2011-06-15 11:19:50 -07:00
|
|
|
|
2011-05-14 19:02:30 -07:00
|
|
|
import front::ast;
|
|
|
|
import front::ast::method;
|
|
|
|
import front::ast::item;
|
|
|
|
import front::ast::item_fn;
|
|
|
|
import front::ast::_fn;
|
|
|
|
import front::ast::obj_field;
|
|
|
|
import front::ast::_obj;
|
|
|
|
import front::ast::stmt;
|
|
|
|
import front::ast::ident;
|
2011-06-24 15:11:22 -07:00
|
|
|
import front::ast::fn_ident;
|
2011-06-19 22:41:21 +02:00
|
|
|
import front::ast::node_id;
|
2011-05-14 19:02:30 -07:00
|
|
|
import front::ast::def_id;
|
2011-06-19 22:41:21 +02:00
|
|
|
import front::ast::local_def;
|
2011-05-14 19:02:30 -07:00
|
|
|
import front::ast::ty_param;
|
|
|
|
import front::ast::crate;
|
2011-05-20 19:50:29 -07:00
|
|
|
import front::ast::return;
|
|
|
|
import front::ast::noreturn;
|
2011-05-14 19:02:30 -07:00
|
|
|
import front::ast::expr;
|
|
|
|
import middle::ty::type_is_nil;
|
|
|
|
import middle::ty::ret_ty_of_fn;
|
|
|
|
import util::common::span;
|
|
|
|
import tstate::ann::ts_ann;
|
|
|
|
import tstate::ann::empty_poststate;
|
|
|
|
import tstate::ann::true_precond;
|
|
|
|
import tstate::ann::true_postcond;
|
|
|
|
import tstate::ann::false_postcond;
|
|
|
|
import tstate::ann::precond;
|
|
|
|
import tstate::ann::postcond;
|
|
|
|
import tstate::ann::poststate;
|
|
|
|
import tstate::ann::prestate;
|
|
|
|
import tstate::ann::implies;
|
|
|
|
import tstate::ann::ann_precond;
|
|
|
|
import tstate::ann::ann_prestate;
|
2011-05-17 20:41:41 +02:00
|
|
|
import std::vec::map;
|
|
|
|
import std::vec;
|
|
|
|
import std::vec::slice;
|
|
|
|
import std::vec::unzip;
|
|
|
|
import std::vec::plus_option;
|
|
|
|
import std::vec::cat_options;
|
2011-05-14 19:02:30 -07:00
|
|
|
import std::option;
|
|
|
|
import std::option::t;
|
|
|
|
import std::option::some;
|
|
|
|
import std::option::none;
|
|
|
|
import aux::fn_ctxt;
|
|
|
|
import aux::crate_ctxt;
|
|
|
|
import aux::new_crate_ctxt;
|
|
|
|
import aux::expr_precond;
|
|
|
|
import aux::expr_prestate;
|
|
|
|
import aux::expr_poststate;
|
|
|
|
import aux::stmt_poststate;
|
|
|
|
import aux::stmt_to_ann;
|
2011-06-01 18:10:10 -07:00
|
|
|
import aux::num_constraints;
|
Compute typestate properly for move
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
2011-06-22 21:26:34 -07:00
|
|
|
import aux::tritv_to_str;
|
2011-05-26 16:02:25 -07:00
|
|
|
import aux::first_difference_string;
|
2011-05-31 10:58:30 -07:00
|
|
|
import pretty::pprust::ty_to_str;
|
2011-05-18 15:43:05 -07:00
|
|
|
import util::common::log_stmt_err;
|
Compute typestate properly for move
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
2011-06-22 21:26:34 -07:00
|
|
|
import aux::log_tritv_err;
|
2011-05-14 19:02:30 -07:00
|
|
|
import bitvectors::promises;
|
|
|
|
import annotate::annotate_crate;
|
|
|
|
import collect_locals::mk_f_to_fn_info;
|
2011-05-18 16:59:34 -07:00
|
|
|
import pre_post_conditions::fn_pre_post;
|
2011-05-14 19:02:30 -07:00
|
|
|
import states::find_pre_post_state_fn;
|
|
|
|
|
2011-06-17 19:07:23 -07:00
|
|
|
fn check_states_expr(&fn_ctxt fcx, &@expr e) {
