VSD - pointers to heap allocations #6218
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jezhiggins
force-pushed
the
vsd-pointers-to-heap-allocations
branch
2 times, most recently
from
5c95d44 to
0fbd46a
Compare
Codecov Report
@@ Coverage Diff @@
## develop #6218 +/- ##
========================================
Coverage 76.18% 76.19%
========================================
Files 1484 1484
Lines 162092 162155 +63
========================================
+ Hits 123495 123558 +63
Misses 38597 38597
Continue to review full report at Codecov.
|
jezhiggins
force-pushed
the
vsd-pointers-to-heap-allocations
branch
from
4176f59 to
0d7d37f
Compare
martin-cs
approved these changes
Jul 9, 2021
| const abstract_environmentt &environment, | ||
| const namespacet &ns) const | ||
| { | ||
| INVARIANT(is_void_pointer(type()), "Only allow pointer casting from void*"); |
Collaborator
There was a problem hiding this comment.
I feel kind of conflicted about this. In some ways it should not be an INVARIANT because it can be triggered by a user but also, at the moment we really aren't handling this case. Could we return a TOP pointer of the correct type? Reads from that should give TOP and writes to it could call havoc()?
Contributor
Author
There was a problem hiding this comment.
I am similarly conflicted. Right now, the call to typecast() is itself guarded so that it will never be called if this invariant will fire
if(expr.id() == ID_typecast)
{
const typecast_exprt &tce = to_typecast_expr(expr);
if(tce.op().id() == ID_symbol && is_void_pointer(tce.op().type()))
Consequently existing typecasts, of which there are a handful, will evaluate as they do at the moment. I suppose this invariant is more of warning for future care than a guard against wacky corner cases.
| const abstract_environmentt &environment, | ||
| const namespacet &ns) const | ||
| { | ||
| INVARIANT(is_void_pointer(type()), "Only allow pointer casting from void*"); |
src/analyses/variable-sensitivity/constant_pointer_abstract_object.cpp
Outdated
Show resolved
Hide resolved
jezhiggins
requested review from
chrisr-diffblue and
peterschrammel
as code owners
Create a special 'heap allocation' placeholder expression. Extend write_stack to be able to store that expression.
That's the expr.type() rather than the representation class.
We can't ensure the modified pointer object will be properly assigned back to its symbol if we wait until first write. If we defer then modified pointer may, or may not, be assigned depending on how the write is expressed *p = 1; // good :) p[0] = 1; // bad :(
I based my code in the previous commit on this code, but then found it caused a type error. This leads me to believe that while this current code path may not be called in normal usage, it is in fact a latent bug. I believe this change is correct.
This feels like the right place for this, and also gives future options for configuration/customisation.
jezhiggins
force-pushed
the
vsd-pointers-to-heap-allocations
branch
from
6651b77 to
1a6a422
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Extends the variable sensitivity domain to be able to track heap allocated memory.
Within the goto-programs the heap allocation instruction is
ALLOCATE(malloc_size, 0 != 0). Within the vsd, this is an expression of typeID_side_effectwith a statement ofID_allocate. When we eval this expression, we create a pointer object with a 'heap-object' placeholder expression. There's a little song and dance to propagate through the pointer type casts returns from malloc are subject to, but we can return 'heap-object' pointer back out.When we assign pointer to a heap allocation to its symbol, we now know that actual (C) type of the object. We replace the 'heap object' placeholder with an array abstract object. The pointer abstract object can now act exactly as normal.