Issues

Incompleteness: an explicit `invariant!` on a loop that writes through a `&mut` drops the reference's prophecy link, so the referent is havoc'd after the borrow ends — safe programs wrongly rejected (no workaround; the inference path handles it)

#205

· coord-e opened

on Aug 6, 2026

Unsound: `Vec` equality (`==`) is modeled as structural equality of the whole `(array, length)` representation, so vectors equal in Rust but differing in stale slots past `length` (after `pop`/`truncate`) compare unequal — dead-branch panics verify as `safe`

bug

#203

· coord-e opened

on Aug 5, 2026

Incompleteness: a `&mut` stored in a `Vec` (Seq/array-backed container) never has its prophecy resolved at drop, so safe programs are wrongly rejected as `Unsat`

#202

· coord-e opened

on Aug 3, 2026

Incompleteness: a `fn(..)` pointer value called outside the basic block that created it loses the callee's refinement spec (result is havoc'd), so valid programs verify as `Unsat`

#201

· coord-e opened

on Aug 2, 2026

Unsound: an uncalled generic function (a type param appears in its signature) has its body skipped entirely, so a `#[thrust::callable]` entry point whose body always panics — or whose body violates its own `ensures` — verifies as `safe`

#200

· coord-e opened

on Aug 1, 2026

`thrust-rustc` compiles at rustc's default edition (2015), not 2021 like its `ui_test` suite: annotation diagnostics are masked as `E0433: missing crate 'core'`, and edition-sensitive programs behave differently

#199

· coord-e opened

on Jul 31, 2026

Panic: `refine_local_defs` calls `optimized_mir` on non-fn-like defs before the `is_fn_like` guard, so any program with a `const`/`static` item (or an array-repeat `[v; N]`) aborts before verification

bug

#198

· coord-e opened

on Jul 30, 2026

Unsound: a `#[param(name: { v | φ })]` precondition combined with `#[ensures(..)]` is dropped at call sites too, so a `#[thrust::trusted]` function with a violated precondition verifies panicking programs as `safe`

#196

· coord-e opened

on Jul 28, 2026

Ordering comparisons (`<`, `>`) on tuple/aggregate values emit ill-typed SMT `(< Tuple Tuple)` via the generic `PartialOrd::lt`/`gt` extern specs, so safe programs comparing tuples are falsely rejected

#195

· coord-e opened

on Jul 27, 2026

Incompleteness: a refinement on a generic type argument in `#[param]` position is dropped for multi-variant enums, so the payload refinement is never assumed in the callee

bug

#193

· coord-e opened

on Jul 26, 2026

Incompleteness: an existentially-quantified precondition (`requires(exists ..)`) emits a quantifier into the Horn clause body, so the default `z3` solver returns `unknown` — `Result::unwrap`/`unwrap_err` are unverifiable

#192

· coord-e opened

on Jul 25, 2026

Incompleteness: a `#[param(name: { v | φ })]` precondition is silently dropped when the function also has an `#[ensures(..)]`, so trivially-correct functions are rejected

#191

· coord-e opened

on Jul 24, 2026

Navigation Menu

All issues

Incompleteness: an explicit `invariant!` on a loop that writes through a `&mut` drops the reference's prophecy link, so the referent is havoc'd after the borrow ends — safe programs wrongly rejected (no workaround; the inference path handles it)

Unsound: `Vec` equality (`==`) is modeled as structural equality of the whole `(array, length)` representation, so vectors equal in Rust but differing in stale slots past `length` (after `pop`/`truncate`) compare unequal — dead-branch panics verify as `safe`

Incompleteness: a `&mut` stored in a `Vec` (Seq/array-backed container) never has its prophecy resolved at drop, so safe programs are wrongly rejected as `Unsat`

Incompleteness: a `fn(..)` pointer value called outside the basic block that created it loses the callee's refinement spec (result is havoc'd), so valid programs verify as `Unsat`

Unsound: an uncalled generic function (a type param appears in its signature) has its body skipped entirely, so a `#[thrust::callable]` entry point whose body always panics — or whose body violates its own `ensures` — verifies as `safe`

`thrust-rustc` compiles at rustc's default edition (2015), not 2021 like its `ui_test` suite: annotation diagnostics are masked as `E0433: missing crate 'core'`, and edition-sensitive programs behave differently

Panic: `refine_local_defs` calls `optimized_mir` on non-fn-like defs before the `is_fn_like` guard, so any program with a `const`/`static` item (or an array-repeat `[v; N]`) aborts before verification

Unsound: a `#[param(name: { v | φ })]` precondition combined with `#[ensures(..)]` is dropped at call sites too, so a `#[thrust::trusted]` function with a violated precondition verifies panicking programs as `safe`

Ordering comparisons (`<`, `>`) on tuple/aggregate values emit ill-typed SMT `(< Tuple Tuple)` via the generic `PartialOrd::lt`/`gt` extern specs, so safe programs comparing tuples are falsely rejected

Incompleteness: a refinement on a generic type argument in `#[param]` position is dropped for multi-variant enums, so the payload refinement is never assumed in the callee

Incompleteness: an existentially-quantified precondition (`requires(exists ..)`) emits a quantifier into the Horn clause body, so the default `z3` solver returns `unknown` — `Result::unwrap`/`unwrap_err` are unverifiable

Incompleteness: a `#[param(name: { v | φ })]` precondition is silently dropped when the function also has an `#[ensures(..)]`, so trivially-correct functions are rejected

Search results