Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Call check_proof_attribute for contract harnesses #3522

Merged
merged 2 commits into from
Sep 18, 2024

Conversation

carolynzech
Copy link
Contributor

Kani enforces that [kani::proof] attribute is not applied to generic functions. We do not currently enforce this restriction on contract harnesses. When the compiler searches for harnesses to verify, it only looks at monomorphized functions. Thus, currently a user can write this code:

#[kani::requires(true)]
fn foo() {}

#[kani::proof_for_contract(foo)]
fn check_foo<T>() {
    foo()
}

and get

"No proof harnesses (functions with #[kani::proof]) were found to verify."

In the case where a user is running many harnesses, they may not notice that Kani skipped the harness. For example, we currently have this harness in the standard library, which doesn't actually run. (PR to fix is here). After this PR merges, the code snippet above would instead error with:

error: the '#[kani::proof_for_contract]' attribute cannot be applied to generic functions
 --> src/lib.rs:4:1
  |
4 | #[kani::proof_for_contract(foo)]
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  |
  = note: this error originates in the attribute macro `kani::proof_for_contract` (in Nightly builds, run with -Z macro-backtrace for more info)

error: aborting due to 1 previous error

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.

@carolynzech carolynzech requested a review from a team as a code owner September 17, 2024 20:19
@github-actions github-actions bot added the Z-BenchCI Tag a PR to run benchmark CI label Sep 17, 2024
@carolynzech
Copy link
Contributor Author

carolynzech commented Sep 17, 2024

Note that we should merge model-checking/verify-rust-std#86 first to avoid breaking the standard library.
(I would appreciate if someone would "Request changes" on this PR to avoid accidental auto-merge; I can't do it myself).

@celinval
Copy link
Contributor

Note that we should merge model-checking/verify-rust-std#86 first to avoid breaking the standard library. (I would appreciate if someone would "Request changes" on this PR to avoid accidental auto-merge; I can't do it myself).

Merging this shouldn't break the std repository, right? BTW, you could leave it as draft for now too since you don't think this is ready to be merged.

Copy link
Contributor

@celinval celinval left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks

kani-compiler/src/kani_middle/attributes.rs Show resolved Hide resolved
@celinval celinval marked this pull request as draft September 17, 2024 22:17
@carolynzech
Copy link
Contributor Author

carolynzech commented Sep 18, 2024

Note that we should merge model-checking/verify-rust-std#86 first to avoid breaking the standard library. (I would appreciate if someone would "Request changes" on this PR to avoid accidental auto-merge; I can't do it myself).

Merging this shouldn't break the std repository, right? BTW, you could leave it as draft for now too since you don't think this is ready to be merged.

It will break our harnesses in the std repository--see the new error messages in the logs:

2024-09-17T20:23:16.3424994Z    Compiling core v0.0.0 (/home/runner/work/kani/kani/verify-rust-std/library/core)
2024-09-17T20:23:26.2257417Z error: the '#[kani::proof_for_contract]' attribute cannot be applied to generic functions
2024-09-17T20:23:26.2258407Z    --> /home/runner/work/kani/kani/verify-rust-std/library/core/src/ptr/unique.rs:287:5
2024-09-17T20:23:26.2258952Z     |
2024-09-17T20:23:26.2259233Z 287 |     #[kani::proof_for_contract(Unique::cast<U>)]
2024-09-17T20:23:26.2259645Z     |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2024-09-17T20:23:26.2259971Z     |
2024-09-17T20:23:26.2260750Z     = note: this error originates in the attribute macro `kani::proof_for_contract` (in Nightly builds, run with -Z macro-backtrace for more info)
2024-09-17T20:23:26.2261394Z 
2024-09-17T20:23:26.4192473Z error: aborting due to 1 previous error

carolynzech added a commit to model-checking/verify-rust-std that referenced this pull request Sep 18, 2024
Modifies the `check_cast` harness to:
- Be a proof instead of a proof for contract
- Remove the generic type parameter

Currently, Kani doesn't run this harness. (See the
[log](https://github.com/model-checking/verify-rust-std/actions/runs/10887990165/job/30211482361?pr=85)
from a recent PR). It doesn't run the harness because it has a generic
type parameter, and Kani's error handling for contract proofs doesn't
check for this condition. (PR to fix is
[here](model-checking/kani#3522)). Once we
remove the generic type parameter so that the harness runs, Kani
complains that we can't run it as a proof for contract because there are
no contracts, so we make it a regular proof instead.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 and MIT licenses.
@carolynzech carolynzech marked this pull request as ready for review September 18, 2024 19:07
@carolynzech carolynzech added this pull request to the merge queue Sep 18, 2024
Merged via the queue into model-checking:main with commit dd26362 Sep 18, 2024
26 of 27 checks passed
@carolynzech carolynzech deleted the contract-harness-errors branch September 18, 2024 20:15
szlee118 pushed a commit to stogaru/verify-rust-std that referenced this pull request Oct 17, 2024
Modifies the `check_cast` harness to:
- Be a proof instead of a proof for contract
- Remove the generic type parameter

Currently, Kani doesn't run this harness. (See the
[log](https://github.com/model-checking/verify-rust-std/actions/runs/10887990165/job/30211482361?pr=85)
from a recent PR). It doesn't run the harness because it has a generic
type parameter, and Kani's error handling for contract proofs doesn't
check for this condition. (PR to fix is
[here](model-checking/kani#3522)). Once we
remove the generic type parameter so that the harness runs, Kani
complains that we can't run it as a proof for contract because there are
no contracts, so we make it a regular proof instead.

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 and MIT licenses.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Z-BenchCI Tag a PR to run benchmark CI
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants