@@ -64,7 +64,9 @@ void log_value_set(
6464 const messaget &log,
6565 const std::vector<exprt> &value_set);
6666
67- // / Log a match between a value in the value set of a given expression, and
67+ // / Log a match between an address and a value the value set. This version of
68+ // / the function reports more details, including the base address, the pointer
69+ // / and the shadow value.
6870void log_value_set_match (
6971 const namespacet &ns,
7072 const messaget &log,
@@ -74,7 +76,7 @@ void log_value_set_match(
7476 const exprt &expr,
7577 const value_set_dereferencet::valuet &shadow_dereference);
7678
77- // TODO: doxygen
79+ // / Logs a successful match between an address and a value within the value set.
7880void log_value_set_match (
7981 const namespacet &ns,
8082 const messaget &log,
@@ -87,17 +89,27 @@ void log_try_shadow_address(
8789 const messaget &log,
8890 const shadow_memory_statet::shadowed_addresst &shadowed_address);
8991
90- // TODO: doxygen
92+ // / Generic logging function that will log depending on the configured
93+ // / verbosity. Will log a specific message given to it, along with an expression
94+ // / passed along to it.
9195void log_cond (
9296 const namespacet &ns,
9397 const messaget &log,
9498 const char *cond_text,
9599 const exprt &cond);
96100
97- // TODO: doxygen
101+ // / Replace an invalid object by a null pointer. Works recursively on the
102+ // / operands (child nodes) of the expression, as well.
103+ // / \param expr The (root) expression where substitution will happen.
98104void replace_invalid_object_by_null (exprt &expr);
99105
100- // TODO: doxygen
106+ // / Retrieve the expression that a field was initialised with within a given
107+ // / symex state.
108+ // / \param field_name The field whose initialisation expression we want to
109+ // / retrieve.
110+ // / \param state The goto symex state within which we want to search for the
111+ // / expression.
112+ // / \returns The expression the field was initialised with.
101113const exprt &
102114get_field_init_expr (const irep_idt &field_name, const goto_symex_statet &state);
103115
@@ -112,45 +124,67 @@ std::vector<std::pair<exprt, exprt>> get_shadow_dereference_candidates(
112124 const typet &lhs_type,
113125 bool &exact_match);
114126
115- // TODO: doxygen
127+ // / Retrieves the value of the initialising expression.
128+ // / \param field_name The name of the field whose value type we want to query.
129+ // / \param state The symex_state within which the query is executed (the field's
130+ // / value is looked up).
131+ // / \returns The type of the value the field was initialised with (actually,
132+ // / the type of the value the field currently is associated with, but it's
133+ // / invariant since the declaration).
116134const typet &
117135get_field_init_type (const irep_idt &field_name, const goto_symex_statet &state);
118136
119- // TODO: doxygen
137+ // / Given a pointer expression check to see if it can be a null pointer or an
138+ // / invalid object within value_set.
139+ // / \param address A pointer expressions that we are using as the query.
140+ // / \param value_set The search space for the query.
141+ // / \returns true if the object can be null or invalid in the value set, false
142+ // / otherwise.
120143bool contains_null_or_invalid (
121144 const std::vector<exprt> &value_set,
122145 const exprt &address);
123146
124- // TODO: doxygen
147+ // / Performs aggregation of the shadow memory field value over multiple cells
148+ // / for fields whose type is _Bool.
125149exprt compute_or_over_cells (
126150 const exprt &expr,
127151 const typet &field_type,
128152 const namespacet &ns,
129153 const messaget &log,
130154 const bool is_union);
131155
132- // TODO: doxygen
156+ // / Performs aggregation of the shadow memory field value over multiple cells
157+ // / for fields whose type is a signed/unsigned bitvector (where the value is
158+ // / arbitrary up until the max represented by the bitvector size).
133159exprt compute_max_over_cells (
134160 const exprt &expr,
135161 const typet &field_type,
136162 const namespacet &ns,
137163 const messaget &log,
138164 const bool is_union);
139165
140- // TODO: doxygen?
166+ // / Build an if-then-else chain from a vector containing pairs of expressions.
167+ // / \param conds_values Contains pairs <e1, e2>, where `e1` is going to be
168+ // / used as an antecedent for an if_expr, and `e2` is going to be used
169+ // / as the consequent.
170+ // / \returns An if_exprt of the form `if e1 then e2 else if e3 then e4 else ...`
141171exprt build_if_else_expr (
142172 const std::vector<std::pair<exprt, exprt>> &conds_values);
143173
144- // TODO: improve?
145- // / returns true if we attempt to set/get a field on a NULL pointer
174+ // / Checks if given expression is a null pointer.
175+ // / \ returns true if expr is a a NULL pointer within value_set.
146176bool set_field_check_null (
147177 const namespacet &ns,
148178 const messaget &log,
149179 const std::vector<exprt> &value_set,
150180 const exprt &expr);
151181
152- // TODO: improve?
153- // / Used for set_field and shadow memory copy
182+ // / Get shadow memory values for a given expression within a specified value
183+ // / set.
184+ // / \returns if potential values are present for that object inside the value
185+ // / set, then we get back an `if e1 then e2 else (if e3 else e4...`
186+ // / expression, where `e1`, `e3`, ... are guards (conditions) and `e2`, `e4`,
187+ // / etc are the possible values of the object within the value set.
154188optionalt<exprt> get_shadow_memory (
155189 const exprt &expr,
156190 const std::vector<exprt> &value_set,
0 commit comments