35 #define forall_objects(it, map) \ 36 for(object_map_dt::const_iterator it = (map).begin(); \ 40 #define forall_valid_objects(it, map) \ 41 for(object_map_dt::const_iterator it = (map).begin(); \ 44 if((map).is_valid_at((it)->first, from_function, from_target_index)) 46 #define Forall_objects(it, map) \ 47 for(object_map_dt::iterator it = (map).begin(); \ 51 #define Forall_valid_objects(it, map) \ 52 for(object_map_dt::iterator it = (map).begin(); \ 55 if((map).is_valid_at((it)->first, from_function, from_target_index)) 59 std::ostream &out)
const 61 for(valuest::const_iterator
71 std::ostream &out)
const 89 identifier=symbol.
name;
97 out << display_name <<
" = { ";
107 std::string result=
"<";
109 if(o.
id()==ID_invalid)
113 if(o.
type().
id()==ID_unknown)
115 else if(o.
type().
id()==ID_invalid)
121 else if(o.
id()==ID_unknown)
125 if(o.
type().
id()==ID_unknown)
127 else if(o.
type().
id()==ID_invalid)
135 result+=
from_expr(ns, identifier, o)+
", ";
144 if(o.
type().
id()==ID_unknown)
155 out << result <<
'\n';
158 object_map_dt::validity_rangest::const_iterator vr =
163 if(vr->second.empty())
164 std::cout <<
" Empty validity record\n";
167 for(object_map_dt::vrange_listt::const_iterator vit =
169 vit!=vr->second.end();
173 " [" << vit->from <<
"," << vit->to <<
"]";
176 from_target_index<=vit->to)
184 out <<
" No validity information\n";
188 width+=result.size();
193 if(next!=object_map.
read().
end())
206 if(
object.
id()==ID_invalid ||
207 object.
id()==ID_unknown)
258 dest.
write()[it->first] = it->second;
268 std::list<exprt> &value_set,
275 value_set.push_back(
to_expr(it));
278 for(std::list<exprt>::const_iterator it=value_set.begin();
279 it!=value_set.end(); it++)
280 std::cout <<
"GET_VALUE_SET: " <<
format(*it) <<
'\n';
298 const std::string &suffix,
299 const typet &original_type,
303 std::cout <<
"GET_VALUE_SET_REC EXPR: " << expr <<
'\n';
304 std::cout <<
"GET_VALUE_SET_REC SUFFIX: " << suffix <<
'\n';
308 if(expr.id()==ID_unknown || expr.id()==ID_invalid)
313 else if(expr.id()==ID_index)
315 assert(expr.operands().size()==2);
320 type.id()==ID_incomplete_array,
321 "operand 0 of index expression must be an array");
327 else if(expr.id()==ID_member)
329 assert(expr.operands().size()==1);
331 if(expr.op0().is_not_nil())
336 type.
id()==ID_union ||
337 type.
id()==ID_incomplete_struct ||
338 type.
id()==ID_incomplete_union,
339 "operand 0 of member expression must be struct or union");
341 const std::string &component_name=
342 expr.get_string(ID_component_name);
350 else if(expr.id()==ID_symbol)
363 valuest::const_iterator v_it=
values.find(ident);
372 else if(expr.id()==ID_if)
374 if(expr.operands().size()!=3)
375 throw "if takes three operands";
384 else if(expr.id()==ID_address_of)
386 if(expr.operands().size()!=1)
387 throw expr.id_string()+
" expected to have one operand";
393 else if(expr.id()==ID_dereference)
399 if(object_map.
begin()!=object_map.
end())
411 else if(expr.id()==
"reference_to")
419 if(object_map.
begin()!=object_map.
end())
431 else if(expr.is_constant())
434 if(expr.get(ID_value)==ID_NULL &&
435 expr.type().id()==ID_pointer)
441 else if(expr.id()==ID_typecast)
443 if(expr.operands().size()!=1)
444 throw "typecast takes one operand";
451 else if(expr.id()==ID_plus || expr.id()==ID_minus)
453 if(expr.operands().size()<2)
454 throw expr.id_string()+
" expected to have at least two operands";
456 if(expr.type().id()==ID_pointer)
459 const exprt *ptr_operand=
nullptr;
462 if(it->type().id()==ID_pointer)
464 if(ptr_operand==
nullptr)
467 throw "more than one pointer operand in pointer arithmetic";
470 if(ptr_operand==
nullptr)
471 throw "pointer type sum expected to have pointer operand";
475 ptr_operand->
type(), ns);
483 if(expr.op0().type().id()!=ID_pointer)
489 *offset = (expr.id() == ID_plus) ? i : -i;
497 *offset = (expr.id() == ID_plus) ? i : -i;
509 else if(expr.id()==ID_side_effect)
511 const irep_idt &statement=expr.get(ID_statement);
513 if(statement==ID_function_call)
516 throw "unexpected function_call sideeffect";
518 else if(statement==ID_allocate)
520 if(expr.type().id()!=ID_pointer)
521 throw "malloc expected to return pointer type";
525 const typet &dynamic_type=
526 static_cast<const typet &
>(expr.find(ID_C_cxx_alloc_type));
537 else if(statement==ID_cpp_new ||
538 statement==ID_cpp_new_array)
541 assert(expr.type().id()==ID_pointer);
553 else if(expr.id()==ID_struct)
559 else if(expr.id()==ID_with ||
560 expr.id()==ID_array_of ||
564 throw "unexpected value in get_value_set: "+expr.id_string();
566 else if(expr.id()==ID_dynamic_object)
571 const std::string name=
572 "value_set::dynamic_object"+
577 valuest::const_iterator v_it=
values.find(name);
594 if(src.
id()==ID_typecast)
596 assert(src.
type().
id()==ID_pointer);
599 throw "typecast expects one operand";
625 std::cout <<
"GET_REFERENCE_SET_REC EXPR: " <<
format(expr) <<
'\n';
628 if(expr.
id()==ID_symbol ||
629 expr.
id()==ID_dynamic_object ||
630 expr.
id()==ID_string_constant)
632 if(expr.
type().
id()==ID_array &&
640 else if(expr.
id()==ID_dereference)
643 throw expr.
id_string()+
" expected to have one operand";
648 for(expr_sett::const_iterator it=value_set.begin();
649 it!=value_set.end(); it++)
650 std::cout <<
"VALUE_SET: " <<
format(*it) <<
'\n';
655 else if(expr.
id()==ID_index)
658 throw "index expected to have two operands";
664 assert(array_type.
id()==ID_array ||
665 array_type.
id()==ID_incomplete_array);
677 if(
object.
id()==ID_unknown)
685 if(ns.
follow(
object.type())!=array_type)
705 else if(expr.
id()==ID_member)
707 const irep_idt &component_name=expr.
get(ID_component_name);
710 throw "member expected to have one operand";
724 if(
object.
id()==ID_unknown)
726 else if(
object.
id()==ID_dynamic_object &&
727 obj_type.
id()!=ID_struct &&
728 obj_type.
id()!=ID_union)
750 else if(expr.
id()==ID_if)
753 throw "if takes three operands";
770 std::cout <<
"ASSIGN LHS: " << lhs <<
'\n';
771 std::cout <<
"ASSIGN LTYPE: " <<
format(ns.
follow(lhs.type())) <<
'\n';
772 std::cout <<
"ASSIGN RHS: " <<
format(rhs) <<
'\n';
778 throw "if takes three operands";
787 if(type.
id()==ID_struct ||
794 for(struct_typet::componentst::const_iterator
799 const typet &subtype=c_it->type();
800 const irep_idt &name=c_it->get(ID_name);
803 if(subtype.
id()==ID_code)
810 if(rhs.
id()==ID_unknown ||
811 rhs.
id()==ID_invalid)
813 rhs_member=
exprt(rhs.
id(), subtype);
819 "type mismatch:\nRHS: "+rhs.
type().
pretty()+
"\n"+
822 if(rhs.
id()==ID_struct ||
823 rhs.
id()==ID_constant)
828 else if(rhs.
id()==ID_with)
833 const exprt &member_operand=rhs.
op1();
836 member_operand.get(ID_component_name);
838 if(component_name==name)
841 rhs_member=rhs.
op2();
846 rhs_member=
exprt(ID_member, subtype);
848 rhs_member.
set(ID_component_name, name);
853 rhs_member=
exprt(ID_member, subtype);
855 rhs_member.
set(ID_component_name, name);
858 assign(lhs_member, rhs_member, ns, add_to_sets);
862 else if(type.
id()==ID_array)
867 if(rhs.
id()==ID_unknown ||
868 rhs.
id()==ID_invalid)
876 if(rhs.
id()==ID_array_of)
880 assign(lhs_index, rhs.
op0(), ns, add_to_sets);
882 else if(rhs.
id()==ID_array ||
883 rhs.
id()==ID_constant)
887 assign(lhs_index, *o_it, ns, add_to_sets);
890 else if(rhs.
id()==ID_with)
897 assign(lhs_index, op0_index, ns, add_to_sets);
904 assign(lhs_index, rhs_index, ns,
true);
915 assign_rec(lhs, values_rhs,
"", ns, add_to_sets);
924 if(op.
type().
id()!=ID_pointer)
925 throw "free expected to have pointer-type operand";
940 if(
object.
id()==ID_dynamic_object)
952 for(valuest::iterator v_it=
values.begin();
959 v_it->second.object_map.read();
967 if(
object.
id()==ID_dynamic_object)
973 set(new_object_map, o_it);
985 set(new_object_map, o_it);
991 v_it->second.suffix);
1000 const std::string &suffix,
1005 std::cout <<
"ASSIGN_REC LHS: " << lhs <<
'\n';
1006 std::cout <<
"ASSIGN_REC SUFFIX: " << suffix <<
'\n';
1009 it!=values_rhs.
read().
end(); it++)
1010 std::cout <<
"ASSIGN_REC RHS: " <<
to_expr(it) <<
'\n';
1013 if(lhs.id()==ID_symbol)
1018 "value_set::dynamic_object") ||
1020 "value_set::return_value") ||
1035 else if(lhs.id()==ID_dynamic_object)
1040 const std::string name=
1041 "value_set::dynamic_object"+
1052 make_union(temp_entry.object_map, values_rhs);
1054 else if(lhs.id()==ID_dereference)
1056 if(lhs.operands().size()!=1)
1057 throw lhs.id_string()+
" expected to have one operand";
1066 if(
object.
id()!=ID_unknown)
1067 assign_rec(
object, values_rhs, suffix, ns, add_to_sets);
1070 else if(lhs.id()==ID_index)
1072 if(lhs.operands().size()!=2)
1073 throw "index expected to have two operands";
1078 "operand 0 of index expression must be an array");
1080 assign_rec(lhs.op0(), values_rhs,
"[]"+suffix, ns, add_to_sets);
1082 else if(lhs.id()==ID_member)
1084 if(lhs.operands().size()!=1)
1085 throw "member expected to have one operand";
1087 if(lhs.op0().is_nil())
1090 const std::string &component_name=lhs.get_string(ID_component_name);
1095 type.
id()==ID_union ||
1096 type.
id()==ID_incomplete_struct ||
1097 type.
id()==ID_incomplete_union,
1098 "operand 0 of member expression must be struct or union");
1100 assign_rec(lhs.op0(), values_rhs,
"."+component_name+suffix,
1103 else if(lhs.id()==
"valid_object" ||
1104 lhs.id()==
"dynamic_size" ||
1105 lhs.id()==
"dynamic_type")
1109 else if(lhs.id()==ID_string_constant)
1114 else if(lhs.id() == ID_null_object)
1118 else if(lhs.id()==ID_typecast)
1125 else if(lhs.id()==
"zero_string" ||
1126 lhs.id()==
"is_zero_string" ||
1127 lhs.id()==
"zero_string_length")
1131 else if(lhs.id()==ID_byte_extract_little_endian ||
1132 lhs.id()==ID_byte_extract_big_endian)
1134 assert(lhs.operands().size()==2);
1135 assign_rec(lhs.op0(), values_rhs, suffix, ns,
true);
1138 throw "assign NYI: `"+lhs.id_string()+
"'";
1163 for(std::size_t i=0; i<arguments.size(); i++)
1165 const std::string identifier=
"value_set::" +
id2string(
function) +
"::" +
1168 const symbol_exprt dummy_lhs(identifier, arguments[i].type());
1170 assign(dummy_lhs, arguments[i], ns,
true);
1186 for(code_typet::parameterst::const_iterator
1187 it=parameter_types.begin();
1188 it!=parameter_types.end();
1191 const irep_idt &identifier=it->get_identifier();
1202 assign(actual_lhs, v_expr, ns,
true);
1214 irep_idt rvs = std::string(
"value_set::return_value") +
1228 if(statement==ID_block)
1233 else if(statement==ID_function_call)
1238 else if(statement==ID_assign ||
1242 throw "assignment expected to have two operands";
1246 else if(statement==ID_decl)
1249 throw "decl expected to have one operand";
1253 if(lhs.
