@@ -30,9 +30,10 @@ class symex_targett;
30
30
// / Note that field sensitivity is not applied as a single pass over the
31
31
// / whole goto program but instead applied as the symbolic execution unfolds.
32
32
// /
33
- // / On a high level, field sensitivity replaces member operators with atomic
34
- // / symbols representing a field when possible. In cases where this is not
35
- // / immediately possible, like struct assignments, some things need to be added.
33
+ // / On a high level, field sensitivity replaces member operators, and array
34
+ // / accesses with atomic symbols representing a field when possible.
35
+ // / In cases where this is not immediately possible, like struct assignments,
36
+ // / some things need to be added.
36
37
// / The possible cases are described below.
37
38
// /
38
39
// / ### Member access
@@ -54,6 +55,30 @@ class symex_targett;
54
55
// / `struct_expr..field_name1 = other_struct..field_name1;`
55
56
// / `struct_expr..field_name2 = other_struct..field_name2;` etc.
56
57
// / See \ref field_sensitivityt::field_assignments.
58
+ // /
59
+ // / ### Array access
60
+ // / An index expression `array[index]` when index is constant and array has
61
+ // / constant size is replaced by the symbol `array[[index]]`; note the use
62
+ // / of `[[` and `]]` to visually distinguish the symbol from the index
63
+ // / expression.
64
+ // / When `index` is not a constant, `array[index]` is replaced by
65
+ // / `{array[[0]]; array[[1]]; …index]`.
66
+ // / Note that this process does not apply to arrays whose size is not constant,
67
+ // / and arrays whose size exceed the bound \ref max_field_sensitive_array_size.
68
+ // / See \ref field_sensitivityt::apply.
69
+ // /
70
+ // / ### Symbols representing arrays
71
+ // / In an rvalue, a symbol `array` which has array type will be replaced by
72
+ // / `{array[[0]]; array[[1]]; …}[index]`.
73
+ // / See \ref field_sensitivityt::get_fields.
74
+ // /
75
+ // / ### Assignment to an array
76
+ // / When the array symbol is on the left-hand-side, for instance for
77
+ // / an assignment `array = other_array`, the assignment is replaced by a
78
+ // / sequence of assignments:
79
+ // / `array[[0]] = other_array[[0]]`;
80
+ // / `array[[1]] = other_array[[1]]`; etc.
81
+ // / See \ref field_sensitivityt::field_assignments.
57
82
class field_sensitivityt
58
83
{
59
84
public:
0 commit comments