Skip to content

Commit 28995bd

Browse files
Document how array are handled by field sensitivity
This explains how field sensitivity transforms instructions that contain array operations.
1 parent 85a1e8f commit 28995bd

File tree

1 file changed

+28
-3
lines changed

1 file changed

+28
-3
lines changed

src/goto-symex/field_sensitivity.h

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,10 @@ class symex_targett;
3030
/// Note that field sensitivity is not applied as a single pass over the
3131
/// whole goto program but instead applied as the symbolic execution unfolds.
3232
///
33-
/// On a high level, field sensitivity replaces member operators with atomic
34-
/// symbols representing a field when possible. In cases where this is not
35-
/// immediately possible, like struct assignments, some things need to be added.
33+
/// On a high level, field sensitivity replaces member operators, and array
34+
/// accesses with atomic symbols representing a field when possible.
35+
/// In cases where this is not immediately possible, like struct assignments,
36+
/// some things need to be added.
3637
/// The possible cases are described below.
3738
///
3839
/// ### Member access
@@ -54,6 +55,30 @@ class symex_targett;
5455
/// `struct_expr..field_name1 = other_struct..field_name1;`
5556
/// `struct_expr..field_name2 = other_struct..field_name2;` etc.
5657
/// See \ref field_sensitivityt::field_assignments.
58+
///
59+
/// ### Array access
60+
/// An index expression `array[index]` when index is constant and array has
61+
/// constant size is replaced by the symbol `array[[index]]`; note the use
62+
/// of `[[` and `]]` to visually distinguish the symbol from the index
63+
/// expression.
64+
/// When `index` is not a constant, `array[index]` is replaced by
65+
/// `{array[[0]]; array[[1]]; …index]`.
66+
/// Note that this process does not apply to arrays whose size is not constant,
67+
/// and arrays whose size exceed the bound \ref max_field_sensitive_array_size.
68+
/// See \ref field_sensitivityt::apply.
69+
///
70+
/// ### Symbols representing arrays
71+
/// In an rvalue, a symbol `array` which has array type will be replaced by
72+
/// `{array[[0]]; array[[1]]; …}[index]`.
73+
/// See \ref field_sensitivityt::get_fields.
74+
///
75+
/// ### Assignment to an array
76+
/// When the array symbol is on the left-hand-side, for instance for
77+
/// an assignment `array = other_array`, the assignment is replaced by a
78+
/// sequence of assignments:
79+
/// `array[[0]] = other_array[[0]]`;
80+
/// `array[[1]] = other_array[[1]]`; etc.
81+
/// See \ref field_sensitivityt::field_assignments.
5782
class field_sensitivityt
5883
{
5984
public:

0 commit comments

Comments
 (0)