CBMC
string_refinement.h
Go to the documentation of this file.
1 /*******************************************************************\
2 
3 Module: String support via creating string constraints and progressively
4  instantiating the universal constraints as needed.
5  The procedure is described in the PASS paper at HVC'13:
6  "PASS: String Solving with Parameterized Array and Interval Automaton"
7  by Guodong Li and Indradeep Ghosh
8 
9 Author: Alberto Griggio, alberto.griggio@gmail.com
10 
11 \*******************************************************************/
12 
19 
20 #ifndef CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_H
21 #define CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_H
22 
24 
26 
28 #include "string_dependencies.h"
29 #include "string_refinement_util.h"
30 
31 #define OPT_STRING_REFINEMENT \
32  "(no-refine-strings)" \
33  "(string-printable)" \
34  "(string-input-value):" \
35  "(string-non-empty)" \
36  "(max-nondet-string-length):"
37 
38 #define HELP_STRING_REFINEMENT \
39  " {y--no-refine-strings} \t turn off string refinement\n" \
40  " {y--string-printable} \t restrict to printable strings and characters\n" \
41  " {y--string-non-empty} \t restrict to non-empty strings (experimental)\n" \
42  " {y--string-input-value} {ust} \t " \
43  "restrict non-null strings to a fixed value {ust}; the switch can be used " \
44  "multiple times to give several strings\n" \
45  " {y--max-nondet-string-length} {un} \t " \
46  "bound the length of nondet (e.g. input) strings. Default is " + \
47  std::to_string(MAX_CONCRETE_STRING_SIZE - 1) + \
48  "; note that setting the value higher than this does not work " \
49  "with {y--trace} or {y--validate-trace}.\n"
50 
51 // The integration of the string solver into CBMC is incomplete. Therefore,
52 // it is not turned on by default and not all options are available.
53 #define OPT_STRING_REFINEMENT_CBMC \
54  "(refine-strings)" \
55  "(string-printable)"
56 
57 #define HELP_STRING_REFINEMENT_CBMC \
58  " {y--refine-strings} \t use string refinement (experimental)\n" \
59  " {y--string-printable} \t restrict to printable strings (experimental)\n"
60 
61 #define DEFAULT_MAX_NB_REFINEMENT std::numeric_limits<size_t>::max()
62 
63 class string_refinementt final : public bv_refinementt
64 {
65 private:
66  struct configt
67  {
68  std::size_t refinement_bound = 0;
69  bool use_counter_example = true;
70  };
71 
72 public:
74  struct infot : public bv_refinementt::infot, public configt
75  {
76  };
77 
78  explicit string_refinementt(const infot &);
79 
80  std::string decision_procedure_text() const override
81  {
82  return "string refinement loop with " + prop.solver_text();
83  }
84 
85  exprt get(const exprt &expr) const override;
86  void set_to(const exprt &expr, bool value) override;
87 
88 protected:
90 
91 private:
92  // Base class
94 
95  string_refinementt(const infot &, bool);
96 
98  std::size_t loop_bound_;
100 
101  // Simple constraints that have been given to the solver
102  std::set<exprt> seen_instances;
103 
105 
106  // Unquantified lemmas that have newly been added
107  std::vector<exprt> current_constraints;
108 
109  // See the definition in the PASS article
110  // Warning: this is indexed by array_expressions and not string expressions
111 
114 
115  std::vector<exprt> equations;
116 
118 
119  void add_lemma(const exprt &lemma, bool simplify_lemma = true);
120 };
121 
122 exprt substitute_array_lists(exprt expr, std::size_t string_max_length);
123 
124 // Declaration required for unit-test:
126  const std::vector<equal_exprt> &equations,
127  const namespacet &ns,
128  messaget::mstreamt &stream);
129 
130 // Declaration required for unit-test:
132  exprt expr,
133  symbol_generatort &symbol_generator,
134  const bool left_propagate);
135 
136 #endif
Abstraction Refinement Loop.
resultt
Result of running the decision procedure.
Base class for all expressions.
Definition: expr.h:56
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
Definition: namespace.h:94
virtual std::string solver_text() const =0
Keep track of dependencies between strings.
string_constraint_generatort generator
std::string decision_procedure_text() const override
Return a textual description of the decision procedure.
union_find_replacet symbol_resolve
bv_refinementt supert
std::vector< exprt > equations
string_axiomst axioms
decision_proceduret::resultt dec_solve(const exprt &) override
Main decision procedure of the solver.
string_refinementt(const infot &)
const configt config_
std::set< exprt > seen_instances
void set_to(const exprt &expr, bool value) override
Record the constraints to ensure that the expression is true when the boolean is true and false other...
string_dependenciest dependencies
index_set_pairt index_sets
exprt get(const exprt &expr) const override
Evaluates the given expression in the valuation found by string_refinementt::dec_solve.
std::vector< exprt > current_constraints
void add_lemma(const exprt &lemma, bool simplify_lemma=true)
Add the given lemma to the solver.
Generation of fresh symbols of a given type.
Definition: array_pool.h:22
Similar interface to union-find for expressions, with a function for replacing sub-expressions by the...
Generates string constraints to link results from string functions with their arguments.
Keeps track of dependencies between strings.
exprt substitute_array_access(exprt expr, symbol_generatort &symbol_generator, const bool left_propagate)
Create an equivalent expression where array accesses and 'with' expressions are replaced by 'if' expr...
exprt substitute_array_lists(exprt expr, std::size_t string_max_length)
union_find_replacet string_identifiers_resolution_from_equations(const std::vector< equal_exprt > &equations, const namespacet &ns, messaget::mstreamt &stream)
Symbol resolution for expressions of type string typet.
string_refinementt constructor arguments