{"action":"created","issue":{"url":"https://api.github.com/repos/StanfordPL/stoke/issues/970","repository_url":"https://api.github.com/repos/StanfordPL/stoke","labels_url":"https://api.github.com/repos/StanfordPL/stoke/issues/970/labels{/name}","comments_url":"https://api.github.com/repos/StanfordPL/stoke/issues/970/comments","events_url":"https://api.github.com/repos/StanfordPL/stoke/issues/970/events","html_url":"https://github.com/StanfordPL/stoke/issues/970","id":244270103,"number":970,"title":"Stoke produce incorrect rewrite for global variable","user":{"login":"yzhao30","id":719033,"avatar_url":"https://avatars0.githubusercontent.com/u/719033?v=4","gravatar_id":"","url":"https://api.github.com/users/yzhao30","html_url":"https://github.com/yzhao30","followers_url":"https://api.github.com/users/yzhao30/followers","following_url":"https://api.github.com/users/yzhao30/following{/other_user}","gists_url":"https://api.github.com/users/yzhao30/gists{/gist_id}","starred_url":"https://api.github.com/users/yzhao30/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yzhao30/subscriptions","organizations_url":"https://api.github.com/users/yzhao30/orgs","repos_url":"https://api.github.com/users/yzhao30/repos","events_url":"https://api.github.com/users/yzhao30/events{/privacy}","received_events_url":"https://api.github.com/users/yzhao30/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-07-20T07:32:06Z","updated_at":"2017-07-20T21:43:21Z","closed_at":null,"body":"It can be reproduced using the example tutorial, just add a global variable\r\n\r\n```C++\r\nuint64_t ga = 0;\r\nsize_t popcnt(uint64_t x) {\r\n  int res = 0;\r\n  for (; x > 0; x >>= 1) {\r\n    res += x & 0x1ull;\r\n  }\r\n  ga += res;\r\n  return res;\r\n}\r\n```\r\n\r\nThe original function is\r\n\r\n```asm\r\n  # Text                       #  Line  RIP       Bytes  Opcode             \r\n._Z6popcntm:                 #        0x4006d0  0      OPC=<label>        \r\n  testq %rdi, %rdi           #  1     0x4006d0  3      OPC=testq_r64_r64  \r\n  je .L_4006f6               #  2     0x4006d3  2      OPC=je_label       \r\n  xorl %eax, %eax            #  3     0x4006d5  2      OPC=xorl_r32_r32           \r\n.L_4006e0:                   #        0x4006e0  0      OPC=<label>        \r\n  movl %edi, %edx            #  13    0x4006e0  2      OPC=movl_r32_r32   \r\n  andl $0x1, %edx            #  14    0x4006e2  3      OPC=andl_r32_imm8  \r\n  addl %edx, %eax            #  15    0x4006e5  2      OPC=addl_r32_r32   \r\n  shrq $0x1, %rdi            #  16    0x4006e7  3      OPC=shrq_r64_one   \r\n  jne .L_4006e0              #  17    0x4006ea  2      OPC=jne_label      \r\n  cltq                       #  18    0x4006ec  2      OPC=cltq           \r\n.L_4006ee:                   #        0x4006ee  0      OPC=<label>        \r\n  addq %rax, 0x200953(%rip)  #  19    0x4006ee  7      OPC=addq_m64_r64   \r\n  retq                       #  20    0x4006f5  1      OPC=retq           \r\n.L_4006f6:                   #        0x4006f6  0      OPC=<label>        \r\n  xorl %eax, %eax            #  21    0x4006f6  2      OPC=xorl_r32_r32   \r\n  jmpq .L_4006ee             #  22    0x4006f8  2      OPC=jmpq_label     \r\n```\r\n\r\nthe rewrite is\r\n\r\n```asm\r\n._Z6popcntm:         #        0x4006d0  0      OPC=<label>          \r\n  popcntq %rdi, %r9  #  1     0x4006d0  5      OPC=popcntq_r64_r64  \r\n  xchgq %r9, %rax    #  2     0x4006d5  3      OPC=xchgq_r64_r64_1  \r\n  retq               #  3     0x4006d8  1      OPC=retq           \r\n``` \r\n\r\nThe optimization totally ignore the global variable. Besides, instruction with memory dereference also results in incorrect rewrite. I am not sure how does the STOKE generate testcases for memory locations. \r\n"},"comment":{"url":"https://api.github.com/repos/StanfordPL/stoke/issues/comments/316838585","html_url":"https://github.com/StanfordPL/stoke/issues/970#issuecomment-316838585","issue_url":"https://api.github.com/repos/StanfordPL/stoke/issues/970","id":316838585,"user":{"login":"yzhao30","id":719033,"avatar_url":"https://avatars0.githubusercontent.com/u/719033?v=4","gravatar_id":"","url":"https://api.github.com/users/yzhao30","html_url":"https://github.com/yzhao30","followers_url":"https://api.github.com/users/yzhao30/followers","following_url":"https://api.github.com/users/yzhao30/following{/other_user}","gists_url":"https://api.github.com/users/yzhao30/gists{/gist_id}","starred_url":"https://api.github.com/users/yzhao30/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yzhao30/subscriptions","organizations_url":"https://api.github.com/users/yzhao30/orgs","repos_url":"https://api.github.com/users/yzhao30/repos","events_url":"https://api.github.com/users/yzhao30/events{/privacy}","received_events_url":"https://api.github.com/users/yzhao30/received_events","type":"User","site_admin":false},"created_at":"2017-07-20T21:43:21Z","updated_at":"2017-07-20T21:43:21Z","body":"I see. Yes it seems the rewrite is correct after using the --stack_out and --heap_out. I use the tutorial example to reproduce this issue because I met this error in other programs, but I will check the options first. I will close this issue after the conversation. \r\n\r\nBy the way, in the `hold_out` strategy, does stoke also run the formal validation in the end or it only runs the `testcase` verification and not the formal validator at all? In my observation, the successful found rewrite in the `bold_out` also fail the program very likely. Thanks."}}
{"actor":{"display_login":"yzhao30"}}