-
Notifications
You must be signed in to change notification settings - Fork 26
Introduce UExprTranslator, UModelBase and revise regions composition
#9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9693276 to
710f4ac
Compare
710f4ac to
7f4cf05
Compare
…s in signatures and tests
Fix: found a bug in KSMT;
UExprTranslator, UMemoryRegionTranslator and etc.UExprTranslator and revise regions composition
UExprTranslator and revise regions compositionUExprTranslator, UModelBase and revise regions composition
CaelmBleidd
requested changes
Apr 18, 2023
24 tasks
petrukhinandrew
pushed a commit
to petrukhinandrew/usvm
that referenced
this pull request
May 5, 2025
Signed-off-by: Arthur Alekseev <[email protected]>
Saloed
pushed a commit
that referenced
this pull request
Jun 2, 2025
petrukhinandrew
pushed a commit
to petrukhinandrew/usvm
that referenced
this pull request
Jun 19, 2025
Signed-off-by: Arthur Alekseev <[email protected]>
petrukhinandrew
pushed a commit
to petrukhinandrew/usvm
that referenced
this pull request
Aug 15, 2025
Signed-off-by: Arthur Alekseev <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds translation and decoding mechanisms. They now encapsulated in
USolverBasevia a translator and a decoder.USolverBase::checkreturns aUSolverSatwith aUModelBasein case of satisfiable path constraints. To successfully evaluate anyUHeapReadings viaUModelBase::eval, memory regions composition was revised and partly reimplemented.Details
UExprTranslatorTranslates custom
UExprto aKExpr. Region readings are translated viaURegionTranslators. Base version caches everything, but doesn't track translated expressions.UExprCachingTranslatortracks translated symbols (e.g. register readings, mock symbols, translated region ids, etc.). This information is used inULazyModelDecoder.The translator can be safely reused inside a single
UContext.ULazyModelDecoderPerforms decoding of a
KModelto aUModelBase. Initialized with tracked information fromUExprTranslator. Actually, it is updated on the fly: when new expressions are translated, they automatically leak to passed caches inULazyModelDecoder, so the decoder sees them. This is the only semantic connection between the decoder and the translator. Syntactically, they don't know about each other, and all the configuration happens inbuildDefaultTranslatorAndDecoderfunction.Internally, the decoder splits
KModelinto 4 components:stack,heap,typesandmocksand initiaizes them withKModel. It has to be detached, due to lazy way of decoding.UModelBaseConsists of decoded components and allows to evaluate any expression. Evaluation is done via generic composition. Evaluated expressions are cached within
UModelBaseinstance. If a symbol from an expression not found inside the model, components return the default value of the correct sort.URegionIdURegionIds holds aninstantiatefunction, which is called for reading a value from a region by a key after fast checks (take default value or a top-most update) inUMemoryRegions fail. This allows us to substitute this behavior when composing onto context heap.ULazyHeapModelA lazy immutable heap model. Declared as a mutable heap for using in regions composition in [UComposer]. Any call to modifying operation throws an exception.
Any
UHeapReadingpossibly writing to this heap in itsURegionId.instantiatecall actually has empty updates,because localization happened, so this heap isn't mutated. It significantly relies on simplification and localization in memory regions!
Heap readings composition
regionIds mapped as well and we put a context heap there.instantiatefunction, we firstly recursively apply this region to the context heap, then read from the context heap by a passed key. In case of aUModelHeap,region.updateswill be empty due to localization, so no mutation occurs. Therefore, we only read a value from theUModelHeapby the passed key.Minor:
UModelBase.UMemoryRegioninterface and renamed previous one toUSymbolicMemoryRegion.UEmptyUpdates.UFlatUpdatessimplify reads.UMemoryUpdatesvisitor.URegionIds, add a visitor for them.mkHeapRefEqto pass tests.0.5.0.TODO:
UMemoryUpdatesUExprTranslatorinto several parts or fix the SRP for it in a different wayURangedUpdateNodefor 2D arraysinternal/privatefunctions