def client_fork(t: Thread, l: BaseLock) -> None:
Requires(Acc(MayStart(t)))
Requires(getMethod(t) == noop)
Requires(l is getArg(t, 0))
Ensures(WaitLevel() < Level(t))
#:: ExpectedOutput(invalid.program:invalid.thread.start)
t.start(noop)
def client_fork_wrong_mayjoin(t: Thread, b: bool, cell: Cell) -> None:
Requires(Acc(MayStart(t)))
Requires(getMethod(t) == Cell.incr)
Requires(Acc(cell.val))
Requires(cell is getArg(t, 0))
#:: ExpectedOutput(postcondition.violated:assertion.false)
Ensures(Joinable(t))
t.start(decr, Cell.incr)
def client_create_wrong_arg(b: bool) -> Thread:
cl = Cell()
if b:
t = Thread(None, cl.incr, 'some_name', (3, ))
else:
#:: ExpectedOutput(thread.creation.failed:invalid.argument.type)
t = Thread(None, decr, args=(cl, cl))
return t
def client_fork_wrong_thread_post(t: Thread, b: bool, cell: Cell) -> None:
Requires(Acc(MayStart(t)))
Requires(getMethod(t) == Cell.incr)
Requires(Acc(cell.val))
Requires(cell is getArg(t, 0))
#:: ExpectedOutput(postcondition.violated:insufficient.permission)
Ensures(Acc(ThreadPost(t)))
t.start(decr, Cell.incr)
def thread_join_wrong_level(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == decr)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(Acc(ThreadPost(t)))
#:: ExpectedOutput(thread.join.failed:wait.level.invalid)
t.join(Cell.incr, decr)
def thread_join_not_joinable(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == decr)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(WaitLevel() < Level(t))
#:: ExpectedOutput(thread.join.failed:thread.not.joinable)
t.join(Cell.incr, decr)
def join1(self, t: Thread) -> None:
Requires(getMethod(t) == Clazz.readX)
Requires(getArg(t, 0) is self)
Requires(Joinable(t))
Requires(Acc(ThreadPost(t), 1))
Requires(Acc(self.x, 1 - getARP(t)))
Requires(WaitLevel() < Level(t))
Ensures(Acc(self.x))
t.join(self.readX)
def start2(self) -> Thread:
Requires(Rd(self.x))
Ensures(Acc(self.x, ARP() - getARP(Result())))
t1 = Thread(None, self.readX, args=())
t2 = Thread(None, self.readX, args=())
t1.start(self.readX)
t2.start(self.readX)
t1.join(self.readX)
return t2
def client_fork_wrong_old_2(t: Thread, b: bool, cell: Cell) -> None:
Requires(Acc(MayStart(t)))
Requires(getMethod(t) == Cell.incr)
Requires(Acc(cell.val))
Requires(cell is getArg(t, 0))
#:: ExpectedOutput(postcondition.violated:assertion.false)
Ensures(getOld(t, arg(0).val) == 14)
cell.val = 12
t.start(decr, Cell.incr)
def thread_join_wrong_method(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == Cell.incr)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(Acc(ThreadPost(t)))
Requires(WaitLevel() < Level(t))
t.join(decr)
#:: ExpectedOutput(assert.failed:insufficient.permission)
assert cl.val == 116
def thread_join_no_post_perm(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == decr)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(Joinable(t))
Requires(WaitLevel() < Level(t))
t.join(Cell.incr, decr)
#:: ExpectedOutput(assert.failed:insufficient.permission)
assert cl.val == 116
def thread_join_part_perm(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == decr)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(Acc(ThreadPost(t), 1 / 2))
Requires(WaitLevel() < Level(t))
t.join(Cell.incr, decr)
assert cl.val == 116
#:: ExpectedOutput(assignment.failed:insufficient.permission)
cl.val = 11
def client_fork(t: Thread, b: bool, cell: Cell) -> None:
Requires(Acc(MayStart(t)))
Requires(getMethod(t) == Cell.incr)
Requires(Acc(cell.val))
Requires(cell is getArg(t, 0))
Ensures(getOld(t, arg(0).val) == 12)
Ensures(WaitLevel() < Level(t))
#:: ExpectedOutput(postcondition.violated:insufficient.permission)
Ensures(Acc(MayStart(t)))
cell.val = 12
t.start(decr, Cell.incr)
def thread_join_pred_partial(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == decr_pred)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(Acc(ThreadPost(t), 1 / 2))
Requires(WaitLevel() < Level(t))
Ensures(Joinable(t))
t.join(decr, decr_pred)
Unfold(Acc(cell_pred(cl, 116), 1 / 2))
assert cl.val == 116
#:: ExpectedOutput(unfold.failed:insufficient.permission)
Unfold(Acc(cell_pred(cl, 116), 1 / 2))
def thread_join_pred(t: Thread, cl: Cell) -> None:
Requires(getMethod(t) == decr_pred)
Requires(getArg(t, 0) is cl)
Requires(getArg(t, 1) is 7)
Requires(getOld(t, arg(0).val) is 123)
Requires(Acc(ThreadPost(t)))
Requires(WaitLevel() < Level(t))
Ensures(Joinable(t))
#:: ExpectedOutput(postcondition.violated:assertion.false)
Ensures(False)
t.join(decr, decr_pred)
Unfold(cell_pred(cl, 116))
assert cl.val == 116
def client_create(b: bool) -> Thread:
Ensures(MayStart(Result()))
Ensures(Implies(b, getArg(Result(), 1) is 3))
