@@ -19,12 +19,14 @@ central CBMC module, the *symbolic execution engine* (from now on, just *symex*)
1919
2020## A (very) short introduction to Symex
2121
22- Symex is, at its core, a GOTO-program interpreter. While Symex is interpreting
23- the program, it's also building a list of SSA steps that form part of the equation
24- that is to be sent to the solver.
22+ Symex is, at its core, a GOTO-program interpreter that uses symbolic values instead of actual ones.
23+ This produces a formula which describes all possible outputs rather than a single output value.
24+ While Symex is interpreting the program, it also builds a list of Static Single Assignment (SSA)
25+ steps that form part of the equation that is to be sent to the solver. For more information see
26+ [ src/goto-symex] ( ../../src/goto-symex/README.md ) .
2527
2628You can see the main instruction dispatcher (what corresponds to the main interpreter
27- loop) at goto_symext::execute_next_instruction.
29+ loop) at ` goto_symext::execute_next_instruction ` .
2830
2931Symex's source code is available under [ src/goto-symex] ( ../../src/goto-symex/ ) .
3032
@@ -37,15 +39,17 @@ purposes:
3739``` c
3840enum goto_program_instruction_typet
3941{
42+ [ ...]
4043 GOTO = 1, // branch, possibly guarded
41- ASSUME = 2, // non-failing guarded self loop
44+ ASSUME = 2, // assumption
4245 ASSERT = 3, // assertions
4346 SKIP = 5, // just advance the PC
4447 SET_RETURN_VALUE = 12, // set function return value (no control-flow change)
4548 ASSIGN = 13, // assignment lhs:=rhs
4649 DECL = 14, // declare a local variable
4750 DEAD = 15, // marks the end-of-live of a local variable
4851 FUNCTION_CALL = 16, // call a function
52+ [ ...]
4953};
5054```
5155
@@ -60,8 +64,8 @@ consider the following C file:
6064``` c
6165int main (int argc, char ** argv)
6266{
63- int arry [ ] = {0, 1, 2, 3};
64- __ CPROVER_assert(arry [ 3] != 3, "expected failure: last arry element is equal to 3");
67+ int a [ ] = {0, 1, 2, 3};
68+ __ CPROVER_assert(a [ 3] != 3, "expected failure: last element of array 'a' is equal to 3");
6569}
6670```
6771
@@ -92,10 +96,10 @@ correspondent instruction types (`DECL`, `ASSIGN`, etc).
9296---
9397
9498Symex (as mentioned above) is going to pick a designated entry point and then start going through
95- each instruction. This happens at goto_symext::execute_next_instruction. While doing so, it will
96- inspect the instruction's type, and then dispatch to a designated handling function (which usually go
97- by the name ` symex_<instruction-type> ` ) to handle that particular instruction type and its symbolic
98- execution. In pseudocode, it looks like this:
99+ each instruction. This happens at ` goto_symext::execute_next_instruction ` . While doing so, it will
100+ inspect the instruction's type, and then dispatch to a designated handling function (which usually
101+ go by the name ` symex_<instruction-type> ` ) to handle that particular instruction type and its
102+ symbolic execution. In pseudocode, it looks like this:
99103
100104``` c
101105switch (instruction.type())
0 commit comments