Skip to content

Commit a4464fb

Browse files
author
Enrico Steffinlongo
committed
Addressed some PR reviews comment
1 parent 2c5fa86 commit a4464fb

File tree

1 file changed

+15
-11
lines changed

1 file changed

+15
-11
lines changed

doc/architectural/symex-instructions.md

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,14 @@ central CBMC module, the *symbolic execution engine* (from now on, just *symex*)
1919

2020
## A (very) short introduction to Symex
2121

22-
Symex is, at its core, a GOTO-program interpreter. While Symex is interpreting
23-
the program, it's also building a list of SSA steps that form part of the equation
24-
that is to be sent to the solver.
22+
Symex is, at its core, a GOTO-program interpreter that uses symbolic values instead of actual ones.
23+
This produces a formula which describes all possible outputs rather than a single output value.
24+
While Symex is interpreting the program, it also builds a list of Static Single Assignment (SSA)
25+
steps that form part of the equation that is to be sent to the solver. For more information see
26+
[src/goto-symex](../../src/goto-symex/README.md).
2527

2628
You can see the main instruction dispatcher (what corresponds to the main interpreter
27-
loop) at goto_symext::execute_next_instruction.
29+
loop) at `goto_symext::execute_next_instruction`.
2830

2931
Symex's source code is available under [src/goto-symex](../../src/goto-symex/).
3032

@@ -37,15 +39,17 @@ purposes:
3739
```c
3840
enum goto_program_instruction_typet
3941
{
42+
[...]
4043
GOTO = 1, // branch, possibly guarded
41-
ASSUME = 2, // non-failing guarded self loop
44+
ASSUME = 2, // assumption
4245
ASSERT = 3, // assertions
4346
SKIP = 5, // just advance the PC
4447
SET_RETURN_VALUE = 12, // set function return value (no control-flow change)
4548
ASSIGN = 13, // assignment lhs:=rhs
4649
DECL = 14, // declare a local variable
4750
DEAD = 15, // marks the end-of-live of a local variable
4851
FUNCTION_CALL = 16, // call a function
52+
[...]
4953
};
5054
```
5155

@@ -60,8 +64,8 @@ consider the following C file:
6064
```c
6165
int main(int argc, char **argv)
6266
{
63-
int arry[] = {0, 1, 2, 3};
64-
__CPROVER_assert(arry[3] != 3, "expected failure: last arry element is equal to 3");
67+
int a[] = {0, 1, 2, 3};
68+
__CPROVER_assert(a[3] != 3, "expected failure: last element of array 'a' is equal to 3");
6569
}
6670
```
6771
@@ -92,10 +96,10 @@ correspondent instruction types (`DECL`, `ASSIGN`, etc).
9296
---
9397

9498
Symex (as mentioned above) is going to pick a designated entry point and then start going through
95-
each instruction. This happens at goto_symext::execute_next_instruction. While doing so, it will
96-
inspect the instruction's type, and then dispatch to a designated handling function (which usually go
97-
by the name `symex_<instruction-type>`) to handle that particular instruction type and its symbolic
98-
execution. In pseudocode, it looks like this:
99+
each instruction. This happens at `goto_symext::execute_next_instruction`. While doing so, it will
100+
inspect the instruction's type, and then dispatch to a designated handling function (which usually
101+
go by the name `symex_<instruction-type>`) to handle that particular instruction type and its
102+
symbolic execution. In pseudocode, it looks like this:
99103

100104
```c
101105
switch(instruction.type())

0 commit comments

Comments
 (0)