Ensures(Implies(not b, getArg(Result(), 1) is 6))
Ensures(Implies(not b, getMethod(Result()) == decr))
#:: ExpectedOutput(postcondition.violated:assertion.false)
Ensures(getArg(Result(), 2) is None)
cl = Cell()
if b:
t = Thread(None, target=cl.incr, args=(3, ))
else:
t = Thread(target=decr, group=None, args=(cl, 6))
return t
def join2(self, t1: Thread, t2: Thread) -> None:
Requires(t1 is not t2)
Requires(getMethod(t1) == Clazz.readX)
Requires(getMethod(t2) == Clazz.readX)
Requires(getArg(t1, 0) is self)
Requires(getArg(t2, 0) is self)
Requires(Joinable(t1))
Requires(Joinable(t2))
Requires(Acc(ThreadPost(t1)))
Requires(Acc(ThreadPost(t2)))
Requires(WaitLevel() < Level(t1))
Requires(WaitLevel() < Level(t2))
Ensures(Acc(self.x, getARP(t1) + getARP(t2)))
t1.join(self.readX)
t2.join(self.readX)
def thread0(secret: bool) -> None:
Requires(LowEvent())
l1 = CellLock(object())
l2 = CellLock(object())
l = l1 if secret else l2
t1 = Thread(target=thread1, args=(l1,)) # x aliases l2 depending on secret
t2 = Thread(target=thread2, args=(l,))
t1.start(thread1)
t2.start(thread2)
def join_low(secret: bool) -> None:
c = Cell()
if secret:
t = Thread(target=zero, args=(c, ))
else:
t = Thread(target=one, args=(c, ))
t.start(zero, one)
t.join(zero, one)
#:: ExpectedOutput(assert.failed:assertion.false)
Assert(Low(c.val))
def a3(self) -> None:
Requires(Rd(self.x))
Ensures(True)
t1 = Thread(None, self.dispose_rd, args=())
t1.start(self.dispose_rd)
self.dispose_rd()
t2 = Thread(None, self.dispose_rd, args=())
t2.start(self.dispose_rd)
#:: UnexpectedOutput(silicon)(call.precondition:insufficient.permission,320)
self.dispose_rd()
def fork_lowevent(secret: bool) -> None:
if secret:
t = Thread(target=printZero, args=())
else:
t = Thread(target=printOne, args=())
#:: ExpectedOutput(thread.start.failed:assertion.false)
t.start(printZero, printOne)
def a9(self, a: int) -> None:
Requires(Rd(self.x))
#:: ExpectedOutput(postcondition.violated:insufficient.permission)
Ensures(Rd(self.x))
t1 = Thread(None, self.dispose_rd, args=())
t1.start(self.dispose_rd)
t1.join(self.dispose_rd)
def a10(self, a: int) -> None:
Requires(Rd(self.x))
Ensures(Implies(a == 3, Rd(self.x)))
t1 = Thread(None, self.void, args=())
t1.start(self.void)
if 3 == a:
t1.join(self.void)
def main() -> None:
data = Data()
w = WatchDog()
wthread = Thread(None, w.watch, None, (data, ))
# Spawn the watchdog thread
wthread.start(w.watch)
data.lock.acquire()
data.d = 0
while True:
Invariant(Acc(data.lock, 1 / 4))
Invariant(data.lock.get_locked() is data)
Invariant(
WaitLevel() < Level(data.lock)) # guarantees deadlock freedom
Invariant(MustRelease(data.lock, 1))
Invariant(Acc(data.d) and data.d % 2 == 0)
# Modify the locked data in a legal way
data.d = data.d + 2
data.lock.release()
# Others may acquire the lock
data.lock.acquire()
def client(secret: bool) -> None:
c1 = Cell()
l1 = CellLock(c1)
c2 = Cell()
l2 = CellLock(c2)
if secret:
x = l1
else:
x = l2
t1 = Thread(target=printTwice,
args=(x, 1)) # x aliases l2 depending on secret
t2 = Thread(target=printTwice, args=(l2, 2))
#:: ExpectedOutput(thread.start.failed:assertion.false)
t1.start(printTwice)
t2.start(printTwice)
def join_low_dyn_bound(secret: bool) -> None:
if secret:
x = A()
else:
x = B()
t = Thread(target=x.foo, args=())
t.start(x.foo)
#:: ExpectedOutput(thread.join.failed:thread.not.joinable)
t.join(x.foo)
def a12(self, a: int) -> None:
Requires(Acc(self.x, 1 / 2))
Ensures(Acc(self.x, 1 / 2))
i = 0 # type: int
while i < a:
Invariant(Acc(self.x, 1 / 2))
t1 = Thread(None, self.void, args=())
t1.start(self.void)
t1.join(self.void)
i += 1
def a8(self, a: int) -> None:
Requires(Rd(self.x))
Ensures(Rd(self.x))
t1 = Thread(None, self.void, args=())
t1.start(self.void)
t1.join(self.void)
def a7(self) -> None:
Requires(Rd(self.x))
Ensures(True)
t1 = Thread(None, self.dispose_rd, args=())
t1.start(self.dispose_rd)
t2 = Thread(None, self.dispose_rd, args=())
# probably due to timeout in silicon, does not always occur
#:: UnexpectedOutput(silicon)(thread.start.failed:insufficient.permission,320)
t2.start(self.dispose_rd)
t3 = Thread(None, self.dispose_rd, args=())
# probably due to timeout in silicon, does not always occur
#:: UnexpectedOutput(silicon)(thread.start.failed:insufficient.permission,320)
t3.start(self.dispose_rd)
t4 = Thread(None, self.dispose_rd, args=())
t4.start(self.dispose_rd)
t5 = Thread(None, self.dispose_rd, args=())
t5.start(self.dispose_rd)
t6 = Thread(None, self.dispose_rd, args=())
t6.start(self.dispose_rd)
def client_fork(t: Thread) -> None:
#:: ExpectedOutput(invalid.program:invalid.thread.start)
t.start(get)
