[csmith-dev] --max-pointer-depth not honored?

Dear Csmith developers,

I have been testing Csmith 2.2.0 (Git version dcef523), and I am trying to understand the meaning of the --max-pointer-depth option.

If I understood well, Csmith with --max-pointer-depth N should produce a program with pointer-dereferencing expressions of length at most N+1 (i.e. without pointer dereferences of the form *..*x with N+2 stars or more.)

However, with --max-pointer-depth 0, I still managed to produce the attached C program with a depth-2 pointer dereference (and similarly, with --max-pointer-depth 1 and a depth-3 pointer dereference, although in the latter case, it is hard to generate such programs if shorter than 400 lines).

Moreover, massive tests show that, with --no-checksum --no-argc --no-arrays --no-bitfields --no-structs --no-unions --max-pointer-depth 1, more than 70% of all programs generated by Csmith (regardless of their sizes) reach pointer dereference level 3 or more (sometimes up to 8).

So, is my understanding correct?

- If so, is there a bug in Csmith that makes --max-pointer-depth not properly honored?

- Otherwise, what should be the exact meaning of this option, and which use cases were intended? How could I control the maximum pointer dereference level in Csmith-generated programs?

And then, a final question too: even though it might be possible to limit the level of pointer dereference expressions, is there a way to limit the depth of pointer types?

Thank you in advance for your help.

Best regards,

Tahina Oliver Ramananandro, Ph. D.

Senior Engineer, Advanced Compilers and Formal Verification

Reservoir Labs, Inc.

632 Broadway, Suite 803

New York, NY 10012

USA

Phone: +1 (212) 780-0527 ext. 157

E-mail: ramananandro@reservoir.com, tahina@ramananandro.org

Web: http://tahina.ramananandro.org

Notes:

[#] Here I consider that --max-pointer-depth 0 does not prevent Csmith from producing pointers at large, by contrast to --no-pointers

/* * This is a RANDOMLY GENERATED PROGRAM. * * Generator: csmith 2.2.0 * Git version: dcef523 * Options: --no-checksum --no-argc --no-bitfields --no-structs --no-unions --no-arrays --max-pointer-depth 1 * Seed: 1180627777 */ #include "csmith.h" volatile uint64_t csmith_sink_ = 0; static long __undefined; /* --- Struct/Union Declarations --- */ /* --- GLOBAL VARIABLES --- */ static int8_t g_12 = 0L; static int64_t g_13 = (-1L); static const uint8_t g_37 = 0xDBL; static int32_t g_39 = 0xD4782549L; static int32_t * volatile g_38 = &g_39;/* VOLATILE GLOBAL g_38 */ static int8_t *g_46 = (void*)0; static int32_t g_62 = 0x5AB171C2L; static const int32_t *g_91 = &g_62; static const int32_t **g_90 = &g_91; static int16_t g_94 = 0xE74CL; static int32_t g_96 = 9L; static uint16_t g_123 = 0x6F3BL; static int32_t *g_128 = &g_96; static int32_t **g_127 = &g_128; static int32_t ***g_126 = &g_127; static uint8_t g_137 = 255UL; static int32_t ** const *g_142 = (void*)0; static uint8_t g_164 = 0xD3L; static uint32_t g_165 = 0UL; static uint16_t g_248 = 0UL; static int64_t g_253 = (-1L); static int8_t g_266 = 0xB1L; static uint8_t g_294 = 0UL; static uint64_t g_300 = 0x8013064C4D074B32LL; static uint32_t g_305 = 0UL; /* --- FORWARD DECLARATIONS --- */ static uint16_t func_1(void); static int32_t func_5(int16_t p_6); static int8_t func_8(int8_t p_9, int8_t p_10); static const int32_t * const func_14(int8_t * const p_15, int32_t p_16, uint32_t p_17, int8_t * p_18, uint8_t p_19); static int32_t func_23(uint32_t p_24, uint16_t p_25, int32_t p_26); static uint8_t func_50(int32_t p_51, uint8_t p_52); static int8_t func_55(int8_t * p_56, const uint8_t p_57); static int8_t * func_58(uint8_t p_59); static int32_t * func_63(uint32_t p_64, uint64_t p_65); static uint32_t func_69(int32_t * p_70); /* --- FUNCTIONS --- */ /* ------------------------------------------ */ /* * reads : g_13 g_12 g_37 g_38 g_39 g_46 g_62 g_90 g_91 g_96 g_94 g_123 g_127 g_128 g_137 g_164 g_165 g_126 g_248 g_294 * writes: g_12 g_39 g_62 g_90 g_94 g_96 g_123 g_165 g_128 g_248 g_253 g_164 g_266 g_91 g_294 g_300 g_305 g_13 */ static uint16_t func_1(void) { /* block id: 0 */ int32_t l_7 = 7L; int8_t *l_11 = &g_12; int32_t *l_61 = &g_62; int32_t **l_60 = &l_61; uint64_t *l_299 = &g_300; int32_t l_301 = 0x1438A765L; int32_t ****l_302 = &g_126; int32_t *l_303 = (void*)0; int32_t *l_304 = (void*)0; uint8_t *l_306 = &g_164; const int32_t **l_307 = &g_91; const int32_t ***l_308 = &l_307; const int32_t ***l_309 = (void*)0; const int32_t ***l_310 = &g_90; int16_t l_313 = (-3L); int64_t *l_314 = (void*)0; int64_t *l_315 = &g_13; uint32_t l_316 = 0x31D6AA01L; int32_t l_317 = 0x2636EEB1L; int64_t l_318 = 0x92F17FB0F1F695C9LL; g_294 ^= (((((safe_sub_func_int16_t_s_s((~func_5((l_7 != func_8(((*l_11) = 1L), g_13)))), (func_50(((safe_rshift_func_int8_t_s_u(func_55(func_58(((void*)0 != l_60)), (((g_253 = ((safe_mod_func_int8_t_s_s(0L, g_37)) , g_137)) > g_37) ^ g_137)), 2)) ^ 0x3EL), g_37) == g_37))) <= 0xBF17L) , 0xE5L) , (**l_60)) < 0x80L); l_317 ^= ((*l_61) = (((+(l_316 = ((*l_315) &= (((((safe_mul_func_uint8_t_u_u(((&l_61 == ((*l_310) = ((*l_308) = (((*l_306) = ((!