CBMC
All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Friends Macros Modules Pages
value_set_fi_fp_removal.cpp
Go to the documentation of this file.
1/*******************************************************************\
2
3Module: value_set_fi_Fp_removal
4
5Author: Daniel Kroening, kroening@kroening.com
6
7\*******************************************************************/
8
10
11#include <util/message.h>
12#include <util/namespace.h>
13#include <util/pointer_expr.h>
14
17
19
21 goto_modelt &goto_model,
22 message_handlert &message_handler)
23{
24 messaget message(message_handler);
25 message.status() << "Doing FI value set analysis" << messaget::eom;
26
27 const namespacet ns(goto_model.symbol_table);
28 value_set_analysis_fit value_sets(ns);
29 value_sets(goto_model.goto_functions);
30
31 message.status() << "Instrumenting" << messaget::eom;
32
33 // now replace aliases by addresses
34 for(auto &f : goto_model.goto_functions.function_map)
35 {
36 for(auto target = f.second.body.instructions.begin();
37 target != f.second.body.instructions.end();
38 target++)
39 {
40 if(target->is_function_call())
41 {
42 const auto &function = as_const(*target).call_function();
43 if(function.id() == ID_dereference)
44 {
45 message.status() << "CALL at " << target->source_location() << ":"
47
48 const auto &pointer = to_dereference_expr(function).pointer();
49 auto addresses = value_sets.get_values(f.first, target, pointer);
50
51 std::unordered_set<symbol_exprt, irep_hash> functions;
52
53 for(const auto &address : addresses)
54 {
55 // is this a plain function address?
56 // strip leading '&'
57 if(address.id() == ID_object_descriptor)
58 {
59 const auto &od = to_object_descriptor_expr(address);
60 const auto &object = od.object();
61 if(object.type().id() == ID_code && object.id() == ID_symbol)
62 functions.insert(to_symbol_expr(object));
63 }
64 }
65
66 for(const auto &f : functions)
67 message.status()
68 << " function: " << f.get_identifier() << messaget::eom;
69
70 if(functions.size() > 0)
71 {
73 message_handler,
74 goto_model.symbol_table,
75 f.second.body,
76 f.first,
77 target,
78 functions);
79 }
80 }
81 }
82 }
83 }
84 goto_model.goto_functions.update();
85}
const T & as_const(T &value)
Return a reference to the same object but ensures the type is const.
Definition as_const.h:14
ait supplies three of the four components needed: an abstract interpreter (in this case handling func...
Definition ai.h:562
function_mapt function_map
symbol_tablet symbol_table
Symbol table.
Definition goto_model.h:31
goto_functionst goto_functions
GOTO functions.
Definition goto_model.h:34
source_locationt source_location
Definition message.h:239
Class that provides messages with a built-in verbosity 'level'.
Definition message.h:154
static eomt eom
Definition message.h:289
mstreamt & status() const
Definition message.h:406
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
Definition namespace.h:91
std::vector< exprt > get_values(const irep_idt &function_id, locationt l, const exprt &expr) override
Symbol Table + CFG.
API to expression classes for Pointers.
const object_descriptor_exprt & to_object_descriptor_expr(const exprt &expr)
Cast an exprt to an object_descriptor_exprt.
const dereference_exprt & to_dereference_expr(const exprt &expr)
Cast an exprt to a dereference_exprt.
void remove_function_pointer(message_handlert &message_handler, symbol_tablet &symbol_table, goto_programt &goto_program, const irep_idt &function_id, goto_programt::targett target, const std::unordered_set< symbol_exprt, irep_hash > &functions)
Replace a call to a dynamic function at location target in the given goto-program by a case-split ove...
Remove Indirect Function Calls.
const symbol_exprt & to_symbol_expr(const exprt &expr)
Cast an exprt to a symbol_exprt.
Definition std_expr.h:272
Value Set Propagation (flow insensitive)
void value_set_fi_fp_removal(goto_modelt &goto_model, message_handlert &message_handler)
Builds the flow-insensitive value set for all function pointers and replaces function pointers with a...
flow insensitive value set function pointer removal