Skip to content

String refinement must not rely on input equations to be simplified #4069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Feb 4, 2019
Merged

String refinement must not rely on input equations to be simplified #4069

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions jbmc/regression/strings-smoke-tests/java_starts_with/test-no-simplify.desc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
CORE
test_starts_with.class
--verbosity 10 --max-nondet-string-length 1000 --function test_starts_with.main --unwind 1 --no-simplify
^EXIT=10$
^SIGNAL=0$
^\[.*assertion.1\].* line 8.* SUCCESS$
^\[.*assertion.2\].* line 9.* FAILURE$
--
non equal types
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe add a comment on what this test is checking

--
This test must also pass when not running simplification during goto-symex
(--no-simplify). Prior to the changes in this commit the test would yield wrong
results for either line 8, because the string solver was not able to identify
the string object in a non-simplified expression.
3 changes: 2 additions & 1 deletion src/solvers/strings/string_constraint_generator_main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ Author: Romain Brenguier, [email protected]
#include <util/arith_tools.h>
#include <util/deprecate.h>
#include <util/pointer_predicates.h>
#include <util/simplify_expr.h>
#include <util/ssa_expr.h>
#include <util/string_constant.h>

Expand Down Expand Up @@ -180,7 +181,7 @@ exprt string_constraint_generatort::associate_array_to_pointer(
: f.arguments()[0]);

const exprt &pointer_expr = f.arguments()[1];
array_pool.insert(pointer_expr, array_expr);
array_pool.insert(simplify_expr(pointer_expr, ns), array_expr);
// created_strings.emplace(to_array_string_expr(array_expr));
return from_integer(0, f.type());
}
Expand Down
7 changes: 5 additions & 2 deletions src/solvers/strings/string_refinement.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -339,7 +339,7 @@ static void add_equations_for_symbol_resolution(

if(is_char_pointer_type(rhs.type()))
{
symbol_solver.make_union(lhs, rhs);
symbol_solver.make_union(lhs, simplify_expr(rhs, ns));
}
else if(rhs.id() == ID_function_application)
{
Expand Down Expand Up @@ -439,7 +439,7 @@ static void add_string_equation_to_symbol_resolution(
{
if(eq.rhs().type() == string_typet())
{
symbol_resolve.make_union(eq.lhs(), eq.rhs());
symbol_resolve.make_union(eq.lhs(), simplify_expr(eq.rhs(), ns));
}
else if(has_subtype(eq.lhs().type(), ID_string, ns))
{
Expand Down Expand Up @@ -646,7 +646,10 @@ decision_proceduret::resultt string_refinementt::dec_solve()
for(equal_exprt &eq : equations)
{
if(can_cast_expr<function_application_exprt>(eq.rhs()))
{
simplify(eq.rhs(), ns);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was a bit confused by the distinction between simplify and simplify_expr; the second one should probably be called simplify_copy, but that's outside the scope of this PR, and they probably need some rework.

string_id_symbol_resolve.replace_expr(eq.rhs());
}
}

// Generator is also used by get, so we have to use it as a class member
Expand Down