ROSE  0.11.98.0
Classes | Public Types | Public Member Functions | Static Public Attributes | Protected Member Functions | Protected Attributes | List of all members
Rose::BinaryAnalysis::SymbolicExpr::Node Class Referenceabstract

Description

Base class for symbolic expression nodes.

Every node has a specified width measured in bits that is constant over the life of the node. The width is always a concrete, positive value stored in a 64-bit field. The corollary of this invariant is that if an expression's result width depends on the values of some of its arguments, those arguments must be concrete and not wider than 64 bits. Only a few operators fall into this category since most expressions depend on the widths of their arguments rather than the values of their arguments.

In order that subtrees can be freely assigned as children of other nodes (provided the structure as a whole remains a lattice and not a graph with cycles), two things are required: First, expression tree nodes are always referenced through shared-ownership pointers that collectively own the expression node (expressions are never explicitly deleted). Second, expression nodes are immutable once they're instantiated. There are a handful of exceptions to the immutable rule: comments and attributes are allowed to change freely since they're not significant to hashing or arithmetic operations.

Each node has a bit flags property, the bits of which are defined by the user. New nodes are created having all bits cleared unless the user specifies a value in the constructor. Bits are significant for hashing. Simplifiers produce result expressions whose bits are set in a predictable manner with the following rules:

Definition at line 456 of file SymbolicExpr.h.

#include <Rose/BinaryAnalysis/SymbolicExpr.h>

Inheritance diagram for Rose::BinaryAnalysis::SymbolicExpr::Node:
Inheritance graph
[legend]
Collaboration diagram for Rose::BinaryAnalysis::SymbolicExpr::Node:
Collaboration graph
[legend]

Classes

class  WithFormatter
 A node with formatter. More...
 

Public Types

using EquivPairs = std::map< Node *, std::vector< std::pair< Node *, bool >>>
 
- Public Types inherited from Sawyer::Attribute::Storage<>
typedef SynchronizationTraits< Sawyer::SingleThreadedTagSync
 

Public Member Functions

Type type () const
 Type of value. More...
 
virtual bool mustEqual (const Ptr &other, const SmtSolverPtr &solver=SmtSolverPtr())=0
 Returns true if two expressions must be equal (cannot be unequal). More...
 
virtual bool mayEqual (const Ptr &other, const SmtSolverPtr &solver=SmtSolverPtr())=0
 Returns true if two expressions might be equal, but not necessarily be equal. More...
 
virtual bool isEquivalentTo (const Ptr &other)=0
 Tests two expressions for structural equivalence. More...
 
virtual int compareStructure (const Ptr &other)=0
 Compare two expressions structurally for sorting. More...
 
virtual Ptr substitute (const Ptr &from, const Ptr &to, const SmtSolverPtr &solver=SmtSolverPtr())=0
 Substitute one value for another. More...
 
Ptr substituteMultiple (const ExprExprHashMap &substitutions, const SmtSolverPtr &solver=SmtSolverPtr())
 Rewrite expression by substituting subexpressions. More...
 
Ptr renameVariables (ExprExprHashMap &index, size_t &nextVariableId, const SmtSolverPtr &solver=SmtSolverPtr())
 Rewrite using lowest numbered variable names. More...
 
virtual Operator getOperator () const =0
 Operator for interior nodes. More...
 
virtual size_t nChildren () const =0
 Number of arguments. More...
 
virtual const Nodes & children () const =0
 Arguments. More...
 
virtual Sawyer::Optional< uint64_t > toUnsigned () const =0
 The unsigned integer value of the expression. More...
 
virtual Sawyer::Optional< int64_t > toSigned () const =0
 The signed integer value of the expression. More...
 
bool isIntegerExpr () const
 True if this expression is of an integer type. More...
 
bool isFloatingPointExpr () const
 True if this expression is of a floating-point type. More...
 
bool isMemoryExpr () const
 True if this expression is of a memory type. More...
 
bool isScalarExpr () const
 True if the expression is a scalar type. More...
 
virtual bool isConstant () const =0
 True if this expression is a constant. More...
 
bool isIntegerConstant () const
 True if this expression is an integer constant. More...
 
bool isFloatingPointConstant () const
 True if this epxression is a floating-point constant. More...
 
bool isScalarConstant () const
 True if this expression is a scalar constant. More...
 
bool isFloatingPointNan () const
 True if this expression is a floating-point NaN constant. More...
 
virtual bool isVariable2 () const =0
 True if this expression is a variable. More...
 
Sawyer::Optional< uint64_t > variableId () const
 Variable ID number. More...
 
bool isIntegerVariable () const
 True if this expression is an integer variable. More...
 
bool isFloatingPointVariable () const
 True if this expression is a floating-point variable. More...
 
bool isMemoryVariable () const
 True if this expression is a memory state variable. More...
 
bool isScalarVariable () const
 True if this expression is a scalar variable. More...
 
size_t nBits () const
 Property: Number of significant bits. More...
 
unsigned flags () const
 Property: User-defined bit flags. More...
 
Ptr newFlags (unsigned flags) const
 Sets flags. More...
 
size_t domainWidth () const
 Property: Width for memory expressions. More...
 
bool isScalar () const
 Check whether expression is scalar. More...
 
virtual VisitAction depthFirstTraversal (Visitor &) const =0
 Traverse the expression. More...
 
virtual uint64_t nNodes () const =0
 Computes the size of an expression by counting the number of nodes. More...
 
uint64_t nNodesUnique () const
 Number of unique nodes in expression. More...
 
std::set< LeafPtrgetVariables () const
 Returns the variables appearing in the expression. More...
 
bool isHashed () const
 Returns true if this node has a hash value computed and cached. More...
 
Hash hash () const
 Returns (and caches) the hash value for this node. More...
 
void hash (Hash) const
 
std::string toString () const
 Convert expression to string. More...
 
void assertAcyclic () const
 Asserts that expressions are acyclic. More...
 
std::vector< PtrfindCommonSubexpressions () const
 Find common subexpressions. More...
 
bool matchAddVariableConstant (LeafPtr &variable, LeafPtr &constant) const
 Determine whether an expression is a variable plus a constant. More...
 
InteriorPtr isOperator (Operator) const
 True (non-null) if this node is the specified operator. More...
 
virtual bool isEquivalentHelper (Node *, EquivPairs &)=0
 
virtual const Ptrchild (size_t idx) const =0
 Argument. More...
 
virtual const NodechildRaw (size_t idx) const =0
 Argument. More...
 
const std::string & comment () const
 Property: Comment. More...
 
void comment (const std::string &s)
 Property: Comment. More...
 
void userData (boost::any &data)
 Property: User-defined data. More...
 
const boost::any & userData () const
 Property: User-defined data. More...
 
InteriorPtr isInteriorNode () const
 Dynamic cast of this object to an interior node. More...
 
InteriorisInteriorNodeRaw () const
 Dynamic cast of this object to an interior node. More...
 
LeafPtr isLeafNode () const
 Dynamic cast of this object to a leaf node. More...
 
LeafisLeafNodeRaw () const
 Dynamic cast of this object to a leaf node. More...
 
WithFormatter withFormat (Formatter &fmt)
 Combines a node with a formatter for printing. More...
 
WithFormatter operator+ (Formatter &fmt)
 Combines a node with a formatter for printing. More...
 
virtual void print (std::ostream &, Formatter &) const =0
 Print the expression to a stream. More...
 
void print (std::ostream &o) const
 Print the expression to a stream. More...
 
- Public Member Functions inherited from Sawyer::SharedObject
 SharedObject ()
 Default constructor. More...
 
 SharedObject (const SharedObject &)
 Copy constructor. More...
 
virtual ~SharedObject ()
 Virtual destructor. More...
 
SharedObjectoperator= (const SharedObject &)
 Assignment. More...
 
- Public Member Functions inherited from Sawyer::SharedFromThis< Node >
SharedPointer< Node > sharedFromThis ()
 Create a shared pointer from this. More...
 
SharedPointer< const Node > sharedFromThis () const
 Create a shared pointer from this. More...
 
- Public Member Functions inherited from Sawyer::Attribute::Storage<>
 Storage ()
 Default constructor. More...
 
 Storage (const Storage &other)
 Copy constructor. More...
 
Storageoperator= (const Storage &other)
 Assignment operator. More...
 
bool attributeExists (Id id) const
 Check attribute existence. More...
 
void eraseAttribute (Id id)
 Erase an attribute. More...
 
void clearAttributes ()
 Erase all attributes. More...
 
void setAttribute (Id id, const T &value)
 Store an attribute. More...
 
bool setAttributeMaybe (Id id, const T &value)
 Store an attribute if not already present. More...
 
getAttribute (Id id) const
 Get an attribute that is known to exist. More...
 
attributeOrElse (Id id, const T &dflt) const
 Return an attribute or a specified value. More...
 
attributeOrDefault (Id id) const
 Return an attribute or a default-constructed value. More...
 
Sawyer::Optional< T > optionalAttribute (Id id) const
 Return the attribute as an optional value. More...
 
size_t nAttributes () const
 Number of attributes stored. More...
 
std::vector< IdattributeIds () const
 Returns ID numbers for all IDs stored in this container. More...
 

Static Public Attributes

static const unsigned RESERVED_FLAGS = 0x0000ffff
 These flags are reserved for use within ROSE. More...
 
static const unsigned INDETERMINATE = 0x00000001
 Value is somehow indeterminate. More...
 
static const unsigned UNSPECIFIED = 0x00000002
 Value is somehow unspecified. More...
 
static const unsigned BOTTOM = 0x00000004
 Value represents bottom in dataflow analysis. More...
 
static boost::logic::tribool(* mayEqualCallback )(const Ptr &a, const Ptr &b, const SmtSolverPtr &)
 User-supplied predicate to augment alias checking. More...
 

Protected Member Functions

 Node (const std::string &comment, unsigned flags=0)
 
void printFlags (std::ostream &o, unsigned flags, char &bracket) const
 

Protected Attributes

Type type_
 
unsigned flags_
 Bit flags. More...
 
std::string comment_
 Optional comment. More...
 
Hash hashval_
 Optional hash used as a quick way to indicate that two expressions are different. More...
 
boost::any userData_
 Additional user-specified data. More...
 

Additional Inherited Members

- Static Public Member Functions inherited from Sawyer::SmallObject
static SynchronizedPoolAllocatorpoolAllocator ()
 Return the pool allocator for this class. More...
 
static void * operator new (size_t size)
 
static void operator delete (void *ptr, size_t size)
 

Member Function Documentation

Type Rose::BinaryAnalysis::SymbolicExpr::Node::type ( ) const
inline
virtual bool Rose::BinaryAnalysis::SymbolicExpr::Node::mustEqual ( const Ptr other,
const SmtSolverPtr &  solver = SmtSolverPtr() 
)
pure virtual

Returns true if two expressions must be equal (cannot be unequal).

If an SMT solver is specified then that solver is used to answer this question, otherwise equality is established by looking only at the structure of the two expressions. Two expressions can be equal without being the same width (e.g., a 32-bit constant zero is equal to a 16-bit constant zero).

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual bool Rose::BinaryAnalysis::SymbolicExpr::Node::mayEqual ( const Ptr other,
const SmtSolverPtr &  solver = SmtSolverPtr() 
)
pure virtual

Returns true if two expressions might be equal, but not necessarily be equal.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual bool Rose::BinaryAnalysis::SymbolicExpr::Node::isEquivalentTo ( const Ptr other)
pure virtual

Tests two expressions for structural equivalence.

Two leaf nodes are equivalent if they are the same width and have equal values or are the same variable. Two interior nodes are equivalent if they are the same width, the same operation, have the same number of children, and those children are all pairwise equivalent.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual int Rose::BinaryAnalysis::SymbolicExpr::Node::compareStructure ( const Ptr other)
pure virtual

Compare two expressions structurally for sorting.

Returns -1 if this is less than other, 0 if they are structurally equal, and 1 if this is greater than other. This function returns zero when an only when isEquivalentTo returns zero, but isEquivalentTo can be much faster since it uses hashing.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual Ptr Rose::BinaryAnalysis::SymbolicExpr::Node::substitute ( const Ptr from,
const Ptr to,
const SmtSolverPtr &  solver = SmtSolverPtr() 
)
pure virtual

Substitute one value for another.

Finds all occurrances of from in this expression and replace them with to. If a substitution occurs, then a new expression is returned. The matching of from to sub-parts of this expression uses structural equivalence, the isEquivalentTo predicate. The from and to expressions must have the same width.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

Ptr Rose::BinaryAnalysis::SymbolicExpr::Node::substituteMultiple ( const ExprExprHashMap substitutions,
const SmtSolverPtr &  solver = SmtSolverPtr() 
)

Rewrite expression by substituting subexpressions.

This expression is rewritten by doing a depth-first traversal. At each step of the traversal, the subexpression is looked up by hash in the supplied substitutions table. If found, a new expression is created using the value found in the table and the traversal does not descend into the new expression. If no substitutions were performed then this expression is returned, otherwise a new expression is returned. An optional solver, which may be null, is used during the simplification step.

Ptr Rose::BinaryAnalysis::SymbolicExpr::Node::renameVariables ( ExprExprHashMap index,
size_t &  nextVariableId,
const SmtSolverPtr &  solver = SmtSolverPtr() 
)

Rewrite using lowest numbered variable names.

Given an expression, use the specified index to rewrite variables. The index uses expression hashes to look up the replacement expression. If the traversal finds a variable which is not in the index then a new variable is created. The new variable has the same type as the original variable, but it's name is generated starting at nextVariableId and incrementing after each replacement is generated. The optional solver is used during the simplification process and may be null.

virtual Operator Rose::BinaryAnalysis::SymbolicExpr::Node::getOperator ( ) const
pure virtual

Operator for interior nodes.

Return the operator for interior nodes, or OP_NONE for leaf nodes that have no operator.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual size_t Rose::BinaryAnalysis::SymbolicExpr::Node::nChildren ( ) const
pure virtual

Number of arguments.

Returns the number of children for an interior node, zero for leaf nodes.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual const Ptr& Rose::BinaryAnalysis::SymbolicExpr::Node::child ( size_t  idx) const
pure virtual

Argument.

Returns the specified argument by index. If the index is out of range, then returns null. A leaf node always returns null since it never has children.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual const Node* Rose::BinaryAnalysis::SymbolicExpr::Node::childRaw ( size_t  idx) const
pure virtual

Argument.

Returns the specified argument by index. If the index is out of range, then returns null. A leaf node always returns null since it never has children.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual const Nodes& Rose::BinaryAnalysis::SymbolicExpr::Node::children ( ) const
pure virtual

Arguments.

Returns the arguments of an operation for an interior node, or an empty list for a leaf node.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual Sawyer::Optional<uint64_t> Rose::BinaryAnalysis::SymbolicExpr::Node::toUnsigned ( ) const
pure virtual

The unsigned integer value of the expression.

Returns nothing if the expression is not a concrete integer value or the value is too wide to be represented by the return type.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual Sawyer::Optional<int64_t> Rose::BinaryAnalysis::SymbolicExpr::Node::toSigned ( ) const
pure virtual

The signed integer value of the expression.

Returns nothing if the expression is not a concrete integer value or the value doesn't fit in the return type.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isIntegerExpr ( ) const
inline

True if this expression is of an integer type.

Definition at line 610 of file SymbolicExpr.h.

References Rose::BinaryAnalysis::SymbolicExpr::Type::INTEGER, and Rose::BinaryAnalysis::SymbolicExpr::Type::typeClass().

Referenced by isIntegerConstant(), isIntegerVariable(), and isScalarExpr().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isFloatingPointExpr ( ) const
inline

True if this expression is of a floating-point type.

Definition at line 615 of file SymbolicExpr.h.

References Rose::BinaryAnalysis::SymbolicExpr::Type::FP, and Rose::BinaryAnalysis::SymbolicExpr::Type::typeClass().

Referenced by isFloatingPointConstant(), isFloatingPointVariable(), and isScalarExpr().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isMemoryExpr ( ) const
inline

True if this expression is of a memory type.

Definition at line 620 of file SymbolicExpr.h.

References Rose::BinaryAnalysis::SymbolicExpr::Type::MEMORY, and Rose::BinaryAnalysis::SymbolicExpr::Type::typeClass().

Referenced by isMemoryVariable().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isScalarExpr ( ) const
inline

True if the expression is a scalar type.

Integers and floating-point expressions are scalar, memory is not.

Definition at line 627 of file SymbolicExpr.h.

References isFloatingPointExpr(), and isIntegerExpr().

virtual bool Rose::BinaryAnalysis::SymbolicExpr::Node::isConstant ( ) const
pure virtual
bool Rose::BinaryAnalysis::SymbolicExpr::Node::isIntegerConstant ( ) const
inline

True if this expression is an integer constant.

Definition at line 635 of file SymbolicExpr.h.

References isConstant(), and isIntegerExpr().

Referenced by isScalarConstant().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isFloatingPointConstant ( ) const
inline

True if this epxression is a floating-point constant.

Definition at line 640 of file SymbolicExpr.h.

References isConstant(), and isFloatingPointExpr().

Referenced by isScalarConstant().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isScalarConstant ( ) const
inline

True if this expression is a scalar constant.

Integer and floating-point constants are scalar.

Definition at line 647 of file SymbolicExpr.h.

References isFloatingPointConstant(), and isIntegerConstant().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isFloatingPointNan ( ) const

True if this expression is a floating-point NaN constant.

virtual bool Rose::BinaryAnalysis::SymbolicExpr::Node::isVariable2 ( ) const
pure virtual

True if this expression is a variable.

Warning: Leaf nodes have a deprecated isVariable method that returns false for memory state variables, thus this method has a "2" appended to its name. After a suitable period of deprecation for Leaf::isVariable, a new isVariable will be added to this class hiearchy and will have the same semantics as isVariable2, which will become deprecated.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

Referenced by isFloatingPointVariable(), isIntegerVariable(), and isMemoryVariable().

Sawyer::Optional<uint64_t> Rose::BinaryAnalysis::SymbolicExpr::Node::variableId ( ) const

Variable ID number.

If this expression is a variable then returns the variable ID number, otherwise nothing.

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isIntegerVariable ( ) const
inline

True if this expression is an integer variable.

Definition at line 667 of file SymbolicExpr.h.

References isIntegerExpr(), and isVariable2().

Referenced by isScalarVariable().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isFloatingPointVariable ( ) const
inline

True if this expression is a floating-point variable.

Definition at line 672 of file SymbolicExpr.h.

References isFloatingPointExpr(), and isVariable2().

Referenced by isScalarVariable().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isMemoryVariable ( ) const
inline

True if this expression is a memory state variable.

Definition at line 677 of file SymbolicExpr.h.

References isMemoryExpr(), and isVariable2().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isScalarVariable ( ) const
inline

True if this expression is a scalar variable.

Integer and floating-point variables are scalar, memory variables are not.

Definition at line 684 of file SymbolicExpr.h.

References isFloatingPointVariable(), and isIntegerVariable().

const std::string& Rose::BinaryAnalysis::SymbolicExpr::Node::comment ( ) const
inline

Property: Comment.

Comments can be changed after a node has been created since the comment is not intended to be used for anything but annotation and/or debugging. If many expressions are sharing the same node, then the comment is changed in all those expressions. Changing the comment property is allowed even though nodes are generally immutable because comments are not considered significant for comparisons, computing hash values, etc.

Definition at line 696 of file SymbolicExpr.h.

References comment_.

Referenced by Rose::BinaryAnalysis::SymbolicExpr::substitute().

void Rose::BinaryAnalysis::SymbolicExpr::Node::comment ( const std::string &  s)
inline

Property: Comment.

Comments can be changed after a node has been created since the comment is not intended to be used for anything but annotation and/or debugging. If many expressions are sharing the same node, then the comment is changed in all those expressions. Changing the comment property is allowed even though nodes are generally immutable because comments are not considered significant for comparisons, computing hash values, etc.

Definition at line 699 of file SymbolicExpr.h.

void Rose::BinaryAnalysis::SymbolicExpr::Node::userData ( boost::any &  data)
inline

Property: User-defined data.

User defined data is always optional and does not contribute to the hash value of an expression. The user-defined data can be changed at any time by the user even if the expression node to which it is attached is shared between many expressions.

Definition at line 711 of file SymbolicExpr.h.

const boost::any& Rose::BinaryAnalysis::SymbolicExpr::Node::userData ( ) const
inline

Property: User-defined data.

User defined data is always optional and does not contribute to the hash value of an expression. The user-defined data can be changed at any time by the user even if the expression node to which it is attached is shared between many expressions.

Definition at line 714 of file SymbolicExpr.h.

References userData_.

size_t Rose::BinaryAnalysis::SymbolicExpr::Node::nBits ( ) const
inline

Property: Number of significant bits.

An expression with a known value is guaranteed to have all higher-order bits cleared.

Definition at line 722 of file SymbolicExpr.h.

References Rose::BinaryAnalysis::SymbolicExpr::Type::nBits().

unsigned Rose::BinaryAnalysis::SymbolicExpr::Node::flags ( ) const
inline

Property: User-defined bit flags.

This property is significant for hashing, comparisons, and possibly other operations, therefore it is immutable. To change the flags one must create a new expression; see newFlags.

Definition at line 730 of file SymbolicExpr.h.

References flags_.

Referenced by Rose::BinaryAnalysis::SymbolicExpr::substitute().

Ptr Rose::BinaryAnalysis::SymbolicExpr::Node::newFlags ( unsigned  flags) const

Sets flags.

Since symbolic expressions are immutable it is not possible to change the flags directly. Therefore if the desired flags are different than the current flags a new expression is created that is the same in every other respect. If the flags are not changed then the original expression is returned.

size_t Rose::BinaryAnalysis::SymbolicExpr::Node::domainWidth ( ) const
inline

Property: Width for memory expressions.

The return value is non-zero if and only if this tree node is a memory expression.

Definition at line 742 of file SymbolicExpr.h.

References Rose::BinaryAnalysis::SymbolicExpr::Type::addressWidth().

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isScalar ( ) const
inline

Check whether expression is scalar.

Everything is scalar except for memory.

Definition at line 749 of file SymbolicExpr.h.

References Rose::BinaryAnalysis::SymbolicExpr::Type::MEMORY, and Rose::BinaryAnalysis::SymbolicExpr::Type::typeClass().

virtual VisitAction Rose::BinaryAnalysis::SymbolicExpr::Node::depthFirstTraversal ( Visitor ) const
pure virtual

Traverse the expression.

The expression is traversed in a depth-first visit. The final return value is the final return value of the last call to the visitor.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

virtual uint64_t Rose::BinaryAnalysis::SymbolicExpr::Node::nNodes ( ) const
pure virtual

Computes the size of an expression by counting the number of nodes.

Operates in constant time. Note that it is possible (even likely) for the 64-bit return value to overflow in expressions when many nodes are shared. For instance, the following loop will create an expression that contains more than 2^64 nodes:

SymbolicExpr expr = Leaf::createVariable(32);
for(size_t i=0; i<64; ++i)
expr = makeAdd(expr, expr)

When an overflow occurs the result is meaningless.

See also
nNodesUnique

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

uint64_t Rose::BinaryAnalysis::SymbolicExpr::Node::nNodesUnique ( ) const

Number of unique nodes in expression.

std::set<LeafPtr> Rose::BinaryAnalysis::SymbolicExpr::Node::getVariables ( ) const

Returns the variables appearing in the expression.

InteriorPtr Rose::BinaryAnalysis::SymbolicExpr::Node::isInteriorNode ( ) const

Dynamic cast of this object to an interior node.

Returns null if the cast is not valid.

Interior* Rose::BinaryAnalysis::SymbolicExpr::Node::isInteriorNodeRaw ( ) const

Dynamic cast of this object to an interior node.

Returns null if the cast is not valid.

Referenced by Rose::BinaryAnalysis::SymbolicExpr::substitute().

LeafPtr Rose::BinaryAnalysis::SymbolicExpr::Node::isLeafNode ( ) const

Dynamic cast of this object to a leaf node.

Returns null if the cast is not valid.

Leaf* Rose::BinaryAnalysis::SymbolicExpr::Node::isLeafNodeRaw ( ) const

Dynamic cast of this object to a leaf node.

Returns null if the cast is not valid.

bool Rose::BinaryAnalysis::SymbolicExpr::Node::isHashed ( ) const
inline

Returns true if this node has a hash value computed and cached.

The hash value zero is reserved to indicate that no hash has been computed; if a node happens to actually hash to zero, it will not be cached and will be recomputed for every call to hash().

Definition at line 803 of file SymbolicExpr.h.

Hash Rose::BinaryAnalysis::SymbolicExpr::Node::hash ( ) const

Returns (and caches) the hash value for this node.

If a hash value is not cached in this node, then a new hash value is computed and cached.

WithFormatter Rose::BinaryAnalysis::SymbolicExpr::Node::withFormat ( Formatter fmt)
inline

Combines a node with a formatter for printing.

This is used for convenient printing with the "<<" operator. For instance:

fmt.show_comments = Formatter::CMT_AFTER; //show comments after the variable
Ptr expression = ...;
std::cout <<"method 1: "; expression->print(std::cout, fmt); std::cout <<"\n";
std::cout <<"method 2: " <<expression->withFormat(fmt) <<"\n";
std::cout <<"method 3: " <<*expression+fmt <<"\n";

Definition at line 837 of file SymbolicExpr.h.

References Sawyer::SharedFromThis< Node >::sharedFromThis().

Referenced by operator+().

WithFormatter Rose::BinaryAnalysis::SymbolicExpr::Node::operator+ ( Formatter fmt)
inline

Combines a node with a formatter for printing.

This is used for convenient printing with the "<<" operator. For instance:

fmt.show_comments = Formatter::CMT_AFTER; //show comments after the variable
Ptr expression = ...;
std::cout <<"method 1: "; expression->print(std::cout, fmt); std::cout <<"\n";
std::cout <<"method 2: " <<expression->withFormat(fmt) <<"\n";
std::cout <<"method 3: " <<*expression+fmt <<"\n";

Definition at line 838 of file SymbolicExpr.h.

References withFormat().

virtual void Rose::BinaryAnalysis::SymbolicExpr::Node::print ( std::ostream &  ,
Formatter  
) const
pure virtual

Print the expression to a stream.

The output is an S-expression with no line-feeds. The format of the output is controlled by the mutable Formatter argument.

Implemented in Rose::BinaryAnalysis::SymbolicExpr::Leaf, and Rose::BinaryAnalysis::SymbolicExpr::Interior.

void Rose::BinaryAnalysis::SymbolicExpr::Node::print ( std::ostream &  o) const
inline

Print the expression to a stream.

The output is an S-expression with no line-feeds. The format of the output is controlled by the mutable Formatter argument.

Definition at line 846 of file SymbolicExpr.h.

References print().

Referenced by print().

std::string Rose::BinaryAnalysis::SymbolicExpr::Node::toString ( ) const

Convert expression to string.

void Rose::BinaryAnalysis::SymbolicExpr::Node::assertAcyclic ( ) const

Asserts that expressions are acyclic.