|
2011-06-15 11:19:50 -07:00
|
|
|
let precond prec = expr_precond(fcx.ccx, e);
|
2011-05-18 15:43:05 -07:00
|
|
|
let prestate pres = expr_prestate(fcx.ccx, e);
|
2011-06-17 19:07:23 -07:00
|
|
|
|
|
|
|
/*
|
|
|
|
log_err("check_states_expr:");
|
|
|
|
util::common::log_expr_err(*e);
|
|
|
|
log_err("prec = ");
|
|
|
|
log_bitv_err(fcx, prec);
|
|
|
|
log_err("pres = ");
|
|
|
|
log_bitv_err(fcx, pres);
|
|
|
|
*/
|
|
|
|
|
2011-05-18 15:43:05 -07:00
|
|
|
if (!implies(pres, prec)) {
|
|
|
|
auto s = "";
|
2011-05-26 16:02:25 -07:00
|
|
|
auto diff = first_difference_string(fcx, prec, pres);
|
2011-06-15 11:19:50 -07:00
|
|
|
s +=
|
|
|
|
"Unsatisfied precondition constraint (for example, " + diff +
|
|
|
|
") for expression:\n";
|
2011-05-31 10:58:30 -07:00
|
|
|
s += pretty::pprust::expr_to_str(e);
|
2011-06-15 11:19:50 -07:00
|
|
|
s += "\nPrecondition:\n";
|
Compute typestate properly for move
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
2011-06-22 21:26:34 -07:00
|
|
|
s += tritv_to_str(fcx, prec);
|
2011-06-15 11:19:50 -07:00
|
|
|
s += "\nPrestate:\n";
|
Compute typestate properly for move
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
2011-06-22 21:26:34 -07:00
|
|
|
s += tritv_to_str(fcx, pres);
|
2011-06-18 22:41:20 -07:00
|
|
|
fcx.ccx.tcx.sess.span_fatal(e.span, s);
|
2011-05-18 15:43:05 -07:00
|
|
|
}
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
|
|
|
|
2011-06-17 19:07:23 -07:00
|
|
|
fn check_states_stmt(&fn_ctxt fcx, &@stmt s) {
|
|
|
|
auto a = stmt_to_ann(fcx.ccx, *s);
|
2011-06-15 11:19:50 -07:00
|
|
|
let precond prec = ann_precond(a);
|
|
|
|
let prestate pres = ann_prestate(a);
|
2011-05-18 15:43:05 -07:00
|
|
|
|
2011-06-17 19:07:23 -07:00
|
|
|
/*
|
2011-05-18 15:43:05 -07:00
|
|
|
log_err("check_states_stmt:");
|
2011-06-17 19:07:23 -07:00
|
|
|
log_stmt_err(*s);
|
2011-05-18 15:43:05 -07:00
|
|
|
log_err("prec = ");
|
2011-06-17 19:07:23 -07:00
|
|
|
log_bitv_err(fcx, prec);
|
2011-05-18 15:43:05 -07:00
|
|
|
log_err("pres = ");
|
2011-06-17 19:07:23 -07:00
|
|
|
log_bitv_err(fcx, pres);
|
2011-05-18 15:43:05 -07:00
|
|
|
*/
|
2011-06-17 19:07:23 -07:00
|
|
|
|
2011-05-18 15:43:05 -07:00
|
|
|
if (!implies(pres, prec)) {
|
|
|
|
auto ss = "";
|
2011-05-26 16:02:25 -07:00
|
|
|
auto diff = first_difference_string(fcx, prec, pres);
|
2011-06-15 11:19:50 -07:00
|
|
|
ss +=
|
|
|
|
"Unsatisfied precondition constraint (for example, " + diff +
|
|
|
|
") for statement:\n";
|
2011-06-17 19:07:23 -07:00
|
|
|
ss += pretty::pprust::stmt_to_str(*s);
|
2011-06-15 11:19:50 -07:00
|
|
|
ss += "\nPrecondition:\n";
|
Compute typestate properly for move
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
2011-06-22 21:26:34 -07:00
|
|
|
ss += tritv_to_str(fcx, prec);
|
2011-06-15 11:19:50 -07:00
|
|
|
ss += "\nPrestate: \n";
|
Compute typestate properly for move
typestate now drops constraints correctly in the post-state of
a move expression or a declaration whose op is a move. It doesn't
yet drop constraints mentioning variables that get updated.
To do this, I had to change typestate to use trit-vectors instead
of bit-vectors, because for every constraint, there are three
possible values: known-to-be-false (e.g. after x <- y, init(y) is
known-to-be-false), known-to-be-true, and unknown. Before, we
conflated known-to-be-false with unknown. But move requires them
to be treated differently. Consider:
(program a)
(a1) x = 1;
(a2) y <- x;
(a3) log x;
(program b)
(b1) x = 1;
(b2) y <- z;
(b3) log x;
With only two values, the postcondition of statement a2 for
constraint init(x) is the same as that of b2: 0. But in (a2)'s
postcondition, init(x) *must* be false, but in (b2)'s condition,
it's just whatever it was in the postcondition of the preceding statement.
2011-06-22 21:26:34 -07:00
|
|
|
ss += tritv_to_str(fcx, pres);
|
2011-06-18 22:41:20 -07:00
|
|
|
fcx.ccx.tcx.sess.span_fatal(s.span, ss);
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2011-06-19 22:41:21 +02:00
|
|
|
fn check_states_against_conditions(&fn_ctxt fcx, &_fn f, node_id id,
|
2011-06-24 15:11:22 -07:00
|
|
|
&span sp, &fn_ident i) {
|
2011-06-17 19:07:23 -07:00
|
|
|
/* Postorder traversal instead of pre is important
|
|
|
|
because we want the smallest possible erroneous statement
|
|
|
|
or expression. */
|
|
|
|
|
|
|
|
let @mutable bool keepgoing = @mutable true;
|
|
|
|
|
|
|
|
/* TODO probably should use visit instead */
|
|
|
|
|
|
|
|
fn quit(@mutable bool keepgoing, &@ast::item i) {
|
|
|
|
*keepgoing = false;
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
2011-06-17 19:07:23 -07:00
|
|
|
fn kg(@mutable bool keepgoing) -> bool {
|
|
|
|
ret *keepgoing;
|
2011-05-18 15:43:05 -07:00
|
|
|
}
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-06-17 19:07:23 -07:00
|
|
|
auto v = rec (visit_stmt_post=bind check_states_stmt(fcx, _),
|
|
|
|
visit_expr_post=bind check_states_expr(fcx, _),
|
|
|
|
visit_item_pre=bind quit(keepgoing, _),
|
|
|
|
keep_going=bind kg(keepgoing)
|
|
|
|
with walk::default_visitor());
|
|
|
|
|
2011-06-19 22:41:21 +02:00
|
|
|
walk::walk_fn(v, f, sp, i, id);
|
2011-06-17 19:07:23 -07:00
|
|
|
|
|
|
|
/* Finally, check that the return value is initialized */
|
|
|
|
auto post = aux::block_poststate(fcx.ccx, f.body);
|
2011-06-13 18:10:33 -07:00
|
|
|
let aux::constr_ ret_c = rec(id=fcx.id, c=aux::ninit(fcx.name));
|
2011-06-17 19:07:23 -07:00
|
|
|
if (f.proto == ast::proto_fn && !promises(fcx, post, ret_c) &&
|
2011-06-19 22:41:21 +02:00
|
|
|
!type_is_nil(fcx.ccx.tcx, ret_ty_of_fn(fcx.ccx.tcx, id)) &&
|
2011-06-17 19:07:23 -07:00
|
|
|
f.decl.cf == return) {
|
2011-06-15 11:19:50 -07:00
|
|
|
fcx.ccx.tcx.sess.span_note(f.body.span,
|
|
|
|
"In function " + fcx.name +
|
|
|
|
", not all control paths \
|
|
|
|
return a value");
|
2011-06-18 22:41:20 -07:00
|
|
|
fcx.ccx.tcx.sess.span_fatal(f.decl.output.span,
|
2011-06-15 11:19:50 -07:00
|
|
|
"see declared return type of '" +
|
|
|
|
ty_to_str(*f.decl.output) + "'");
|
2011-06-17 19:07:23 -07:00
|
|
|
} else if (f.decl.cf == noreturn) {
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-05-20 19:50:29 -07:00
|
|
|
// check that this really always fails
|
|
|
|
// the fcx.id bit means "returns" for a returning fn,
|
2011-06-01 18:10:10 -07:00
|
|
|
// "diverges" for a non-returning fn
|
2011-06-17 19:07:23 -07:00
|
|
|
if (!promises(fcx, post, ret_c)) {
|
2011-06-18 22:41:20 -07:00
|
|
|
fcx.ccx.tcx.sess.span_fatal(f.body.span,
|
2011-06-15 11:19:50 -07:00
|
|
|
"In non-returning function " + fcx.name
|
2011-06-16 16:55:46 -07:00
|
|
|
+
|
|
|
|
", some control paths may \
|
2011-06-15 11:19:50 -07:00
|
|
|
return to the caller");
|
2011-05-20 19:50:29 -07:00
|
|
|
}
|
|
|
|
}
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
|
|
|
|
2011-06-24 15:11:22 -07:00
|
|
|
fn check_fn_states(&fn_ctxt fcx, &_fn f, node_id id, &span sp, &fn_ident i) {
|
2011-05-14 19:02:30 -07:00
|
|
|
/* Compute the pre- and post-states for this function */
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-06-25 17:29:50 +02:00
|
|
|
// Fixpoint iteration
|
|
|
|
while (find_pre_post_state_fn(fcx, f)) {}
|
|
|
|
|
2011-05-14 19:02:30 -07:00
|
|
|
/* Now compare each expr's pre-state to its precondition
|
|
|
|
and post-state to its postcondition */
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-06-19 22:41:21 +02:00
|
|
|
check_states_against_conditions(fcx, f, id, sp, i);
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
|
|
|
|
2011-06-24 15:11:22 -07:00
|
|
|
fn fn_states(&crate_ctxt ccx, &_fn f, &span sp, &fn_ident i, node_id id) {
|
2011-05-14 19:02:30 -07:00
|
|
|
/* Look up the var-to-bit-num map for this function */
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-05-14 19:02:30 -07:00
|
|
|
assert (ccx.fm.contains_key(id));
|
|
|
|
auto f_info = ccx.fm.get(id);
|
2011-06-24 15:11:22 -07:00
|
|
|
auto name = option::from_maybe("anon", i);
|
|
|
|
auto fcx = rec(enclosing=f_info, id=id, name=name, ccx=ccx);
|
2011-06-19 22:41:21 +02:00
|
|
|
check_fn_states(fcx, f, id, sp, i);
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
|
|
|
|
2011-06-15 11:19:50 -07:00
|
|
|
fn check_crate(ty::ctxt cx, @crate crate) {
|
2011-05-19 15:47:15 -07:00
|
|
|
let crate_ctxt ccx = new_crate_ctxt(cx);
|
2011-05-14 19:02:30 -07:00
|
|
|
/* Build the global map from function id to var-to-bit-num-map */
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-05-14 19:02:30 -07:00
|
|
|
mk_f_to_fn_info(ccx, crate);
|
2011-05-18 15:43:05 -07:00
|
|
|
/* Add a blank ts_ann for every statement (and expression) */
|
2011-05-14 19:02:30 -07:00
|
|
|
|
2011-06-15 11:19:50 -07:00
|
|
|
annotate_crate(ccx, *crate);
|
2011-05-14 19:02:30 -07:00
|
|
|
/* Compute the pre and postcondition for every subexpression */
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-05-18 16:59:34 -07:00
|
|
|
auto do_pre_post = walk::default_visitor();
|
2011-06-15 11:19:50 -07:00
|
|
|
do_pre_post =
|
2011-06-19 22:41:21 +02:00
|
|
|
rec(visit_fn_post=bind fn_pre_post(ccx, _, _, _, _)
|
2011-06-15 11:19:50 -07:00
|
|
|
with do_pre_post);
|
2011-05-18 16:59:34 -07:00
|
|
|
walk::walk_crate(do_pre_post, *crate);
|
2011-05-18 18:04:07 -07:00
|
|
|
/* Check the pre- and postcondition against the pre- and poststate
|
|
|
|
for every expression */
|
2011-06-15 11:19:50 -07:00
|
|
|
|
2011-05-18 18:04:07 -07:00
|
|
|
auto do_states = walk::default_visitor();
|
2011-06-15 11:19:50 -07:00
|
|
|
do_states =
|
2011-06-19 22:41:21 +02:00
|
|
|
rec(visit_fn_post=bind fn_states(ccx, _, _, _, _) with do_states);
|
2011-05-18 18:04:07 -07:00
|
|
|
walk::walk_crate(do_states, *crate);
|
2011-05-14 19:02:30 -07:00
|
|
|
}
|
|
|
|
//
|
|
|
|
// Local Variables:
|
|
|
|
// mode: rust
|
|
|
|
// fill-column: 78;
|
|
|
|
// indent-tabs-mode: nil
|
|
|
|
// c-basic-offset: 4
|
|
|
|
// buffer-file-coding-system: utf-8-unix
|
|
|
|
// compile-command: "make -k -C $RBUILD 2>&1 | sed -e 's/\\/x\\//x:\\//g'";
|
|
|
|
// End:
|
|
|
|
//
|