h*Ysx      !"#$%&'()*+,-./0123 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X YZ[\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~                                                                                                                                                           ! " " " " " # # # $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ) * * * * * * * * * * * * * + + + , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , - - . / / / / / / / / / / / / / / / / / / / / / / / / / / 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 111222222222222222233333333333333333333333333333333333333333444450.75 (c) Galois, Inc 2014-2018BSD3 Safe-Inferred93crucibleThe 3 data structure captures the current state of assumptions made inside a 7.5crucible.Assumptions made at the top level of a solver.6crucibleA sequence of pushed frames, together with the assumptions that were made in each frame. The sequence is organized with newest frames on the end (right side) of the sequence.7crucibleA data-strucutre that can incrementally collect goals in context. It keeps track both of the collection of assumptions that lead to the current state, as well as any proof obligations incurred along the way.8crucibleA FrameIdentifier is a value that identifies an an assumption frame. These are expected to be unique when a new frame is pushed onto the stack. This is primarily a debugging aid, to ensure that stack management remains well-bracketed.:crucible>A collection of goals, which can represent shared assumptions.;crucibleMake an assumption that is in context for all the contained goals.<crucibleA proof obligation, to be proved in the context of all previously-made assumptions.=crucibleA conjunction of two goals.>crucibleA proof goal consists of a collection of assumptions that were in scope when an assertion was made, together with the given assertion.crucibleConstruct a goal that first assumes a collection of assumptions and then states a goal.Bcrucible Construct a : object from a collection of subgoals, all of which are to be proved. This yields  if the collection of goals is empty, and otherwise builds a conjunction of all the goals. Note that there is no new sharing in the resulting structure.Ccrucible'Helper to conjoin two possibly trivial : objects.DcrucibleRender the tree of goals as a list instead, duplicating shared assumptions over each goal as necessary.EcrucibleTraverse the structure of a : data structure. The function for visiting goals my decide to remove the goal from the structure. If no goals remain after the traversal, the resulting value will be a .In a call to 'traverseGoals assumeAction transformer goals', the arguments are used as follows:E8 is an action is called every time we encounter an ; constructor. The first argument is the original sequence of assumptions. The second argument is a continuation action. The result is a sequence of transformed assumptions and the result of the continuation action. assumeAction0 is a transformer action on goals. Return 6 if you wish to remove the goal from the overall tree.GcrucibleTraverse a sequence of : data structures. See E for an explanation of the action arguments. The resulting sequence may be shorter than the original if some : become trivial.HcrucibleVisit every goal in a : structure, remembering the sequence of assumptions along the way to that goal.Icrucible)A collector with no goals and no context.Jcrucible-Traverse the goals in a 'GoalCollector. See E0 for an explaination of the action arguments.KcrucibleTraverse the goals in a 7, keeping track, for each goal, of the assumptions leading to that goal.LcrucibleReturn a list of all the assumption frames in this goal collector. The first element of the pair is a collection of assumptions made unconditionaly at top level. The remaining list is a sequence of assumption frames, each consisting of a collection of assumptions made in that frame. Frames closer to the front of the list are older. A Q8 will remove the newest (rightmost) frame from the list.McrucibleMark the current frame. Using Q will unwind to here.Ocrucible2Add a new proof obligation to the current context.Pcrucible;Add a sequence of extra assumptions to the current context.QcruciblePop to the last push, or all the way to the top, if there were no more pushes. If the result is , then we popped until an explicitly marked push; in that case we return: )the frame identifier of the popped frame,$the assumptions that were forgotten,=any proof goals that were generated since the frame push, and+the state of the collector before the push.If the result is , then we popped all the way to the top, and the result is the goal tree, or  if there were no goals. Rcrucible"Get all currently collected goals.ScrucibleReset the goal collector to the empty assumption state; but first collect all the pending proof goals and stash them.TcrucibleThis operation restores the assumption state of the first given 7, overwriting the assumptions state of the second collector. However, all proof obligations in the second collector are retained and placed into the the first goal collector in the base assumption level.The end result is a goal collector that maintains all the active proof obligations of both collectors, and has the same assumption context as the first collector.UcrucibleRemove all collected proof obligations, but keep the current set of assumptions.Tcrucible The assumption state to restore crucible#The assumptions state to overwrite #>?@A:;<=DBCEFHG897IJKPOMQNUTSR3456L#>?