CBMC
object_tracking.cpp
Go to the documentation of this file.
1 // Author: Diffblue Ltd.
2 
3 #include "object_tracking.h"
4 
5 #include <util/arith_tools.h>
6 #include <util/c_types.h>
8 #include <util/std_code.h>
9 #include <util/std_expr.h>
10 #include <util/string_constant.h>
11 
13 {
14  return constant_exprt(ID_invalid, pointer_type(void_type()));
15 }
16 
18 {
19  auto current = std::ref(address_of.object());
20  while(
21  !(can_cast_expr<symbol_exprt>(current) ||
25  {
26  if(const auto index = expr_try_dynamic_cast<index_exprt>(current.get()))
27  {
28  // For the case `my_array[bar]` the base expression is `my_array`.
29  current = index->array();
30  continue;
31  }
32  if(const auto member = expr_try_dynamic_cast<member_exprt>(current.get()))
33  {
34  // For the case `my_struct.field_name` the base expression is `my_struct`.
35  current = member->compound();
36  continue;
37  }
38  INVARIANT(
39  false,
40  "Unable to find base object of expression: " +
41  current.get().pretty(1, 0));
42  }
43  return current.get();
44 }
45 
47 {
49  null_object.unique_id = 0;
51  null_object.size = from_integer(0, size_type());
52  return null_object;
53 }
54 
56 {
57  decision_procedure_objectt invalid_pointer_object;
58  // Using unique_id = 1, so 0 is the NULL object, 1 is the invalid object and
59  // other valid objects have unique_id > 1.
60  invalid_pointer_object.unique_id = 1;
61  invalid_pointer_object.base_expression = make_invalid_pointer_expr();
62  invalid_pointer_object.size = from_integer(0, size_type());
63  return invalid_pointer_object;
64 }
65 
67 {
68  smt_object_mapt object_map;
70  exprt null_object_base = null_object.base_expression;
71  object_map.emplace(std::move(null_object_base), std::move(null_object));
72  decision_procedure_objectt invalid_pointer_object =
74  exprt invalid_pointer_object_base = invalid_pointer_object.base_expression;
75  object_map.emplace(
76  std::move(invalid_pointer_object_base), std::move(invalid_pointer_object));
77  return object_map;
78 }
79 
81  const exprt &expression,
82  const namespacet &ns,
83  smt_object_mapt &object_map)
84 {
86  expression, [&](const exprt &object_base) -> void {
87  const auto find_result = object_map.find(object_base);
88  if(find_result != object_map.cend())
89  return;
90  const auto size = size_of_expr(object_base.type(), ns);
91  INVARIANT(size, "Objects are expected to have well defined size");
93  object.base_expression = object_base;
94  object.unique_id = object_map.size();
95  object.size = *size;
96  object_map.emplace_hint(find_result, object_base, std::move(object));
97  });
98 }
99 
101  const exprt &expression,
102  const smt_object_mapt &object_map)
103 {
104  bool all_objects_tracked = true;
106  expression, [&](const exprt &object_base) -> void {
107  const auto find_result = object_map.find(object_base);
108  if(find_result != object_map.cend())
109  return;
110  all_objects_tracked = false;
111  });
112  return all_objects_tracked;
113 }
pointer_offset_size.h
can_cast_expr< symbol_exprt >
bool can_cast_expr< symbol_exprt >(const exprt &base)
Definition: std_expr.h:206
can_cast_expr< string_constantt >
bool can_cast_expr< string_constantt >(const exprt &base)
Definition: string_constant.h:30
make_null_object
static decision_procedure_objectt make_null_object()
Definition: object_tracking.cpp:46
arith_tools.h
track_expression_objects
void track_expression_objects(const exprt &expression, const namespacet &ns, smt_object_mapt &object_map)
Finds all the object expressions in the given expression and adds them to the object map for cases wh...
Definition: object_tracking.cpp:80
address_of_exprt::object
exprt & object()
Definition: pointer_expr.h:380
decision_procedure_objectt
Information the decision procedure holds about each object.
Definition: object_tracking.h:40
object_tracking.h
irept::find
const irept & find(const irep_idt &name) const
Definition: irep.cpp:106
make_invalid_pointer_object
static decision_procedure_objectt make_invalid_pointer_object()
Definition: object_tracking.cpp:55
string_constant.h
exprt
Base class for all expressions.
Definition: expr.h:55
void_type
empty_typet void_type()
Definition: c_types.cpp:263
namespacet
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
Definition: namespace.h:90
exprt::type
typet & type()
Return the type of the expression.
Definition: expr.h:84
can_cast_expr< code_labelt >
bool can_cast_expr< code_labelt >(const exprt &base)
Definition: std_code.h:994
null_pointer_exprt
The null pointer constant.
Definition: pointer_expr.h:734
pointer_type
pointer_typet pointer_type(const typet &subtype)
Definition: c_types.cpp:253
find_object_base_expression
exprt find_object_base_expression(const address_of_exprt &address_of)
The model of addresses we use consists of a unique object identifier and an offset.
Definition: object_tracking.cpp:17
std_code.h
objects_are_already_tracked
bool objects_are_already_tracked(const exprt &expression, const smt_object_mapt &object_map)
Finds whether all base object expressions in the given expression are already tracked in the given ob...
Definition: object_tracking.cpp:100
null_object
exprt null_object(const exprt &pointer)
Definition: pointer_predicates.cpp:87
decision_procedure_objectt::base_expression
exprt base_expression
The expression for the root of the object.
Definition: object_tracking.h:44
decision_procedure_objectt::unique_id
std::size_t unique_id
Number which uniquely identifies this particular object.
Definition: object_tracking.h:46
from_integer
constant_exprt from_integer(const mp_integer &int_value, const typet &type)
Definition: arith_tools.cpp:100
smt_object_mapt
std::unordered_map< exprt, decision_procedure_objectt, irep_hash > smt_object_mapt
Mapping from an object's base expression to the set of information about it which we track.
Definition: object_tracking.h:89
size_of_expr
optionalt< exprt > size_of_expr(const typet &type, const namespacet &ns)
Definition: pointer_offset_size.cpp:280
make_invalid_pointer_expr
exprt make_invalid_pointer_expr()
Create the invalid pointer constant.
Definition: object_tracking.cpp:12
can_cast_expr< constant_exprt >
bool can_cast_expr< constant_exprt >(const exprt &base)
Definition: std_expr.h:2976
decision_procedure_objectt::size
exprt size
Expression which evaluates to the size of the object in bytes.
Definition: object_tracking.h:48
address_of_exprt
Operator to return the address of an object.
Definition: pointer_expr.h:370
size_type
unsignedbv_typet size_type()
Definition: c_types.cpp:68
constant_exprt
A constant literal expression.
Definition: std_expr.h:2941
std_expr.h
find_object_base_expressions
void find_object_base_expressions(const exprt &expression, const output_object_functiont &output_object)
Arbitary expressions passed to the decision procedure may have multiple address of operations as its ...
Definition: object_tracking.h:74
c_types.h
initial_smt_object_map
smt_object_mapt initial_smt_object_map()
Constructs an initial object map containing the null object.
Definition: object_tracking.cpp:66
validation_modet::INVARIANT
@ INVARIANT