Skip to content

Snapshot-harness may initialise variables in the wrong order #4978

@smowton

Description

@smowton

When snapshot-harness tries to set up aliasing pointers, it may use the name of one of the aliases to set up the other. For example, when working correctly it might generate:

int memory[10];
x = memory;
y = &x[1];

But when generating those same assignments it might emit them in the wrong order, as it appears to expect that their RHS values are independent, leading to:

int memory[10];
y = &x[1];
x = memory;

Since x is a global variable this leads to y being (int*)4 rather than pointing into the same array as x as intended.

Real-world example from regression test snapshot-harness/dynamic-array-int:
Good:

generated_entry_function /* generated_entry_function */
        // 177 no location
        tmp = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
        // 178 no location
        array = tmp;
        // 179 no location
        iterator1 = tmp;
        // 180 no location
        iterator2 = &array[1ul];
        // 181 no location
        iterator3 = &array[1ul];
        // 182 no location
        func_init_done = FALSE;
        // 183 no location
        main();
        // 184 no location
        END_FUNCTION

Bad (note array is read at line 45 before it is set at line 47)

generated_entry_function /* generated_entry_function */
        // 44 no location
        tmp = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
        // 45 no location
        iterator2 = &array[1ul];
        // 46 no location
        iterator1 = tmp;
        // 47 no location
        array = tmp;
        // 48 no location
        iterator3 = &array[1ul];
        // 49 no location
        func_init_done = FALSE;
        // 50 no location
        main();
        // 51 no location
        END_FUNCTION

Whether or not snapshot-harness malfunctions on any given occasion depends on the order it chooses to emit the assignments, which depends on compiler version, standard library version, phase of moon, etc.

GOTO binaries showing the problem: examples.zip

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions