Description
Base class for symbolic expression nodes.
Every node has a specified width measured in bits that is constant over the life of the node. The width is always a concrete, positive value stored in a 64-bit field. The corollary of this invariant is that if an expression's result width depends on the values of some of its arguments, those arguments must be concrete and not wider than 64 bits. Only a few operators fall into this category since most expressions depend on the widths of their arguments rather than the values of their arguments.
In order that subtrees can be freely assigned as children of other nodes (provided the structure as a whole remains a lattice and not a graph with cycles), two things are required: First, expression tree nodes are always referenced through shared-ownership pointers that collectively own the expression node (expressions are never explicitly deleted). Second, expression nodes are immutable once they're instantiated. There are a handful of exceptions to the immutable rule: comments and attributes are allowed to change freely since they're not significant to hashing or arithmetic operations.
Each node has a bit flags property, the bits of which are defined by the user. New nodes are created having all bits cleared unless the user specifies a value in the constructor. Bits are significant for hashing. Simplifiers produce result expressions whose bits are set in a predictable manner with the following rules:
- Simplification Discard Rule: If a simplification discards a subtree then that subtree does not contribute flags to the result. E.g., cancellation of terms in an
addoperation.
- Simplification Create Rule: If a simplification creates a new leaf node that doesn't depend on the input expression that new leaf node will have zero flags. E.g., XOR of an expression with itself; an add operation where all the terms cancel each other resulting in zero.
- Simplification Folding Rule: If a simplification creates a new expression from some combination of incoming expressions then the flags of the new expression are the union of the flags from the expressions on which it depends. E.g., constant folding, which is therefore consistent with the Interior Node Rule.
- Hashing Rule: User-defined flags are significant for hashing. E.g., structural equivalence will return false if the two expressions have different flags since structural equivalence uses hashes.
- Relational Operator Rule: Simplification of relational operators to produce a Boolean constant will act as if they are performing constant folding even if the simplification is on variables. E.g.,
(ule v1 v1)results in true with flags the same asv1.
Definition at line 458 of file SymbolicExpression.h.
#include <Rose/BinaryAnalysis/SymbolicExpression.h>
Classes | |
| class | WithFormatter |
| A node with formatter. More... | |
Public Types | |
| using | EquivPairs = std::map< Node *, std::vector< std::pair< Node *, bool >>> |
 Public Types inherited from Sawyer::Attribute::Storage<> | |
| typedef SynchronizationTraits< Sawyer::SingleThreadedTag > | Sync |
Public Member Functions | |
| Type | type () const |
| Type of value. More... | |
| virtual bool | mustEqual (const Ptr &other, const SmtSolverPtr &solver=SmtSolverPtr())=0 |
| Returns true if two expressions must be equal (cannot be unequal). More... | |
| virtual bool | mayEqual (const Ptr &other, const SmtSolverPtr &solver=SmtSolverPtr())=0 |
| Returns true if two expressions might be equal, but not necessarily be equal. More... | |
| virtual bool | isEquivalentTo (const Ptr &other)=0 |
| Tests two expressions for structural equivalence. More... | |
| virtual int | compareStructure (const Ptr &other)=0 |
| Compare two expressions structurally for sorting. More... | |
| virtual Ptr | substitute (const Ptr &from, const Ptr &to, const SmtSolverPtr &solver=SmtSolverPtr())=0 |
| Substitute one value for another. More... | |
| Ptr | substituteMultiple (const ExprExprHashMap &substitutions, const SmtSolverPtr &solver=SmtSolverPtr()) |
| Rewrite expression by substituting subexpressions. More... | |
| Ptr | renameVariables (ExprExprHashMap &index, size_t &nextVariableId, const SmtSolverPtr &solver=SmtSolverPtr()) |
| Rewrite using lowest numbered variable names. More... | |
| virtual Operator | getOperator () const =0 |
| Operator for interior nodes. More... | |
| virtual size_t | nChildren () const =0 |
| Number of arguments. More... | |
| virtual const Nodes & | children () const =0 |
| Arguments. More... | |
| virtual Sawyer::Optional< uint64_t > | toUnsigned () const =0 |
| The unsigned integer value of the expression. More... | |
| virtual Sawyer::Optional< int64_t > | toSigned () const =0 |
| The signed integer value of the expression. More... | |
| bool | isIntegerExpr () const |
| True if this expression is of an integer type. More... | |
| bool | isFloatingPointExpr () const |
| True if this expression is of a floating-point type. More... | |
| bool | isMemoryExpr () const |
| True if this expression is of a memory type. More... | |
| bool | isScalarExpr () const |
| True if the expression is a scalar type. More... | |
| virtual bool | isConstant () const =0 |
| True if this expression is a constant. More... | |
| bool | isIntegerConstant () const |
| True if this expression is an integer constant. More... | |
| bool | isFloatingPointConstant () const |
| True if this epxression is a floating-point constant. More... | |
| bool | isScalarConstant () const |
| True if this expression is a scalar constant. More... | |
| bool | isFloatingPointNan () const |
| True if this expression is a floating-point NaN constant. More... | |
| virtual bool | isVariable2 () const =0 |
| True if this expression is a variable. More... | |
| Sawyer::Optional< uint64_t > | variableId () const |
| Variable ID number. More... | |
| bool | isIntegerVariable () const |
| True if this expression is an integer variable. More... | |
| bool | isFloatingPointVariable () const |
| True if this expression is a floating-point variable. More... | |
| bool | isMemoryVariable () const |
| True if this expression is a memory state variable. More... | |
| bool | isScalarVariable () const |
| True if this expression is a scalar variable. More... | |
| size_t | nBits () const |
| Property: Number of significant bits. More... | |
| unsigned | flags () const |
| Property: User-defined bit flags. More... | |
| Ptr | newFlags (unsigned flags) const |
| Sets flags. More... | |
| size_t | domainWidth () const |
| Property: Width for memory expressions. More... | |
| bool | isScalar () const |
| Check whether expression is scalar. More... | |
| virtual VisitAction | depthFirstTraversal (Visitor &) const =0 |
| Traverse the expression. More... | |
| virtual uint64_t | nNodes () const =0 |
| Computes the size of an expression by counting the number of nodes. More... | |
| uint64_t | nNodesUnique () const |
| Number of unique nodes in expression. More... | |
| std::set< LeafPtr > | getVariables () const |
| Returns the variables appearing in the expression. More... | |
| bool | isHashed () const |
| Returns true if this node has a hash value computed and cached. More... | |
| Hash | hash () const |
| Returns (and caches) the hash value for this node. More... | |
| void | hash (Hash) const |
| std::string | toString () const |
| Convert expression to string. More... | |
| void | assertAcyclic () const |
| Asserts that expressions are acyclic. More... | |
| std::vector< Ptr > | findCommonSubexpressions () const |
| Find common subexpressions. More... | |
| bool | matchAddVariableConstant (LeafPtr &variable, LeafPtr &constant) const |
| Determine whether an expression is a variable plus a constant. More... | |
| InteriorPtr | isOperator (Operator) const |
| True (non-null) if this node is the specified operator. More... | |
| virtual bool | isEquivalentHelper (Node *, EquivPairs &)=0 |
| virtual const Ptr & | child (size_t idx) const =0 |
| Argument. More... | |
| virtual const Node * | childRaw (size_t idx) const =0 |
| Argument. More... | |
| const std::string & | comment () const |
| Property: Comment. More... | |
| void | comment (const std::string &s) |
| Property: Comment. More... | |
| void | userData (boost::any &data) |
| Property: User-defined data. More... | |
| const boost::any & | userData () const |
| Property: User-defined data. More... | |
| InteriorPtr | isInteriorNode () const |
| Dynamic cast of this object to an interior node. More... | |
| Interior * | isInteriorNodeRaw () const |
| Dynamic cast of this object to an interior node. More... | |
| LeafPtr | isLeafNode () const |
| Dynamic cast of this object to a leaf node. More... | |
| Leaf * | isLeafNodeRaw () const |
| Dynamic cast of this object to a leaf node. More... | |
| WithFormatter | withFormat (Formatter &fmt) |
| Combines a node with a formatter for printing. More... | |
| WithFormatter | operator+ (Formatter &fmt) |
| Combines a node with a formatter for printing. More... | |
| virtual void | print (std::ostream &, Formatter &) const =0 |
| Print the expression to a stream. More... | |
| void | print (std::ostream &o) const |
| Print the expression to a stream. More... | |
| Public Member Functions inherited from Sawyer::SharedObject | |
| SharedObject () | |
| Default constructor. More... | |
| SharedObject (const SharedObject &) | |
| Copy constructor. More... | |
| virtual | ~SharedObject () |
| Virtual destructor. More... | |
| SharedObject & | operator= (const SharedObject &) |
| Assignment. More... | |
| Public Member Functions inherited from Sawyer::SharedFromThis< Node > | |
| SharedPointer< Node > | sharedFromThis () |
Create a shared pointer from this. More... | |
| SharedPointer< const Node > | sharedFromThis () const |
Create a shared pointer from this. More... | |
| Public Member Functions inherited from Sawyer::Attribute::Storage<> | |
| Storage () | |
| Default constructor. More... | |
| Storage (const Storage &other) | |
| Copy constructor. More... | |
| Storage & | operator= (const Storage &other) |
| Assignment operator. More... | |
| bool | attributeExists (Id id) const |
| Check attribute existence. More... | |
| void | eraseAttribute (Id id) |
| Erase an attribute. More... | |
| void | clearAttributes () |
| Erase all attributes. More... | |
| void | setAttribute (Id id, const T &value) |
| Store an attribute. More... | |
| bool | setAttributeMaybe (Id id, const T &value) |
| Store an attribute if not already present. More... | |
| T | getAttribute (Id id) const |
| Get an attribute that is known to exist. More... | |
| T | attributeOrElse (Id id, const T &dflt) const |
| Return an attribute or a specified value. More... | |
| T | attributeOrDefault (Id id) const |
| Return an attribute or a default-constructed value. More... | |
| Sawyer::Optional< T > | optionalAttribute (Id id) const |
| Return the attribute as an optional value. More... | |
| size_t | nAttributes () const |
| Number of attributes stored. More... | |
| std::vector< Id > | attributeIds () const |
| Returns ID numbers for all IDs stored in this container. More... | |
Static Public Attributes | |
| static const unsigned | RESERVED_FLAGS = 0x0000ffff |
| These flags are reserved for use within ROSE. More... | |
| static const unsigned | INDETERMINATE = 0x00000001 |
| Value is somehow indeterminate. More... | |
| static const unsigned | UNSPECIFIED = 0x00000002 |
| Value is somehow unspecified. More... | |
| static const unsigned | BOTTOM = 0x00000004 |
| Value represents bottom in dataflow analysis. More... | |
| static boost::logic::tribool(* | mayEqualCallback )(const Ptr &a, const Ptr &b, const SmtSolverPtr &) |
| User-supplied predicate to augment alias checking. More... | |
Protected Member Functions | |
| Node (const std::string &comment, unsigned flags=0) | |
| void | printFlags (std::ostream &o, unsigned flags, char &bracket) const |
Protected Attributes | |
| Type | type_ |
| unsigned | flags_ |
| Bit flags. More... | |
| std::string | comment_ |
| Optional comment. More... | |
| Hash | hashval_ |
| Optional hash used as a quick way to indicate that two expressions are different. More... | |
| boost::any | userData_ |
| Additional user-specified data. More... | |
Additional Inherited Members | |
| Static Public Member Functions inherited from Sawyer::SmallObject | |
| static SynchronizedPoolAllocator & | poolAllocator () |
| Return the pool allocator for this class. More... | |
| static void * | operator new (size_t size) |
| static void | operator delete (void *ptr, size_t size) |
Member Function Documentation
|
inline |
Type of value.
Definition at line 516 of file SymbolicExpression.h.
Referenced by Rose::BinaryAnalysis::SymbolicExpression::Leaf::isFloatingPointVariable(), Rose::BinaryAnalysis::SymbolicExpression::Leaf::isIntegerVariable(), and Rose::BinaryAnalysis::SymbolicExpression::Leaf::isMemoryVariable().
|
pure virtual |
Returns true if two expressions must be equal (cannot be unequal).
If an SMT solver is specified then that solver is used to answer this question, otherwise equality is established by looking only at the structure of the two expressions. Two expressions can be equal without being the same width (e.g., a 32-bit constant zero is equal to a 16-bit constant zero).
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Returns true if two expressions might be equal, but not necessarily be equal.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Tests two expressions for structural equivalence.
Two leaf nodes are equivalent if they are the same width and have equal values or are the same variable. Two interior nodes are equivalent if they are the same width, the same operation, have the same number of children, and those children are all pairwise equivalent.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Compare two expressions structurally for sorting.
Returns -1 if this is less than other, 0 if they are structurally equal, and 1 if this is greater than other. This function returns zero when an only when isEquivalentTo returns zero, but isEquivalentTo can be much faster since it uses hashing.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Substitute one value for another.
Finds all occurrances of from in this expression and replace them with to. If a substitution occurs, then a new expression is returned. The matching of from to sub-parts of this expression uses structural equivalence, the isEquivalentTo predicate. The from and to expressions must have the same width.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
| Ptr Rose::BinaryAnalysis::SymbolicExpression::Node::substituteMultiple | ( | const ExprExprHashMap & | substitutions, |
| const SmtSolverPtr & | solver = SmtSolverPtr() |
||
| ) |
Rewrite expression by substituting subexpressions.
This expression is rewritten by doing a depth-first traversal. At each step of the traversal, the subexpression is looked up by hash in the supplied substitutions table. If found, a new expression is created using the value found in the table and the traversal does not descend into the new expression. If no substitutions were performed then this expression is returned, otherwise a new expression is returned. An optional solver, which may be null, is used during the simplification step.
| Ptr Rose::BinaryAnalysis::SymbolicExpression::Node::renameVariables | ( | ExprExprHashMap & | index, |
| size_t & | nextVariableId, | ||
| const SmtSolverPtr & | solver = SmtSolverPtr() |
||
| ) |
Rewrite using lowest numbered variable names.
Given an expression, use the specified index to rewrite variables. The index uses expression hashes to look up the replacement expression. If the traversal finds a variable which is not in the index then a new variable is created. The new variable has the same type as the original variable, but it's name is generated starting at nextVariableId and incrementing after each replacement is generated. The optional solver is used during the simplification process and may be null.
|
pure virtual |
Operator for interior nodes.
Return the operator for interior nodes, or OP_NONE for leaf nodes that have no operator.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Number of arguments.
Returns the number of children for an interior node, zero for leaf nodes.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Argument.
Returns the specified argument by index. If the index is out of range, then returns null. A leaf node always returns null since it never has children.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Argument.
Returns the specified argument by index. If the index is out of range, then returns null. A leaf node always returns null since it never has children.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Arguments.
Returns the arguments of an operation for an interior node, or an empty list for a leaf node.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
The unsigned integer value of the expression.
Returns nothing if the expression is not a concrete integer value or the value is too wide to be represented by the return type.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
The signed integer value of the expression.
Returns nothing if the expression is not a concrete integer value or the value doesn't fit in the return type.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
inline |
True if this expression is of an integer type.
Definition at line 615 of file SymbolicExpression.h.
References Rose::BinaryAnalysis::SymbolicExpression::Type::INTEGER, and Rose::BinaryAnalysis::SymbolicExpression::Type::typeClass().
Referenced by isIntegerConstant(), isIntegerVariable(), and isScalarExpr().
|
inline |
True if this expression is of a floating-point type.
Definition at line 620 of file SymbolicExpression.h.
References Rose::BinaryAnalysis::SymbolicExpression::Type::FP, and Rose::BinaryAnalysis::SymbolicExpression::Type::typeClass().
Referenced by isFloatingPointConstant(), isFloatingPointVariable(), and isScalarExpr().
|
inline |
True if this expression is of a memory type.
Definition at line 625 of file SymbolicExpression.h.
References Rose::BinaryAnalysis::SymbolicExpression::Type::MEMORY, and Rose::BinaryAnalysis::SymbolicExpression::Type::typeClass().
Referenced by isMemoryVariable().
|
inline |
True if the expression is a scalar type.
Integers and floating-point expressions are scalar, memory is not.
Definition at line 632 of file SymbolicExpression.h.
References isFloatingPointExpr(), and isIntegerExpr().
|
pure virtual |
True if this expression is a constant.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
Referenced by isFloatingPointConstant(), and isIntegerConstant().
|
inline |
True if this expression is an integer constant.
Definition at line 640 of file SymbolicExpression.h.
References isConstant(), and isIntegerExpr().
Referenced by isScalarConstant().
|
inline |
True if this epxression is a floating-point constant.
Definition at line 645 of file SymbolicExpression.h.
References isConstant(), and isFloatingPointExpr().
Referenced by isScalarConstant().
|
inline |
True if this expression is a scalar constant.
Integer and floating-point constants are scalar.
Definition at line 652 of file SymbolicExpression.h.
References isFloatingPointConstant(), and isIntegerConstant().
| bool Rose::BinaryAnalysis::SymbolicExpression::Node::isFloatingPointNan | ( | ) | const |
True if this expression is a floating-point NaN constant.
|
pure virtual |
True if this expression is a variable.
Warning: Leaf nodes have a deprecated isVariable method that returns false for memory state variables, thus this method has a "2" appended to its name. After a suitable period of deprecation for Leaf::isVariable, a new isVariable will be added to this class hiearchy and will have the same semantics as isVariable2, which will become deprecated.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
Referenced by isFloatingPointVariable(), isIntegerVariable(), and isMemoryVariable().
| Sawyer::Optional<uint64_t> Rose::BinaryAnalysis::SymbolicExpression::Node::variableId | ( | ) | const |
Variable ID number.
If this expression is a variable then returns the variable ID number, otherwise nothing.
|
inline |
True if this expression is an integer variable.
Definition at line 672 of file SymbolicExpression.h.
References isIntegerExpr(), and isVariable2().
Referenced by isScalarVariable().
|
inline |
True if this expression is a floating-point variable.
Definition at line 677 of file SymbolicExpression.h.
References isFloatingPointExpr(), and isVariable2().
Referenced by isScalarVariable().
|
inline |
True if this expression is a memory state variable.
Definition at line 682 of file SymbolicExpression.h.
References isMemoryExpr(), and isVariable2().
|
inline |
True if this expression is a scalar variable.
Integer and floating-point variables are scalar, memory variables are not.
Definition at line 689 of file SymbolicExpression.h.
References isFloatingPointVariable(), and isIntegerVariable().
|
inline |
Property: Comment.
Comments can be changed after a node has been created since the comment is not intended to be used for anything but annotation and/or debugging. If many expressions are sharing the same node, then the comment is changed in all those expressions. Changing the comment property is allowed even though nodes are generally immutable because comments are not considered significant for comparisons, computing hash values, etc.
Definition at line 701 of file SymbolicExpression.h.
References comment_.
Referenced by Rose::BinaryAnalysis::SymbolicExpression::substitute().
|
inline |
Property: Comment.
Comments can be changed after a node has been created since the comment is not intended to be used for anything but annotation and/or debugging. If many expressions are sharing the same node, then the comment is changed in all those expressions. Changing the comment property is allowed even though nodes are generally immutable because comments are not considered significant for comparisons, computing hash values, etc.
Definition at line 704 of file SymbolicExpression.h.
|
inline |
Property: User-defined data.
User defined data is always optional and does not contribute to the hash value of an expression. The user-defined data can be changed at any time by the user even if the expression node to which it is attached is shared between many expressions.
Definition at line 716 of file SymbolicExpression.h.
|
inline |
Property: User-defined data.
User defined data is always optional and does not contribute to the hash value of an expression. The user-defined data can be changed at any time by the user even if the expression node to which it is attached is shared between many expressions.
Definition at line 719 of file SymbolicExpression.h.
References userData_.
|
inline |
Property: Number of significant bits.
An expression with a known value is guaranteed to have all higher-order bits cleared.
Definition at line 727 of file SymbolicExpression.h.
References Rose::BinaryAnalysis::SymbolicExpression::Type::nBits().
|
inline |
Property: User-defined bit flags.
This property is significant for hashing, comparisons, and possibly other operations, therefore it is immutable. To change the flags one must create a new expression; see newFlags.
Definition at line 735 of file SymbolicExpression.h.
References flags_.
Referenced by Rose::BinaryAnalysis::SymbolicExpression::substitute().
| Ptr Rose::BinaryAnalysis::SymbolicExpression::Node::newFlags | ( | unsigned | flags | ) | const |
Sets flags.
Since symbolic expressions are immutable it is not possible to change the flags directly. Therefore if the desired flags are different than the current flags a new expression is created that is the same in every other respect. If the flags are not changed then the original expression is returned.
|
inline |
Property: Width for memory expressions.
The return value is non-zero if and only if this tree node is a memory expression.
Definition at line 747 of file SymbolicExpression.h.
References Rose::BinaryAnalysis::SymbolicExpression::Type::addressWidth().
|
inline |
Check whether expression is scalar.
Everything is scalar except for memory.
Definition at line 754 of file SymbolicExpression.h.
References Rose::BinaryAnalysis::SymbolicExpression::Type::MEMORY, and Rose::BinaryAnalysis::SymbolicExpression::Type::typeClass().
|
pure virtual |
Traverse the expression.
The expression is traversed in a depth-first visit. The final return value is the final return value of the last call to the visitor.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
pure virtual |
Computes the size of an expression by counting the number of nodes.
Operates in constant time. Note that it is possible (even likely) for the 64-bit return value to overflow in expressions when many nodes are shared. For instance, the following loop will create an expression that contains more than 2^64 nodes:
When an overflow occurs the result is meaningless.
- See also
- nNodesUnique
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
| uint64_t Rose::BinaryAnalysis::SymbolicExpression::Node::nNodesUnique | ( | ) | const |
Number of unique nodes in expression.
| std::set<LeafPtr> Rose::BinaryAnalysis::SymbolicExpression::Node::getVariables | ( | ) | const |
Returns the variables appearing in the expression.
| InteriorPtr Rose::BinaryAnalysis::SymbolicExpression::Node::isInteriorNode | ( | ) | const |
Dynamic cast of this object to an interior node.
Returns null if the cast is not valid.
| Interior* Rose::BinaryAnalysis::SymbolicExpression::Node::isInteriorNodeRaw | ( | ) | const |
Dynamic cast of this object to an interior node.
Returns null if the cast is not valid.
Referenced by Rose::BinaryAnalysis::SymbolicExpression::substitute().
| LeafPtr Rose::BinaryAnalysis::SymbolicExpression::Node::isLeafNode | ( | ) | const |
Dynamic cast of this object to a leaf node.
Returns null if the cast is not valid.
| Leaf* Rose::BinaryAnalysis::SymbolicExpression::Node::isLeafNodeRaw | ( | ) | const |
Dynamic cast of this object to a leaf node.
Returns null if the cast is not valid.
|
inline |
Returns true if this node has a hash value computed and cached.
The hash value zero is reserved to indicate that no hash has been computed; if a node happens to actually hash to zero, it will not be cached and will be recomputed for every call to hash().
Definition at line 808 of file SymbolicExpression.h.
| Hash Rose::BinaryAnalysis::SymbolicExpression::Node::hash | ( | ) | const |
Returns (and caches) the hash value for this node.
If a hash value is not cached in this node, then a new hash value is computed and cached.
|
inline |
Combines a node with a formatter for printing.
This is used for convenient printing with the "<<" operator. For instance:
Definition at line 842 of file SymbolicExpression.h.
References Sawyer::SharedFromThis< Node >::sharedFromThis().
Referenced by operator+().
|
inline |
Combines a node with a formatter for printing.
This is used for convenient printing with the "<<" operator. For instance:
Definition at line 843 of file SymbolicExpression.h.
