// Run Alias Analysis on a sequential Boogie program
// and returned the pruned program
public static PersistentProgram RunAliasAnalysis(PersistentProgram inp, bool pruneEP = true)
{
var newinp = inp;
if (Options.unrollDepth > 0)
{
Stats.resume("unroll");
var unrp = new cba.LoopUnrollingPass(Options.unrollDepth);
newinp = unrp.run(newinp);
Stats.stop("unroll");
}
var program = newinp.getProgram();
//AliasAnalysis.AliasAnalysis.dbg = true;
//AliasAnalysis.AliasConstraintSolver.dbg = true;
AliasAnalysis.AliasAnalysisResults res = null;
if (Options.UseAliasAnalysisForAssertions)
{
// Do SSA
program =
SSA.Compute(program, PhiFunctionEncoding.Verifiable, new HashSet <string> {
"int"
});
if (Options.inlineDepth > 0)
{
Stats.resume("inlining");
Stats.resume("read.write");
program = BoogieUtil.ReResolveInMem(program);
Stats.stop("read.write");
var op = CommandLineOptions.Clo.InlineDepth;
CommandLineOptions.Clo.InlineDepth = Options.inlineDepth;
cba.InliningPass.InlineToDepth(program);
CommandLineOptions.Clo.InlineDepth = op;
RemoveHavocs(program);
Stats.stop("inlining");
}
/* TODO: Is this needed?
* Stats.resume("read.write");
* program = BoogieUtil.ReResolveInMem(program);
* Stats.stop("read.write");
*/
// Make sure that aliasing queries are on identifiers only
var af =
AliasAnalysis.SimplifyAliasingQueries.Simplify(program);
Stats.resume("fixpoint");
res =
AliasAnalysis.AliasAnalysis.DoAliasAnalysis(program);
Stats.stop("fixpoint");
}
else
{
// Make sure that aliasing queries are on identifiers only
var af =
AliasAnalysis.SimplifyAliasingQueries.Simplify(program);
res = new AliasAnalysis.AliasAnalysisResults();
af.Iter(s => res.aliases.Add(s, true));
}
var origProgram = inp.getProgram();
AliasAnalysis.PruneAliasingQueries.Prune(origProgram, res);
if (pruneEP)
{
PruneRedundantEntryPoints(origProgram);
}
return(new PersistentProgram(origProgram, inp.mainProcName, inp.contextBound));
}
// Replace "assume x == NULL" with "assume x == NULL; assert false;"
// provided x can indeed alias NULL
// Also returns a map from allocation_site to possible branches affected by it
public static Tuple <Program, Dictionary <int, HashSet <int> > > Run(Program program, string ep, bool useAA, bool injectAssert)
{
var ib = new InstrumentBranches(program, useAA, injectAssert);
ib.instrument(ep);
if (!useAA)
{
Console.WriteLine("For deadcode detection, we added {0} angelic assertions", ib.assertsAdded);
return(Tuple.Create <Program, Dictionary <int, HashSet <int> > >(program, null));
}
var inp = new PersistentProgram(program, ep, 1);
//inp.writeToFile("progbefore.bpl");
// Make sure that aliasing queries are on identifiers only
var af =
AliasAnalysis.SimplifyAliasingQueries.Simplify(program);
// Do SSA
program =
SSA.Compute(program, PhiFunctionEncoding.Verifiable, new HashSet <string> {
"int"
});
//BoogieUtil.PrintProgram(program, "b3.bpl");
// Run AA
AliasAnalysis.AliasAnalysisResults res =
AliasAnalysis.AliasAnalysis.DoAliasAnalysis(program);
// allocation site of null
var nil = res.allocationSites[ib.nullQuery.Name].FirstOrDefault();
Debug.Assert(nil != null);
var deadcodeAssertId = 0;
// add the assert false OR assume reach(true)
var MkAssertFalse = new Func <int, PredicateCmd>(i =>
{
var acmd = injectAssert ? BoogieAstFactory.MkAssert(Expr.False) as PredicateCmd :
new AssumeCmd(Token.NoToken,
new NAryExpr(Token.NoToken, new FunctionCall(ib.reach), new List <Expr> {
Expr.True
})) as PredicateCmd;
acmd.Attributes = new QKeyValue(Token.NoToken,
"deadcode", new List <object> {
Expr.Literal(i)
}, null);
return(acmd);
});
// build a map from AA allocation sites to allocation_site id
var as2id = new Dictionary <string, HashSet <int> >();
foreach (var tup in ib.allocationSite2Func)
{
var asites = res.allocationSites[tup.Value.Name];
asites.Where(s => !as2id.ContainsKey(s)).Iter(s => as2id.Add(s, new HashSet <int>()));
asites.Iter(s => as2id[s].Add(tup.Key));
}
if (AliasAnalysis.AliasConstraintSolver.environmentPointersUnroll != 0)
{
Console.WriteLine("AA Warning: EnvironmentPointersUnroll is non-zero, which means that the dependency information for deadcode branches is not sound.");
Console.WriteLine("AA Warning: We currently rely on: forall unknown allocation sites that return a, ReachableAllocationSitesViaFields(a) = {a}.");
}
// map from allocation_site to possible branches affected by it
var depInfo = new Dictionary <int, HashSet <int> >();
program = inp.getProgram();
var id = 0; var added = 0;
foreach (var impl in program.TopLevelDeclarations.OfType <Implementation>())
{
foreach (var blk in impl.Blocks)
{
blk.Cmds.RemoveAll(c => (c is AssumeCmd) && QKeyValue.FindBoolAttribute((c as AssumeCmd).Attributes, "ForDeadCodeDetection"));
var ncmds = new List <Cmd>();
for (int i = 0; i < blk.Cmds.Count; i++)
{
ncmds.Add(blk.Cmds[i]);
var acmd = blk.Cmds[i] as AssumeCmd;
if (acmd == null)
{
continue;
}
id++;
if (!ib.id2Func.ContainsKey(id))
{
continue;
}
var asites = res.allocationSites[ib.id2Func[id].Name];
//if (!Options.disbleDeadcodeOpt || !asites.Contains(nil) && asites.Count != 0)
{
var assertid = deadcodeAssertId++;
ncmds.Add(MkAssertFalse(assertid));
// compute dependent allocations for this branch
var dep = new HashSet <int>();
asites.Where(a => as2id.ContainsKey(a))
.Iter(a => dep.UnionWith(as2id[a]));
dep.Where(d => !depInfo.ContainsKey(d))
.Iter(d => depInfo.Add(d, new HashSet <int>()));
dep.Iter(d => depInfo[d].Add(assertid));
added++;
}
//i++;
}
blk.Cmds = ncmds;
}
}
//BoogieUtil.PrintProgram(program, "progafter.bpl");
Console.WriteLine("For deadcode detection, we added {0} angelic assertions", added);
return(Tuple.Create(program, depInfo));
}