Skip to content

Commit 7d8543f

Browse files
committed
--stop-on-fail now stops on failed path
When doing path exploration, one sometimes wants CBMC to halt symbolic execution as soon as it encounters a single bug, rather than continuing to explore the program for all bugs. This behaviour can now be enabled by passing the --stop-on-fail flag together with the --paths flag. Prior to this commit, the --stop-on-fail flag --- which was written with model-checking rather than path exploration in mind --- would explore all paths, but only print out a single failed property, which isn't terribly useful because it uses just as much time as printing out all properties. This commit makes this flag more useful when used in conjunction with --paths, while not changing its behaviour for model checking.
1 parent acaeb24 commit 7d8543f

File tree

2 files changed

+45
-0
lines changed

2 files changed

+45
-0
lines changed

src/cbmc/bmc.cpp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -588,6 +588,12 @@ int bmct::do_language_agnostic_bmc(
588588
if(driver_configure_bmc)
589589
driver_configure_bmc(bmc, symbol_table);
590590
tmp_result = bmc.run(model);
591+
592+
if(
593+
tmp_result == safety_checkert::resultt::UNSAFE &&
594+
opts.get_bool_option("stop-on-fail") && opts.is_set("paths"))
595+
return CPROVER_EXIT_VERIFICATION_UNSAFE;
596+
591597
if(tmp_result != safety_checkert::resultt::PAUSED)
592598
final_result = tmp_result;
593599
}
@@ -637,6 +643,12 @@ int bmct::do_language_agnostic_bmc(
637643
if(driver_configure_bmc)
638644
driver_configure_bmc(pe, symbol_table);
639645
tmp_result = pe.run(model);
646+
647+
if(
648+
tmp_result == safety_checkert::resultt::UNSAFE &&
649+
opts.get_bool_option("stop-on-fail") && opts.is_set("paths"))
650+
return CPROVER_EXIT_VERIFICATION_UNSAFE;
651+
640652
if(tmp_result != safety_checkert::resultt::PAUSED)
641653
final_result &= tmp_result;
642654
worklist->pop();

unit/path_strategies.cpp

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,39 @@ SCENARIO("path strategies")
223223
symex_eventt::resume(symex_eventt::enumt::JUMP, 9),
224224
symex_eventt::result(symex_eventt::enumt::FAILURE),
225225
});
226+
227+
GIVEN("program to check for stop-on-fail with path exploration")
228+
{
229+
std::function<void(optionst &)> halt_callback = [](optionst &opts) {
230+
opts.set_option("stop-on-fail", true);
231+
};
232+
std::function<void(optionst &)> no_halt_callback = [](optionst &opts) {};
233+
234+
c =
235+
"/* 1 */ int main() \n"
236+
"/* 2 */ { \n"
237+
"/* 3 */ int x, y; \n"
238+
"/* 4 */ if(x) \n"
239+
"/* 5 */ y = 5 / 0; \n"
240+
"/* 6 */ else \n"
241+
"/* 7 */ y = 5 / 0; \n"
242+
"/* 8 */ } \n";
243+
244+
check_with_strategy(
245+
"lifo",
246+
no_halt_callback,
247+
c,
248+
{symex_eventt::resume(symex_eventt::enumt::NEXT, 4),
249+
symex_eventt::result(symex_eventt::enumt::FAILURE),
250+
symex_eventt::resume(symex_eventt::enumt::NEXT, 6),
251+
symex_eventt::result(symex_eventt::enumt::FAILURE)});
252+
check_with_strategy(
253+
"lifo",
254+
halt_callback,
255+
c,
256+
{symex_eventt::resume(symex_eventt::enumt::NEXT, 4),
257+
symex_eventt::result(symex_eventt::enumt::FAILURE)});
258+
}
226259
}
227260
}
228261

0 commit comments

Comments
 (0)