44 if(expr.
id()==ID_symbol)
50 std::string identifier=
53 std::string::size_type l0_l1=identifier.find_first_of(
"!@");
54 if(l0_l1!=std::string::npos)
56 identifier.resize(l0_l1);
63 else if(expr.
id() == ID_string_constant)
84 if(cit !=
cache.end())
89 if(assign.
rhs().
id() == ID_array_list)
92 const auto &ops = array_list.
operands();
94 for(std::size_t listidx = 0; listidx != ops.size(); listidx += 2)
103 else if(assign.
rhs().
id() == ID_array)
117 else if(assign.
rhs().
id()==ID_struct ||
118 assign.
rhs().
id()==ID_union)
123 assign.
lhs().
id() == ID_member &&
131 else if(assign.
lhs().
id()==ID_byte_extract_little_endian ||
132 assign.
lhs().
id()==ID_byte_extract_big_endian)
145 exprt::operandst::const_iterator it=
147 for(
const auto &comp : components)
150 comp.type().id() != ID_code,
"struct member must not be of code type");
152 comp.get_is_padding() ||
158 it != assign.
rhs().
operands().end(),
"expression must have operands");
170 if(assign.
rhs().
id()==ID_union)
174 else if(assign.
rhs().
id() == ID_with)
177 const auto &ops = with_expr.
operands();
179 for(std::size_t i = 1; i < ops.size(); i += 2)
184 if(ops[i].
id() == ID_member_name)
187 assign.
lhs(), ops[i].
get(ID_component_name), ops[i + 1].type()};
209 lhs.find(
"#return_value") != std::string::npos ||
210 (lhs.find(
'$') != std::string::npos &&
211 has_prefix(lhs,
"return_value___VERIFIER_nondet_")))
230 const goto_tracet::stepst::const_iterator &prev_it,
231 goto_tracet::stepst::const_iterator &it)
235 (!it->pc->is_assign() || it->pc->assign_rhs().id() != ID_side_effect ||
236 it->pc->assign_rhs().get(ID_statement) != ID_nondet))
239 if(!it->is_assignment() && !it->is_goto() && !it->is_assert())
246 prev_it != goto_trace.
steps.end() &&
247 prev_it->pc->source_location() == it->pc->source_location())
250 if(it->is_goto() && it->pc->condition().is_true())
255 if(source_location.
is_nil() ||
274 expr.
id() == ID_symbol &&
280 for(
const auto &op : expr.
operands())
291 unsigned int max_thread_idx = 0;
292 bool trace_has_violation =
false;
293 for(goto_tracet::stepst::const_iterator it = goto_trace.
steps.begin();
294 it != goto_trace.
steps.end();
297 if(it->thread_nr > max_thread_idx)
298 max_thread_idx = it->thread_nr;
299 if(it->is_assert() && !it->cond_value)
300 trace_has_violation =
true;
306 graphml[sink].node_name=
"sink";
307 graphml[sink].is_violation=
false;
308 graphml[sink].has_invariant=
false;
310 if(max_thread_idx > 0 && trace_has_violation)
312 std::vector<graphmlt::node_indext> nodes;
314 for(
unsigned int i = 0; i <= max_thread_idx + 1; ++i)
317 graphml[nodes.back()].node_name =
"N" + std::to_string(i);
318 graphml[nodes.back()].is_violation = i == max_thread_idx + 1;
319 graphml[nodes.back()].has_invariant =
false;
322 for(
auto it = nodes.cbegin(); std::next(it) != nodes.cend(); ++it)
327 const auto thread_id = std::distance(nodes.cbegin(), it);
329 data.set_attribute(
"key",
"createThread");
334 data.set_attribute(
"key",
"enterFunction");
337 graphml[*std::next(it)].
in[*it].xml_node = edge;
338 graphml[*it].
out[*std::next(it)].xml_node = edge;
347 std::vector<std::size_t> step_to_node(goto_trace.
steps.size()+1, 0);
349 goto_tracet::stepst::const_iterator prev_it=goto_trace.
steps.end();
350 for(goto_tracet::stepst::const_iterator
351 it=goto_trace.
steps.begin();
352 it!=goto_trace.
steps.end();
357 step_to_node[it->step_nr]=sink;
363 goto_tracet::stepst::const_iterator next=it;
366 next != goto_trace.
steps.end() &&
368 it->full_lhs == next->full_lhs &&
369 it->pc->source_location() == next->pc->source_location())
371 step_to_node[it->step_nr]=sink;
382 std::to_string(it->pc->location_number)+
"."+std::to_string(it->step_nr);
387 graphml[node].has_invariant=
false;
389 step_to_node[it->step_nr]=node;
395 for(goto_tracet::stepst::const_iterator
396 it=goto_trace.
steps.begin();
397 it!=goto_trace.
steps.end();
400 const std::size_t from=step_to_node[it->step_nr];
403 if(from == sink ||
graphml[from].is_violation)
409 auto next = std::next(it);
410 for(; next != goto_trace.
steps.end() &&
411 (step_to_node[next->step_nr] == sink ||
417 const std::size_t to=
418 next==goto_trace.
steps.end()?
419 sink:step_to_node[next->step_nr];
430 {{
"source",
graphml[from].node_name},
431 {
"target",
graphml[to].node_name}},
445 data_t.
data = std::to_string(it->thread_nr);
448 const auto lhs_object = it->get_lhs_object();
451 lhs_object.has_value())
453 const std::string &lhs_id =
id2string(lhs_object->get_identifier());
454 if(lhs_id.find(
"pthread_create::thread") != std::string::npos)
465 lhs_id.find(
"thread") == std::string::npos &&
466 lhs_id.find(
"mutex") == std::string::npos &&
467 (!it->full_lhs_value.is_constant() ||
468 !it->full_lhs_value.has_operands() ||
480 if(!it->function_id.empty())
484 irep_idt function_id = it->function_id;
485 const symbolt *symbol_ptr =
nullptr;
488 function_id = lhs_id.substr(0, lhs_id.find(
"::"));
540 graphml[sink].node_name=
"sink";
541 graphml[sink].is_violation=
false;
542 graphml[sink].has_invariant=
false;
545 std::vector<std::size_t> step_to_node(equation.
SSA_steps.size()+1, 0);
547 std::size_t step_nr=1;
548 for(symex_target_equationt::SSA_stepst::const_iterator
557 (!it->is_assignment() && !it->is_goto() && !it->is_assert()) ||
558 (it->is_goto() && it->source.pc->condition().is_true()) ||
562 step_to_node[step_nr]=sink;
568 symex_target_equationt::SSA_stepst::const_iterator next=it;
571 next != equation.
SSA_steps.end() && next->is_assignment() &&
572 it->ssa_full_lhs == next->ssa_full_lhs &&
573 it->source.pc->source_location() == next->source.pc->source_location())
575 step_to_node[step_nr]=sink;
582 std::to_string(it->source.pc->location_number)+
"."+
583 std::to_string(step_nr);
586 graphml[node].is_violation=
false;
587 graphml[node].has_invariant=
false;
589 step_to_node[step_nr]=node;
594 for(symex_target_equationt::SSA_stepst::const_iterator
599 const std::size_t from=step_to_node[step_nr];
608 symex_target_equationt::SSA_stepst::const_iterator next=it;
609 std::size_t next_step_nr=step_nr;
610 for(++next, ++next_step_nr;
612 (step_to_node[next_step_nr]==sink || it->source.pc==next->source.pc);
613 ++next, ++next_step_nr)
617 const std::size_t to=
619 sink:step_to_node[next_step_nr];
630 {{
"source",
graphml[from].node_name},
631 {
"target",
graphml[to].node_name}},
645 (it->is_assignment() || it->is_decl()) && it->ssa_rhs.is_not_nil() &&
646 it->ssa_full_lhs.is_not_nil())
648 irep_idt identifier = it->ssa_lhs.get_object_name();
650 graphml[to].has_invariant =
true;
682 step_nr=next_step_nr;
Expression classes for byte-level operators.
const byte_extract_exprt & to_byte_extract_expr(const exprt &expr)
bitvector_typet c_index_type()
Array constructor from a list of index-element pairs Operands are index/value pairs,...
const typet & element_type() const
The type of the elements of the array.
