Skip to content

Use of UnionDomain.meet in refinement causes unsoundness and crashes #1105

@jerhard

Description

@jerhard

The refinement that is done when encountering branching uses UnionDomain.meet, which currently causes unsound behavior and crashes.

In the following example, Goblint considers both branches of the if to be dead:

union u a;
union u b;
a.x = 12;
b.f = 129.0;
int i = 0;
if(a.x == b.x){
i++;
}

The reason is that the meet of a: $(field: x, value: 12)$ and b: $(field: f, value: 129.0)$ yields $(field: \bot, value: \bot)$.

In an example where the union type contains either a char or an int, Goblint crashes with a IncompatibleIkind-exception, because the abstract values with ikinds of Char and Int are passed to a meet.

union u {
int x;
char c;
};
int main(){
union u a;
union u b;
a.x = 12;
b.c = 12;
int i = 0;
if(a.x == b.x){
i++;
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions