-
Notifications
You must be signed in to change notification settings - Fork 87
Use of UnionDomain.meet in refinement causes unsoundness and crashes #1105
Description
The refinement that is done when encountering branching uses UnionDomain.meet, which currently causes unsound behavior and crashes.
In the following example, Goblint considers both branches of the if to be dead:
analyzer/tests/regression/27-inv_invariants/18-union-float-int.c
Lines 9 to 18 in b45d527
| union u a; | |
| union u b; | |
| a.x = 12; | |
| b.f = 129.0; | |
| int i = 0; | |
| if(a.x == b.x){ | |
| i++; | |
| } |
The reason is that the meet of a:
In an example where the union type contains either a char or an int, Goblint crashes with a IncompatibleIkind-exception, because the abstract values with ikinds of Char and Int are passed to a meet.
analyzer/tests/regression/27-inv_invariants/19-union-char-int.c
Lines 3 to 18 in b45d527
| union u { | |
| int x; | |
| char c; | |
| }; | |
| int main(){ | |
| union u a; | |
| union u b; | |
| a.x = 12; | |
| b.c = 12; | |
| int i = 0; | |
| if(a.x == b.x){ | |
| i++; | |
| } |