Closed
Description
CBMC version: 5.40.0 (0cdc654) with PR 6376 and 5.31.0
Operating system: Both Ubuntu 20 and macOS 11.6 (20G165)
Exact command line resulting in the issue:
$ cbmc --version
5.31.0 (cbmc-5.31.0)
$ cbmc --object-bits 11 --unwinding-assertions --unwind 2 before-slice.out &> before-log.txt
$ goto-instrument --reachability-slice before-slice.out after-slice.out
Reading GOTO program from 'before-slice.out'
Function Pointer Removal
Virtual function removal
Cleaning inline assembler statements
Performing a reachability slice
Writing GOTO program to 'after-slice.out'
$ cbmc --object-bits 11 --unwinding-assertions --unwind 2 after-slice.out &> after-log.txt
$ cat before-log.txt | grep VERIFICATION
VERIFICATION FAILED
$ cat after-log.txt | grep VERIFICATION
VERIFICATION SUCCESSFUL
The issue seems to be this function goes from nontrivial to an assume(0) despite being reachable:
// _ZN3std2io5error5Error3new17h1430579a7771a700E
// file /home/ubuntu/rmc/library/std/src/io/error.rs line 407 column 5 function std::io::Error::new
struct _5372671742868111021 _ZN3std2io5error5Error3new17h1430579a7771a700E(struct _5803772184803114267 kind, struct _12284072475024233176 error)
{
struct _5372671742868111021 var_0;
struct _5803772184803114267 var_3;
struct _194830641207493724 var_4;
struct _194830641207493724 var_5;
struct _12284072475024233176 var_6;
bb0:
;
var_3 = kind;
var_5=_ZN50_$LT$T$u20$as$u20$core__convert__Into$LT$U$GT$$GT$4into17h248557188006561aE(var_6);
bb1:
;
var_4 = var_5;
var_0=_ZN3std2io5error5Error4_new17h9c927d8b7dad0d7aE(var_3, var_4);
bb2:
;
return var_0;
}
to
// _ZN3std2io5error5Error3new17h1430579a7771a700E
// file /home/ubuntu/rmc/library/std/src/io/error.rs line 407 column 5 function std::io::Error::new
struct _5372671742868111021 _ZN3std2io5error5Error3new17h1430579a7771a700E(struct _5803772184803114267 kind, struct _12284072475024233176 error)
{
__CPROVER_assume(0);
bb2:
;
}
What behaviour did you expect: same result
What happened instead: verification result changes
Binaries included here, apologies that they are large, so far unable to replicate on a minimal example:
reachability-slice-bug.zip