/* This file is part of solidity. solidity is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. solidity is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with solidity. If not, see . */ #include #include using namespace std; using namespace dev; using namespace dev::solidity; SMTCheckerImpl::SMTCheckerImpl(ErrorReporter& _errorReporter): m_errorReporter(_errorReporter) { } void SMTCheckerImpl::analyze(SourceUnit const& _source) { bool pragmaFound = false; for (auto const& node: _source.nodes()) if (auto const* pragma = dynamic_cast(node.get())) if (pragma->literals()[0] == "checkAssertionsZ3") pragmaFound = true; if (pragmaFound) { m_interface.reset(); m_currentSequenceCounter.clear(); _source.accept(*this); } } void SMTCheckerImpl::endVisit(VariableDeclaration const& _varDecl) { if (_varDecl.value()) { m_errorReporter.warning( _varDecl.location(), "Assertion checker does not yet support this." ); } else if (_varDecl.isLocalOrReturn()) createVariable(_varDecl, true); else if (_varDecl.isCallableParameter()) createVariable(_varDecl, false); } bool SMTCheckerImpl::visit(FunctionDefinition const& _function) { if (!_function.modifiers().empty() || _function.isConstructor()) m_errorReporter.warning( _function.location(), "Assertion checker does not yet support constructors and functions with modifiers." ); // TODO actually we probably also have to reset all local variables and similar things. m_currentFunction = &_function; m_interface.push(); return true; } void SMTCheckerImpl::endVisit(FunctionDefinition const&) { // TOOD we could check for "reachability", i.e. satisfiability here. m_interface.pop(); m_currentFunction = nullptr; } void SMTCheckerImpl::endVisit(VariableDeclarationStatement const& _varDecl) { if (_varDecl.declarations().size() != 1) m_errorReporter.warning( _varDecl.location(), "Assertion checker does not yet support such variable declarations." ); else if (knownVariable(*_varDecl.declarations()[0]) && _varDecl.initialValue()) // TODO more checks? // TODO add restrictions about type (might be assignment from smaller type) m_interface.addAssertion(newValue(*_varDecl.declarations()[0]) == expr(*_varDecl.initialValue())); else m_errorReporter.warning( _varDecl.location(), "Assertion checker does not yet implement such variable declarations." ); } void SMTCheckerImpl::endVisit(ExpressionStatement const&) { } void SMTCheckerImpl::endVisit(Assignment const& _assignment) { if (_assignment.assignmentOperator() != Token::Value::Assign) m_errorReporter.warning( _assignment.location(), "Assertion checker does not yet implement compound assignment." ); else if (_assignment.annotation().type->category() != Type::Category::Integer) m_errorReporter.warning( _assignment.location(), "Assertion checker does not yet implement type " + _assignment.annotation().type->toString() ); else if (Identifier const* identifier = dynamic_cast(&_assignment.leftHandSide())) { Declaration const* decl = identifier->annotation().referencedDeclaration; if (knownVariable(*decl)) // TODO more checks? // TODO add restrictions about type (might be assignment from smaller type) m_interface.addAssertion(newValue(*decl) == expr(_assignment.rightHandSide())); else m_errorReporter.warning( _assignment.location(), "Assertion checker does not yet implement such assignments." ); } else m_errorReporter.warning( _assignment.location(), "Assertion checker does not yet implement such assignments." ); } void SMTCheckerImpl::endVisit(TupleExpression const& _tuple) { if (_tuple.isInlineArray() || _tuple.components().size() != 1) m_errorReporter.warning( _tuple.location(), "Assertion checker does not yet implement tules and inline arrays." ); else m_interface.addAssertion(expr(_tuple) == expr(*_tuple.components()[0])); } void SMTCheckerImpl::endVisit(BinaryOperation const& _op) { if (Token::isArithmeticOp(_op.getOperator())) arithmeticOperation(_op); else if (Token::isCompareOp(_op.getOperator())) compareOperation(_op); else if (Token::isBooleanOp(_op.getOperator())) booleanOperation(_op); else m_errorReporter.warning( _op.location(), "Assertion checker does not yet implement this operator." ); } void SMTCheckerImpl::endVisit(FunctionCall const& _funCall) { FunctionType const& funType = dynamic_cast(*_funCall.expression().annotation().type); std::vector> const args = _funCall.arguments(); if (funType.kind() == FunctionType::Kind::Assert) { solAssert(args.size() == 1, ""); solAssert(args[0]->annotation().type->category() == Type::Category::Bool, ""); checkCondition(!(expr(*args[0])), _funCall.location(), "Assertion violation"); m_interface.addAssertion(expr(*args[0])); } else if (funType.kind() == FunctionType::Kind::Require) { solAssert(args.size() == 1, ""); solAssert(args[0]->annotation().type->category() == Type::Category::Bool, ""); m_interface.addAssertion(expr(*args[0])); checkCondition(!(expr(*args[0])), _funCall.location(), "Unreachable code"); // TODO is there something meaningful we can check here? // We can check whether the condition is always fulfilled or never fulfilled. } } void SMTCheckerImpl::endVisit(Identifier const& _identifier) { Declaration const* decl = _identifier.annotation().referencedDeclaration; solAssert(decl, ""); if (dynamic_cast(_identifier.annotation().type.get())) { m_interface.addAssertion(expr(_identifier) == currentValue(*decl)); return; } else if (FunctionType const* fun = dynamic_cast(_identifier.annotation().type.get())) { if (fun->kind() == FunctionType::Kind::Assert || fun->kind() == FunctionType::Kind::Require) return; // TODO for others, clear our knowledge about storage and memory } m_errorReporter.warning( _identifier.location(), "Assertion checker does not yet support the type of this expression (" + _identifier.annotation().type->toString() + ")." ); } void SMTCheckerImpl::endVisit(Literal const& _literal) { Type const& type = *_literal.annotation().type; if (type.category() == Type::Category::Integer || type.category() == Type::Category::RationalNumber) { if (RationalNumberType const* rational = dynamic_cast(&type)) solAssert(!rational->isFractional(), ""); m_interface.addAssertion(expr(_literal) == smt::Expression(type.literalValue(&_literal))); } else m_errorReporter.warning( _literal.location(), "Assertion checker does not yet support the type of this expression (" + _literal.annotation().type->toString() + ")." ); } void SMTCheckerImpl::arithmeticOperation(BinaryOperation const& _op) { switch (_op.getOperator()) { case Token::Add: case Token::Sub: case Token::Mul: { solAssert(_op.annotation().commonType, ""); solAssert(_op.annotation().commonType->category() == Type::Category::Integer, ""); smt::Expression left(expr(_op.leftExpression())); smt::Expression right(expr(_op.rightExpression())); Token::Value op = _op.getOperator(); smt::Expression value( op == Token::Add ? left + right : op == Token::Sub ? left - right : /*op == Token::Mul*/ left * right ); // Overflow check auto const& intType = dynamic_cast(*_op.annotation().commonType); checkCondition( value < minValue(intType), _op.location(), "Underflow (resulting value less than " + intType.minValue().str() + ")", "value", &value ); checkCondition( value > maxValue(intType), _op.location(), "Overflow (resulting value larger than " + intType.maxValue().str() + ")", "value", &value ); m_interface.addAssertion(expr(_op) == value); break; } default: m_errorReporter.warning( _op.location(), "Assertion checker does not yet implement this operator." ); } } void SMTCheckerImpl::compareOperation(BinaryOperation const& _op) { solAssert(_op.annotation().commonType, ""); if (_op.annotation().commonType->category() == Type::Category::Integer) { smt::Expression left(expr(_op.leftExpression())); smt::Expression right(expr(_op.rightExpression())); Token::Value op = _op.getOperator(); smt::Expression value = ( op == Token::Equal ? (left == right) : op == Token::NotEqual ? (left != right) : op == Token::LessThan ? (left < right) : op == Token::LessThanOrEqual ? (left <= right) : op == Token::GreaterThan ? (left > right) : /*op == Token::GreaterThanOrEqual*/ (left >= right) ); // TODO: check that other values for op are not possible. m_interface.addAssertion(expr(_op) == value); } else m_errorReporter.warning( _op.location(), "Assertion checker does not yet implement the type " + _op.annotation().commonType->toString() + " for comparisons" ); } void SMTCheckerImpl::booleanOperation(BinaryOperation const& _op) { solAssert(_op.getOperator() == Token::And || _op.getOperator() == Token::Or, ""); solAssert(_op.annotation().commonType, ""); if (_op.annotation().commonType->category() == Type::Category::Bool) { if (_op.getOperator() == Token::And) m_interface.addAssertion(expr(_op) == expr(_op.leftExpression()) && expr(_op.rightExpression())); else m_interface.addAssertion(expr(_op) == expr(_op.leftExpression()) || expr(_op.rightExpression())); } else m_errorReporter.warning( _op.location(), "Assertion checker does not yet implement the type " + _op.annotation().commonType->toString() + " for boolean operations" ); } void SMTCheckerImpl::checkCondition( smt::Expression _condition, SourceLocation const& _location, string const& _description, string const& _additionalValueName, smt::Expression* _additionalValue ) { m_interface.push(); m_interface.addAssertion(_condition); switch (m_interface.check()) { case smt::CheckResult::SAT: { std::ostringstream message; message << _description << " happens here"; if (m_currentFunction) { message << " for:\n"; if (_additionalValue) message << " " << _additionalValueName << " = " << m_interface.eval(*_additionalValue) << "\n"; for (auto const& param: m_currentFunction->parameters()) if (knownVariable(*param)) message << " " << param->name() << " = " << m_interface.eval(currentValue(*param)) << "\n"; for (auto const& var: m_currentFunction->localVariables()) if (knownVariable(*var)) message << " " << var->name() << " = " << m_interface.eval(currentValue(*var)) << "\n"; // message << m << endl; // message << m_solver << endl; } else message << "."; m_errorReporter.warning(_location, message.str()); break; } case smt::CheckResult::UNSAT: break; case smt::CheckResult::UNKNOWN: m_errorReporter.warning(_location, _description + " might happen here."); break; } m_interface.pop(); } void SMTCheckerImpl::createVariable(VariableDeclaration const& _varDecl, bool _setToZero) { if (auto intType = dynamic_cast(_varDecl.type().get())) { solAssert(m_currentSequenceCounter.count(&_varDecl) == 0, ""); solAssert(m_z3Variables.count(&_varDecl) == 0, ""); m_currentSequenceCounter[&_varDecl] = 0; m_z3Variables.emplace(&_varDecl, m_interface.newFunction(uniqueSymbol(_varDecl), smt::Sort::Int, smt::Sort::Int)); if (_setToZero) m_interface.addAssertion(currentValue(_varDecl) == 0); else { m_interface.addAssertion(currentValue(_varDecl) >= minValue(*intType)); m_interface.addAssertion(currentValue(_varDecl) <= maxValue(*intType)); } } else m_errorReporter.warning( _varDecl.location(), "Assertion checker does not yet support the type of this variable." ); } string SMTCheckerImpl::uniqueSymbol(Declaration const& _decl) { return _decl.name() + "_" + to_string(_decl.id()); } string SMTCheckerImpl::uniqueSymbol(Expression const& _expr) { return "expr_" + to_string(_expr.id()); } bool SMTCheckerImpl::knownVariable(Declaration const& _decl) { return m_currentSequenceCounter.count(&_decl); } smt::Expression SMTCheckerImpl::currentValue(Declaration const& _decl) { solAssert(m_currentSequenceCounter.count(&_decl), ""); return var(_decl)(m_currentSequenceCounter.at(&_decl)); } smt::Expression SMTCheckerImpl::newValue(const Declaration& _decl) { solAssert(m_currentSequenceCounter.count(&_decl), ""); m_currentSequenceCounter[&_decl]++; return currentValue(_decl); } smt::Expression SMTCheckerImpl::minValue(IntegerType const& _t) { return m_interface.newInteger(_t.minValue()); } smt::Expression SMTCheckerImpl::maxValue(IntegerType const& _t) { return m_interface.newInteger(_t.maxValue()); } smt::Expression SMTCheckerImpl::expr(Expression const& _e) { if (!m_z3Expressions.count(&_e)) { solAssert(_e.annotation().type, ""); switch (_e.annotation().type->category()) { case Type::Category::RationalNumber: { if (RationalNumberType const* rational = dynamic_cast(_e.annotation().type.get())) solAssert(!rational->isFractional(), ""); m_z3Expressions.emplace(&_e, m_interface.newInteger(uniqueSymbol(_e))); break; } case Type::Category::Integer: m_z3Expressions.emplace(&_e, m_interface.newInteger(uniqueSymbol(_e))); break; case Type::Category::Bool: m_z3Expressions.emplace(&_e, m_interface.newBool(uniqueSymbol(_e))); break; default: solAssert(false, "Type not implemented."); } } return m_z3Expressions.at(&_e); } smt::Expression SMTCheckerImpl::var(Declaration const& _decl) { solAssert(m_z3Variables.count(&_decl), ""); return m_z3Variables.at(&_decl); }