This is intended only for debugging.

std::vector<Ptr> Rose::BinaryAnalysis::SymbolicExpr::Node::findCommonSubexpressions ( ) const

Find common subexpressions.

Returns a vector of the largest common subexpressions. The list is computed by performing a depth-first search on this expression and adding expressions to the return vector whenever a subtree is encountered a second time. Therefore the if a common subexpression A contains another common subexpression B then B will appear earlier in the list than A.

bool Rose::BinaryAnalysis::SymbolicExpr::Node::matchAddVariableConstant ( LeafPtr variable,
LeafPtr constant 
) const

Determine whether an expression is a variable plus a constant.

If this expression is of the form V + X or X + V where V is an integer variable and X is an integer constant, return true and make variable point to the variable and constant point to the constant. If the expression is not one of these forms, then return false without modifying the arguments.

InteriorPtr Rose::BinaryAnalysis::SymbolicExpr::Node::isOperator ( Operator  ) const

True (non-null) if this node is the specified operator.

Member Data Documentation

unsigned Rose::BinaryAnalysis::SymbolicExpr::Node::flags_
protected

Bit flags.

Meaning of flags is up to the user. Low-order 16 bits are reserved.

Definition at line 463 of file SymbolicExpr.h.

Referenced by flags().

std::string Rose::BinaryAnalysis::SymbolicExpr::Node::comment_
protected

Optional comment.

Only for debugging; not significant for any calculation.

Definition at line 464 of file SymbolicExpr.h.

Referenced by comment().

Hash Rose::BinaryAnalysis::SymbolicExpr::Node::hashval_
mutableprotected

Optional hash used as a quick way to indicate that two expressions are different.

Definition at line 465 of file SymbolicExpr.h.

boost::any Rose::BinaryAnalysis::SymbolicExpr::Node::userData_
protected

Additional user-specified data.

This is not part of the hash.

Definition at line 466 of file SymbolicExpr.h.

Referenced by userData().

const unsigned Rose::BinaryAnalysis::SymbolicExpr::Node::RESERVED_FLAGS = 0x0000ffff
static

These flags are reserved for use within ROSE.

Definition at line 488 of file SymbolicExpr.h.

const unsigned Rose::BinaryAnalysis::SymbolicExpr::Node::INDETERMINATE = 0x00000001
static

Value is somehow indeterminate.

E.g., read from writable memory.

Definition at line 491 of file SymbolicExpr.h.

const unsigned Rose::BinaryAnalysis::SymbolicExpr::Node::UNSPECIFIED = 0x00000002
static

Value is somehow unspecified.

A value that is intantiated as part of processing a machine instruction where the ISA documentation is incomplete or says that some result is unspecified or undefined. Intel documentation for the x86 shift and rotate instructions, for example, states that certain status bits have "undefined" values after the instruction executes.

Definition at line 497 of file SymbolicExpr.h.

Referenced by Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue::instance_unspecified(), and Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::instance_unspecified().

const unsigned Rose::BinaryAnalysis::SymbolicExpr::Node::BOTTOM = 0x00000004
static

Value represents bottom in dataflow analysis.

If this flag is used by ROSE's dataflow engine to represent a bottom value in a lattice.

Definition at line 501 of file SymbolicExpr.h.

Referenced by Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue::instance_bottom(), and Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::instance_bottom().

boost::logic::tribool(* Rose::BinaryAnalysis::SymbolicExpr::Node::mayEqualCallback) (const Ptr &a, const Ptr &b, const SmtSolverPtr &)
static

User-supplied predicate to augment alias checking.

If this pointer is non-null, then the mayEqual methods invoke this function. If this function returns true or false, then its return value becomes the return value of mayEqual, otherwise mayEqual continues as it normally would. This user-defined function is invoked by mayEqual after trivial situations are checked and before any calls to an SMT solver. The SMT solver argument is optional (may be null).

Definition at line 521 of file SymbolicExpr.h.


The documentation for this class was generated from the following file: