Skip to content

goto-symex: support struct-keyed arrays (maps) in value materialisation#9065

Open
tautschnig wants to merge 1 commit into
developfrom
strata/symex-struct-keyed-maps
Open

goto-symex: support struct-keyed arrays (maps) in value materialisation#9065
tautschnig wants to merge 1 commit into
developfrom
strata/symex-struct-keyed-maps

Conversation

@tautschnig

@tautschnig tautschnig commented Jun 18, 2026

Copy link
Copy Markdown
Collaborator

Field-sensitivity and the value-set assume array indices are integer-typed. For arrays keyed by a struct (used to model heaps as Map Ref Struct), the from_integer-based index construction aborts. Gate is_divisible/get_fields to integer/bitvector/enum index types, and relax value_sett::assign array type-equality to allow arrays with the same element type but differing size (unbounded heap maps).

  • Each commit message has a non-empty body, explaining why the change was made.
  • Methods or procedures I have added are documented, following the guidelines provided in CODING_STANDARD.md.
  • n/a The feature or user visible behaviour I have added or modified has been documented in the User Guide in doc/cprover-manual/
  • Regression or unit tests are included, or existing tests cover the modified code (in this case I have detailed which ones those are in the commit message).
  • n/a My commit message includes data points confirming performance improvements (if claimed).
  • My PR is restricted to a single feature or bugfix.
  • n/a White-space or formatting changes outside the feature-related changed lines are in commits of their own.

@tautschnig tautschnig self-assigned this Jun 18, 2026
Copilot AI review requested due to automatic review settings June 18, 2026 20:07

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR updates goto-symex field sensitivity and pointer-analysis value materialisation to support “map-like” arrays keyed by non-integer types (e.g., struct references), avoiding invalid integer-index enumeration and relaxing array type matching to ignore size differences.

Changes:

  • Treat arrays with non-scalar index types monolithically (skip element enumeration / field decomposition).
  • Relax value_sett::assign array type invariant to allow differing array sizes when element types match.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
src/pointer-analysis/value_set.cpp Allows assigning arrays with same element type but different sizes (for unbounded heap-map models).
src/goto-symex/field_sensitivity.cpp Prevents field-splitting / enumeration for arrays whose index types can’t be constructed via from_integer.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/pointer-analysis/value_set.cpp
Comment thread src/goto-symex/field_sensitivity.cpp Outdated
Comment thread src/goto-symex/field_sensitivity.cpp Outdated
@codecov

codecov Bot commented Jun 19, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 80.68%. Comparing base (7483d0d) to head (c996a37).

Files with missing lines Patch % Lines
src/goto-symex/field_sensitivity.cpp 85.71% 1 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff            @@
##           develop    #9065   +/-   ##
========================================
  Coverage    80.68%   80.68%           
========================================
  Files         1714     1714           
  Lines       189593   189600    +7     
  Branches        73       73           
========================================
+ Hits        152979   152988    +9     
+ Misses       36614    36612    -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Field-sensitivity and the value-set assume array indices are integer-typed.
For arrays keyed by a struct (used to model heaps as Map Ref Struct), the
from_integer-based index construction aborts. Gate get_fields/is_divisible on
an enumerable index type (integer/bitvector/enum) via a shared
is_enumerable_array_index_type() helper, so the two tightly-coupled predicates
cannot drift. Boolean index types are excluded: from_integer(i, bool)
collapses every i > 1 to true and would yield duplicate indices on
enumeration.

Relax the value_sett::assign array type-equality invariant to allow arrays
that share an element type but differ in size and index type. Array indices
are abstracted to exprt(ID_unknown, c_index_type()) on this path, so the index
type does not affect materialisation; the invariant message now states this
explicitly.

Co-authored-by: Kiro <kiro-agent@users.noreply.github.com>
@tautschnig tautschnig force-pushed the strata/symex-struct-keyed-maps branch from abda365 to c996a37 Compare June 24, 2026 19:46
@tautschnig tautschnig assigned kroening and unassigned tautschnig Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants