@@ -22,13 +22,13 @@ features of JBMC, and explore the most useful features.
22
22
23
23
\subsection jbmc-manual-auto-assert Automatic assertions
24
24
25
- Consider the following simplistic ` Example1 .java` file which we have compiled
26
- into ` Example1 .class` and which contains a utility method to query a given
25
+ Consider the following simplistic ` ExampleArray .java` file which we have compiled
26
+ into ` ExampleArray .class` and which contains a utility method to query a given
27
27
array at a given index:
28
28
```
29
29
package tutorial;
30
30
31
- public class Example1 {
31
+ public class ExampleArray {
32
32
33
33
public static int query(int[] array, int index) {
34
34
return array[index];
@@ -39,15 +39,15 @@ public class Example1 {
39
39
Now let's run the following command to let JBMC tell us about potential errors
40
40
in our ` query ` method.
41
41
42
- jbmc Example1 .class --function tutorial.Example1 .query
42
+ jbmc ExampleArray .class --function tutorial.ExampleArray .query
43
43
44
44
45
45
The output contains the following:
46
46
47
- [java::tutorial.Example1 .query:([II)I.null-pointer-exception.1] line 6 Null pointer check: FAILURE
48
- [java::tutorial.Example1 .query:([II)I.array-index-out-of-bounds-low.1] line 6 Array index should be >= 0: FAILURE
49
- [java::tutorial.Example1 .query:([II)I.array-index-out-of-bounds-high.1] line 6 Array index should be < length: FAILURE
50
- [java::tutorial.Example1 .query:([II)I.1] line 6 no uncaught exception: SUCCESS
47
+ [java::tutorial.ExampleArray .query:([II)I.null-pointer-exception.1] line 6 Null pointer check: FAILURE
48
+ [java::tutorial.ExampleArray .query:([II)I.array-index-out-of-bounds-low.1] line 6 Array index should be >= 0: FAILURE
49
+ [java::tutorial.ExampleArray .query:([II)I.array-index-out-of-bounds-high.1] line 6 Array index should be < length: FAILURE
50
+ [java::tutorial.ExampleArray .query:([II)I.1] line 6 no uncaught exception: SUCCESS
51
51
52
52
Three reported failures spring up:
53
53
1 . there is no null pointer check on the array passed as argument
@@ -59,7 +59,7 @@ safe as follows:
59
59
```
60
60
package tutorial;
61
61
62
- public class Example2 {
62
+ public class ExampleArraySafe {
63
63
public static int query(int[] array, int index) {
64
64
if (array == null) {
65
65
return -1;
@@ -75,11 +75,11 @@ public class Example2 {
75
75
then the JBMC automatic assertions become valid, meaning that there is no
76
76
possible inputs (argument values) for which they can be violated:
77
77
78
- [java::tutorial.Example2 .query:([II)I.1] line 6 no uncaught exception: SUCCESS
79
- [java::tutorial.Example2 .query:([II)I.null-pointer-exception.1] line 9 Null pointer check: SUCCESS
80
- [java::tutorial.Example2 .query:([II)I.null-pointer-exception.2] line 12 Null pointer check: SUCCESS
81
- [java::tutorial.Example2 .query:([II)I.array-index-out-of-bounds-low.1] line 12 Array index should be >= 0: SUCCESS
82
- [java::tutorial.Example2 .query:([II)I.array-index-out-of-bounds-high.1] line 12 Array index should be < length: SUCCESS
78
+ [java::tutorial.ExampleArraySafe .query:([II)I.1] line 6 no uncaught exception: SUCCESS
79
+ [java::tutorial.ExampleArraySafe .query:([II)I.null-pointer-exception.1] line 9 Null pointer check: SUCCESS
80
+ [java::tutorial.ExampleArraySafe .query:([II)I.null-pointer-exception.2] line 12 Null pointer check: SUCCESS
81
+ [java::tutorial.ExampleArraySafe .query:([II)I.array-index-out-of-bounds-low.1] line 12 Array index should be >= 0: SUCCESS
82
+ [java::tutorial.ExampleArraySafe .query:([II)I.array-index-out-of-bounds-high.1] line 12 Array index should be < length: SUCCESS
83
83
84
84
85
85
\subsection jbmc-manual-unwind Loop unwinding
@@ -93,7 +93,7 @@ depends on an input):
93
93
```
94
94
package tutorial;
95
95
96
- public class Example3 {
96
+ public class ExampleUnwind {
97
97
98
98
public static void doSomething(int inputVal) {
99
99
if (inputVal > 1 && inputVal % 2 == 1) {
@@ -116,7 +116,7 @@ public class Example3 {
116
116
To limit the number of times the for-loop is unwound, we use the ` --unwind N `
117
117
options, in which case the following call to JBMC:
118
118
119
- jbmc Example3 .class --function tutorial.Example3 .isPrime --unwind 10
119
+ jbmc ExampleUnwind .class --function tutorial.ExampleUnwind .isPrime --unwind 10
120
120
121
121
will terminate (with ` VERIFICATION SUCCESSFUL ` ).
122
122
@@ -128,12 +128,12 @@ JBMC will try do refute. On line 7, we check the assertion that all odd
128
128
numbers greater than 1 are prime. To be sure that this always holds, we run
129
129
JBMC on the example, with a reasonable ` unwind ` value:
130
130
131
- jbmc Example3 .class --function tutorial.Example3 .doSomething --unwind 10
131
+ jbmc ExampleUnwind .class --function tutorial.ExampleUnwind .doSomething --unwind 10
132
132
133
133
Unsurprisingly JBMC doesn't agree, and prints an assertion failure
134
134
(truncated here for readability):
135
135
136
- [...doSomething:(I)V.assertion.1] line 7 assertion at file tutorial/Example3 .java: FAILURE
136
+ [...doSomething:(I)V.assertion.1] line 7 assertion at file tutorial/ExampleUnwind .java: FAILURE
137
137
138
138
139
139
Rerunning the analysis with the ` --trace ` option, the following line appears
@@ -165,7 +165,7 @@ from `java.lang.String`, e.g.
165
165
```
166
166
package tutorial;
167
167
168
- public class Example4 {
168
+ public class ExampleModels {
169
169
170
170
public static void stringOp() {
171
171
StringBuilder sb = new StringBuilder("abcd");
@@ -178,11 +178,11 @@ public class Example4 {
178
178
The following command line (note that the current directory is also added to
179
179
the classpath):
180
180
181
- jbmc Example4 .class --function tutorial.Example4 .stringOp --cp <path_to_cbmc>/jbmc/src/java_bytecode/library/core-models.jar:.
181
+ jbmc ExampleModels .class --function tutorial.ExampleModels .stringOp --cp <path_to_cbmc>/jbmc/src/java_bytecode/library/core-models.jar:.
182
182
183
183
will flag this violation (truncated):
184
184
185
- [java::tutorial.Example4 .stringOp:()V.assertion.1] line 8 assertion: FAILURE
185
+ [java::tutorial.ExampleModels .stringOp:()V.assertion.1] line 8 assertion: FAILURE
186
186
187
187
Again, the trace shows the string violating the condition in the assertion:
188
188
@@ -202,7 +202,7 @@ line 11 will be considered as unreachable, and hence the assertion to be valid.
202
202
```
203
203
package tutorial;
204
204
205
- public class Example5 {
205
+ public class ExampleExceptions {
206
206
207
207
public static int exceptionHandling(String str) {
208
208
int retval = 0;
0 commit comments