Skip to content

Commit 6219cf2

Browse files
Simplify single-path symex checker
Instead of handling the first symex run differently: Push initial state into the worklist, then iterate symex until done.
1 parent 6e66834 commit 6219cf2

File tree

3 files changed

+46
-88
lines changed

3 files changed

+46
-88
lines changed

src/goto-checker/single_path_symex_checker.cpp

Lines changed: 28 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -30,44 +30,10 @@ operator()(propertiest &properties)
3030
{
3131
resultt result(resultt::progresst::DONE);
3232

33-
// Unfortunately, the initial symex run is currently handled differently
34-
// from the subsequent runs
35-
if(!initial_symex_has_run)
36-
{
37-
initial_symex_has_run = true;
38-
first_equation = symex_target_equationt();
39-
symex_bmct symex(
40-
ui_message_handler,
41-
goto_model.get_symbol_table(),
42-
first_equation.value(),
43-
options,
44-
*worklist);
45-
46-
setup_symex(symex);
47-
perform_symex(
48-
goto_model,
49-
symex,
50-
symex_symbol_table,
51-
first_equation.value(),
52-
options,
53-
ns,
54-
ui_message_handler);
55-
56-
output_coverage_report(
57-
options.get_option("symex-coverage-report"),
58-
goto_model,
59-
symex,
60-
ui_message_handler);
61-
62-
if(symex.get_remaining_vccs() > 0)
63-
{
64-
prepare(result, properties, first_equation.value());
65-
decide(result, properties);
66-
67-
if(result.progress == resultt::progresst::FOUND_FAIL)
68-
return result;
69-
}
70-
}
33+
auto get_goto_function =
34+
[this](const irep_idt &id) -> const goto_functionst::goto_functiont & {
35+
return goto_model.get_goto_function(id);
36+
};
7137

7238
// There might be more solutions from the previous equation.
7339
if(property_decider)
@@ -77,24 +43,28 @@ operator()(propertiest &properties)
7743
return result;
7844
}
7945

80-
if(first_equation.has_value())
46+
if(!worklist->empty())
8147
{
82-
// We are in the second iteration. We don't need the equation
83-
// from the first iteration anymore.
84-
first_equation = {};
48+
// We pop the item processed in the previous iteration.
49+
worklist->pop();
8550
}
86-
else
51+
52+
if(!symex_initialized)
8753
{
88-
if(!worklist->empty())
89-
{
90-
// We are in iteration 3 or later; we pop the item processed
91-
// in the previous iteration.
92-
worklist->pop();
93-
}
94-
else
95-
{
96-
// We are already done.
97-
}
54+
symex_initialized = true;
55+
56+
// Put initial state into the work list
57+
symex_target_equationt equation;
58+
symex_bmct symex(
59+
ui_message_handler,
60+
goto_model.get_symbol_table(),
61+
equation,
62+
options,
63+
*worklist);
64+
setup_symex(symex);
65+
66+
symex.initialize_path_storage_from_entry_point_of(
67+
get_goto_function, symex_symbol_table);
9868
}
9969

10070
while(!worklist->empty())
@@ -106,16 +76,12 @@ operator()(propertiest &properties)
10676
resume.equation,
10777
options,
10878
*worklist);
109-
11079
setup_symex(symex);
111-
perform_symex(
112-
goto_model,
113-
symex,
114-
resume,
115-
symex_symbol_table,
116-
options,
117-
ns,
118-
ui_message_handler);
80+
81+
symex.resume_symex_from_saved_state(
82+
get_goto_function, resume.state, &resume.equation, symex_symbol_table);
83+
postprocess_equation(
84+
symex, resume.equation, options, ns, ui_message_handler);
11985

12086
output_coverage_report(
12187
options.get_option("symex-coverage-report"),

src/goto-checker/single_path_symex_checker.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,7 @@ class single_path_symex_checkert : public single_path_symex_only_checkert,
4343
virtual ~single_path_symex_checkert() = default;
4444

4545
protected:
46-
bool initial_symex_has_run = false;
47-
optionalt<symex_target_equationt> first_equation; // for building traces
46+
bool symex_initialized = false;
4847
std::unique_ptr<goto_symex_property_decidert> property_decider;
4948

5049
void prepare(

src/goto-checker/single_path_symex_only_checker.cpp

Lines changed: 17 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -37,29 +37,24 @@ operator()(propertiest &properties)
3737
{
3838
resultt result(resultt::progresst::DONE);
3939

40-
// First run goto-symex from entry point to initialize worklist
40+
auto get_goto_function =
41+
[this](const irep_idt &id) -> const goto_functionst::goto_functiont & {
42+
return goto_model.get_goto_function(id);
43+
};
44+
4145
{
42-
symex_target_equationt first_equation;
46+
// Put initial state into the work list
47+
symex_target_equationt equation;
4348
symex_bmct symex(
4449
ui_message_handler,
4550
goto_model.get_symbol_table(),
46-
first_equation,
51+
equation,
4752
options,
4853
*worklist);
49-
5054
setup_symex(symex);
51-
perform_symex(
52-
goto_model,
53-
symex,
54-
symex_symbol_table,
55-
first_equation,
56-
options,
57-
ns,
58-
ui_message_handler);
5955

60-
equation_output(symex, first_equation);
61-
update_properties_status_from_symex_target_equation(
62-
properties, result.updated_properties, first_equation);
56+
symex.initialize_path_storage_from_entry_point_of(
57+
get_goto_function, symex_symbol_table);
6358
}
6459

6560
while(!worklist->empty())
@@ -71,17 +66,15 @@ operator()(propertiest &properties)
7166
resume.equation,
7267
options,
7368
*worklist);
74-
7569
setup_symex(symex);
76-
perform_symex(
77-
goto_model,
78-
symex,
79-
resume,
80-
symex_symbol_table,
81-
options,
82-
ns,
83-
ui_message_handler);
70+
71+
symex.resume_symex_from_saved_state(
72+
get_goto_function, resume.state, &resume.equation, symex_symbol_table);
73+
postprocess_equation(
74+
symex, resume.equation, options, ns, ui_message_handler);
75+
8476
equation_output(symex, resume.equation);
77+
8578
update_properties_status_from_symex_target_equation(
8679
properties, result.updated_properties, resume.equation);
8780

0 commit comments

Comments
 (0)