{ "generatedAt": "2026-10-19T02:52:39.297Z", "svfCommit": "ea287cf0040bb82f46b33572b121df39ac104094", "semantics": "32-bit inputs; bit-vector arithmetic; signed and unsigned comparisons; acyclic SSA without phi or memory", "examples": [ { "edges": [ { "formula": "true", "from": 1, "id": 0, "label": "", "smt": "true", "to": 3 }, { "formula": "true", "from": 3, "id": 1, "label": "", "smt": "true", "to": 4 }, { "formula": "true", "from": 4, "id": 2, "label": "", "smt": "true", "to": 5 }, { "formula": "true", "from": 5, "id": 3, "label": "", "smt": "true", "to": 6 }, { "formula": "input_0 > 0", "from": 6, "id": 4, "label": "true", "smt": "(not (bvsle input_0 #x00000000))", "to": 7 }, { "formula": "not (input_0 > 0)", "from": 6, "id": 5, "label": "false", "smt": "(bvsle input_0 #x00000000)", "to": 8 }, { "formula": "true", "from": 7, "id": 6, "label": "", "smt": "true", "to": 9 }, { "formula": "true", "from": 8, "id": 7, "label": "", "smt": "true", "to": 2 }, { "formula": "input_0 <= 0", "from": 9, "id": 8, "label": "true", "smt": "(bvsle input_0 #x00000000)", "to": 10 }, { "formula": "not (input_0 <= 0)", "from": 9, "id": 9, "label": "false", "smt": "(not (bvsle input_0 #x00000000))", "to": 12 }, { "formula": "true", "from": 10, "id": 10, "label": "", "smt": "true", "to": 11 }, { "formula": "true", "from": 11, "id": 11, "label": "", "smt": "true", "to": 13 }, { "formula": "true", "from": 12, "id": 12, "label": "", "smt": "true", "to": 8 }, { "formula": "true", "from": 13, "id": 13, "label": "", "smt": "true", "to": 12 } ], "engine": "SVF 3.4 + LLVM 21 + Z3; immutable-input predicate abstraction", "entry": 1, "inputs": [ { "name": "input_0", "node": 3 } ], "nodes": [ { "id": 1, "kind": "entry", "line": 0, "raw": "FunEntryICFGNode1 {fun: main{ \"ln\": 4, \"file\": \"examples/contradiction.c\" }}", "statements": [] }, { "id": 2, "kind": "exit", "line": 0, "raw": "FunExitICFGNode2 {fun: main{ \"ln\": 11, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }}\nPhiStmt: [Var6 <-- ([Var11, ICFGNode8],)]\t\nValVar ID: 20\n ret i32 0, !dbg !27 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }", "statements": [ "PhiStmt: [Var6 <-- ([Var11, ICFGNode8],)]\t\nValVar ID: 20\n ret i32 0, !dbg !27 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }" ] }, { "id": 3, "kind": "input", "line": 5, "raw": "CallICFGNode3 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 CallICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }", "statements": [] }, { "id": 4, "kind": "instruction", "line": 5, "raw": "RetICFGNode4 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 RetICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }", "statements": [] }, { "id": 5, "kind": "instruction", "line": 6, "raw": "IntraICFGNode5 {fun: main{ \"ln\": 6, \"cl\": 11, \"fl\": \"examples/contradiction.c\" }}\nCmpStmt: [Var10 <-- (Var7 predicate38 Var11)]\t\nValVar ID: 10\n %cmp = icmp sgt i32 %call, 0, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/contradiction.c\" }", "statements": [ "CmpStmt: [Var10 <-- (Var7 predicate38 Var11)]\t\nValVar ID: 10\n %cmp = icmp sgt i32 %call, 0, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/contradiction.c\" }" ] }, { "id": 6, "kind": "instruction", "line": 6, "raw": "IntraICFGNode6 {fun: main{ \"ln\": 6, \"cl\": 11, \"fl\": \"examples/contradiction.c\" }}\nBranchStmt: [Condition Var10]\nSuccessor 0 ICFGNode7 Successor 1 ICFGNode8 \nValVar ID: 12\n br i1 %cmp, label %if.then, label %if.end3, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/contradiction.c\" }", "statements": [ "BranchStmt: [Condition Var10]\nSuccessor 0 ICFGNode7 Successor 1 ICFGNode8 \nValVar ID: 12\n br i1 %cmp, label %if.then, label %if.end3, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/contradiction.c\" }" ] }, { "id": 7, "kind": "instruction", "line": 7, "raw": "IntraICFGNode7 {fun: main{ \"ln\": 7, \"cl\": 15, \"fl\": \"examples/contradiction.c\" }}\nCmpStmt: [Var13 <-- (Var7 predicate41 Var11)]\t\nValVar ID: 13\n %cmp1 = icmp sle i32 %call, 0, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/contradiction.c\" }", "statements": [ "CmpStmt: [Var13 <-- (Var7 predicate41 Var11)]\t\nValVar ID: 13\n %cmp1 = icmp sle i32 %call, 0, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/contradiction.c\" }" ] }, { "id": 8, "kind": "instruction", "line": 11, "raw": "IntraICFGNode8 {fun: main{ \"ln\": 11, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }}\n ret i32 0, !dbg !27 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }", "statements": [] }, { "id": 9, "kind": "instruction", "line": 7, "raw": "IntraICFGNode9 {fun: main{ \"ln\": 7, \"cl\": 15, \"fl\": \"examples/contradiction.c\" }}\nBranchStmt: [Condition Var13]\nSuccessor 0 ICFGNode10 Successor 1 ICFGNode12 \nValVar ID: 14\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/contradiction.c\" }", "statements": [ "BranchStmt: [Condition Var13]\nSuccessor 0 ICFGNode10 Successor 1 ICFGNode12 \nValVar ID: 14\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/contradiction.c\" }" ] }, { "id": 10, "kind": "error", "line": 8, "raw": "CallICFGNode10 {fun: main{ \"ln\": 8, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }}\n call void @ERROR(), !dbg !23 CallICFGNode: { \"ln\": 8, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }", "statements": [] }, { "id": 11, "kind": "instruction", "line": 8, "raw": "RetICFGNode11 {fun: main{ \"ln\": 8, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }}\n call void @ERROR(), !dbg !23 RetICFGNode: { \"ln\": 8, \"cl\": 13, \"fl\": \"examples/contradiction.c\" }", "statements": [] }, { "id": 12, "kind": "instruction", "line": 10, "raw": "IntraICFGNode12 {fun: main{ \"ln\": 10, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode8 \nValVar ID: 19\n br label %if.end3, !dbg !26 { \"ln\": 10, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode8 \nValVar ID: 19\n br label %if.end3, !dbg !26 { \"ln\": 10, \"cl\": 5, \"fl\": \"examples/contradiction.c\" }" ] }, { "id": 13, "kind": "instruction", "line": 9, "raw": "IntraICFGNode13 {fun: main{ \"ln\": 9, \"cl\": 9, \"fl\": \"examples/contradiction.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode12 \nValVar ID: 18\n br label %if.end, !dbg !25 { \"ln\": 9, \"cl\": 9, \"fl\": \"examples/contradiction.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode12 \nValVar ID: 18\n br label %if.end, !dbg !25 { \"ln\": 9, \"cl\": 9, \"fl\": \"examples/contradiction.c\" }" ] } ], "reason": "Complete abstract exploration found no reachable ERROR in the supported bit-vector model", "rounds": [ { "blocked": [], "constraints": [ { "edge": 4, "formula": "input_0 > 0", "smt": "(not (bvsle input_0 #x00000000))" }, { "edge": 8, "formula": "input_0 <= 0", "smt": "(bvsle input_0 #x00000000)" } ], "core": [ "edge_4", "edge_8" ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 3, "valuation": 0 }, { "node": 4, "valuation": 0 }, { "node": 5, "valuation": 0 }, { "node": 6, "valuation": 0 }, { "node": 7, "valuation": 0 }, { "node": 8, "valuation": 0 }, { "node": 9, "valuation": 0 }, { "node": 2, "valuation": 0 }, { "node": 10, "valuation": 0 }, { "node": 12, "valuation": 0 } ], "index": 0, "initialStates": [ { "node": 1, "valuation": 0 } ], "learned": "input_0 > 0", "learnedPredicates": [ "input_0 > 0" ], "modelComplete": true, "outcome": "unsat", "path": [ 0, 1, 2, 3, 4, 6, 8 ], "pathEliminated": true, "pathValuation": 0, "predicates": [], "refinement": { "added": [ { "edge": 4, "formula": "input_0 > 0", "smt": "(not (bvsle input_0 #x00000000))" } ], "core": [ { "edge": 4, "formula": "input_0 > 0" }, { "edge": 8, "formula": "input_0 <= 0" } ], "coreMinimal": true, "coverage": [ { "blockedEdge": 4, "infeasible": false, "valuation": 0 }, { "blockedEdge": 8, "infeasible": false, "valuation": 1 } ], "ignored": [], "method": "smt-unsat-core", "obligations": [ { "expected": "unsat", "purpose": "The selected core is inconsistent", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(and (and true (not $x11)) $x11)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 > 0 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(and true $x11)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 <= 0 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(let (($x14 (not $x11)))\n(and true $x14))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Predicate input_0 <= 0 is the complement of input_0 > 0", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(let (($x14 (not $x11)))\n(= $x11 $x14))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 0 blocks input_0 > 0", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(let (($x14 (not $x11)))\n(let (($x144 (and true (not $x14))))\n(and $x144 $x14)))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 1 blocks input_0 <= 0", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(let (($x14 (not $x11)))\n(let (($x143 (and true $x14)))\n(and $x143 $x11)))))\n(check-sat)\n" } ], "reductions": [ { "formula": "input_0 <= 0", "relation": "complement", "representative": "input_0 > 0" } ] }, "reportedCore": [ "edge_4", "edge_8" ], "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n (not $x11)))\n(assert\n (bvsle input_0 (_ bv0 32)))\n(check-sat)\n", "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 5, "from": 6, "to": 8, "valuation": 0 }, { "edge": 6, "from": 7, "to": 9, "valuation": 0 }, { "edge": 7, "from": 8, "to": 2, "valuation": 0 }, { "edge": 8, "from": 9, "to": 10, "valuation": 0 }, { "edge": 9, "from": 9, "to": 12, "valuation": 0 }, { "edge": 12, "from": 12, "to": 8, "valuation": 0 } ], "z3Response": "unsat\n(edge_4 edge_8)", "z3Session": "(set-option :produce-unsat-cores true)\n(set-option :timeout 5000)\n; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(declare-fun edge_4 () Bool)\n(declare-fun edge_8 () Bool)\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n (let (($x14 (not $x11)))\n (=> edge_4 $x14))))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n(=> edge_8 $x11)))\n(check-sat-assuming (edge_4 edge_8))\n(get-unsat-core)\n" }, { "blocked": [ { "edge": 4, "valuation": 0 }, { "edge": 5, "valuation": 1 }, { "edge": 8, "valuation": 1 } ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 3, "valuation": 0 }, { "node": 3, "valuation": 1 }, { "node": 4, "valuation": 0 }, { "node": 4, "valuation": 1 }, { "node": 5, "valuation": 0 }, { "node": 5, "valuation": 1 }, { "node": 6, "valuation": 0 }, { "node": 6, "valuation": 1 }, { "node": 8, "valuation": 0 }, { "node": 7, "valuation": 1 }, { "node": 2, "valuation": 0 }, { "node": 9, "valuation": 1 }, { "node": 12, "valuation": 1 }, { "node": 8, "valuation": 1 }, { "node": 2, "valuation": 1 } ], "index": 1, "initialStates": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 } ], "modelComplete": true, "outcome": "safe", "predicates": [ "input_0 > 0" ], "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 0, "from": 1, "to": 3, "valuation": 1 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 1 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 1 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 1 }, { "edge": 5, "from": 6, "to": 8, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 1 }, { "edge": 7, "from": 8, "to": 2, "valuation": 0 }, { "edge": 6, "from": 7, "to": 9, "valuation": 1 }, { "edge": 9, "from": 9, "to": 12, "valuation": 1 }, { "edge": 12, "from": 12, "to": 8, "valuation": 1 }, { "edge": 7, "from": 8, "to": 2, "valuation": 1 } ] } ], "solverQueries": 48, "source": "extern int nondet_int(void);\nextern void ERROR(void);\n\nint main(void) {\n int x = nondet_int();\n if (x > 0) {\n if (x <= 0) {\n ERROR();\n }\n }\n return 0;\n}\n", "sourceFile": "examples/contradiction.c", "verdict": "SAFE", "z3Version": "4.15.4.0", "id": "contradiction", "title": "The impossible branch", "subtitle": "One missing fact creates a false alarm.", "llvm": "; ModuleID = 'build/contradiction.bc'\nsource_filename = \"examples/contradiction.c\"\ntarget datalayout = \"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128\"\ntarget triple = \"x86_64-unknown-linux-gnu\"\n\n; Function Attrs: noinline nounwind uwtable\ndefine dso_local i32 @main() #0 !dbg !10 {\nentry:\n %call = call i32 @nondet_int(), !dbg !15\n #dbg_value(i32 %call, !16, !DIExpression(), !17)\n %cmp = icmp sgt i32 %call, 0, !dbg !18\n br i1 %cmp, label %if.then, label %if.end3, !dbg !18\n\nif.then: ; preds = %entry\n %cmp1 = icmp sle i32 %call, 0, !dbg !20\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !20\n\nif.then2: ; preds = %if.then\n call void @ERROR(), !dbg !23\n br label %if.end, !dbg !25\n\nif.end: ; preds = %if.then2, %if.then\n br label %if.end3, !dbg !26\n\nif.end3: ; preds = %if.end, %entry\n ret i32 0, !dbg !27\n}\n\ndeclare i32 @nondet_int() #1\n\ndeclare void @ERROR() #1\n\nattributes #0 = { noinline nounwind uwtable \"frame-pointer\"=\"all\" \"min-legal-vector-width\"=\"0\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\nattributes #1 = { \"frame-pointer\"=\"all\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\n\n!llvm.dbg.cu = !{!0}\n!llvm.module.flags = !{!2, !3, !4, !5, !6, !7, !8}\n!llvm.ident = !{!9}\n\n!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, producer: \"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, splitDebugInlining: false, nameTableKind: None)\n!1 = !DIFile(filename: \"examples/contradiction.c\", directory: \"/app\", checksumkind: CSK_MD5, checksum: \"b64d3fdf17e245fae63b76e18448c96e\")\n!2 = !{i32 7, !\"Dwarf Version\", i32 5}\n!3 = !{i32 2, !\"Debug Info Version\", i32 3}\n!4 = !{i32 1, !\"wchar_size\", i32 4}\n!5 = !{i32 8, !\"PIC Level\", i32 2}\n!6 = !{i32 7, !\"PIE Level\", i32 2}\n!7 = !{i32 7, !\"uwtable\", i32 2}\n!8 = !{i32 7, !\"frame-pointer\", i32 2}\n!9 = !{!\"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\"}\n!10 = distinct !DISubprogram(name: \"main\", scope: !1, file: !1, line: 4, type: !11, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !14)\n!11 = !DISubroutineType(types: !12)\n!12 = !{!13}\n!13 = !DIBasicType(name: \"int\", size: 32, encoding: DW_ATE_signed)\n!14 = !{}\n!15 = !DILocation(line: 5, column: 13, scope: !10)\n!16 = !DILocalVariable(name: \"x\", scope: !10, file: !1, line: 5, type: !13)\n!17 = !DILocation(line: 0, scope: !10)\n!18 = !DILocation(line: 6, column: 11, scope: !19)\n!19 = distinct !DILexicalBlock(scope: !10, file: !1, line: 6, column: 9)\n!20 = !DILocation(line: 7, column: 15, scope: !21)\n!21 = distinct !DILexicalBlock(scope: !22, file: !1, line: 7, column: 13)\n!22 = distinct !DILexicalBlock(scope: !19, file: !1, line: 6, column: 16)\n!23 = !DILocation(line: 8, column: 13, scope: !24)\n!24 = distinct !DILexicalBlock(scope: !21, file: !1, line: 7, column: 21)\n!25 = !DILocation(line: 9, column: 9, scope: !24)\n!26 = !DILocation(line: 10, column: 5, scope: !22)\n!27 = !DILocation(line: 11, column: 5, scope: !10)\n" }, { "edges": [ { "formula": "true", "from": 1, "id": 0, "label": "", "smt": "true", "to": 3 }, { "formula": "true", "from": 3, "id": 1, "label": "", "smt": "true", "to": 4 }, { "formula": "true", "from": 4, "id": 2, "label": "", "smt": "true", "to": 5 }, { "formula": "true", "from": 5, "id": 3, "label": "", "smt": "true", "to": 6 }, { "formula": "input_0 > 0", "from": 6, "id": 4, "label": "true", "smt": "(not (bvsle input_0 #x00000000))", "to": 7 }, { "formula": "not (input_0 > 0)", "from": 6, "id": 5, "label": "false", "smt": "(bvsle input_0 #x00000000)", "to": 8 }, { "formula": "true", "from": 7, "id": 6, "label": "", "smt": "true", "to": 9 }, { "formula": "true", "from": 8, "id": 7, "label": "", "smt": "true", "to": 2 }, { "formula": "input_0 == 1", "from": 9, "id": 8, "label": "true", "smt": "(= input_0 #x00000001)", "to": 10 }, { "formula": "not (input_0 == 1)", "from": 9, "id": 9, "label": "false", "smt": "(not (= input_0 #x00000001))", "to": 12 }, { "formula": "true", "from": 10, "id": 10, "label": "", "smt": "true", "to": 11 }, { "formula": "true", "from": 11, "id": 11, "label": "", "smt": "true", "to": 13 }, { "formula": "true", "from": 12, "id": 12, "label": "", "smt": "true", "to": 8 }, { "formula": "true", "from": 13, "id": 13, "label": "", "smt": "true", "to": 12 } ], "engine": "SVF 3.4 + LLVM 21 + Z3; immutable-input predicate abstraction", "entry": 1, "inputs": [ { "name": "input_0", "node": 3 } ], "nodes": [ { "id": 1, "kind": "entry", "line": 0, "raw": "FunEntryICFGNode1 {fun: main{ \"ln\": 4, \"file\": \"examples/real-bug.c\" }}", "statements": [] }, { "id": 2, "kind": "exit", "line": 0, "raw": "FunExitICFGNode2 {fun: main{ \"ln\": 11, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }}\nPhiStmt: [Var6 <-- ([Var11, ICFGNode8],)]\t\nValVar ID: 21\n ret i32 0, !dbg !27 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }", "statements": [ "PhiStmt: [Var6 <-- ([Var11, ICFGNode8],)]\t\nValVar ID: 21\n ret i32 0, !dbg !27 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }" ] }, { "id": 3, "kind": "input", "line": 5, "raw": "CallICFGNode3 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 CallICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }", "statements": [] }, { "id": 4, "kind": "instruction", "line": 5, "raw": "RetICFGNode4 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 RetICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }", "statements": [] }, { "id": 5, "kind": "instruction", "line": 6, "raw": "IntraICFGNode5 {fun: main{ \"ln\": 6, \"cl\": 11, \"fl\": \"examples/real-bug.c\" }}\nCmpStmt: [Var10 <-- (Var7 predicate38 Var11)]\t\nValVar ID: 10\n %cmp = icmp sgt i32 %call, 0, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/real-bug.c\" }", "statements": [ "CmpStmt: [Var10 <-- (Var7 predicate38 Var11)]\t\nValVar ID: 10\n %cmp = icmp sgt i32 %call, 0, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/real-bug.c\" }" ] }, { "id": 6, "kind": "instruction", "line": 6, "raw": "IntraICFGNode6 {fun: main{ \"ln\": 6, \"cl\": 11, \"fl\": \"examples/real-bug.c\" }}\nBranchStmt: [Condition Var10]\nSuccessor 0 ICFGNode7 Successor 1 ICFGNode8 \nValVar ID: 12\n br i1 %cmp, label %if.then, label %if.end3, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/real-bug.c\" }", "statements": [ "BranchStmt: [Condition Var10]\nSuccessor 0 ICFGNode7 Successor 1 ICFGNode8 \nValVar ID: 12\n br i1 %cmp, label %if.then, label %if.end3, !dbg !18 { \"ln\": 6, \"cl\": 11, \"fl\": \"examples/real-bug.c\" }" ] }, { "id": 7, "kind": "instruction", "line": 7, "raw": "IntraICFGNode7 {fun: main{ \"ln\": 7, \"cl\": 15, \"fl\": \"examples/real-bug.c\" }}\nCmpStmt: [Var13 <-- (Var7 predicate32 Var14)]\t\nValVar ID: 13\n %cmp1 = icmp eq i32 %call, 1, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/real-bug.c\" }", "statements": [ "CmpStmt: [Var13 <-- (Var7 predicate32 Var14)]\t\nValVar ID: 13\n %cmp1 = icmp eq i32 %call, 1, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/real-bug.c\" }" ] }, { "id": 8, "kind": "instruction", "line": 11, "raw": "IntraICFGNode8 {fun: main{ \"ln\": 11, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }}\n ret i32 0, !dbg !27 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }", "statements": [] }, { "id": 9, "kind": "instruction", "line": 7, "raw": "IntraICFGNode9 {fun: main{ \"ln\": 7, \"cl\": 15, \"fl\": \"examples/real-bug.c\" }}\nBranchStmt: [Condition Var13]\nSuccessor 0 ICFGNode10 Successor 1 ICFGNode12 \nValVar ID: 15\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/real-bug.c\" }", "statements": [ "BranchStmt: [Condition Var13]\nSuccessor 0 ICFGNode10 Successor 1 ICFGNode12 \nValVar ID: 15\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !20 { \"ln\": 7, \"cl\": 15, \"fl\": \"examples/real-bug.c\" }" ] }, { "id": 10, "kind": "error", "line": 8, "raw": "CallICFGNode10 {fun: main{ \"ln\": 8, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }}\n call void @ERROR(), !dbg !23 CallICFGNode: { \"ln\": 8, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }", "statements": [] }, { "id": 11, "kind": "instruction", "line": 8, "raw": "RetICFGNode11 {fun: main{ \"ln\": 8, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }}\n call void @ERROR(), !dbg !23 RetICFGNode: { \"ln\": 8, \"cl\": 13, \"fl\": \"examples/real-bug.c\" }", "statements": [] }, { "id": 12, "kind": "instruction", "line": 10, "raw": "IntraICFGNode12 {fun: main{ \"ln\": 10, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode8 \nValVar ID: 20\n br label %if.end3, !dbg !26 { \"ln\": 10, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode8 \nValVar ID: 20\n br label %if.end3, !dbg !26 { \"ln\": 10, \"cl\": 5, \"fl\": \"examples/real-bug.c\" }" ] }, { "id": 13, "kind": "instruction", "line": 9, "raw": "IntraICFGNode13 {fun: main{ \"ln\": 9, \"cl\": 9, \"fl\": \"examples/real-bug.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode12 \nValVar ID: 19\n br label %if.end, !dbg !25 { \"ln\": 9, \"cl\": 9, \"fl\": \"examples/real-bug.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode12 \nValVar ID: 19\n br label %if.end, !dbg !25 { \"ln\": 9, \"cl\": 9, \"fl\": \"examples/real-bug.c\" }" ] } ], "reason": "Z3 found an input reaching ERROR", "rounds": [ { "blocked": [], "constraints": [ { "edge": 4, "formula": "input_0 > 0", "smt": "(not (bvsle input_0 #x00000000))" }, { "edge": 8, "formula": "input_0 == 1", "smt": "(= input_0 #x00000001)" } ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 3, "valuation": 0 }, { "node": 4, "valuation": 0 }, { "node": 5, "valuation": 0 }, { "node": 6, "valuation": 0 }, { "node": 7, "valuation": 0 }, { "node": 8, "valuation": 0 }, { "node": 9, "valuation": 0 }, { "node": 2, "valuation": 0 }, { "node": 10, "valuation": 0 }, { "node": 12, "valuation": 0 } ], "index": 0, "initialStates": [ { "node": 1, "valuation": 0 } ], "modelComplete": true, "outcome": "sat", "path": [ 0, 1, 2, 3, 4, 6, 8 ], "pathValuation": 0, "predicates": [], "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n (not $x11)))\n(assert\n (= input_0 (_ bv1 32)))\n(check-sat)\n", "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 5, "from": 6, "to": 8, "valuation": 0 }, { "edge": 6, "from": 7, "to": 9, "valuation": 0 }, { "edge": 7, "from": 8, "to": 2, "valuation": 0 }, { "edge": 8, "from": 9, "to": 10, "valuation": 0 }, { "edge": 9, "from": 9, "to": 12, "valuation": 0 }, { "edge": 12, "from": 12, "to": 8, "valuation": 0 } ], "witness": [ { "input": "input_0", "node": 3, "signed": 1, "unsigned": 1 } ], "z3Session": "(set-option :produce-unsat-cores true)\n(set-option :timeout 5000)\n; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(declare-fun edge_4 () Bool)\n(declare-fun edge_8 () Bool)\n(assert\n (let (($x11 (bvsle input_0 (_ bv0 32))))\n (let (($x14 (not $x11)))\n (=> edge_4 $x14))))\n(assert\n (let (($x10 (= input_0 (_ bv1 32))))\n(=> edge_8 $x10)))\n(check-sat-assuming (edge_4 edge_8))\n" } ], "solverQueries": 13, "source": "extern int nondet_int(void);\nextern void ERROR(void);\n\nint main(void) {\n int x = nondet_int();\n if (x > 0) {\n if (x == 1) {\n ERROR();\n }\n }\n return 0;\n}\n", "sourceFile": "examples/real-bug.c", "verdict": "UNSAFE", "z3Version": "4.15.4.0", "id": "real-bug", "title": "A real counterexample", "subtitle": "One changed condition turns the alarm into a bug.", "llvm": "; ModuleID = 'build/real-bug.bc'\nsource_filename = \"examples/real-bug.c\"\ntarget datalayout = \"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128\"\ntarget triple = \"x86_64-unknown-linux-gnu\"\n\n; Function Attrs: noinline nounwind uwtable\ndefine dso_local i32 @main() #0 !dbg !10 {\nentry:\n %call = call i32 @nondet_int(), !dbg !15\n #dbg_value(i32 %call, !16, !DIExpression(), !17)\n %cmp = icmp sgt i32 %call, 0, !dbg !18\n br i1 %cmp, label %if.then, label %if.end3, !dbg !18\n\nif.then: ; preds = %entry\n %cmp1 = icmp eq i32 %call, 1, !dbg !20\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !20\n\nif.then2: ; preds = %if.then\n call void @ERROR(), !dbg !23\n br label %if.end, !dbg !25\n\nif.end: ; preds = %if.then2, %if.then\n br label %if.end3, !dbg !26\n\nif.end3: ; preds = %if.end, %entry\n ret i32 0, !dbg !27\n}\n\ndeclare i32 @nondet_int() #1\n\ndeclare void @ERROR() #1\n\nattributes #0 = { noinline nounwind uwtable \"frame-pointer\"=\"all\" \"min-legal-vector-width\"=\"0\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\nattributes #1 = { \"frame-pointer\"=\"all\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\n\n!llvm.dbg.cu = !{!0}\n!llvm.module.flags = !{!2, !3, !4, !5, !6, !7, !8}\n!llvm.ident = !{!9}\n\n!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, producer: \"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, splitDebugInlining: false, nameTableKind: None)\n!1 = !DIFile(filename: \"examples/real-bug.c\", directory: \"/app\", checksumkind: CSK_MD5, checksum: \"98f8bf480ae2a3c2a57540e935f2e5d6\")\n!2 = !{i32 7, !\"Dwarf Version\", i32 5}\n!3 = !{i32 2, !\"Debug Info Version\", i32 3}\n!4 = !{i32 1, !\"wchar_size\", i32 4}\n!5 = !{i32 8, !\"PIC Level\", i32 2}\n!6 = !{i32 7, !\"PIE Level\", i32 2}\n!7 = !{i32 7, !\"uwtable\", i32 2}\n!8 = !{i32 7, !\"frame-pointer\", i32 2}\n!9 = !{!\"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\"}\n!10 = distinct !DISubprogram(name: \"main\", scope: !1, file: !1, line: 4, type: !11, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !14)\n!11 = !DISubroutineType(types: !12)\n!12 = !{!13}\n!13 = !DIBasicType(name: \"int\", size: 32, encoding: DW_ATE_signed)\n!14 = !{}\n!15 = !DILocation(line: 5, column: 13, scope: !10)\n!16 = !DILocalVariable(name: \"x\", scope: !10, file: !1, line: 5, type: !13)\n!17 = !DILocation(line: 0, scope: !10)\n!18 = !DILocation(line: 6, column: 11, scope: !19)\n!19 = distinct !DILexicalBlock(scope: !10, file: !1, line: 6, column: 9)\n!20 = !DILocation(line: 7, column: 15, scope: !21)\n!21 = distinct !DILexicalBlock(scope: !22, file: !1, line: 7, column: 13)\n!22 = distinct !DILexicalBlock(scope: !19, file: !1, line: 6, column: 16)\n!23 = !DILocation(line: 8, column: 13, scope: !24)\n!24 = distinct !DILexicalBlock(scope: !21, file: !1, line: 7, column: 21)\n!25 = !DILocation(line: 9, column: 9, scope: !24)\n!26 = !DILocation(line: 10, column: 5, scope: !22)\n!27 = !DILocation(line: 11, column: 5, scope: !10)\n", "replay": { "confirmed": true, "exitCode": 42, "stdout": "ERROR reached" } }, { "edges": [ { "formula": "true", "from": 1, "id": 0, "label": "", "smt": "true", "to": 3 }, { "formula": "true", "from": 3, "id": 1, "label": "", "smt": "true", "to": 4 }, { "formula": "true", "from": 4, "id": 2, "label": "", "smt": "true", "to": 5 }, { "formula": "true", "from": 5, "id": 3, "label": "", "smt": "true", "to": 6 }, { "formula": "true", "from": 6, "id": 4, "label": "", "smt": "true", "to": 7 }, { "formula": "input_0 u 20", "from": 10, "id": 9, "label": "true", "smt": "(let ((a!1 (and (= ((_ extract 31 5) (bvadd #x00000001 input_0))\n #b000000000000000000000000000)\n (bvule (bvadd #b00001 ((_ extract 4 0) input_0)) #b10100))))\n (not a!1))", "to": 11 }, { "formula": "not ((input_0 + 1) >u 20)", "from": 10, "id": 10, "label": "false", "smt": "(and (= ((_ extract 31 5) (bvadd #x00000001 input_0))\n #b000000000000000000000000000)\n (bvule (bvadd #b00001 ((_ extract 4 0) input_0)) #b10100))", "to": 13 }, { "formula": "true", "from": 11, "id": 11, "label": "", "smt": "true", "to": 12 }, { "formula": "true", "from": 12, "id": 12, "label": "", "smt": "true", "to": 14 }, { "formula": "true", "from": 13, "id": 13, "label": "", "smt": "true", "to": 9 }, { "formula": "true", "from": 14, "id": 14, "label": "", "smt": "true", "to": 13 } ], "engine": "SVF 3.4 + LLVM 21 + Z3; immutable-input predicate abstraction", "entry": 1, "inputs": [ { "name": "input_0", "node": 3 } ], "nodes": [ { "id": 1, "kind": "entry", "line": 0, "raw": "FunEntryICFGNode1 {fun: main{ \"ln\": 4, \"file\": \"examples/arithmetic.c\" }}", "statements": [] }, { "id": 2, "kind": "exit", "line": 0, "raw": "FunExitICFGNode2 {fun: main{ \"ln\": 12, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }}\nPhiStmt: [Var6 <-- ([Var24, ICFGNode9],)]\t\nValVar ID: 23\n ret i32 0, !dbg !30 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "PhiStmt: [Var6 <-- ([Var24, ICFGNode9],)]\t\nValVar ID: 23\n ret i32 0, !dbg !30 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 3, "kind": "input", "line": 5, "raw": "CallICFGNode3 {fun: main{ \"ln\": 5, \"cl\": 18, \"fl\": \"examples/arithmetic.c\" }}\n %call = call i32 @nondet_uint(), !dbg !15 CallICFGNode: { \"ln\": 5, \"cl\": 18, \"fl\": \"examples/arithmetic.c\" }", "statements": [] }, { "id": 4, "kind": "instruction", "line": 5, "raw": "RetICFGNode4 {fun: main{ \"ln\": 5, \"cl\": 18, \"fl\": \"examples/arithmetic.c\" }}\n %call = call i32 @nondet_uint(), !dbg !15 RetICFGNode: { \"ln\": 5, \"cl\": 18, \"fl\": \"examples/arithmetic.c\" }", "statements": [] }, { "id": 5, "kind": "instruction", "line": 6, "raw": "IntraICFGNode5 {fun: main{ \"ln\": 6, \"cl\": 20, \"fl\": \"examples/arithmetic.c\" }}\nBinaryOPStmt: [Var10 <-- (Var7 opcode13 Var11)]\t\nValVar ID: 10\n %add = add i32 %call, 1, !dbg !19 { \"ln\": 6, \"cl\": 20, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "BinaryOPStmt: [Var10 <-- (Var7 opcode13 Var11)]\t\nValVar ID: 10\n %add = add i32 %call, 1, !dbg !19 { \"ln\": 6, \"cl\": 20, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 6, "kind": "instruction", "line": 7, "raw": "IntraICFGNode6 {fun: main{ \"ln\": 7, \"cl\": 11, \"fl\": \"examples/arithmetic.c\" }}\nCmpStmt: [Var12 <-- (Var7 predicate36 Var13)]\t\nValVar ID: 12\n %cmp = icmp ult i32 %call, 10, !dbg !21 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "CmpStmt: [Var12 <-- (Var7 predicate36 Var13)]\t\nValVar ID: 12\n %cmp = icmp ult i32 %call, 10, !dbg !21 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 7, "kind": "instruction", "line": 7, "raw": "IntraICFGNode7 {fun: main{ \"ln\": 7, \"cl\": 11, \"fl\": \"examples/arithmetic.c\" }}\nBranchStmt: [Condition Var12]\nSuccessor 0 ICFGNode8 Successor 1 ICFGNode9 \nValVar ID: 14\n br i1 %cmp, label %if.then, label %if.end3, !dbg !21 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "BranchStmt: [Condition Var12]\nSuccessor 0 ICFGNode8 Successor 1 ICFGNode9 \nValVar ID: 14\n br i1 %cmp, label %if.then, label %if.end3, !dbg !21 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 8, "kind": "instruction", "line": 8, "raw": "IntraICFGNode8 {fun: main{ \"ln\": 8, \"cl\": 15, \"fl\": \"examples/arithmetic.c\" }}\nCmpStmt: [Var15 <-- (Var10 predicate34 Var16)]\t\nValVar ID: 15\n %cmp1 = icmp ugt i32 %add, 20, !dbg !23 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "CmpStmt: [Var15 <-- (Var10 predicate34 Var16)]\t\nValVar ID: 15\n %cmp1 = icmp ugt i32 %add, 20, !dbg !23 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 9, "kind": "instruction", "line": 12, "raw": "IntraICFGNode9 {fun: main{ \"ln\": 12, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }}\n ret i32 0, !dbg !30 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }", "statements": [] }, { "id": 10, "kind": "instruction", "line": 8, "raw": "IntraICFGNode10 {fun: main{ \"ln\": 8, \"cl\": 15, \"fl\": \"examples/arithmetic.c\" }}\nBranchStmt: [Condition Var15]\nSuccessor 0 ICFGNode11 Successor 1 ICFGNode13 \nValVar ID: 17\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !23 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "BranchStmt: [Condition Var15]\nSuccessor 0 ICFGNode11 Successor 1 ICFGNode13 \nValVar ID: 17\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !23 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 11, "kind": "error", "line": 9, "raw": "CallICFGNode11 {fun: main{ \"ln\": 9, \"cl\": 13, \"fl\": \"examples/arithmetic.c\" }}\n call void @ERROR(), !dbg !26 CallICFGNode: { \"ln\": 9, \"cl\": 13, \"fl\": \"examples/arithmetic.c\" }", "statements": [] }, { "id": 12, "kind": "instruction", "line": 9, "raw": "RetICFGNode12 {fun: main{ \"ln\": 9, \"cl\": 13, \"fl\": \"examples/arithmetic.c\" }}\n call void @ERROR(), !dbg !26 RetICFGNode: { \"ln\": 9, \"cl\": 13, \"fl\": \"examples/arithmetic.c\" }", "statements": [] }, { "id": 13, "kind": "instruction", "line": 11, "raw": "IntraICFGNode13 {fun: main{ \"ln\": 11, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode9 \nValVar ID: 22\n br label %if.end3, !dbg !29 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode9 \nValVar ID: 22\n br label %if.end3, !dbg !29 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/arithmetic.c\" }" ] }, { "id": 14, "kind": "instruction", "line": 10, "raw": "IntraICFGNode14 {fun: main{ \"ln\": 10, \"cl\": 9, \"fl\": \"examples/arithmetic.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode13 \nValVar ID: 21\n br label %if.end, !dbg !28 { \"ln\": 10, \"cl\": 9, \"fl\": \"examples/arithmetic.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode13 \nValVar ID: 21\n br label %if.end, !dbg !28 { \"ln\": 10, \"cl\": 9, \"fl\": \"examples/arithmetic.c\" }" ] } ], "reason": "Complete abstract exploration found no reachable ERROR in the supported bit-vector model", "rounds": [ { "blocked": [], "constraints": [ { "edge": 5, "formula": "input_0 u 20", "smt": "(let ((a!1 (and (= ((_ extract 31 5) (bvadd #x00000001 input_0))\n #b000000000000000000000000000)\n (bvule (bvadd #b00001 ((_ extract 4 0) input_0)) #b10100))))\n (not a!1))" } ], "core": [ "edge_5", "edge_9" ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 3, "valuation": 0 }, { "node": 4, "valuation": 0 }, { "node": 5, "valuation": 0 }, { "node": 6, "valuation": 0 }, { "node": 7, "valuation": 0 }, { "node": 8, "valuation": 0 }, { "node": 9, "valuation": 0 }, { "node": 10, "valuation": 0 }, { "node": 2, "valuation": 0 }, { "node": 11, "valuation": 0 }, { "node": 13, "valuation": 0 } ], "index": 0, "initialStates": [ { "node": 1, "valuation": 0 } ], "learned": "input_0 u 20" ], "modelComplete": true, "outcome": "unsat", "path": [ 0, 1, 2, 3, 4, 5, 7, 9 ], "pathEliminated": true, "pathValuation": 0, "predicates": [], "refinement": { "added": [ { "edge": 5, "formula": "input_0 u 20", "smt": "(let ((a!1 (and (= ((_ extract 31 5) (bvadd #x00000001 input_0))\n #b000000000000000000000000000)\n (bvule (bvadd #b00001 ((_ extract 4 0) input_0)) #b10100))))\n (not a!1))" } ], "core": [ { "edge": 5, "formula": "input_0 u 20" } ], "coreMinimal": true, "coverage": [ { "blockedEdge": 5, "infeasible": false, "valuation": 0 }, { "blockedEdge": 9, "infeasible": false, "valuation": 1 }, { "blockedEdge": 5, "infeasible": false, "valuation": 2 }, { "infeasible": true, "valuation": 3 } ], "ignored": [], "method": "smt-unsat-core", "obligations": [ { "expected": "unsat", "purpose": "The selected core is inconsistent", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let ((?x34 ((_ extract 4 0) input_0)))\n(let ((?x37 (bvadd (_ bv1 5) ?x34)))\n(let (($x39 (bvule ?x37 (_ bv20 5))))\n(let ((?x7 (bvadd (_ bv1 32) input_0)))\n(let ((?x19 ((_ extract 31 5) ?x7)))\n(let (($x31 (= ?x19 (_ bv0 27))))\n(let (($x40 (and $x31 $x39)))\n(let (($x43 (not $x40)))\n(let ((?x17 ((_ extract 3 0) input_0)))\n(let (($x21 (bvule (_ bv10 4) ?x17)))\n(let (($x23 (or (not (= ((_ extract 31 4) input_0) (_ bv0 28))) $x21)))\n(let (($x26 (not $x23)))\n(and (and true $x26) $x43))))))))))))))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 u 20 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let ((?x17 ((_ extract 3 0) input_0)))\n(let (($x21 (bvule (_ bv10 4) ?x17)))\n(let (($x23 (or (not (= ((_ extract 31 4) input_0) (_ bv0 28))) $x21)))\n(let (($x26 (not $x23)))\n(and true $x26))))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 0 