Frama-C-discuss mailing list archives

This page gathers the archives of the old Frama-C-discuss archives, that was hosted by Inria's gforge before its demise at the end of 2020. To search for mails newer than September 2020, please visit the page of the new mailing list on Renater.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] Validating pointers

  • Subject: [Frama-c-discuss] Validating pointers
  • From: barbaraisabelvieira at (Bárbara Vieira)
  • Date: Wed, 1 Jul 2009 12:09:42 +0100

Hi everybody!


Probably this is a C doubt, but I couldn?t find yet a answer to my question.


I?m trying to prove the proof obligations generated by the JESSIE plug-in to
the following C code:


typedef struct ast


      unsigned long *d; 

      int top;    

      } AST;


typedef struct


  AST *a;

} BST;


/*@ requires \valid(a) && \valid(*a);

  @ ensures  \valid(*a) &&

  @         \valid_range((*a)->d,0,((*a)->top)-1); 

  @ */

int g(AST **a);



/*@ requires \valid(e) && \valid(e->a) && \valid(&(e->a)); 

  @ ensures \valid(e->a) && \valid_range(e->a->d,0,(e->a->top)-1);

  @ */ 

void f(BST *e)





Function ?f? argument  is a pointer ?e? to a structure BST. Structure BST
has a field ?a?  which points to a structure ?AST?. 

Function ?g? argument is a pointer  ?a?  that is a pointer to a structure


To validate the pre-conditions on ?g?, I have to assume that:


\valid(e) && \valid(e->a) && \valid(&(e->a));


My question is, why I have to assume \valid(&(e->a)) ?

Assuming just that \valid(e) && \valid(e->a) is not sufficient?

If I assume that e!=NULL && e->a!=NULL, this does not implies that &(e->a)
!= NULL? 


-------------- next part --------------
An HTML attachment was scrubbed...