Skip to content

Commit 4b7f6c3

Browse files
Update unwinding tutorial (rust-lang#1877)
Co-authored-by: Adrian Palacios <[email protected]>
1 parent 2b3a9be commit 4b7f6c3

File tree

1 file changed

+6
-12
lines changed

1 file changed

+6
-12
lines changed

docs/src/tutorial-loop-unwinding.md

+6-12
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,9 @@ The code tries to execute more than 1 loop iteration.
6060
<summary>Click to see explanation for the exercise</summary>
6161

6262
Since the proof harness is trying to limit the array to size 10, an initial unwind value of 10 seems like the obvious place to start.
63-
But that's not large enough for Kani.
63+
But that's not large enough for Kani, and we still see the "unwinding assertion" failure.
6464

65-
At size 11, we still see the "unwinding assertion" failure, but now we can see the actual failures we're trying to find, too.
66-
Finally at size 12, the "unwinding assertion" goes away, just leaving the other failures.
65+
At size 11, the "unwinding assertion" goes away, and now we can see the actual failure we're trying to find too.
6766
We'll explain why we see this behavior in a moment.
6867

6968
</details>
@@ -72,25 +71,20 @@ Once we have increased the unwinding limit high enough, we're left with these fa
7271

7372
```
7473
SUMMARY:
75-
** 2 of 67 failed
74+
** 1 of 68 failed
7675
Failed Checks: index out of bounds: the length is less than or equal to the given index
7776
File: "./src/lib.rs", line 12, in initialize_prefix
78-
Failed Checks: dereference failure: pointer outside object bounds
79-
File: "./src/lib.rs", line 12, in initialize_prefix
8077
8178
VERIFICATION:- FAILED
8279
```
8380

8481
**Exercise**: Fix the off-by-one error, and get the (bounded) proof to go through.
8582

86-
We now return to the question: why is 12 the unwinding bound?
87-
Well, the first answer is: it isn't!
88-
Reduce it to 11 and observe that the proof now still works!
83+
We now return to the question: why is 11 the unwinding bound?
8984

9085
Kani needs the unwinding bound to be "one more than" the number of loop iterations.
9186
We previously had an off-by-one error that tried to do 11 iterations on an array of size 10.
92-
So... the unwinding bound needed to be 12, then.
93-
Fixing that error to do the correct 10 iterations means we can now successfully reduce that unwind bound to 11 again.
87+
So... the unwinding bound needed to be 11, then.
9488

9589
> **NOTE**: Presently, there are some situations where "number of iterations of a loop" can be less obvious than it seems.
9690
> This can be easily triggered with use of `break` or `continue` within loops.
@@ -115,7 +109,7 @@ In that case you can either use `--default-unwind x` to set an unwind bound for
115109
Or you can _override_ a harness's bound, but only when running a specific harness:
116110

117111
```
118-
cargo kani --harness check_initialize_prefix --unwind 12
112+
cargo kani --harness check_initialize_prefix --unwind 11
119113
```
120114

121115
Finally, you might be interested in defaulting the unwind bound to 1, to force termination (and force supplying a bound) on all your proof harnesses.

0 commit comments

Comments
 (0)