@A:;<=DBCEFHG897IJKPOMQNUTSR3456L Trustworthy9YZYZ (c) Galois, Inc 2018BSD3!Rob Dockins  Safe-Inferred /01D`\crucibleAn assumption stack is a data structure for tracking logical assumptions and proof obligations. Assumptions can be added to the current stack frame, and stack frames may be pushed (to remember a previous state) or popped to restore a previous state.`crucible A single AssumptionFrame represents a collection of assumptions. They will later be rescinded when the associated frame is popped from the stack.ecrucible!Produce a fresh assumption stack.fcrucibleRecord the current state of the assumption stack in a data structure that can later be used to restore the current assumptions.NOTE! however, that proof obligations are NOT copied into the saved stack data. Instead, proof obligations remain only in the original AssumptionStack0 and the new stack has an empty obligation list.gcrucibleRestore a previously saved assumption stack. Any proof obligations in the saved stack will be copied into the assumption stack, which will also retain any proof obligations it had previously. A saved stack created with f will have no included proof obligations; restoring such a stack will have no effect on the current proof obligations.hcrucibleAdd the given collection logical assumptions to the current stack frame.icrucibleAdd a new proof obligation to the current collection of obligations based on all the assumptions currently in scope and the predicate in the given assertion.jcrucibleCollect all the assumptions currently in scope in this stack frame and all previously-pushed stack frames.kcrucible5Retrieve the current collection of proof obligations.lcrucible%Remove all pending proof obligations.mcrucible Reset the \ to an empty set of assumptions, but retain any pending proof obligations.ncruciblePush a new assumption frame on top of the stack. The returned FrameIdentifier can be used later to pop this frame. Frames must be pushed and popped in a coherent, well-bracketed way.ocruciblePop all frames up to and including the frame with the given identifier. The return value indicates how many stack frames were popped.pcruciblePop a previously-pushed assumption frame from the stack. All assumptions in that frame will be forgotten. The assumptions contained in the popped frame are returned.rcrucibleRun an action in the scope of a fresh assumption frame. The frame will be popped and returned on successful completion of the action. If the action raises an exception, the frame will be popped and discarded.$>?@A:;<=8`abc3456\]^_efgnpqomklirjhd$>?@A:;<=8`abc3456\]^_efgnpqomklirjhd 3Data structure the execution state of the simulator(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred)*/17Fwcrucible,Class for exceptions generated by simulator.ycrucibleWe can't do that (yet?). The call stack identifies where in the Haskell code the error occured.{crucibleAn assertion failed. The first parameter is a short description. The second is a more detailed explanation.|crucibleA loop iteration count, or similar resource limit, was exceeded. w|xyz{stuv}~ w|xyz{stuv}~(c) Galois, Inc 2014-2022BSD3!Joe Hendrix  Safe-Inferred"()*/019f>3crucibleThis class provides operations that interact with the symbolic simulator. It allows for logical assumptions/assertions to be added to the current path condition, and allows queries to be asked about branch conditions.The bak type contains all the datastructures necessary to maintain the current program path conditions, and keep track of assumptions and assertions made during program execution. The sym$ type is expected to satisfy the  constraints, which provide access to the What4 expression language. A sym is uniquely determined by a bak.cruciblePush a new assumption frame onto the stack. Assumptions and assertions made will now be associated with this frame on the stack until a new frame is pushed onto the stack, or until this one is popped.cruciblePop an assumption frame from the stack. The collected assumptions in this frame are returned. Pops are required to be well-bracketed with pushes. In particular, if the given frame identifier is not the identifier of the top frame on the stack, an error will be raised.cruciblePop all assumption frames up to and including the frame with the given frame identifier. This operation will panic if the named frame does not exist on the stack.cruciblePop an assumption frame from the stack. The collected assummptions in this frame are returned, along with any proof obligations that were incurred while the frame was active. Pops are required to be well-bracketed with pushes. In particular, if the given frame identifier is not the identifier of the top frame on the stack, an error will be raised.crucible'Add an assumption to the current state.crucible5Add a collection of assumptions to the current state.crucibleGet the current path condition as a predicate. This consists of the conjunction of all the assumptions currently in scope.crucible.Collect all the assumptions currently in scopecrucibleAdd a new proof obligation to the system. The proof may use the current path condition and assumptions. Note that this *DOES NOT* add the goal as an assumption. See also . Also note that predicates that concretely evaluate to True will be silently discarded. See  to avoid discarding goals.crucibleAdd a new proof obligation to the system which will persist throughout symbolic execution even if it is concretely valid. The proof may use the current path condition and assumptions. Note that this *DOES NOT* add the goal as an assumption. See also .crucible(Get the collection of proof obligations.crucibleForget the current collection of proof obligations. Presumably, we've already used  to save them somewhere else.crucibleCreate a snapshot of the current assumption state, that may later be restored. This is useful for supporting control-flow patterns that don't neatly fit into the stack push/pop model.crucible4Restore the assumption state to a previous snapshot.crucible2Reset the assumption state to a fresh, blank statecrucible4Class for backend type that can retrieve sym values.This is separate from  specifically to avoid the need for additional class constraints on the , operation, which is occasionally useful.crucibleRetrive the symbolic expression builder corresponding to this simulator backend.crucibleThis is used to signal that current execution path is infeasible.crucibleWe have discovered that the currently-executing branch is infeasible. The given program location describes the point at which infeasibility was discovered.crucibleAn assertion concretely failed.crucibleWe tried all possible cases for a variant, and now we should do something else.crucibleWe invoked a function which ends the current thread of execution (e.g., abort() or exit(1)).crucibleThis type tracks both logical assumptions and program events that are relevant when evaluating proof obligations arising from simulation.crucibleThis type describes events we can track during program execution.crucible9This event describes the creation of a symbolic variable.crucible?@A:;<=D\8>?@A:;<=DThe "simple" solver backend(c) Galois, Inc 2015-2016BSD3!Rob Dockins  provisional Safe-Inferred )*hcrucibleThis represents the state of the backend along a given execution. It contains the current assertion stack.  0  07A solver backend that maintains a persistent connection(c) Galois, Inc 2015-2016BSD3!Joe Hendrix  provisional Safe-Inferred)*7<ycrucible.Result of attempting to branch on a predicate.crucibleThe both branches of the predicate might be satisfiable (although satisfiablility of either branch is not guaranteed).crucibleCommit to the branch where the given predicate is equal to the returned boolean. The opposite branch is unsatisfiable (although the given branch is not necessarily satisfiable).crucibleThe context before considering the given predicate was already unsatisfiable.crucibleThis represents the state of the backend along a given execution. It contains the current assertions and program location.crucibleThe solver process, if any.crucible provisional Safe-Inferred()*/016crucible:A family of representatives for Crucible types. Parameter tp has kind .crucibleThis is a representation of floats that works at known fixed mantissa and exponent widths, but the symbolic backend may pick the representation.crucibleThis is a float with user-definable mantissa and exponent that maps directly to the what4 base type.crucibleA finite map from bitvector values to the given Crucible type. The  index gives the width of the bitvector values used to index the map.crucibleSequences of values, represented as linked lists of cons cells. Sequences only allow access to the front. Unlike Vectors, sequences of different lengths may be combined at join points.crucibleA finite (one-dimensional) sequence of values. Vectors are optimized for random-access indexing and updating. Vectors of different lengths may not be combined at join points.crucibleA variant is a disjoint union of the types listed in the context.crucibleA type for natural numbers.crucible!A type containing a single value Unit.crucibleA structure is an aggregate type consisting of a sequence of values. The type of each value is known statically.crucible%A partial map from strings to values.crucibleThe ' type lifted into Crucible expressions.crucible$The type of mutable reference cells.crucibleNamed intrinsic types. Intrinsic types are a way to extend the Crucible type system after-the-fact and add new type implementations. Core Crucible provides no operations on intrinsic types; they must be provided as built-in override functions. See the  6 typeclass and the  7 type family defined in "Lang.Crucible.Simulator.Intrinsics.crucibleNamed recursive types, named by the given symbol. To use recursive types you must provide an instance of the = class that gives the unfolding of this recursive type. The 8 and 9 operations witness the isomorphism between a recursive type and its one-step unrolling. Similar to Haskell's newtype, recursive types do not necessarily have to mention the recursive type being defined; in which case, the type is simply a new named type which is isomorphic to its definition.crucibleA function handle taking a context of formal arguments and a return type.crucibleA type index for floating point numbers, whose interpretation depends on the symbolic backend.crucible*A single character, as a 16-bit wide char.crucible3A dynamic type that can contain values of any type.crucibleThis data kind describes the types of values and expressions that can occur in Crucible CFGs.crucible:An injection of solver interface types into Crucible typescrucible3A dynamic type that can contain values of any type.crucible!A type containing a single value UnitcrucibleA type for natural numbers.crucibleA type index for floating point numbers, whose interpretation depends on the symbolic backend.crucible*A single character, as a 16-bit wide char.crucibleA function handle taking a context of formal arguments and a return typecrucibleThis typeclass is used to register recursive Crucible types with the compiler. This class defines, for a given symbol, both the type-level and the representative-level unrolling of a named recursive type.The symbol constitutes a unique compile-time identifier for the recursive type, allowing recursive types to be unrolled at run time without requiring dynamic checks. Parameter nm has kind .cruciblePattern synonym specifying bitvector TypeReprs. Intended to be use with type applications, e.g.,  KnownBV @32.crucible::  ->  -> .crucible::  -> .crucible::  -> .crucible::   -> .crucible:: .crucible:: .crucible::   -> .crucible::  -> .crucible::  -> .crucible::  -> .crucible::  ->   -> .crucible::  ->   -> .crucible::   ->  -> .crucible:: - -> .crucible:: .crucible:: .crucible::   -> .crucible::   ->  -> .crucible !:: FloatPrecision -> CrucibleTypecrucible:: .crucible::  -> .crucible:: .crucible:: .crucible::  -> .crucible:: .crucible::  -> . -,+*)(' !"#$%&./-,+*)(' !"#$%&./  Safe-Inferred")*1crucibleA symbolic sequence of values supporting efficent merge operations. Semantically, these are essentially cons-lists, and designed to support access from the front only. Nodes carry nonce values that allow DAG-based traversal, which efficently supports the common case where merged nodes share a common sublist.crucible Compute an ifthenelse on symbolic sequences. This will simply produce an internal merge node except in the special case where the then and else branches are sytactically identical.crucible.Compute the nonce of a sequence, if it has onecrucible Generate an empty sequence valuecrucible-Cons a new value onto the front of a sequencecrucibleAppend two sequencescrucible$Test if a sequence is nil (is empty)crucible Compute the length of a sequencecrucible-Compute the head of a sequence, if it has onecrucibleCompute both the head and the tail of a sequence, if it is nonemptycrucible-Compute the tail of a sequence, if it has onecrucibleVisit every element in the given symbolic sequence, applying the given action, and constructing a new sequence. The traversal is memoized, so any given subsequence will be visited at most once.crucibleUsing the given evaluation function for booleans, and an evaluation function for values, compute a concrete sequence corresponding to the given symbolic sequence.crucibleGiven a pretty printer for elements, print a symbolic sequence.cruciblefront sequence crucibleback sequence cruciblemux function on values cruciblemux function on values crucibleevaluation for booleans crucibleevaluation for values  .Basic definitions for defining intrinsic types(c) Galois, Inc 2015-2016BSD3!Rob Dockins  provisional Safe-Inferred)*01 crucible. is a map from symbol name representatives to  values. Such a map is useful for providing access to intrinsic type implementations that are not known statically at compile time.crucibleThe  datatype allows an  instance to be packaged up into a value. This allows us to get access to  instance methods (the  method in particular) at runtime even for symbol names that are not known statically.By packaging up a type class instance (rather than just providing some method with the same signature as ) we get the compiler to ensure that a single distinguished implementation is always used for each backend/symbol name combination. This prevents any possible confusion between different parts of the system.crucible(Sometimes it is convenient to provide a  as the type argument to , rather than the symbol and context. If you accidentally supply a non-! type, this family will be stuck.crucibleType family for intrinsic type representations. Intrinsic types are identified by a type-level , and this typeclass allows backends to define implementations for these types.>An instance of this class defines both an instance for the  type family (which defines the runtime representation for this intrinsic type) and also the  method (which defines how to merge to intrinsic values when the simulator reaches a merge point).Note: Instances of this will typically end up as orphan instances. This warning is normally quite important, as orphan instances allow one to define multiple instances for a particular class. However, in this case,  contains a type family, and GHC will globally check consistency of all type family instances. Consequently, there can be at most one implementation of  in a program.crucibleThe  type family defines, for a given backend and symbol name, the runtime implementation of that Crucible intrinsic type.crucibleThe push branch function is called when an intrinsic value is passed through a symbolic branch. This allows it to do any necessary bookkeeping to prepare for an upcoming merge. A push branch should eventually be followed by a matching abort or mux call.crucibleThe abort branch function is called when an intrinsic value reaches a merge point, but the sibling branch has aborted.crucibleThe  method defines the if-then-else operation that is used when paths are merged in the simulator and intrinsic types need to be used.crucibleAn empty collection of intrinsic types, for cases where no additional types are requiredcrucibleUtility function for reporting errors when improper Crucible type arguments are applied to an intrinsic type symbol.   Safe-Inferred )*1crucible"Used to allocate function handles.crucibleA function handle is a reference to a function in a given run of the simulator. It has a set of expected arguments and return type.crucibleA handle uniquely identifies a function. The signature indicates the expected argument types and the return type of the function.crucible%A unique identifier for the function.crucible1The name of the function (not necessarily unique)crucible$The arguments types for the functioncrucible The return type of the function.crucibleReturn type of handle.crucibleCreate a new handle allocator.crucible Safe-Inferred)*/016WcrucibleThe empty statement syntax extension, which adds no new syntactic forms.crucibleThe empty expression syntax extension, which adds no new syntactic forms.crucibleThis class captures all the grungy technical capabilities that are needed for syntax extensions. These capabilities allow syntax to be tested for equality, ordered, put into hashtables, traversed and printed, etc.The actual meat of implementing the semantics of syntax extensions is left to a later phase. See the  ExtensionImpl record defined in %Lang.Crucible.Simulator.ExecutionTree.  $Common CFG datastructure definitions(c) Galois, Inc 2014-2016BSD3!Joe Hendrix  Safe-Inferred1;crucibleA global variable.  Encode a set of enumerable elements using the bit-positions in an Integer(c) Galois, Inc 2015-2016BSD3!Joe Hendrix  provisional Safe-Inferred47A typeclass for monads equipped with a logging function(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred<crucibleThis class applies to monads that contain verbosity information, which is used to control the level of debugging messages presented to the user.cruciblePrint a message.crucible;Print a warning message when verbosity satisfies predicate.(c) Galois, Inc 2018BSD3!Rob Dockins  Safe-Inferred` crucibleA mux tree represents a collection of if-then-else branches over a collection of values. Generally, a mux tree is used to provide a way to conditionally merge values that otherwise do not naturally have a merge operation.crucibleCompute a binary boolean predicate between two mux trees. This operation decomposes the mux trees and compares all combinations of the underlying values, conditional on the path conditions leading to those values.crucible+Compute an equality predicate on mux trees.7NOTE! This assumes the equality relation defined by ) is the semantic equality relation on a.crucible+Compute a less-than predicate on mux trees.4NOTE! This assumes the order relation defined by & is the semantic order relation on a.crucible4Compute a less-than-or-equal predicate on mux trees.4NOTE! This assumes the order relation defined by & is the semantic order relation on a.crucible.Compute a greater-than predicate on mux trees.4NOTE! This assumes the order relation defined by & is the semantic order relation on a.crucible7Compute a greater-than-or-equal predicate on mux trees.4NOTE! This assumes the order relation defined by & is the semantic order relation on a.crucibleUse the provided if-then-else operation to collapse the given mux tree into its underlying type.crucibleApply a unary operation through a mux tree. The provided operation is applied to each leaf of the tree.crucibleApply a binary operation through two mux trees. The provided operation is applied pairwise to each leaf of the two trees, and appropriate path conditions are computed for the resulting values.crucible0Compute the if-then-else operation on mux trees.crucible-compute the predicate on the underlying type  'Runtime representation of CFG registers(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred)*1 crucible A class for s that have a mux function.crucible Version of  specialized to crucibleRepresents a function closure.crucibleA newtype wrapper around RegValue. This is wrapper necessary because RegValue is a type family and, as such, cannot be partially applied.crucible2Maps register types to the runtime representation.crucible provisional Safe-Inferredcrucible"A monad transformer that provides  MonadCont and  MonadState.  (c) Galois, Inc 2013-2016BSD3!Joe Hendrix  Safe-Inferred )*cruciblestructuralPretty tp' generates a function with the type forall f ann. (forall x. f x -> Doc ann) -> (forall x. tp f x -> Doc ann)# suitable for instantiating the  PrettyApp class.cruciblePattern match functionsExpression syntax definitions(c) Galois, Inc 2014-2016BSD3!Joe Hendrix  Safe-Inferred)*013DcrucibleThe main Crucible expression datastructure, defined as a multisorted algebra. Type  ext f tp encodes the top-level application of a Crucible expression. The parameter ext is used to indicate which syntax extension is being used via the  ExprExtension" type family. The type parameter tp is a type index that indicates the Crucible type of the values denoted by the given expression form. Parameter f is used everywhere a recursive sub-expression would go. Uses of the 0 type will tie the knot through this parameter.crucible(Return true if two base types are equal.crucibleSelect one or othercrucibleGenerate an "undefined" float value. The semantics of this construct are still under discussion, see crucible#366.crucibleGenerate an "undefined" bitvector value. The semantics of this construct are still under discussion, see crucible#366.crucibleThis performs signed division. The result is truncated to zero.TODO: Document semantics when divisor is zero and case of minSigned w / -1 = minSigned w.crucibleBase terms represent the subset of expressions of base types, packaged together with a run-time representation of their type.crucible4Return first or second value depending on condition.crucible5Return first or second number depending on condition.crucible4Return first or second value depending on condition.crucible4Return first or second value depending on condition.crucibleEquality on bitvectorscrucibleEquality on real numbers.crucibleEquality on integerscrucibleEquality on booleanscrucibleCompute a run-time representation of the type of an application.crucibleTraversal that performs the given action on each immediate subterm of an application. Used for the  instance.crucibleFold over an application.crucibleMap a Crucible-type-preserving function over the immediate subterms of an application.Provides a typeclass and methods for constructing AST expressions.(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred")*01 crucibleConvert value of type to Nat. This may be partial, it is the responsibility of the calling code that it is correct for this type.crucible5An expression that embeds literal values of its type.crucible8A typeclass for injecting applications into expressions.crucible0Inject an extension app into the expression typecrucible5Test if an expression is formed from an extension appcrucibleTrue expressioncrucibleFalse expressioncrucible&Get the entry from a zero-based index.crucible2Initialize the ident value map to the given value.cruciblenumber of bytes to writecruciblenumber of bytes to writecruciblenumber of bytes to loadcruciblenumber of bytes to loadcruciblenumber of bytes to loadcruciblenumber of bytes to load;;44444432Provides a representation of Crucible programs using mutable registers rather than SSA.(c) Galois, Inc 2014-2016BSD3!Joe Hendrix  provisional Safe-Inferred")*01**crucibleControl flow graph. This data type closes existentially over all the type parameters except ext.crucible& is a CFG with an arbitrary parameter s.crucible*A CFG using registers instead of SSA form. Parameter ext is the syntax extension, s< is a phantom type parameter identifying a particular CFG, init- is the list of input types of the CFG, and ret is the return type.crucible A basic block within a function.crucibleRegisters that are known to be needed as inputs for this block. For the first block, this includes the function arguments. It also includes registers read by this block before they are assigned. It does not include the lambda reg for lambda blocks.crucibleRegisters assigned by statements in block. This is a field so that its value can be memoized.crucibleStatement that terminates a basic block in a control flow graph.crucible Statement in control flow graph.crucible)Assert that the given expression is true.crucibleAssume the given expression.crucibleThe value of an assigned atom.crucible$An expression in RTL representation.The type arguments are: ext%the extensions currently in use (use () for no extension)sa dummy variable that should almost always be universally quantifiedtp#the Crucible type of the expressioncrucibleAn application of an expressioncrucibleAn evaluated expessioncrucibleA set of values.crucible(A value is either a register or an atom.crucible*A mutable value in the control flow graph.crucible:Position where register was declared (used for debugging).crucibleUnique identifier for register.crucibleType of register.crucibleAn expression in the control flow graph with a unique identifier. Unlike registers, atoms must be assigned exactly once.crucible:Position where register was declared (used for debugging).crucibleUnique identifier for atom.crucible$How the atom expression was defined.crucible"Identifies what generated an atom.crucibleInput argument to function. They are ordered before other inputs to a program.crucibleValue passed into a lambda label. This must appear after other expressions.crucibleA label for a block is either a standard label, or a label expecting an input.crucibleA label for a block that expects an argument of a specific type.crucible9Nonce that uniquely identifies this label within the CFG.crucible'The atom to store the output result in.3Note. This must be lazy to break a recursive cycle.crucible2A label for a block that does not expect an input.crucible7Print list of documents separated by commas and spaces.crucibleFold over all values in an .crucible1Return local value assigned by this statement or Nothing% if this does not modify a register.crucible*Fold all registers that are inputs tostmt.crucible4Provide all registers in term stmt to fold function.crucibleReturns the set of registers appearing as inputs to a terminal statement.crucibleReturns the next labels for the given block. Error statements have no next labels, while return/tail call statements return .crucibleRename all the atoms, labels, and other named things in the CFG. Useful for rewriting, since the names can be generated from a nonce generator the client controls (and can thus keep using to generate fresh names).crucibleRun a computation along all of the paths in a cfg, without taking backedges.The computation has access to an environment that is specific to the current path being explored, as well as a global environment that is maintained across the entire computation.crucibleRun a computation along all of the paths in a cfg, without taking backedges.The computation has access to an environment that is specific to the current path being explored, as well as a global environment that is maintained across the entire computation.Each step of the computation inspects the global- and path-environments as well as the current block, and returns new environments.crucible8Extra inputs to block (only non-empty for initial block)-Operations for manipulating registerized CFGs(c) Galois, Inc 2014-2018BSD3#Luke Maurer  provisional Safe-Inferred)*1PcrucibleMonad providing operations for modifying a basic block by adding statements and/or splicing in conditional braches. Also provides a ! instance for storing user state.crucibleAdd statements to each block in a CFG according to the given instrumentation functions. See the 4 monad for the operations provided for adding code.crucible,Add a new statement at the current position.crucibleAdd a new statement at the current position, marking it as internally generated.crucibleAdd a conditional at the current position. This will cause the current block to end and new blocks to be generated for the two branches and the remaining statements in the original block.crucibleCreate a new atom with a freshly allocated id. The id will not have been used anywhere in the original CFG.crucible?Return the output of a writer action without passing it onward.crucibleInitial user statecrucibleAction to run on each non-terminating statement; must explicitly add the original statement back if desiredcrucible+Action to run on each terminating statementcrucibleGraph to rewrite(Provides transformations on pre-SSA CFGs(c) Galois, Inc 2020BSD3 experimental Safe-Inferred"()*01 %crucibleUsed as a substitution between labels. Closes over the type of LambdaLabelscrucible Merging PathsThis is a record used to construct/manage the variant type that the router block will use to switch on. The important piece is the map that relates blockIDs to an index into the variant type's ctx -- with this map we can associate a _value_ of the variant type with a given blockIDcrucible$Undefined Value Fixup TransformationA PartialValue of type t closes over a register of type Maybe tcrucibleNatural Loop AnalysisThis structure identifies natural loops. Natural loops are either disjoint from each other, nested, or they share the same header.crucible1This is the block with a backedge (to the header)crucible(This is the destination of the backedge.crucibleThe loop members, which is the set of nodes that can reach the footer without going through the header.crucibleAn exiting edge is an edge from a node in the loop to an edge not in the loop. An early exit is such an edge from a node that is not the footer node.crucibleAll the edges to the footercrucible"The dominators of the loop header.crucibleDetect all loops in a cfg. The assumption is that two backedges in a cfg will have distinct destination blocks. If this assumption does not hold, then return the empty list.crucibleIs li1 nested in li2crucibleReturn all loops in g, which are edges from a node in g to a dominator of that node.crucibleReturn any edges from n to a dominator of n, n' . The edge n to n' is a loop.crucibleThe members of a loop are just those nodes dominated by the header that can reach the header againcrucibleView a blockID as a nodecrucible)Compute the successor nodes of this blockcrucible3Returns the edges from this block to its successorscrucibleUndefined Value Fixup pass The merge-block insertion process introduces infeasible paths along which some registers may be undefined: this will later be interpreted as a block input in the SSA transformation. To avoid this, we introduce a pass to replace registers/atoms that may be undefined along some path with a partial register (i.e. of type Maybe t).Assuming that the input CFG has no paths along which a value is read before being written, the paths along which the reference is read but never written are a subset of the infeasible paths.crucibleFixup the reads and writes in a block. This means, for each value in the domain of the ValueToPartialMap argument, 1. If the value is read, then find the associated partial value register and read that instead 2. Dually, if the value is written, then write that value to the associated partial value register.crucibleThe atom in a lambda ID is essentially an 'atom definition', so we need to check if this lambda's atom needs to be lowered.crucible8Jumping to a block with a value a la Output is akin to reading the atom, so if we already lifted the original value of type T to a (Maybe T), we need to convert it back to a T here.crucibleReplace each write of a possibly-undef atom/register to a write of the associated partial register by injecting it into a value of Maybe type.crucibleReplace each read of a lowered atom/register to a read of the associated register + projection from MaybecrucibleReplace each read of a lowered atom to a read of the associated register + projection from MaybecrucibleGiven an atom a of type t: whose definition we've already replaced with a register r of type Maybe t&, produce the statements to 1. read r into a fresh a' 2. set fresh a'' to  fromJust a' returns a mapping from a to a' and the abovecruciblelowerRegRead ng pos a pr constructs a' := pr; a := fromJust a'.crucibleTraverse all dfs paths, avoiding backedges, to find values that may be read but not written. Returns: 1. a mapping from values of type t$ to corresponding registers of type Maybe t 2. statements to initialize the registers mentioned in said mapping.crucibleGiven a value v of type t, create a new register r of type Maybe t-. This function returns 1. the mapping from v to such an r, as well as the stmts that will initialize r to Nothing : Maybe t.crucibleThis is the main pass that attempts to optimize early exits in the loops in a CFG. In particular, this transformation ensures that the postdominator of the loop header is a member of the loop.6Given a natural loop, its members are a set of blocks bs4. Let the exit edges be the edges from some block b in bs- to either the loop header or a block not in bs.Let (i, j) be such an exit edge.This transofrmation inserts a new block r such that in the transformed cfg there is an edge (i, r) and an edge (r, j). Moreover, the transformation ensures that [i, r, j'] is not feasible for j' != j. This works by setting a "destination" register d := j in each block i for each exit edge (i, j), and switching on the value of d in the block r.crucible&Apply the transformation described in earlyMergeLoops to a single loop.crucibleGiven a set of edges (i, j) in E, Create a single block that merges all paths before continuing on to the respective j'sCreate a unique block F and multiple blocks i' j' such that