0001484: ill-typed alt-ergo proof obligation - Frama-C Bug Tracking System

View Issue Details [ Jump to Notes ]

[ Issue History ] [ Print ]

Project

Category

View Status

Date Submitted

Last Update

0001484

Frama-C

Plug-in > wp

public

2013-09-25 15:30

2018-02-05 17:27

Reporter

virgile

Assigned To

correnson

Priority

normal

Severity

minor

Reproducibility

always

Status

assigned

Resolution

open

Platform

OS Version

Product Version

Frama-C GIT, precise the release id

Target Version

Fixed in Version

Summary

0001484: ill-typed alt-ergo proof obligation

Description

Using WP with RTE enabled on the attached file results in proof obligations rejected as ill-typed by Alt-Ergo.

Steps To Reproduce

frama-c -wp -wp-rte t.c

Additional Information

Without rte, everything is fine. With RTE, the resulting proof obligation is the following:

  forall x_0 : int.
  let x_1 = to_sint32(neqb(0, x_0)) : int in
  let x_2 = to_uint8(x_0 - (ite((eqb(0, x_0)), 0, 1))) : int in
  is_uint8(x_0) ->
  (x_1 <= (2147483648 + x_0)) ->
  (x_0 <= (2147483647 + x_1)) ->
  is_uint8(x_2) ->
  (x_2 <= x_0)

the definition of x_1 is lacking an ite(_,0,1) conversion, as shown in the definition of x_2. x_1 does not appear in the PO without RTE, as it is only used in the (x<=2147483648 + x_0) and x_0 <= (2147483647 + x_1) hypotheses reflecting the RTE-generated hypotheses.
Note that writing the RTE-generated hypotheses in the code (and launching WP without -wp-rte) results in warning cast from (boolean) not yet implemented, and degenerated goals.

Tags

No tags attached.

Attached Files

t.c [^] (165 bytes) 2013-09-25 15:30 [Show Content] [Hide Content]

//@ ensures \result <= x;
unsigned char f(unsigned char x) { 
  /*@ assert rte: signed_overflow: (int)x-(int)((int)x≢0) ≤ 2147483647;
  */
  return x-(x!=0); 
}

Relationships

related to

0002355

assigned

virgile

Alt-Ergo reports about " bool and int cannot be unified"

Notes
(0004090) virgile (developer) 2013-09-25 16:11	Actually, thinking about it, I guess that the difference between RTE-generated and user-written assertions lies in the fact that RTE might not insert a coercion from boolean to integer in the corresponding AST node.

Issue History
Date Modified	Username	Field	Change
2013-09-25 15:30	virgile	New Issue
2013-09-25 15:30	virgile	Status	new => assigned
2013-09-25 15:30	virgile	Assigned To	=> correnson
2013-09-25 15:30	virgile	File Added: t.c
2013-09-25 16:03	virgile	Additional Information Updated
2013-09-25 16:11	virgile	Note Added: 0004090
2018-02-05 17:27	virgile	Relationship added	related to 0002355