Repository navigation
Soundness: a catch block is checked as if the whole try block had completed #339
Description
Impact: a real bug passes verification (false negative). It blocks 1 of the 48 real-code examples we built (bugs mined from open-source Java).
Description
The state at the start of a catch block is the state at the END of the try block, not the join of the states at every point that can throw. When work() throws before b.mark(), b.reset() in the catch fails at run time, but it passes verification because the catch sees b as marked.
Minimal reproducer
import liquidjava.specification.StateRefinement;
import liquidjava.specification.StateSet;
@StateSet({"open", "marked"})
class Buf {
@StateRefinement(to = "open(this)")
public Buf() {}
@StateRefinement(to = "marked(this)")
public void mark() {}
@StateRefinement(from = "marked(this)", to = "open(this)")
public void reset() {}
}
public class Repro {
static void work() throws Exception { throw new Exception("fails before mark()"); }
static void m() {
Buf b = new Buf();
try {
work();
b.mark();
} catch (Exception e) {
b.reset(); // reached when work() throws, i.e. before b.mark()
}
}
}Expected
A state error at b.reset() in the catch: on the path where work() throws, b is still open.
Actual
Correct! Passed Verification.
Control: the same code without the problem construct is reported
import liquidjava.specification.StateRefinement;
import liquidjava.specification.StateSet;
@StateSet({"open", "marked"})
class Buf {
@StateRefinement(to = "open(this)")
public Buf() {}
@StateRefinement(to = "marked(this)")
public void mark() {}
@StateRefinement(from = "marked(this)", to = "open(this)")
public void reset() {}
}
public class Control {
static void m() {
Buf b = new Buf();
b.reset(); // reset with no mark, outside a try: reported
}
}State Refinement Error: found open(b⁷) but expected marked(b⁷)
17 | static void m() {
18 | Buf b = new Buf();
19 | b.reset(); // reset with no mark, outside a try: reported
| ^^^^^^^^^^
20 | }
Reproduced on main at 0472025 (liquidjava-verifier 0.0.35); also on fbfb4e2 and 0.0.33 in the original form.
Context
Found while turning bugs mined from real open-source Java (fixed upstream or still present) into study examples for the error-message study.
Activity