42 if(expr.
id()==ID_symbol)
48 std::string identifier=
52 if(l0_l1!=std::string::npos)
54 identifier.resize(l0_l1);
61 else if(expr.
id() == ID_string_constant)
82 if(cit !=
cache.end())
87 if(assign.
rhs().
id() == ID_array_list)
90 const auto &ops = array_list.
operands();
92 for(std::size_t listidx = 0; listidx != ops.size(); listidx += 2)
101 else if(assign.
rhs().
id() == ID_array)
117 else if(assign.
rhs().
id()==ID_struct ||
118 assign.
rhs().
id()==ID_union)
123 assign.
lhs().
id() == ID_member &&
131 else if(assign.
lhs().
id()==ID_byte_extract_little_endian ||
132 assign.
lhs().
id()==ID_byte_extract_big_endian)
145 exprt::operandst::const_iterator it=
147 for(
const auto &comp : components)
149 if(comp.type().id()==ID_code ||
150 comp.get_is_padding() ||
156 it != assign.
rhs().
operands().end(),
"expression must have operands");
168 if(assign.
rhs().
id()==ID_union)
172 else if(assign.
rhs().
id() == ID_with)
175 const auto &ops = with_expr.
operands();
177 for(std::size_t i = 1; i < ops.size(); i += 2)
182 if(ops[i].
id() == ID_member_name)
185 assign.
lhs(), ops[i].
get(ID_component_name), ops[i + 1].type()};
207 lhs.find(
"#return_value") != std::string::npos ||
208 (lhs.find(
'$') != std::string::npos &&
209 has_prefix(lhs,
"return_value___VERIFIER_nondet_")))
228 const goto_tracet::stepst::const_iterator &prev_it,
229 goto_tracet::stepst::const_iterator &it)
232 it->hidden && (!it->pc->is_assign() ||
233 it->pc->get_assign().rhs().id() != ID_side_effect ||
234 it->pc->get_assign().rhs().get(ID_statement) != ID_nondet))
237 if(!it->is_assignment() && !it->is_goto() && !it->is_assert())
243 if(prev_it!=goto_trace.
steps.end() &&
244 prev_it->pc->source_location==it->pc->source_location)
247 if(it->is_goto() && it->pc->get_condition().is_true())
252 if(source_location.
is_nil() ||
271 expr.
id() == ID_symbol &&
288 unsigned int max_thread_idx = 0;
289 bool trace_has_violation =
false;
290 for(goto_tracet::stepst::const_iterator it = goto_trace.
steps.begin();
291 it != goto_trace.
steps.end();
294 if(it->thread_nr > max_thread_idx)
295 max_thread_idx = it->thread_nr;
296 if(it->is_assert() && !it->cond_value)
297 trace_has_violation =
true;
303 graphml[sink].node_name=
"sink";
304 graphml[sink].is_violation=
false;
305 graphml[sink].has_invariant=
false;
307 if(max_thread_idx > 0 && trace_has_violation)
309 std::vector<graphmlt::node_indext> nodes;
311 for(
unsigned int i = 0; i <= max_thread_idx + 1; ++i)
315 graphml[nodes.back()].is_violation = i == max_thread_idx + 1;
316 graphml[nodes.back()].has_invariant =
false;
319 for(
auto it = nodes.cbegin(); std::next(it) != nodes.cend(); ++it)
324 const auto thread_id = std::distance(nodes.cbegin(), it);
326 data.set_attribute(
"key",
"createThread");
331 data.set_attribute(
"key",
"enterFunction");
334 graphml[*std::next(it)].
in[*it].xml_node = edge;
335 graphml[*it].
out[*std::next(it)].xml_node = edge;
344 std::vector<std::size_t> step_to_node(goto_trace.
steps.size()+1, 0);
346 goto_tracet::stepst::const_iterator prev_it=goto_trace.
steps.end();
347 for(goto_tracet::stepst::const_iterator
348 it=goto_trace.
steps.begin();
349 it!=goto_trace.
steps.end();
354 step_to_node[it->step_nr]=sink;
360 goto_tracet::stepst::const_iterator next=it;
362 if(next!=goto_trace.
steps.end() &&
364 it->full_lhs==next->full_lhs &&
365 it->pc->source_location==next->pc->source_location)
367 step_to_node[it->step_nr]=sink;
383 graphml[node].has_invariant=
false;
385 step_to_node[it->step_nr]=node;
391 for(goto_tracet::stepst::const_iterator
392 it=goto_trace.
steps.begin();
393 it!=goto_trace.
steps.end();
396 const std::size_t from=step_to_node[it->step_nr];
399 if(from == sink ||
graphml[from].is_violation)
405 auto next = std::next(it);
406 for(; next != goto_trace.
steps.end() &&
407 (step_to_node[next->step_nr] == sink ||
413 const std::size_t to=
414 next==goto_trace.
steps.end()?
415 sink:step_to_node[next->step_nr];
426 {{
"source",
graphml[from].node_name},
427 {
"target",
graphml[to].node_name}},
444 const auto lhs_object = it->get_lhs_object();
447 lhs_object.has_value())
449 const std::string &lhs_id =
id2string(lhs_object->get_identifier());
450 if(lhs_id.find(
"pthread_create::thread") != std::string::npos)
461 lhs_id.find(
"thread") == std::string::npos &&
462 lhs_id.find(
"mutex") == std::string::npos &&
463 (!it->full_lhs_value.is_constant() ||
464 !it->full_lhs_value.has_operands() ||
478 irep_idt function_id = it->function_id;
479 const symbolt *symbol_ptr =
nullptr;
482 function_id = lhs_id.substr(0, lhs_id.find(
"::"));
533 graphml[sink].node_name=
"sink";
534 graphml[sink].is_violation=
false;
535 graphml[sink].has_invariant=
false;
538 std::vector<std::size_t> step_to_node(equation.
SSA_steps.size()+1, 0);
540 std::size_t step_nr=1;
541 for(symex_target_equationt::SSA_stepst::const_iterator
550 (!it->is_assignment() && !it->is_goto() && !it->is_assert()) ||
551 (it->is_goto() && it->source.pc->get_condition().is_true()) ||
555 step_to_node[step_nr]=sink;
561 symex_target_equationt::SSA_stepst::const_iterator next=it;
564 next->is_assignment() &&
565 it->ssa_full_lhs==next->ssa_full_lhs &&
566 it->source.pc->source_location==next->source.pc->source_location)
568 step_to_node[step_nr]=sink;
579 graphml[node].is_violation=
false;
580 graphml[node].has_invariant=
false;
582 step_to_node[step_nr]=node;
587 for(symex_target_equationt::SSA_stepst::const_iterator
592 const std::size_t from=step_to_node[step_nr];
601 symex_target_equationt::SSA_stepst::const_iterator next=it;
602 std::size_t next_step_nr=step_nr;
603 for(++next, ++next_step_nr;
605 (step_to_node[next_step_nr]==sink || it->source.pc==next->source.pc);
606 ++next, ++next_step_nr)
610 const std::size_t to=
612 sink:step_to_node[next_step_nr];
623 {{
"source",
graphml[from].node_name},
624 {
"target",
graphml[to].node_name}},
638 (it->is_assignment() || it->is_decl()) && it->ssa_rhs.is_not_nil() &&
639 it->ssa_full_lhs.is_not_nil())
641 irep_idt identifier = it->ssa_lhs.get_object_name();
643 graphml[to].has_invariant =
true;
675 step_nr=next_step_nr;
Expression classes for byte-level operators.
const byte_extract_exprt & to_byte_extract_expr(const exprt &expr)
bitvector_typet index_type()
unsignedbv_typet size_type()
Array constructor from a list of index-element pairs Operands are index/value pairs,...
