|
While IKOS achieved perfect precision, it¡¯s just as important to understand the False Negatives—the bugs the tool missed. We identified four main coding patterns that caused these misses.
First, Wide Characters: IKOS failed to detect errors involving wchar_t because it lacks internal library definitions for these specific types. Second, Global Variables proved challenging; if a bugs logic depended on a value stored globally, the tool sometimes lost track of that state.
We also saw issues with Multiple Loops. To prevent the analysis from running forever, IKOS uses a technique called Widening. While this keeps the tool fast, it can sometimes over-generalize a pointers state, causing the tool to miss a specific error. Finally, Complex C++ Containers, like std::vector or std::map, presented lifecycles that were simply too complex for the tools current memory modeling. |