Repository navigation
Closed
Copy link
Labels
[C] BugThis is a bug. Something isn't working.This is a bug. Something isn't working.[F] CrashKani crashedKani crashed
Milestone
Description
I tried this code:
#[kani::proof]
fn foo() -> u32 { 42 }
#[kani::proof]
fn main() {
println!("{:p}", &foo);
//~^ WARNING taking a reference to a function item does not give a function pointer
}using the following command line invocation:
kani file.rs
with Kani version: 0.22.0
I expected to see this happen: explanation
Instead, this happened: explanation
warning: taking a reference to a function item does not give a function pointer
--> a.rs:6:22
|
6 | println!("{:p}", &foo);
| ^^^^ help: cast `foo` to obtain a function pointer: `foo as fn() -> _`
|
= note: `#[warn(function_item_references)]` on by default
thread '<unnamed>' panicked at 'Can't take address of Expr { value: AddressOf(Expr { value: Symbol { identifier: "_RNvCsbvss9KOnXkz_1a3foo::FnDefSingleton" }, typ: StructTag("tag-_RNvCsbvss9KOnXkz_1a3foo::FnDefStruct"), location: None }), typ: Pointer { typ: StructTag("tag-_RNvCsbvss9KOnXkz_1a3foo::FnDefStruct") }, location: None }', cprover_bindings/src/goto_program/expr.rs:420:9
stack backtrace:
0: 0x7f25411667da - std::backtrace_rs::backtrace::libunwind::trace::hc84915c67f6fb1e5
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
1: 0x7f25411667da - std::backtrace_rs::backtrace::trace_unsynchronized::h74fef551999c3a2f
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
2: 0x7f25411667da - std::sys_common::backtrace::_print_fmt::h8acfd19c1a6f1d1d
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/sys_common/backtrace.rs:65:5
3: 0x7f25411667da - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::h9271b09f3576b7e0
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/sys_common/backtrace.rs:44:22
4: 0x7f25411c92ee - core::fmt::write::h27d0bbb767cff1d5
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/core/src/fmt/mod.rs:1208:17
5: 0x7f2541156c65 - std::io::Write::write_fmt::hc409ea2bb818fbea
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/io/mod.rs:1682:15
6: 0x7f25411665a5 - std::sys_common::backtrace::_print::hfa031a98cf1e4011
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/sys_common/backtrace.rs:47:5
7: 0x7f25411665a5 - std::sys_common::backtrace::print::he69ac0980f15620d
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/sys_common/backtrace.rs:34:9
8: 0x7f25411692ef - std::panicking::default_hook::{{closure}}::h014cf704a69dce2b
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/panicking.rs:267:22
9: 0x7f254116902b - std::panicking::default_hook::h380e71f8d8d49df7
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/panicking.rs:286:9
10: 0x557a3c1aeb0d - kani_compiler::session::PANIC_HOOK::{{closure}}::{{closure}}::h10f33c4e395bf462
11: 0x557a3c104f67 - kani_compiler::codegen_cprover_gotoc::utils::debug::DEFAULT_HOOK::{{closure}}::{{closure}}::hf568cc16e5ffa08a
12: 0x7f2541169b2d - <alloc::boxed::Box<F,A> as core::ops::function::Fn<Args>>::call::hcfa7e50330911a79
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/alloc/src/boxed.rs:2032:9
13: 0x7f2541169b2d - std::panicking::rust_panic_with_hook::h483f1ef90c766581
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/panicking.rs:692:13
14: 0x7f25411698a9 - std::panicking::begin_panic_handler::{{closure}}::hd4c7d9116c0ef489
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/panicking.rs:579:13
15: 0x7f2541166c8c - std::sys_common::backtrace::__rust_end_short_backtrace::had27a083c7d7188b
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/sys_common/backtrace.rs:137:18
16: 0x7f25411695b2 - rust_begin_unwind
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/panicking.rs:575:5
17: 0x7f25411c5cd3 - core::panicking::panic_fmt::hbacb72817da3b060
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/core/src/panicking.rs:64:14
18: 0x557a3c2df7ca - cprover_bindings::goto_program::expr::Expr::address_of::h1636674499f01393
19: 0x557a3c0c7821 - kani_compiler::codegen_cprover_gotoc::codegen::place::<impl kani_compiler::codegen_cprover_gotoc::context::goto_ctx::GotocCtx>::codegen_place_ref::h4b77c777dff90545
20: 0x557a3c0c8fbb - kani_compiler::codegen_cprover_gotoc::codegen::rvalue::<impl kani_compiler::codegen_cprover_gotoc::context::goto_ctx::GotocCtx>::codegen_rvalue::h57a2cf71297ecf62
21: 0x557a3c0d8080 - kani_compiler::codegen_cprover_gotoc::codegen::statement::<impl kani_compiler::codegen_cprover_gotoc::context::goto_ctx::GotocCtx>::codegen_statement::h4c6e1c8bf226a338
22: 0x557a3c07f0d1 - kani_compiler::codegen_cprover_gotoc::codegen::function::<impl kani_compiler::codegen_cprover_gotoc::context::goto_ctx::GotocCtx>::codegen_function::h541ea7f90d847b35
23: 0x557a3c10abf0 - std::thread::local::LocalKey<T>::with::hb907a536239d23f6
24: 0x557a3c1964c8 - <kani_compiler::codegen_cprover_gotoc::compiler_interface::GotocCodegenBackend as rustc_codegen_ssa::traits::backend::CodegenBackend>::codegen_crate::heaa499391d53b3f6
25: 0x7f2543686fa1 - <rustc_session[19dfb3d05ff8562d]::session::Session>::time::<alloc[58cfa59ca61fafa9]::boxed::Box<dyn core[6d94cc961ac87456]::any::Any>, rustc_interface[aec886e93b1add3f]::passes::start_codegen::{closure#0}>
26: 0x7f2543686ac9 - rustc_interface[aec886e93b1add3f]::passes::start_codegen
27: 0x7f25436847a6 - <rustc_interface[aec886e93b1add3f]::passes::QueryContext>::enter::<<rustc_interface[aec886e93b1add3f]::queries::Queries>::ongoing_codegen::{closure#0}::{closure#0}, core[6d94cc961ac87456]::result::Result<alloc[58cfa59ca61fafa9]::boxed::Box<dyn core[6d94cc961ac87456]::any::Any>, rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>
28: 0x7f2543681a46 - <rustc_interface[aec886e93b1add3f]::queries::Queries>::ongoing_codegen
29: 0x7f2543680f67 - <rustc_interface[aec886e93b1add3f]::interface::Compiler>::enter::<rustc_driver[94a2f0241de75afa]::run_compiler::{closure#1}::{closure#2}, core[6d94cc961ac87456]::result::Result<core[6d94cc961ac87456]::option::Option<rustc_interface[aec886e93b1add3f]::queries::Linker>, rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>
30: 0x7f254367bf88 - rustc_span[ae2df7aa7c6c667b]::with_source_map::<core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>, rustc_interface[aec886e93b1add3f]::interface::run_compiler<core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>, rustc_driver[94a2f0241de75afa]::run_compiler::{closure#1}>::{closure#0}::{closure#0}>
31: 0x7f254367ba75 - <scoped_tls[db87656d258d017b]::ScopedKey<rustc_span[ae2df7aa7c6c667b]::SessionGlobals>>::set::<rustc_interface[aec886e93b1add3f]::interface::run_compiler<core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>, rustc_driver[94a2f0241de75afa]::run_compiler::{closure#1}>::{closure#0}, core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>
32: 0x7f254367b062 - std[acd1f573e90225f]::sys_common::backtrace::__rust_begin_short_backtrace::<rustc_interface[aec886e93b1add3f]::util::run_in_thread_pool_with_globals<rustc_interface[aec886e93b1add3f]::interface::run_compiler<core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>, rustc_driver[94a2f0241de75afa]::run_compiler::{closure#1}>::{closure#0}, core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>
33: 0x7f2543cec49e - <<std[acd1f573e90225f]::thread::Builder>::spawn_unchecked_<rustc_interface[aec886e93b1add3f]::util::run_in_thread_pool_with_globals<rustc_interface[aec886e93b1add3f]::interface::run_compiler<core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>, rustc_driver[94a2f0241de75afa]::run_compiler::{closure#1}>::{closure#0}, core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>::{closure#0}::{closure#0}, core[6d94cc961ac87456]::result::Result<(), rustc_errors[56887b15c7ec6fbf]::ErrorGuaranteed>>::{closure#1} as core[6d94cc961ac87456]::ops::function::FnOnce<()>>::call_once::{shim:vtable#0}
34: 0x7f25451da2d3 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::he955d3e33f115328
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/alloc/src/boxed.rs:2000:9
35: 0x7f25451da2d3 - <alloc::boxed::Box<F,A> as core::ops::function::FnOnce<Args>>::call_once::h32515d9eaa012a19
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/alloc/src/boxed.rs:2000:9
36: 0x7f25451da2d3 - std::sys::unix::thread::Thread::new::thread_start::h5af9cdd9a5a58d64
at /rustc/c6fcdb690609769a240fc8ab0de0ce68d5ea7dba/library/std/src/sys/unix/thread.rs:108:17
37: 0x7f2540f05bb5 - <unknown>
38: 0x7f2540f87d90 - <unknown>
39: 0x0 - <unknown>
Kani unexpectedly panicked during compilation.
Please file an issue here: https://github.com/model-checking/kani/issues/new?labels=bug&template=bug_report.md
[Kani] current codegen item: codegen_function: <&fn() -> u32 {foo} as std::fmt::Pointer>::fmt
_RNvXsk_NtCshQhm45nWocF_4core3fmtRNvCsbvss9KOnXkz_1a3fooNtB5_7Pointer3fmtBx_
[Kani] current codegen location: Loc { file: "/home/runner/.rustup/toolchains/nightly-2022-12-11-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/fmt/mod.rs", function: None, start_line: 2520, start_col: Some(5), end_line: 2520, end_col: Some(51) }
warning: 1 warning emitted
error: /home/matthias/.kani/kani-0.22.0/bin/kani-compiler exited with status exit status: 101
Metadata
Metadata
Assignees
Labels
[C] BugThis is a bug. Something isn't working.This is a bug. Something isn't working.[F] CrashKani crashedKani crashed
Activity
matthiaskrgr commentedon Nov 12, 2023
with kani 0.40, this now crashes with:
[-]ICE: Can't take address of Expr[/-][+]ICE: `Function should've been declared before usage`, was: `Can't take address of Expr`[/+]feliperodri commentedon Sep 25, 2026
This also aborts
kani autoharness. Verified againstmain(de756c9): runningkani autoharness -Z autoharnesson this reproducer panics atkani-compiler/src/codegen_cprover_gotoc/codegen/operand.rs:697withFunction...should've been declared before usage.Worth knowing because the blast radius is bigger than the report suggests: with a manual harness this costs you one harness, but under
autoharnessa single function like this aborts the whole crate sweep, so nothing in the crate gets verified. Adding it to the Autoharness milestone for that reason.Treat pointer and Box locals of function items as ordinary variables
Treat pointer and `Box` locals of function items as ordinary variables (