and a result dir named for it +# would mix two engines) +# hybrid the tool's actual default: the fuzzer at 0.2x, then KLEE +# hybrid-seed the same, with the two engines exchanging input vectors +# +# The default is hybrid, which is also the tool's own default when no +# --nondet-generator is given. Every Test-Comp measurement before 2026-08-23 +# forced symex and so measured a mode nobody actually runs. +# +# Measured on the same 372-task corpus: symex 23% covered, fuzzer 35%, hybrid +# 47% -- and the hybrid captured the whole UNION of what the two engines reach +# alone. Directories written before the switch carry `symex` in this comment's +# place; they are not comparable to hybrid runs and should not be pooled. +GENERATOR="${GENERATOR:-hybrid}" + +# Extra flags handed straight to map2check, for measuring an opt-in capability +# against a run without it. Kept separate from GENERATOR because these are not +# engine choices: --slice and --seed-exchange both sit on top of whichever +# engine is running. +EXTRA_FLAGS="${EXTRA_FLAGS:-}" +case "$GENERATOR" in + symex|afl) GENERATOR_FLAG="--nondet-generator $GENERATOR" ;; + fuzzer) echo "GENERATOR=fuzzer was LibFuzzer, which AFL++ replaced -- use GENERATOR=afl" >&2; exit 2 ;; + hybrid) GENERATOR_FLAG="" ;; # absent flag IS the hybrid path + hybrid-seed) GENERATOR_FLAG="--seed-exchange" ;; + *) echo "unknown GENERATOR: $GENERATOR" >&2; exit 2 ;; +esac + +MAP2CHECK_DIR="${MAP2CHECK_PATH:?set MAP2CHECK_PATH}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" + +case "$PROPERTY" in + cover-error) PRP="$BENCH/properties/coverage-error-call.prp" + GOAL_FLAGS="--target-function --target-function-name reach_error" ;; + cover-branches) PRP="$BENCH/properties/coverage-branches.prp" + GOAL_FLAGS="--cover-branches" ;; + *) echo "unknown PROPERTY: $PROPERTY" >&2; exit 2 ;; +esac + +mkdir -p "$RESULTS_DIR/raw" + +# Per-task work directories live under one root per results dir and shard, and +# the root is emptied on start. A task killed by a reboot never reaches the +# rm -rf at the end of the loop, so its directory -- KLEE output included, up to +# 4 GB each -- used to stay in /tmp for good. Over the V99c campaign, a handful +# of reboots left 11 GB in one container and filled the Windows disk under WSL. +# Only this shard writes here, so nothing that is still running gets swept. +WORK_ROOT="${TMPDIR:-/tmp}/m2c-eval.$(basename "$RESULTS_DIR").s$SHARD" +rm -rf "$WORK_ROOT" +mkdir -p "$WORK_ROOT" +CSV="$RESULTS_DIR/results.csv" +if [ ! -f "$CSV" ]; then + echo "category,program,data_model,expected_unreach,verdict,testcov,coverage,goals,n_tests,elapsed_s" > "$CSV" +fi + +# Already-done set, read once. Re-reading per task turns a resume into O(n^2) +# over a corpus of hundreds. +declare -A DONE +while IFS=, read -r _cat prog _rest; do + [ -n "$prog" ] && DONE["$prog"]=1 +done < <(tail -n +2 "$CSV") + +started=$(date +%s) +index=-1 +processed=0 +skipped=0 + +# fd 3, not stdin: map2check, zip and testcov all inherit stdin, and one of them +# consuming it eats the rest of the manifest. That is not hypothetical -- it is +# how an earlier harness processed exactly one case per chunk. +while IFS=$'\t' read -r category program data_model expected <&3; do + case "$category" in ''|\#*) continue ;; esac + index=$((index + 1)) + [ $((index % SHARDS)) -eq "$SHARD" ] || continue + + if [ -n "${DONE[$program]:-}" ]; then + skipped=$((skipped + 1)) + continue + fi + + now=$(date +%s) + if [ $((now - started)) -ge "$DEADLINE_S" ]; then + echo "[deadline] stopping after ${processed} tasks ($(( (now-started)/60 )) min)" + break + fi + + src="$BENCH/$program" + if [ ! -f "$src" ]; then + echo "$category,$program,$data_model,$expected,MISSING,NA,,,0,0" >> "$CSV" + continue + fi + + # A private directory per task. map2check names its scratch by the hash of the + # input, so two tasks with identical content would otherwise share -- and a + # directory left behind by an aborted run would be reused with stale contents. + work=$(mktemp -d -p "$WORK_ROOT") + cp "$src" "$work/" 2>/dev/null || { rm -rf "$work"; continue; } + cp "$PRP" "$work/prop.prp" + name=$(basename "$src") + arch=$([ "$data_model" = "LP64" ] && echo 64bit || echo 32bit) + + t0=$(date +%s) + ( + cd "$work" || exit 1 + MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 $((BUDGET + 30)) "$MAP2CHECK" \ + $GENERATOR_FLAG $EXTRA_FLAGS --generate-test-suite $GOAL_FLAGS \ + --property-file prop.prp --architecture "$arch" \ + --timeout "$BUDGET" "$name" + ) > "$work/map2check.log" 2>&1 </dev/null 3<&- + t1=$(date +%s) + + verdict=$(grep -oE 'VERIFICATION (FAILED|SUCCEEDED|UNKNOWN)' "$work/map2check.log" | tail -1) + verdict="${verdict#VERIFICATION }" + [ -z "$verdict" ] && verdict="ERROR" + n_tests=$(ls "$work/test-suite"/testcase-*.xml 2>/dev/null | wc -l) + + testcov="NO_SUITE" + coverage="" + goals="" + if [ -d "$work/test-suite" ]; then + ( cd "$work/test-suite" && zip -q -r ../suite.zip . ) </dev/null 3<&- + fi + # TESTCOV_S=0 skips the internal TestCov (3.7) and leaves the verdict to the + # official validators (tests/testcomp/official/run.sh validate), which read + # the suite kept by SUITES_DIR. + if [ -d "$work/test-suite" ] && [ "${TESTCOV_S:-90}" -ne 0 ]; then + bits=$([ "$arch" = "64bit" ] && echo -64 || echo -32) + ( cd "$work" && timeout -k 10 "$TESTCOV_S" testcov --test-suite suite.zip \ + --no-isolation "$bits" --goal prop.prp "$name" ) \ + > "$work/testcov.log" 2>&1 </dev/null 3<&- + # TestCov exits 0 whether or not the suite covers, so the verdict is the + # Result line, never $?. + # + # The label is property-aware, because the same Result line does not mean + # the same thing in both categories. + # + # cover-error is pass/fail: TRUE means the suite reproduced the bug, + # UNKNOWN means it did not. + # + # cover-branches has no pass/fail. The competition scores the coverage + # FRACTION, and the Result line says nothing about it: measured, DONE + # appears at 100% and at 77.78%, while UNKNOWN appears when TestCov had to + # abort a test's execution. So DONE means "validated cleanly" and UNKNOWN + # means "validated, with a test that would not run" -- and in BOTH cases + # the coverage column beside it is the number that matters. Labelling them + # FULL and PARTIAL, as a first version did, reads as a coverage claim the + # Result line is not making. + if grep -qE '^Result: TRUE' "$work/testcov.log"; then + testcov="COVERED" + elif grep -qE '^Result: DONE' "$work/testcov.log"; then + testcov=$([ "$PROPERTY" = "cover-branches" ] && echo VALIDATED || echo DONE) + elif grep -qE '^Result: UNKNOWN' "$work/testcov.log"; then + testcov=$([ "$PROPERTY" = "cover-branches" ] && echo VALIDATED_ABORTS \ + || echo NOT_COVERED) + else + testcov="TESTCOV_ERROR" + fi + coverage=$(grep -oE '^Coverage: [0-9.]+' "$work/testcov.log" | tail -1 | awk '{print $2}') + goals=$(grep -oE '^Number of goals: [0-9]+' "$work/testcov.log" | tail -1 | awk '{print $4}') + fi + + echo "$category,$program,$data_model,$expected,$verdict,$testcov,$coverage,$goals,$n_tests,$((t1-t0))" >> "$CSV" + printf '[%s] %-14s %-52s %-9s %-13s %s%%\n' \ + "$(date +%H:%M:%S)" "$category" "$(basename "$program")" "$verdict" "$testcov" "${coverage:-—}" + + # Raw logs only for the interesting cases: keeping every log over hundreds of + # tasks fills the disk with successes nobody reads. + if [ "$testcov" = "TESTCOV_ERROR" ] || [ "$verdict" = "ERROR" ]; then + cp "$work/map2check.log" "$RESULTS_DIR/raw/$(echo "$program" | tr '/' '_').m2c.log" 2>/dev/null + cp "$work/testcov.log" "$RESULTS_DIR/raw/$(echo "$program" | tr '/' '_').tc.log" 2>/dev/null + fi + + if [ -n "${SUITES_DIR:-}" ] && [ -f "$work/suite.zip" ]; then + rundef=$([ "$PROPERTY" = "cover-branches" ] && echo Test-Comp26_coverage-branches \ + || echo Test-Comp26_coverage-error-call) + taskdef=$(basename "${program%.*}").yml + mkdir -p "$SUITES_DIR/$rundef/$taskdef" + cp "$work/suite.zip" "$SUITES_DIR/$rundef/$taskdef/test-suite.zip" + fi + + rm -rf "$work" + processed=$((processed + 1)) +done 3< "$MANIFEST" + +echo "==========================================================" +echo "shard $SHARD/$SHARDS: $processed processed, $skipped already done" +echo "CSV: $CSV" +echo "==========================================================" diff --git a/tests/testcomp/run_testcov.sh b/tests/testcomp/run_testcov.sh new file mode 100755 index 000000000..25079b5b9 --- /dev/null +++ b/tests/testcomp/run_testcov.sh @@ -0,0 +1,128 @@ +#!/bin/bash +# run_testcov.sh <program.c> <property.prp> [--verdict-only] +# +# Generates a test suite with Map2Check and hands it to TestCov, the official +# Test-Comp validator. This answers the question the structural test cannot: +# not "is the XML well formed" but "does this suite actually reproduce the bug", +# which is the only thing the competition scores. +# +# TestCov takes a zip while the competition consumes a directory, so the zip is +# built here rather than by the tool. +# +# No --nondet-generator: the absent flag IS the hybrid path, LibFuzzer then +# KLEE, which is what the tool does when a competition harness invokes it. This +# used to force symex, so the gate exercised a mode the competition never sees. + +set -u + +PROGRAM="$1" +PROPERTY="$2" +VERDICT_ONLY="" +[ "${3:-}" = "--verdict-only" ] && VERDICT_ONLY=1 + +MAP2CHECK_DIR="${MAP2CHECK_PATH:-/workspace/install_e2e}" +MAP2CHECK="$MAP2CHECK_DIR/map2check" +TESTCOV="${TESTCOV:-testcov}" +BUDGET="${BUDGET:-120}" + +WORK=$(mktemp -d) +# Keeping the working directory on request is what makes a red CI job +# debuggable; cleaning by default keeps local runs from littering /tmp with one +# directory per program per invocation. +# +# The notice goes to STDERR and must stay there. In --verdict-only mode stdout +# carries exactly one word, which the caller captures with $(...); printing this +# on stdout appended a second line to the verdict and made every comparison +# fail with "expected COVERED, observed COVERED". It passed locally and failed +# in CI purely because only the CI step sets KEEP_WORK. +if [ -n "${KEEP_WORK:-}" ]; then + trap 'echo " (work kept at $WORK)" >&2' EXIT +else + trap 'rm -rf "$WORK"' EXIT +fi + +# Verdict extraction. These patterns are not guesses: they are what TestCov 3.7 +# printed on a covering and on a non-covering suite, recorded verbatim in +# NOTES-testcov-output.md. +# +# The exit code is NOT usable -- TestCov returns 0 in both cases, so a gate +# built on $? would pass unconditionally. Anything that matches neither pattern +# becomes ERROR rather than NOT_COVERED, so a wording change in a future TestCov +# fails loudly instead of quietly reporting that nothing covers anything. +testcov_verdict() { + local log="$1" + if grep -qE '^Result: TRUE[[:space:]]*$' "$log"; then + echo COVERED + elif grep -qE '^Result: UNKNOWN[[:space:]]*$' "$log"; then + echo NOT_COVERED + else + echo ERROR + fi +} + +name=$(basename "$PROGRAM") +prop=$(basename "$PROPERTY") +cp "$PROGRAM" "$WORK/" +cp "$PROPERTY" "$WORK/" + +( cd "$WORK" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 "$BUDGET" \ + "$MAP2CHECK" --target-function --target-function-name reach_error \ + --generate-test-suite --property-file "$prop" --architecture 64bit \ + --timeout "$((BUDGET / 2))" "$name" ) \ + > "$WORK/map2check.log" 2>&1 + +if [ ! -d "$WORK/test-suite" ]; then + # No violation found means no suite, which for validation purposes is exactly + # "the error was not covered". Telling that apart from "found the wrong thing" + # is the tool's job, not the validator's. + if [ -n "$VERDICT_ONLY" ]; then + echo NOT_COVERED + exit 0 + fi + echo "FAIL $name: no test suite produced" + tail -3 "$WORK/map2check.log" + exit 1 +fi + +( cd "$WORK/test-suite" && zip -q -r ../suite.zip . ) + +# --no-isolation: no cgroup access on CI runners. -64: TestCov defaults to -m32 +# while Map2Check compiles for the host model, and the mismatch surfaces as a +# suite that covers nothing rather than as an error. +( cd "$WORK" && timeout -k 10 "$BUDGET" "$TESTCOV" --test-suite suite.zip \ + --no-isolation -64 --goal "$prop" "$name" ) > "$WORK/testcov.log" 2>&1 + +verdict=$(testcov_verdict "$WORK/testcov.log") + +# An ERROR verdict means TestCov printed neither Result: line -- it did not run, +# or it ran and blew up. In --verdict-only mode the caller reads stdout and would +# otherwise see the single word "ERROR" with no way to find out why, which is +# exactly how this gate first failed in CI: undebuggable from the job log. +# Diagnostics go to stderr so they reach the log without corrupting the verdict +# the caller parses from stdout. +if [ "$verdict" = "ERROR" ]; then + { + echo "--- $name: TestCov produced no Result: line ---" + echo "--- last 25 lines of testcov.log ---" + tail -25 "$WORK/testcov.log" + echo "--- last 5 lines of map2check.log ---" + tail -5 "$WORK/map2check.log" + echo "--- suite contents ---" + ls -la "$WORK/test-suite" 2>/dev/null + echo "--- end $name ---" + } >&2 +fi + +if [ -n "$VERDICT_ONLY" ]; then + echo "$verdict" + [ "$verdict" = "ERROR" ] && exit 1 + exit 0 +fi + +if [ "$verdict" = "COVERED" ]; then + echo "PASS $name: TestCov reproduced the error" + exit 0 +fi +echo "FAIL $name: TestCov verdict is $verdict" +tail -20 "$WORK/testcov.log" +exit 1 diff --git a/tests/testcomp/run_testcov_suite.sh b/tests/testcomp/run_testcov_suite.sh new file mode 100755 index 000000000..1db55cba8 --- /dev/null +++ b/tests/testcomp/run_testcov_suite.sh @@ -0,0 +1,73 @@ +#!/bin/bash +# run_testcov_suite.sh -- runs every program in expected.txt through Map2Check +# and TestCov, and compares each verdict against the manifest. +# +# Exit 0 only if every observed verdict equals its expected verdict. BOTH +# directions are failures: a regression, and an improvement nobody recorded. +# The second half of that matters more than it looks -- an unrecorded +# improvement is indistinguishable from a harness that started reporting +# COVERED for everything. +# +# Per-program budget is deliberately small. This is a conformance gate, not a +# benchmark: a program that needs more than two minutes to have its error +# covered does not belong in this corpus. + +set -u + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +MANIFEST="$SCRIPT_DIR/expected.txt" +PROPERTY="$SCRIPT_DIR/cover-error-call.prp" +export BUDGET="${BUDGET:-120}" + +PASSED=0 +FAILED=0 + +echo "============================================================" +echo "Test-Comp validation via TestCov (budget ${BUDGET}s per program)" +echo "============================================================" + +if ! command -v "${TESTCOV:-testcov}" >/dev/null 2>&1; then + echo "FATAL: ${TESTCOV:-testcov} not found. Install it with: pip3 install testcov" >&2 + exit 2 +fi + +while read -r program expected _rest; do + case "$program" in '' | \#*) continue ;; esac + + path="$SCRIPT_DIR/programs/$program" + if [ ! -f "$path" ]; then + echo " FAIL $program: listed in expected.txt but the file is missing" + FAILED=$((FAILED + 1)) + continue + fi + + observed=$(bash "$SCRIPT_DIR/run_testcov.sh" "$path" "$PROPERTY" --verdict-only) + + # Guard the contract explicitly. --verdict-only promises exactly one word on + # stdout; anything else means the runner leaked a diagnostic there. Left + # unchecked that produces "expected COVERED, observed COVERED" -- a comparison + # that fails while printing two identical-looking values, which is about the + # most confusing way a gate can break. Naming the problem beats tolerating it. + case "$observed" in + COVERED | NOT_COVERED | ERROR) ;; + *) + printf ' FAIL %-18s runner emitted an unparseable verdict: %q\n' \ + "$program" "$observed" + FAILED=$((FAILED + 1)) + continue + ;; + esac + + if [ "$observed" = "$expected" ]; then + printf ' PASS %-18s %s\n' "$program" "$observed" + PASSED=$((PASSED + 1)) + else + printf ' FAIL %-18s expected %s, observed %s\n' "$program" "$expected" "$observed" + FAILED=$((FAILED + 1)) + fi +done < "$MANIFEST" + +echo "============================================================" +echo "Results: $PASSED passed, $FAILED failed" +echo "============================================================" +[ "$FAILED" -eq 0 ] && exit 0 || exit 1 diff --git a/tests/unit/CMakeLists.txt b/tests/unit/CMakeLists.txt index df4885978..d413da1de 100644 --- a/tests/unit/CMakeLists.txt +++ b/tests/unit/CMakeLists.txt @@ -3,4 +3,5 @@ function(map2check_test EXECUTABLE) add_test(NAME ${EXECUTABLE} COMMAND ${EXECUTABLE}) endfunction(map2check_test) -add_subdirectory(backend-library) \ No newline at end of file +add_subdirectory(backend-library) +add_subdirectory(frontend) diff --git a/tests/unit/backend-library/CMakeLists.txt b/tests/unit/backend-library/CMakeLists.txt index baca1f5e7..0c7101072 100644 --- a/tests/unit/backend-library/CMakeLists.txt +++ b/tests/unit/backend-library/CMakeLists.txt @@ -44,9 +44,16 @@ add_executable(MemTrackTest $<TARGET_OBJECTS:WitnessGenerationNoneLib> ) +add_executable(NonDetLogTest + NonDetLogTest.cpp + $<TARGET_OBJECTS:NonDetLogLib> + ${DEFAULT_CONTAINER_LIB} +) + map2check_test(AllocationLogTest) map2check_test(HeapLogTest) map2check_test(ContainerReallocTest) map2check_test(BTreeTest) map2check_test(ContainerBTreeTest) -map2check_test(MemTrackTest) \ No newline at end of file +map2check_test(MemTrackTest) +map2check_test(NonDetLogTest) diff --git a/tests/unit/backend-library/NonDetLogTest.cpp b/tests/unit/backend-library/NonDetLogTest.cpp new file mode 100644 index 000000000..20ee622b8 --- /dev/null +++ b/tests/unit/backend-library/NonDetLogTest.cpp @@ -0,0 +1,86 @@ +#include <gtest/gtest.h> +extern "C" { +#include <modules/backend/library/header/NonDetLog.h> +} + +#include <cfloat> +#include <climits> +#include <filesystem> +#include <fstream> +#include <sstream> +#include <string> + +/* NonDetLog.c takes its step counter from Map2CheckFunctions.c; the test + * links only the log and its container. */ +extern "C" { +static unsigned current_step = 0; +unsigned map2check_get_current_step() { return current_step; } +void map2check_next_current_step() { current_step++; } +} + +namespace { +std::string readFile(const std::string &path) { + std::ifstream in(path); + std::stringstream text; + text << in.rdbuf(); + return text.str(); +} +} // namespace + +class NonDetLogTest : public ::testing::Test { + protected: + void SetUp() override { + previous = std::filesystem::current_path(); + directory = std::filesystem::temp_directory_path() / + ("nondetlog-" + std::to_string(::getpid())); + std::filesystem::create_directories(directory); + std::filesystem::current_path(directory); + current_step = 0; + nondet_log_init(); + } + void TearDown() override { + nondet_log_destroy(); + std::filesystem::current_path(previous); + std::filesystem::remove_all(directory); + } + + std::filesystem::path previous; + std::filesystem::path directory; +}; + +/* The writer formats numbers by hand, not with fprintf (issue #75: under KLEE + * uClibc's vfprintf cost ~7,000 instructions a call). Every expected line + * below is what the fprintf version printed for the same row, so the file the + * frontend parses is byte for byte the same. */ +TEST_F(NonDetLogTest, WritesEveryTypeExactlyAsPrintfDid) { + map2check_nondet_int(10, 3, -1, "__VERIFIER_nondet_int"); + map2check_nondet_int(11, 3, INT_MIN, "__VERIFIER_nondet_int"); + map2check_nondet_unsigned(1, 2, UINT_MAX, "u"); + map2check_nondet_longlong(5, 6, LLONG_MIN, "ll"); + map2check_nondet_ulonglong(7, 8, ULLONG_MAX, "ull"); + map2check_nondet_double(9, 9, 1.5, "d"); + map2check_nondet_double(9, 9, -0.0, "d"); + map2check_nondet_float(9, 9, 1e-30f, "f"); + map2check_nondet_float(9, 9, 0.1f, "f"); + map2check_nondet_memory_byte(0, 0, 200, "__VERIFIER_nondet_memory"); + map2check_nondet_int(1, 1, 7, "a_function_name_that_is_exactly_34c"); + + ASSERT_TRUE(nondet_log_to_file(map2check_nondet_get_log())); + EXPECT_EQ(readFile("klee_log.csv"), + "0;10;3;__VERIFIER_nondet_int;0;-1;0\n" + "1;11;3;__VERIFIER_nondet_int;1;-2147483648;0\n" + "2;1;2;u;2;4294967295;5\n" + "3;5;6;ll;3;-9223372036854775808;17\n" + "4;7;8;ull;4;18446744073709551615;18\n" + "5;9;9;d;5;1.500000;15\n" + "6;9;9;d;6;-0.000000;15\n" + "7;9;9;f;7;1e-30;16\n" + "8;9;9;f;8;0.100000001;16\n" + "9;0;0;__VERIFIER_nondet_memory;9;200;22\n" + "10;1;1;a_function_name_that_is_exactly_34c;10;7;0\n"); +} + +TEST_F(NonDetLogTest, AnEmptyLogIsAnEmptyFile) { + ASSERT_TRUE(nondet_log_to_file(map2check_nondet_get_log())); + EXPECT_EQ(readFile("klee_log.csv"), ""); +} diff --git a/tests/unit/frontend/AlternationTest.cpp b/tests/unit/frontend/AlternationTest.cpp new file mode 100644 index 000000000..18139ff18 --- /dev/null +++ b/tests/unit/frontend/AlternationTest.cpp @@ -0,0 +1,59 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include <gtest/gtest.h> + +#include "../../../modules/frontend/utils/alternation.hpp" + +using Map2Check::Engine; + +TEST(AlternationWindow, StartsAtTheBaseShareOfTheBudget) { + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Fuzzer, 1, 300, 300), + 30); + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Klee, 1, 300, 270), 90); +} + +TEST(AlternationWindow, DoublesEveryRound) { + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Fuzzer, 2, 300, 300), + 60); + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Klee, 3, 300, 1000), + 360); +} + +TEST(AlternationWindow, NeverExceedsWhatIsLeft) { + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Klee, 2, 300, 40), 40); +} + +TEST(StagnationSeconds, IsFivePercentButAtLeastTen) { + EXPECT_EQ(Map2Check::stagnationSeconds(300), 15u); + EXPECT_EQ(Map2Check::stagnationSeconds(60), 10u); +} + +TEST(CoverageWatch, StagnatesOnlyAfterTheQuietPeriod) { + Map2Check::CoverageWatch watch(10); + EXPECT_FALSE(watch.stagnated(100, 0)); + EXPECT_FALSE(watch.stagnated(100, 9)); + EXPECT_FALSE(watch.stagnated(120, 9.5)); // progress resets the clock + EXPECT_FALSE(watch.stagnated(120, 19)); + EXPECT_TRUE(watch.stagnated(120, 19.5)); +} + +TEST(CoverageWatch, AnUnreadableSampleIsNotEvidence) { + Map2Check::CoverageWatch watch(10); + EXPECT_FALSE(watch.stagnated(-1, 0)); + EXPECT_FALSE(watch.stagnated(-1, 50)); // never read: no verdict on progress + EXPECT_FALSE(watch.stagnated(5, 51)); + EXPECT_FALSE(watch.stagnated(-1, 60)); + EXPECT_TRUE(watch.stagnated(5, 61.5)); +} + +TEST(StagnationSeconds, KleesPatienceDoublesWithItsRounds) { + EXPECT_EQ(Map2Check::stagnationSeconds(300, 1), 15u); + EXPECT_EQ(Map2Check::stagnationSeconds(300, 2), 30u); + EXPECT_EQ(Map2Check::stagnationSeconds(300, 3), 60u); +} diff --git a/tests/unit/frontend/CMakeLists.txt b/tests/unit/frontend/CMakeLists.txt new file mode 100644 index 000000000..1ff300a70 --- /dev/null +++ b/tests/unit/frontend/CMakeLists.txt @@ -0,0 +1,39 @@ +add_executable(Sha256Test + Sha256Test.cpp + $<TARGET_OBJECTS:Sha256> +) +map2check_test(Sha256Test) + +add_executable(TestSuiteTest + TestSuiteTest.cpp + $<TARGET_OBJECTS:TestSuite> +) +map2check_test(TestSuiteTest) + +add_executable(KtestReaderTest + KtestReaderTest.cpp + $<TARGET_OBJECTS:TestSuite> +) +map2check_test(KtestReaderTest) + +add_executable(SlicerTest + SlicerTest.cpp +) +map2check_test(SlicerTest) + +add_executable(SeedStoreTest + SeedStoreTest.cpp +) +map2check_test(SeedStoreTest) + +add_executable(AlternationTest + AlternationTest.cpp +) +map2check_test(AlternationTest) + +add_executable(KleeLogTest + KleeLogTest.cpp + $<TARGET_OBJECTS:Tools> + $<TARGET_OBJECTS:Log> +) +map2check_test(KleeLogTest) diff --git a/tests/unit/frontend/KleeLogTest.cpp b/tests/unit/frontend/KleeLogTest.cpp new file mode 100644 index 000000000..ca7ec337e --- /dev/null +++ b/tests/unit/frontend/KleeLogTest.cpp @@ -0,0 +1,68 @@ +#include <gtest/gtest.h> + +#include <cstdio> +#include <fstream> +#include <string> +#include <vector> + +#include "../../../modules/frontend/utils/tools.hpp" + +namespace { + +using Map2Check::KleeLogHelper; +using Map2Check::KleeLogRow; +using Map2Check::KleeLogType; + +// One klee_log.csv row per type number: id;line;scope;function;step;value;type +std::vector<KleeLogRow> parse(const std::vector<std::string>& types) { + const std::string path = "klee_log_test.csv"; + { + std::ofstream out(path); + for (size_t i = 0; i < types.size(); ++i) { + out << i << ";10;1;main;" << i << ";7;" << types[i] << "\n"; + } + } + std::vector<KleeLogRow> rows = KleeLogHelper::getListLogFromCSV(path); + std::remove(path.c_str()); + return rows; +} + +} // namespace + +// Every number of the runtime's enum NONDET_TYPE (Map2CheckTypes.h) has a +// type and a generator name; the parser used to know only 0-5 and left the +// type uninitialized, which the witness then read. +TEST(KleeLog, EveryRuntimeTypeHasAGeneratorName) { + const std::vector<std::string> expected = { + "__VERIFIER_nondet_int", "__VERIFIER_nondet_char", + "__VERIFIER_nondet_pointer", "__VERIFIER_nondet_ushort", + "__VERIFIER_nondet_long", "__VERIFIER_nondet_uint", + "__VERIFIER_nondet_ulong", "__VERIFIER_nondet_bool", + "__VERIFIER_nondet_uchar", "__VERIFIER_nondet_pchar", + "__VERIFIER_nondet_size_t", "__VERIFIER_nondet_loff_t", + "__VERIFIER_nondet_sector_t", "__VERIFIER_nondet_uint", + "__VERIFIER_nondet_short", "__VERIFIER_nondet_double", + "__VERIFIER_nondet_float", "__VERIFIER_nondet_longlong", + "__VERIFIER_nondet_ulonglong", "__VERIFIER_nondet_u8", + "__VERIFIER_nondet_u16", "__VERIFIER_nondet_u32", + "__VERIFIER_nondet_memory"}; + std::vector<std::string> types; + for (size_t i = 0; i < expected.size(); ++i) types.push_back(std::to_string(i)); + std::vector<KleeLogRow> rows = parse(types); + ASSERT_EQ(rows.size(), expected.size()); + for (size_t i = 0; i < expected.size(); ++i) { + EXPECT_EQ(static_cast<size_t>(rows[i].type), i) << "type " << i; + EXPECT_EQ(rows[i].generateWitnessFunctionName(), expected[i]) << "type " << i; + } +} + +// A number outside the enum, or no number at all, is UNKNOWN with no name. +TEST(KleeLog, AnUnknownTypeIsUnknownAndHasNoName) { + std::vector<KleeLogRow> rows = parse({"23", "-1", "abc"}); + ASSERT_EQ(rows.size(), 3u); + for (const KleeLogRow& row : rows) { + EXPECT_EQ(row.type, KleeLogType::UNKNOWN); + EXPECT_EQ(row.generateWitnessFunctionName(), ""); + EXPECT_EQ(std::string(row).find("Call Function"), std::string::npos); + } +} diff --git a/tests/unit/frontend/KtestReaderTest.cpp b/tests/unit/frontend/KtestReaderTest.cpp new file mode 100644 index 000000000..040267e1f --- /dev/null +++ b/tests/unit/frontend/KtestReaderTest.cpp @@ -0,0 +1,603 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +// A .ktest is a binary format written by another project. Parsing it wrong +// does not crash: it yields plausible-looking numbers, which become plausible- +// looking <input> elements, which a validator scores as covering nothing. The +// failure is silent all the way down, so the parsing is pinned here against +// bytes this file builds by hand rather than against whatever KLEE happened to +// emit on the day. + +#include <gtest/gtest.h> + +#include <cstdint> +#include <cstdlib> +#include <cstring> +#include <filesystem> +#include <fstream> +#include <string> +#include <vector> + +#include "../../../modules/frontend/test_suite/ktest_reader.hpp" + +namespace fs = std::filesystem; + +namespace { + +// The format, from KLEE's ktest-tool: five-byte magic, then big-endian 32-bit +// counts. Version >= 2 carries two symbolic-argv fields before the objects. +class KtestBuilder { + public: + explicit KtestBuilder(uint32_t version = 3) : version_(version) {} + + KtestBuilder& object(const std::string& name, + const std::vector<uint8_t>& bytes) { + objects_.push_back({name, bytes}); + return *this; + } + + void writeTo(const fs::path& path, const char* magic = "KTEST") const { + std::ofstream out(path, std::ios::binary); + out.write(magic, 5); + putBE(out, version_); + putBE(out, 1); // one argument, the bitcode path + const std::string arg = "./program.bc"; + putBE(out, static_cast<uint32_t>(arg.size())); + out.write(arg.data(), arg.size()); + if (version_ >= 2) { + putBE(out, 0); // symArgvs + putBE(out, 0); // symArgvLen + } + putBE(out, static_cast<uint32_t>(objects_.size())); + for (const auto& object : objects_) { + putBE(out, static_cast<uint32_t>(object.first.size())); + out.write(object.first.data(), object.first.size()); + putBE(out, static_cast<uint32_t>(object.second.size())); + if (!object.second.empty()) { + out.write(reinterpret_cast<const char*>(object.second.data()), + object.second.size()); + } + } + } + + private: + static void putBE(std::ofstream& out, uint32_t value) { + const unsigned char raw[4] = { + static_cast<unsigned char>((value >> 24) & 0xff), + static_cast<unsigned char>((value >> 16) & 0xff), + static_cast<unsigned char>((value >> 8) & 0xff), + static_cast<unsigned char>(value & 0xff)}; + out.write(reinterpret_cast<const char*>(raw), 4); + } + + uint32_t version_; + std::vector<std::pair<std::string, std::vector<uint8_t>>> objects_; +}; + +std::vector<uint8_t> le32(int32_t value) { + std::vector<uint8_t> bytes(4); + std::memcpy(bytes.data(), &value, 4); + return bytes; +} + +std::vector<uint8_t> leDouble(double value) { + std::vector<uint8_t> bytes(8); + std::memcpy(bytes.data(), &value, 8); + return bytes; +} + +std::vector<uint8_t> le64(int64_t value) { + std::vector<uint8_t> bytes(8); + std::memcpy(bytes.data(), &value, 8); + return bytes; +} + +std::vector<uint8_t> leFloat(float value) { + std::vector<uint8_t> bytes(4); + std::memcpy(bytes.data(), &value, 4); + return bytes; +} + +fs::path freshDir(const std::string& name) { + fs::path d = fs::temp_directory_path() / ("m2c_ktest_" + name); + fs::remove_all(d); + fs::create_directories(d); + return d; +} + +Map2Check::KtestObject obj(const std::string& name, + const std::vector<uint8_t>& bytes) { + return Map2Check::KtestObject{name, bytes}; +} + +} // namespace + +// --- parsing ---------------------------------------------------------------- + +TEST(ReadKtestFile, ReadsObjectsInOrder) { + fs::path d = freshDir("order"); + KtestBuilder() + .object("non_det_int", le32(42)) + .object("non_det_char", {'z'}) + .writeTo(d / "test000001.ktest"); + + auto objects = Map2Check::readKtestFile((d / "test000001.ktest").string()); + ASSERT_EQ(objects.size(), 2u); + EXPECT_EQ(objects[0].name, "non_det_int"); + EXPECT_EQ(objects[0].bytes.size(), 4u); + EXPECT_EQ(objects[1].name, "non_det_char"); + EXPECT_EQ(objects[1].bytes.size(), 1u); + fs::remove_all(d); +} + +// KLEE has written both magics over its lifetime; refusing the older one would +// make the suite silently empty rather than loudly wrong. +TEST(ReadKtestFile, AcceptsTheLegacyBoutMagic) { + fs::path d = freshDir("bout"); + KtestBuilder(1).object("non_det_int", le32(7)).writeTo(d / "a.ktest", "BOUT\n"); + auto objects = Map2Check::readKtestFile((d / "a.ktest").string()); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} + +// Version 1 has no symbolic-argv fields. Reading them anyway would consume +// eight bytes of the object table and produce garbage names. +TEST(ReadKtestFile, HandlesVersionOneWithoutSymArgvFields) { + fs::path d = freshDir("v1"); + KtestBuilder(1).object("non_det_int", le32(5)).writeTo(d / "a.ktest"); + auto objects = Map2Check::readKtestFile((d / "a.ktest").string()); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} + +TEST(ReadKtestFile, RejectsAFileThatIsNotAKtest) { + fs::path d = freshDir("garbage"); + { std::ofstream(d / "a.ktest") << "this is not a ktest file at all"; } + EXPECT_TRUE(Map2Check::readKtestFile((d / "a.ktest").string()).empty()); + fs::remove_all(d); +} + +TEST(ReadKtestFile, MissingFileYieldsNothing) { + EXPECT_TRUE(Map2Check::readKtestFile("/nonexistent/a.ktest").empty()); +} + +// --- decoding --------------------------------------------------------------- + +TEST(DecodeKtestObject, DecodesSignedIntegers) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_int", le32(42))), "42"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_int", le32(-7))), "-7"); +} + +// The whole reason the object name had to be fixed. Read as unsigned, -1 +// becomes 4294967295; read as signed, an unsigned 4294967295 becomes -1. Only +// the name says which. +TEST(DecodeKtestObject, SignednessComesFromTheName) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_int", le32(-1))), "-1"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_unsigned", le32(-1))), + "4294967295"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_uint", le32(-1))), + "4294967295"); +} + +// Narrow types must sign-extend from their own width, not from 32 bits. +TEST(DecodeKtestObject, SignExtendsFromTheObjectWidth) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_char", {0xff})), "-1"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_uchar", {0xff})), "255"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_short", {0xff, 0xff})), + "-1"); +} + +TEST(DecodeKtestObject, DecodesDoubles) { + const std::string text = + Map2Check::decodeKtestObject(obj("non_det_double", leDouble(1.5))); + EXPECT_EQ(text.rfind("1.5", 0), 0u) << "got " << text; +} + +// An unknown name is a nondet type nobody has taught this decoder about yet -- +// a reason to guess, not to drop the test case. +TEST(DecodeKtestObject, FallsBackToSignedForAnUnknownName) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("something_new", le32(-3))), "-3"); +} + +TEST(DecodeKtestObject, EmptyObjectDecodesToZero) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_int", {})), "0"); +} + +// --- directory sweep -------------------------------------------------------- + +TEST(ReadKtestVectors, OneVectorPerKtestOrderedByName) { + fs::path d = freshDir("sweep"); + KtestBuilder().object("non_det_int", le32(1)).writeTo(d / "test000002.ktest"); + KtestBuilder().object("non_det_int", le32(0)).writeTo(d / "test000001.ktest"); + KtestBuilder().object("non_det_int", le32(2)).writeTo(d / "test000003.ktest"); + + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 3u); + EXPECT_EQ(vectors[0][0], "0"); + EXPECT_EQ(vectors[1][0], "1"); + EXPECT_EQ(vectors[2][0], "2"); + fs::remove_all(d); +} + +// klee-last holds .err, .kquery and statistics files alongside the vectors. +TEST(ReadKtestVectors, IgnoresEverythingThatIsNotAKtest) { + fs::path d = freshDir("filter"); + KtestBuilder().object("non_det_int", le32(9)).writeTo(d / "test000001.ktest"); + { std::ofstream(d / "test000001.abort.err") << "error"; } + { std::ofstream(d / "run.stats") << "stats"; } + { std::ofstream(d / "assembly.ll") << "; ir"; } + + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 1u); + EXPECT_EQ(vectors[0][0], "9"); + fs::remove_all(d); +} + +TEST(ReadKtestVectors, StopsAtTheLimit) { + fs::path d = freshDir("limit"); + for (int i = 0; i < 6; ++i) { + char name[64]; + snprintf(name, sizeof(name), "test%06d.ktest", i); + KtestBuilder().object("non_det_int", le32(i)).writeTo(d / name); + } + auto vectors = Map2Check::readKtestVectors(d.string(), 3); + ASSERT_EQ(vectors.size(), 3u); + EXPECT_EQ(vectors[2][0], "2"); + fs::remove_all(d); +} + +// A path that read no input is not a test case; emitting one would put an +// empty <testcase> into the suite for every such path. +TEST(ReadKtestVectors, DropsVectorsWithNoObjects) { + fs::path d = freshDir("empty"); + KtestBuilder().writeTo(d / "test000001.ktest"); + KtestBuilder().object("non_det_int", le32(4)).writeTo(d / "test000002.ktest"); + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 1u); + EXPECT_EQ(vectors[0][0], "4"); + fs::remove_all(d); +} + +// A path a failed assumption pruned carries the marker object. The marker is +// not an input, and such paths come after every other one, so shallow pruned +// paths cannot crowd deep ones out of a capped suite. +TEST(ReadKtestFile, StripsThePrunedPathMarker) { + fs::path d = freshDir("marker"); + KtestBuilder() + .object("non_det_int", le32(5)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + bool pruned = false; + auto objects = + Map2Check::readKtestFile((d / "test000001.ktest").string(), &pruned); + EXPECT_TRUE(pruned); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} + +TEST(ReadKtestVectors, PrunedPathsComeLast) { + fs::path d = freshDir("pruned"); + KtestBuilder() + .object("non_det_int", le32(1)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + KtestBuilder().object("non_det_int", le32(2)).writeTo(d / "test000002.ktest"); + KtestBuilder() + .object("non_det_int", le32(3)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000003.ktest"); + KtestBuilder().object("non_det_int", le32(4)).writeTo(d / "test000004.ktest"); + + auto all = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(all.size(), 4u); + EXPECT_EQ(all[0], std::vector<std::string>{"2"}); + EXPECT_EQ(all[1], std::vector<std::string>{"4"}); + EXPECT_EQ(all[2], std::vector<std::string>{"1"}); + EXPECT_EQ(all[3], std::vector<std::string>{"3"}); + + auto capped = Map2Check::readKtestVectors(d.string(), 3); + ASSERT_EQ(capped.size(), 3u); + EXPECT_EQ(capped[2], std::vector<std::string>{"1"}); + fs::remove_all(d); +} + +// Only pruned paths: they are the whole suite rather than none of it. +TEST(ReadKtestVectors, OnlyPrunedPathsStillMakeASuite) { + fs::path d = freshDir("onlypruned"); + KtestBuilder() + .object("non_det_int", le32(7)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 1u); + EXPECT_EQ(vectors[0], std::vector<std::string>{"7"}); + fs::remove_all(d); +} + +TEST(ReadKtestVectors, MissingDirectoryYieldsNothing) { + EXPECT_TRUE(Map2Check::readKtestVectors("/nonexistent/klee-last", 10).empty()); +} + +// --- violating path --------------------------------------------------------- + +// A program with no nondeterministic input reaches its error with the empty +// vector. That is a complete witness, and the verdict must not be downgraded +// for lacking one (tests/testcomp/programs/no_input.c). +TEST(HasViolatingKtest, CountsAnAbortingPathWithNoObjects) { + fs::path d = freshDir("violating_empty"); + KtestBuilder().writeTo(d / "test000001.ktest"); + std::ofstream(d / "test000001.abort.err") << "abort"; + EXPECT_TRUE(Map2Check::hasViolatingKtest(d.string())); + EXPECT_TRUE(Map2Check::readViolatingKtest(d.string()).empty()); + fs::remove_all(d); +} + +TEST(HasViolatingKtest, IgnoresErrorsThatAreNotAborts) { + fs::path d = freshDir("violating_ptr"); + KtestBuilder().object("non_det_int", le32(1)).writeTo(d / "test000001.ktest"); + std::ofstream(d / "test000001.ptr.err") << "ptr"; + EXPECT_FALSE(Map2Check::hasViolatingKtest(d.string())); + fs::remove_all(d); +} + +TEST(HasViolatingKtest, NeedsTheKtestBesideTheReport) { + fs::path d = freshDir("violating_orphan"); + std::ofstream(d / "test000001.abort.err") << "abort"; + EXPECT_FALSE(Map2Check::hasViolatingKtest(d.string())); + EXPECT_FALSE(Map2Check::hasViolatingKtest("/nonexistent/klee-last")); + fs::remove_all(d); +} + +// --- a KLEE run that stopped on its timer did not finish --------------------- + +// KLEE halting on --max-time exits 0, exactly like a run that explored every +// path. With one short path having written NONE to the property file, that +// read as a proof: a reachable null dereference came back TRUE. +TEST(KleeHaltedOnTimer, DetectsTheHaltTimerLine) { + fs::path d = freshDir("halt"); + std::ofstream(d / "messages.txt") + << "KLEE: output directory is \"x\"\nKLEE: HaltTimer invoked\n" + "KLEE: halting execution, dumping remaining states\n"; + EXPECT_TRUE(Map2Check::kleeHaltedOnTimer(d.string())); + fs::remove_all(d); +} + +TEST(KleeHaltedOnTimer, AFinishedRunIsNotHalted) { + fs::path d = freshDir("finished"); + std::ofstream(d / "messages.txt") << "KLEE: output directory is \"x\"\n"; + EXPECT_FALSE(Map2Check::kleeHaltedOnTimer(d.string())); + EXPECT_FALSE(Map2Check::kleeHaltedOnTimer("/nonexistent/klee-last")); + fs::remove_all(d); +} + +// KLEE also exits 0 after dropping paths without running out of them: a +// symbolic double concretized to 0 (float-benchs/sin_interpolated_index-1: one +// path, answered TRUE), or states killed by its own errors (a VLA of symbolic +// size in loops/insertion_sort-1-2: "partially completed paths = 2", TRUE). +TEST(KleeDroppedPaths, ConcretizingAnInputDropsPaths) { + fs::path d = freshDir("concretized"); + std::ofstream(d / "warnings.txt") + << "KLEE: WARNING ONCE: silently concretizing (reason: floating point) " + "expression (ReadLSB w64 0 non_det_double) to value 0 (x.c:155)\n"; + std::ofstream(d / "info") << "KLEE: done: partially completed paths = 0\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, AStateKilledByAnErrorDropsPaths) { + fs::path d = freshDir("killed"); + std::ofstream(d / "test000001.ktest") << ""; + std::ofstream(d / "test000001.model.err") << "Error: concretized symbolic size\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, AStateTerminatedEarlyDropsPaths) { + fs::path d = freshDir("early"); + std::ofstream(d / "test000002.early") << "Memory limit exceeded\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// KLEE that died -- a solver crash, an LLVM assertion, the OOM killer -- +// writes no HaltTimer, no .err and no "done" lines, and may leave NONE in the +// property file from the paths it did finish. +TEST(KleeDroppedPaths, ARunThatNeverFinishedDropsPaths) { + fs::path d = freshDir("crashed"); + std::ofstream(d / "info") << "KLEE: output directory is \"x\"\n"; + std::ofstream(d / "test000001.ktest") << ""; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// Near --max-memory KLEE stops forking and follows one side of each branch +// at random; it logs that once and can still exit 0. +TEST(KleeDroppedPaths, SkippingForksDropsPaths) { + fs::path d = freshDir("skipfork"); + std::ofstream(d / "warnings.txt") + << "KLEE: WARNING ONCE: skipping fork (memory cap exceeded)\n"; + std::ofstream(d / "info") << "KLEE: done: completed paths = 3\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// A path pruned by an assumption is not a dropped path, and KLEE counts it +// among the "partially completed" all the same (klee_silent_exit and a failed +// klee_assume alike). Reading that counter made every program with an +// assume_abort_if_not unprovable: TRUE became UNKNOWN. +TEST(KleeDroppedPaths, AnAssumptionPrunedPathDropsNothing) { + fs::path d = freshDir("pruned"); + std::ofstream(d / "info") << "KLEE: done: completed paths = 1\n" + "KLEE: done: partially completed paths = 1\n"; + std::ofstream(d / "test000001.ktest") << ""; + EXPECT_TRUE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, TheHaltTimerDropsPaths) { + fs::path d = freshDir("halted"); + std::ofstream(d / "messages.txt") << "KLEE: HaltTimer invoked\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, AnExhaustedRunDropsNothing) { + fs::path d = freshDir("exhausted"); + std::ofstream(d / "warnings.txt") + << "KLEE: WARNING ONCE: calling external: close(12)\n"; + std::ofstream(d / "info") << "KLEE: done: completed paths = 7\n" + "KLEE: done: partially completed paths = 0\n"; + std::ofstream(d / "messages.txt") << "KLEE: output directory is \"x\"\n"; + EXPECT_TRUE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// --- the nondet log as seeds ------------------------------------------------- + +// KLEE matches a seed's objects to its symbolic inputs by POSITION. A read the +// converter cannot express (a pchar, a loff_t) must end the seed there: skipping +// it shifted every later object onto the wrong input. +TEST(ReadNonDetLogAsObjects, StopsAtTheFirstUnsupportedRead) { + fs::path d = freshDir("nondetlog"); + std::ofstream(d / "klee_log.csv") + << "1;0;main;0;x;7;0\n" // int 7 + << "2;0;main;0;s;0;9\n" // pchar: unsupported + << "3;0;main;0;y;9;0\n"; // int 9, must not be taken + const auto objects = + Map2Check::readNonDetLogAsObjects((d / "klee_log.csv").string()); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} + +TEST(ReadKtestVectors, FlagsThePrunedVectors) { + fs::path d = freshDir("prunedflags"); + KtestBuilder() + .object("non_det_int", le32(1)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + KtestBuilder().object("non_det_int", le32(2)).writeTo(d / "test000002.ktest"); + std::vector<bool> pruned; + auto vectors = Map2Check::readKtestVectors(d.string(), 100, &pruned); + ASSERT_EQ(vectors.size(), 2u); + ASSERT_EQ(pruned.size(), 2u); + EXPECT_FALSE(pruned[0]); + EXPECT_TRUE(pruned[1]); + EXPECT_EQ(vectors[1], std::vector<std::string>{"1"}); + fs::remove_all(d); +} + +// --- the types issue #74 added ------------------------------------------------ + +// Intel-TDX reads __VERIFIER_nondet_ulonglong, and its values span all 64 +// bits: one decoded through the 32-bit path is a different input. +TEST(DecodeKtestObject, DecodesSixtyFourBitTypes) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_longlong", le64(-5))), + "-5"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_ulonglong", le64(-1))), + "18446744073709551615"); +} + +TEST(DecodeKtestObject, DecodesTheFixedWidthUnsignedTypes) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_u8", {0xff})), "255"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_u16", {0xff, 0xff})), + "65535"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_u32", le32(-1))), + "4294967295"); +} + +// Four bytes read as an integer is the failure mode a float has without its +// own name. The text must also round-trip: the validator parses it with %f, +// and a fixed six decimals turns 1e-30 into 0. +TEST(DecodeKtestObject, DecodesFloatsSoTheyRoundTrip) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_float", leFloat(1.5f))), + "1.5"); + const std::string tiny = + Map2Check::decodeKtestObject(obj("non_det_float", leFloat(1e-30f))); + EXPECT_EQ(std::strtof(tiny.c_str(), nullptr), 1e-30f) << "got " << tiny; +} + +// The validators' harness reads __VERIFIER_nondet_memory(p, n) as n uchar +// inputs, one per byte; KLEE holds it as one object of n bytes. +TEST(DecodeKtestInputs, ExpandsMemoryIntoOneUcharPerByte) { + EXPECT_EQ(Map2Check::decodeKtestInputs(obj("non_det_memory", {1, 0, 255})), + (std::vector<std::string>{"1", "0", "255"})); + EXPECT_EQ(Map2Check::decodeKtestInputs(obj("non_det_int", le32(-2))), + std::vector<std::string>{"-2"}); +} + +TEST(ReadKtestVectors, ExpandsMemoryObjectsInPlace) { + fs::path d = freshDir("memory"); + KtestBuilder() + .object("non_det_int", le32(7)) + .object("non_det_memory", {9, 8}) + .object("non_det_ulonglong", le64(3)) + .writeTo(d / "test000001.ktest"); + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 1u); + EXPECT_EQ(vectors[0], (std::vector<std::string>{"7", "9", "8", "3"})); + fs::remove_all(d); +} + +TEST(ReadViolatingKtest, ExpandsMemoryObjectsInPlace) { + fs::path d = freshDir("memoryerr"); + KtestBuilder() + .object("non_det_memory", {4, 5}) + .writeTo(d / "test000001.ktest"); + std::ofstream(d / "test000001.abort.err") << "abort"; + EXPECT_EQ(Map2Check::readViolatingKtest(d.string()), + (std::vector<std::string>{"4", "5"})); + fs::remove_all(d); +} + +// Enumerators 16-21 of NONDET_TYPE (Map2CheckTypes.h). +TEST(ReadNonDetLogAsObjects, ConvertsTheTypesIssue74Added) { + fs::path d = freshDir("nondetlog74"); + std::ofstream(d / "klee_log.csv") + << "0;1;0;main;0;1.5;16\n" + << "1;1;0;main;1;-3;17\n" + << "2;1;0;main;2;18446744073709551615;18\n" + << "3;1;0;main;3;200;19\n" + << "4;1;0;main;4;60000;20\n" + << "5;1;0;main;5;4000000000;21\n"; + const auto objects = + Map2Check::readNonDetLogAsObjects((d / "klee_log.csv").string()); + ASSERT_EQ(objects.size(), 6u); + EXPECT_EQ(objects[0].name, "non_det_float"); + EXPECT_EQ(objects[0].bytes, leFloat(1.5f)); + EXPECT_EQ(objects[1].name, "non_det_longlong"); + EXPECT_EQ(objects[1].bytes, le64(-3)); + EXPECT_EQ(objects[2].name, "non_det_ulonglong"); + EXPECT_EQ(objects[2].bytes, le64(-1)); + EXPECT_EQ(objects[3].name, "non_det_u8"); + EXPECT_EQ(objects[3].bytes, std::vector<uint8_t>{200}); + EXPECT_EQ(objects[4].name, "non_det_u16"); + EXPECT_EQ(objects[4].bytes, (std::vector<uint8_t>{0x60, 0xea})); + EXPECT_EQ(objects[5].name, "non_det_u32"); + EXPECT_EQ(objects[5].bytes, le32(static_cast<int32_t>(4000000000u))); + fs::remove_all(d); +} + +// The runtime logs __VERIFIER_nondet_memory(p, n) as n MEMORY_BYTE rows while +// KLEE makes one n-byte object, and the log does not mark where a call ends. +// n one-byte seed objects would not match it, so the seed stops there. +TEST(ReadNonDetLogAsObjects, StopsAtAMemoryByte) { + fs::path d = freshDir("nondetlogmem"); + std::ofstream(d / "klee_log.csv") + << "0;1;0;main;0;7;0\n" + << "1;0;0;__VERIFIER_nondet_memory;1;3;22\n" + << "2;1;0;main;2;9;0\n"; + const auto objects = + Map2Check::readNonDetLogAsObjects((d / "klee_log.csv").string()); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} diff --git a/tests/unit/frontend/SeedStoreTest.cpp b/tests/unit/frontend/SeedStoreTest.cpp new file mode 100644 index 000000000..d7b40dbf3 --- /dev/null +++ b/tests/unit/frontend/SeedStoreTest.cpp @@ -0,0 +1,67 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include <gtest/gtest.h> + +#include <set> +#include <string> +#include <vector> + +#include "../../../modules/frontend/utils/seed_store.hpp" + +// Next to the scratch directory, not inside it: every hybrid phase recreates +// the scratch directory, and a store inside it never reached the next phase. +TEST(SeedStorePath, SitsBesideTheScratchDirectory) { + EXPECT_EQ(Map2Check::seedStorePath("/work", "abc.map2check"), + "/work/abc.map2check.seeds"); +} + +TEST(SelectQueueEntries, KeepsOnlyQueueEntriesInIdOrderUpToTheCap) { + const std::vector<std::string> names = { + "id:000002,src:000000,time:9", ".state", "README.txt", + "id:000000,time:0,execs:0,orig:seed", "id:000001,src:000000,time:5"}; + const std::vector<std::string> chosen = + Map2Check::selectQueueEntries(names, 2); + ASSERT_EQ(chosen.size(), 2u); + // The ",orig:" seed is not the fuzzer's discovery (see the test below). + EXPECT_EQ(chosen[0], "id:000001,src:000000,time:5"); + EXPECT_EQ(chosen[1], "id:000002,src:000000,time:9"); +} + +TEST(IsNewVector, RejectsEmptyAndDuplicateVectors) { + std::set<std::vector<uint8_t>> seen; + EXPECT_FALSE(Map2Check::isNewVector({}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_FALSE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 3}, &seen)); +} + +// The fuzzer's own seeds come back in its queue tagged ",orig:" -- the KLEE +// vectors, the previous rounds' entries -- and KLEE already has those. Only +// what this round discovered is worth replaying (tacas 3b). +TEST(SelectQueueEntries, SkipsTheSeedsTheFuzzerStartedFrom) { + const auto picked = Map2Check::selectQueueEntries( + {"id:000000,time:0,execs:0,orig:klee-0", "id:000001,src:000000,op:havoc"}, + 8); + ASSERT_EQ(picked.size(), 1u); + EXPECT_EQ(picked[0], "id:000001,src:000000,op:havoc"); +} + +// Ranked (tacas 3c): the entries that reached new edges ("+cov") first, then +// the ones that only changed hit counts, each in id order -- so when the queue +// outgrows the cap, the seeds KLEE gets are the ones that went somewhere new. +TEST(SelectQueueEntries, PutsNewCoverageFirst) { + const auto picked = Map2Check::selectQueueEntries( + {"id:000001,src:000000,op:havoc", "id:000002,src:000001,op:havoc,+cov", + "id:000003,src:000000,op:havoc", "id:000004,src:000002,op:havoc,+cov"}, + 3); + ASSERT_EQ(picked.size(), 3u); + EXPECT_EQ(picked[0], "id:000002,src:000001,op:havoc,+cov"); + EXPECT_EQ(picked[1], "id:000004,src:000002,op:havoc,+cov"); + EXPECT_EQ(picked[2], "id:000001,src:000000,op:havoc"); +} diff --git a/tests/unit/frontend/Sha256Test.cpp b/tests/unit/frontend/Sha256Test.cpp new file mode 100644 index 000000000..2beb0bb78 --- /dev/null +++ b/tests/unit/frontend/Sha256Test.cpp @@ -0,0 +1,71 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +// SHA-256 exists here for one reason: the Test-Comp test-suite metadata +// defines <programhash> as the SHA-256 of the program file, and Map2Check only +// had SHA-1 (Boost, in gen_crypto_hash.hpp). A wrong hash does not break a run +// -- it produces a suite that looks valid and misidentifies the program it was +// generated for -- so the implementation is pinned to published vectors rather +// than to a self-consistent round trip. + +#include <gtest/gtest.h> + +#include <cstdio> +#include <fstream> +#include <string> + +#include "../../../modules/frontend/utils/sha256.hpp" + +// Vectors from FIPS 180-4 / RFC 6234. +TEST(Sha256Test, EmptyString) { + EXPECT_EQ(Map2Check::sha256Hex(""), + "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"); +} + +TEST(Sha256Test, Abc) { + EXPECT_EQ(Map2Check::sha256Hex("abc"), + "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"); +} + +// 448 bits: the length field no longer fits beside the padding in one block, +// so this forces the two-block tail path where naive implementations break. +TEST(Sha256Test, TwoBlockMessage) { + EXPECT_EQ(Map2Check::sha256Hex( + "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"), + "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1"); +} + +TEST(Sha256Test, OneMillionA) { + EXPECT_EQ(Map2Check::sha256Hex(std::string(1000000, 'a')), + "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0"); +} + +// A file whose name and contents differ, so hashing the path instead of the +// contents cannot pass by coincidence. +TEST(Sha256Test, HashesFileContentsNotPath) { + std::string path = "sha256_fixture.txt"; + { + std::ofstream out(path, std::ios::binary); + out << "abc"; + } + EXPECT_EQ(Map2Check::sha256File(path), + "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"); + std::remove(path.c_str()); +} + +// Binary-safe: a NUL in the middle must not truncate the digest. +TEST(Sha256Test, HandlesEmbeddedNulBytes) { + std::string withNul("a\0b", 3); + ASSERT_EQ(withNul.size(), 3u); + EXPECT_NE(Map2Check::sha256Hex(withNul), Map2Check::sha256Hex("a")); + EXPECT_NE(Map2Check::sha256Hex(withNul), Map2Check::sha256Hex("ab")); +} + +TEST(Sha256Test, MissingFileReturnsEmptyString) { + EXPECT_EQ(Map2Check::sha256File("no_such_file_here.bin"), ""); +} diff --git a/tests/unit/frontend/SlicerTest.cpp b/tests/unit/frontend/SlicerTest.cpp new file mode 100644 index 000000000..707df2e97 --- /dev/null +++ b/tests/unit/frontend/SlicerTest.cpp @@ -0,0 +1,246 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include <gtest/gtest.h> + +#include <algorithm> +#include <string> +#include <vector> + +#include "../../../modules/frontend/utils/slicer.hpp" + +// The suite is generated on the slice and run by TestCov on the ORIGINAL +// program, so every nondet read the original performs must survive slicing. +TEST(SlicingCriteria, AppendsEveryNondetFunctionAfterThePrimary) { + const std::string criteria = Map2Check::slicingCriteria({"reach_error"}); + EXPECT_EQ(criteria.rfind("reach_error,", 0), 0u); + for (const std::string& name : Map2Check::nondetFunctionNames()) { + EXPECT_NE(criteria.find("," + name), std::string::npos) << name; + } +} + +TEST(SlicingCriteria, KeepsSeveralPrimariesInOrder) { + const std::string criteria = + Map2Check::slicingCriteria({"__VERIFIER_assert", "__assert_fail"}); + EXPECT_EQ(criteria.rfind("__VERIFIER_assert,__assert_fail,", 0), 0u); +} + +TEST(NondetFunctionNames, CoversWhatNonDetPassInstruments) { + const auto& names = Map2Check::nondetFunctionNames(); + for (const char* type : {"bool", "char", "uchar", "short", "ushort", "int", + "uint", "unsigned", "long", "ulong", "size_t", + "loff_t", "sector_t", "pointer", "pchar", "double", + "float", "longlong", "ulonglong", "u8", "u16", "u32", + "memory"}) { + const std::string name = std::string("__VERIFIER_nondet_") + type; + EXPECT_NE(std::find(names.begin(), names.end(), name), names.end()) << name; + } +} + +TEST(TargetStubSource, VoidTargetGetsAVoidStub) { + EXPECT_EQ(Map2Check::targetStubSource("reach_error"), + "void __attribute__((weak)) reach_error(void) {}\n"); +} + +// __VERIFIER_assert takes the condition; a (void) stub would not link against +// the program's own declaration. +TEST(TargetStubSource, AssertStubTakesTheCondition) { + EXPECT_EQ(Map2Check::targetStubSource("__VERIFIER_assert"), + "void __attribute__((weak)) __VERIFIER_assert(int cond) {}\n"); +} + +TEST(ParseSlicerStatistics, ReadsBeforeAndAfter) { + const std::string output = + "Statistics before Globals/Functions/Blocks/Instr.: 37 97 2215 10764\n" + "[llvm-slicer] Sliced away 1454 from 4227 nodes in DG\n" + "Statistics after Globals/Functions/Blocks/Instr.: 37 38 444 2989\n"; + const Map2Check::SlicerStatistics stats = + Map2Check::parseSlicerStatistics(output); + ASSERT_TRUE(stats.found); + EXPECT_EQ(stats.before.functions, 97u); + EXPECT_EQ(stats.before.blocks, 2215u); + EXPECT_EQ(stats.before.instructions, 10764u); + EXPECT_EQ(stats.after.globals, 37u); + EXPECT_EQ(stats.after.functions, 38u); + EXPECT_EQ(stats.after.instructions, 2989u); +} + +// A slicer that prints no statistics must not be reported as having sliced +// everything away. +TEST(ParseSlicerStatistics, MissingLinesAreNotFound) { + EXPECT_FALSE(Map2Check::parseSlicerStatistics("").found); + EXPECT_FALSE(Map2Check::parseSlicerStatistics( + "Statistics before Globals/Functions/Blocks/Instr.: 1 2 3 4\n") + .found); +} + +TEST(DescribeSlice, ReportsCountsWhenFound) { + Map2Check::SlicerStatistics stats; + stats.found = true; + stats.before = {37, 97, 2215, 10764}; + stats.after = {37, 38, 444, 2989}; + EXPECT_EQ(Map2Check::describeSlice("reach_error", stats, 184164, 171708), + "Sliced with respect to reach_error: 97/2215/10764 -> 38/444/2989 " + "functions/blocks/instructions (184164 -> 171708 bytes of " + "bitcode)"); +} + +TEST(DescribeSlice, FallsBackToBytesWithoutStatistics) { + EXPECT_EQ(Map2Check::describeSlice("reach_error", {}, 10, 8), + "Sliced with respect to reach_error: 10 -> 8 bytes of bitcode"); +} + +// The fixed list cannot know every name a benchmark declares (int128, +// uint128, ...); a name missing from the criteria silently reintroduces the +// shifted suite. The names come from the program itself as well. +TEST(NondetNamesInIR, FindsEveryDeclaredOrCalledNondetFunction) { + const std::string ir = + "declare i32 @__VERIFIER_nondet_int()\n" + "declare i128 @__VERIFIER_nondet_int128()\n" + " %1 = call i128 @__VERIFIER_nondet_int128(), !dbg !19\n" + " call void @reach_error()\n" + "@__VERIFIER_nondet_not_a_call = global i32 0\n"; + const std::vector<std::string> names = Map2Check::nondetNamesInIR(ir); + ASSERT_EQ(names.size(), 3u); + EXPECT_EQ(names[0], "__VERIFIER_nondet_int"); + EXPECT_EQ(names[1], "__VERIFIER_nondet_int128"); + EXPECT_EQ(names[2], "__VERIFIER_nondet_not_a_call"); +} + +TEST(SlicingCriteria, AddsNamesFromTheProgramOnceEach) { + const std::string criteria = Map2Check::slicingCriteria( + {"reach_error"}, {"__VERIFIER_nondet_int128", "__VERIFIER_nondet_int"}); + EXPECT_NE(criteria.find(",__VERIFIER_nondet_int128"), std::string::npos); + size_t count = 0; + for (size_t at = criteria.find("__VERIFIER_nondet_int,"); + at != std::string::npos; + at = criteria.find("__VERIFIER_nondet_int,", at + 1)) { + ++count; + } + EXPECT_EQ(count, 1u); +} + +// After instrumentation the memory property lives in the runtime calls +// MemoryTrackPass inserted; every one of them is a criterion, so nothing that +// records memory is sliced away. +TEST(RuntimeNamesInIR, FindsEveryMap2checkSymbolOnce) { + const std::string ir = + "declare void @map2check_malloc(ptr, i64)\n" + " call void @map2check_check_deref(ptr %3, i64 4), !dbg !7\n" + " call void @map2check_malloc(ptr %1, i64 8)\n" + " call i32 @__VERIFIER_nondet_int()\n"; + const std::vector<std::string> names = Map2Check::runtimeNamesInIR(ir); + ASSERT_EQ(names.size(), 2u); + EXPECT_EQ(names[0], "map2check_malloc"); + EXPECT_EQ(names[1], "map2check_check_deref"); +} + +// A memory error can happen INSIDE an external function (strcpy overflowing a +// stack buffer). No map2check_* call depends on such a call, so without it as +// a criterion the slicer drops it and the bug with it -- measured: CASTLE-787-2 +// went from UNKNOWN to a wrong TRUE. Every declared-but-undefined function is +// a criterion in the post-instrumentation modes; intrinsics are not calls. +TEST(ExternalNamesInIR, FindsDeclaredFunctionsButNotIntrinsicsOrDefinitions) { + const std::string ir = + "define dso_local i32 @__map2check_main__() {\n" + " call ptr @strcpy(ptr %1, ptr @.str)\n" + "}\n" + "declare ptr @strcpy(ptr noundef, ptr noundef) #2\n" + "declare void @llvm.dbg.declare(metadata, metadata, metadata) #1\n" + "declare i32 @printf(ptr noundef, ...) #2\n" + "declare void @map2check_malloc(ptr, i64)\n" + "declare ptr @strcpy(ptr noundef, ptr noundef) #2\n"; + const std::vector<std::string> names = Map2Check::externalNamesInIR(ir); + ASSERT_EQ(names.size(), 3u); + EXPECT_EQ(names[0], "strcpy"); + EXPECT_EQ(names[1], "printf"); + EXPECT_EQ(names[2], "map2check_malloc"); +} + +// clang lowers memcpy/memset/memmove (and struct copies) to intrinsics, and a +// copy that overflows into a buffer nothing reads again feeds no criterion: +// without its name the slicer drops it, the same wrong-TRUE shape as the +// strcpy of CASTLE-787-2. Other intrinsics (debug info) are not calls. +TEST(ExternalNamesInIR, KeepsTheMemoryIntrinsics) { + const std::string ir = + "declare void @llvm.memcpy.p0.p0.i64(ptr, ptr, i64, i1)\n" + "declare void @llvm.memset.p0.i64(ptr, i8, i64, i1)\n" + "declare void @llvm.memmove.p0.p0.i64(ptr, ptr, i64, i1)\n" + "declare void @llvm.dbg.declare(metadata, metadata, metadata)\n" + "declare void @llvm.lifetime.start.p0(i64, ptr)\n"; + const std::vector<std::string> names = Map2Check::externalNamesInIR(ir); + ASSERT_EQ(names.size(), 3u); + EXPECT_EQ(names[0], "llvm.memcpy.p0.p0.i64"); + EXPECT_EQ(names[1], "llvm.memset.p0.i64"); + EXPECT_EQ(names[2], "llvm.memmove.p0.p0.i64"); +} + +// Slicing the instrumented module is only sound with the runtime checks as +// criteria. If the IR could not be read (a failed disassembly, an empty file) +// there are none, and the slice would remove every check: refuse instead. +TEST(InstrumentedSliceCriteria, RefusesWithoutRuntimeCalls) { + std::vector<std::string> criteria; + EXPECT_FALSE(Map2Check::instrumentedSliceCriteria("", &criteria)); + EXPECT_FALSE(Map2Check::instrumentedSliceCriteria( + "declare i32 @__VERIFIER_nondet_int()\n", &criteria)); +} + +TEST(InstrumentedSliceCriteria, CollectsRuntimeThenExternalNames) { + std::vector<std::string> criteria; + ASSERT_TRUE(Map2Check::instrumentedSliceCriteria( + " call void @map2check_check_deref(ptr %3, i64 4)\n" + "declare ptr @strcpy(ptr, ptr)\n" + "declare void @map2check_check_deref(ptr, i64)\n", + &criteria)); + ASSERT_EQ(criteria.size(), 2u); + EXPECT_EQ(criteria[0], "map2check_check_deref"); + EXPECT_EQ(criteria[1], "strcpy"); +} + +// --- the slice cache (tacas 2d) ---------------------------------------------- + +// Every hybrid phase recreates the scratch directory and used to slice again: +// on eca-* the slicer timed out in phase 1 AND phase 2, and the run blew its +// budget. The cache reuses a slice only for the very same input and settings. +TEST(SliceCacheKey, IsDeterministic) { + EXPECT_EQ(Map2Check::sliceCacheKey("BC", "reach_error", "main", ""), + Map2Check::sliceCacheKey("BC", "reach_error", "main", "")); +} + +TEST(SliceCacheKey, ChangesWithEveryInput) { + const std::string base = + Map2Check::sliceCacheKey("BC", "reach_error", "main", ""); + EXPECT_NE(base, Map2Check::sliceCacheKey("BD", "reach_error", "main", "")); + EXPECT_NE(base, Map2Check::sliceCacheKey("BC", "reach_errors", "main", "")); + EXPECT_NE(base, Map2Check::sliceCacheKey("BC", "reach_error", "mai", "")); + EXPECT_NE(base, + Map2Check::sliceCacheKey("BC", "reach_error", "main", "--pta=fs")); + // Field boundaries count: moving a character between fields is another key. + EXPECT_NE(Map2Check::sliceCacheKey("B", "Creach_error", "main", ""), base); +} + +TEST(SliceCacheKey, IsAFileName) { + const std::string key = + Map2Check::sliceCacheKey("BC", "reach_error", "main", "--cda=ntscd"); + EXPECT_EQ(key.size(), 16u); + EXPECT_EQ(key.find_first_not_of("0123456789abcdef"), std::string::npos); +} + +TEST(SliceCachePath, SitsBesideTheScratchDirectory) { + EXPECT_EQ(Map2Check::sliceCachePath("/w", "abc.map2check"), + "/w/abc.map2check.slice"); +} + +TEST(SliceCleanupPasses, MapsTheKnob) { + EXPECT_EQ(Map2Check::sliceCleanupPasses(""), ""); + EXPECT_EQ(Map2Check::sliceCleanupPasses("none"), ""); + EXPECT_EQ(Map2Check::sliceCleanupPasses("light"), + "-passes='function(simplifycfg,dce),globaldce'"); + EXPECT_EQ(Map2Check::sliceCleanupPasses("o2"), "-O2"); + EXPECT_EQ(Map2Check::sliceCleanupPasses("bogus"), ""); +} diff --git a/tests/unit/frontend/TestSuiteTest.cpp b/tests/unit/frontend/TestSuiteTest.cpp new file mode 100644 index 000000000..34e704ccc --- /dev/null +++ b/tests/unit/frontend/TestSuiteTest.cpp @@ -0,0 +1,337 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +// A malformed test suite does not fail loudly -- the validator simply scores +// it as covering nothing, which is indistinguishable from the tool having +// found no bug. These assertions pin the parts of the format whose violation +// would be invisible at run time: element order (the DTD is a sequence), +// the public identifiers, and above all the ORDER of <input> elements, which +// is the whole semantics of a test vector. + +#include <gtest/gtest.h> + +#include <filesystem> +#include <fstream> +#include <sstream> +#include <string> +#include <vector> + +#include "../../../modules/frontend/test_suite/test_suite.hpp" + +namespace fs = std::filesystem; + +namespace { + +std::string slurp(const fs::path& p) { + std::ifstream in(p); + std::ostringstream buf; + buf << in.rdbuf(); + return buf.str(); +} + +// Each test owns its directory so nothing leaks between cases. +fs::path freshDir(const std::string& name) { + fs::path d = fs::temp_directory_path() / ("m2c_ts_" + name); + fs::remove_all(d); + return d; +} + +Map2Check::TestSuiteMetadata sampleMetadata() { + Map2Check::TestSuiteMetadata md; + md.producer = "Map2Check v8.0.0"; + md.specification = + "COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) )"; + md.programFile = "./digits.c"; + md.programHash = + "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"; + md.entryFunction = "main"; + md.architecture = "64bit"; + md.creationTime = "2026-08-16T12:00:00Z"; + return md; +} + +} // namespace + +// --- metadata.xml ----------------------------------------------------------- + +TEST(TestSuiteWriter, MetadataStartsWithDeclarationThenDoctype) { + fs::path d = freshDir("meta_head"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(sampleMetadata())); + + std::string xml = slurp(d / "metadata.xml"); + EXPECT_EQ( + xml.find("<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>"), + 0u); + EXPECT_NE( + xml.find("<!DOCTYPE test-metadata PUBLIC " + "\"+//IDN sosy-lab.org//DTD test-format test-metadata 1.1//EN\" " + "\"https://sosy-lab.org/test-format/test-metadata-1.1.dtd\">"), + std::string::npos); + fs::remove_all(d); +} + +// The DTD declares a sequence, so a validator rejects reordered elements. +TEST(TestSuiteWriter, MetadataElementsFollowTheDtdOrder) { + fs::path d = freshDir("meta_order"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(sampleMetadata())); + + std::string xml = slurp(d / "metadata.xml"); + const std::vector<std::string> order = {"<sourcecodelang>", "<producer>", + "<specification>", "<programfile>", + "<programhash>", "<entryfunction>", + "<architecture>", "<creationtime>"}; + size_t previous = 0; + for (const std::string& tag : order) { + size_t at = xml.find(tag); + ASSERT_NE(at, std::string::npos) << "missing " << tag; + EXPECT_GT(at, previous) << tag << " is out of order"; + previous = at; + } + fs::remove_all(d); +} + +TEST(TestSuiteWriter, MetadataCarriesTheSuppliedValues) { + fs::path d = freshDir("meta_values"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(sampleMetadata())); + + std::string xml = slurp(d / "metadata.xml"); + EXPECT_NE(xml.find("<sourcecodelang>C</sourcecodelang>"), std::string::npos); + EXPECT_NE(xml.find("<producer>Map2Check v8.0.0</producer>"), + std::string::npos); + EXPECT_NE(xml.find("<programfile>./digits.c</programfile>"), + std::string::npos); + EXPECT_NE(xml.find("<architecture>64bit</architecture>"), std::string::npos); + EXPECT_NE(xml.find("<creationtime>2026-08-16T12:00:00Z</creationtime>"), + std::string::npos); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, MetadataEscapesXmlMetacharacters) { + fs::path d = freshDir("meta_escape"); + Map2Check::TestSuiteMetadata md = sampleMetadata(); + md.programFile = "./a&b<c>.c"; + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(md)); + + std::string xml = slurp(d / "metadata.xml"); + EXPECT_NE(xml.find("<programfile>./a&b<c>.c</programfile>"), + std::string::npos); + fs::remove_all(d); +} + +// --- testcase files --------------------------------------------------------- + +TEST(TestSuiteWriter, TestCaseHasDoctypeAndInputsInOrder) { + fs::path d = freshDir("tc_order"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1023", "-7", "254"}, true)); + + std::string xml = slurp(d / "testcase-1.xml"); + EXPECT_EQ( + xml.find("<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?>"), + 0u); + EXPECT_NE( + xml.find("<!DOCTYPE testcase PUBLIC " + "\"+//IDN sosy-lab.org//DTD test-format testcase 1.1//EN\" " + "\"https://sosy-lab.org/test-format/testcase-1.1.dtd\">"), + std::string::npos); + + size_t first = xml.find("<input>1023</input>"); + size_t second = xml.find("<input>-7</input>"); + size_t third = xml.find("<input>254</input>"); + ASSERT_NE(first, std::string::npos); + ASSERT_NE(second, std::string::npos); + ASSERT_NE(third, std::string::npos); + EXPECT_LT(first, second); + EXPECT_LT(second, third); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, CoversErrorAttributeReflectsTheArgument) { + fs::path d = freshDir("tc_covers"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1"}, true)); + ASSERT_TRUE(w.writeTestCase({"2"}, false)); + + EXPECT_NE(slurp(d / "testcase-1.xml").find("<testcase coversError=\"true\">"), + std::string::npos); + EXPECT_NE(slurp(d / "testcase-2.xml").find("<testcase>"), std::string::npos); + EXPECT_EQ(slurp(d / "testcase-2.xml").find("coversError"), std::string::npos); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, TestCasesAreNumberedFromOne) { + fs::path d = freshDir("tc_numbering"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1"}, false)); + ASSERT_TRUE(w.writeTestCase({"2"}, false)); + ASSERT_TRUE(w.writeTestCase({"3"}, false)); + + EXPECT_TRUE(fs::exists(d / "testcase-1.xml")); + EXPECT_TRUE(fs::exists(d / "testcase-2.xml")); + EXPECT_TRUE(fs::exists(d / "testcase-3.xml")); + EXPECT_FALSE(fs::exists(d / "testcase-0.xml")); + fs::remove_all(d); +} + +// A program with no nondeterministic input still needs a test case. Dropping +// it would leave a suite with nothing to execute, which scores zero even +// though the error is trivially reachable. +TEST(TestSuiteWriter, EmptyInputVectorStillWritesAValidTestCase) { + fs::path d = freshDir("tc_empty"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({}, true)); + + std::string xml = slurp(d / "testcase-1.xml"); + EXPECT_NE(xml.find("<testcase coversError=\"true\">"), std::string::npos); + EXPECT_NE(xml.find("</testcase>"), std::string::npos); + EXPECT_EQ(xml.find("<input>"), std::string::npos); + fs::remove_all(d); +} + +TEST(TestSuiteWriter, CreatesNestedDirectoriesIfAbsent) { + fs::path root = freshDir("tc_mkdir"); + fs::path d = root / "nested" / "test-suite"; + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeTestCase({"1"}, false)); + EXPECT_TRUE(fs::exists(d / "testcase-1.xml")); + fs::remove_all(root); +} + +// --- reading klee_log.csv --------------------------------------------------- + +TEST(ReadNonDetLog, ReturnsValuesInConsumptionOrder) { + fs::path d = freshDir("log_order"); + fs::create_directories(d); + fs::path csv = d / "klee_log.csv"; + { + // id;line;scope;function;step;value;type -- as written by NonDetLog.c + std::ofstream out(csv); + out << "0;12;0;main;1;1023;0\n"; + out << "1;13;0;main;2;-7;0\n"; + out << "2;14;0;main;3;254;5\n"; + } + std::vector<std::string> values = Map2Check::readNonDetLog(csv.string()); + ASSERT_EQ(values.size(), 3u); + EXPECT_EQ(values[0], "1023"); + EXPECT_EQ(values[1], "-7"); + EXPECT_EQ(values[2], "254"); + fs::remove_all(d); +} + +// A log truncated by a crash or a budget kill still yields a usable prefix. +TEST(ReadNonDetLog, SkipsMalformedRowsRatherThanThrowing) { + fs::path d = freshDir("log_malformed"); + fs::create_directories(d); + fs::path csv = d / "klee_log.csv"; + { + std::ofstream out(csv); + out << "0;12;0;main;1;1023;0\n"; + out << "garbage\n"; + out << "\n"; + out << "1;13;0;main;2;42;0\n"; + } + std::vector<std::string> values = Map2Check::readNonDetLog(csv.string()); + ASSERT_EQ(values.size(), 2u); + EXPECT_EQ(values[0], "1023"); + EXPECT_EQ(values[1], "42"); + fs::remove_all(d); +} + +TEST(ReadNonDetLog, MissingFileYieldsAnEmptyVector) { + EXPECT_TRUE(Map2Check::readNonDetLog("no_such_log.csv").empty()); +} + +// --- timestamp -------------------------------------------------------------- + +TEST(IsoUtcNow, MatchesTheFormatTheFormatExpects) { + std::string now = Map2Check::isoUtcNow(); + ASSERT_EQ(now.size(), 20u); // 2026-08-16T12:00:00Z + EXPECT_EQ(now[4], '-'); + EXPECT_EQ(now[7], '-'); + EXPECT_EQ(now[10], 'T'); + EXPECT_EQ(now[13], ':'); + EXPECT_EQ(now[16], ':'); + EXPECT_EQ(now[19], 'Z'); +} + +// Engines alternate (tacas 3b): more than one phase writes test cases into the +// same suite. A writer counting from 1 again overwrote the earlier phase's. +TEST(TestSuiteWriter, NumbersAfterTheCasesAlreadyThere) { + fs::path d = freshDir("tc_continue"); + { + Map2Check::TestSuiteWriter first(d.string()); + ASSERT_TRUE(first.writeTestCase({"1"}, false)); + ASSERT_TRUE(first.writeTestCase({"2"}, false)); + } + Map2Check::TestSuiteWriter second(d.string()); + ASSERT_TRUE(second.writeTestCase({"3"}, false)); + EXPECT_NE(slurp(d / "testcase-1.xml").find("<input>1</input>"), + std::string::npos); + EXPECT_NE(slurp(d / "testcase-3.xml").find("<input>3</input>"), + std::string::npos); +} + +// Under alternation every KLEE phase adds Cover-Branches cases: the cap and +// the duplicates are counted across phases, not per phase. +TEST(TestSuiteWriter, KnowsTheCasesAnEarlierWriterLeft) { + fs::path d = freshDir("tc_known"); + { + Map2Check::TestSuiteWriter first(d.string()); + ASSERT_TRUE(first.writeTestCase({"1", "a<b"}, false)); + EXPECT_TRUE(first.hasTestCase({"1", "a<b"})); + } + Map2Check::TestSuiteWriter second(d.string()); + EXPECT_EQ(second.caseCount(), 1u); + EXPECT_TRUE(second.hasTestCase({"1", "a<b"})); + EXPECT_FALSE(second.hasTestCase({"1"})); +} + +// A run starts from an empty suite: re-running in the same directory must not +// keep the previous run's cases, possibly of another program. +TEST(TestSuiteWriter, RemoveTestCasesKeepsTheMetadata) { + fs::path d = freshDir("tc_remove"); + Map2Check::TestSuiteWriter w(d.string()); + ASSERT_TRUE(w.writeMetadata(Map2Check::TestSuiteMetadata{})); + ASSERT_TRUE(w.writeTestCase({"1"}, false)); + Map2Check::TestSuiteWriter::removeTestCases(d.string()); + EXPECT_FALSE(fs::exists(d / "testcase-1.xml")); + EXPECT_TRUE(fs::exists(d / "metadata.xml")); + EXPECT_EQ(Map2Check::TestSuiteWriter(d.string()).caseCount(), 0u); +} + +// A case from an assumption-pruned path is remembered as such across phases, +// and only such a case is evicted to make room for a deeper path. +TEST(TestSuiteWriter, EvictsOnlyPrunedCasesAcrossPhases) { + fs::path d = freshDir("tc_pruned"); + { + Map2Check::TestSuiteWriter first(d.string()); + ASSERT_TRUE(first.writeTestCase({"1"}, false)); + ASSERT_TRUE(first.writeTestCase({"2"}, false, true)); + EXPECT_EQ(first.prunedCount(), 1u); + } + Map2Check::TestSuiteWriter second(d.string()); + EXPECT_EQ(second.caseCount(), 2u); + EXPECT_EQ(second.prunedCount(), 1u); + EXPECT_TRUE(second.hasTestCase({"2"})); + + EXPECT_TRUE(second.evictPrunedCase()); + EXPECT_FALSE(fs::exists(d / "testcase-2.xml")); + EXPECT_TRUE(fs::exists(d / "testcase-1.xml")); + EXPECT_EQ(second.caseCount(), 1u); + EXPECT_FALSE(second.hasTestCase({"2"})); + EXPECT_FALSE(second.evictPrunedCase()); + + ASSERT_TRUE(second.writeTestCase({"3"}, false)); + EXPECT_TRUE(fs::exists(d / "testcase-3.xml")); + EXPECT_EQ(slurp(d / "testcase-3.xml").find("pruned"), std::string::npos); + fs::remove_all(d); +} diff --git a/utils/build_crabllvm.py b/utils/build_crabllvm.py deleted file mode 100755 index d0f26042d..000000000 --- a/utils/build_crabllvm.py +++ /dev/null @@ -1,58 +0,0 @@ -#!/usr/bin/env python3 - -import os -import sys -import shutil - -FORCE_BUILD = False - -if not FORCE_BUILD and os.path.isdir("build/dependencies/crab-llvm/build/_DIR_"): - if not os.path.isdir("release/bin/crabllvm"): - os.system("mkdir release/bin/crabllvm") - os.system("cp -r build/dependencies/crab-llvm/build/_DIR_/* release/bin/crabllvm/") - os.system("sed -i '54s/\"PATH\"/\"CLANG_PATH\"/' release/bin/crabllvm/bin/crabllvm.py") - sys.exit(0) - - -os.chdir("build/dependencies/") - -#llvm_dir=os.path.dirname(os.path.abspath("../../LLVM-3.8-Linux.tar.gz")) -#print(llvm_dir) -#llvm_dir = llvm_dir + "/LLVM-3.8-Linux/share/llvm/cmake" -llvm_dir = "/llvm/release/llvm600/lib/cmake/llvm/" - - -if not os.path.isdir("crab-llvm"): - os.system("git clone https://github.com/hbgit/crab-llvm.git") - -os.chdir("crab-llvm") -# Defining brach to build -os.system("git checkout dev-llvm-6.0") - -if not os.path.isdir("build"): - os.system("mkdir build") - -os.chdir("build") - -os.system("cmake -DLLVM_DIR=" + llvm_dir + " -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER=g++-5 -DCMAKE_PROGRAM_PATH=/usr/bin -DCMAKE_INSTALL_PREFIX=_DIR_ -DUSE_LDD=ON -DUSE_APRON=ON ../") -#print("cmake -DLLVM_DIR=" + llvm_dir + " -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=_DIR_ -DUSE_LDD=ON -DUSE_APRON=ON ../") - -# cmake --build . --target extra -os.system("cmake --build . --target extra && cmake ..") -os.system("cmake --build . --target crab && cmake ..") -os.system("cmake --build . --target ldd && cmake ..") -os.system("cmake --build . --target apron && cmake ..") -# os.system("cmake --build . --target llvm && cmake ..") -os.system("cmake --build . --target install") -os.system("") -os.system("pwd") - -os.chdir("../../../../") -#/home/map2check/devel_tool/mygitclone/release/bin -if not os.path.isdir("release/bin/crabllvm"): - os.system("mkdir release/bin/crabllvm") - os.system("cp -r build/dependencies/crab-llvm/build/_DIR_/* release/bin/crabllvm/") - os.system("sed -i '54s/\"PATH\"/\"CLANG_PATH\"/' release/bin/crabllvm/bin/crabllvm.py") - - - diff --git a/utils/map2check-wrapper-reg-test.py b/utils/map2check-wrapper-reg-test.py index 10c70dd81..5d57a8c38 100755 --- a/utils/map2check-wrapper-reg-test.py +++ b/utils/map2check-wrapper-reg-test.py @@ -72,6 +72,11 @@ elif is_memcleanup: command_line += " --memcleanup-property --generate-witness " elif is_reachability: + # --add-invariants needs Clam (the renamed crab-llvm), which this build does + # not ship. map2check exits 3 rather than ignoring the flag, so this branch + # fails until Clam lands -- deliberately. The fix is to build with + # -DENABLE_CLAM=ON, not to drop the flag. + # See docs/reports/2026-08-16-crabllvm-review.md. command_line += " --smt-solver yices2 --add-invariants --target-function --generate-witness " elif is_overflow: command_line += " --check-overflow --generate-witness " diff --git a/utils/map2check-wrapper.py b/utils/map2check-wrapper.py index 3ff8ad7fb..0f12ff50a 100755 --- a/utils/map2check-wrapper.py +++ b/utils/map2check-wrapper.py @@ -1,141 +1,282 @@ #!/usr/bin/env python3 +"""Competition entry point for Map2Check, for both SV-COMP and Test-Comp. + +One wrapper, because BenchExec has one tool-info module per tool +(benchexec/tools/map2check.py): the property file decides what is asked. + + CHECK(...) SV-COMP verification. Prints a verdict as the last line + (TRUE, FALSE, FALSE_DEREF, ..., UNKNOWN). + COVER(...) Test-Comp test generation. Writes ./test-suite/ and prints + DONE as the last line. The suite is written whether or not a + violation was found -- an absent directory reads as a crashed + tool, an empty suite as an honest zero -- and DONE does not + claim the suite covers anything; the validators decide that. + +Both Test-Comp goals are supported, with AFL++ and KLEE taking turns: + + cover-error one test case, the violating input vector of whichever + engine reached reach_error first + cover-branches up to 50 test cases: the fuzzer's corpus (at most half) and + one input vector per path KLEE explored +""" -import os import argparse +import os import shlex import subprocess +import sys + +HERE = os.path.dirname(os.path.abspath(__file__)) + +# Resolved against this file rather than "./map2check", so that the wrapper +# does not depend on the directory BenchExec starts it in. map2check itself +# derives MAP2CHECK_PATH from /proc/self/exe, so an absolute path is fine -- +# what is NOT fine is renaming the binary, which makes that derivation produce +# a garbage prefix. +MAP2CHECK = os.path.join(HERE, "map2check") + +# --- SV-COMP ------------------------------------------------------------------ + +SVCOMP_OUTER_TIMEOUT = "897s" +SVCOMP_TIMEOUT = "895" + +# --- Test-Comp ---------------------------------------------------------------- + +# Test-Comp coverage properties. Matched on the FQL body rather than on the +# file name: the competition names these files differently across years and +# the body is what actually defines the goal. +COVER_ERROR = "COVER EDGES(@CALL(reach_error))" +COVER_BRANCHES = "COVER EDGES(@DECISIONEDGE)" + +# 900s is the Test-Comp per-task budget. The tool gets slightly less so that it +# is Map2Check that stops and writes its suite, rather than the harness killing +# it mid-write and leaving a truncated metadata.xml behind. +DEFAULT_BUDGET = 900 +SHUTDOWN_MARGIN = 20 + + +def parse_args(argv): + parser = argparse.ArgumentParser(add_help=True) + parser.add_argument("-v", "--version", action="store_true", + help="print Map2Check's version") + parser.add_argument("-p", "--propertyfile", help="path to the property file") + parser.add_argument("--data-model", choices=["ILP32", "LP64"], default="LP64", + help="machine model of the task (ILP32 or LP64)") + parser.add_argument("--budget", type=int, default=DEFAULT_BUDGET, + help="total wall-clock budget in seconds (Test-Comp)") + parser.add_argument("benchmark", nargs="?", help="path to the C program") + return parser.parse_args(argv) + + +def tool_environment(): + """The environment map2check runs with. + + In the competition archive (utils/testcomp-archive/make-archive.sh) AFL++ + travels inside the tool directory, since the competition machines do not + have it: map2check is pointed at the bundled afl-fuzz and afl-clang-fast, + afl-cc at its passes and runtime objects (AFL_PATH) and at the bundled + LLVM 16 clang (AFL_CC). Outside the archive -- a development install -- + none of these exist and the defaults (/usr/local) stay in force.""" + env = dict(os.environ) + bundled = { + "MAP2CHECK_AFL_FUZZ": os.path.join(HERE, "bin", "afl-fuzz"), + "MAP2CHECK_AFL_CC": os.path.join(HERE, "bin", "afl-clang-fast"), + "AFL_PATH": os.path.join(HERE, "lib", "afl"), + "AFL_CC": os.path.join(HERE, "bin", "clang"), + } + if os.path.exists(bundled["MAP2CHECK_AFL_FUZZ"]): + for key, value in bundled.items(): + env.setdefault(key, value) + return env + -tool_path = "./map2check " -# default args -extra_tool = "timeout 897s " -command_line = extra_tool + tool_path -timemapsplit = "895" - -# Options -parser = argparse.ArgumentParser() -parser.add_argument("-v", "--version", help="Prints Map2check's version", action='store_true') -parser.add_argument("-p", "--propertyfile", help="Path to the property file") -parser.add_argument("benchmark", nargs='?', help="Path to the benchmark") - -args = parser.parse_args() - -# ARG options -version = args.version -property_file = args.propertyfile -benchmark = args.benchmark - -if version == True: - os.system(tool_path + "--version") - exit(0) - -if property_file is None: - print("Please, specify a property file") - exit(1) - -if benchmark is None: - print("Please, specify a benchmark to verify") - exit(1) - -is_memsafety = False -is_reachability = False -is_overflow = False -is_memcleanup = False - -f = open(property_file, 'r') -property_file_content = f.read() - -if "CHECK( init(main()), LTL(G valid-free) )" in property_file_content: - is_memsafety = True -elif "CHECK( init(main()), LTL(G valid-deref) )" in property_file_content: - is_memsafety = True -elif "CHECK( init(main()), LTL(G valid-memtrack) )" in property_file_content: - is_memsafety = True -elif "CHECK( init(main()), LTL(G valid-memcleanup) )" in property_file_content: - is_memcleanup = True -elif "CHECK( init(main()), LTL(G ! overflow) )" in property_file_content: - is_overflow = True -elif "CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) )" in property_file_content: - is_reachability = True -else: - # We don't support termination - print("Unsupported Property") - exit(1) - - -# Set options -command_line_bkp = "" -if is_memsafety: - command_line += " --timeout "+timemapsplit+" --memtrack --smt-solver yices2 --generate-witness " -elif is_memcleanup: - command_line += " --timeout "+timemapsplit+" --memcleanup-property --smt-solver yices2 --generate-witness " -elif is_reachability: - command_line_bkp = command_line + " --timeout "+timemapsplit+" --smt-solver yices2 --target-function --generate-witness " - command_line += " --timeout "+timemapsplit+" --smt-solver yices2 --add-invariants --target-function --generate-witness " -elif is_overflow: - command_line += " --timeout "+timemapsplit+" --check-overflow --smt-solver yices2 --generate-witness " - -print("Verifying with MAP2CHECK ") - -# Call MAP2CHECK -command_line += benchmark -command_line_bkp += benchmark - -print("Command: " + command_line) -args = shlex.split(command_line) -p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE) -(stdout, stderr) = p.communicate() - -# Check invariant conflict -if b'failed external call: __map2check_main__' in stderr: - if is_reachability: - args = shlex.split(command_line_bkp) - p = subprocess.Popen(args, stdout=subprocess.PIPE, stderr=subprocess.PIPE) +def architecture(data_model): + return "32bit" if data_model == "ILP32" else "64bit" + + +def generate_tests(args, prop): + """Test-Comp: write ./test-suite/ and end with DONE.""" + if COVER_ERROR in prop: + # One test case: the violating vector. + goal_flags = ["--target-function", "--target-function-name", "reach_error"] + else: + # The fuzzer's corpus and one test case per path KLEE explored. + # No target function: the goal is to cover branches, and asking the + # tool to hunt for reach_error would make it stop at the first error + # instead of exploring. + goal_flags = ["--cover-branches"] + + # The inner budget is what Map2Check divides between AFL++ and KLEE; the + # outer one is the backstop for a shutdown that hangs. + inner = max(1, args.budget - SHUTDOWN_MARGIN) + + command = [MAP2CHECK] + goal_flags + [ + "--generate-test-suite", + "--property-file", args.propertyfile, + "--architecture", architecture(args.data_model), + "--timeout", str(inner), + args.benchmark, + ] + + print("Generating tests with MAP2CHECK") + print("Command: " + " ".join(command)) + sys.stdout.flush() + + try: + completed = subprocess.run(command, timeout=args.budget, env=tool_environment()) + rc = completed.returncode + except subprocess.TimeoutExpired: + print("Timed out") + rc = 0 + + suite = os.path.join(os.getcwd(), "test-suite") + if not os.path.isdir(suite): + # Reported, not repaired. Fabricating a metadata.xml here would hide a + # Map2Check that died before it could write one, and the whole point of + # always emitting the suite is that its absence means something. + print("ERROR: no test-suite/ directory was produced") + return 1 + + print("Test suite in " + suite) + if rc not in (0, 1): + print("ERROR: map2check exited with %d" % rc) + return rc + print("DONE") + return 0 + + +def verify(args, prop): + """SV-COMP: print a verdict as the last line.""" + is_memsafety = False + is_reachability = False + is_overflow = False + is_memcleanup = False + + if "CHECK( init(main()), LTL(G valid-free) )" in prop: + is_memsafety = True + elif "CHECK( init(main()), LTL(G valid-deref) )" in prop: + is_memsafety = True + elif "CHECK( init(main()), LTL(G valid-memtrack) )" in prop: + is_memsafety = True + elif "CHECK( init(main()), LTL(G valid-memcleanup) )" in prop: + is_memcleanup = True + elif "CHECK( init(main()), LTL(G ! overflow) )" in prop: + is_overflow = True + elif "CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) )" in prop: + is_reachability = True + else: + # We don't support termination + print("Unsupported Property") + return 1 + + command_line = ("timeout " + SVCOMP_OUTER_TIMEOUT + " " + shlex.quote(MAP2CHECK) + + " --architecture " + architecture(args.data_model)) + + # Set options + command_line_bkp = "" + if is_memsafety: + command_line += " --timeout " + SVCOMP_TIMEOUT + " --memtrack --smt-solver yices2 --generate-witness " + elif is_memcleanup: + command_line += " --timeout " + SVCOMP_TIMEOUT + " --memcleanup-property --smt-solver yices2 --generate-witness " + elif is_reachability: + # --add-invariants needs Clam (the renamed crab-llvm), which this build does + # not ship. map2check now exits 3 rather than ignoring the flag, so this + # branch fails until Clam lands -- deliberately. Do not drop the flag to + # silence it: the request is what makes the gap visible, and hiding it is how + # the flag stayed dead through an entire baseline (issue #54). + # + # command_line_bkp below is the pre-existing no-invariants fallback, and it is + # intentionally NOT wired to exit 3: it fires only on the Crab-specific + # 'failed external call' signal further down. Wiring it here would restore the + # silence this change exists to remove. + # See docs/reports/2026-08-16-crabllvm-review.md. + command_line_bkp = command_line + " --timeout " + SVCOMP_TIMEOUT + " --smt-solver yices2 --target-function --generate-witness " + command_line += " --timeout " + SVCOMP_TIMEOUT + " --smt-solver yices2 --add-invariants --target-function --generate-witness " + elif is_overflow: + command_line += " --timeout " + SVCOMP_TIMEOUT + " --check-overflow --smt-solver yices2 --generate-witness " + + print("Verifying with MAP2CHECK ") + + # Call MAP2CHECK + command_line += shlex.quote(args.benchmark) + command_line_bkp += shlex.quote(args.benchmark) + + print("Command: " + command_line) + env = tool_environment() + p = subprocess.Popen(shlex.split(command_line), stdout=subprocess.PIPE, + stderr=subprocess.PIPE, env=env) (stdout, stderr) = p.communicate() + # Check invariant conflict + if b'failed external call: __map2check_main__' in stderr: + if is_reachability: + p = subprocess.Popen(shlex.split(command_line_bkp), stdout=subprocess.PIPE, + stderr=subprocess.PIPE, env=env) + (stdout, stderr) = p.communicate() + + output = stdout.decode() + + # Parse output + if 'Timed out' in output: + print("Timed out") + return 1 -# Parse output -if b'Timed out' in stdout: - print("Timed out") - exit(1) + # Error messages + free_offset = "\tFALSE-FREE: Operand of free must have zero pointer offset" + deref_offset = "\tFALSE-DEREF: Reference to pointer was lost" + memtrack_offset = "\tFALSE-MEMTRACK" + memcleanup_offset = "\tFALSE-MEMCLEANUP" + target_offset = "\tFALSE: Target Reached" + overflow_offset = "\tOVERFLOW" + if "VERIFICATION FAILED" in output: + if free_offset in output: + print("FALSE_FREE") + return 0 + if deref_offset in output: + print("FALSE_DEREF") + return 0 + if memtrack_offset in output: + print("FALSE_MEMTRACK") + return 0 + if memcleanup_offset in output: + print("FALSE_MEMCLEANUP") + return 0 + if target_offset in output: + print("FALSE") + return 0 + if overflow_offset in output: + print("FALSE_OVERFLOW") + return 0 -# Error messages -free_offset = "\tFALSE-FREE: Operand of free must have zero pointer offset" -deref_offset = "\tFALSE-DEREF: Reference to pointer was lost" -memtrack_offset = "\tFALSE-MEMTRACK" -memcleanup_offset = "\tFALSE-MEMCLEANUP" -target_offset = "\tFALSE: Target Reached" -overflow_offset = "\tOVERFLOW" + if "VERIFICATION SUCCEEDED" in output: + print("TRUE") + return 0 -if "VERIFICATION FAILED" in stdout.decode(): - if free_offset in stdout.decode(): - print("FALSE_FREE") - exit(0) + print("UNKNOWN") + return 0 - if deref_offset in stdout.decode(): - print("FALSE_DEREF") - exit(0) - if memtrack_offset in stdout.decode(): - print("FALSE_MEMTRACK") - exit(0) +def main(argv): + args = parse_args(argv) - if memcleanup_offset in stdout.decode(): - print("FALSE_MEMCLEANUP") - exit(0) + if args.version: + return subprocess.call([MAP2CHECK, "--version"]) - if target_offset in stdout.decode(): - print("FALSE") - exit(0) + if args.propertyfile is None: + print("Please, specify a property file") + return 1 + if args.benchmark is None: + print("Please, specify a benchmark") + return 1 - if overflow_offset in stdout.decode(): - print("FALSE_OVERFLOW") - exit(0) + with open(args.propertyfile, "r") as handle: + prop = handle.read() + if COVER_ERROR in prop or COVER_BRANCHES in prop: + return generate_tests(args, prop) + return verify(args, prop) -if "VERIFICATION SUCCEEDED" in stdout.decode(): - print("TRUE") - exit(0) -print("UNKNOWN") -exit(0) +if __name__ == "__main__": + sys.exit(main(sys.argv[1:])) diff --git a/utils/moduleBenchExec/__init__.py b/utils/moduleBenchExec/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/utils/moduleBenchExec/map2check.py b/utils/moduleBenchExec/map2check.py index 7dba57fa1..c5a52456f 100644 --- a/utils/moduleBenchExec/map2check.py +++ b/utils/moduleBenchExec/map2check.py @@ -1,110 +1,121 @@ -""" -BenchExec is a framework for reliable benchmarking. -This file is part of BenchExec. +# This file is part of BenchExec, a framework for reliable benchmarking: +# https://github.com/sosy-lab/benchexec +# +# SPDX-FileCopyrightText: 2007-2020 Dirk Beyer <https://www.sosy-lab.org> +# +# SPDX-License-Identifier: Apache-2.0 + +import functools +import os +import re -Copyright (C) 2007-2015 Dirk Beyer +import benchexec.tools.template +from benchexec import result +from benchexec.tools.sv_benchmarks_util import ILP32, LP64, get_data_model_from_task +from benchexec.tools.template import ToolNotFoundException -All rights reserved. -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at +class Tool(benchexec.tools.template.BaseTool2): + """ + This class serves as tool adaptor for Map2Check + (https://github.com/hbgit/Map2Check). - http://www.apache.org/licenses/LICENSE-2.0 + Map2Check is both a verifier and a test generator; its wrapper decides from + the property file which one is asked for. For a coverage property it + writes the test suite to ./test-suite/ and prints DONE. -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -""" -import os -import benchexec.util as Util -import benchexec.tools.template -import benchexec.result as result - -class Tool(benchexec.tools.template.BaseTool): - """ - This class serves as tool adaptor for Map2Check (https://github.com/hbgit/Map2Check) + Since Map2Check 9, the task's data model (--data-model) and the time limit + (--budget, the tool stops shortly before it so that the test suite is + complete) are passed to the wrapper. Older wrappers do not accept them. """ REQUIRED_PATHS_6 = [ - "__init__.py", - "map2check.py", - "map2check-wrapper.sh", - "modules" - ] - - REQUIRED_PATHS_7_1 = [ - "map2check", - "map2check-wrapper.py", - "bin", - "include", - "lib" - ] - - def executable(self): - #Relative path to map2check wrapper - if self._get_version() == 6: - return Util.find_executable('map2check-wrapper.sh') - elif self._get_version() > 6: - return Util.find_executable('map2check-wrapper.py') + "__init__.py", + "map2check.py", + "map2check-wrapper.sh", + "modules", + ] + + REQUIRED_PATHS_7_1 = ["map2check", "map2check-wrapper.py", "bin", "include", "lib"] + + def executable(self, tool_locator): + try: + executable = tool_locator.find_executable("map2check-wrapper.sh") + self._version = 6 + except ToolNotFoundException: + executable = tool_locator.find_executable("map2check-wrapper.py") + self._version = 7 + return executable def program_files(self, executable): """ Determine the file paths to be adopted """ - if self._get_version() == 6: + if self._version == 6: paths = self.REQUIRED_PATHS_6 - elif self._get_version() > 6: + elif self._version > 6: paths = self.REQUIRED_PATHS_7_1 return paths - def _get_version(self): - """ - Determine the version based on map2check-wrapper.sh file - """ - exe_v6 = Util.find_executable('map2check-wrapper.sh', exitOnError=False) - if exe_v6: - return 6 - else: - return 7 - - def working_directory(self, executable): executableDir = os.path.dirname(executable) return executableDir def version(self, executable): - return self._version_from_tool(executable) + # Map2Check prints "v9.0.0-Songbirds:2026-10-13". + return self._version_from_tool(executable).removeprefix("v") def name(self): - return 'Map2Check' - - def cmdline(self, executable, options, sourcefiles, propertyfile, rlimits): - assert len(sourcefiles) == 1, "only one sourcefile supported" - assert propertyfile, "property file required" - sourcefile = sourcefiles[0] - if self._get_version() == 6: - return [executable] + options + ['-c', propertyfile, sourcefile] - elif self._get_version() > 6: - return [executable] + options + ['-p', propertyfile, sourcefile] - - - def determine_result(self, returncode, returnsignal, output, isTimeout): + return "Map2Check" + + def project_url(self): + return "https://github.com/hbgit/Map2Check" + + def cmdline(self, executable, options, task, rlimits): + if task.property_file is None: + raise benchexec.tools.template.UnsupportedFeatureException( + "Map2Check requires a property file" + ) + + if self._version == 6: + return ( + [executable] + + options + + ["-c", task.property_file, task.single_input_file] + ) + elif self._version > 6: + cmd = [executable] + options + ["-p", task.property_file] + if _major_version(executable) >= 9: + data_model = get_data_model_from_task( + task, {ILP32: "ILP32", LP64: "LP64"} + ) + if data_model: + cmd += ["--data-model", data_model] + budget = rlimits.walltime or rlimits.cputime + if budget: + cmd += ["--budget", str(budget)] + return cmd + [task.single_input_file] + assert False, f"Unexpected version {self._version}" + + def determine_result(self, run): + output = run.output if not output: return result.RESULT_UNKNOWN output = output[-1].strip() status = result.RESULT_UNKNOWN - if self._get_version() > 6: - if output.endswith('TRUE'): + if self._version > 6: + if output == "DONE": + status = result.RESULT_DONE + elif output.endswith("TRUE"): status = result.RESULT_TRUE_PROP - elif 'FALSE' in output: + elif "FALSE" in output: if "FALSE_MEMTRACK" in output: status = result.RESULT_FALSE_MEMTRACK + elif "FALSE_MEMCLEANUP" in output: + status = result.RESULT_FALSE_MEMCLEANUP elif "FALSE_DEREF" in output: status = result.RESULT_FALSE_DEREF elif "FALSE_FREE" in output: @@ -113,28 +124,36 @@ def determine_result(self, returncode, returnsignal, output, isTimeout): status = result.RESULT_FALSE_OVERFLOW else: status = result.RESULT_FALSE_REACH - elif output.endswith('UNKNOWN'): + elif output.endswith("UNKNOWN"): status = result.RESULT_UNKNOWN - elif isTimeout: - status = 'TIMEOUT' + elif run.was_timeout: + status = result.RESULT_TIMEOUT else: - status = 'ERROR' + status = "ERROR" - elif self._get_version() == 6: - if output.endswith('TRUE'): + elif self._version == 6: + if output.endswith("TRUE"): status = result.RESULT_TRUE_PROP - elif 'FALSE' in output: + elif "FALSE" in output: if "FALSE(valid-memtrack)" in output: status = result.RESULT_FALSE_MEMTRACK elif "FALSE(valid-deref)" in output: status = result.RESULT_FALSE_DEREF elif "FALSE(valid-free)" in output: status = result.RESULT_FALSE_FREE - elif output.endswith('UNKNOWN'): + elif output.endswith("UNKNOWN"): status = result.RESULT_UNKNOWN - elif isTimeout: - status = 'TIMEOUT' + elif run.was_timeout: + status = result.RESULT_TIMEOUT else: - status = 'ERROR' + status = "ERROR" return status + + +@functools.lru_cache +def _major_version(executable): + """The major version of Map2Check, or 0 if the wrapper does not tell.""" + version = Tool._version_from_tool(executable) + match = re.match(r"v?