-1
$\begingroup$

I am reading the paper[1] at: https://arxiv.org/abs/1905.07147

The paper says in Overview section 3:

The figure shows a constructed function Bar, which is written in Solidity and contained in a smart contract. (The comments should be ignored for now.) There are three assertions in this function, on lines 14, 19, and 22. A compiler will typically introduce a conditional jump for each assertion, where one branch leads to a location that fails. Let us assume that we select the failing locations (t14, t19 , and t22) of the three assertions as our target locations. Note that any target locations could be (automatically) selected based on various strategies, e.g., recently modified code (for smart contracts under development), assertions (added manually or by the compiler for checked errors such as division by zero), etc. Out of the above locations, t14 and t19 are unreachable, whereas t22 is reachable when input parameter a has value 42.

Somebody please guide me why t14, t19 are unreachable and why t22 is reachable in Figure2 of the paper?

Zulfi.

[1] Valentin W{"u}stholz and M. Christakis, Targeted Greybox Fuzzing with Static Lookahead Analysis,2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE),2020,789-80.

$\endgroup$
2
  • 2
    $\begingroup$ What do you think are reachable, and why? $\endgroup$
    – D.W.
    Commented Jun 25, 2021 at 18:18
  • $\begingroup$ Thanks. I have provided the link for correct answer below. $\endgroup$ Commented Jun 27, 2021 at 0:29

1 Answer 1

0
$\begingroup$

I found the answer here. What I understand is that conditions of both the assertions (line#14 and line#19) coincides with the loops. If the loop does not end we can't access the assertion. But line#22 has no such problem.

Zulfi.

$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.