Traces printed using the --trace option doesn't show memory operations performed by printf() (and maybe filesystem steps?).

Currently, RefinedC rejects expressions of the form e1 == e2 in the case where e1 and e2 have different integer types T1 and T2. What I'd like to do is find out which of T1 or T2 is more general, and automatically insert a cast to it on the operand with the less general type. Is that a reasonable approach? And if yes, how can I determine which type is more general?

Some global definitions do not show up on the generated Core, for example:

union { // same problem with a struct
  short c1, c2;
} d;

short *glob_bug = &d.c2; // this disappear at the level of Core

short *glob_ok; 

The Core linking function Core_linking.merge_globs seems to be the culprit.

UI bug: When I load a file (eg from PNVI tests), step through a bit, then load a new file, it doesn't clear the displayed memory graph. The same should happen if the source is edited live.

UI enhancement: When a new user sees an example in the UI, eg from a link, we'd usually like them to try stepping. That'd be more obvious if the "Step n: Forward" button was coloured green, as in the isla-axiomatic UI (https://isla-axiomatic.cl.cam.ac.uk/).

#include <assert.h>
#include <string.h>

int main() {
    int i=42;
    int *x= &i;
    int *y= 0;
    unsigned char buffer[sizeof(x)];
    memcpy(buffer, &x, sizeof(x));
    memcpy(&y, buffer, sizeof(x));
    assert(x == y);
    assert(*y==42);
}

https://cerberus.cl.cam.ac.uk/?short/4eef98

When occuring inside the body of a function, the lifetime of unnamed object should be automatic.

https://github.com/rems-project/cerberus-private/blob/b55da7eca19925d7cb0b76c8a3d660bf371caea5/frontend/model/translation.lem#L2681

You get the error:

cerberus: internal error, uncaught exception:
(Failure "internal error: gentpying.annotate_expression: AilEident symbol couldn't be resolved")

if you run dune exec -- cerberus test.c where test.c is the file:

void f() {
  int array[20];
  _Static_assert(sizeof(array) < 100, "ERROR");
}

I am getting the following error when trying to use Ocaml_implementation.HafniumImml.typeof_enum:

internal error, uncaught exception:
(Failure "Hafnium impl => typeof_enum: 'Symbol(446, Just (\"e\"))' was not registered")

Any idea where this comes from? Is there any restriction for using this function?

If you run the frontend on the following file (called test.c)

int main(){
  uintptr_t i = 0;
  return 0;
}

then you get the following error (file path shortened).

test.c:2:13: error: unexpected token 'i'
  uintptr_t i = 0;
            ^ 

So what I thought seeing that is that there was a weird bug with the lexer or the parser. However, it turns out that I forgot to add #include <stding.h>, and so uintptr_t is unknown. Obviously the error message is suboptimal.

If I try gcc I get the following.

test.c: In function ‘main’:
test.c:2:3: error: unknown type name ‘uintptr_t’
    2 |   uintptr_t i = 0;
      |   ^~~~~~~~~

And with clang I get the following.

test.c:2:3: error: use of undeclared identifier 'uintptr_t'
  uintptr_t i = 0;
  ^
1 error generated.

Is there any plan to support flexible array members? (At least up to typed ail.)

"attribute declaration" causes a runtime error:

int main(void) {
  [[foo]];
}

It would be nice for it to be pushed to the Ail AST instead. rems-project/cerberus-old#46

(Leaving this for later)

struct [[ AA ]] T2;
struct [[ BB ]] T2 { int x; } st2;

the Ail StructDef for T2 should have both AA and BB as annotations, but currently AA is missing.

// whole translation unit:
struct T st;

this should properly give an error: the tentative definition of struct T is still incomplete at the end of the translation unit.

Currently, cerby does:

cerberus: internal error, uncaught exception: (Failure "internal error: [Cabs_to_ail.mk_zeroInit_aux] - internal ERROR: Struct")

The Ail AST exposes attributes on function definitions, but not in several other places where @MackieLoeffel and I need them:

• on the definition of structures and unions,
• on their fields,
• on statements.

Would it be possible to add them, or alternatively tell me how to do it properly?

I tried to do the modifications myself, but I'm not quite sure how to do this right. And I don't want to spend the day figuring out which constructor I should extend at the Cabs level if someone else can do it in five minutes!

I found something rather weird in the Ail AST that is generated by Cerberus. Apparently, a continue in C is translated to a AilSgoto "continueN" and an AilSlabel "continueN" where N is some unique number. However, I do not expect this translation to be made at the Ail level since it has an AilScontinue constructor.

Note that break is handled properly, with the AilSbreak constructor and no generated label.

The integer character constant '\xFF' should have value -1 on implementations where char is signed (the default impl choice for cerby), and 255 otherwise. This is because (§6.4.4.4#10) says that the value of integer character constants containing an escape sequence is interpreted as a value of type char (then converted to int).

Currently cerby evaluates this to 255 because Decode_ocaml.decode_character_constant simply uses the integer constant decoding function for escape sequences.

Additionally, the following:

'\xFFF';

should result in a constraint violation according to (§6.4.4.4#9).

#include <stdio.h>

union {
    int x[2];
    struct { int y; int z; };
} foo;

static void f (int * p, int * q) {
    if (p == q) {
        *p = 1;
    } else {
        *q = 1;
    }
}

int g() {
    int * p = foo.x + 1;    // In-bounds
    int * q = &(foo.z);     // In-bounds, should coincide with x[1]

    f(p, q);
}

int main(void){ g(); }

This fails with TODO: abst, Union (as value). This seems related, but distinct from rems-project/cerberus-old#11 .

Edit: minor tweak to make the program interesting. Output from Cerberus unchanged.

AilTypesAux.are_compatible is wrong for Struct/Union types from different translation units. We need to replace the comparison of the tag symbol with a lookup of the associated string + tag definitions (for one-to-one correspondence).

Example of broken program:

// header.h
typedef struct T {
int x;
} mytype;

int f(mytype);
int (*fp)(mytype);

void init(void);

// first.c
#include "header.h"

int main(void)
{
  init();
  mytype st;
  st.x = 10;
  return fp(st);
}

// second.c
#include "header.h"

void init(void)
{
  fp = f;
}

int f(mytype st) {
  return st.x;
}