2021-02-24 19:30 CET

View Issue Details Jump to Notes ]
IDProjectCategoryView StatusLast Update
0000997Frama-CPlug-in > Evapublic2012-09-19 17:16
Assigned Toyakobowski 
Product VersionFrama-C Nitrogen-20111001 
Target VersionFixed in VersionFrama-C Oxygen-20120901 
Summary0000997: Warnings in presence of Top floats
DescriptionConsider the following program analyzed with
frama-c -val -absolute-valid-range 0-100

const short max = 255;
const short min = 0;

extern float u[256];

float main () {
  short r;

  float f = *((float *)18);

  // assert -3.40282346639e+38 <= f <= 3.40282346639e+38;
  int j = 2; // To be able to see the value of f in the gui

  if(f >= max) r = max;
  else if (f <= min) r = min;
  else r = f + 0.5;

  return u[r];

The results are not optimal, as the access to u[r] is not proven correct. The reason is as follows: with a "normal" float, the reductions within the 'if' take place normally, and r belongs to [0..255]. However, here we have a Topint inside a float, and the reduction does not happen.

If we activate the assertion to help the user, the result is worse: the assertion is incorrectly proven correct, as the conversion to a finite float happens before the truth value of the assertion is computed. Moreover, since the assertion is "correct", no reduction by the assertion occurs, and the access to u[r] is still not correct.
TagsNo tags attached.
Attached Files




yakobowski (manager)

Fixed in revision 15912.

-Issue History
Date Modified Username Field Change
2011-10-23 11:37 yakobowski New Issue
2011-10-23 11:37 yakobowski Status new => assigned
2011-10-23 11:37 yakobowski Assigned To => pascal
2011-10-23 13:51 svn
2011-10-23 18:48 yakobowski Assigned To pascal => yakobowski
2011-10-24 11:29 yakobowski Note Added: 0002422
2011-10-24 11:29 yakobowski Status assigned => resolved
2011-10-24 11:29 yakobowski Resolution open => fixed
2011-11-21 23:38 svn
2012-09-19 17:15 signoles Fixed in Version => Frama-C Oxygen-20120901
2012-09-19 17:16 signoles Status resolved => closed
2018-01-12 14:26 signoles Category Plug-in > value analysis => Plug-in > Eva
+Issue History