Issues

Stack overflow (non-termination) in `TypeBuilder::build`: a struct is always expanded structurally with no cycle cut, so any struct that reaches itself (`struct Node { next: Option<Box<Node>> }`, `struct Tree { kids: Vec<Tree> }`) aborts the compiler

bug

#249

· coord-e opened

on Aug 28, 2026

Unsound: at `-C opt-level >= 1` a compound assignment through a `&mut` that sits behind a projection is reborrowed twice, the two prophecy resolutions contradict the write, and the function verifies vacuously — even `assert!(false)` is `safe`

bug

#248

· coord-e opened

on Aug 27, 2026

Unsound: at `-C opt-level >= 1` GVN rewrites the `Box` deref temp from `deref_copy` to `copy`, so `unelaborate_derefs` misses it and every write through a nested `Box` lands on a copy — panicking programs verify as `safe`

bug

#244

· coord-e opened

on Aug 25, 2026

Incompleteness: calling the same un-annotated `&mut`-taking helper twice from a function that itself takes `&mut` makes the inferred-spec CHC system recursive over a `Mut<T>` datatype argument — trivially-safe programs die on `Timeout`

bug

#243

· coord-e opened

on Aug 24, 2026

Incompleteness: the statically-known length `N` of `[T; N]` is dropped by the `Seq` model, so a fixed-size array that is not built by an array literal in the same body has an unconstrained `length` and cannot be indexed at all

#241

· coord-e opened

on Aug 23, 2026

Implicit derefs (rustc adjustments) are dropped in annotation translation, so any `v.len()`/`v.length`/`s.0` on a `&mut` parameter builds an ill-sorted term and ICEs — only the explicit `(*v)` spelling works

bug

#239

· coord-e opened

on Aug 21, 2026

Incompleteness: `#[requires(..)]` alone pins the postcondition to `true` instead of leaving it inferred (unlike `closure!(requires(..))` and `#[param(..)]`), so adding a precondition silently strips every caller of the call's result

bug

#238

· coord-e opened

on Aug 20, 2026

Incompleteness: a local `impl PartialEq` is checked against the blanket `_extern_spec_partialeq_eq` (structural model equality), so any non-structural `eq` — even one that is never used — makes the whole crate fail with `Unsat`

bug

#225

· coord-e opened

on Aug 15, 2026

Unsound: a user `Drop` impl is never checked at the drop site — `TerminatorKind::Drop` only resolves prophecies, so a destructor that panics verifies as `safe`

bug

#215

· coord-e opened

on Aug 13, 2026

Unsound: `==` on `&mut` references compares the prophecy too, so the comparison's result depends on writes made after it — panicking programs verify as `safe`

bug

#210

· coord-e opened

on Aug 10, 2026

Unsound: a two-phase borrow (`v.push(v.len())`) havocs the receiver before the arguments are evaluated, so reads in the argument see the prophecy — panicking programs verify as `safe`

#209

· coord-e opened

on Aug 9, 2026

Unsound: moving a `&mut`-capturing closure out of any aggregate (incl. `enum`/`Option`), with no higher-order call, drops its prophecy and verifies panicking programs as `safe` (generalizes #177)

bug

#207

· coord-e opened

on Aug 8, 2026

Navigation Menu

All issues

Stack overflow (non-termination) in `TypeBuilder::build`: a struct is always expanded structurally with no cycle cut, so any struct that reaches itself (`struct Node { next: Option<Box<Node>> }`, `struct Tree { kids: Vec<Tree> }`) aborts the compiler

Unsound: at `-C opt-level >= 1` a compound assignment through a `&mut` that sits behind a projection is reborrowed twice, the two prophecy resolutions contradict the write, and the function verifies vacuously — even `assert!(false)` is `safe`

Unsound: at `-C opt-level >= 1` GVN rewrites the `Box` deref temp from `deref_copy` to `copy`, so `unelaborate_derefs` misses it and every write through a nested `Box` lands on a copy — panicking programs verify as `safe`

Incompleteness: calling the same un-annotated `&mut`-taking helper twice from a function that itself takes `&mut` makes the inferred-spec CHC system recursive over a `Mut<T>` datatype argument — trivially-safe programs die on `Timeout`

Incompleteness: the statically-known length `N` of `[T; N]` is dropped by the `Seq` model, so a fixed-size array that is not built by an array literal in the same body has an unconstrained `length` and cannot be indexed at all

Implicit derefs (rustc adjustments) are dropped in annotation translation, so any `v.len()`/`v.length`/`s.0` on a `&mut` parameter builds an ill-sorted term and ICEs — only the explicit `(*v)` spelling works

Incompleteness: `#[requires(..)]` alone pins the postcondition to `true` instead of leaving it inferred (unlike `closure!(requires(..))` and `#[param(..)]`), so adding a precondition silently strips every caller of the call's result

Incompleteness: a local `impl PartialEq` is checked against the blanket `_extern_spec_partialeq_eq` (structural model equality), so any non-structural `eq` — even one that is never used — makes the whole crate fail with `Unsat`

Unsound: a user `Drop` impl is never checked at the drop site — `TerminatorKind::Drop` only resolves prophecies, so a destructor that panics verifies as `safe`

Unsound: `==` on `&mut` references compares the prophecy too, so the comparison's result depends on writes made after it — panicking programs verify as `safe`

Unsound: a two-phase borrow (`v.push(v.len())`) havocs the receiver before the arguments are evaluated, so reads in the argument see the prophecy — panicking programs verify as `safe`

Unsound: moving a `&mut`-capturing closure out of any aggregate (incl. `enum`/`Option`), with no higher-order call, drops its prophecy and verifies panicking programs as `safe` (generalizes #177)

Search results