Skip to content

Delay Spec lifter argument conversions until exception handlers inside lift_fun - #2108

Merged
sim642 merged 1 commit into
masterfrom
qsolver-deadcode-escape
Sep 17, 2026
Merged

sim642 merged 1 commit into
masterfrom
qsolver-deadcode-escape

Conversation

@sim642

@sim642 sim642 commented Aug 18, 2026 •

Copy link
Copy Markdown
Member

In particular, this should fix an issue encountered by Kalmer's QSolvers where the Deadcode exception escaped to the top level due to conv on bottom happening outside the exception handler.

  • At 5410a4f, the qsr solver crashes on Concrat pigz after 13.8s:

    ./goblint --enable ana.sv-comp.enabled --enable ana.sv-comp.functions --set 'lib.activated[+]' zlib --set 'lib.activated[+]' pcre --set 'lib.activated[+]' liblzma -v --set solver qsr --sets ana.specification /mnt/goblint-svcomp/goblint-bench/bench/concrat/properties/no-data-race.prp --sets exp.architecture 64bit /mnt/goblint-svcomp/goblint-bench/bench/concrat/pigz/main.c
    Fatal error: exception Goblint_lib__Analyses.Deadcode
    Marked with transfer function at /mnt/goblint-svcomp/goblint-bench/bench/concrat/pigz/main.c:8695:3-8695:49
    Raised at Goblint_lib__Analyses.Dom.unlift in file "src/framework/analyses.ml", line 134, characters 11-25
    Called from Goblint_lib__SpecLifters.DeadCodeLifter.conv in file "src/lifters/specLifters.ml", line 570, characters 23-41
    Called from Goblint_lib__SpecLifters.DeadCodeLifter.event in file "src/lifters/specLifters.ml", line 606, characters 122-133
    Called from Goblint_lib__SpecLifters.DomainLifter.event in file "src/lifters/specLifters.ml", line 109, characters 14-46
    Called from Goblint_lib__Constraints.FromSpec.tf_proc.tf_special_call.once in file "src/framework/constraints.ml", line 273, characters 19-84
    Called from Goblint_lib__Constraints.FromSpec.tf_proc.one_function in file "src/framework/constraints.ml", line 317, characters 15-36
    [...]
    
  • At a6eed62 (on master), the td3 solver with narrow-globs crashes on Concrat pigz after 1.26s:

    ./goblint --enable ana.sv-comp.enabled --enable ana.sv-comp.functions --set 'lib.activated[+]' zlib --set 'lib.activated[+]' pcre --set 'lib.activated[+]' liblzma -v --set solver td3 --enable solvers.td3.narrow-globs.enabled --set solvers.td3.side_widen_gas 2 --set solvers.td3.widen_gas 2 --enable solvers.td3.narrow-globs.eliminate-dead --set solvers.td3.narrow-globs.narrow-gas -1 --sets ana.specification /mnt/goblint-svcomp/goblint-bench/bench/concrat/properties/no-data-race.prp --sets exp.architecture 64bit /mnt/goblint-svcomp/goblint-bench/bench/concrat/pigz/main.c
    Fatal error: exception Fun.Finally_raised: Fun.Finally_raised: Fun.Finally_raised: Fun.Finally_raised: Fun.Finally_raised: Goblint_lib__Analyses.Deadcode
    Marked with transfer function at /home/simmo/dev/goblint/sv-comp/goblint-bench/concrat/pigz/main.c:2862:7-2862:71
    Marked with transfer function at /home/simmo/dev/goblint/sv-comp/goblint-bench/concrat/pigz/main.c:3746:7-3746:23
    Marked with transfer function at /home/simmo/dev/goblint/sv-comp/goblint-bench/concrat/pigz/main.c:5332:3-5332:25
    Marked with transfer function at /home/simmo/dev/goblint/sv-comp/goblint-bench/concrat/pigz/main.c:7452:7-7452:18
    Marked with transfer function at /home/simmo/dev/goblint/sv-comp/goblint-bench/concrat/pigz/main.c:7395:9-7395:23
    Marked with transfer function at /home/simmo/dev/goblint/sv-comp/goblint-bench/concrat/pigz/main.c:8575:13-8575:30
    Raised at Goblint_lib__Analyses.Dom.unlift in file "src/framework/analyses.ml", line 134, characters 11-25
    Called from Goblint_lib__SpecLifters.DeadCodeLifter.conv in file "src/lifters/specLifters.ml", line 570, characters 23-41
    Called from Goblint_lib__SpecLifters.DeadCodeLifter.event in file "src/lifters/specLifters.ml", line 606, characters 122-133
    Called from Goblint_lib__SpecLifters.DomainLifter.event in file "src/lifters/specLifters.ml", line 109, characters 14-46
    Called from Goblint_lib__Constraints.FromSpec.tf_proc.tf_special_call.once in file "src/framework/constraints.ml", line 273, characters 19-84
    [...]
    

TODO

  • Test that the issue with QSolvers is fixed: no crash in 15min.
  • Test that the issue with TD3 is fixed: no crash in 15min.

…e lift_fun

In particular, this should fix an issue encountered by Kalmer's QSolvers where the Deadcode exception escaped to the top level due to conv on bottom happening outside the exception handler.
@sim642 sim642 self-assigned this Aug 18, 2026
@sim642 sim642 added the bug label Aug 18, 2026
@sim642 sim642 mentioned this pull request Aug 24, 2026
10 tasks
@sim642 sim642 added this to the v2.9.0 milestone Aug 31, 2026
@sim642 sim642 removed their assignment Aug 31, 2026
@sim642
sim642 marked this pull request as ready for review August 31, 2026 08:02
@sim642
sim642 merged commit 05a5419 into master Sep 17, 2026
19 checks passed
@sim642
sim642 deleted the qsolver-deadcode-escape branch September 17, 2026 17:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant