CBMC
interval_analysis.cpp
Go to the documentation of this file.
1 /*******************************************************************\
2 
3 Module: Interval Analysis
4 
5 Author: Daniel Kroening, kroening@kroening.com
6 
7 \*******************************************************************/
8 
13 
14 #include "interval_analysis.h"
15 
16 #include <util/find_symbols.h>
17 
18 #include "ai.h"
19 #include "interval_domain.h"
20 
32  goto_functionst::goto_functiont &goto_function)
33 {
34  std::set<symbol_exprt> symbols;
35 
36  for(const auto &i : goto_function.body.instructions)
37  i.apply([&symbols](const exprt &e) { find_symbols(e, symbols); });
38 
39  Forall_goto_program_instructions(i_it, goto_function.body)
40  {
41  if(i_it==goto_function.body.instructions.begin())
42  {
43  // first instruction, we instrument
44  }
45  else
46  {
47  goto_programt::const_targett previous = std::prev(i_it);
48 
49  if(previous->is_goto() && !previous->condition().is_true())
50  {
51  // we follow a branch, instrument
52  }
53  else if(previous->is_function_call())
54  {
55  // we follow a function call, instrument
56  }
57  else if(i_it->is_target() || i_it->is_function_call())
58  {
59  // we are a target or a function call, instrument
60  }
61  else
62  continue; // don't instrument
63  }
64 
65  const interval_domaint &d=interval_analysis[i_it];
66 
67  exprt::operandst assertion;
68 
69  for(const auto &symbol_expr : symbols)
70  {
71  exprt tmp=d.make_expression(symbol_expr);
72  if(!tmp.is_true())
73  assertion.push_back(tmp);
74  }
75 
76  if(!assertion.empty())
77  {
79  goto_function.body.insert_before_swap(i_it);
80  i_it++; // goes to original instruction
82  conjunction(assertion), i_it->source_location());
83  }
84  }
85 }
86 
90 void interval_analysis(goto_modelt &goto_model)
91 {
93 
94  const namespacet ns(goto_model.symbol_table);
95  interval_analysis(goto_model.goto_functions, ns);
96 
97  for(auto &gf_entry : goto_model.goto_functions.function_map)
98  instrument_intervals(interval_analysis, gf_entry.second);
99 }
Abstract Interpretation.
ait supplies three of the four components needed: an abstract interpreter (in this case handling func...
Definition: ai.h:562
Base class for all expressions.
Definition: expr.h:56
std::vector< exprt > operandst
Definition: expr.h:58
bool is_true() const
Return whether the expression is a constant representing true.
Definition: expr.cpp:27
const source_locationt & source_location() const
Definition: expr.h:231
function_mapt function_map
::goto_functiont goto_functiont
symbol_tablet symbol_table
Symbol table.
Definition: goto_model.h:31
goto_functionst goto_functions
GOTO functions.
Definition: goto_model.h:34
static instructiont make_assumption(const exprt &g, const source_locationt &l=source_locationt::nil())
Definition: goto_program.h:945
instructionst::iterator targett
Definition: goto_program.h:614
instructionst::const_iterator const_targett
Definition: goto_program.h:615
exprt make_expression(const symbol_exprt &) const
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
Definition: namespace.h:94
static bool find_symbols(symbol_kindt, const typet &, std::function< bool(const symbol_exprt &)>, std::unordered_set< irep_idt > &bindings)
#define Forall_goto_program_instructions(it, program)
void interval_analysis(goto_modelt &goto_model)
Initialises the abstract interpretation over interval domain and instruments instructions using inter...
void instrument_intervals(const ait< interval_domaint > &interval_analysis, goto_functionst::goto_functiont &goto_function)
Instruments all "post-branch" instructions with assumptions about variable intervals.
Interval Analysis.
Interval Domain.
exprt conjunction(const exprt::operandst &op)
1) generates a conjunction for two or more operands 2) for one operand, returns the operand 3) return...
Definition: std_expr.cpp:66