Merge pull request #7090 from esteffin/esteffin/address-of-array-index

Add address_of(array[index]) support to incremental SMT2 backend

Author: Enrico Steffinlongo

regression/cbmc-incr-smt2/arrays/array_address_of.c

@@ -0,0 +1,8 @@
+int main()
+{
+  int example_array[10000];
+  __CPROVER_assert(
+    __CPROVER_OBJECT_SIZE(example_array) == 40000, "Array condition 1");
+  __CPROVER_assert(
+    __CPROVER_OBJECT_SIZE(example_array) == 40001, "Array condition 2");
+}

regression/cbmc-incr-smt2/arrays/array_address_of.desc

@@ -0,0 +1,11 @@
+CORE
+array_address_of.c
+
+Passing problem to incremental SMT2 solving
+line \d+ Array condition 1: SUCCESS
+line \d+ Array condition 2: FAILURE
+^EXIT=10$
+^SIGNAL=0$
+--
+--
+Test of getting the size of an array resulting in a address_of(array[0]) expression.

regression/cbmc-primitives/exists_assume_6231/test2.desc

@@ -1,4 +1,4 @@
-CORE
+CORE new-smt-backend
 test2.c
 --pointer-check
 ^EXIT=10$

regression/cbmc-primitives/implication_statement_checks_1/test.desc

@@ -1,4 +1,4 @@
-CORE
+CORE new-smt-backend
 --div-by-zero-check
 test.c
 ^EXIT=0$

regression/cbmc-primitives/r_w_ok_valid/test-no-cp.desc

@@ -1,4 +1,4 @@
-CORE
+CORE new-smt-backend
 main.c
 --pointer-check --no-simplify --no-propagation
 ^EXIT=0$

regression/cbmc-primitives/same-object-01/test-no-cp.desc

@@ -1,4 +1,4 @@
-CORE
+CORE new-smt-backend
 main.c
 --no-simplify --no-propagation
 ^EXIT=0$

regression/cbmc-primitives/same-object-02/test-no-cp.desc

@@ -1,4 +1,4 @@
-CORE
+CORE new-smt-backend
 main.c
 --no-simplify --no-propagation
 ^EXIT=0$

regression/cbmc-primitives/same-object-04/test-no-cp.desc

@@ -1,4 +1,4 @@
-CORE
+CORE new-smt-backend
 main.c
 --no-simplify --no-propagation
 ^EXIT=0$

src/solvers/smt2_incremental/convert_expr_to_smt.cpp

@@ -1813,6 +1813,25 @@ at_scope_exitt<functiont> at_scope_exit(functiont exit_function)
 }
 #endif
 
+exprt lower_address_of_array_index(exprt expr)
+{
+  expr.visit_pre([](exprt &expr) {
+    const auto address_of_expr = expr_try_dynamic_cast<address_of_exprt>(expr);
+    if(!address_of_expr)
+      return;
+    const auto array_index_expr =
+      expr_try_dynamic_cast<index_exprt>(address_of_expr->object());
+    if(!array_index_expr)
+      return;
+    expr = plus_exprt{
+      address_of_exprt{
+        array_index_expr->array(),
+        type_checked_cast<pointer_typet>(address_of_expr->type())},
+      array_index_expr->index()};
+  });
+  return expr;
+}
+
 smt_termt convert_expr_to_smt(
   const exprt &expr,
   const smt_object_mapt &object_map,
@@ -1830,13 +1849,14 @@ smt_termt convert_expr_to_smt(
   const auto end_conversion = at_scope_exit([&]() { in_conversion = false; });
 #endif
   sub_expression_mapt sub_expression_map;
-  expr.visit_post([&](const exprt &expr) {
+  const auto lowered_expr = lower_address_of_array_index(expr);
+  lowered_expr.visit_post([&](const exprt &expr) {
     const auto find_result = sub_expression_map.find(expr);
     if(find_result != sub_expression_map.cend())
       return;
     smt_termt term = dispatch_expr_to_smt_conversion(
       expr, sub_expression_map, object_map, pointer_sizes, object_size);
     sub_expression_map.emplace_hint(find_result, expr, std::move(term));
   });
-  return std::move(sub_expression_map.at(expr));
+  return std::move(sub_expression_map.at(lowered_expr));
 }

src/solvers/smt2_incremental/convert_expr_to_smt.h

@@ -16,6 +16,11 @@ class typet;
 ///   stored as sort ast (abstract syntax tree).
 smt_sortt convert_type_to_smt_sort(const typet &type);
 
+/// \brief Lower the `address_of(array[idx])` sub expressions in \p expr to
+///   `idx + address_of(array)`, so that it can be fed to
+///   `convert_expr_to_smt`.
+exprt lower_address_of_array_index(exprt expr);
+
 /// \brief Converts the \p expression to an smt encoding of the same expression
 ///   stored as term ast (abstract syntax tree).
 smt_termt convert_expr_to_smt(