From 4713ccd56becd7eb3a39d6c5a8c1f5ef1d8adbe0 Mon Sep 17 00:00:00 2001
From: Aleksandr Misonizhnik <misonijnik@gmail.com>
Date: Tue, 21 Nov 2023 04:53:53 +0400
Subject: [PATCH] [chore] Update `kleef`

---
 scripts/kleef | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/scripts/kleef b/scripts/kleef
index 58017a8fc8..2dd0bd016d 100755
--- a/scripts/kleef
+++ b/scripts/kleef
@@ -22,9 +22,9 @@ def klee_options(
     write_ktests,
 ):
     if max_time and int(max_time) > 30:
-        MAX_SOLVER_TIME = 10
+        MAX_SOLVER_TIME = 15
     else:
-        MAX_SOLVER_TIME = 5
+        MAX_SOLVER_TIME = 10
     cmd = [
         "--strip-unwanted-calls",  # removes llvm.dbg.* instructions, exponentially reduces time on some benchmarks
         "--delete-dead-loops=false",  # without this optimizer removes some code, which decreases coverage
@@ -33,10 +33,11 @@ def klee_options(
         "--external-calls=all",
         "--use-forked-solver=false",
         # "--solver-backend=stp",
-        "--solver-backend=z3-tree",
+        # "--solver-backend=z3-tree",
+        "--solver-backend=bitwuzla-tree",
         "--max-solvers-approx-tree-inc=16",
         f"--max-memory={int(max_memory * 0.9)}",  # Just use half of the memory in case we have to fork
-        "--optimize",
+        "--libc=klee",
         "--skip-not-lazy-initialized",
         f"--output-dir={test_output_dir}",  # Output files into specific directory
         "--output-source=false",  # Do not output assembly.ll - it can be too large
@@ -53,7 +54,6 @@ def klee_options(
         # "--libc=uclibc",
         # "--posix-runtime",
         "--fp-runtime",
-        "--x86FP-as-x87FP80=false",
         # "--max-sym-array-size=4096",
         "--symbolic-allocation-threshold=8192",
         "--uninit-memory-test-multiplier=10",
@@ -68,19 +68,21 @@ def klee_options(
             "--allocate-determ",
             f"--allocate-determ-size={min(int(max_memory * 0.6), 3 * 1024)}",
             "--allocate-determ-start-address=0x00030000000",
+            "--x86FP-as-x87FP80",
         ]
 
     if f_err:
         cmd += [
-            "--use-alpha-equivalence=false",
+            "--optimize=true",
+            "--use-alpha-equivalence=true",
             "--function-call-reproduce=reach_error",
-            "--dump-states-on-halt-with-function-call-reproduce",
             # "--max-cycles=0",
             # "--tc-type=bug",
             "--dump-states-on-halt=unreached",  # Explicitly do not dump states
             "--exit-on-error-type=Assert",  # Only generate test cases of type assert
             # "--dump-test-case-type=Assert", # Only dump test cases of type assert
             "--search=dfs",
+            "--search=bfs",
             #    "--search=nurs:covnew", "--search=random-path","--search=dfs", "--use-batching-search",
             #    "--search=distance","--search=random-path","--use-batching-search",
             # "--target-assert", # Target
@@ -97,8 +99,10 @@ def klee_options(
 
     if f_cov:
         cmd += [
+            "--optimize=false",
             "--mem-trigger-cof", # Start on the fly tests generation after approaching memory cup
             "--use-alpha-equivalence=true",
+            "--optimize-aggressive=false",
             "--track-coverage=all", # Only branches and only instructions are wrong in real life. E.g., ternary operators are sometimes counted as different branches, while we stick to look at them as a single instruction from a single branch
             "--use-iterative-deepening-search=max-cycles",
             f"--max-solver-time={MAX_SOLVER_TIME}s",
@@ -273,6 +277,7 @@ class KLEEF(object):
 
     def run(self):
         test_output_dir = self.test_results_path / self.source.name
+        test_output_dir = self.test_results_path
         # Clean-up from previous runs if needed
         shutil.rmtree(test_output_dir, ignore_errors=True)