A codet representing an assignment in the program.
dstringt has one field, an unsigned integer no which is an index into a static table of strings.
Base class for all expressions.
typet & type()
Return the type of the expression.
void operator()(const goto_tracet &goto_trace)
counterexample witness
std::unordered_map< std::pair< unsigned int, const irept::dt * >, std::string, pair_hash< unsigned int, const irept::dt * > > cache
void remove_l0_l1(exprt &expr)
std::string convert_assign_rec(const irep_idt &identifier, const code_assignt &assign)
const edgest & in(node_indext n) const
nodet::node_indext node_indext
node_indext add_node(arguments &&... values)
const edgest & out(node_indext n) const
const irep_idt & id() const
const irep_idt & get(const irep_namet &name) const
Extract member of struct or union.
const exprt & struct_op() const
const typet & follow(const typet &) const
Resolve type symbol to the type it points to.
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
bool lookup(const irep_idt &name, const symbolt *&symbol) const override
See documentation for namespace_baset::lookup().
const irep_idt & get_function() const
const irep_idt & get_line() const
const irep_idt & get_file() const
static bool is_built_in(const std::string &s)
const exprt & get_original_expr() const
array_exprt to_array_expr() const
convert string into array constant
Base type for structs and unions.
const componentst & components() const
std::vector< componentt > componentst
void set_identifier(const irep_idt &identifier)
Inheriting the interface of symex_targett this class represents the SSA form of the input program as ...
const typet & subtype() const
Operator to update elements in structs and arrays.
void set_attribute(const std::string &attribute, unsigned value)
xmlt & new_element(const std::string &key)
static bool is_printable_xml(const std::string &s)
Determine whether s does not contain any characters that cannot be escaped in XML 1....
bool has_prefix(const std::string &s, const std::string &prefix)
std::string expr2c(const exprt &expr, const namespacet &ns, const expr2c_configurationt &configuration)
#define forall_operands(it, expr)
#define Forall_operands(it, expr)
static std::string expr_to_string(const namespacet &ns, const irep_idt &id, const exprt &expr)
static bool contains_symbol_prefix(const exprt &expr, const std::string &prefix)
static bool filter_out(const goto_tracet &goto_trace, const goto_tracet::stepst::const_iterator &prev_it, goto_tracet::stepst::const_iterator &it)
Witnesses for Traces and Proofs.
const std::string & id2string(const irep_idt &d)
const std::string thread_id
std::string from_expr(const namespacet &ns, const irep_idt &identifier, const exprt &expr)
const irep_idt & get_mode_from_identifier(const namespacet &ns, const irep_idt &identifier)
Get the mode of the given identifier's symbol.
Various predicates over pointers in programs.
#define SYMEX_DYNAMIC_PREFIX
const ssa_exprt & to_ssa_expr(const exprt &expr)
Cast a generic exprt to an ssa_exprt.
bool is_ssa_expr(const exprt &expr)
const symbol_exprt & to_symbol_expr(const exprt &expr)
Cast an exprt to a symbol_exprt.
const array_list_exprt & to_array_list_expr(const exprt &expr)
const multi_ary_exprt & to_multi_ary_expr(const exprt &expr)
Cast an exprt to a multi_ary_exprt.
const with_exprt & to_with_expr(const exprt &expr)
Cast an exprt to a with_exprt.
const member_exprt & to_member_expr(const exprt &expr)
Cast an exprt to a member_exprt.
const array_typet & to_array_type(const typet &type)
Cast a typet to an array_typet.
const struct_union_typet & to_struct_union_type(const typet &type)
Cast a typet to a struct_union_typet.
const string_constantt & to_string_constant(const exprt &expr)
std::string to_string(const string_not_contains_constraintt &expr)
Used for debug printing.
string_containert & get_string_container()
Get a reference to the global string container.
static expr2c_configurationt clean_configuration
This prints compilable C that loses some of the internal details of the GOTO program.
Functor to check whether iterators from different collections point at the same object.