-
Notifications
You must be signed in to change notification settings - Fork 277
Ensure locations are updated after inlining #6076
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Note that regressions tests are NOT included (yet) as this is urgent/blocking for AWS. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This needs a regression test adding before we merge it.
Yes, I also favour regression tests being in place before any merge. As it stands, this looks like a random code change, with no way for me (as a reviewer) to verify that this fixes anything. |
Codecov Report
@@ Coverage Diff @@
## develop #6076 +/- ##
===========================================
+ Coverage 74.30% 75.42% +1.12%
===========================================
Files 1444 1447 +3
Lines 157453 158094 +641
===========================================
+ Hits 116995 119249 +2254
+ Misses 40458 38845 -1613
Continue to review full report at Codecov.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I really wouldn't be surprised if this line is the correct fix, failing to update location numbers after modifying goto-programs is a classic bug that many of us have made. Particularly when duplicating code.
However I am less convinced that this is currently in the right place. It seems that it is before the inlining changes things. If this is the right place, please explain why in the commit message.
I worked with TGWDB to help find the cause of the issue. There were definitely location numbers which were left uninitialised / zero valued before the inlining. I'd need to check to confirm whether or not additional bad locations were introduced during the inling process as well. |
I've been looking this morning (not updating each little bit). The problem with the locations in the example is occurring inside the Note that this strongly implies the error is inside the |
Further update. During the unifying of the parsing options and goto code paths between To summarise:
With the above in mind, I recommend doing at least:
in TODO: also a small regression test. |
On Wed, 2021-05-05 at 02:28 -0700, thomasspriggs wrote:
I worked with TGWDB to help find the cause of the issue. There were
definitely location numbers which were left uninitialised / zero
valued before the inlining. I'd need to check to confirm whether or
not additional bad locations were introduced during the inling
process as well.
Thank you; this is absolutely the correct thing to do. There should be
no uninitialised locations at the end of any instrumentation pass so we
need to track down where they are added. `goto_programt::update()`
should be called after modifications to a `goto-programt`.
https://github.com/diffblue/cbmc/blob/c3729fb105cc0b53c6d8ed0f5fa728b1f5109cc5/src/goto-programs/goto_program.cpp#L540
Sorry to be such a pain about this but it's the kind of thing that is
easy to 'paper over' but doing so causes long-term confusion and
inconsistency.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry to keep on about this but fixing this at the root cause is important.
// inlining can fail if locations are not in correct order. | ||
// This refreshes the locations before inlining so any failures | ||
// later are correctly attributed to errors in the inlining. | ||
goto_model.goto_functions.compute_location_numbers(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this needs to be in instrument_preconditions
because "update
was called after modification" should be an invariant of goto_programt
's and things that work on them.
In an ideal world we could add this to the validate
checks and call them as post-condition of all of these transforms.
This is an update that goes with a commit that may come before or after this message. The commit moves the updating of the The main point for this message is to discuss the regression test (or lack of) and how to finish this PR. I've been refining the example that caused this originally but have not narrowed this down to anything suitable small and reasonably to turn into a regression test. Below are the (apparent) requirements to cause the invariant violation.
Unfortunately the example relies on openssl includes, and there is a LOT of complexity in sorting out the details of what is necessary and what isn't. So far shrinking the example has gone down to two files, one is 3 lines, the other is about 85 lines, but still includes openssl. At this point there are five (all undesirable) options, which I'd like to have feedback on. (Presented in no particular order.)
Feedback welcome! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am still not 100% convinced this is the right patch but I think it is close to fixing /a/ problem. I would not block this patch.
@@ -135,10 +135,15 @@ void instrument_preconditions(goto_modelt &goto_model) | |||
instrument_preconditions( | |||
goto_model, | |||
f_it.second.body); | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What happens if you move the addition and call to update
to here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like this is still missing a regression test. Message me and we can work together on reducing the example down, if it is still causing problems.
src/goto-programs/goto_inline.cpp
Outdated
@@ -203,7 +203,6 @@ void goto_partial_inline( | |||
} | |||
} | |||
} | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
⛏️ This empty line removal looks unrelated to the changes this commit is supposed to be making. Presumably this is due to adding and removing different changes in this PR, but this formatting change should be cleaned up. Same applied to the line marked with a 💨
@@ -135,10 +135,15 @@ void instrument_preconditions(goto_modelt &goto_model) | |||
instrument_preconditions( | |||
goto_model, | |||
f_it.second.body); | |||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💨 See previous comment.