id()!=ID_symbol)
1254 throw "decl expected to have symbol on lhs";
1258 else if(statement==ID_expression)
1262 else if(statement==ID_cpp_delete ||
1263 statement==ID_cpp_delete_array)
1267 else if(statement==ID_free)
1272 throw "free expected to have one operand";
1276 else if(statement==
"lock" || statement==
"unlock")
1280 else if(statement==ID_asm)
1284 else if(statement==ID_nondet)
1288 else if(statement==ID_printf)
1292 else if(statement==ID_return)
1297 irep_idt rvs = std::string(
"value_set::return_value") +
1304 else if(statement==ID_input || statement==ID_output)
1312 "value_set_fivrnst: unexpected statement: "+
id2string(statement);
1337 if(old_offset && offset)
1339 if(*old_offset == *offset)
1347 else if(!old_offset)
1378 if(old_offset && offset)
1380 if(*old_offset == *offset)
1388 else if(!old_offset)
1407 vrange_listt::iterator it=ranges.begin();
1409 while(it->function!=f && it!=ranges.end()) it++;
1412 it!=ranges.end() && it->function==f && it->from <= line;
1417 if( line == it->to+1)
1422 vrange_listt::iterator n_it = it; n_it++;
1423 if(n_it!=ranges.end() &&
1424 it->function == n_it->function &&
1425 it->to+1 == n_it->from)
1427 n_it->from = it->from;
1428 it = ranges.erase(it);
1438 if(it!=ranges.end())
1442 if( line == it->from - 1)
1447 if(it!=ranges.begin())
1449 vrange_listt::iterator p_it = it; p_it--;
1450 if(p_it->function == it->function &&
1451 p_it->to+1 == it->from)
1454 it = ranges.erase(it);
1464 ranges.insert(it, insr);
1472 unsigned line)
const 1475 std::cout <<
"IS_VALID_AT: " << inx <<
", " << f <<
", line " << line <<
1479 validity_rangest::const_iterator vrs = validity_ranges.find(inx);
1480 if(vrs!=validity_ranges.end())
1484 object_map_dt::vrange_listt::const_iterator it = ranges.begin();
1486 while(it->function!=f &&
1491 it!=ranges.end() && it->function==f && it->from<=line;
1493 if(it->contains(f, line))
1504 for(valuest::iterator it=
values.begin();
1528 if(
make_union(state_map, t_it->second.object_map))
The type of an expression.
irep_idt name
The unique identifier.
const std::string & id2string(const irep_idt &d)
void do_function_call(const irep_idt &function, const exprt::operandst &arguments, const namespacet &ns)
const std::string integer2string(const mp_integer &n, unsigned base)
std::string pretty(unsigned indent=0, unsigned max_indent=0) const
static object_numberingt object_numbering
const dynamic_object_exprt & to_dynamic_object_expr(const exprt &expr)
Cast a generic exprt to a dynamic_object_exprt.
void output(const namespacet &ns, std::ostream &out) const
bool base_type_eq(const typet &type1, const typet &type2, const namespacet &ns)
bool insert_from(object_mapt &dest, object_map_dt::const_iterator it) const
bool set_valid_at(unsigned inx, unsigned f, unsigned line)
const code_typet & to_code_type(const typet &type)
Cast a generic typet to a code_typet.