blocks input_0 u 20", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let ((?x34 ((_ extract 4 0) input_0)))\n(let ((?x37 (bvadd (_ bv1 5) ?x34)))\n(let (($x39 (bvule ?x37 (_ bv20 5))))\n(let ((?x7 (bvadd (_ bv1 32) input_0)))\n(let ((?x19 ((_ extract 31 5) ?x7)))\n(let (($x31 (= ?x19 (_ bv0 27))))\n(let (($x40 (and $x31 $x39)))\n(let (($x43 (not $x40)))\n(let ((?x17 ((_ extract 3 0) input_0)))\n(let (($x21 (bvule (_ bv10 4) ?x17)))\n(let (($x23 (or (not (= ((_ extract 31 4) input_0) (_ bv0 28))) $x21)))\n(let (($x26 (not $x23)))\n(let (($x212 (and (and true $x26) (not $x43))))\n(and $x212 $x43)))))))))))))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 2 blocks input_0 edge_5 $x26))))))\n(assert\n (let ((?x34 ((_ extract 4 0) input_0)))\n(let ((?x37 (bvadd (_ bv1 5) ?x34)))\n(let (($x39 (bvule ?x37 (_ bv20 5))))\n(let ((?x7 (bvadd (_ bv1 32) input_0)))\n(let ((?x19 ((_ extract 31 5) ?x7)))\n(let (($x31 (= ?x19 (_ bv0 27))))\n(let (($x40 (and $x31 $x39)))\n(let (($x43 (not $x40)))\n(=> edge_9 $x43))))))))))\n(check-sat-assuming (edge_5 edge_9))\n(get-unsat-core)\n" }, { "blocked": [ { "edge": 5, "valuation": 0 }, { "edge": 6, "valuation": 1 }, { "edge": 5, "valuation": 2 }, { "edge": 9, "valuation": 1 } ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 1, "valuation": 2 }, { "node": 3, "valuation": 0 }, { "node": 3, "valuation": 1 }, { "node": 3, "valuation": 2 }, { "node": 4, "valuation": 0 }, { "node": 4, "valuation": 1 }, { "node": 4, "valuation": 2 }, { "node": 5, "valuation": 0 }, { "node": 5, "valuation": 1 }, { "node": 5, "valuation": 2 }, { "node": 6, "valuation": 0 }, { "node": 6, "valuation": 1 }, { "node": 6, "valuation": 2 }, { "node": 7, "valuation": 0 }, { "node": 7, "valuation": 1 }, { "node": 7, "valuation": 2 }, { "node": 9, "valuation": 0 }, { "node": 8, "valuation": 1 }, { "node": 9, "valuation": 2 }, { "node": 2, "valuation": 0 }, { "node": 10, "valuation": 1 }, { "node": 2, "valuation": 2 }, { "node": 13, "valuation": 1 }, { "node": 9, "valuation": 1 }, { "node": 2, "valuation": 1 } ], "index": 1, "initialStates": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 1, "valuation": 2 } ], "modelComplete": true, "outcome": "safe", "predicates": [ "input_0 u 20" ], "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 0, "from": 1, "to": 3, "valuation": 1 }, { "edge": 0, "from": 1, "to": 3, "valuation": 2 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 1 }, { "edge": 1, "from": 3, "to": 4, "valuation": 2 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 1 }, { "edge": 2, "from": 4, "to": 5, "valuation": 2 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 1 }, { "edge": 3, "from": 5, "to": 6, "valuation": 2 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 1 }, { "edge": 4, "from": 6, "to": 7, "valuation": 2 }, { "edge": 6, "from": 7, "to": 9, "valuation": 0 }, { "edge": 5, "from": 7, "to": 8, "valuation": 1 }, { "edge": 6, "from": 7, "to": 9, "valuation": 2 }, { "edge": 8, "from": 9, "to": 2, "valuation": 0 }, { "edge": 7, "from": 8, "to": 10, "valuation": 1 }, { "edge": 8, "from": 9, "to": 2, "valuation": 2 }, { "edge": 10, "from": 10, "to": 13, "valuation": 1 }, { "edge": 13, "from": 13, "to": 9, "valuation": 1 }, { "edge": 8, "from": 9, "to": 2, "valuation": 1 } ] } ], "solverQueries": 65, "source": "extern unsigned nondet_uint(void);\nextern void ERROR(void);\n\nint main(void) {\n unsigned x = nondet_uint();\n unsigned y = x + 1;\n if (x < 10) {\n if (y > 20) {\n ERROR();\n }\n }\n return 0;\n}\n", "sourceFile": "examples/arithmetic.c", "verdict": "SAFE", "z3Version": "4.15.4.0", "id": "arithmetic", "title": "Follow the arithmetic", "subtitle": "An unsigned addition connects two branch conditions.", "llvm": "; ModuleID = 'build/arithmetic.bc'\nsource_filename = \"examples/arithmetic.c\"\ntarget datalayout = \"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128\"\ntarget triple = \"x86_64-unknown-linux-gnu\"\n\n; Function Attrs: noinline nounwind uwtable\ndefine dso_local i32 @main() #0 !dbg !10 {\nentry:\n %call = call i32 @nondet_uint(), !dbg !15\n #dbg_value(i32 %call, !16, !DIExpression(), !18)\n %add = add i32 %call, 1, !dbg !19\n #dbg_value(i32 %add, !20, !DIExpression(), !18)\n %cmp = icmp ult i32 %call, 10, !dbg !21\n br i1 %cmp, label %if.then, label %if.end3, !dbg !21\n\nif.then: ; preds = %entry\n %cmp1 = icmp ugt i32 %add, 20, !dbg !23\n br i1 %cmp1, label %if.then2, label %if.end, !dbg !23\n\nif.then2: ; preds = %if.then\n call void @ERROR(), !dbg !26\n br label %if.end, !dbg !28\n\nif.end: ; preds = %if.then2, %if.then\n br label %if.end3, !dbg !29\n\nif.end3: ; preds = %if.end, %entry\n ret i32 0, !dbg !30\n}\n\ndeclare i32 @nondet_uint() #1\n\ndeclare void @ERROR() #1\n\nattributes #0 = { noinline nounwind uwtable \"frame-pointer\"=\"all\" \"min-legal-vector-width\"=\"0\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\nattributes #1 = { \"frame-pointer\"=\"all\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\n\n!llvm.dbg.cu = !{!0}\n!llvm.module.flags = !{!2, !3, !4, !5, !6, !7, !8}\n!llvm.ident = !{!9}\n\n!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, producer: \"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, splitDebugInlining: false, nameTableKind: None)\n!1 = !DIFile(filename: \"examples/arithmetic.c\", directory: \"/app\", checksumkind: CSK_MD5, checksum: \"6d449af950296d139f17e82bb391904c\")\n!2 = !{i32 7, !\"Dwarf Version\", i32 5}\n!3 = !{i32 2, !\"Debug Info Version\", i32 3}\n!4 = !{i32 1, !\"wchar_size\", i32 4}\n!5 = !{i32 8, !\"PIC Level\", i32 2}\n!6 = !{i32 7, !\"PIE Level\", i32 2}\n!7 = !{i32 7, !\"uwtable\", i32 2}\n!8 = !{i32 7, !\"frame-pointer\", i32 2}\n!9 = !{!\"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\"}\n!10 = distinct !DISubprogram(name: \"main\", scope: !1, file: !1, line: 4, type: !11, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !14)\n!11 = !DISubroutineType(types: !12)\n!12 = !{!13}\n!13 = !DIBasicType(name: \"int\", size: 32, encoding: DW_ATE_signed)\n!14 = !{}\n!15 = !DILocation(line: 5, column: 18, scope: !10)\n!16 = !DILocalVariable(name: \"x\", scope: !10, file: !1, line: 5, type: !17)\n!17 = !DIBasicType(name: \"unsigned int\", size: 32, encoding: DW_ATE_unsigned)\n!18 = !DILocation(line: 0, scope: !10)\n!19 = !DILocation(line: 6, column: 20, scope: !10)\n!20 = !DILocalVariable(name: \"y\", scope: !10, file: !1, line: 6, type: !17)\n!21 = !DILocation(line: 7, column: 11, scope: !22)\n!22 = distinct !DILexicalBlock(scope: !10, file: !1, line: 7, column: 9)\n!23 = !DILocation(line: 8, column: 15, scope: !24)\n!24 = distinct !DILexicalBlock(scope: !25, file: !1, line: 8, column: 13)\n!25 = distinct !DILexicalBlock(scope: !22, file: !1, line: 7, column: 17)\n!26 = !DILocation(line: 9, column: 13, scope: !27)\n!27 = distinct !DILexicalBlock(scope: !24, file: !1, line: 8, column: 21)\n!28 = !DILocation(line: 10, column: 9, scope: !27)\n!29 = !DILocation(line: 11, column: 5, scope: !25)\n!30 = !DILocation(line: 12, column: 5, scope: !10)\n" }, { "edges": [ { "formula": "true", "from": 1, "id": 0, "label": "", "smt": "true", "to": 3 }, { "formula": "true", "from": 3, "id": 1, "label": "", "smt": "true", "to": 4 }, { "formula": "true", "from": 4, "id": 2, "label": "", "smt": "true", "to": 5 }, { "formula": "true", "from": 5, "id": 3, "label": "", "smt": "true", "to": 6 }, { "formula": "true", "from": 6, "id": 4, "label": "", "smt": "true", "to": 7 }, { "formula": "true", "from": 7, "id": 5, "label": "", "smt": "true", "to": 8 }, { "formula": "input_0 > 0", "from": 8, "id": 6, "label": "true", "smt": "(not (bvsle input_0 #x00000000))", "to": 9 }, { "formula": "not (input_0 > 0)", "from": 8, "id": 7, "label": "false", "smt": "(bvsle input_0 #x00000000)", "to": 10 }, { "formula": "true", "from": 9, "id": 8, "label": "", "smt": "true", "to": 11 }, { "formula": "true", "from": 10, "id": 9, "label": "", "smt": "true", "to": 12 }, { "formula": "input_0 <= 0", "from": 11, "id": 10, "label": "true", "smt": "(bvsle input_0 #x00000000)", "to": 13 }, { "formula": "not (input_0 <= 0)", "from": 11, "id": 11, "label": "false", "smt": "(not (bvsle input_0 #x00000000))", "to": 15 }, { "formula": "input_1 > 10", "from": 12, "id": 12, "label": "true", "smt": "(not (bvsle input_1 #x0000000a))", "to": 16 }, { "formula": "not (input_1 > 10)", "from": 12, "id": 13, "label": "false", "smt": "(bvsle input_1 #x0000000a)", "to": 17 }, { "formula": "true", "from": 13, "id": 14, "label": "", "smt": "true", "to": 14 }, { "formula": "true", "from": 14, "id": 15, "label": "", "smt": "true", "to": 18 }, { "formula": "true", "from": 15, "id": 16, "label": "", "smt": "true", "to": 10 }, { "formula": "true", "from": 16, "id": 17, "label": "", "smt": "true", "to": 19 }, { "formula": "true", "from": 17, "id": 18, "label": "", "smt": "true", "to": 2 }, { "formula": "true", "from": 18, "id": 19, "label": "", "smt": "true", "to": 15 }, { "formula": "input_1 <= 10", "from": 19, "id": 20, "label": "true", "smt": "(bvsle input_1 #x0000000a)", "to": 20 }, { "formula": "not (input_1 <= 10)", "from": 19, "id": 21, "label": "false", "smt": "(not (bvsle input_1 #x0000000a))", "to": 22 }, { "formula": "true", "from": 20, "id": 22, "label": "", "smt": "true", "to": 21 }, { "formula": "true", "from": 21, "id": 23, "label": "", "smt": "true", "to": 23 }, { "formula": "true", "from": 22, "id": 24, "label": "", "smt": "true", "to": 17 }, { "formula": "true", "from": 23, "id": 25, "label": "", "smt": "true", "to": 22 } ], "engine": "SVF 3.4 + LLVM 21 + Z3; immutable-input predicate abstraction", "entry": 1, "inputs": [ { "name": "input_0", "node": 3 }, { "name": "input_1", "node": 5 } ], "nodes": [ { "id": 1, "kind": "entry", "line": 0, "raw": "FunEntryICFGNode1 {fun: main{ \"ln\": 4, \"file\": \"examples/two-refinements.c\" }}", "statements": [] }, { "id": 2, "kind": "exit", "line": 0, "raw": "FunExitICFGNode2 {fun: main{ \"ln\": 13, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }}\nPhiStmt: [Var6 <-- ([Var12, ICFGNode17],)]\t\nValVar ID: 29\n ret i32 0, !dbg !34 { \"ln\": 13, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "PhiStmt: [Var6 <-- ([Var12, ICFGNode17],)]\t\nValVar ID: 29\n ret i32 0, !dbg !34 { \"ln\": 13, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 3, "kind": "input", "line": 5, "raw": "CallICFGNode3 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 CallICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 4, "kind": "instruction", "line": 5, "raw": "RetICFGNode4 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 RetICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 5, "kind": "input", "line": 6, "raw": "CallICFGNode5 {fun: main{ \"ln\": 6, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }}\n %call1 = call i32 @nondet_int(), !dbg !18 CallICFGNode: { \"ln\": 6, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 6, "kind": "instruction", "line": 6, "raw": "RetICFGNode6 {fun: main{ \"ln\": 6, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }}\n %call1 = call i32 @nondet_int(), !dbg !18 RetICFGNode: { \"ln\": 6, \"cl\": 13, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 7, "kind": "instruction", "line": 7, "raw": "IntraICFGNode7 {fun: main{ \"ln\": 7, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }}\nCmpStmt: [Var11 <-- (Var7 predicate38 Var12)]\t\nValVar ID: 11\n %cmp = icmp sgt i32 %call, 0, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "CmpStmt: [Var11 <-- (Var7 predicate38 Var12)]\t\nValVar ID: 11\n %cmp = icmp sgt i32 %call, 0, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 8, "kind": "instruction", "line": 7, "raw": "IntraICFGNode8 {fun: main{ \"ln\": 7, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [Condition Var11]\nSuccessor 0 ICFGNode9 Successor 1 ICFGNode10 \nValVar ID: 13\n br i1 %cmp, label %if.then, label %if.end4, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [Condition Var11]\nSuccessor 0 ICFGNode9 Successor 1 ICFGNode10 \nValVar ID: 13\n br i1 %cmp, label %if.then, label %if.end4, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 9, "kind": "instruction", "line": 8, "raw": "IntraICFGNode9 {fun: main{ \"ln\": 8, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }}\nCmpStmt: [Var14 <-- (Var7 predicate41 Var12)]\t\nValVar ID: 14\n %cmp2 = icmp sle i32 %call, 0, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "CmpStmt: [Var14 <-- (Var7 predicate41 Var12)]\t\nValVar ID: 14\n %cmp2 = icmp sle i32 %call, 0, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 10, "kind": "instruction", "line": 10, "raw": "IntraICFGNode10 {fun: main{ \"ln\": 10, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }}\nCmpStmt: [Var21 <-- (Var10 predicate38 Var22)]\t\nValVar ID: 21\n %cmp5 = icmp sgt i32 %call1, 10, !dbg !27 { \"ln\": 10, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "CmpStmt: [Var21 <-- (Var10 predicate38 Var22)]\t\nValVar ID: 21\n %cmp5 = icmp sgt i32 %call1, 10, !dbg !27 { \"ln\": 10, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 11, "kind": "instruction", "line": 8, "raw": "IntraICFGNode11 {fun: main{ \"ln\": 8, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [Condition Var14]\nSuccessor 0 ICFGNode13 Successor 1 ICFGNode15 \nValVar ID: 15\n br i1 %cmp2, label %if.then3, label %if.end, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [Condition Var14]\nSuccessor 0 ICFGNode13 Successor 1 ICFGNode15 \nValVar ID: 15\n br i1 %cmp2, label %if.then3, label %if.end, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 12, "kind": "instruction", "line": 10, "raw": "IntraICFGNode12 {fun: main{ \"ln\": 10, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [Condition Var21]\nSuccessor 0 ICFGNode16 Successor 1 ICFGNode17 \nValVar ID: 23\n br i1 %cmp5, label %if.then6, label %if.end10, !dbg !27 { \"ln\": 10, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [Condition Var21]\nSuccessor 0 ICFGNode16 Successor 1 ICFGNode17 \nValVar ID: 23\n br i1 %cmp5, label %if.then6, label %if.end10, !dbg !27 { \"ln\": 10, \"cl\": 11, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 13, "kind": "error", "line": 8, "raw": "CallICFGNode13 {fun: main{ \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }}\n call void @ERROR(), !dbg !25 CallICFGNode: { \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 14, "kind": "instruction", "line": 8, "raw": "RetICFGNode14 {fun: main{ \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }}\n call void @ERROR(), !dbg !25 RetICFGNode: { \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 15, "kind": "instruction", "line": 9, "raw": "IntraICFGNode15 {fun: main{ \"ln\": 9, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode10 \nValVar ID: 20\n br label %if.end4, !dbg !26 { \"ln\": 9, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode10 \nValVar ID: 20\n br label %if.end4, !dbg !26 { \"ln\": 9, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 16, "kind": "instruction", "line": 11, "raw": "IntraICFGNode16 {fun: main{ \"ln\": 11, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }}\nCmpStmt: [Var24 <-- (Var10 predicate41 Var22)]\t\nValVar ID: 24\n %cmp7 = icmp sle i32 %call1, 10, !dbg !29 { \"ln\": 11, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "CmpStmt: [Var24 <-- (Var10 predicate41 Var22)]\t\nValVar ID: 24\n %cmp7 = icmp sle i32 %call1, 10, !dbg !29 { \"ln\": 11, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 17, "kind": "instruction", "line": 13, "raw": "IntraICFGNode17 {fun: main{ \"ln\": 13, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }}\n ret i32 0, !dbg !34 { \"ln\": 13, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 18, "kind": "instruction", "line": 8, "raw": "IntraICFGNode18 {fun: main{ \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode15 \nValVar ID: 19\n br label %if.end, !dbg !25 { \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode15 \nValVar ID: 19\n br label %if.end, !dbg !25 { \"ln\": 8, \"cl\": 21, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 19, "kind": "instruction", "line": 11, "raw": "IntraICFGNode19 {fun: main{ \"ln\": 11, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [Condition Var24]\nSuccessor 0 ICFGNode20 Successor 1 ICFGNode22 \nValVar ID: 25\n br i1 %cmp7, label %if.then8, label %if.end9, !dbg !29 { \"ln\": 11, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [Condition Var24]\nSuccessor 0 ICFGNode20 Successor 1 ICFGNode22 \nValVar ID: 25\n br i1 %cmp7, label %if.then8, label %if.end9, !dbg !29 { \"ln\": 11, \"cl\": 15, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 20, "kind": "error", "line": 11, "raw": "CallICFGNode20 {fun: main{ \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }}\n call void @ERROR(), !dbg !32 CallICFGNode: { \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 21, "kind": "instruction", "line": 11, "raw": "RetICFGNode21 {fun: main{ \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }}\n call void @ERROR(), !dbg !32 RetICFGNode: { \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }", "statements": [] }, { "id": 22, "kind": "instruction", "line": 12, "raw": "IntraICFGNode22 {fun: main{ \"ln\": 12, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode17 \nValVar ID: 28\n br label %if.end10, !dbg !33 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode17 \nValVar ID: 28\n br label %if.end10, !dbg !33 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/two-refinements.c\" }" ] }, { "id": 23, "kind": "instruction", "line": 11, "raw": "IntraICFGNode23 {fun: main{ \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode22 \nValVar ID: 27\n br label %if.end9, !dbg !32 { \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode22 \nValVar ID: 27\n br label %if.end9, !dbg !32 { \"ln\": 11, \"cl\": 22, \"fl\": \"examples/two-refinements.c\" }" ] } ], "reason": "Complete abstract exploration found no reachable ERROR in the supported bit-vector model", "rounds": [ { "blocked": [], "constraints": [ { "edge": 6, "formula": "input_0 > 0", "smt": "(not (bvsle input_0 #x00000000))" }, { "edge": 10, "formula": "input_0 <= 0", "smt": "(bvsle input_0 #x00000000)" } ], "core": [ "edge_6", "edge_10" ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 3, "valuation": 0 }, { "node": 4, "valuation": 0 }, { "node": 5, "valuation": 0 }, { "node": 6, "valuation": 0 }, { "node": 7, "valuation": 0 }, { "node": 8, "valuation": 0 }, { "node": 9, "valuation": 0 }, { "node": 10, "valuation": 0 }, { "node": 11, "valuation": 0 }, { "node": 12, "valuation": 0 }, { "node": 13, "valuation": 0 }, { "node": 15, "valuation": 0 }, { "node": 16, "valuation": 0 }, { "node": 17, "valuation": 0 }, { "node": 19, "valuation": 0 }, { "node": 2, "valuation": 0 }, { "node": 20, "valuation": 0 }, { "node": 22, "valuation": 0 } ], "index": 0, "initialStates": [ { "node": 1, "valuation": 0 } ], "learned": "input_0 > 0", "learnedPredicates": [ "input_0 > 0" ], "modelComplete": true, "outcome": "unsat", "path": [ 0, 1, 2, 3, 4, 5, 6, 8, 10 ], "pathEliminated": true, "pathValuation": 0, "predicates": [], "refinement": { "added": [ { "edge": 6, "formula": "input_0 > 0", "smt": "(not (bvsle input_0 #x00000000))" } ], "core": [ { "edge": 6, "formula": "input_0 > 0" }, { "edge": 10, "formula": "input_0 <= 0" } ], "coreMinimal": true, "coverage": [ { "blockedEdge": 6, "infeasible": false, "valuation": 0 }, { "blockedEdge": 10, "infeasible": false, "valuation": 1 } ], "ignored": [], "method": "smt-unsat-core", "obligations": [ { "expected": "unsat", "purpose": "The selected core is inconsistent", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(and (and true (not $x12)) $x12)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 > 0 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(and true $x12)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 <= 0 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(let (($x15 (not $x12)))\n(and true $x15))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Predicate input_0 <= 0 is the complement of input_0 > 0", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(let (($x15 (not $x12)))\n(= $x12 $x15))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 0 blocks input_0 > 0", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(let (($x15 (not $x12)))\n(let (($x150 (and true (not $x15))))\n(and $x150 $x15)))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 1 blocks input_0 <= 0", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(let (($x15 (not $x12)))\n(let (($x149 (and true $x15)))\n(and $x149 $x12)))))\n(check-sat)\n" } ], "reductions": [ { "formula": "input_0 <= 0", "relation": "complement", "representative": "input_0 > 0" } ] }, "reportedCore": [ "edge_6", "edge_10" ], "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n (not $x12)))\n(assert\n (bvsle input_0 (_ bv0 32)))\n(check-sat)\n", "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 5, "from": 7, "to": 8, "valuation": 0 }, { "edge": 6, "from": 8, "to": 9, "valuation": 0 }, { "edge": 7, "from": 8, "to": 10, "valuation": 0 }, { "edge": 8, "from": 9, "to": 11, "valuation": 0 }, { "edge": 9, "from": 10, "to": 12, "valuation": 0 }, { "edge": 10, "from": 11, "to": 13, "valuation": 0 }, { "edge": 11, "from": 11, "to": 15, "valuation": 0 }, { "edge": 12, "from": 12, "to": 16, "valuation": 0 }, { "edge": 13, "from": 12, "to": 17, "valuation": 0 }, { "edge": 16, "from": 15, "to": 10, "valuation": 0 }, { "edge": 17, "from": 16, "to": 19, "valuation": 0 }, { "edge": 18, "from": 17, "to": 2, "valuation": 0 }, { "edge": 20, "from": 19, "to": 20, "valuation": 0 }, { "edge": 21, "from": 19, "to": 22, "valuation": 0 }, { "edge": 24, "from": 22, "to": 17, "valuation": 0 } ], "z3Response": "unsat\n(edge_6 edge_10)", "z3Session": "(set-option :produce-unsat-cores true)\n(set-option :timeout 5000)\n; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(declare-fun edge_6 () Bool)\n(declare-fun edge_10 () Bool)\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n (let (($x15 (not $x12)))\n (=> edge_6 $x15))))\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n(=> edge_10 $x12)))\n(check-sat-assuming (edge_6 edge_10))\n(get-unsat-core)\n" }, { "blocked": [ { "edge": 6, "valuation": 0 }, { "edge": 7, "valuation": 1 }, { "edge": 10, "valuation": 1 } ], "constraints": [ { "edge": 7, "formula": "not (input_0 > 0)", "smt": "(bvsle input_0 #x00000000)" }, { "edge": 12, "formula": "input_1 > 10", "smt": "(not (bvsle input_1 #x0000000a))" }, { "edge": 20, "formula": "input_1 <= 10", "smt": "(bvsle input_1 #x0000000a)" } ], "core": [ "edge_12", "edge_20" ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 3, "valuation": 0 }, { "node": 3, "valuation": 1 }, { "node": 4, "valuation": 0 }, { "node": 4, "valuation": 1 }, { "node": 5, "valuation": 0 }, { "node": 5, "valuation": 1 }, { "node": 6, "valuation": 0 }, { "node": 6, "valuation": 1 }, { "node": 7, "valuation": 0 }, { "node": 7, "valuation": 1 }, { "node": 8, "valuation": 0 }, { "node": 8, "valuation": 1 }, { "node": 10, "valuation": 0 }, { "node": 9, "valuation": 1 }, { "node": 12, "valuation": 0 }, { "node": 11, "valuation": 1 }, { "node": 16, "valuation": 0 }, { "node": 17, "valuation": 0 }, { "node": 15, "valuation": 1 }, { "node": 19, "valuation": 0 }, { "node": 2, "valuation": 0 }, { "node": 10, "valuation": 1 }, { "node": 20, "valuation": 0 }, { "node": 22, "valuation": 0 }, { "node": 12, "valuation": 1 }, { "node": 16, "valuation": 1 }, { "node": 17, "valuation": 1 }, { "node": 19, "valuation": 1 }, { "node": 2, "valuation": 1 }, { "node": 20, "valuation": 1 }, { "node": 22, "valuation": 1 } ], "index": 1, "initialStates": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 } ], "learned": "input_1 > 10", "learnedPredicates": [ "input_1 > 10" ], "modelComplete": true, "outcome": "unsat", "path": [ 0, 1, 2, 3, 4, 5, 7, 9, 12, 17, 20 ], "pathEliminated": true, "pathValuation": 0, "predicates": [ "input_0 > 0" ], "refinement": { "added": [ { "edge": 12, "formula": "input_1 > 10", "smt": "(not (bvsle input_1 #x0000000a))" } ], "core": [ { "edge": 12, "formula": "input_1 > 10" }, { "edge": 20, "formula": "input_1 <= 10" } ], "coreMinimal": true, "coverage": [ { "blockedEdge": 12, "infeasible": false, "valuation": 0 }, { "blockedEdge": 12, "infeasible": false, "valuation": 1 }, { "blockedEdge": 20, "infeasible": false, "valuation": 2 }, { "blockedEdge": 20, "infeasible": false, "valuation": 3 } ], "ignored": [ { "edge": 7, "formula": "not (input_0 > 0)" } ], "method": "smt-unsat-core", "obligations": [ { "expected": "unsat", "purpose": "The selected core is inconsistent", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(and (and true (not $x17)) $x17)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_1 > 10 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(and true $x17)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_1 <= 10 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(let (($x20 (not $x17)))\n(and true $x20))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Predicate input_1 <= 10 is the complement of input_1 > 10", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(let (($x20 (not $x17)))\n(= $x17 $x20))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 0 blocks input_1 > 10", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(let (($x20 (not $x17)))\n(let (($x249 (and (and true (not (not (bvsle input_0 (_ bv0 32))))) (not $x20))))\n(and $x249 $x20)))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 1 blocks input_1 > 10", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(let (($x20 (not $x17)))\n(let (($x239 (and (and true (not (bvsle input_0 (_ bv0 32)))) (not $x20))))\n(and $x239 $x20)))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 2 blocks input_1 <= 10", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(let (($x20 (not $x17)))\n(let (($x254 (and (and true (not (not (bvsle input_0 (_ bv0 32))))) $x20)))\n(and $x254 $x17)))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 3 blocks input_1 <= 10", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(let (($x20 (not $x17)))\n(let (($x244 (and (and true (not (bvsle input_0 (_ bv0 32)))) $x20)))\n(and $x244 $x17)))))\n(check-sat)\n" } ], "reductions": [ { "formula": "input_1 <= 10", "relation": "complement", "representative": "input_1 > 10" } ] }, "reportedCore": [ "edge_20", "edge_12" ], "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(declare-fun input_1 () (_ BitVec 32))\n(assert\n (bvsle input_0 (_ bv0 32)))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n (not $x17)))\n(assert\n (bvsle input_1 (_ bv10 32)))\n(check-sat)\n", "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 0, "from": 1, "to": 3, "valuation": 1 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 1 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 1 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 1 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 1 }, { "edge": 5, "from": 7, "to": 8, "valuation": 0 }, { "edge": 5, "from": 7, "to": 8, "valuation": 1 }, { "edge": 7, "from": 8, "to": 10, "valuation": 0 }, { "edge": 6, "from": 8, "to": 9, "valuation": 1 }, { "edge": 9, "from": 10, "to": 12, "valuation": 0 }, { "edge": 8, "from": 9, "to": 11, "valuation": 1 }, { "edge": 12, "from": 12, "to": 16, "valuation": 0 }, { "edge": 13, "from": 12, "to": 17, "valuation": 0 }, { "edge": 11, "from": 11, "to": 15, "valuation": 1 }, { "edge": 17, "from": 16, "to": 19, "valuation": 0 }, { "edge": 18, "from": 17, "to": 2, "valuation": 0 }, { "edge": 16, "from": 15, "to": 10, "valuation": 1 }, { "edge": 20, "from": 19, "to": 20, "valuation": 0 }, { "edge": 21, "from": 19, "to": 22, "valuation": 0 }, { "edge": 9, "from": 10, "to": 12, "valuation": 1 }, { "edge": 24, "from": 22, "to": 17, "valuation": 0 }, { "edge": 12, "from": 12, "to": 16, "valuation": 1 }, { "edge": 13, "from": 12, "to": 17, "valuation": 1 }, { "edge": 17, "from": 16, "to": 19, "valuation": 1 }, { "edge": 18, "from": 17, "to": 2, "valuation": 1 }, { "edge": 20, "from": 19, "to": 20, "valuation": 1 }, { "edge": 21, "from": 19, "to": 22, "valuation": 1 }, { "edge": 24, "from": 22, "to": 17, "valuation": 1 } ], "z3Response": "unsat\n(edge_20 edge_12)", "z3Session": "(set-option :produce-unsat-cores true)\n(set-option :timeout 5000)\n; \n(set-info :status unknown)\n(declare-fun input_0 () (_ BitVec 32))\n(declare-fun edge_7 () Bool)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun edge_12 () Bool)\n(declare-fun edge_20 () Bool)\n(assert\n (let (($x12 (bvsle input_0 (_ bv0 32))))\n (=> edge_7 $x12)))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n (let (($x20 (not $x17)))\n (=> edge_12 $x20))))\n(assert\n (let (($x17 (bvsle input_1 (_ bv10 32))))\n(=> edge_20 $x17)))\n(check-sat-assuming (edge_7 edge_12 edge_20))\n(get-unsat-core)\n" }, { "blocked": [ { "edge": 6, "valuation": 0 }, { "edge": 7, "valuation": 1 }, { "edge": 6, "valuation": 2 }, { "edge": 7, "valuation": 3 }, { "edge": 12, "valuation": 0 }, { "edge": 10, "valuation": 1 }, { "edge": 13, "valuation": 2 }, { "edge": 10, "valuation": 3 }, { "edge": 20, "valuation": 2 }, { "edge": 12, "valuation": 1 }, { "edge": 13, "valuation": 3 }, { "edge": 20, "valuation": 3 } ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 1, "valuation": 2 }, { "node": 1, "valuation": 3 }, { "node": 3, "valuation": 0 }, { "node": 3, "valuation": 1 }, { "node": 3, "valuation": 2 }, { "node": 3, "valuation": 3 }, { "node": 4, "valuation": 0 }, { "node": 4, "valuation": 1 }, { "node": 4, "valuation": 2 }, { "node": 4, "valuation": 3 }, { "node": 5, "valuation": 0 }, { "node": 5, "valuation": 1 }, { "node": 5, "valuation": 2 }, { "node": 5, "valuation": 3 }, { "node": 6, "valuation": 0 }, { "node": 6, "valuation": 1 }, { "node": 6, "valuation": 2 }, { "node": 6, "valuation": 3 }, { "node": 7, "valuation": 0 }, { "node": 7, "valuation": 1 }, { "node": 7, "valuation": 2 }, { "node": 7, "valuation": 3 }, { "node": 8, "valuation": 0 }, { "node": 8, "valuation": 1 }, { "node": 8, "valuation": 2 }, { "node": 8, "valuation": 3 }, { "node": 10, "valuation": 0 }, { "node": 9, "valuation": 1 }, { "node": 10, "valuation": 2 }, { "node": 9, "valuation": 3 }, { "node": 12, "valuation": 0 }, { "node": 11, "valuation": 1 }, { "node": 12, "valuation": 2 }, { "node": 11, "valuation": 3 }, { "node": 17, "valuation": 0 }, { "node": 15, "valuation": 1 }, { "node": 16, "valuation": 2 }, { "node": 15, "valuation": 3 }, { "node": 2, "valuation": 0 }, { "node": 10, "valuation": 1 }, { "node": 19, "valuation": 2 }, { "node": 10, "valuation": 3 }, { "node": 12, "valuation": 1 }, { "node": 22, "valuation": 2 }, { "node": 12, "valuation": 3 }, { "node": 17, "valuation": 1 }, { "node": 17, "valuation": 2 }, { "node": 16, "valuation": 3 }, { "node": 2, "valuation": 1 }, { "node": 2, "valuation": 2 }, { "node": 19, "valuation": 3 }, { "node": 22, "valuation": 3 }, { "node": 17, "valuation": 3 }, { "node": 2, "valuation": 3 } ], "index": 2, "initialStates": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 1, "valuation": 2 }, { "node": 1, "valuation": 3 } ], "modelComplete": true, "outcome": "safe", "predicates": [ "input_0 > 0", "input_1 > 10" ], "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 0, "from": 1, "to": 3, "valuation": 1 }, { "edge": 0, "from": 1, "to": 3, "valuation": 2 }, { "edge": 0, "from": 1, "to": 3, "valuation": 3 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 1 }, { "edge": 1, "from": 3, "to": 4, "valuation": 2 }, { "edge": 1, "from": 3, "to": 4, "valuation": 3 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 1 }, { "edge": 2, "from": 4, "to": 5, "valuation": 2 }, { "edge": 2, "from": 4, "to": 5, "valuation": 3 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 1 }, { "edge": 3, "from": 5, "to": 6, "valuation": 2 }, { "edge": 3, "from": 5, "to": 6, "valuation": 3 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 1 }, { "edge": 4, "from": 6, "to": 7, "valuation": 2 }, { "edge": 4, "from": 6, "to": 7, "valuation": 3 }, { "edge": 5, "from": 7, "to": 8, "valuation": 0 }, { "edge": 5, "from": 7, "to": 8, "valuation": 1 }, { "edge": 5, "from": 7, "to": 8, "valuation": 2 }, { "edge": 5, "from": 7, "to": 8, "valuation": 3 }, { "edge": 7, "from": 8, "to": 10, "valuation": 0 }, { "edge": 6, "from": 8, "to": 9, "valuation": 1 }, { "edge": 7, "from": 8, "to": 10, "valuation": 2 }, { "edge": 6, "from": 8, "to": 9, "valuation": 3 }, { "edge": 9, "from": 10, "to": 12, "valuation": 0 }, { "edge": 8, "from": 9, "to": 11, "valuation": 1 }, { "edge": 9, "from": 10, "to": 12, "valuation": 2 }, { "edge": 8, "from": 9, "to": 11, "valuation": 3 }, { "edge": 13, "from": 12, "to": 17, "valuation": 0 }, { "edge": 11, "from": 11, "to": 15, "valuation": 1 }, { "edge": 12, "from": 12, "to": 16, "valuation": 2 }, { "edge": 11, "from": 11, "to": 15, "valuation": 3 }, { "edge": 18, "from": 17, "to": 2, "valuation": 0 }, { "edge": 16, "from": 15, "to": 10, "valuation": 1 }, { "edge": 17, "from": 16, "to": 19, "valuation": 2 }, { "edge": 16, "from": 15, "to": 10, "valuation": 3 }, { "edge": 9, "from": 10, "to": 12, "valuation": 1 }, { "edge": 21, "from": 19, "to": 22, "valuation": 2 }, { "edge": 9, "from": 10, "to": 12, "valuation": 3 }, { "edge": 13, "from": 12, "to": 17, "valuation": 1 }, { "edge": 24, "from": 22, "to": 17, "valuation": 2 }, { "edge": 12, "from": 12, "to": 16, "valuation": 3 }, { "edge": 18, "from": 17, "to": 2, "valuation": 1 }, { "edge": 18, "from": 17, "to": 2, "valuation": 2 }, { "edge": 17, "from": 16, "to": 19, "valuation": 3 }, { "edge": 21, "from": 19, "to": 22, "valuation": 3 }, { "edge": 24, "from": 22, "to": 17, "valuation": 3 }, { "edge": 18, "from": 17, "to": 2, "valuation": 3 } ] } ], "solverQueries": 170, "source": "extern int nondet_int(void);\nextern void ERROR(void);\n\nint main(void) {\n int x = nondet_int();\n int y = nondet_int();\n if (x > 0) {\n if (x <= 0) ERROR();\n }\n if (y > 10) {\n if (y <= 10) ERROR();\n }\n return 0;\n}\n", "sourceFile": "examples/two-refinements.c", "verdict": "SAFE", "z3Version": "4.15.4.0", "id": "two-refinements", "title": "Learn one fact at a time", "subtitle": "Two independent contradictions need two refinements.", "llvm": "; ModuleID = 'build/two-refinements.bc'\nsource_filename = \"examples/two-refinements.c\"\ntarget datalayout = \"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128\"\ntarget triple = \"x86_64-unknown-linux-gnu\"\n\n; Function Attrs: noinline nounwind uwtable\ndefine dso_local i32 @main() #0 !dbg !10 {\nentry:\n %call = call i32 @nondet_int(), !dbg !15\n #dbg_value(i32 %call, !16, !DIExpression(), !17)\n %call1 = call i32 @nondet_int(), !dbg !18\n #dbg_value(i32 %call1, !19, !DIExpression(), !17)\n %cmp = icmp sgt i32 %call, 0, !dbg !20\n br i1 %cmp, label %if.then, label %if.end4, !dbg !20\n\nif.then: ; preds = %entry\n %cmp2 = icmp sle i32 %call, 0, !dbg !22\n br i1 %cmp2, label %if.then3, label %if.end, !dbg !22\n\nif.then3: ; preds = %if.then\n call void @ERROR(), !dbg !25\n br label %if.end, !dbg !25\n\nif.end: ; preds = %if.then3, %if.then\n br label %if.end4, !dbg !26\n\nif.end4: ; preds = %if.end, %entry\n %cmp5 = icmp sgt i32 %call1, 10, !dbg !27\n br i1 %cmp5, label %if.then6, label %if.end10, !dbg !27\n\nif.then6: ; preds = %if.end4\n %cmp7 = icmp sle i32 %call1, 10, !dbg !29\n br i1 %cmp7, label %if.then8, label %if.end9, !dbg !29\n\nif.then8: ; preds = %if.then6\n call void @ERROR(), !dbg !32\n br label %if.end9, !dbg !32\n\nif.end9: ; preds = %if.then8, %if.then6\n br label %if.end10, !dbg !33\n\nif.end10: ; preds = %if.end9, %if.end4\n ret i32 0, !dbg !34\n}\n\ndeclare i32 @nondet_int() #1\n\ndeclare void @ERROR() #1\n\nattributes #0 = { noinline nounwind uwtable \"frame-pointer\"=\"all\" \"min-legal-vector-width\"=\"0\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\nattributes #1 = { \"frame-pointer\"=\"all\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\n\n!llvm.dbg.cu = !