((*l_299) = (*l_61))) & (((l_301 = 0xEED50243L) , (g_305 = ((void*)0 != l_302))) , (*l_61)))) , l_307)))) != (safe_rshift_func_uint16_t_u_s(0xE2A2L, 15))), (((**l_60) < 0xDCF8C165L) < 0x7E8E832CL))) , g_39) == g_62) < l_313) > (*l_61))))) != 0x2F05403430B8F8A4LL) && (*l_61))); return l_318; } /* ------------------------------------------ */ /* * reads : g_38 g_39 * writes: */ static int32_t func_5(int16_t p_6) { /* block id: 19 */ return (*g_38); } /* ------------------------------------------ */ /* * reads : g_13 g_12 g_37 g_38 g_39 g_46 * writes: g_39 g_12 */ static int8_t func_8(int8_t p_9, int8_t p_10) { /* block id: 2 */ int8_t l_29 = 8L; int32_t l_32 = 0xE3F9150FL; const int32_t *l_48 = &g_39; const int32_t **l_47 = &l_48; int32_t *l_49 = &g_39; (*l_47) = func_14(((safe_mul_func_uint16_t_u_u(((~func_23(g_13, (0UL || ((g_12 | (l_29 ^= p_10)) && (4L < ((safe_mod_func_uint16_t_u_u(l_32, (~(safe_sub_func_int8_t_s_s((g_12 ^ 0x392715EE56E31BB0LL), g_12))))) || l_32)))), l_32)) , p_10), g_13)) , (void*)0), l_32, l_32, g_46, g_37); (*l_49) = (*l_48); return (*l_49); } /* ------------------------------------------ */ /* * reads : * writes: */ static const int32_t * const func_14(int8_t * const p_15, int32_t p_16, uint32_t p_17, int8_t * p_18, uint8_t p_19) { /* block id: 14 */ return &g_39; } /* ------------------------------------------ */ /* * reads : g_37 g_38 g_39 g_12 * writes: g_39 g_12 */ static int32_t func_23(uint32_t p_24, uint16_t p_25, int32_t p_26) { /* block id: 4 */ uint8_t l_40 = 254UL; int32_t l_41 = 0x3E141B6BL; int32_t l_44 = (-10L); int32_t *l_45 = &g_39; (*g_38) ^= (!g_37); l_41 |= l_40; for (g_12 = 25; (g_12 != (-4)); g_12--) { /* block id: 9 */ return (*g_38); } (*l_45) |= l_44; return (*g_38); } /* ------------------------------------------ */ /* * reads : * writes: */ static uint8_t func_50(int32_t p_51, uint8_t p_52) { /* block id: 72 */ uint16_t l_293 = 0xBAA5L; return l_293; } /* ------------------------------------------ */ /* * reads : g_127 g_94 g_137 g_62 g_128 g_90 g_164 * writes: g_128 g_94 g_164 g_266 g_62 g_91 */ static int8_t func_55(int8_t * p_56, const uint8_t p_57) { /* block id: 55 */ uint32_t l_254 = 0x13081650L; int32_t ***l_255 = &g_127; int32_t *l_260 = (void*)0; int32_t *l_262 = &g_62; int32_t **l_261 = &l_262; int16_t *l_263 = &g_94; uint8_t *l_264 = &g_164; int8_t *l_265 = &g_266; int32_t *l_267 = &g_62; uint32_t l_277 = 0xAFDE751AL; uint8_t l_282 = 0x8CL; int32_t l_291 = 0x2662B469L; int32_t l_292 = (-5L); (*l_267) |= (l_254 < (p_57 | (((l_255 = l_255) == &g_90) >= (((0x3E41L && ((safe_add_func_int8_t_s_s(((*l_265) = (safe_add_func_int16_t_s_s(((*l_263) &= (l_254 , (((*g_127) = l_260) == ((*l_261) = l_260)))), (((*l_264) = p_57) > 255UL)))), p_57)) , g_137)) , &l_261) == (void*)0)))); (*g_90) = ((*l_261) = ((*g_127) = (**l_255))); (*l_267) &= 0x74014540L; l_292 ^= (safe_mul_func_int8_t_s_s((safe_sub_func_int32_t_s_s((-4L), (l_282 <= (safe_mod_func_uint32_t_u_u((g_62 < (safe_mod_func_int32_t_s_s(p_57, (safe_lshift_func_uint16_t_u_u(p_57, (*l_267)))))), ((((*l_261) = ((*g_127) = (*l_261))) == (((safe_mod_func_int32_t_s_s((&l_255 == (void*)0), l_291)) , g_164) , (void*)0)) | p_57)))))), p_57)); return (*l_267); } /* ------------------------------------------ */ /* * reads : g_62 g_13 g_90 g_37 g_91 g_96 g_94 g_123 g_127 g_128 g_137 g_164 g_165 g_126 g_248 g_46 * writes: g_62 g_90 g_94 g_96 g_123 g_165 g_128 g_248 */ static int8_t * func_58(uint8_t p_59) { /* block id: 21 */ int64_t l_66 = 1L; int32_t *l_166 = &g_62; int32_t *l_167 = &g_62; int32_t *l_168 = &g_96; int32_t *l_169 = (void*)0; int32_t *l_170 = &g_96; int32_t *l_171 = &g_62; int32_t *l_172 = &g_62; int32_t *l_173 = (void*)0; int32_t *l_174 = &g_96; int32_t l_175 = (-1L); int32_t l_176 = (-2L); int32_t *l_177 = &g_62; int32_t *l_178 = &g_96; int32_t *l_179 = &l_176; int32_t *l_180 = &l_176; int32_t *l_181 = &l_175; int32_t *l_182 = &l_175; int32_t *l_183 = &l_176; int32_t l_184 = 0x8B6AEB2BL; int32_t *l_185 = (void*)0; int32_t l_186 = 0L; int32_t *l_187 = &l_175; int32_t *l_188 = &l_184; int32_t *l_189 = (void*)0; int32_t *l_190 = (void*)0; int32_t *l_191 = (void*)0; int32_t *l_192 = &l_186; int32_t l_193 = 0x3B8C42DAL; int32_t *l_194 = &l_184; int32_t *l_195 = &l_175; int32_t *l_196 = &l_184; int32_t *l_197 = &l_176; int32_t *l_198 = (void*)0; int32_t *l_199 = &l_175; int32_t *l_200 = &g_62; int32_t *l_201 = (void*)0; int32_t *l_202 = (void*)0; int32_t *l_203 = &l_184; int32_t *l_204 = &l_186; int32_t *l_205 = (void*)0; int32_t *l_206 = &l_186; int32_t *l_207 = &l_175; int32_t *l_208 = &l_184; int32_t l_209 = (-6L); int32_t *l_210 = &l_184; int32_t l_211 = 1L; int32_t *l_212 = &g_96; int32_t *l_213 = &l_184; int32_t l_214 = 5L; int32_t *l_215 = &l_175; int32_t *l_216 = &l_211; int32_t l_217 = 0x5803A083L; int32_t l_218 = 0x1E9BB602L; int32_t *l_219 = &g_62; int32_t *l_220 = &g_96; int32_t *l_221 = &l_184; int32_t *l_222 = &l_186; int32_t *l_223 = (void*)0; int32_t *l_224 = &l_218; int32_t l_225 = (-9L); int32_t *l_226 = &l_214; int32_t *l_227 = &l_217; int32_t *l_228 = &l_209; int32_t *l_229 = (void*)0; int32_t l_230 = 0x8505D4F8L; int32_t *l_231 = &l_211; int32_t *l_232 = &l_184; int32_t *l_233 = &l_193; int32_t *l_234 = &l_230; int32_t *l_235 = &l_217; int32_t *l_236 = &l_211; int32_t *l_237 = &l_214; int32_t *l_238 = (void*)0; int32_t *l_239 = &l_211; int32_t *l_240 = &l_225; int32_t *l_241 = (void*)0; int32_t *l_242 = &l_186; int32_t l_243 = (-1L); int32_t *l_244 = (void*)0; int32_t *l_245 = &l_243; int32_t *l_246 = &l_176; int32_t *l_247 = &l_211; l_166 = ((**g_126) = func_63(g_62, l_66)); ++g_248; return g_46; } /* ------------------------------------------ */ /* * reads : g_62 g_13 g_90 g_37 g_91 g_96 g_94 g_123 g_127 g_128 g_137 g_164 g_165 * writes: g_62 g_90 g_94 g_96 g_123 g_165 */ static int32_t * func_63(uint32_t p_64, uint64_t p_65) { /* block id: 22 */ int32_t *l_71 = &g_62; (*l_71) = ((safe_lshift_func_int16_t_s_u(((func_69(l_71) || ((safe_unary_minus_func_uint32_t_u(((g_96 , (g_94 | 1L)) & (((safe_rshift_func_int8_t_s_s((!(*l_71)), (((safe_mul_func_int16_t_s_s(((*g_128) >= (g_165 |= (65535UL != (safe_rshift_func_int8_t_s_u((safe_mod_func_int16_t_s_s((safe_lshift_func_uint16_t_u_u(((safe_lshift_func_uint16_t_u_s(0xF130L, g_164)) <= p_65), 7)), 0x33AFL)), 5))))), g_37)) , g_94) && p_65))) == 0x95BEA926L) , p_64)))) && p_65)) , 6L), g_164)) != p_64); return (*g_127); } /* ------------------------------------------ */ /* * reads : g_62 g_13 g_90 g_37 g_91 g_96 g_94 g_123 g_127 g_128 g_137 * writes: g_62 g_90 g_94 g_96 g_123 */ static uint32_t func_69(int32_t * p_70) { /* block id: 23 */ uint32_t l_74 = 0xD0509419L; int32_t l_75 = (-7L); int16_t *l_115 = &g_94; int32_t ***l_129 = &g_127; uint8_t *l_145 = &g_137; uint8_t l_149 = 0x7CL; for (g_62 = 9; (g_62 < 10); ++g_62) { /* block id: 26 */ const uint8_t l_76 = 0x1FL; const int32_t ***l_92 = &g_90; int16_t *l_93 = &g_94; int32_t *l_95 = &g_96; uint16_t *l_122 = &g_123; int32_t ** const *l_140 = (void*)0; (*l_95) = ((l_75 = l_74) | ((l_76 || (((((l_76 > ((safe_mod_func_int16_t_s_s((g_62 <= (safe_rshift_func_int8_t_s_u(((safe_rshift_func_uint8_t_u_u((safe_sub_func_int16_t_s_s(((safe_unary_minus_func_int16_t_s(((*l_93) = ((-6L) >= ((((safe_mod_func_uint64_t_u_u(g_13, ((safe_lshift_func_uint16_t_u_s(((((((18446744073709551608UL > (((*l_92) = g_90) != &p_70)) <= 4294967295UL) , g_62) <= g_37) , (***l_92)) && g_37), 0)) & l_76))) || 3L) == (-1L)) && l_74))))) , (***l_92)), g_62)), l_74)) >= (*p_70)), 5))), 0x7F96L)) | 9L)) >= (-2L)) >= (-1L)) , (***l_92)) < g_37)) , l_74)); (*l_95) = (safe_lshift_func_uint16_t_u_u((safe_mod_func_int16_t_s_s((safe_add_func_uint8_t_u_u(g_13, (***l_92))), ((((*l_122) &= (safe_rshift_func_uint16_t_u_s((((((safe_rshift_func_int8_t_s_u((safe_rshift_func_int8_t_s_u(((safe_sub_func_uint16_t_u_u(((safe_mul_func_uint8_t_u_u((*l_95), ((((g_37 , g_37) && (safe_lshift_func_uint8_t_u_u((l_93 == l_115), 1))) < g_62) || (safe_sub_func_int64_t_s_s(((safe_add_func_int32_t_s_s(((safe_mod_func_uint64_t_u_u(g_62, g_94)) == 0UL), 0xE6FB37E8L)) , l_75), g_96))))) <= 0x52L), 0x54C9L)) < l_74), 7)), 3)) > 1UL) , (**g_90)) , l_115) != l_115), 15))) > 0xFF03L) | l_75))), 0)); } l_149 &= (((safe_lshift_func_uint8_t_u_u(((g_123 || ((void*)0 == l_145)) & (((safe_unary_minus_func_int32_t_s((l_145 != &g_137))) > ((&g_37 != &g_137) != (0x57L > 0x26L))) , g_123)), 0)) , (***l_129)) <= 0xA2L); return g_137; } /* ---------------------------------------- */ int main (void) { int print_hash_value = 0; platform_main_begin(); func_1(); csmith_sink_ = g_12; csmith_sink_ = g_13; csmith_sink_ = g_37; csmith_sink_ = g_39; csmith_sink_ = g_62; csmith_sink_ = g_94; csmith_sink_ = g_96; csmith_sink_ = g_123; csmith_sink_ = g_137; csmith_sink_ = g_164; csmith_sink_ = g_165; csmith_sink_ = g_248; csmith_sink_ = g_253; csmith_sink_ = g_266; csmith_sink_ = g_294; csmith_sink_ = g_300; csmith_sink_ = g_305; platform_main_end(0,0); return 0; } /************************ statistics ************************* XXX max struct depth: 0 breakdown: depth: 0, occurrence: 59 XXX total union variables: 0 XXX max expression depth: 34 breakdown: depth: 1, occurrence: 34 depth: 2, occurrence: 2 depth: 3, occurrence: 1 depth: 4, occurrence: 1 depth: 13, occurrence: 1 depth: 16, occurrence: 1 depth: 20, occurrence: 1 depth: 21, occurrence: 1 depth: 24, occurrence: 1 depth: 25, occurrence: 1 depth: 27, occurrence: 1 depth: 29, occurrence: 1 depth: 34, occurrence: 1 XXX total number of pointers: 119 XXX times a variable address is taken: 104 XXX times a pointer is dereferenced on RHS: 34 breakdown: depth: 1, occurrence: 23 depth: 2, occurrence: 4 depth: 3, occurrence: 7 XXX times a pointer is dereferenced on LHS: 35 breakdown: depth: 1, occurrence: 33 depth: 2, occurrence: 2 XXX times a pointer is compared with null: 4 XXX times a pointer is compared with address of another variable: 1 XXX times a pointer is compared with another pointer: 3 XXX times a pointer is qualified to be dereferenced: 314 XXX max dereference level: 4 breakdown: level: 0, occurrence: 0 level: 1, occurrence: 114 level: 2, occurrence: 35 level: 3, occurrence: 36 level: 4, occurrence: 3 XXX number of pointers point to pointers: 17 XXX number of pointers point to scalars: 102 XXX number of pointers point to structs: 0 XXX percent of pointers has null in alias set: 24.4 XXX average alias set size: 1.05 XXX times a non-volatile is read: 202 XXX times a non-volatile is write: 92 XXX times a volatile is read: 3 XXX times read thru a pointer: 0 XXX times a volatile is write: 1 XXX times written thru a pointer: 0 XXX times a volatile is available for access: 9 XXX percentage of non-volatile access: 98.7 XXX forward jumps: 0 XXX backward jumps: 0 XXX stmts: 30 XXX max block depth: 1 breakdown: depth: 0, occurrence: 27 depth: 1, occurrence: 3 XXX percentage a fresh-made variable is used: 22.8 XXX percentage an existing variable is used: 77.2 ********************* end of statistics **********************/