A goto_instruction_codet representing an assignment in the program.
dstringt has one field, an unsigned integer no which is an index into a static table of strings.
Base class for all expressions.
typet & type()
Return the type of the expression.
void operator()(const goto_tracet &goto_trace)
counterexample witness
std::unordered_map< std::pair< unsigned int, const irept::dt * >, std::string, pair_hash< unsigned int, const irept::dt * > > cache
void remove_l0_l1(exprt &expr)
std::string convert_assign_rec(const irep_idt &identifier, const code_assignt &assign)
nodet::node_indext node_indext
const edgest & out(node_indext n) const
node_indext add_node(arguments &&... values)
const edgest & in(node_indext n) const
const irep_idt & get(const irep_idt &name) const
const irep_idt & id() const
Extract member of struct or union.
const exprt & struct_op() const
const typet & follow(const typet &) const
Resolve type symbol to the type it points to.
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
bool lookup(const irep_idt &name, const symbolt *&symbol) const override
See documentation for namespace_baset::lookup().
const irep_idt & get_function() const
const irep_idt & get_file() const
const irep_idt & get_line() const
static bool is_built_in(const std::string &s)
const exprt & get_original_expr() const
array_exprt to_array_expr() const
convert string into array constant
Base type for structs and unions.
const componentst & components() const
std::vector< componentt > componentst
void set_identifier(const irep_idt &identifier)
Inheriting the interface of symex_targett this class represents the SSA form of the input program as ...
Operator to update elements in structs and arrays.
xmlt & new_element(const std::string &key)
void set_attribute(const std::string &attribute, unsigned value)
static bool is_printable_xml(const std::string &s)
Determine whether s does not contain any characters that cannot be escaped in XML 1....
bool has_prefix(const std::string &s, const std::string &prefix)
std::string expr2c(const exprt &expr, const namespacet &ns, const expr2c_configurationt &configuration)
#define Forall_operands(it, expr)
static std::string expr_to_string(const namespacet &ns, const irep_idt &id, const exprt &expr)
static bool contains_symbol_prefix(const exprt &expr, const std::string &prefix)
static bool filter_out(const goto_tracet &goto_trace, const goto_tracet::stepst::const_iterator &prev_it, goto_tracet::stepst::const_iterator &it)
Witnesses for Traces and Proofs.
const std::string & id2string(const irep_idt &d)
const std::string thread_id
std::string from_expr(const namespacet &ns, const irep_idt &identifier, const exprt &expr)
const irep_idt & get_mode_from_identifier(const namespacet &ns, const irep_idt &identifier)
Get the mode of the given identifier's symbol.
Various predicates over pointers in programs.
#define SYMEX_DYNAMIC_PREFIX
#define DATA_INVARIANT(CONDITION, REASON)
This condition should be used to document that assumptions that are made on goto_functions,...
#define INVARIANT(CONDITION, REASON)
This macro uses the wrapper function 'invariant_violated_string'.
bool is_ssa_expr(const exprt &expr)
const ssa_exprt & to_ssa_expr(const exprt &expr)
Cast a generic exprt to an ssa_exprt.
const array_list_exprt & to_array_list_expr(const exprt &expr)
const multi_ary_exprt & to_multi_ary_expr(const exprt &expr)
Cast an exprt to a multi_ary_exprt.
const member_exprt & to_member_expr(const exprt &expr)
Cast an exprt to a member_exprt.
const symbol_exprt & to_symbol_expr(const exprt &expr)
Cast an exprt to a symbol_exprt.
const with_exprt & to_with_expr(const exprt &expr)
Cast an exprt to a with_exprt.
const array_typet & to_array_type(const typet &type)
Cast a typet to an array_typet.
const struct_union_typet & to_struct_union_type(const typet &type)
Cast a typet to a struct_union_typet.
const string_constantt & to_string_constant(const exprt &expr)
string_containert & get_string_container()
Get a reference to the global string container.
static expr2c_configurationt clean_configuration
This prints compilable C that loses some of the internal details of the GOTO program.
Functor to check whether iterators from different collections point at the same object.
Generate Equation using Symbolic Execution.