Skip to content

Commit f2667db

Browse files
tautschnigtautschnig
committed
Merge remote-tracking branch 'origin/main' into unchecked_mull_add
2 parents 8bd1151 + f804a33 commit f2667db

File tree

34 files changed

+309
-283
lines changed

34 files changed

+309
-283
lines changed

‎.github/workflows/kani-metrics.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
python-version: '3.x'
2727

2828
- name: Compute Kani Metrics
29-
run: ./scripts/run-kani.sh --run metrics --path ${{github.workspace}}
29+
run: ./scripts/run-kani.sh --run metrics --with-autoharness --path ${{github.workspace}}
3030

3131
- name: Create Pull Request
3232
uses: peter-evans/create-pull-request@v7

‎.github/workflows/kani.yml

+108-2
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,79 @@ jobs:
5353
- name: Run Kani Verification
5454
run: head/scripts/run-kani.sh --path ${{github.workspace}}/head
5555

56+
kani-autoharness:
57+
name: Verify std library using autoharness
58+
runs-on: ${{ matrix.os }}
59+
strategy:
60+
matrix:
61+
os: [ubuntu-latest, macos-latest]
62+
include:
63+
- os: ubuntu-latest
64+
base: ubuntu
65+
- os: macos-latest
66+
base: macos
67+
fail-fast: false
68+
69+
steps:
70+
# Step 1: Check out the repository
71+
- name: Checkout Repository
72+
uses: actions/checkout@v4
73+
with:
74+
submodules: true
75+
76+
# Step 2: Run Kani autoharness on the std library for selected functions.
77+
# Uses "--include-pattern" to make sure we do not try to run across all
78+
# possible functions as that may take a lot longer than expected. Instead,
79+
# explicitly list all functions (or prefixes thereof) the proofs of which
80+
# are known to pass.
81+
- name: Run Kani Verification
82+
run: |
83+
scripts/run-kani.sh --run autoharness --kani-args \
84+
--include-pattern alloc::layout::Layout::from_size_align \
85+
--include-pattern ascii::ascii_char::AsciiChar::from_u8 \
86+
--include-pattern char::convert::from_u32_unchecked \
87+
--include-pattern "num::nonzero::NonZero::<i8>::count_ones" \
88+
--include-pattern "num::nonzero::NonZero::<i16>::count_ones" \
89+
--include-pattern "num::nonzero::NonZero::<i32>::count_ones" \
90+
--include-pattern "num::nonzero::NonZero::<i64>::count_ones" \
91+
--include-pattern "num::nonzero::NonZero::<i128>::count_ones" \
92+
--include-pattern "num::nonzero::NonZero::<isize>::count_ones" \
93+
--include-pattern "num::nonzero::NonZero::<u8>::count_ones" \
94+
--include-pattern "num::nonzero::NonZero::<u16>::count_ones" \
95+
--include-pattern "num::nonzero::NonZero::<u32>::count_ones" \
96+
--include-pattern "num::nonzero::NonZero::<u64>::count_ones" \
97+
--include-pattern "num::nonzero::NonZero::<u128>::count_ones" \
98+
--include-pattern "num::nonzero::NonZero::<usize>::count_ones" \
99+
--include-pattern "num::nonzero::NonZero::<i8>::rotate_" \
100+
--include-pattern "num::nonzero::NonZero::<i16>::rotate_" \
101+
--include-pattern "num::nonzero::NonZero::<i32>::rotate_" \
102+
--include-pattern "num::nonzero::NonZero::<i64>::rotate_" \
103+
--include-pattern "num::nonzero::NonZero::<i128>::rotate_" \
104+
--include-pattern "num::nonzero::NonZero::<isize>::rotate_" \
105+
--include-pattern "num::nonzero::NonZero::<u8>::rotate_" \
106+
--include-pattern "num::nonzero::NonZero::<u16>::rotate_" \
107+
--include-pattern "num::nonzero::NonZero::<u32>::rotate_" \
108+
--include-pattern "num::nonzero::NonZero::<u64>::rotate_" \
109+
--include-pattern "num::nonzero::NonZero::<u128>::rotate_" \
110+
--include-pattern "num::nonzero::NonZero::<usize>::rotate_" \
111+
--include-pattern ptr::align_offset::mod_inv \
112+
--include-pattern ptr::alignment::Alignment::as_nonzero \
113+
--include-pattern ptr::alignment::Alignment::as_usize \
114+
--include-pattern ptr::alignment::Alignment::log2 \
115+
--include-pattern ptr::alignment::Alignment::mask \
116+
--include-pattern ptr::alignment::Alignment::new \
117+
--include-pattern ptr::alignment::Alignment::new_unchecked \
118+
--include-pattern time::Duration::from_micros \
119+
--include-pattern time::Duration::from_millis \
120+
--include-pattern time::Duration::from_nanos \
121+
--include-pattern time::Duration::from_secs \
122+
--exclude-pattern time::Duration::from_secs_f \
123+
--include-pattern unicode::unicode_data::conversions::to_ \
124+
--exclude-pattern ::precondition_check \
125+
--harness-timeout 5m \
126+
--default-unwind 1000 \
127+
--jobs=3 --output-format=terse
128+
56129
run-kani-list:
57130
name: Kani List
58131
runs-on: ubuntu-latest
@@ -66,8 +139,14 @@ jobs:
66139