{!0}\n!llvm.module.flags = !{!2, !3, !4, !5, !6, !7, !8}\n!llvm.ident = !{!9}\n\n!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, producer: \"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, splitDebugInlining: false, nameTableKind: None)\n!1 = !DIFile(filename: \"examples/two-refinements.c\", directory: \"/app\", checksumkind: CSK_MD5, checksum: \"b3a59a2fbcb91e66319655a55562ec43\")\n!2 = !{i32 7, !\"Dwarf Version\", i32 5}\n!3 = !{i32 2, !\"Debug Info Version\", i32 3}\n!4 = !{i32 1, !\"wchar_size\", i32 4}\n!5 = !{i32 8, !\"PIC Level\", i32 2}\n!6 = !{i32 7, !\"PIE Level\", i32 2}\n!7 = !{i32 7, !\"uwtable\", i32 2}\n!8 = !{i32 7, !\"frame-pointer\", i32 2}\n!9 = !{!\"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\"}\n!10 = distinct !DISubprogram(name: \"main\", scope: !1, file: !1, line: 4, type: !11, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !14)\n!11 = !DISubroutineType(types: !12)\n!12 = !{!13}\n!13 = !DIBasicType(name: \"int\", size: 32, encoding: DW_ATE_signed)\n!14 = !{}\n!15 = !DILocation(line: 5, column: 13, scope: !10)\n!16 = !DILocalVariable(name: \"x\", scope: !10, file: !1, line: 5, type: !13)\n!17 = !DILocation(line: 0, scope: !10)\n!18 = !DILocation(line: 6, column: 13, scope: !10)\n!19 = !DILocalVariable(name: \"y\", scope: !10, file: !1, line: 6, type: !13)\n!20 = !DILocation(line: 7, column: 11, scope: !21)\n!21 = distinct !DILexicalBlock(scope: !10, file: !1, line: 7, column: 9)\n!22 = !DILocation(line: 8, column: 15, scope: !23)\n!23 = distinct !DILexicalBlock(scope: !24, file: !1, line: 8, column: 13)\n!24 = distinct !DILexicalBlock(scope: !21, file: !1, line: 7, column: 16)\n!25 = !DILocation(line: 8, column: 21, scope: !23)\n!26 = !DILocation(line: 9, column: 5, scope: !24)\n!27 = !DILocation(line: 10, column: 11, scope: !28)\n!28 = distinct !DILexicalBlock(scope: !10, file: !1, line: 10, column: 9)\n!29 = !DILocation(line: 11, column: 15, scope: !30)\n!30 = distinct !DILexicalBlock(scope: !31, file: !1, line: 11, column: 13)\n!31 = distinct !DILexicalBlock(scope: !28, file: !1, line: 10, column: 17)\n!32 = !DILocation(line: 11, column: 22, scope: !30)\n!33 = !DILocation(line: 12, column: 5, scope: !31)\n!34 = !DILocation(line: 13, column: 5, scope: !10)\n" }, { "edges": [ { "formula": "true", "from": 1, "id": 0, "label": "", "smt": "true", "to": 3 }, { "formula": "true", "from": 3, "id": 1, "label": "", "smt": "true", "to": 4 }, { "formula": "true", "from": 4, "id": 2, "label": "", "smt": "true", "to": 5 }, { "formula": "true", "from": 5, "id": 3, "label": "", "smt": "true", "to": 6 }, { "formula": "true", "from": 6, "id": 4, "label": "", "smt": "true", "to": 7 }, { "formula": "true", "from": 7, "id": 5, "label": "", "smt": "true", "to": 8 }, { "formula": "input_0 > input_1", "from": 8, "id": 6, "label": "true", "smt": "(not (bvsle input_0 input_1))", "to": 9 }, { "formula": "not (input_0 > input_1)", "from": 8, "id": 7, "label": "false", "smt": "(bvsle input_0 input_1)", "to": 10 }, { "formula": "true", "from": 9, "id": 8, "label": "", "smt": "true", "to": 11 }, { "formula": "true", "from": 10, "id": 9, "label": "", "smt": "true", "to": 2 }, { "formula": "input_0 <= input_1", "from": 11, "id": 10, "label": "true", "smt": "(bvsle input_0 input_1)", "to": 12 }, { "formula": "not (input_0 <= input_1)", "from": 11, "id": 11, "label": "false", "smt": "(not (bvsle input_0 input_1))", "to": 14 }, { "formula": "true", "from": 12, "id": 12, "label": "", "smt": "true", "to": 13 }, { "formula": "true", "from": 13, "id": 13, "label": "", "smt": "true", "to": 15 }, { "formula": "true", "from": 14, "id": 14, "label": "", "smt": "true", "to": 10 }, { "formula": "true", "from": 15, "id": 15, "label": "", "smt": "true", "to": 14 } ], "engine": "SVF 3.4 + LLVM 21 + Z3; immutable-input predicate abstraction", "entry": 1, "inputs": [ { "name": "input_0", "node": 3 }, { "name": "input_1", "node": 5 } ], "nodes": [ { "id": 1, "kind": "entry", "line": 0, "raw": "FunEntryICFGNode1 {fun: main{ \"ln\": 4, \"file\": \"examples/relational.c\" }}", "statements": [] }, { "id": 2, "kind": "exit", "line": 0, "raw": "FunExitICFGNode2 {fun: main{ \"ln\": 12, \"cl\": 5, \"fl\": \"examples/relational.c\" }}\nPhiStmt: [Var6 <-- ([Var21, ICFGNode10],)]\t\nValVar ID: 20\n ret i32 0, !dbg !29 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/relational.c\" }", "statements": [ "PhiStmt: [Var6 <-- ([Var21, ICFGNode10],)]\t\nValVar ID: 20\n ret i32 0, !dbg !29 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/relational.c\" }" ] }, { "id": 3, "kind": "input", "line": 5, "raw": "CallICFGNode3 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/relational.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 CallICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 4, "kind": "instruction", "line": 5, "raw": "RetICFGNode4 {fun: main{ \"ln\": 5, \"cl\": 13, \"fl\": \"examples/relational.c\" }}\n %call = call i32 @nondet_int(), !dbg !15 RetICFGNode: { \"ln\": 5, \"cl\": 13, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 5, "kind": "input", "line": 6, "raw": "CallICFGNode5 {fun: main{ \"ln\": 6, \"cl\": 13, \"fl\": \"examples/relational.c\" }}\n %call1 = call i32 @nondet_int(), !dbg !18 CallICFGNode: { \"ln\": 6, \"cl\": 13, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 6, "kind": "instruction", "line": 6, "raw": "RetICFGNode6 {fun: main{ \"ln\": 6, \"cl\": 13, \"fl\": \"examples/relational.c\" }}\n %call1 = call i32 @nondet_int(), !dbg !18 RetICFGNode: { \"ln\": 6, \"cl\": 13, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 7, "kind": "instruction", "line": 7, "raw": "IntraICFGNode7 {fun: main{ \"ln\": 7, \"cl\": 11, \"fl\": \"examples/relational.c\" }}\nCmpStmt: [Var11 <-- (Var7 predicate38 Var10)]\t\nValVar ID: 11\n %cmp = icmp sgt i32 %call, %call1, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/relational.c\" }", "statements": [ "CmpStmt: [Var11 <-- (Var7 predicate38 Var10)]\t\nValVar ID: 11\n %cmp = icmp sgt i32 %call, %call1, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/relational.c\" }" ] }, { "id": 8, "kind": "instruction", "line": 7, "raw": "IntraICFGNode8 {fun: main{ \"ln\": 7, \"cl\": 11, \"fl\": \"examples/relational.c\" }}\nBranchStmt: [Condition Var11]\nSuccessor 0 ICFGNode9 Successor 1 ICFGNode10 \nValVar ID: 12\n br i1 %cmp, label %if.then, label %if.end4, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/relational.c\" }", "statements": [ "BranchStmt: [Condition Var11]\nSuccessor 0 ICFGNode9 Successor 1 ICFGNode10 \nValVar ID: 12\n br i1 %cmp, label %if.then, label %if.end4, !dbg !20 { \"ln\": 7, \"cl\": 11, \"fl\": \"examples/relational.c\" }" ] }, { "id": 9, "kind": "instruction", "line": 8, "raw": "IntraICFGNode9 {fun: main{ \"ln\": 8, \"cl\": 15, \"fl\": \"examples/relational.c\" }}\nCmpStmt: [Var13 <-- (Var7 predicate41 Var10)]\t\nValVar ID: 13\n %cmp2 = icmp sle i32 %call, %call1, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/relational.c\" }", "statements": [ "CmpStmt: [Var13 <-- (Var7 predicate41 Var10)]\t\nValVar ID: 13\n %cmp2 = icmp sle i32 %call, %call1, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/relational.c\" }" ] }, { "id": 10, "kind": "instruction", "line": 12, "raw": "IntraICFGNode10 {fun: main{ \"ln\": 12, \"cl\": 5, \"fl\": \"examples/relational.c\" }}\n ret i32 0, !dbg !29 { \"ln\": 12, \"cl\": 5, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 11, "kind": "instruction", "line": 8, "raw": "IntraICFGNode11 {fun: main{ \"ln\": 8, \"cl\": 15, \"fl\": \"examples/relational.c\" }}\nBranchStmt: [Condition Var13]\nSuccessor 0 ICFGNode12 Successor 1 ICFGNode14 \nValVar ID: 14\n br i1 %cmp2, label %if.then3, label %if.end, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/relational.c\" }", "statements": [ "BranchStmt: [Condition Var13]\nSuccessor 0 ICFGNode12 Successor 1 ICFGNode14 \nValVar ID: 14\n br i1 %cmp2, label %if.then3, label %if.end, !dbg !22 { \"ln\": 8, \"cl\": 15, \"fl\": \"examples/relational.c\" }" ] }, { "id": 12, "kind": "error", "line": 9, "raw": "CallICFGNode12 {fun: main{ \"ln\": 9, \"cl\": 13, \"fl\": \"examples/relational.c\" }}\n call void @ERROR(), !dbg !25 CallICFGNode: { \"ln\": 9, \"cl\": 13, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 13, "kind": "instruction", "line": 9, "raw": "RetICFGNode13 {fun: main{ \"ln\": 9, \"cl\": 13, \"fl\": \"examples/relational.c\" }}\n call void @ERROR(), !dbg !25 RetICFGNode: { \"ln\": 9, \"cl\": 13, \"fl\": \"examples/relational.c\" }", "statements": [] }, { "id": 14, "kind": "instruction", "line": 11, "raw": "IntraICFGNode14 {fun: main{ \"ln\": 11, \"cl\": 5, \"fl\": \"examples/relational.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode10 \nValVar ID: 19\n br label %if.end4, !dbg !28 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/relational.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode10 \nValVar ID: 19\n br label %if.end4, !dbg !28 { \"ln\": 11, \"cl\": 5, \"fl\": \"examples/relational.c\" }" ] }, { "id": 15, "kind": "instruction", "line": 10, "raw": "IntraICFGNode15 {fun: main{ \"ln\": 10, \"cl\": 9, \"fl\": \"examples/relational.c\" }}\nBranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode14 \nValVar ID: 18\n br label %if.end, !dbg !27 { \"ln\": 10, \"cl\": 9, \"fl\": \"examples/relational.c\" }", "statements": [ "BranchStmt: [ Unconditional branch]\nSuccessor 0 ICFGNode14 \nValVar ID: 18\n br label %if.end, !dbg !27 { \"ln\": 10, \"cl\": 9, \"fl\": \"examples/relational.c\" }" ] } ], "reason": "Complete abstract exploration found no reachable ERROR in the supported bit-vector model", "rounds": [ { "blocked": [], "constraints": [ { "edge": 6, "formula": "input_0 > input_1", "smt": "(not (bvsle input_0 input_1))" }, { "edge": 10, "formula": "input_0 <= input_1", "smt": "(bvsle input_0 input_1)" } ], "core": [ "edge_6", "edge_10" ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 3, "valuation": 0 }, { "node": 4, "valuation": 0 }, { "node": 5, "valuation": 0 }, { "node": 6, "valuation": 0 }, { "node": 7, "valuation": 0 }, { "node": 8, "valuation": 0 }, { "node": 9, "valuation": 0 }, { "node": 10, "valuation": 0 }, { "node": 11, "valuation": 0 }, { "node": 2, "valuation": 0 }, { "node": 12, "valuation": 0 }, { "node": 14, "valuation": 0 } ], "index": 0, "initialStates": [ { "node": 1, "valuation": 0 } ], "learned": "input_0 > input_1", "learnedPredicates": [ "input_0 > input_1" ], "modelComplete": true, "outcome": "unsat", "path": [ 0, 1, 2, 3, 4, 5, 6, 8, 10 ], "pathEliminated": true, "pathValuation": 0, "predicates": [], "refinement": { "added": [ { "edge": 6, "formula": "input_0 > input_1", "smt": "(not (bvsle input_0 input_1))" } ], "core": [ { "edge": 6, "formula": "input_0 > input_1" }, { "edge": 10, "formula": "input_0 <= input_1" } ], "coreMinimal": true, "coverage": [ { "blockedEdge": 6, "infeasible": false, "valuation": 0 }, { "blockedEdge": 10, "infeasible": false, "valuation": 1 } ], "ignored": [], "method": "smt-unsat-core", "obligations": [ { "expected": "unsat", "purpose": "The selected core is inconsistent", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(and (and true (not $x11)) $x11)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 > input_1 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(and true $x11)))\n(check-sat)\n" }, { "expected": "sat", "purpose": "Removing core constraint input_0 <= input_1 restores satisfiability", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(let (($x14 (not $x11)))\n(and true $x14))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Predicate input_0 <= input_1 is the complement of input_0 > input_1", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(let (($x14 (not $x11)))\n(= $x11 $x14))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 0 blocks input_0 > input_1", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(let (($x14 (not $x11)))\n(let (($x278 (and true (not $x14))))\n(and $x278 $x14)))))\n(check-sat)\n" }, { "expected": "unsat", "purpose": "Refined valuation 1 blocks input_0 <= input_1", "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(let (($x14 (not $x11)))\n(let (($x277 (and true $x14)))\n(and $x277 $x11)))))\n(check-sat)\n" } ], "reductions": [ { "formula": "input_0 <= input_1", "relation": "complement", "representative": "input_0 > input_1" } ] }, "reportedCore": [ "edge_10", "edge_6" ], "smtlib": "; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n (not $x11)))\n(assert\n (bvsle input_0 input_1))\n(check-sat)\n", "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 5, "from": 7, "to": 8, "valuation": 0 }, { "edge": 6, "from": 8, "to": 9, "valuation": 0 }, { "edge": 7, "from": 8, "to": 10, "valuation": 0 }, { "edge": 8, "from": 9, "to": 11, "valuation": 0 }, { "edge": 9, "from": 10, "to": 2, "valuation": 0 }, { "edge": 10, "from": 11, "to": 12, "valuation": 0 }, { "edge": 11, "from": 11, "to": 14, "valuation": 0 }, { "edge": 14, "from": 14, "to": 10, "valuation": 0 } ], "z3Response": "unsat\n(edge_10 edge_6)", "z3Session": "(set-option :produce-unsat-cores true)\n(set-option :timeout 5000)\n; \n(set-info :status unknown)\n(declare-fun input_1 () (_ BitVec 32))\n(declare-fun input_0 () (_ BitVec 32))\n(declare-fun edge_6 () Bool)\n(declare-fun edge_10 () Bool)\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n (let (($x14 (not $x11)))\n (=> edge_6 $x14))))\n(assert\n (let (($x11 (bvsle input_0 input_1)))\n(=> edge_10 $x11)))\n(check-sat-assuming (edge_6 edge_10))\n(get-unsat-core)\n" }, { "blocked": [ { "edge": 6, "valuation": 0 }, { "edge": 7, "valuation": 1 }, { "edge": 10, "valuation": 1 } ], "explored": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 }, { "node": 3, "valuation": 0 }, { "node": 3, "valuation": 1 }, { "node": 4, "valuation": 0 }, { "node": 4, "valuation": 1 }, { "node": 5, "valuation": 0 }, { "node": 5, "valuation": 1 }, { "node": 6, "valuation": 0 }, { "node": 6, "valuation": 1 }, { "node": 7, "valuation": 0 }, { "node": 7, "valuation": 1 }, { "node": 8, "valuation": 0 }, { "node": 8, "valuation": 1 }, { "node": 10, "valuation": 0 }, { "node": 9, "valuation": 1 }, { "node": 2, "valuation": 0 }, { "node": 11, "valuation": 1 }, { "node": 14, "valuation": 1 }, { "node": 10, "valuation": 1 }, { "node": 2, "valuation": 1 } ], "index": 1, "initialStates": [ { "node": 1, "valuation": 0 }, { "node": 1, "valuation": 1 } ], "modelComplete": true, "outcome": "safe", "predicates": [ "input_0 > input_1" ], "transitions": [ { "edge": 0, "from": 1, "to": 3, "valuation": 0 }, { "edge": 0, "from": 1, "to": 3, "valuation": 1 }, { "edge": 1, "from": 3, "to": 4, "valuation": 0 }, { "edge": 1, "from": 3, "to": 4, "valuation": 1 }, { "edge": 2, "from": 4, "to": 5, "valuation": 0 }, { "edge": 2, "from": 4, "to": 5, "valuation": 1 }, { "edge": 3, "from": 5, "to": 6, "valuation": 0 }, { "edge": 3, "from": 5, "to": 6, "valuation": 1 }, { "edge": 4, "from": 6, "to": 7, "valuation": 0 }, { "edge": 4, "from": 6, "to": 7, "valuation": 1 }, { "edge": 5, "from": 7, "to": 8, "valuation": 0 }, { "edge": 5, "from": 7, "to": 8, "valuation": 1 }, { "edge": 7, "from": 8, "to": 10, "valuation": 0 }, { "edge": 6, "from": 8, "to": 9, "valuation": 1 }, { "edge": 9, "from": 10, "to": 2, "valuation": 0 }, { "edge": 8, "from": 9, "to": 11, "valuation": 1 }, { "edge": 11, "from": 11, "to": 14, "valuation": 1 }, { "edge": 14, "from": 14, "to": 10, "valuation": 1 }, { "edge": 9, "from": 10, "to": 2, "valuation": 1 } ] } ], "solverQueries": 54, "source": "extern int nondet_int(void);\nextern void ERROR(void);\n\nint main(void) {\n int x = nondet_int();\n int y = nondet_int();\n if (x > y) {\n if (x <= y) {\n ERROR();\n }\n }\n return 0;\n}\n", "sourceFile": "examples/relational.c", "verdict": "SAFE", "z3Version": "4.15.4.0", "id": "relational", "title": "Remember a relation: x > y", "subtitle": "Two symbolic inputs; one relational predicate rules out the false alarm.", "llvm": "; ModuleID = 'build/relational.bc'\nsource_filename = \"examples/relational.c\"\ntarget datalayout = \"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128\"\ntarget triple = \"x86_64-unknown-linux-gnu\"\n\n; Function Attrs: noinline nounwind uwtable\ndefine dso_local i32 @main() #0 !dbg !10 {\nentry:\n %call = call i32 @nondet_int(), !dbg !15\n #dbg_value(i32 %call, !16, !DIExpression(), !17)\n %call1 = call i32 @nondet_int(), !dbg !18\n #dbg_value(i32 %call1, !19, !DIExpression(), !17)\n %cmp = icmp sgt i32 %call, %call1, !dbg !20\n br i1 %cmp, label %if.then, label %if.end4, !dbg !20\n\nif.then: ; preds = %entry\n %cmp2 = icmp sle i32 %call, %call1, !dbg !22\n br i1 %cmp2, label %if.then3, label %if.end, !dbg !22\n\nif.then3: ; preds = %if.then\n call void @ERROR(), !dbg !25\n br label %if.end, !dbg !27\n\nif.end: ; preds = %if.then3, %if.then\n br label %if.end4, !dbg !28\n\nif.end4: ; preds = %if.end, %entry\n ret i32 0, !dbg !29\n}\n\ndeclare i32 @nondet_int() #1\n\ndeclare void @ERROR() #1\n\nattributes #0 = { noinline nounwind uwtable \"frame-pointer\"=\"all\" \"min-legal-vector-width\"=\"0\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\nattributes #1 = { \"frame-pointer\"=\"all\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\n\n!llvm.dbg.cu = !{!0}\n!llvm.module.flags = !{!2, !3, !4, !5, !6, !7, !8}\n!llvm.ident = !{!9}\n\n!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, producer: \"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, splitDebugInlining: false, nameTableKind: None)\n!1 = !DIFile(filename: \"examples/relational.c\", directory: \"/app\", checksumkind: CSK_MD5, checksum: \"66dca3a30d31f802c9c77070c4d46b05\")\n!2 = !{i32 7, !\"Dwarf Version\", i32 5}\n!3 = !{i32 2, !\"Debug Info Version\", i32 3}\n!4 = !{i32 1, !\"wchar_size\", i32 4}\n!5 = !{i32 8, !\"PIC Level\", i32 2}\n!6 = !{i32 7, !\"PIE Level\", i32 2}\n!7 = !{i32 7, !\"uwtable\", i32 2}\n!8 = !{i32 7, !\"frame-pointer\", i32 2}\n!9 = !{!\"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\"}\n!10 = distinct !DISubprogram(name: \"main\", scope: !1, file: !1, line: 4, type: !11, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !14)\n!11 = !DISubroutineType(types: !12)\n!12 = !{!13}\n!13 = !DIBasicType(name: \"int\", size: 32, encoding: DW_ATE_signed)\n!14 = !{}\n!15 = !DILocation(line: 5, column: 13, scope: !10)\n!16 = !DILocalVariable(name: \"x\", scope: !10, file: !1, line: 5, type: !13)\n!17 = !DILocation(line: 0, scope: !10)\n!18 = !DILocation(line: 6, column: 13, scope: !10)\n!19 = !DILocalVariable(name: \"y\", scope: !10, file: !1, line: 6, type: !13)\n!20 = !DILocation(line: 7, column: 11, scope: !21)\n!21 = distinct !DILexicalBlock(scope: !10, file: !1, line: 7, column: 9)\n!22 = !DILocation(line: 8, column: 15, scope: !23)\n!23 = distinct !DILexicalBlock(scope: !24, file: !1, line: 8, column: 13)\n!24 = distinct !DILexicalBlock(scope: !21, file: !1, line: 7, column: 16)\n!25 = !DILocation(line: 9, column: 13, scope: !26)\n!26 = distinct !DILexicalBlock(scope: !23, file: !1, line: 8, column: 21)\n!27 = !DILocation(line: 10, column: 9, scope: !26)\n!28 = !DILocation(line: 11, column: 5, scope: !24)\n!29 = !DILocation(line: 12, column: 5, scope: !10)\n" }, { "engine": "SVF 3.4 + LLVM 21 + Z3; immutable-input predicate abstraction", "reason": "Unsupported instruction: phi. This prototype supports acyclic scalar programs without phi nodes or memory.", "rounds": [], "source": "extern int nondet_int(void);\nextern void ERROR(void);\n\nint main(void) {\n unsigned x = (unsigned)nondet_int();\n while (x > 0) x--;\n if (x != 0) ERROR();\n return 0;\n}\n", "sourceFile": "examples/unsupported-loop.c", "verdict": "UNKNOWN", "id": "unsupported-loop", "title": "Know the boundary", "subtitle": "A loop is outside this first prototype.", "llvm": "; ModuleID = 'build/unsupported-loop.bc'\nsource_filename = \"examples/unsupported-loop.c\"\ntarget datalayout = \"e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128\"\ntarget triple = \"x86_64-unknown-linux-gnu\"\n\n; Function Attrs: noinline nounwind uwtable\ndefine dso_local i32 @main() #0 !dbg !12 {\nentry:\n %call = call i32 @nondet_int(), !dbg !17\n #dbg_value(i32 %call, !18, !DIExpression(), !19)\n br label %while.cond, !dbg !20\n\nwhile.cond: ; preds = %while.body, %entry\n %x.0 = phi i32 [ %call, %entry ], [ %dec, %while.body ], !dbg !19\n #dbg_value(i32 %x.0, !18, !DIExpression(), !19)\n %cmp = icmp ugt i32 %x.0, 0, !dbg !21\n br i1 %cmp, label %while.body, label %while.end, !dbg !20\n\nwhile.body: ; preds = %while.cond\n %dec = add i32 %x.0, -1, !dbg !22\n #dbg_value(i32 %dec, !18, !DIExpression(), !19)\n br label %while.cond, !dbg !20, !llvm.loop !23\n\nwhile.end: ; preds = %while.cond\n %cmp1 = icmp ne i32 %x.0, 0, !dbg !25\n br i1 %cmp1, label %if.then, label %if.end, !dbg !25\n\nif.then: ; preds = %while.end\n call void @ERROR(), !dbg !27\n br label %if.end, !dbg !27\n\nif.end: ; preds = %if.then, %while.end\n ret i32 0, !dbg !28\n}\n\ndeclare i32 @nondet_int() #1\n\ndeclare void @ERROR() #1\n\nattributes #0 = { noinline nounwind uwtable \"frame-pointer\"=\"all\" \"min-legal-vector-width\"=\"0\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\nattributes #1 = { \"frame-pointer\"=\"all\" \"no-trapping-math\"=\"true\" \"stack-protector-buffer-size\"=\"8\" \"target-cpu\"=\"x86-64\" \"target-features\"=\"+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87\" \"tune-cpu\"=\"generic\" }\n\n!llvm.dbg.cu = !{!0}\n!llvm.module.flags = !{!4, !5, !6, !7, !8, !9, !10}\n!llvm.ident = !{!11}\n\n!0 = distinct !DICompileUnit(language: DW_LANG_C11, file: !1, producer: \"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, retainedTypes: !2, splitDebugInlining: false, nameTableKind: None)\n!1 = !DIFile(filename: \"examples/unsupported-loop.c\", directory: \"/app\", checksumkind: CSK_MD5, checksum: \"5b89d1684c1043405de29d0f53ce5207\")\n!2 = !{!3}\n!3 = !DIBasicType(name: \"unsigned int\", size: 32, encoding: DW_ATE_unsigned)\n!4 = !{i32 7, !\"Dwarf Version\", i32 5}\n!5 = !{i32 2, !\"Debug Info Version\", i32 3}\n!6 = !{i32 1, !\"wchar_size\", i32 4}\n!7 = !{i32 8, !\"PIC Level\", i32 2}\n!8 = !{i32 7, !\"PIE Level\", i32 2}\n!9 = !{i32 7, !\"uwtable\", i32 2}\n!10 = !{i32 7, !\"frame-pointer\", i32 2}\n!11 = !{!\"clang version 21.1.0 (https://github.com/bjjwwang/LLVM-compile 4f7056e8ada487923d1c8f9bc38df6472008eda3)\"}\n!12 = distinct !DISubprogram(name: \"main\", scope: !1, file: !1, line: 4, type: !13, scopeLine: 4, flags: DIFlagPrototyped, spFlags: DISPFlagDefinition, unit: !0, retainedNodes: !16)\n!13 = !DISubroutineType(types: !14)\n!14 = !{!15}\n!15 = !DIBasicType(name: \"int\", size: 32, encoding: DW_ATE_signed)\n!16 = !{}\n!17 = !DILocation(line: 5, column: 28, scope: !12)\n!18 = !DILocalVariable(name: \"x\", scope: !12, file: !1, line: 5, type: !3)\n!19 = !DILocation(line: 0, scope: !12)\n!20 = !DILocation(line: 6, column: 5, scope: !12)\n!21 = !DILocation(line: 6, column: 14, scope: !12)\n!22 = !DILocation(line: 6, column: 20, scope: !12)\n!23 = distinct !{!23, !20, !22, !24}\n!24 = !{!\"llvm.loop.mustprogress\"}\n!25 = !DILocation(line: 7, column: 11, scope: !26)\n!26 = distinct !DILexicalBlock(scope: !12, file: !1, line: 7, column: 9)\n!27 = !DILocation(line: 7, column: 17, scope: !26)\n!28 = !DILocation(line: 8, column: 5, scope: !12)\n" } ] }