@@ -60,10 +60,9 @@ The code tries to execute more than 1 loop iteration.
60
60
<summary >Click to see explanation for the exercise</summary >
61
61
62
62
Since the proof harness is trying to limit the array to size 10, an initial unwind value of 10 seems like the obvious place to start.
63
- But that's not large enough for Kani.
63
+ But that's not large enough for Kani, and we still see the "unwinding assertion" failure .
64
64
65
- At size 11, we still see the "unwinding assertion" failure, but now we can see the actual failures we're trying to find, too.
66
- Finally at size 12, the "unwinding assertion" goes away, just leaving the other failures.
65
+ At size 11, the "unwinding assertion" goes away, and now we can see the actual failure we're trying to find too.
67
66
We'll explain why we see this behavior in a moment.
68
67
69
68
</details >
@@ -72,25 +71,20 @@ Once we have increased the unwinding limit high enough, we're left with these fa
72
71
73
72
```
74
73
SUMMARY:
75
- ** 2 of 67 failed
74
+ ** 1 of 68 failed
76
75
Failed Checks: index out of bounds: the length is less than or equal to the given index
77
76
File: "./src/lib.rs", line 12, in initialize_prefix
78
- Failed Checks: dereference failure: pointer outside object bounds
79
- File: "./src/lib.rs", line 12, in initialize_prefix
80
77
81
78
VERIFICATION:- FAILED
82
79
```
83
80
84
81
** Exercise** : Fix the off-by-one error, and get the (bounded) proof to go through.
85
82
86
- We now return to the question: why is 12 the unwinding bound?
87
- Well, the first answer is: it isn't!
88
- Reduce it to 11 and observe that the proof now still works!
83
+ We now return to the question: why is 11 the unwinding bound?
89
84
90
85
Kani needs the unwinding bound to be "one more than" the number of loop iterations.
91
86
We previously had an off-by-one error that tried to do 11 iterations on an array of size 10.
92
- So... the unwinding bound needed to be 12, then.
93
- Fixing that error to do the correct 10 iterations means we can now successfully reduce that unwind bound to 11 again.
87
+ So... the unwinding bound needed to be 11, then.
94
88
95
89
> ** NOTE** : Presently, there are some situations where "number of iterations of a loop" can be less obvious than it seems.
96
90
> This can be easily triggered with use of ` break ` or ` continue ` within loops.
@@ -115,7 +109,7 @@ In that case you can either use `--default-unwind x` to set an unwind bound for
115
109
Or you can _ override_ a harness's bound, but only when running a specific harness:
116
110
117
111
```
118
- cargo kani --harness check_initialize_prefix --unwind 12
112
+ cargo kani --harness check_initialize_prefix --unwind 11
119
113
```
120
114
121
115
Finally, you might be interested in defaulting the unwind bound to 1, to force termination (and force supplying a bound) on all your proof harnesses.
0 commit comments