Beispiel #1
0
exprt local_SSAt::read_rhs(const exprt &expr, locationt loc) const
{
  exprt tmp1=expr;
  adjust_float_expressions(tmp1, ns);
  
  unsigned counter=0;
  replace_side_effects_rec(tmp1, loc, counter);

  #ifdef DEBUG
  std::cout << "read_rhs tmp1: " << from_expr(ns, "", tmp1) << '\n';
  #endif
  
  exprt tmp2=dereference(tmp1, loc);

  #ifdef DEBUG
  std::cout << "read_rhs tmp2: " << from_expr(ns, "", tmp2) << '\n';
  #endif
  
  exprt result=read_rhs_rec(tmp2, loc);
  
  #ifdef DEBUG
  std::cout << "read_rhs result: " << from_expr(ns, "", result) << '\n';
  #endif
  
  return result;
}
Beispiel #2
0
exprt path_symex_statet::read(const exprt &src, bool propagate)
{
  #ifdef DEBUG
  //std::cout << "path_symex_statet::read " << src.pretty() << std::endl;
  #endif

  // This has four phases!
  // 1. Floating-point expression adjustment (rounding mode)
  // 2. Dereferencing, including propagation of pointers.
  // 3. Rewriting to SSA symbols
  // 4. Simplifier

  exprt tmp1=src;
  adjust_float_expressions(tmp1, var_map.ns);

  // we force propagation for dereferencing
  exprt tmp2=dereference_rec(tmp1, true);

  exprt tmp3=instantiate_rec(tmp2, propagate);

  exprt tmp4=simplify_expr(tmp3, var_map.ns);

  #ifdef DEBUG
  //std::cout << " ==> " << tmp.pretty() << std::endl;
  #endif

  return tmp4;
}
Beispiel #3
0
void goto_symext::clean_expr(
  exprt &expr,
  statet &state,
  const bool write)
{
  rewrite_union(expr, ns);
  replace_nondet(expr);
  dereference(expr, state, write);
  replace_array_equal(expr);
  adjust_float_expressions(expr, ns);
}
Beispiel #4
0
bool symex_parse_optionst::process_goto_program(const optionst &options)
{
  try
  {
    // we add the library
    status() << "Adding CPROVER library" << eom;
    link_to_library(goto_model, ui_message_handler);

    // do partial inlining
    status() << "Partial Inlining" << eom;
    goto_partial_inline(goto_model, ui_message_handler);

    // add generic checks
    status() << "Generic Property Instrumentation" << eom;
    goto_check(options, goto_model);

    // remove stuff
    remove_complex(goto_model);
    remove_vector(goto_model);
    // Java virtual functions -> explicit dispatch tables:
    remove_virtual_functions(goto_model);
    // Java throw and catch -> explicit exceptional return variables:
    remove_exceptions(goto_model);
    // Java instanceof -> clsid comparison:
    remove_instanceof(goto_model);
    rewrite_union(goto_model);
    adjust_float_expressions(goto_model);

    // recalculate numbers, etc.
    goto_model.goto_functions.update();

    // add loop ids
    goto_model.goto_functions.compute_loop_numbers();

    if(cmdline.isset("cover"))
    {
      std::string criterion=cmdline.get_value("cover");

      coverage_criteriont c;

      if(criterion=="assertion" || criterion=="assertions")
        c=coverage_criteriont::ASSERTION;
      else if(criterion=="path" || criterion=="paths")
        c=coverage_criteriont::PATH;
      else if(criterion=="branch" || criterion=="branches")
        c=coverage_criteriont::BRANCH;
      else if(criterion=="location" || criterion=="locations")
        c=coverage_criteriont::LOCATION;
      else if(criterion=="decision" || criterion=="decisions")
        c=coverage_criteriont::DECISION;
      else if(criterion=="condition" || criterion=="conditions")
        c=coverage_criteriont::CONDITION;
      else if(criterion=="mcdc")
        c=coverage_criteriont::MCDC;
      else if(criterion=="cover")
        c=coverage_criteriont::COVER;
      else
      {
        error() << "unknown coverage criterion" << eom;
        return true;
      }

      status() << "Instrumenting coverge goals" << eom;
      instrument_cover_goals(symbol_table, goto_model.goto_functions, c);
      goto_model.goto_functions.update();
    }

    // show it?
    if(cmdline.isset("show-loops"))
    {
      show_loop_ids(get_ui(), goto_model.goto_functions);
      return true;
    }

    // show it?
    if(cmdline.isset("show-goto-functions"))
    {
      show_goto_functions(goto_model, get_ui());
      return true;
    }
  }

  catch(const char *e)
  {
    error() << e << eom;
    return true;
  }

  catch(const std::string e)
  {
    error() << e << eom;
    return true;
  }

  catch(int)
  {
    return true;
  }

  catch(std::bad_alloc)
  {
    error() << "Out of memory" << eom;
    return true;
  }

  return false;
}