Go to the documentation of this file.
50 if(expr.
id()==ID_byte_extract_little_endian ||
51 expr.
id()==ID_byte_extract_big_endian)
61 if(be.
op().
type().
id() == ID_array && result.
id() == ID_address_of)
67 t->
id() == ID_array && expr.
type() != *t;
83 typet dest_type_subtype;
85 if(expr_type.
id()==ID_array && !keep_array)
86 dest_type_subtype=expr_type.
subtype();
88 dest_type_subtype=expr_type;
92 else if(expr.
id()==ID_index ||
106 else if(expr.
id()==ID_dereference)
115 else if(expr.
id()==ID_if)
130 else if(expr.
id()==ID_symbol ||
131 expr.
id()==ID_string_constant ||
132 expr.
id()==ID_label ||
140 if(result.
type().
id() == ID_array && !keep_array)
149 offset = *offset_opt;
167 else if(expr.
id() == ID_typecast)
175 typet dest_type_subtype;
177 if(expr_type.
id() == ID_array && !keep_array)
178 dest_type_subtype = expr_type.
subtype();
180 dest_type_subtype = expr_type;
186 "goto_symext::address_arithmetic does not handle " + expr.
id_string());
190 (expr_type.
id() == ID_array && !keep_array) ||
192 "either non-persistent array or pointer to result");
200 auto const cache_key = [&] {
203 if(
auto let_expr = expr_try_dynamic_cast<let_exprt>(dereference_result))
205 let_expr->value() = state.
rename<
L2>(let_expr->value(),
ns).get();
209 cache_key = state.
rename<
L2>(cache_key,
ns).get();
230 auto cache_value = cache_key;
236 auto cache_symbol_expr = cache_symbol.symbol_expr();
237 assign.assign_symbol(
244 return cache_symbol_expr;
262 bool is_in_quantifier)
264 if(expr.
id()==ID_dereference)
266 bool expr_is_not_null =
false;
271 if(!expr_function.
empty())
277 .is_safe_dereference(to_check, state.
source.
pc);
314 "simplify re-introduced dereferencing");
325 symex_dereference_state,
350 (tmp2.
id() == ID_if || tmp2.
id() == ID_let))
356 expr = std::move(tmp2);
360 expr.
id() == ID_index &&
to_index_expr(expr).array().
id() == ID_member &&
380 else if(expr.
id()==ID_index &&
386 else if(expr.
id()==ID_address_of)
397 else if(expr.
id()==ID_typecast)
403 tc_op.
id() == ID_address_of &&
423 bool is_quantifier = expr.
id() == ID_forall || expr.
id() == ID_exists;
432 if(
auto deref = expr_try_dynamic_cast<dereference_exprt>(e))
434 deref->op() = f(std::move(deref->op()));
489 ns, state, state.
rename<
L1>(std::move(e),
ns).get(),
false);
496 expr = state.
rename<
L1>(std::move(expr),
ns).get();
521 "simplify re-introduced dereferencing");
#define UNREACHABLE
This should be used to mark dead code.
dstringt has one field, an unsigned integer no which is an index into a static table of strings.
sharing_mapt< exprt, symbol_exprt, false, irep_hash > dereference_cache
This is used for eliminating repeated complicated dereferences.
symbol_exprt cache_dereference(exprt &dereference_result, statet &state)
const typet & subtype() const
bool has_subexpr(const exprt &expr, const std::function< bool(const exprt &)> &pred)
returns true if the expression has a subexpression that satisfies pred
Symbolic Execution of assignments.
#define Forall_operands(it, expr)
void build(const exprt &expr, const namespacet &ns)
Given an expression expr, attempt to find the underlying object it represents by skipping over type c...
const dereference_exprt & to_dereference_expr(const exprt &expr)
Cast an exprt to a dereference_exprt.
The type of an expression, extends irept.
exprt address_arithmetic(const exprt &, statet &, bool keep_array)
Transforms an lvalue expression by replacing any dereference operations it contains with explicit ref...
Fresh auxiliary symbol creation.
goto_programt::const_targett pc
const byte_extract_exprt & to_byte_extract_expr(const exprt &expr)
const index_exprt & to_index_expr(const exprt &expr)
Cast an exprt to an index_exprt.
const if_exprt & to_if_expr(const exprt &expr)
Cast an exprt to an if_exprt.
symex_target_equationt & target
The equation that this execution is building up.
Operator to dereference a pointer.
path_storaget & path_storage
Symbolic execution paths to be resumed later.
bool cache_dereferences
Whether or not to replace multiple occurrences of the same dereference with a single symbol that cont...
Central data structure: state.
Thrown when we encounter an instruction, parameters to an instruction etc.
The trinary if-then-else operator.
Split an expression into a base object and a (byte) offset.
The plus expression Associativity is not specified.
Base class for all expressions.
symex_targett::sourcet source
Functor for symex assignment.
void trigger_auto_object(const exprt &, statet &)
Symbolic Execution of ANSI-C.
Expression to hold a symbol (variable)
NODISCARD exprt apply(const namespacet &ns, goto_symex_statet &state, exprt expr, bool write) const
Turn an expression expr into a field-sensitive SSA expression.
bitvector_typet index_type()
static const exprt & root_object(const exprt &expr)
messaget log
The messaget to write log messages to.
optionalt< mp_integer > compute_pointer_offset(const exprt &expr, const namespacet &ns)
irep_idt byte_extract_id()
typet & type()
Return the type of the expression.
std::vector< threadt > threads
Expression classes for byte-level operators.
bool is_ssa_expr(const exprt &expr)
call_stackt & call_stack()
const ssa_exprt & to_ssa_expr(const exprt &expr)
Cast a generic exprt to an ssa_exprt.
virtual void dereference(exprt &, statet &, bool write)
Replace all dereference operations within expr with explicit references to the objects they may refer...
symbol_tablet symbol_table
contains symbols that are minted during symbolic execution, such as dynamically created objects etc.
#define PRECONDITION(CONDITION)
void dereference_rec(exprt &expr, statet &state, bool write, bool is_in_quantifier)
If expr is a dereference_exprt, replace it with explicit references to the objects it may point to.
Callback object that goto_symext::dereference_rec provides to value_set_dereferencet to provide value...
const std::string & id_string() const
const pointer_typet & to_pointer_type(const typet &type)
Cast a typet to a pointer_typet.
pointer_typet pointer_type(const typet &subtype)
exprt get_original_name(exprt expr)
Undo all levels of renaming.
const irep_idt & id() const
@ L1_WITH_CONSTANT_PROPAGATION
virtual void do_simplify(exprt &expr)
void insert(const key_type &k, valueU &&m)
Insert element, element must not exist in map.
field_sensitivityt field_sensitivity
bitvector_typet char_type()
Wrapper for a function dereferencing pointer expressions using a value set.
namespacet ns
Initialized just before symbolic execution begins, to point to both outer_symbol_table and the symbol...
Deprecated expression utility functions.
static exprt apply_to_objects_in_dereference(exprt e, const std::function< exprt(exprt)> &f)
Forward depth-first search iterators These iterators' copy operations are expensive,...
irep_idt language_mode
language_mode: ID_java, ID_C or another language identifier if we know the source language in use,...
std::unordered_map< irep_idt, local_safe_pointerst > safe_pointers
Map function identifiers to local_safe_pointerst instances.
const typecast_exprt & to_typecast_expr(const exprt &expr)
Cast an exprt to a typecast_exprt.
void lift_lets(statet &, exprt &)
Execute any let expressions in expr using symex_assignt::assign_symbol.
const symex_configt symex_config
The configuration to use for this symbolic execution.
const array_typet & to_array_type(const typet &type)
Cast a typet to an array_typet.
NODISCARD renamedt< exprt, level > rename(exprt expr, const namespacet &ns)
Rewrites symbol expressions in exprt, applying a suffix to each symbol reflecting its most recent ver...
const address_of_exprt & to_address_of_expr(const exprt &expr)
Cast an exprt to an address_of_exprt.
Operator to return the address of an object.
#define INVARIANT(CONDITION, REASON)
This macro uses the wrapper function 'invariant_violated_string'.
source_locationt & add_source_location()
bool run_validation_checks
Should the additional validation checks be run? If this flag is set the checks for renaming (both lev...
Semantic type conversion.
const source_locationt & source_location() const
symbolt & get_fresh_aux_symbol(const typet &type, const std::string &name_prefix, const std::string &basename_prefix, const source_locationt &source_location, const irep_idt &symbol_mode, const namespacet &ns, symbol_table_baset &symbol_table)
Installs a fresh-named symbol with respect to the given namespace ns with the requested name pattern ...
Expression in which some part is missing and can be substituted for another expression.
optionalt< std::reference_wrapper< const mapped_type > > find(const key_type &k) const
Find element.