(\d+)\.", version) + return int(match.group(1)) if match else 0 diff --git a/utils/testcomp-archive/README.txt b/utils/testcomp-archive/README.txt new file mode 100644 index 000000000..91e8569dc --- /dev/null +++ b/utils/testcomp-archive/README.txt @@ -0,0 +1,62 @@ +Map2Check -- Test-Comp 2027 archive +=================================== + +Map2Check is a bug-hunting tool for C programs: LLVM passes instrument the +program, and inputs are generated by alternating AFL++ fuzzing with KLEE +symbolic execution, each engine seeded with the other's inputs. + +Project: https://github.com/hbgit/Map2Check +License: GPL-2.0 (LICENSE); third-party components under licenses/ + +Usage (Test-Comp) +----------------- + ./map2check-wrapper.py -p <property.prp> [--data-model ILP32|LP64] \ + [--budget <seconds>] <program.c> + +The test suite is written to ./test-suite/ in the current directory, in the +Test-Comp exchange format. Supported properties: coverage-error-call and +coverage-branches. --budget defaults to 900 s; the tool stops shortly before +it so that the suite is complete. The same wrapper verifies when given an +SV-COMP property (CHECK(...)) and then prints a verdict instead. + + ./map2check-wrapper.py --version prints the version + ./smoketest.sh runs the two examples in examples/ + +The archive runs on x86_64 Ubuntu 24.04: it carries LLVM 16 (clang, opt, +llvm-link), KLEE 3.1 with klee-uclibc, AFL++ 4.40c and every shared library +they need except glibc. The host needs two packages: + + apt-get install python3 gcc-multilib + +python3 runs the wrapper. gcc-multilib brings the linker, the C runtime and +libgcc, for both 64 and 32 bits (ILP32 tasks): the bundled clang links the +AFL++ binary of the program with them. Without them the tool still runs and +writes a suite, but skips the fuzzer and leaves the whole budget to KLEE +(the log says "the AFL++ binary failed to build"); ./smoketest.sh fails. +The tool can be run from any directory. + +How it runs +----------- +Map2Check alternates the two engines in windows until the budget ends, each +seeding the other: AFL++ fuzzes a natively compiled, instrumented binary of +the program, and KLEE explores its bitcode symbolically, starting from the +fuzzer's inputs. Cover-Error stops at the first input that reaches +reach_error, replays it and writes it as the only test case. Cover-Branches +runs until the budget ends or KLEE has explored every path, and writes at most +50 test cases: up to half from the fuzzer's corpus (the inputs that found new +edges), the rest one per path KLEE explored. + +The log records what each engine did, from its own output after the run: +"AFL++ ran: N executions, M inputs in the corpus" and "KLEE ran: N tests +generated". ./smoketest.sh requires both lines. + +Bundled components +------------------ + Map2Check GPL-2.0 LICENSE + LLVM / Clang 16 Apache-2.0 WITH LLVM-exception licenses/llvm-16.copyright, clang-16.copyright + KLEE 3.1 NCSA licenses/KLEE-3.1.LICENSE.TXT + klee-uclibc LGPL-2.1 licenses/klee-uclibc.COPYING.LIB + AFL++ 4.40c Apache-2.0 licenses/AFLplusplus-4.40c.LICENSE + STP 2.3.4 MIT licenses/STP-2.3.4.LICENSE + MiniSat MIT licenses/MiniSat.LICENSE + shared libraries see licenses/*.copyright (Debian copyright files) diff --git a/utils/testcomp-archive/examples/cover_branches.c b/utils/testcomp-archive/examples/cover_branches.c new file mode 100644 index 000000000..e8fc7c520 --- /dev/null +++ b/utils/testcomp-archive/examples/cover_branches.c @@ -0,0 +1,15 @@ +extern int __VERIFIER_nondet_int(void); + +int main(void) { + int x = __VERIFIER_nondet_int(); + int y = __VERIFIER_nondet_int(); + if (x > 10) { + y = y + 1; + } else { + y = y - 1; + } + if (y == 7) { + return 1; + } + return 0; +} diff --git a/utils/testcomp-archive/examples/cover_error.c b/utils/testcomp-archive/examples/cover_error.c new file mode 100644 index 000000000..89b569388 --- /dev/null +++ b/utils/testcomp-archive/examples/cover_error.c @@ -0,0 +1,14 @@ +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +/* As in sv-benchmarks: reach_error is defined, so that the program links + natively for the AFL++ phase, and not only as bitcode for KLEE. */ +void reach_error(void) { __assert_fail("0", "cover_error.c", 5, "reach_error"); } +extern int __VERIFIER_nondet_int(void); + +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x == 42) { + reach_error(); + } + return 0; +} diff --git a/test-comp2026/simulation/coverage-branches.prp b/utils/testcomp-archive/examples/coverage-branches.prp similarity index 100% rename from test-comp2026/simulation/coverage-branches.prp rename to utils/testcomp-archive/examples/coverage-branches.prp diff --git a/utils/testcomp-archive/examples/coverage-error-call.prp b/utils/testcomp-archive/examples/coverage-error-call.prp new file mode 100644 index 000000000..92c06f546 --- /dev/null +++ b/utils/testcomp-archive/examples/coverage-error-call.prp @@ -0,0 +1 @@ +COVER( init(main()), FQL(COVER EDGES(@CALL(reach_error))) ) diff --git a/utils/testcomp-archive/licenses/AFLplusplus-4.40c-THIRD-PARTY.txt b/utils/testcomp-archive/licenses/AFLplusplus-4.40c-THIRD-PARTY.txt new file mode 100644 index 000000000..4fc96c6e8 --- /dev/null +++ b/utils/testcomp-archive/licenses/AFLplusplus-4.40c-THIRD-PARTY.txt @@ -0,0 +1,74 @@ +AFL++ 4.40c: third-party code compiled into bin/afl-fuzz (hashing, src/afl-performance.c), +besides AFL++'s own Apache-2.0 (AFLplusplus-4.40c.LICENSE), and the LLVM-derived pass. +Source: https://github.com/AFLplusplus/AFLplusplus/tree/v4.40c, verbatim. + +============================================================================== +include/t1ha.h +============================================================================== +/* + * Copyright (c) 2016-2020 Positive Technologies, https://www.ptsecurity.com, + * Fast Positive Hash. + * + * Portions Copyright (c) 2010-2020 Leonid Yuriev <leo@yuriev.ru>, + * The 1Hippeus project (t1h). + * + * This software is provided 'as-is', without any express or implied + * warranty. In no event will the authors be held liable for any damages + * arising from the use of this software. + * + * Permission is granted to anyone to use this software for any purpose, + * including commercial applications, and to alter it and redistribute it + * freely, subject to the following restrictions: + * + * 1. The origin of this software must not be misrepresented; you must not + * claim that you wrote the original software. If you use this software + * in a product, an acknowledgement in the product documentation would be + * appreciated but is not required. + * 2. Altered source versions must be plainly marked as such, and must not be + * misrepresented as being the original software. + * 3. This notice may not be removed or altered from any source distribution. + */ + +============================================================================== +include/xxhash.h +============================================================================== +/* + * xxHash - Extremely Fast Hash algorithm + * Header File + * Copyright (C) 2012-2023 Yann Collet + * + * BSD 2-Clause License (https://www.opensource.org/licenses/bsd-license.php) + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are + * met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following disclaimer + * in the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * You can contact the author at: + * - xxHash homepage: https://www.xxhash.com + * - xxHash source repository: https://github.com/Cyan4973/xxHash + */ + +============================================================================== +instrumentation/SanitizerCoveragePCGUARD.so.cc (lib/afl/SanitizerCoveragePCGUARD.so) +============================================================================== +"Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions." +See LLVM-16.LICENSE.TXT. diff --git a/utils/testcomp-archive/licenses/AFLplusplus-4.40c.LICENSE b/utils/testcomp-archive/licenses/AFLplusplus-4.40c.LICENSE new file mode 100644 index 000000000..261eeb9e9 --- /dev/null +++ b/utils/testcomp-archive/licenses/AFLplusplus-4.40c.LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/utils/testcomp-archive/licenses/Artistic-1.0-Perl.txt b/utils/testcomp-archive/licenses/Artistic-1.0-Perl.txt new file mode 100644 index 000000000..dd45f4cd8 --- /dev/null +++ b/utils/testcomp-archive/licenses/Artistic-1.0-Perl.txt @@ -0,0 +1,51 @@ +The "Artistic License" + +Preamble + +The intent of this document is to state the conditions under which a Package may be copied, such that the Copyright Holder maintains some semblance of artistic control over the development of the package, while giving the users of the package the right to use and distribute the Package in a more-or-less customary fashion, plus the right to make reasonable modifications. + +Definitions: + + "Package" refers to the collection of files distributed by the Copyright Holder, and derivatives of that collection of files created through textual modification. + + "Standard Version" refers to such a Package if it has not been modified, or has been modified in accordance with the wishes of the Copyright Holder as specified below. + + "Copyright Holder" is whoever is named in the copyright or copyrights for the package. + + "You" is you, if you're thinking about copying or distributing this Package. + + "Reasonable copying fee" is whatever you can justify on the basis of media cost, duplication charges, time of people involved, and so on. (You will not be required to justify it to the Copyright Holder, but only to the computing community at large as a market that must bear the fee.) + + "Freely Available" means that no fee is charged for the item itself, though there may be fees involved in handling the item. It also means that recipients of the item may redistribute it under the same conditions they received it. + +1. You may make and give away verbatim copies of the source form of the Standard Version of this Package without restriction, provided that you duplicate all of the original copyright notices and associated disclaimers. + +2. You may apply bug fixes, portability fixes and other modifications derived from the Public Domain or from the Copyright Holder. A Package modified in such a way shall still be considered the Standard Version. + +3. You may otherwise modify your copy of this Package in any way, provided that you insert a prominent notice in each changed file stating how and when you changed that file, and provided that you do at least ONE of the following: + + a) place your modifications in the Public Domain or otherwise make them Freely Available, such as by posting said modifications to Usenet or an equivalent medium, or placing the modifications on a major archive site such as uunet.uu.net, or by allowing the Copyright Holder to include your modifications in the Standard Version of the Package. + b) use the modified Package only within your corporation or organization. + c) rename any non-standard executables so the names do not conflict with standard executables, which must also be provided, and provide a separate manual page for each non-standard executable that clearly documents how it differs from the Standard Version. + d) make other distribution arrangements with the Copyright Holder. + +4. You may distribute the programs of this Package in object code or executable form, provided that you do at least ONE of the following: + + a) distribute a Standard Version of the executables and library files, together with instructions (in the manual page or equivalent) on where to get the Standard Version. + b) accompany the distribution with the machine-readable source of the Package with your modifications. + c) give non-standard executables non-standard names, and clearly document the differences in manual pages (or equivalent), together with instructions on where to get the Standard Version. + d) make other distribution arrangements with the Copyright Holder. + +5. You may charge a reasonable copying fee for any distribution of this Package. You may charge any fee you choose for support of this Package. You may not charge a fee for this Package itself. However, you may distribute this Package in aggregate with other (possibly commercial) programs as part of a larger (possibly commercial) software distribution provided that you do not advertise this Package as a product of your own. You may embed this Package's interpreter within an executable of yours (by linking); this shall be construed as a mere form of aggregation, provided that the complete Standard Version of the interpreter is so embedded. + +6. The scripts and library files supplied as input to or produced as output from the programs of this Package do not automatically fall under the copyright of this Package, but belong to whoever generated them, and may be sold commercially, and may be aggregated with this Package. If such scripts or library files are aggregated with this Package via the so-called "undump" or "unexec" methods of producing a binary executable image, then distribution of such an image shall neither be construed as a distribution of this Package nor shall it fall under the restrictions of Paragraphs 3 and 4, provided that you do not represent such an executable image as a Standard Version of this Package. + +7. C subroutines (or comparably compiled subroutines in other languages) supplied by you and linked into this Package in order to emulate subroutines and variables of the language defined by this Package shall not be considered part of this Package, but are the equivalent of input as in Paragraph 6, provided these subroutines do not change the language in any way that would cause it to fail the regression tests for the language. + +8. Aggregation of this Package with a commercial distribution is always permitted provided that the use of this Package is embedded; that is, when no overt attempt is made to make this Package's interfaces visible to the end user of the commercial distribution. Such use shall not be construed as a distribution of this Package. + +9. The name of the Copyright Holder may not be used to endorse or promote products derived from this software without specific prior written permission. + +10. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. + +The End diff --git a/utils/testcomp-archive/licenses/KLEE-3.1-runtime-NOTICES.txt b/utils/testcomp-archive/licenses/KLEE-3.1-runtime-NOTICES.txt new file mode 100644 index 000000000..589ef715d --- /dev/null +++ b/utils/testcomp-archive/licenses/KLEE-3.1-runtime-NOTICES.txt @@ -0,0 +1,341 @@ +KLEE 3.1 runtime: notices of the files under another license than KLEE's +(University of Illinois/NCSA, KLEE-3.1.LICENSE.TXT). They are compiled into +lib/klee/runtime/libkleeRuntimeFreestanding64*.bca and libkleeRuntimeKLEELibc64*.bca. +Source: https://github.com/klee/klee/tree/v3.1/runtime (fe22b90), verbatim. + +============================================================================== +runtime/Freestanding/memcmp.c +============================================================================== +/*- + * Copyright (c) 1990, 1993 + * The Regents of the University of California. All rights reserved. + * + * This code is derived from software contributed to Berkeley by + * Chris Torek. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/atoi.c +============================================================================== +/* + * Copyright (c) 1988, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/memchr.c +============================================================================== +/*- + * Copyright (c) 1990, 1993 + * The Regents of the University of California. All rights reserved. + * + * This code is derived from software contributed to Berkeley by + * Chris Torek. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/stpcpy.c +============================================================================== +/* + * Copyright (c) 1999 + * David E. O'Brien + * Copyright (c) 1988, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/strcat.c +============================================================================== +/* + * Copyright (c) 1988, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/strncmp.c +============================================================================== +/* + * Copyright (c) 1989, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/strncpy.c +============================================================================== +/*- + * Copyright (c) 1990, 1993 + * The Regents of the University of California. All rights reserved. + * + * This code is derived from software contributed to Berkeley by + * Chris Torek. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/strtol.c +============================================================================== +/*- + * Copyright (c) 1990, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/klee-libc/strtoul.c +============================================================================== +/* + * Copyright (c) 1990, 1993 + * The Regents of the University of California. All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by the University of + * California, Berkeley and its contributors. + * 4. Neither the name of the University nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE + * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL + * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS + * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +============================================================================== +runtime/Sanitizer (libkleeUBSan64*.bca) +============================================================================== +Derived from LLVM compiler-rt: "Part of the LLVM Project, under the Apache License +v2.0 with LLVM Exceptions." See LLVM-16.LICENSE.TXT. diff --git a/utils/testcomp-archive/licenses/KLEE-3.1.LICENSE.TXT b/utils/testcomp-archive/licenses/KLEE-3.1.LICENSE.TXT new file mode 100644 index 000000000..b358bb352 --- /dev/null +++ b/utils/testcomp-archive/licenses/KLEE-3.1.LICENSE.TXT @@ -0,0 +1,74 @@ +============================================================================== +KLEE Release License +============================================================================== +University of Illinois/NCSA +Open Source License + +http://klee.github.io/ + +Developed by: + KLEE Team + Stanford Checking Group + +Copyright (c) 2007-2009 Stanford University. +All rights reserved. + + +Maintained since 2009 by: + Software Reliability Group + http://srg.doc.ic.ac.uk/ + Imperial College London + + +Improved and extended since 2009 by many developers. For a full list +of contributors, refer to + https://github.com/klee/klee/graphs/contributors +and the Git commit history. + + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal with +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies +of the Software, and to permit persons to whom the Software is furnished to do +so, subject to the following conditions: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimers. + + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimers in the + documentation and/or other materials provided with the distribution. + + * Neither the names of the KLEE Team, Stanford University, + Imperial College London, nor the names of its contributors may + be used to endorse or promote products derived from this + Software without specific prior written permission. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE +SOFTWARE. + +============================================================================== +The KLEE software contains code written by third parties. Such software will +have its own individual LICENSE.TXT file in the directory in which it appears. +This file will describe the copyrights, license, and restrictions which apply +to that code. + +The disclaimer of warranty in the University of Illinois Open Source +License applies to all code in the KLEE distribution, and nothing in +any of the other licenses gives permission to use the names of the +KLEE team, Stanford University, or the names of its contributors to +endorse or promote products derived from this Software. + +The following pieces of software have additional or alternate copyrights, +licenses, and/or restrictions: + +Program Directory +------- --------- +klee-libc runtime/klee-libc + diff --git a/utils/testcomp-archive/licenses/LGPL-2.0.txt b/utils/testcomp-archive/licenses/LGPL-2.0.txt new file mode 100644 index 000000000..843b00b56 --- /dev/null +++ b/utils/testcomp-archive/licenses/LGPL-2.0.txt @@ -0,0 +1,175 @@ +GNU LIBRARY GENERAL PUBLIC LICENSE + +Version 2, June 1991 + +Copyright (C) 1991 Free Software Foundation, Inc. +51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA + +Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. + +[This is the first released version of the library GPL. It is numbered 2 because it goes with version 2 of the ordinary GPL.] + +Preamble + +The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. + +This license, the Library General Public License, applies to some specially designated Free Software Foundation software, and to any other libraries whose authors decide to use it. You can use it for your libraries, too. + +When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. + +To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library, or if you modify it. + +For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link a program with the library, you must provide complete object files to the recipients so that they can relink them with the library, after making changes to the library and recompiling it. And you must show them these terms so they know their rights. + +Our method of protecting your rights has two steps: (1) copyright the library, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the library. + +Also, for each distributor's protection, we want to make certain that everyone understands that there is no warranty for this free library. If the library is modified by someone else and passed on, we want its recipients to know that what they have is not the original version, so that any problems introduced by others will not reflect on the original authors' reputations. + +Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that companies distributing free software will individually obtain patent licenses, thus in effect transforming the program into proprietary software. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. + +Most GNU software, including some libraries, is covered by the ordinary GNU General Public License, which was designed for utility programs. This license, the GNU Library General Public License, applies to certain designated libraries. This license is quite different from the ordinary one; be sure to read it in full, and don't assume that anything in it is the same as in the ordinary license. + +The reason we have a separate public license for some libraries is that they blur the distinction we usually make between modifying or adding to a program and simply using it. Linking a program with a library, without changing the library, is in some sense simply using the library, and is analogous to running a utility program or application program. However, in a textual and legal sense, the linked executable is a combined work, a derivative of the original library, and the ordinary General Public License treats it as such. + +Because of this blurred distinction, using the ordinary General Public License for libraries did not effectively promote software sharing, because most developers did not use the libraries. We concluded that weaker conditions might promote sharing better. + +However, unrestricted linking of non-free programs would deprive the users of those programs of all benefit from the free status of the libraries themselves. This Library General Public License is intended to permit developers of non-free programs to use free libraries, while preserving your freedom as a user of such programs to change the free libraries that are incorporated in them. (We have not seen how to achieve this as regards changes in header files, but we have achieved it as regards changes in the actual functions of the Library.) The hope is that this will lead to faster development of free libraries. + +The precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, while the latter only works together with the library. + +Note that it is possible for a library to be covered by the ordinary General Public License rather than by this special one. + +GNU LIBRARY GENERAL PUBLIC LICENSE +TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + +0. This License Agreement applies to any software library which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Library General Public License (also called "this License"). Each licensee is addressed as "you". + +A "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables. + +The "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".) + +"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library. + +Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does. + +1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library. + +You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. + +2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: + + a) The modified work must itself be a software library. + + b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change. + + c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License. + + d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful. + +(For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.) + +These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library. + +In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. + +3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices. + +Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy. + +This option is useful when you wish to copy part of the code of the Library into a program that is not a library. + +4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange. + +If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code. + +5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License. + +However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables. + +When a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law. + +If such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.) + +Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself. + +6. As an exception to the Sections above, you may also compile or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications. + +You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things: + + a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.) + + b) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution. + + c) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place. + + d) Verify that the user has already received a copy of these materials or that you have already sent this user a copy. + +For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. + +It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute. + +7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things: + + a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above. + + b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. + +8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. + +9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it. + +10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. + +11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library. + +If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances. + +It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. + +This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. + +12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. + +13. The Free Software Foundation may publish revised and/or new versions of the Library General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. + +Each version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation. + +14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. + +NO WARRANTY + +15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + +16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +END OF TERMS AND CONDITIONS + +How to Apply These Terms to Your New Libraries + +If you develop a new library, and you want it to be of the greatest possible use to the public, we recommend making it free software that everyone can redistribute and change. You can do so by permitting redistribution under these terms (or, alternatively, under the terms of the ordinary General Public License). + +To apply these terms, attach the following notices to the library. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. + + one line to give the library's name and an idea of what it does. + Copyright (C) year name of author + + This library is free software; you can redistribute it and/or modify it under the terms of the GNU Library General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public License for more details. + + You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA. + +Also add information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the library, if necessary. Here is a sample; alter the names: + +Yoyodyne, Inc., hereby disclaims all copyright interest in +the library `Frob' (a library for tweaking knobs) written +by James Random Hacker. + +signature of Ty Coon, 1 April 1990 +Ty Coon, President of Vice + +That's all there is to it! diff --git a/utils/testcomp-archive/licenses/LLVM-16.LICENSE.TXT b/utils/testcomp-archive/licenses/LLVM-16.LICENSE.TXT new file mode 100644 index 000000000..fa6ac5400 --- /dev/null +++ b/utils/testcomp-archive/licenses/LLVM-16.LICENSE.TXT @@ -0,0 +1,279 @@ +============================================================================== +The LLVM Project is under the Apache License v2.0 with LLVM Exceptions: +============================================================================== + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + +---- LLVM Exceptions to the Apache 2.0 License ---- + +As an exception, if, as a result of your compiling your source code, portions +of this Software are embedded into an Object form of such source code, you +may redistribute such embedded portions in such Object form without complying +with the conditions of Sections 4(a), 4(b) and 4(d) of the License. + +In addition, if you combine or link compiled forms of this Software with +software that is licensed under the GPLv2 ("Combined Software") and if a +court of competent jurisdiction determines that the patent provision (Section +3), the indemnity provision (Section 9) or other Section of the License +conflicts with the conditions of the GPLv2, you may retroactively and +prospectively choose to deem waived or otherwise exclude such Section(s) of +the License, but only in their entirety and only with respect to the Combined +Software. + +============================================================================== +Software from third parties included in the LLVM Project: +============================================================================== +The LLVM Project contains third party software which is under different license +terms. All such code will be identified clearly using at least one of two +mechanisms: +1) It will be in a separate directory tree with its own `LICENSE.txt` or + `LICENSE` file at the top containing the specific license and restrictions + which apply to that software, or +2) It will contain specific license and restriction terms at the top of every + file. + +============================================================================== +Legacy LLVM License (https://llvm.org/docs/DeveloperPolicy.html#legacy): +============================================================================== +University of Illinois/NCSA +Open Source License + +Copyright (c) 2003-2019 University of Illinois at Urbana-Champaign. +All rights reserved. + +Developed by: + + LLVM Team + + University of Illinois at Urbana-Champaign + + http://llvm.org + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal with +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies +of the Software, and to permit persons to whom the Software is furnished to do +so, subject to the following conditions: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimers. + + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimers in the + documentation and/or other materials provided with the distribution. + + * Neither the names of the LLVM Team, University of Illinois at + Urbana-Champaign, nor the names of its contributors may be used to + endorse or promote products derived from this Software without specific + prior written permission. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE +SOFTWARE. + diff --git a/utils/testcomp-archive/licenses/MiniSat.LICENSE b/utils/testcomp-archive/licenses/MiniSat.LICENSE new file mode 100644 index 000000000..22816ff39 --- /dev/null +++ b/utils/testcomp-archive/licenses/MiniSat.LICENSE @@ -0,0 +1,21 @@ +MiniSat -- Copyright (c) 2003-2006, Niklas Een, Niklas Sorensson + Copyright (c) 2007-2010 Niklas Sorensson + +Permission is hereby granted, free of charge, to any person obtaining a +copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be included +in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/utils/testcomp-archive/licenses/README.md b/utils/testcomp-archive/licenses/README.md new file mode 100644 index 000000000..9e3e32c21 --- /dev/null +++ b/utils/testcomp-archive/licenses/README.md @@ -0,0 +1,28 @@ +# Licenses of the Map2Check Test-Comp archive + +Every file in the archive belongs to one of the components below, and the +archive carries the license texts of each. `make-archive.sh` enforces this +table: it refuses to build an archive with a file that matches no row, or +with a license file of a row missing. + +| Component | Version / source | Files in the archive | License | Texts in `licenses/` | +|---|---|---|---|---| +| Map2Check | this repository | `map2check`, `map2check-wrapper.py`, `smoketest.sh`, `examples/`, `README`, `lib/lib*Pass.so`, `lib/libMap2CheckLibrary.so`, `lib/*.bc` (runtime) | GPL-2.0 | `../LICENSE` | +| KLEE | 3.1 (`fe22b90`) | `bin/klee`, `bin/kleaver`, `bin/ktest-tool` | NCSA | `KLEE-3.1.LICENSE.TXT` | +| KLEE runtime | 3.1 (`runtime/`) | `lib/klee/runtime/libkleeRuntime*.bca`, `libkleeUBSan64*.bca` | NCSA; 9 files of klee-libc and Freestanding under BSD (University of California, FreeBSD); the UBSan runtime from LLVM compiler-rt | `KLEE-3.1.LICENSE.TXT`, `KLEE-3.1-runtime-NOTICES.txt` (the 9 notices, verbatim), `LLVM-16.LICENSE.TXT` | +| klee-uclibc | `klee/klee-uclibc` | `lib/klee/runtime/klee-uclibc.bca` | LGPL-2.1 | `klee-uclibc.COPYING.LIB` | +| AFL++ | 4.40c | `bin/afl-*`, `lib/afl/*` | Apache-2.0; t1ha (zlib-style) and xxHash (BSD-2-Clause) compiled into `afl-fuzz`; `SanitizerCoveragePCGUARD.so` from LLVM | `AFLplusplus-4.40c.LICENSE`, `AFLplusplus-4.40c-THIRD-PARTY.txt`, `LLVM-16.LICENSE.TXT` | +| STP | 2.3.4 | `lib/libstp.so.2.3` | MIT; components Bit::Vector (Artistic / GPL / LGPL), CVC's SMT-LIB parser, ABC (UC) | `STP-2.3.4.LICENSE`, `STP-2.3.4.LICENSE_COMPONENTS`, `Artistic-1.0-Perl.txt`, `LGPL-2.0.txt`, GPL-2 in `../LICENSE` | +| MiniSat | `stp/minisat` (`62a143a`) | `lib/libminisat.so.2` | MIT | `MiniSat.LICENSE` | +| LLVM / Clang 16 | Ubuntu 22.04 packages | `bin/clang`, `bin/opt`, `bin/llvm-link`, `lib/libLLVM-16.so.1`, `lib/libclang-cpp.so.16` | Apache-2.0 WITH LLVM-exception | `clang-16.copyright`, `llvm-16.copyright`, `libllvm16.copyright`, `libclang-cpp16.copyright`, `LLVM-16.LICENSE.TXT` | +| Clang resource headers | Ubuntu 22.04 `libclang-common-16-dev` | `lib/clang/16/`, `include/` | Apache-2.0 WITH LLVM-exception | `libclang-common-16-dev.copyright`, `LLVM-16.LICENSE.TXT` | +| Shared libraries | Ubuntu 22.04 packages | every other `lib/*.so*` (Z3, Boost, libstdc++, ICU, libxml2, ...) | as stated in each package's copyright | `<package>.copyright`, one per package, and the texts they name in `common-licenses/` | + +Sources of the texts: +- KLEE, AFL++, STP and MiniSat: the license files of the tagged versions above, + and the notices copied verbatim from their source files; +- the LLVM license: `llvm/LICENSE.TXT` of the `release/16.x` branch; +- `Artistic-1.0-Perl.txt` and `LGPL-2.0.txt`: the SPDX license list (v3.25.0), + the texts STP's `LICENSE_COMPONENTS` refers to for Bit::Vector; +- the Debian copyright files and `common-licenses/`: copied from the build + image by `make-archive.sh`. diff --git a/utils/testcomp-archive/licenses/STP-2.3.4.LICENSE b/utils/testcomp-archive/licenses/STP-2.3.4.LICENSE new file mode 100644 index 000000000..62da2095c --- /dev/null +++ b/utils/testcomp-archive/licenses/STP-2.3.4.LICENSE @@ -0,0 +1,41 @@ +The MIT License + +Copyright (c) + 2005 - 2015 Vijay Ganesh. Main codebase, project lead + 2010 - 2014 Trevor Hansen + 2013 - 2015 Ryan Govostes + 2013 - 2015 Dan Liew + 2011 - 2013 Khoo Yit Phang + 2005 - 2015 David L. Dill + 2009 - 2015 Mate Soos + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +--- + +Also includes copyrighted software from: + * Bit::Vector -- Copyright (c) 1995 - 2004 by Steffen Beyer + * CVC's SMT-LIB Parser -- Copyright (C) 2004 by the Board of Trustees + of Leland Stanford Junior University and by New York University. + * ABC -- Copyright (c) The Regents of the University of California. + * Windows msc99hdr -- Copyright (c) 2006-2008 