3

I am trying to insert an assertion inside a function. Here is what I did:

void foo(int a) {
    //@ assert a == 1;
}

void main() {
   foo(1);
   foo(2);
}

I expect to get an invalid result, but Frama-C returns an unknown result while it can provide a counterexample with the call stack.

Here is the screenshot when I run my example with Frama-C:

Screenshot of the Frama-C GUI with the values per callstack computed by Eva

anol
  • 8,264
  • 3
  • 34
  • 78
Thuy Nguyen
  • 353
  • 2
  • 10
  • 1
    Please always indicate which plugins you're using. Frama-C features very different analyzers and precise answers often depend on which one you're interested in. Given the picture you're showing, it is obvious that here we are talking about Eva, but it would be better if it was said explicitly from the beginning. – Virgile Feb 14 '19 at 15:27

1 Answers1

3

Eva indicates that the status is unknown because it has observed a callstack where the assertion was valid and another were it was invalid. However, because the plug-in performs over-approximations (well, not here, as your program is trivial, but in the general case there will be), it has no way to be sure that both can happen in a concrete execution: one of the branch (either the one validating the assertion or the one invalidating it) might be impossible to reach in the concrete world, because of conditions that are out of reach of the abstractions that are used by Eva. Hence the only sound possibility, which encompasses all possibilities, is to put an Unknown status here.

You can also see the same issue arise if you comment out the foo(1) call. Eva will then report that the assertion is invalid, but only provided that it can indeed be reached.

Finally, this kind of annotations are indeed the ones you usually want to investigate about first (as opposed to annotations with a "plain" Unknown status), and in newer versions of Frama-C (starting from v17.0), you have an additional panel Red Alarms that lists properties that are invalid for at least one callstack.

Virgile
  • 9,724
  • 18
  • 42