@TGWDB thank you so much for chasing this one. I think the changes you have made are already a lot better but I am not quite sure we are at the end of the journey yet. Thoughts on the options.
How does the following sound for a (falsifiable) conjecture...?
If this lot is correct or correct enough then I think that gives you a route to a regression test and to option 4. |
Also @TGWDB have you come across https://github.com/csmith-project/creduce ? |
@thomasspriggs The example is very hard to be reduced further - I checked it out with Thomas G. yesterday. The reason for that is that the problematic behaviour is manifesting on a reduced file that includes an |
@martin-cs This is a great idea, I didn't think of |
Quick response to update, I'll add more later today/tomorrow.
snip
This is true and tested before.
This is also true and tested before.
I'll look into this further (it's part of what I was doing when I wrote above).
I strongly suspect we can do it without openssl, eventually.
Agree, it's the path I'm on. |
I tried |
…entation This commit ensures the goto_model.goto_functions are updated during the instrument_preconditions function. This is due to some of these leaving locations uninitialized and this causing later problems with partial inlining (that can only occur in goto-analyzer). Fixes issue diffblue#6065
d6e5e94
to
570de31
Compare
This changes the chain.sh (and adds a READFME.md to explain) so that a test can be written that uses its own script to build the goto binary.
03ad7d9
to
45dac8f
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍
@martin-cs Can you please re-review this? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for chasing this down and sorry it has turned out to be more of an ordeal than it first looked.
Comments are mostly thoughts / suggestions but one last question -- what triggers the instrument_preconditions
if there are no preconditions in the source code?
}; | ||
struct s2n_evp_digest | ||
{ | ||
struct evp_md_ctx_st *ctx; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It feels like this might be simplified a bit more, can this be replaced with the const void *
field directly?
Equally well; if you are done with reducing this, that is also fine.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
test.c | ||
--verify | ||
Checking assertions | ||
^EXIT=0$ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you check for at least one of the assertions?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tested for the first verification result.
-- | ||
Invariant check failed | ||
-- | ||
This test checks that after building the goto binary (see test.sh) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Brilliant!
// for later passes. | ||
// Note that only the first loop is the one known to leave locations | ||
// uninitialized. | ||
goto_model.goto_functions.update(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍
This adds a regression test that checks to ensure that goto-analyser reaches the "Checking assertions" phase of it's execution and also one of the checks was SUCCESFUL. This also fails on any invariant violation.
Line 52 of |
Apologies; I wasn't clear. My confusion was that
|
@peterschrammel @tautschnig Any chance of a codeowner review for this? |
@@ -0,0 +1,44 @@ | |||
struct evp_md_ctx_st |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
❓ What's the license of this file?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For s2n_hash_inlined.c
lines 1-4 are adapted from openssl which has an Apache like licence and lines 5-44 are modified from the AWS s2n library that is also under Apache 2.0 licence. All of simple.c
is modified from the AWS s2n library.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add a header and comments to explain this so that we know where this is coming from.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
To answer my own question : it might well be |
This adds information on the origin of the regression test.
I still felt like I didn't understand why this bug was occurring so I started having a dig.
Doing this removes the need for the This reduces the possible cause of the issue but I am still pretty hazy on the exact sequence of events that cause it. I /speculate/ that there is something to do with a pointer to |
Thanks for digging deeper into this. I merged since the invariant violation was a blocking issue for AWS. I'm not sure if the "inlining" is a distraction here since the problems appear before the |
Inlining the precondition. I think there is another bug which is a difference in how the preprocessing is done and possibly when / how the C library is linked. |
This commit ensures the locations in the goto program are
updated during the partial inlining process. This is due to
some paths (in goto-analyzer) checking for this part way through
various goto program transformations.
Fixes issue #6065