Soundness: try/catch is checked as if the catch block always runs
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Locate where the verifier visits try/catch statements (search the visitor/checker for the try-statement case) and compare it with how if/else merges branch states at the join point — the issue says try/catch is currently sequenced instead of merged. Work out how both branches (normal exit from try, entry into catch at an arbitrary point) should be joined, and how the state after the join relates to the state on entry. Done means both reproducers in the issue report errors, the swapped-value case reports correctly, and existing verification tests still pass; add the reproducers as regression tests.
由索引模型根據 Issue 內容生成。
描述
Impact: a real bug passes verification (false negative).
Description
The verifier checks try and catch blocks one after the other, so after a try/catch a variable keeps whatever the catch block last assigned. The path where the try finishes normally is lost. An if/else instead merges both branches after the join, and try/catch should be merged the same way.
Also, an exception can be thrown at any point in the try. The catch block should therefore not assume the try ran to completion, or that it never ran at all.
Minimal reproducer
import liquidjava.specification.ExternalRefinementsFor;
import liquidjava.specification.StateRefinement;
import liquidjava.specification.StateSet;
@ExternalRefinementsFor("java.lang.Throwable")
@StateSet({"withThrowable", "noThrowable"})
interface ThrowableRefinements {
@StateRefinement(to = "noThrowable(this)")
void Throwable(String message);
@StateRefinement(to = "withThrowable(this)")
void Throwable(String message, Throwable cause);
@StateRefinement(from = "noThrowable(this)", to = "withThrowable(this)")
Throwable initCause(Throwable cause);
}
public class Repro {
static void load() throws Exception { throw new Exception("x"); }
static void m() {
Throwable t = new Throwable("start");
try {
load();
t = new Throwable("try", new RuntimeException()); // withThrowable
} catch (Exception e) {
t = new Throwable("catch"); // noThrowable
}
t.initCause(new RuntimeException()); // not reported, but t is withThrowable if load() returns
}
}
Expected: a State Refinement Error on t.initCause(...), because t may be withThrowable.
Actual: Correct! Passed Verification.
Same bug with value refinements
static void m() {
int y = 0;
try {
load();
y = -5;
} catch (Exception e) {
y = 7;
}
@Refinement("_ > 0")
int z = y; // not reported, but y == -5 if load() returns
}
Actual: Correct! Passed Verification. If the values are swapped (5 in the try, -5 in the catch), the error is reported, but as z == -5 is not a subtype of z > 0: only the catch path is considered.
Found while reviewing #362 (catch parameters, #333).
- 主要語言
- Java
- 星號
- 67
- 分支
- 36
- 平均合併
- 2 天 3 小時
- 30 天內合併 PR
- 29
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue,再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫,在一個分支上完成修改。
- 送出 Pull Request,並在描述裡引用這個 Issue 編號。
liquid-java/liquidjava 的其他 Issue
-
bug
難度 2/5 1-3 小時 新手友好度 72/100
liquid-java/liquidjava#388 ·
維護者通常 1 天內回覆
-
enhancement
難度 2/5 1-3 小時 新手友好度 65/100
liquid-java/liquidjava#373 ·
維護者通常 1 天內回覆
-
bug
難度 2/5 1-3 小時 新手友好度 78/100
liquid-java/liquidjava#321 ·
維護者通常 1 天內回覆
-
bug
難度 3/5 1-2 天 新手友好度 62/100
liquid-java/liquidjava#390 ·
維護者通常 1 天內回覆
-
Verifier crashes on `!` (or another unary operator) applied to a call whose type cannot be resolved未關閉bug
難度 3/5 1-2 天 新手友好度 65/100
liquid-java/liquidjava#389 ·
維護者通常 1 天內回覆
查看 liquid-java/liquidjava 的全部 Issue
相似的 Issue
-
BoxAttachmentMulti parsing leaks IOException / ArrayIndexOutOfBoundsException on malformed content instead of IllegalArgumentException可能已有人在做 @Kshot3000 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 74/100
ergoplatform/ergo-appkit#272 ·
-
難度 2/5 1-3 小時 新手友好度 64/100
-
難度 2/5 1-3 小時 新手友好度 66/100
-
難度 2/5 1-3 小時 新手友好度 64/100
utopia-rise/godot-jvm#1004 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 82/100
spring-projects/spring-grpc#442 ·