void copy_to_operands(const exprt &expr)
const irep_idt & get_identifier() const
std::string from_expr(const namespacet &ns, const irep_idt &identifier, const exprt &expr)
std::vector< parametert > parameterst
void apply_code(const exprt &code, const namespacet &ns)
const_iterator find(object_numberingt::number_type k)
const componentst & components() const
void copy_objects(object_mapt &dest, const object_mapt &src) const
static const object_map_dt blank
optionalt< mp_integer > offsett
Represents the offset into an object: either a unique integer offset, or an unknown value...
void dereference_rec(const exprt &src, exprt &dest) const
Symbol table entry.This is a symbol in the symbol table, stored in an object of type symbol_tablet...
static const char * alloc_adapter_prefix
Extract member of struct or union.
void do_free(const exprt &op, const namespacet &ns)
bool make_union(object_mapt &dest, const object_mapt &src) const
bool offset_is_zero(offsett offset) const
bool insert_to(object_mapt &dest, object_map_dt::const_iterator it) const
void get_value_set_rec(const exprt &expr, object_mapt &dest, const std::string &suffix, const typet &original_type, const namespacet &ns) const
const irep_idt & id() const
void output_entry(const entryt &e, const namespacet &ns, std::ostream &out) const
The boolean constant true.
#define forall_valid_objects(it, map)
void do_end_function(const exprt &lhs, const namespacet &ns)
entryt & get_entry(const idt &id, const std::string &suffix)
API to expression classes.
const irep_idt & get(const irep_namet &name) const
void assign(const exprt &lhs, const exprt &rhs, const namespacet &ns, bool add_to_sets=false)
bool has_prefix(const std::string &s, const std::string &prefix)
split an expression into a base object and a (byte) offset
Value Set (Flow Insensitive, Validity Regions)
#define forall_operands(it, expr)
const symbol_exprt & to_symbol_expr(const exprt &expr)
Cast a generic exprt to a symbol_exprt.
exprt to_expr(object_map_dt::const_iterator it) const
const typet & follow(const typet &) const
bitvector_typet index_type()
const struct_typet & to_struct_type(const typet &type)
Cast a generic typet to a struct_typet.
typename Map::mapped_type number_type
objmapt::const_iterator const_iterator
validity_rangest validity_ranges
Operator to return the address of an object.
std::string from_type(const namespacet &ns, const irep_idt &identifier, const typet &type)
#define forall_objects(it, map)
void add_var(const idt &id, const std::string &suffix)
std::vector< exprt > operandst
std::list< validity_ranget > vrange_listt
const irep_idt & display_name() const
typet type
Type of symbol.
void get_reference_set_rec(const exprt &expr, object_mapt &dest, const namespacet &ns) const
static hash_numbering< irep_idt, irep_id_hash > function_numbering
std::unordered_set< exprt, irep_hash > expr_sett
void assign_rec(const exprt &lhs, const object_mapt &values_rhs, const std::string &suffix, const namespacet &ns, bool add_to_sets)
Base class for all expressions.
const parameterst & parameters() const
std::string to_string(const string_constraintt &expr)
Used for debug printing.
bool is_valid_at(unsigned inx, unsigned f, unsigned line) const
const typecast_exprt & to_typecast_expr(const exprt &expr)
Cast a generic exprt to a typecast_exprt.
void get_reference_set(const exprt &expr, expr_sett &expr_set, const namespacet &ns) const
const std::string & id_string() const
bool make_valid_union(object_mapt &dest, const object_mapt &src) const
std::unordered_set< unsigned int > dynamic_object_id_sett
Expression to hold a symbol (variable)
exprt dynamic_object(const exprt &pointer)
void get_value_set(const exprt &expr, std::list< exprt > &expr_set, const namespacet &ns) const
const typet & subtype() const
entryt & get_temporary_entry(const idt &id, const std::string &suffix)
#define DATA_INVARIANT(CONDITION, REASON)
void make_typecast(const typet &_type)
bool lookup(const irep_idt &name, const symbolt *&symbol) const override
See namespace_baset::lookup().
unsigned from_target_index
void set(const irep_namet &name, const irep_idt &value)
#define Forall_valid_objects(it, map)
bool simplify(exprt &expr, const namespacet &ns)