67140
# Step 2: Run list on the std library
68141
- name: Run Kani List
69-
run: head/scripts/run-kani.sh --run list --path ${{github.workspace}}/head
70-
142+
run: |
143+
head/scripts/run-kani.sh --run list --with-autoharness --path ${{github.workspace}}/head
144+
# remove duplicate white space to reduce file size (GitHub permits at
145+
# most one 1MB)
146+
ls -l ${{github.workspace}}/head/kani-list.md
147+
perl -p -i -e 's/ +/ /g' ${{github.workspace}}/head/kani-list.md
148+
ls -l ${{github.workspace}}/head/kani-list.md
149+
71150
# Step 3: Add output to job summary
72151
- name: Add Kani List output to job summary
73152
uses: actions/github-script@v6
@@ -79,3 +158,30 @@ jobs:
79158
.addHeading('Kani List Output', 2)
80159
.addRaw(kaniOutput, false)
81160
.write();
161+
162+
run-autoharness-analyzer:
163+
name: Kani Autoharness Analyzer
164+
runs-on: ubuntu-latest
165+
steps:
166+
# Step 1: Check out the repository
167+
- name: Checkout Repository
168+
uses: actions/checkout@v4
169+
with:
170+
submodules: true
171+
172+
# Step 2: Run autoharness analyzer on the std library
173+
- name: Run Autoharness Analyzer
174+
run: scripts/run-kani.sh --run autoharness-analyzer
175+
176+
# Step 3: Add output to job summary
177+
- name: Add Autoharness Analyzer output to job summary
178+
run: |
179+
echo "# Autoharness Failure Summary" >> "$GITHUB_STEP_SUMMARY"
180+
echo "## Crate core, all functions" >> "$GITHUB_STEP_SUMMARY"
181+
cat autoharness_analyzer/core_autoharness_data.md >> "$GITHUB_STEP_SUMMARY"
182+
echo "## Crate core, unsafe functions" >> "$GITHUB_STEP_SUMMARY"
183+
cat autoharness_analyzer/core_autoharness_data.md >> "$GITHUB_STEP_SUMMARY"
184+
echo "## Crate std, all functions" >> "$GITHUB_STEP_SUMMARY"
185+
cat autoharness_analyzer/std_autoharness_data.md >> "$GITHUB_STEP_SUMMARY"
186+
echo "## Crate std, unsafe functions" >> "$GITHUB_STEP_SUMMARY"
187+
cat autoharness_analyzer/std_unsafe_autoharness_data.md >> "$GITHUB_STEP_SUMMARY"

‎doc/src/SUMMARY.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@
3131
- [15: Contracts and Tests for SIMD Intrinsics](./challenges/0015-intrinsics-simd.md)
3232
- [16: Verify the safety of Iterator functions](./challenges/0016-iter.md)
3333
- [17: Verify the safety of slice functions](./challenges/0017-slice.md)
34-
- [18: Verify the safety of slice iter functions](./challenges/0018-slice-iter-pt1.md)
34+
- [18: Verify the safety of slice iter functions](./challenges/0018-slice-iter.md)

‎library/Cargo.lock

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎library/alloc/Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ bench = false
1616

1717
[dependencies]
1818
core = { path = "../core", public = true }
19-
compiler_builtins = { version = "=0.1.155", features = ['rustc-dep-of-std'] }
2019
safety = { path = "../contracts/safety" }
20+
compiler_builtins = { version = "=0.1.156", features = ['rustc-dep-of-std'] }
2121

2222
[features]
2323
compiler-builtins-mem = ['compiler_builtins/mem']

‎library/core/src/alloc/layout.rs

-18
Original file line numberDiff line numberDiff line change
@@ -637,24 +637,6 @@ mod verify {
637637
}
638638
}
639639

640-
// pub const fn from_size_align(size: usize, align: usize) -> Result<Self, LayoutError>
641-
#[kani::proof_for_contract(Layout::from_size_align)]
642-
pub fn check_from_size_align() {
643-
let s = kani::any::<usize>();
644-
let a = kani::any::<usize>();
645-
let _ = Layout::from_size_align(s, a);
646-
}
647-
648-
// pub const unsafe fn from_size_align_unchecked(size: usize, align: usize) -> Self
649-
#[kani::proof_for_contract(Layout::from_size_align_unchecked)]
650-
pub fn check_from_size_align_unchecked() {
651-
let s = kani::any::<usize>();
652-
let a = kani::any::<usize>();
653-
unsafe {
654-
let _ = Layout::from_size_align_unchecked(s, a);
655-
}
656-
}
657-
658640
// pub const fn size(&self) -> usize
659641
#[kani::proof]
660642
pub fn check_size() {

‎library/core/src/ascii/ascii_char.rs

-20
Original file line numberDiff line numberDiff line change
@@ -621,23 +621,3 @@ impl fmt::Debug for AsciiChar {
621621
f.write_str(buf[..len].as_str())
622622
}
623623
}
624-
625-
#[cfg(kani)]
626-
#[unstable(feature = "kani", issue = "none")]
627-
mod verify {
628-
use AsciiChar;
629-
630-
use super::*;
631-
632-
#[kani::proof_for_contract(AsciiChar::from_u8)]
633-
fn check_from_u8() {
634-
let b: u8 = kani::any();
635-
AsciiChar::from_u8(b);
636-
}
637-
638-
#[kani::proof_for_contract(AsciiChar::from_u8_unchecked)]
639-
fn check_from_u8_unchecked() {
640-
let b: u8 = kani::any();
641-
unsafe { AsciiChar::from_u8_unchecked(b) };
642-
}
643-
}

‎library/core/src/char/convert.rs

-12
Original file line numberDiff line numberDiff line change
@@ -288,15 +288,3 @@ pub(super) const fn from_digit(num: u32, radix: u32) -> Option<char> {
288288
None
289289
}
290290
}
291-
292-
#[cfg(kani)]
293-
#[unstable(feature = "kani", issue = "none")]
294-
mod verify {
295-
use super::*;
296-
297-
#[kani::proof_for_contract(from_u32_unchecked)]
298-
fn check_from_u32_unchecked() {
299-
let i: u32 = kani::any();
300-
unsafe { from_u32_unchecked(i) };
301-
}
302-
}

‎library/core/src/num/f128.rs

+3
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,9 @@ impl f128 {
151151
pub const RADIX: u32 = 2;
152152

153153
/// Number of significant digits in base 2.
154+
///
155+
/// Note that the size of the mantissa in the bitwise representation is one
156+
/// smaller than this since the leading 1 is not stored explicitly.
154157
#[unstable(feature = "f128", issue = "116909")]
155158
pub const MANTISSA_DIGITS: u32 = 113;
156159

‎library/core/src/num/f16.rs

+3
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,9 @@ impl f16 {
146146
pub const RADIX: u32 = 2;
147147

148148
/// Number of significant digits in base 2.
149+
///
150+
/// Note that the size of the mantissa in the bitwise representation is one
151+
/// smaller than this since the leading 1 is not stored explicitly.
149152
#[unstable(feature = "f16", issue = "116909")]
150153
pub const MANTISSA_DIGITS: u32 = 11;
151154

‎library/core/src/num/f32.rs

+3
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,9 @@ impl f32 {
396396
pub const RADIX: u32 = 2;
397397

398398
/// Number of significant digits in base 2.
399+
///
400+
/// Note that the size of the mantissa in the bitwise representation is one
401+
/// smaller than this since the leading 1 is not stored explicitly.
399402
#[stable(feature = "assoc_int_consts", since = "1.43.0")]
400403
pub const MANTISSA_DIGITS: u32 = 24;
401404

‎library/core/src/num/f64.rs

+3
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,9 @@ impl f64 {
396396
pub const RADIX: u32 = 2;
397397

398398
/// Number of significant digits in base 2.
399+
///
400+
/// Note that the size of the mantissa in the bitwise representation is one
401+
/// smaller than this since the leading 1 is not stored explicitly.
399402
#[stable(feature = "assoc_int_consts", since = "1.43.0")]
400403
pub const MANTISSA_DIGITS: u32 = 53;
401404
/// Approximate number of significant digits in base 10.

‎library/core/src/num/int_macros.rs

+3
Original file line numberDiff line numberDiff line change
@@ -1589,6 +1589,7 @@ macro_rules! int_impl {
15891589
let mut base = self;
15901590
let mut acc: Self = 1;
15911591

1592+
#[safety::loop_invariant(true)]
15921593
loop {
15931594
if (exp & 1) == 1 {
15941595
acc = try_opt!(acc.checked_mul(base));
@@ -2299,6 +2300,7 @@ macro_rules! int_impl {
22992300
let mut acc: Self = 1;
23002301

23012302
if intrinsics::is_val_statically_known(exp) {
2303+
#[safety::loop_invariant(exp>=1)]
23022304
while exp > 1 {
23032305
if (exp & 1) == 1 {
23042306
acc = acc.wrapping_mul(base);
@@ -2316,6 +2318,7 @@ macro_rules! int_impl {
23162318
// at compile time. We can't use the same code for the constant
23172319
// exponent case because LLVM is currently unable to unroll
23182320
// this loop.
2321+
#[safety::loop_invariant(true)]
23192322
loop {
23202323
if (exp & 1) == 1 {
23212324
acc = acc.wrapping_mul(base);

‎library/core/src/num/nonzero.rs

+5-52
Original file line numberDiff line numberDiff line change
@@ -728,6 +728,7 @@ macro_rules! nonzero_integer {
728728
#[must_use = "this returns the result of the operation, \
729729
without modifying the original"]
730730
#[inline(always)]
731+
#[ensures(|result| result.get() > 0)]
731732
pub const fn count_ones(self) -> NonZero<u32> {
732733
// SAFETY:
733734
// `self` is non-zero, which means it has at least one bit set, which means
@@ -761,6 +762,8 @@ macro_rules! nonzero_integer {
761762
#[must_use = "this returns the result of the operation, \
762763
without modifying the original"]
763764
#[inline(always)]
765+
#[ensures(|result| result.get() > 0)]
766+
#[ensures(|result| result.rotate_right(n).get() == old(self).get())]
764767
pub const fn rotate_left(self, n: u32) -> Self {
765768
let result = self.get().rotate_left(n);
766769
// SAFETY: Rotating bits preserves the property int > 0.
@@ -794,6 +797,8 @@ macro_rules! nonzero_integer {
794797
#[must_use = "this returns the result of the operation, \
795798
without modifying the original"]
796799
#[inline(always)]
800+
#[ensures(|result| result.get() > 0)]
801+
#[ensures(|result| result.rotate_left(n).get() == old(self).get())]
797802
pub const fn rotate_right(self, n: u32) -> Self {
798803
let result = self.get().rotate_right(n);
799804
// SAFETY: Rotating bits preserves the property int > 0.
@@ -2618,58 +2623,6 @@ mod verify {
26182623
nonzero_check_clamp_panic!(core::num::NonZeroU128, nonzero_check_clamp_panic_for_u128);
26192624
nonzero_check_clamp_panic!(core::num::NonZeroUsize, nonzero_check_clamp_panic_for_usize);
26202625

2621-
macro_rules! nonzero_check_count_ones {
2622-
($nonzero_type:ty, $nonzero_check_count_ones_for:ident) => {
2623-
#[kani::proof]
2624-
pub fn $nonzero_check_count_ones_for() {
2625-
let x: $nonzero_type = kani::any();
2626-
let result = x.count_ones();
2627-
// Since x is non-zero, count_ones should never return 0
2628-
assert!(result.get() > 0);
2629-
}
2630-
};
2631-
}
2632-
2633-
// Use the macro to generate different versions of the function for multiple types
2634-
nonzero_check_count_ones!(core::num::NonZeroI8, nonzero_check_count_ones_for_i8);
2635-
nonzero_check_count_ones!(core::num::NonZeroI16, nonzero_check_count_ones_for_i16);
2636-
nonzero_check_count_ones!(core::num::NonZeroI32, nonzero_check_count_ones_for_i32);
2637-
nonzero_check_count_ones!(core::num::NonZeroI64, nonzero_check_count_ones_for_i64);
2638-
nonzero_check_count_ones!(core::num::NonZeroI128, nonzero_check_count_ones_for_i128);
2639-
nonzero_check_count_ones!(core::num::NonZeroIsize, nonzero_check_count_ones_for_isize);
2640-
nonzero_check_count_ones!(core::num::NonZeroU8, nonzero_check_count_ones_for_u8);
2641-
nonzero_check_count_ones!(core::num::NonZeroU16, nonzero_check_count_ones_for_u16);
2642-
nonzero_check_count_ones!(core::num::NonZeroU32, nonzero_check_count_ones_for_u32);
2643-
nonzero_check_count_ones!(core::num::NonZeroU64, nonzero_check_count_ones_for_u64);
2644-
nonzero_check_count_ones!(core::num::NonZeroU128, nonzero_check_count_ones_for_u128);
2645-
nonzero_check_count_ones!(core::num::NonZeroUsize, nonzero_check_count_ones_for_usize);
2646-
2647-
macro_rules! nonzero_check_rotate_left_and_right {
2648-
($nonzero_type:ty, $nonzero_check_rotate_for:ident) => {
2649-
#[kani::proof]
2650-
pub fn $nonzero_check_rotate_for() {
2651-
let x: $nonzero_type = kani::any();
2652-
let n: u32 = kani::any();
2653-
let result = x.rotate_left(n).rotate_right(n);
2654-
assert!(result == x);
2655-
}
2656-
};
2657-
}
2658-
2659-
// Use the macro to generate different versions of the function for multiple types
2660-
nonzero_check_rotate_left_and_right!(core::num::NonZeroI8, nonzero_check_rotate_for_i8);
2661-
nonzero_check_rotate_left_and_right!(core::num::NonZeroI16, nonzero_check_rotate_for_i16);
2662-
nonzero_check_rotate_left_and_right!(core::num::NonZeroI32, nonzero_check_rotate_for_i32);
2663-
nonzero_check_rotate_left_and_right!(core::num::NonZeroI64, nonzero_check_rotate_for_i64);
2664-
nonzero_check_rotate_left_and_right!(core::num::NonZeroI128, nonzero_check_rotate_for_i128);
2665-
nonzero_check_rotate_left_and_right!(core::num::NonZeroIsize, nonzero_check_rotate_for_isize);
2666-
nonzero_check_rotate_left_and_right!(core::num::NonZeroU8, nonzero_check_rotate_for_u8);
2667-
nonzero_check_rotate_left_and_right!(core::num::NonZeroU16, nonzero_check_rotate_for_u16);
2668-
nonzero_check_rotate_left_and_right!(core::num::NonZeroU32, nonzero_check_rotate_for_u32);
2669-
nonzero_check_rotate_left_and_right!(core::num::NonZeroU64, nonzero_check_rotate_for_u64);
2670-
nonzero_check_rotate_left_and_right!(core::num::NonZeroU128, nonzero_check_rotate_for_u128);
2671-
nonzero_check_rotate_left_and_right!(core::num::NonZeroUsize, nonzero_check_rotate_for_usize);
2672-
26732626
macro_rules! check_mul_unchecked_small {
26742627
($t:ty, $nonzero_type:ty, $nonzero_check_unchecked_mul_for:ident) => {
26752628
#[kani::proof_for_contract(<$t>::unchecked_mul)]

0 commit comments

Comments
 (0)