Skip to content

Soundness: if/else-if assignment followed by a guard hides a state violation #304

Description

@CatarinaGamboa

Description

When a variable is assigned in an if/else if chain and a later guard tests it through a boolean local, a call whose state depends on the variable is accepted even on the path where it is illegal. With a single if (no else if), or without the guard, the same violation is reported.

Minimal reproducer

import liquidjava.specification.StateRefinement;
import liquidjava.specification.StateSet;

@StateSet({"off", "on"})
class Encoder {
    @StateRefinement(to = "off(this)")
    public Encoder() {}

    @StateRefinement(to = "mode == 2 ? on(this) : off(this)")
    public void setMode(int mode) {}

    @StateRefinement(from = "on(this)")
    public void setQuality() {}
}

public class Repro {
    static void configure(boolean keep, boolean lossless) {
        Encoder e = new Encoder();
        int mode = 2;
        if (keep) {
            mode = 3;
        } else if (lossless) {
            mode = 0;
        }
        boolean fromSource = mode == 3;
        if (!fromSource) {
            e.setMode(mode);
            e.setQuality();         // expected error when lossless (mode == 0), but it verifies
        }
    }
}

Expected

A state refinement error at e.setQuality(): when keep is false and lossless is true, mode == 0, so setMode(mode) leaves the encoder off.

Actual

Correct! Passed Verification.

Reproduced on main at 8816186 (liquidjava-verifier 0.0.35), and on 0.0.33.

Context

Found while turning real open-source Java code into study examples for the error-message study: real code hits this constantly, so the examples have to be rewritten around it or cannot be verified. Found in a real image writer that picks a compression mode from two flags.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions