analyzer
analyzer copied to clipboard
Fix C2PO witness invariant generation
Inspired by https://github.com/goblint/analyzer/issues/1710#issuecomment-2717951685, I wondered what invariants C2PO analysis even generates. Turns out, none! Which is surprising, because it does implement the Invariant query.
I have no idea what's happening in the C2PO domain, but its pseudo-variable handling logic somehow even messes up normal program variables: Var.to_varinfo (NormalVar var) returns something different from var. And that variable is such that the temp-ness and in-scope checks cause everything to be filtered out.
I'm not sure why it does things the way it does and what should happen with non-NormalVar.
It then outputs some interesting invariants:
- On line 19:
z == x + -1(which makes sense) and*x == *(z + 1)(which I guess is somehow derived from the former). The latter seems redundant. - On line 20:
z != *x(where bothxandzare of typelong*). The comparison oflong*andlongis strange. But I'm also not sure if it's even true:zis just freshly allocated, so it's pointer value (cast tolong) may equal an arbitrary integer.