Class ConstraintState
At each program point, a ConstraintState maps each tracked variable to its
abstract value. Untracked variables are implicitly TopValue.INSTANCE.
Supports copy-on-write semantics for branch splitting — creating a new state from an existing one is cheap (shallow copy of the internal map).
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionvoidRecord that nothing is provable aboutsymbolhere.evaluateCondition(AbstractValue left, String operator, AbstractValue right) Evaluate a condition given the current state of two symbols/values.Get the abstract value for a symbol.The constant values that reach this point on SOME path; empty when nothing is provable.booleanCheck if this state represents an unreachable program point.static ConstraintStatejoin(ConstraintState first, ConstraintState second) Join this state with another at a branch convergence point.static ConstraintStatejoinRetainingMayOf(ConstraintState first, ConstraintState second) Join for a construct whose second state is GUARANTEED to have executed - the body of ado ... whileloop, or afinallyblock.voidMark this state as unreachable (BOTTOM).voidset(ISymbol symbol, AbstractValue abstractValue) Set the abstract value for a symbol (mutates this state).voidRecord thatsymboldefinitely holdsvaluehere, REPLACING anything it may have held before — a later write kills an earlier value on this path.voidRecord the full set of values that may reachsymbolhere, REPLACING what came before.snapshot()Create a snapshot (copy) of this state for branch splitting.toString()
-
Constructor Details
-
ConstraintState
public ConstraintState()Create an empty constraint state.
-
-
Method Details
-
snapshot
Create a snapshot (copy) of this state for branch splitting. -
get
Get the abstract value for a symbol. Returns TOP if not tracked. -
set
Set the abstract value for a symbol (mutates this state). -
setMay
-
setMayAll
-
clearMay
Record that nothing is provable aboutsymbolhere. Clears rather than keeps, so a value that has been overwritten by something unknowable can never be reported as still arriving. -
getMay
-
markUnreachable
public void markUnreachable()Mark this state as unreachable (BOTTOM). Used after throw statements or contradictory conditions. -
isUnreachable
public boolean isUnreachable()Check if this state represents an unreachable program point. -
join
Join this state with another at a branch convergence point.If either state is unreachable (BOTTOM), the other state is used. Otherwise, for each variable, the joined value is the lattice join of both branch values.
- Parameters:
first- the state from the first branchsecond- the state from the second branch- Returns:
- a new joined state
-
joinRetainingMayOf
Join for a construct whose second state is GUARANTEED to have executed - the body of ado ... whileloop, or afinallyblock.The MUST side still joins with the first state: a body such as
n: n + 1produces a different constant on every iteration, so only TOP is sound there. The MAY side takes the second state ALONE - because that code definitely ran, a definition it overwrote can no longer reach the exit. Unioning the MAY sets here is precisely what makes an unconditional repair inside adobody fail to kill the breach it repairs.A body that assigns only CONDITIONALLY needs no special handling: the branch join inside that body has already unioned the surviving earlier value into its own MAY set.
- Parameters:
first- the state before the guaranteed code ransecond- the state after it ran - the sole source of the MAY side- Returns:
- joined MUST side, second's MAY side
-
evaluateCondition
Evaluate a condition given the current state of two symbols/values.- Parameters:
left- the abstract value of the left operandoperator- the comparison operatorright- the abstract value of the right operand- Returns:
- the condition evaluation result
-
toString
-