References withFormat().
|
pure virtual |
Print the expression to a stream.
The output is an S-expression with no line-feeds. The format of the output is controlled by the mutable Formatter argument.
Implemented in Rose::BinaryAnalysis::SymbolicExpression::Leaf, and Rose::BinaryAnalysis::SymbolicExpression::Interior.
|
inline |
Print the expression to a stream.
The output is an S-expression with no line-feeds. The format of the output is controlled by the mutable Formatter argument.
Definition at line 851 of file SymbolicExpression.h.
References print().
Referenced by print().
| std::string Rose::BinaryAnalysis::SymbolicExpression::Node::toString | ( | ) | const |
Convert expression to string.
| void Rose::BinaryAnalysis::SymbolicExpression::Node::assertAcyclic | ( | ) | const |
Asserts that expressions are acyclic.
This is intended only for debugging.
| std::vector<Ptr> Rose::BinaryAnalysis::SymbolicExpression::Node::findCommonSubexpressions | ( | ) | const |
Find common subexpressions.
Returns a vector of the largest common subexpressions. The list is computed by performing a depth-first search on this expression and adding expressions to the return vector whenever a subtree is encountered a second time. Therefore the if a common subexpression A contains another common subexpression B then B will appear earlier in the list than A.
| bool Rose::BinaryAnalysis::SymbolicExpression::Node::matchAddVariableConstant | ( | LeafPtr & | variable, |
| LeafPtr & | constant | ||
| ) | const |
Determine whether an expression is a variable plus a constant.
If this expression is of the form V + X or X + V where V is an integer variable and X is an integer constant, return true and make variable point to the variable and constant point to the constant. If the expression is not one of these forms, then return false without modifying the arguments.
| InteriorPtr Rose::BinaryAnalysis::SymbolicExpression::Node::isOperator | ( | Operator | ) | const |
True (non-null) if this node is the specified operator.
Member Data Documentation
|
protected |
Bit flags.
Meaning of flags is up to the user. Low-order 16 bits are reserved.
Definition at line 465 of file SymbolicExpression.h.
Referenced by flags().
|
protected |
Optional comment.
Only for debugging; not significant for any calculation.
Definition at line 466 of file SymbolicExpression.h.
Referenced by comment().
|
mutableprotected |
Optional hash used as a quick way to indicate that two expressions are different.
Definition at line 467 of file SymbolicExpression.h.
|
protected |
Additional user-specified data.
This is not part of the hash.
Definition at line 468 of file SymbolicExpression.h.
Referenced by userData().
|
static |
These flags are reserved for use within ROSE.
Definition at line 490 of file SymbolicExpression.h.
|
static |
Value is somehow indeterminate.
E.g., read from writable memory.
Definition at line 493 of file SymbolicExpression.h.
|
static |
Value is somehow unspecified.
A value that is intantiated as part of processing a machine instruction where the ISA documentation is incomplete or says that some result is unspecified or undefined. Intel documentation for the x86 shift and rotate instructions, for example, states that certain status bits have "undefined" values after the instruction executes.
Definition at line 499 of file SymbolicExpression.h.
Referenced by Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue::instance_unspecified(), and Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::instance_unspecified().
|
static |
Value represents bottom in dataflow analysis.
If this flag is used by ROSE's dataflow engine to represent a bottom value in a lattice.
Definition at line 503 of file SymbolicExpression.h.
Referenced by Rose::BinaryAnalysis::InstructionSemantics::TaintSemantics::SValue::instance_bottom(), and Rose::BinaryAnalysis::InstructionSemantics::SymbolicSemantics::SValue::instance_bottom().
|
static |
User-supplied predicate to augment alias checking.
If this pointer is non-null, then the mayEqual methods invoke this function. If this function returns true or false, then its return value becomes the return value of mayEqual, otherwise mayEqual continues as it normally would. This user-defined function is invoked by mayEqual after trivial situations are checked and before any calls to an SMT solver. The SMT solver argument is optional (may be null).
Definition at line 526 of file SymbolicExpression.h.
The documentation for this class was generated from the following file:
