@@ -19,12 +19,14 @@ central CBMC module, the *symbolic execution engine* (from now on, just *symex*)
19
19
20
20
## A (very) short introduction to Symex
21
21
22
- Symex is, at its core, a GOTO-program interpreter. While Symex is interpreting
23
- the program, it's also building a list of SSA steps that form part of the equation
24
- that is to be sent to the solver.
22
+ Symex is, at its core, a GOTO-program interpreter that uses symbolic values instead of actual ones.
23
+ This produces a formula which describes all possible outputs rather than a single output value.
24
+ While Symex is interpreting the program, it also builds a list of Static Single Assignment (SSA)
25
+ steps that form part of the equation that is to be sent to the solver. For more information see
26
+ [ src/goto-symex] ( ../../src/goto-symex/README.md ) .
25
27
26
28
You can see the main instruction dispatcher (what corresponds to the main interpreter
27
- loop) at goto_symext::execute_next_instruction.
29
+ loop) at ` goto_symext::execute_next_instruction ` .
28
30
29
31
Symex's source code is available under [ src/goto-symex] ( ../../src/goto-symex/ ) .
30
32
@@ -37,15 +39,17 @@ purposes:
37
39
``` c
38
40
enum goto_program_instruction_typet
39
41
{
42
+ [ ...]
40
43
GOTO = 1, // branch, possibly guarded
41
- ASSUME = 2, // non-failing guarded self loop
44
+ ASSUME = 2, // assumption
42
45
ASSERT = 3, // assertions
43
46
SKIP = 5, // just advance the PC
44
47
SET_RETURN_VALUE = 12, // set function return value (no control-flow change)
45
48
ASSIGN = 13, // assignment lhs:=rhs
46
49
DECL = 14, // declare a local variable
47
50
DEAD = 15, // marks the end-of-live of a local variable
48
51
FUNCTION_CALL = 16, // call a function
52
+ [ ...]
49
53
};
50
54
```
51
55
@@ -60,8 +64,8 @@ consider the following C file:
60
64
``` c
61
65
int main (int argc, char ** argv)
62
66
{
63
- int arry [ ] = {0, 1, 2, 3};
64
- __ CPROVER_assert(arry [ 3] != 3, "expected failure: last arry element is equal to 3");
67
+ int a [ ] = {0, 1, 2, 3};
68
+ __ CPROVER_assert(a [ 3] != 3, "expected failure: last element of array 'a' is equal to 3");
65
69
}
66
70
```
67
71
@@ -92,10 +96,10 @@ correspondent instruction types (`DECL`, `ASSIGN`, etc).
92
96
---
93
97
94
98
Symex (as mentioned above) is going to pick a designated entry point and then start going through
95
- each instruction. This happens at goto_symext::execute_next_instruction. While doing so, it will
96
- inspect the instruction's type, and then dispatch to a designated handling function (which usually go
97
- by the name ` symex_<instruction-type> ` ) to handle that particular instruction type and its symbolic
98
- execution. In pseudocode, it looks like this:
99
+ each instruction. This happens at ` goto_symext::execute_next_instruction ` . While doing so, it will
100
+ inspect the instruction's type, and then dispatch to a designated handling function (which usually
101
+ go by the name ` symex_<instruction-type> ` ) to handle that particular instruction type and its
102
+ symbolic execution. In pseudocode, it looks like this:
99
103
100
104
``` c
101
105
switch (instruction.type())
0 commit comments