Skip to content

Commit 8652d9c

Browse files
committed
Include pointer offset in counterexample output
While the bit-level pointer output would convey the information, the human-readable expression previously did not consider non-zero offsets except for null pointers.
1 parent 49230ec commit 8652d9c

File tree

3 files changed

+59
-1
lines changed

3 files changed

+59
-1
lines changed
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#include <assert.h>
2+
3+
typedef struct
4+
{
5+
int inta;
6+
int intb;
7+
} struct_t;
8+
9+
typedef union {
10+
int intaa;
11+
struct_t structbb;
12+
} union_struct_t;
13+
14+
int main()
15+
{
16+
union_struct_t uuu;
17+
char *ptr = (char *)&uuu.structbb.intb;
18+
int A[2];
19+
int *ip = &A[1];
20+
uuu.structbb.intb = 1;
21+
// assert(*ptr == 1);
22+
assert(0);
23+
}
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
CORE
2+
main.c
3+
--trace
4+
^EXIT=10$
5+
^SIGNAL=0$
6+
ptr=\(char \*\)&uuu!0@1 \+ 4(l+)? \(.*\)$
7+
ip=A!0@1 \+ 1(l+)? \(.*\)$
8+
^VERIFICATION FAILED$
9+
--
10+
^warning: ignoring

src/solvers/flattening/pointer_logic.cpp

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,33 @@ exprt pointer_logict::pointer_expr(
9999
const exprt &object_expr=objects[pointer.object];
100100

101101
exprt deep_object=object_rec(pointer.offset, type, object_expr);
102+
const address_of_exprt base(deep_object);
102103

103-
return address_of_exprt(deep_object, type);
104+
if(pointer.offset == 0)
105+
return typecast_exprt::conditional_cast(base, type);
106+
107+
const auto object_size = pointer_offset_size(deep_object.type(), ns);
108+
if(object_size.has_value() && *object_size <= 1)
109+
{
110+
return typecast_exprt::conditional_cast(
111+
plus_exprt(base, from_integer(pointer.offset, pointer_diff_type())),
112+
type);
113+
}
114+
else if(object_size.has_value() && pointer.offset % *object_size == 0)
115+
{
116+
return typecast_exprt::conditional_cast(
117+
plus_exprt(
118+
base, from_integer(pointer.offset % *object_size, pointer_diff_type())),
119+
type);
120+
}
121+
else
122+
{
123+
return typecast_exprt::conditional_cast(
124+
plus_exprt(
125+
typecast_exprt(base, pointer_type(char_type())),
126+
from_integer(pointer.offset, pointer_diff_type())),
127+
type);
128+
}
104129
}
105130

106131
exprt pointer_logict::object_rec(

0 commit comments

Comments
 (0)