Skip to content

Commit f4dedec

Browse files
Merge pull request #3970 from peterschrammel/fault-localizer
Integrate fault localizer into goto checker [blocks: 4215]
2 parents 60fe468 + b1d9072 commit f4dedec

19 files changed

+837
-30
lines changed

jbmc/src/jbmc/jbmc_parse_options.cpp

+29-13
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,10 @@ Author: Daniel Kroening, [email protected]
2929
#include <ansi-c/ansi_c_language.h>
3030

3131
#include <goto-checker/all_properties_verifier.h>
32+
#include <goto-checker/all_properties_verifier_with_fault_localization.h>
3233
#include <goto-checker/all_properties_verifier_with_trace_storage.h>
3334
#include <goto-checker/stop_on_fail_verifier.h>
35+
#include <goto-checker/stop_on_fail_verifier_with_fault_localization.h>
3436

3537
#include <goto-programs/adjust_float_expressions.h>
3638
#include <goto-programs/lazy_goto_model.h>
@@ -161,12 +163,6 @@ void jbmc_parse_optionst::get_command_line_options(optionst &options)
161163

162164
if(cmdline.isset("localize-faults"))
163165
options.set_option("localize-faults", true);
164-
if(cmdline.isset("localize-faults-method"))
165-
{
166-
options.set_option(
167-
"localize-faults-method",
168-
cmdline.get_value("localize-faults-method"));
169-
}
170166

171167
if(cmdline.isset("unwind"))
172168
options.set_option("unwind", cmdline.get_value("unwind"));
@@ -613,9 +609,19 @@ int jbmc_parse_optionst::doit()
613609
}
614610
else
615611
{
616-
verifier = util_make_unique<
617-
stop_on_fail_verifiert<java_multi_path_symex_checkert>>(
618-
options, ui_message_handler, goto_model);
612+
if(options.get_bool_option("localize-faults"))
613+
{
614+
verifier =
615+
util_make_unique<stop_on_fail_verifier_with_fault_localizationt<
616+
java_multi_path_symex_checkert>>(
617+
options, ui_message_handler, goto_model);
618+
}
619+
else
620+
{
621+
verifier = util_make_unique<
622+
stop_on_fail_verifiert<java_multi_path_symex_checkert>>(
623+
options, ui_message_handler, goto_model);
624+
}
619625
}
620626
}
621627
else
@@ -629,10 +635,20 @@ int jbmc_parse_optionst::doit()
629635
}
630636
else
631637
{
632-
verifier =
633-
util_make_unique<all_properties_verifier_with_trace_storaget<
634-
java_multi_path_symex_checkert>>(
635-
options, ui_message_handler, goto_model);
638+
if(options.get_bool_option("localize-faults"))
639+
{
640+
verifier =
641+
util_make_unique<all_properties_verifier_with_fault_localizationt<
642+
java_multi_path_symex_checkert>>(
643+
options, ui_message_handler, goto_model);
644+
}
645+
else
646+
{
647+
verifier =
648+
util_make_unique<all_properties_verifier_with_trace_storaget<
649+
java_multi_path_symex_checkert>>(
650+
options, ui_message_handler, goto_model);
651+
}
636652
}
637653
}
638654
}

jbmc/src/jbmc/jbmc_parse_options.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ class optionst;
7777
OPT_FLUSH \
7878
JAVA_BYTECODE_LANGUAGE_OPTIONS \
7979
"(java-unwind-enum-static)" \
80-
"(localize-faults)(localize-faults-method):" \
80+
"(localize-faults)" \
8181
"(java-threading)" \
8282
OPT_GOTO_TRACE \
8383
OPT_VALIDATE \

src/cbmc/cbmc_parse_options.cpp

+29-11
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ Author: Daniel Kroening, [email protected]
3434
#include <cpp/cprover_library.h>
3535

3636
#include <goto-checker/all_properties_verifier.h>
37+
#include <goto-checker/all_properties_verifier_with_fault_localization.h>
3738
#include <goto-checker/all_properties_verifier_with_trace_storage.h>
3839
#include <goto-checker/bmc_util.h>
3940
#include <goto-checker/cover_goals_verifier_with_trace_storage.h>
@@ -43,6 +44,7 @@ Author: Daniel Kroening, [email protected]
4344
#include <goto-checker/single_path_symex_checker.h>
4445
#include <goto-checker/single_path_symex_only_checker.h>
4546
#include <goto-checker/stop_on_fail_verifier.h>
47+
#include <goto-checker/stop_on_fail_verifier_with_fault_localization.h>
4648

4749
#include <goto-programs/adjust_float_expressions.h>
4850
#include <goto-programs/initialize_goto_model.h>
@@ -230,12 +232,6 @@ void cbmc_parse_optionst::get_command_line_options(optionst &options)
230232

231233
if(cmdline.isset("localize-faults"))
232234
options.set_option("localize-faults", true);
233-
if(cmdline.isset("localize-faults-method"))
234-
{
235-
options.set_option(
236-
"localize-faults-method",
237-
cmdline.get_value("localize-faults-method"));
238-
}
239235

240236
if(cmdline.isset("unwind"))
241237
options.set_option("unwind", cmdline.get_value("unwind"));
@@ -625,9 +621,19 @@ int cbmc_parse_optionst::doit()
625621
}
626622
else
627623
{
628-
verifier =
629-
util_make_unique<stop_on_fail_verifiert<multi_path_symex_checkert>>(
630-
options, ui_message_handler, goto_model);
624+
if(options.get_bool_option("localize-faults"))
625+
{
626+
verifier =
627+
util_make_unique<stop_on_fail_verifier_with_fault_localizationt<
628+
multi_path_symex_checkert>>(
629+
options, ui_message_handler, goto_model);
630+
}
631+
else
632+
{
633+
verifier =
634+
util_make_unique<stop_on_fail_verifiert<multi_path_symex_checkert>>(
635+
options, ui_message_handler, goto_model);
636+
}
631637
}
632638
}
633639
else
@@ -639,8 +645,20 @@ int cbmc_parse_optionst::doit()
639645
}
640646
else
641647
{
642-
verifier = util_make_unique<all_properties_verifier_with_trace_storaget<
643-
multi_path_symex_checkert>>(options, ui_message_handler, goto_model);
648+
if(options.get_bool_option("localize-faults"))
649+
{
650+
verifier =
651+
util_make_unique<all_properties_verifier_with_fault_localizationt<
652+
multi_path_symex_checkert>>(
653+
options, ui_message_handler, goto_model);
654+
}
655+
else
656+
{
657+
verifier =
658+
util_make_unique<all_properties_verifier_with_trace_storaget<
659+
multi_path_symex_checkert>>(
660+
options, ui_message_handler, goto_model);
661+
}
644662
}
645663
}
646664
}

src/cbmc/cbmc_parse_options.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ class optionst;
7676
"(string-abstraction)(no-arch)(arch):" \
7777
"(round-to-nearest)(round-to-plus-inf)(round-to-minus-inf)(round-to-zero)" \
7878
OPT_FLUSH \
79-
"(localize-faults)(localize-faults-method):" \
79+
"(localize-faults)" \
8080
OPT_GOTO_TRACE \
8181
OPT_VALIDATE \
8282
OPT_ANSI_C_LANGUAGE \

src/goto-checker/Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ SRC = bmc_util.cpp \
22
counterexample_beautification.cpp \
33
cover_goals_report_util.cpp \
44
incremental_goto_checker.cpp \
5+
goto_symex_fault_localizer.cpp \
56
goto_symex_property_decider.cpp \
67
goto_trace_storage.cpp \
78
goto_verifier.cpp \
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
/*******************************************************************\
2+
3+
Module: Goto Verifier for Verifying all Properties and Localizing Faults
4+
5+
Author: Daniel Kroening, Peter Schrammel
6+
7+
\*******************************************************************/
8+
9+
/// \file
10+
/// Goto verifier for verifying all properties that stores traces
11+
/// and localizes faults
12+
13+
#ifndef CPROVER_GOTO_CHECKER_ALL_PROPERTIES_VERIFIER_WITH_FAULT_LOCALIZATION_H
14+
#define CPROVER_GOTO_CHECKER_ALL_PROPERTIES_VERIFIER_WITH_FAULT_LOCALIZATION_H
15+
16+
#include "goto_verifier.h"
17+
18+
#include "fault_localization_provider.h"
19+
#include "goto_trace_storage.h"
20+
#include "incremental_goto_checker.h"
21+
#include "properties.h"
22+
#include "report_util.h"
23+
24+
/// Requires an incremental goto checker that is a
25+
/// `goto_trace_providert` and `fault_localization_providert`.
26+
template <class incremental_goto_checkerT>
27+
class all_properties_verifier_with_fault_localizationt : public goto_verifiert
28+
{
29+
public:
30+
all_properties_verifier_with_fault_localizationt(
31+
const optionst &options,
32+
ui_message_handlert &ui_message_handler,
33+
abstract_goto_modelt &goto_model)
34+
: goto_verifiert(options, ui_message_handler),
35+
goto_model(goto_model),
36+
incremental_goto_checker(options, ui_message_handler, goto_model),
37+
traces(incremental_goto_checker.get_namespace())
38+
{
39+
properties = initialize_properties(goto_model);
40+
}
41+
42+
resultt operator()() override
43+
{
44+
while(true)
45+
{
46+
const auto result = incremental_goto_checker(properties);
47+
if(result.progress == incremental_goto_checkert::resultt::progresst::DONE)
48+
break;
49+
50+
// we've got an error trace
51+
message_building_error_trace(log);
52+
for(const auto &property_id : result.updated_properties)
53+
{
54+
if(properties.at(property_id).status == property_statust::FAIL)
55+
{
56+
// get correctly truncated error trace for property and store it
57+
(void)traces.insert(
58+
incremental_goto_checker.build_trace(property_id));
59+
60+
fault_locations.insert(
61+
{property_id,
62+
incremental_goto_checker.localize_fault(property_id)});
63+
}
64+
}
65+
66+
++iterations;
67+
}
68+
69+
return determine_result(properties);
70+
}
71+
72+
void report() override
73+
{
74+
if(
75+
options.get_bool_option("trace") ||
76+
// currently --trace only affects plain text output
77+
ui_message_handler.get_ui() != ui_message_handlert::uit::PLAIN)
78+
{
79+
const trace_optionst trace_options(options);
80+
output_properties_with_traces_and_fault_localization(
81+
properties,
82+
traces,
83+
trace_options,
84+
fault_locations,
85+
iterations,
86+
ui_message_handler);
87+
}
88+
else
89+
{
90+
output_properties_with_fault_localization(
91+
properties, fault_locations, iterations, ui_message_handler);
92+
}
93+
output_overall_result(determine_result(properties), ui_message_handler);
94+
}
95+
96+
const goto_trace_storaget &get_traces() const
97+
{
98+
return traces;
99+
}
100+
101+
protected:
102+
abstract_goto_modelt &goto_model;
103+
incremental_goto_checkerT incremental_goto_checker;
104+
std::size_t iterations = 1;
105+
goto_trace_storaget traces;
106+
std::unordered_map<irep_idt, fault_location_infot> fault_locations;
107+
};
108+
109+
#endif // CPROVER_GOTO_CHECKER_ALL_PROPERTIES_VERIFIER_WITH_FAULT_LOCALIZATION_H

src/goto-checker/bmc_util.cpp

+13
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,19 @@ void output_error_trace(
102102
}
103103
}
104104

105+
void freeze_guards(
106+
const symex_target_equationt &equation,
107+
prop_convt &prop_conv)
108+
{
109+
for(const auto &step : equation.SSA_steps)
110+
{
111+
if(!step.guard_literal.is_constant())
112+
prop_conv.set_frozen(step.guard_literal);
113+
if(step.is_assert() && !step.cond_literal.is_constant())
114+
prop_conv.set_frozen(step.cond_literal);
115+
}
116+
}
117+
105118
/// outputs an error witness in graphml format
106119
void output_graphml(
107120
const goto_tracet &goto_trace,

src/goto-checker/bmc_util.h

+2
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ void output_error_trace(
5757
const trace_optionst &,
5858
ui_message_handlert &);
5959

60+
void freeze_guards(const symex_target_equationt &, prop_convt &);
61+
6062
void output_graphml(const goto_tracet &, const namespacet &, const optionst &);
6163
void output_graphml(
6264
const symex_target_equationt &,
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
/*******************************************************************\
2+
3+
Module: Interface for Goto Checkers to provide Fault Localization
4+
5+
Author: Daniel Kroening, Peter Schrammel
6+
7+
\*******************************************************************/
8+
9+
/// \file
10+
/// Interface for Goto Checkers to provide Fault Localization
11+
12+
#ifndef CPROVER_GOTO_CHECKER_FAULT_LOCALIZATION_PROVIDER_H
13+
#define CPROVER_GOTO_CHECKER_FAULT_LOCALIZATION_PROVIDER_H
14+
15+
#include <map>
16+
17+
#include <goto-programs/goto_program.h>
18+
19+
class goto_tracet;
20+
class namespacet;
21+
22+
struct fault_location_infot
23+
{
24+
typedef std::map<goto_programt::const_targett, std::size_t> score_mapt;
25+
score_mapt scores;
26+
};
27+
28+
/// An implementation of `incremental_goto_checkert`
29+
/// may implement this interface to provide fault localization information.
30+
class fault_localization_providert
31+
{
32+
public:
33+
/// Returns the most likely fault locations
34+
/// for the given FAILed \p property_id
35+
virtual fault_location_infot
36+
localize_fault(const irep_idt &property_id) const = 0;
37+
38+
virtual ~fault_localization_providert() = default;
39+
};
40+
41+
#endif // CPROVER_GOTO_CHECKER_FAULT_LOCALIZATION_PROVIDER_H

0 commit comments

Comments
 (0)