Alexander Chemeris + Copyright (c) 2000 Jeroen Ruigrok van der Werven <asmodai@FreeBSD.org> + +For licenses of these SW packages, please see LICENSE_COMPONENTS \ No newline at end of file diff --git a/utils/testcomp-archive/licenses/STP-2.3.4.LICENSE_COMPONENTS b/utils/testcomp-archive/licenses/STP-2.3.4.LICENSE_COMPONENTS new file mode 100644 index 000000000..387e638d9 --- /dev/null +++ b/utils/testcomp-archive/licenses/STP-2.3.4.LICENSE_COMPONENTS @@ -0,0 +1,201 @@ +STP imports code from the following libraries: + * Bit::Vector Copyright (c) 1995 - 2004 by Steffen Beyer. + * CVC's SMT-LIB Parser Copyright (C) 2004 by the Board of Trustees + of Leland Stanford Junior University and by New York University. + * ABC Copyright (c) The Regents of the University of California. + * Windows msc99hdr Copyright (c) 2006-2008 Alexander Chemeris + Copyright (c) 2000 Jeroen Ruigrok van der Werven <asmodai@FreeBSD.org> + +For testing purposes we also use (but do not compile STP with): + * llvm-lit Copyright (c) 2003-2014 University of Illinois at Urbana-Champaign. + * OutputCheck Copyright (c) 2014, Daniel Liew + * GoogleTest framework Copyright 2008, Google Inc. + + +Individual licenses are listed below +================================================================================ + +Bit::Vector + This package with all its parts is + + Copyright (c) 1995 - 2004 by Steffen Beyer. + All rights reserved. + + This package is free software; you can use, modify and redistribute + it under the same terms as Perl itself, i.e., under the terms of + the "Artistic License" or the "GNU General Public License". + + The C library at the core of this Perl module can additionally + be used, modified and redistributed under the terms of the + "GNU Library General Public License". + + Please refer to the files "Artistic.txt", "GNU_GPL.txt" and + "GNU_LGPL.txt" in this distribution, respectively, for details! + +CVC's SMT-LIB Parser + \file smtlib.y + + Author: Sergey Berezin, Clark Barrett + + Created: Apr 30 2005 + + Copyright (C) 2004 by the Board of Trustees of Leland Stanford + Junior University and by New York University. + + License to use, copy, modify, sell and/or distribute this software + and its documentation for any purpose is hereby granted without + royalty, subject to the terms and conditions defined in the \ref + LICENSE file provided with this distribution. In particular: + + - The above copyright notice and this permission notice must appear + in all copies of the software and related documentation. + + - THE SOFTWARE IS PROVIDED "AS-IS", WITHOUT ANY WARRANTIES, + EXPRESSED OR IMPLIED. USE IT AT YOUR OWN RISK. + +ABC + Copyright (c) The Regents of the University of California. All rights reserved. + + Permission is hereby granted, without written agreement and without license or + royalty fees, to use, copy, modify, and distribute this software and its + documentation for any purpose, provided that the above copyright notice and + the following two paragraphs appear in all copies of this software. + + IN NO EVENT SHALL THE UNIVERSITY OF CALIFORNIA BE LIABLE TO ANY PARTY FOR + DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF + THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF THE UNIVERSITY OF + CALIFORNIA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING, + BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE. THE SOFTWARE PROVIDED HEREUNDER IS ON AN "AS IS" BASIS, + AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATION TO PROVIDE MAINTENANCE, + SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. + +Windows msc99hdr + Copyright (c) 2006-2008 Alexander Chemeris + Copyright (c) 2000 Jeroen Ruigrok van der Werven <asmodai@FreeBSD.org> + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + 3. The name of the author may be used to endorse or promote products + derived from this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED + WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO + EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; + OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +LLVM integration tester (llvm-lit) + University of Illinois/NCSA + Open Source License + + Copyright (c) 2003-2014 University of Illinois at Urbana-Champaign. + All rights reserved. + + Developed by: + + LLVM Team + + University of Illinois at Urbana-Champaign + + http://llvm.org + + Permission is hereby granted, free of charge, to any person obtaining a copy of + this software and associated documentation files (the "Software"), to deal with + the Software without restriction, including without limitation the rights to + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies + of the Software, and to permit persons to whom the Software is furnished to do + so, subject to the following conditions: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimers. + + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimers in the + documentation and/or other materials provided with the distribution. + + * Neither the names of the LLVM Team, University of Illinois at + Urbana-Champaign, nor the names of its contributors may be used to + endorse or promote products derived from this Software without specific + prior written permission. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + CONTRIBUTORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS WITH THE + SOFTWARE. + +OutputCheck + Copyright (c) 2014, Daniel Liew All rights reserved. + + Redistribution and use in source and binary forms, with or without modification, + are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation and/or + other materials provided with the distribution. + + 3. Neither the name of the copyright holder nor the names of its contributors + may be used to endorse or promote products derived from this software without + specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR + ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +GoogleTest framework + Copyright 2008, Google Inc. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + * Neither the name of Google Inc. nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/utils/testcomp-archive/make-archive.sh b/utils/testcomp-archive/make-archive.sh new file mode 100755 index 000000000..28be155e2 --- /dev/null +++ b/utils/testcomp-archive/make-archive.sh @@ -0,0 +1,208 @@ +#!/bin/bash +# Builds the Test-Comp tool archive: a self-contained Map2Check directory that +# runs on the competition machines (Ubuntu 24.04, clang 18, no LLVM 16, no KLEE, +# no AFL++), zipped as the competition expects (one top-level directory). +# The host provides only python3 and gcc-multilib, the linker and C runtime +# that AFL++'s native build needs (required_ubuntu_packages in FM-Tools). +# +# Run inside the development image, where the install and its dependencies +# live (Dockerfile.dev, or map2check-dev:aflpp): +# +# docker run --rm -v "$PWD:/workspace" -w /workspace map2check-dev:aflpp \ +# utils/testcomp-archive/make-archive.sh /workspace/install_v9b /workspace/map2check.zip +# +# What goes in, and why: +# - the install (map2check, its passes and runtime bitcode); +# - LLVM 16's clang, opt and llvm-link with clang's resource directory: the +# frontend compiles and links bitcode with them, and the image has clang 18; +# - KLEE 3.1 with its runtime (klee-uclibc included); +# - AFL++: afl-fuzz, afl-cc and its passes and runtime objects, which the +# wrapper points to with MAP2CHECK_AFL_CC, MAP2CHECK_AFL_FUZZ and AFL_PATH; +# - every shared library those need that is not glibc, with each ELF's +# RUNPATH rewritten to find them. Not LD_LIBRARY_PATH: it would leak into +# the system's bash, gcc and timeout, and a library from Ubuntu 22.04 +# loaded under them could break them. +# Optional engines (Clam for --add-invariants, sbt-slicer for --slice) stay out: +# both are off by default and absent from the competition configuration. +set -euo pipefail + +# Absolute paths: the zip runs from inside the staging directory, where a +# relative output name would create the archive only to have the cleanup +# delete it -- after `rm -f "$OUT"` removed the caller's previous one (review +# of #73). +INSTALL=$(realpath -m "${1:?install directory}") +OUT=$(realpath -m "${2:?output zip}") +[ -d "$(dirname "$OUT")" ] || { echo "no such directory: $(dirname "$OUT")" >&2; exit 2; } +AFL_ROOT=${AFL_ROOT:-/usr/local} +LLVM=${LLVM:-/usr/lib/llvm-16} +KLEE=${KLEE:-/opt/klee} +HERE=$(cd "$(dirname "$0")" && pwd) + +command -v patchelf > /dev/null || { apt-get update -qq && apt-get install -y -qq patchelf > /dev/null; } +command -v zip > /dev/null || { apt-get update -qq && apt-get install -y -qq zip > /dev/null; } + +STAGE=$(mktemp -d) +T=$STAGE/map2check +mkdir -p "$T"/{bin,lib,include,lib/afl} + +# --- Map2Check ------------------------------------------------------------- +cp -a "$INSTALL/map2check" "$T/" +cp -aL "$INSTALL/lib/." "$T/lib/" 2>/dev/null || true +rm -rf "$T/lib/clang" "$T/lib/klee" "$T/lib/libz3*" +cp "$HERE/../map2check-wrapper.py" "$T/" +chmod +x "$T/map2check-wrapper.py" + +# --- LLVM 16 --------------------------------------------------------------- +for tool in clang opt llvm-link; do cp -L "$LLVM/bin/$tool" "$T/bin/"; done +mkdir -p "$T/lib/clang" +cp -aL "$LLVM/lib/clang/16" "$T/lib/clang/" +cp -aL "$LLVM/lib/clang/16/include/." "$T/include/" + +# --- KLEE ------------------------------------------------------------------ +cp -L "$KLEE/bin/klee" "$KLEE/bin/kleaver" "$T/bin/" +cp -L "$KLEE/bin/ktest-tool" "$T/bin/" 2>/dev/null || true +mkdir -p "$T/lib/klee" +cp -aL "$KLEE/lib/klee/runtime" "$T/lib/klee/" + +# --- AFL++ ----------------------------------------------------------------- +cp -L "$AFL_ROOT/bin/afl-fuzz" "$AFL_ROOT/bin/afl-cc" "$T/bin/" +# Copies, not symlinks: an archive without links unpacks the same with any zip +# tool. afl-cc picks its mode from argv[0], so a copy behaves as the link would. +cp "$T/bin/afl-cc" "$T/bin/afl-clang-fast" +cp -aL "$AFL_ROOT/lib/afl/." "$T/lib/afl/" + +# --- shared libraries ------------------------------------------------------ +# Everything ldd resolves outside glibc (and the loader), for every ELF here. +is_glibc() { + case "$(basename "$1")" in + libc.so*|libm.so*|libdl.so*|libpthread.so*|librt.so*|ld-linux*|libresolv.so*|libutil.so*) return 0 ;; + esac + return 1 +} +elves=$(find "$T" -type f \( -perm -u+x -o -name '*.so*' \) -exec sh -c 'head -c4 "$1" | grep -q "ELF"' _ {} \; -print) +for elf in $elves; do + { ldd "$elf" 2>/dev/null || true; } | awk '/=> \//{print $3}' | while read -r lib; do + is_glibc "$lib" && continue + [ -e "$T/lib/$(basename "$lib")" ] || cp -L "$lib" "$T/lib/" + done +done +# Libraries bring their own dependencies: one more round over lib/. +for lib in "$T"/lib/*.so*; do + { ldd "$lib" 2>/dev/null || true; } | awk '/=> \//{print $3}' | while read -r dep; do + is_glibc "$dep" && continue + [ -e "$T/lib/$(basename "$dep")" ] || cp -L "$dep" "$T/lib/" + done +done + +# --- RUNPATH --------------------------------------------------------------- +for elf in $(find "$T" -type f -exec sh -c 'head -c4 "$1" | grep -q "ELF"' _ {} \; -print); do + dir=$(dirname "$elf") + rel=$(realpath --relative-to="$dir" "$T/lib") + # Relocatable objects (afl-compiler-rt.o) and static archives have no RUNPATH. + if patchelf --print-rpath "$elf" > /dev/null 2>&1; then + patchelf --set-rpath "\$ORIGIN/$rel" "$elf" + fi +done + +# --- smoke test, README, licenses ------------------------------------------ +# What the FM-Tools CI and the Test-Comp rules ask of the archive: a +# smoketest.sh that runs the tool on examples shipped with it, a README, and a +# LICENSE that allows anybody to reproduce the evaluation -- here Map2Check's +# own plus one for every third-party component it carries. +cp "$HERE/smoketest.sh" "$T/" && chmod +x "$T/smoketest.sh" +cp -r "$HERE/examples" "$T/" +cp "$HERE/README.txt" "$T/README" +cp "$HERE/../../LICENSE" "$T/LICENSE" +mkdir -p "$T/licenses" +cp "$HERE"/licenses/* "$T/licenses/" +cp /opt/klee-uclibc/COPYING.LIB "$T/licenses/klee-uclibc.COPYING.LIB" +# The Debian copyright file of every bundled library and LLVM tool that came +# from an Ubuntu package (the ones built from source are in licenses/ above), +# and of clang's resource headers (lib/clang/16, include/). dpkg records some +# libraries under /lib, the merged-/usr path under /usr/lib. +declare -A DEB_PKG # file in the archive -> its Debian package +debian_package() { # <absolute path on this system> + local real; real=$(readlink -f "$1") + { dpkg -S "$real" 2>/dev/null || dpkg -S "${real/#\/usr\/lib/\/lib}" 2>/dev/null; } | cut -d: -f1 | head -1 +} +for f in "$T"/lib/*.so* "$T"/bin/clang "$T"/bin/opt "$T"/bin/llvm-link; do + name=$(basename "$f") + for dir in /usr/lib/x86_64-linux-gnu /lib/x86_64-linux-gnu "$LLVM/lib" "$LLVM/bin"; do + [ -f "$dir/$name" ] || continue + pkg=$(debian_package "$dir/$name") + if [ -n "$pkg" ] && [ -f "/usr/share/doc/$pkg/copyright" ]; then + cp "/usr/share/doc/$pkg/copyright" "$T/licenses/$pkg.copyright" + DEB_PKG[${f#"$T"/}]=$pkg + fi + break + done +done +headers_pkg=$(debian_package "$LLVM/lib/clang/16/include/stddef.h") +cp "/usr/share/doc/$headers_pkg/copyright" "$T/licenses/$headers_pkg.copyright" +# Debian copyright files name their licenses and point to the full text in +# /usr/share/common-licenses; the texts travel with them. +mkdir -p "$T/licenses/common-licenses" +for name in $(grep -oh "/usr/share/common-licenses/[A-Za-z0-9.+_-]*" "$T"/licenses/*.copyright \ + | sed 's#.*/##; s/[.,]*$//' | sort -u); do + if [ -f "/usr/share/common-licenses/$name" ]; then + cp "/usr/share/common-licenses/$name" "$T/licenses/common-licenses/" + else + echo "a Debian copyright file names /usr/share/common-licenses/$name, which is missing" >&2 + exit 1 + fi +done + +# --- license coverage ------------------------------------------------------ +# Every file in the archive belongs to a component, and every component's +# license texts are in it: the archive is not built otherwise. The table is +# licenses/README.md; this is its executable form. +need() { for l in "$@"; do [ -f "$T/$l" ] || { echo "missing license $l" >&2; return 1; }; done; } +uncovered=() +while IFS= read -r -d '' file; do + rel=${file#"$T"/} + case "$rel" in + licenses/*) continue ;; + LICENSE|README|smoketest.sh|map2check|map2check-wrapper.py|examples/*|lib/*Pass.so|lib/libMap2CheckLibrary.so|lib/*.bc) + need LICENSE ;; + bin/klee|bin/kleaver|bin/ktest-tool) + need licenses/KLEE-3.1.LICENSE.TXT ;; + lib/klee/runtime/klee-uclibc.bca) + need licenses/klee-uclibc.COPYING.LIB ;; + lib/klee/runtime/*) + need licenses/KLEE-3.1.LICENSE.TXT licenses/KLEE-3.1-runtime-NOTICES.txt licenses/LLVM-16.LICENSE.TXT ;; + bin/afl-*|lib/afl/*) + need licenses/AFLplusplus-4.40c.LICENSE licenses/AFLplusplus-4.40c-THIRD-PARTY.txt licenses/LLVM-16.LICENSE.TXT ;; + lib/libstp.so*) + need licenses/STP-2.3.4.LICENSE licenses/STP-2.3.4.LICENSE_COMPONENTS licenses/Artistic-1.0-Perl.txt licenses/LGPL-2.0.txt ;; + lib/libminisat.so*) + need licenses/MiniSat.LICENSE ;; + lib/clang/*|include/*) + need "licenses/$headers_pkg.copyright" licenses/LLVM-16.LICENSE.TXT ;; + *) + if [ -n "${DEB_PKG[$rel]:-}" ]; then + need "licenses/${DEB_PKG[$rel]}.copyright" + case "${DEB_PKG[$rel]}" in clang-*|llvm-*|libllvm*|libclang*) need licenses/LLVM-16.LICENSE.TXT ;; esac + else + uncovered+=("$rel") + fi ;; + esac || exit 1 +done < <(find "$T" -type f -print0) +if [ "${#uncovered[@]}" -gt 0 ]; then + echo "files with no license component (add a rule above and to licenses/README.md):" >&2 + printf ' %s\n' "${uncovered[@]}" >&2 + exit 1 +fi +echo "license coverage: $(find "$T" -type f ! -path "$T/licenses/*" | wc -l) files, each with its license" + +# --- check and zip --------------------------------------------------------- +missing=$(for elf in "$T"/map2check "$T"/bin/* "$T"/lib/*.so* "$T"/lib/afl/*.so; do + [ -f "$elf" ] || continue + { ldd "$elf" 2>/dev/null || true; } | grep "not found" | sed "s#^#$(basename "$elf"): #" || true +done | sort -u) +if [ -n "$missing" ]; then echo "unresolved libraries:"; echo "$missing"; exit 1; fi + +rm -f "$OUT" +if [ -n "$(find "$T" -type l)" ]; then echo "symlinks left in the archive:"; find "$T" -type l; exit 1; fi +(cd "$STAGE" && zip -qr "$OUT" map2check) +echo "archive: $OUT ($(du -h "$OUT" | cut -f1), $(find "$T" -type f | wc -l) files)" +rm -rf "$STAGE" diff --git a/utils/testcomp-archive/smoketest.sh b/utils/testcomp-archive/smoketest.sh new file mode 100755 index 000000000..aa1e123ec --- /dev/null +++ b/utils/testcomp-archive/smoketest.sh @@ -0,0 +1,81 @@ +#!/bin/sh +# Smoke test of the Test-Comp archive (required by the FM-Tools CI): runs +# Map2Check on the two examples in examples/, one per Test-Comp property, and +# checks that each run writes a test suite in the exchange format and that the +# engines ran: AFL++ in both, KLEE in Cover-Branches. Exits 0 only if all do. +# +# The engine checks matter because a missing host package does not stop the +# tool: without a native linker and C runtime (gcc-multilib) the AFL++ binary +# fails to build, Map2Check gives the whole budget to KLEE, and a suite is +# still written. +set -eu + +HERE=$(cd "$(dirname "$0")" && pwd) +TOOL="$HERE/map2check-wrapper.py" + +"$TOOL" --version + +run() { # <program> <property> <budget> + work=$(mktemp -d) + # The wrapper exits 0 whenever Map2Check ran (a verdict, no verdict, or the + # budget spent): any other status is a failure, even with a suite on disk. + status=0 + (cd "$work" && "$TOOL" -p "$HERE/examples/$2" --data-model LP64 --budget "$3" \ + "$HERE/examples/$1") > "$work/run.log" 2>&1 || status=$? + if [ "$status" -ne 0 ]; then + echo "FAIL $1: the wrapper exited with status $status" >&2 + cat "$work/run.log" >&2 + rm -rf "$work" + exit 1 + fi + if [ ! -f "$work/test-suite/metadata.xml" ]; then + echo "FAIL $1: no test-suite/metadata.xml" >&2 + cat "$work/run.log" >&2 + rm -rf "$work" + exit 1 + fi + echo "$work" +} + +fail() { # <work> <message> + echo "FAIL $2" >&2 + cat "$1/run.log" >&2 + rm -rf "$1" + exit 1 +} + +# The run log must show that <engine> ran. Not the "Executing ..." banners: +# map2check prints those before launching the engine, so they appear when it +# fails to start too, and the other engine can still produce the suite (review +# of #86). These lines are printed after the run, from what the engine itself +# wrote: afl-fuzz's execution count in fuzzer_stats, KLEE's .ktest files. +ran() { # <work> <program> <engine> + case "$3" in + AFL++) line="AFL++ ran: [1-9][0-9]* executions" ;; + KLEE) line="KLEE ran: [1-9][0-9]* tests generated" ;; + esac + grep -q "$line" "$1/run.log" || fail "$1" "$2: $3 did not run" +} + +# Cover-Error: the suite must hold a test case with the input that reaches +# reach_error (x == 42). AFL++ finds it in its first window, so KLEE is not +# required here. +work=$(run cover_error.c coverage-error-call.prp 60) +ran "$work" cover_error.c AFL++ +grep -q "<input>42</input>" "$work"/test-suite/testcase-*.xml 2>/dev/null || + fail "$work" "cover_error.c: no test case with the input 42" +echo "ok cover_error.c" +rm -rf "$work" + +# Cover-Branches: both engines take a turn, and the suite must hold at least +# one test case. A smaller budget leaves no window for KLEE after AFL++'s; +# the run still ends in seconds, once KLEE has explored the four paths. +work=$(run cover_branches.c coverage-branches.prp 60) +ran "$work" cover_branches.c AFL++ +ran "$work" cover_branches.c KLEE +ls "$work"/test-suite/testcase-*.xml > /dev/null 2>&1 || + fail "$work" "cover_branches.c: no test case" +echo "ok cover_branches.c" +rm -rf "$work" + +echo "smoke test passed"