7
7
\section string_solver_interface String solver interface
8
8
9
9
The basic role of the solver is to answer whether the set of equations given
10
- is satisfiable. One example usage, is to determine whether an assertion in a
10
+ is satisfiable. One example usage, is to determine whether an assertion in a
11
11
program can be violated.
12
- For instance, CBMC and JBMC, convert a input program and property to check
12
+ For instance, CBMC and JBMC, convert a input program and property to check
13
13
about this program to a set of equations. These equations are fed to a solver,
14
- which is one of the last step in CBMC and JBMC, as it tells us whether the
14
+ which is one of the last step in CBMC and JBMC, as it tells us whether the
15
15
property holds or can fail.
16
16
17
- The secondary role of the solver is to provide a satisfying assignment of
17
+ The secondary role of the solver is to provide a satisfying assignment of
18
18
the variables of the equations, this can for instance be used to construct
19
19
a trace.
20
20
@@ -54,57 +54,57 @@ equation true, in that case `length2 = length3 = 1` and
54
54
55
55
\subsection general_interface General interface
56
56
57
- The common interface for solvers in CProver is inherited from
57
+ The common interface for solvers in CProver is inherited from
58
58
` decision_proceduret ` and is the common interface for all solvers.
59
59
It is essentially composed of these three functions:
60
60
61
- - ` string_refinementt::set_to(const exprt &expr, bool value) ` :
61
+ - ` string_refinementt::set_to(const exprt &expr, bool value) ` :
62
62
\copybrief string_refinementt::set_to
63
- - ` string_refinementt::dec_solve() ` :
63
+ - ` string_refinementt::dec_solve() ` :
64
64
\copybrief string_refinementt::dec_solve
65
- - ` string_refinementt::get(const exprt &expr) const ` :
65
+ - ` string_refinementt::get(const exprt &expr) const ` :
66
66
\copybrief string_refinementt::get
67
-
67
+
68
68
For each goal given to CProver:
69
- - ` set_to ` is called on several equations, roughly one for each step of the
69
+ - ` set_to ` is called on several equations, roughly one for each step of the
70
70
symbolic execution that leads to that goal;
71
71
- ` dec_solve ` is called to determine whether the goal is reachable given these
72
72
equations;
73
73
- ` get ` is called by the interpreter to obtain concrete value to build a trace
74
74
leading to the goal;
75
- - The same process can be repeated for further goals, in that case the
75
+ - The same process can be repeated for further goals, in that case the
76
76
constraints added by previous calls to ` set_to ` remain valid.
77
77
78
78
\subsection specificity Specificity of the string solver
79
79
80
- The specificity of the solver is in what kind of expressions ` set_to ` accepts
80
+ The specificity of the solver is in what kind of expressions ` set_to ` accepts
81
81
and understands. ` string_refinementt::set_to ` accepts all constraints that are
82
82
normally accepted by ` bv_refinementt ` .
83
83
84
84
` string_refinementt::set_to ` also understands constraints of the form:
85
- * ` char_pointer1 = b ? char_pointer2 : char_pointer3 ` where ` char_pointer<i> `
85
+ * ` char_pointer1 = b ? char_pointer2 : char_pointer3 ` where ` char_pointer<i> `
86
86
variables are of type pointer to characters and ` b ` is a Boolean
87
87
expression.
88
88
* ` i = cprover_primitive(args) ` where ` i ` is of signed bit vector type.
89
89
String primitives are listed in the next section.
90
90
91
- \note In the implementation, equations that are not of these forms are passed
91
+ \note In the implementation, equations that are not of these forms are passed
92
92
to an embedded ` bv_refinementt ` solver.
93
93
94
94
\subsection string-representation String representation in the solver
95
95
96
96
String primitives can have arguments which are pointers to characters.
97
- These pointers represent strings.
98
- To each of these pointers the string solver associate a char array
97
+ These pointers represent strings.
98
+ To each of these pointers the string solver associate a char array
99
99
which represents the content of the string.
100
- If the pointer is the address of an actual array in the program they should be
100
+ If the pointer is the address of an actual array in the program they should be
101
101
linked by using the primitive ` cprover_string_associate_array_to_pointer ` .
102
102
The length of the array can also be linked to a variable of the program using
103
103
` cprover_string_associate_length_to_array ` .
104
104
105
105
\warning The solver assumes the memory pointed by the arguments is immutable
106
106
which is not something that is true in general for C pointers for instance.
107
- Therefore for each transformation on a string, it is assumed the program
107
+ Therefore for each transformation on a string, it is assumed the program
108
108
allocates a new string before calling a primitive.
109
109
110
110
\section primitives String primitives
@@ -118,7 +118,7 @@ allocates a new string before calling a primitive.
118
118
* ` cprover_string_char_at ` :
119
119
\copybrief string_constraint_generatort::add_axioms_for_char_at(const function_application_exprt &f)
120
120
\link string_constraint_generatort::add_axioms_for_char_at(const function_application_exprt &f) More... \endlink
121
- * ` cprover_string_length ` :
121
+ * ` cprover_string_length ` :
122
122
\copybrief string_constraint_generatort::add_axioms_for_length(const function_application_exprt &f)
123
123
\link string_constraint_generatort::add_axioms_for_length(const function_application_exprt &f) More... \endlink
124
124
@@ -127,10 +127,10 @@ allocates a new string before calling a primitive.
127
127
* ` cprover_string_compare_to ` :
128
128
\copybrief string_constraint_generatort::add_axioms_for_compare_to(const function_application_exprt &f)
129
129
\link string_constraint_generatort::add_axioms_for_compare_to(const function_application_exprt &f) More... \endlink
130
- * ` cprover_string_contains ` :
130
+ * ` cprover_string_contains ` :
131
131
\copybrief string_constraint_generatort::add_axioms_for_contains(const function_application_exprt &f)
132
132
\link string_constraint_generatort::add_axioms_for_contains(const function_application_exprt &f) More... \endlink
133
- * ` cprover_string_equals ` :
133
+ * ` cprover_string_equals ` :
134
134
\copybrief string_constraint_generatort::add_axioms_for_equals(const function_application_exprt &f)
135
135
\link string_constraint_generatort::add_axioms_for_equals(const function_application_exprt &f) More... \endlink
136
136
* ` cprover_string_equals_ignore_case ` :
@@ -145,25 +145,25 @@ allocates a new string before calling a primitive.
145
145
* ` cprover_string_is_suffix ` :
146
146
\copybrief string_constraint_generatort::add_axioms_for_is_suffix
147
147
\link string_constraint_generatort::add_axioms_for_is_suffix More... \endlink
148
- * ` cprover_string_index_of ` :
148
+ * ` cprover_string_index_of ` :
149
149
\copybrief string_constraint_generatort::add_axioms_for_index_of(const function_application_exprt &f)
150
150
\link string_constraint_generatort::add_axioms_for_index_of(const function_application_exprt &f) More... \endlink
151
151
* ` cprover_string_last_index_of ` :
152
152
\copybrief string_constraint_generatort::add_axioms_for_last_index_of(const function_application_exprt &f)
153
153
\link string_constraint_generatort::add_axioms_for_last_index_of(const function_application_exprt &f) More... \endlink
154
154
155
- \subsection transformations Transformations:
155
+ \subsection transformations Transformations:
156
156
157
157
* ` cprover_string_char_set ` :
158
158
\copybrief string_constraint_generatort::add_axioms_for_char_set(const function_application_exprt &f)
159
159
\link string_constraint_generatort::add_axioms_for_char_set(const function_application_exprt &f) More... \endlink
160
- * ` cprover_string_concat ` :
160
+ * ` cprover_string_concat ` :
161
161
\copybrief string_constraint_generatort::add_axioms_for_concat(const function_application_exprt &f)
162
162
\link string_constraint_generatort::add_axioms_for_concat(const function_application_exprt &f) More... \endlink
163
163
* ` cprover_string_delete ` :
164
164
\copybrief string_constraint_generatort::add_axioms_for_delete(const function_application_exprt &f)
165
165
\link string_constraint_generatort::add_axioms_for_delete(const function_application_exprt &f) More... \endlink
166
- * ` cprover_string_insert ` :
166
+ * ` cprover_string_insert ` :
167
167
\copybrief string_constraint_generatort::add_axioms_for_insert(const function_application_exprt &f)
168
168
\link string_constraint_generatort::add_axioms_for_insert(const function_application_exprt &f) More... \endlink
169
169
* ` cprover_string_replace ` :
@@ -172,7 +172,7 @@ allocates a new string before calling a primitive.
172
172
* ` cprover_string_set_length ` :
173
173
\copybrief string_constraint_generatort::add_axioms_for_set_length(const function_application_exprt &f)
174
174
\link string_constraint_generatort::add_axioms_for_set_length(const function_application_exprt &f) More... \endlink
175
- * ` cprover_string_substring ` :
175
+ * ` cprover_string_substring ` :
176
176
\copybrief string_constraint_generatort::add_axioms_for_substring(const function_application_exprt &f)
177
177
\link string_constraint_generatort::add_axioms_for_substring(const function_application_exprt &f) More... \endlink
178
178
* ` cprover_string_to_lower_case ` :
@@ -212,18 +212,18 @@ allocates a new string before calling a primitive.
212
212
\subsection deprecated Deprecated primitives:
213
213
214
214
* ` cprover_string_concat_code_point ` , ` cprover_string_code_point_at ` ,
215
- ` cprover_string_code_point_before ` , ` cprover_string_code_point_count ` :
215
+ ` cprover_string_code_point_before ` , ` cprover_string_code_point_count ` :
216
216
Java specific, should be part of Java models.
217
- * ` cprover_string_offset_by_code_point ` , ` cprover_string_concat_char ` ,
218
- ` cprover_string_concat_int ` , ` cprover_string_concat_long ` ,
217
+ * ` cprover_string_offset_by_code_point ` , ` cprover_string_concat_char ` ,
218
+ ` cprover_string_concat_int ` , ` cprover_string_concat_long ` ,
219
219
` cprover_string_concat_bool ` , ` cprover_string_concat_double ` ,
220
- ` cprover_string_concat_float ` , ` cprover_string_insert_int ` ,
220
+ ` cprover_string_concat_float ` , ` cprover_string_insert_int ` ,
221
221
` cprover_string_insert_long ` , ` cprover_string_insert_bool ` ,
222
222
` cprover_string_insert_char ` , ` cprover_string_insert_double ` ,
223
- ` cprover_string_insert_float ` :
223
+ ` cprover_string_insert_float ` :
224
224
Should be done in two steps: conversion from primitive type and call
225
225
to the string primitive.
226
- * ` cprover_string_array_of_char_pointer ` , ` cprover_string_to_char_array ` :
226
+ * ` cprover_string_array_of_char_pointer ` , ` cprover_string_to_char_array ` :
227
227
Pointer to char array association
228
228
is now handled by ` string_constraint_generatort ` , there is no need for
229
229
explicit conversion.
@@ -232,15 +232,15 @@ allocates a new string before calling a primitive.
232
232
Should use ` cprover_string_length(s) == 0 ` instead.
233
233
* ` cprover_string_empty_string ` : Can use literal of empty string instead.
234
234
* ` cprover_string_of_long ` : Should be the same as ` cprover_string_of_int ` .
235
- * ` cprover_string_delete_char_at ` : A call to
236
- ` cprover_string_delete_char_at(s, i) ` would be the same thing as
235
+ * ` cprover_string_delete_char_at ` : A call to
236
+ ` cprover_string_delete_char_at(s, i) ` would be the same thing as
237
237
` cprover_string_delete(s, i, i+1) ` .
238
238
* ` cprover_string_of_bool ` :
239
239
Language dependent, should be implemented in the models.
240
240
* ` cprover_string_copy ` : Same as ` cprover_string_substring(s, 0) ` .
241
241
* ` cprover_string_of_int_hex ` : Same as ` cprover_string_of_int(s, 16) ` .
242
242
* ` cprover_string_of_double ` : Same as ` cprover_string_of_float ` .
243
-
243
+
244
244
\section algorithm Decision algorithm
245
245
246
246
\copydetails string_refinementt::dec_solve
@@ -249,9 +249,9 @@ allocates a new string before calling a primitive.
249
249
250
250
This is done by generate_instantiations(messaget::mstreamt &stream, const namespacet &ns, const string_constraint_generatort &generator, const index_set_pairt &index_set, const string_axiomst &axioms).
251
251
\copydetails generate_instantiations(messaget::mstreamt &stream, const namespacet &ns, const string_constraint_generatort &generator, const index_set_pairt &index_set, const string_axiomst &axioms)
252
-
252
+
253
253
\subsection axiom-check Axiom check
254
254
255
255
\copydetails check_axioms(const string_axiomst &axioms, string_constraint_generatort &generator, const std::function<exprt(const exprt &)> &get, messaget::mstreamt &stream, const namespacet &ns, std::size_t max_string_length, bool use_counter_example, ui_message_handlert::uit ui, const union_find_replacet &symbol_resolve)
256
- \link check_axioms(const string_axiomst &axioms, string_constraint_generatort &generator, const std::function<exprt(const exprt &)> &get, messaget::mstreamt &stream, const namespacet &ns, std::size_t max_string_length, bool use_counter_example, ui_message_handlert::uit ui, const union_find_replacet &symbol_resolve)
256
+ \link check_axioms(const string_axiomst &axioms, string_constraint_generatort &generator, const std::function<exprt(const exprt &)> &get, messaget::mstreamt &stream, const namespacet &ns, std::size_t max_string_length, bool use_counter_example, ui_message_handlert::uit ui, const union_find_replacet &symbol_resolve)
257
257
(See function documentation...) \endlink
0 commit comments