Class ConstraintState
At each program point, a ConstraintState maps each tracked variable to its
abstract value. Untracked variables are implicitly TopValue.INSTANCE.
Supports copy-on-write semantics for branch splitting — creating a new state from an existing one is cheap (shallow copy of the internal map).
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionvoidA loop body is being entered: nothing has been written in it yet.voidRecord that nothing is provable aboutsymbolhere.evaluateCondition(AbstractValue left, String operator, AbstractValue right) Evaluate a condition given the current state of two symbols/values.Get the abstract value for a symbol.The constant values that reach this point on SOME path; empty when nothing is provable.booleanisFreshInLoop(ISymbol symbol) True ifsymbolwas written, on every path here, since the innermost loop body was entered.booleanCheck if this state represents an unreachable program point.join(ConstraintState second) Join this state with another at a branch convergence point.joinRetainingMayOf(ConstraintState second) Join for a construct whose second state is GUARANTEED to have executed - the body of ado ... whileloop, or afinallyblock.voidmarkFreshInLoop(ISymbol symbol) Note thatsymbolwas written since the innermost loop body was entered (seefreshInLoop).voidMark this state as unreachable (BOTTOM).voidset(ISymbol symbol, AbstractValue abstractValue) Set the abstract value for a symbol (mutates this state).voidRecord thatsymboldefinitely holdsvaluehere, REPLACING anything it may have held before — a later write kills an earlier value on this path.voidRecord the full set of values that may reachsymbolhere, REPLACING what came before.snapshot()Create a snapshot (copy) of this state for branch splitting.toString()Every symbol this state holds anything about (a value or the values it may hold), as a copy.voidunmarkFreshInLoop(ISymbol symbol) symbolwas written with something other than a literal: what it holds may be what an earlier pass left in another variable, so it is no longer fresh (seefreshInLoop).
-
Constructor Details
-
ConstraintState
public ConstraintState()Create an empty constraint state.
-
-
Method Details
-
snapshot
Create a snapshot (copy) of this state for branch splitting. -
trackedSymbols
-
get
Get the abstract value for a symbol. Returns TOP if not tracked. -
set
Set the abstract value for a symbol (mutates this state). -
setMay
-
setMayAll
-
clearMay
Record that nothing is provable aboutsymbolhere. Clears rather than keeps, so a value that has been overwritten by something unknowable can never be reported as still arriving. -
getMay
-
markFreshInLoop
Note thatsymbolwas written since the innermost loop body was entered (seefreshInLoop). -
unmarkFreshInLoop
symbolwas written with something other than a literal: what it holds may be what an earlier pass left in another variable, so it is no longer fresh (seefreshInLoop). -
isFreshInLoop
True ifsymbolwas written, on every path here, since the innermost loop body was entered. -
clearFreshInLoop
public void clearFreshInLoop()A loop body is being entered: nothing has been written in it yet. -
markUnreachable
public void markUnreachable()Mark this state as unreachable (BOTTOM). Used after throw statements or contradictory conditions. -
isUnreachable
public boolean isUnreachable()Check if this state represents an unreachable program point. -
join
Join this state with another at a branch convergence point.If either state is unreachable (BOTTOM), the other state is used. Otherwise, for each variable, the joined value is the lattice join of both branch values. This state is the first branch's; neither is changed.
- Parameters:
second- the state from the second branch- Returns:
- a new joined state
-
joinRetainingMayOf
Join for a construct whose second state is GUARANTEED to have executed - the body of ado ... whileloop, or afinallyblock.The MUST side still joins with the first state: a body such as
n: n + 1produces a different constant on every iteration, so only TOP is sound there. The MAY side takes the second state ALONE - because that code definitely ran, a definition it overwrote can no longer reach the exit. Unioning the MAY sets here is precisely what makes an unconditional repair inside adobody fail to kill the breach it repairs.A body that assigns only CONDITIONALLY needs no special handling: the branch join inside that body has already unioned the surviving earlier value into its own MAY set.
This state is the one before the guaranteed code ran.
- Parameters:
second- the state after it ran - the sole source of the MAY side- Returns:
- joined MUST side, second's MAY side
-
evaluateCondition
Evaluate a condition given the current state of two symbols/values.- Parameters:
left- the abstract value of the left operandoperator- the comparison operatorright- the abstract value of the right operand- Returns:
- the condition evaluation result
-
toString
-