Add function inlining pass to improve DSA precision - #809
Open
shaobo-he wants to merge 5 commits into
Open
Conversation
Inline small functions (especially pointer-involving ones) before sea-dsa analysis to reduce unnecessary node merges caused by context-insensitive analysis. Uses SCC-based recursion detection and bottom-up call graph processing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The inlining pass is useful for DSA precision but may not be desired in all contexts. Disable it by default and enable it in the SVCOMP frontend via --inline-funcs flag. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
`-fsanitize=unsigned-integer-overflow` was added to frontend.py by commit 8a69c5d ("updates") alongside genuine inliner work. It was committed by mistake and has nothing to do with function inlining. It was not inert. Because the condition is on the integer encoding rather than on any check being requested, it applied to every run that did not pass `--integer-encoding=bit-vector` -- i.e. the default. clang then emitted `llvm.uadd/usub/umul.with.overflow` intrinsics, which IntegerOverflowChecker matches without discriminating signed from unsigned (lib/smack/IntegerOverflowChecker.cpp:28), so `--check=integer-overflow` reported an error for plain unsigned wraparound: unsigned x = __VERIFIER_nondet_unsigned_int(); unsigned y = x + 1; before: SMACK found an error: integer overflow. after: SMACK found no errors with unroll bound 1. Unsigned wraparound is well-defined modular arithmetic (C17 6.2.5p9), which is why clang leaves this check out of -fsanitize=undefined. On the default unbounded-integer encoding the instrumentation could not even buy precision, since $trunc and $zext are identity functions there. It only added, per unsigned +/-/*, a branch and a call to a bodyless external, plus a pair of ubsan descriptor globals per file. Two further side effects: the rewrite dropped the `{:cexpr}` recording for the assigned variable, so error traces stopped naming it, and one of the new globals embeds the absolute source path, which made $GLOBALS_BOTTOM -- and hence the generated Boogie -- depend on the directory the input happened to live in. The existing suite did not catch any of this: the integer-overflow tests in test/c/targeted-checks and test/c/bits pin --integer-encoding=bit-vector, so the added condition was false for all of them. share/smack/frontend.py is now byte-identical to the merge base again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Inline small functions (especially pointer-involving ones) before sea-dsa analysis to reduce unnecessary node merges caused by context-insensitive analysis. Uses SCC-based recursion detection and bottom-up call graph processing.