Skip to content

Conversation

@tautschnig
Copy link
Collaborator

Change --replace-call-with-contract to produce a hard error instead of a warning when used with functions lacking explicit contracts. This change addresses a soundness issue where CBMC would previously assume a trivial contract automatically.

Users that really need a trivial contract with no constraints should use

int my_function(int x)
  __CPROVER_requires(1)
  __CPROVER_ensures(1)
{
  return x + 1;
}

Fixes: #8728

  • Each commit message has a non-empty body, explaining why the change was made.
  • n/a Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
  • The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
  • Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
  • n/a My commit message includes data points confirming performance improvements (if claimed).
  • My PR is restricted to a single feature or bugfix.
  • n/a White-space or formatting changes outside the feature-related changed lines are in commits of their own.

@tautschnig tautschnig force-pushed the replace-call-with-contract-error branch 3 times, most recently from fa3ad0a to ed4f99b Compare December 1, 2025 17:21
Change --replace-call-with-contract to produce a hard error instead of a
warning when used with functions lacking explicit contracts.  This
change addresses a soundness issue where CBMC would previously assume a
trivial contract automatically.

Users that really need a trivial contract with no constraints should use

````c
int my_function(int x)
  __CPROVER_requires(1)
  __CPROVER_ensures(1)
{
  return x + 1;
}
````

Fixes: diffblue#8728
@tautschnig tautschnig force-pushed the replace-call-with-contract-error branch from ed4f99b to 2a32be7 Compare December 1, 2025 17:28
@codecov
Copy link

codecov bot commented Dec 1, 2025

Codecov Report

❌ Patch coverage is 57.14286% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.94%. Comparing base (0985044) to head (2a32be7).

Files with missing lines Patch % Lines
...contracts/dynamic-frames/dfcc_contract_handler.cpp 0.00% 6 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #8739      +/-   ##
===========================================
- Coverage    79.94%   79.94%   -0.01%     
===========================================
  Files         1699     1699              
  Lines       187790   187786       -4     
  Branches        73       73              
===========================================
- Hits        150133   150122      -11     
- Misses       37657    37664       +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Use of --replace-call-with-contract with function that does not have a contract should be errored

3 participants