i -> i' -> F -> j' -> j. This function defines a register 'r : () + () + ... + ()' Each j corresponds to one of these tags, so each i' sets r to indicate which j to jump to, and F switches on r. Each j' is a lambda block that jumps to the original j.E.g. given i0 -> j0, i1 -> j0, i2 -> j1, then i0' = r := inj(0, ()); jump F i1' = r := inj(0, ()); jump F i2' = r := inj(1, ()); jump F F = switch r { 0: j0', 1: j1' } j0' = jump j0 j1' = jump j1crucibleGiven a list of blocks, build a record of a variant type such that each injection is associated with a single block.crucible(This function does most of the work for  funnelPaths). In particular, given a list of blocks b0...bn, it constructs a single r , a list  b_in0...b_inn, and a list  b_out0...b_outn such that b_in_i jump to r, and r jumps to the corresponding  b_out_i@.The return value is a pair of (1) A list of BlockIDPairs, which should be understood as a substitution on labels. This is necessary since we are introducing *new* blocks to replace *old* jump targets. This substitution is used to update the old jump targets (2) A list of newly created blockscrucibleCreate a block that switches on a register. This does the work of allocating the new label and discriminant registercrucible0This creates a block that to be substituted for origID. This block will set the given register to the injection given by destIdx0, and then jump to a router block (described in  routePaths ) that will switch on this register. crucibleGenerally useful helperscrucible entry nodecrucible the graphcrucible DominatorscrucibleThe graph itselfcrucible&The root node to inspect for backedgescrucible A loop is an edge to a dominatorcrucible1The position we should use for the new statementscrucibleThe atom we're defininigcrucible!The partial register to read fromcrucible,the variant info should map each element of outs to an index into ctxcrucible3the blocks that we want to join & then fan out fromcrucibleThe register we will switch oncrucible*The ID of the block we're substituting forcrucible*Which injection in the variant type to usecrucibleThe label of the router blockSSA-based control flow graphs(c) Galois, Inc 2014-2016BSD3!Joe Hendrix  Safe-Inferred)*013crucibleControl flow graph. This data type closes existentially over all the type parameters except ext.crucibleControl flow graph with some blocks. This data type closes existentially over the blocks type parameter.crucible.Class for types that embed a CFG of some sort.crucibleA CFG consists of:a function handle, uniquely identifying the function this CFG implements;6a block map, representing the main CFG data structure;/and the identifier of the function entry point.The blocks type parameter maps each block identifier to the formal arguments it expects. The init type parameter identifies the formal arguments of the function represented by this control-flow graph, which correspond to the formal arguments of the CFG entry point. The ret: type parameter indicates the return type of the function.crucible*A mapping from block indices to CFG blockscrucible A basic block within a function.crucible#The unique identifier of this blockcrucible8The expected types of the formal arguments to this blockcrucible(The sequence of statements in this blockcruciblePostdominator information about a CFG. The assignment maps each block to the postdominators of the given block. The postdominators are ordered with nearest postdominator first.crucibleA sequence of straight-line program statements that end with a terminating statement (return, jump, etc).crucibleA sequential statement that does not affect the program location within the current block or leave the current block.crucibleTarget for a switch statement.crucible%Target for jump and branch statementscrucibleA  uniquely identifies a block in a control-flow graph. Each block has an associated context, indicating the formal arguments it expects to find in registers from its calling locations.crucible7An expression is just an App applied to some registers.crucibleA temporary register identifier introduced during translation. These are unique to the current function. The ctx parameter is a context containing the types of all the temporary registers currently in scope, and the tp parameter indicates the type of this register (which necessarily appears somewhere in ctx)crucibleFinds the value of the most-recently introduced register in scope.crucibleExtend the set of registers in scope for a given register value without changing its index or type.crucible6Return the set of possible next blocks from a TermStmtcrucible#Return the location of a statement.crucibleA lens-like operation that gives one access to program location and term statement, and allows the terminal statement to be replaced with an arbitrary sequence of statements.crucible"Return location of start of block.crucibleGet the terminal statement of a basic block. This is implemented in a CPS style due to the block context.cruciblePretty print a CFG.crucible*Pretty print CFG with postdom information.cruciblePrint line numbers.cruciblePrint block args. Note that you can infer the number of block args from the first SSA temp register assigned to in the block: if the block has n6 args, then the first register it assigns to will be $n.crucibleOptionally print postdom info.crucibleBlock to print.crucible.Flag indicates if we should print line numberscrucible.Flag indicates if we should print line numbers  !"#$%&'()*+,-./%Operations for manipulating Core CFGs(c) Galois, Inc 2016BSD3Simon Winwood  provisional Safe-Inferred)*013$crucible?This function walks through all the blocks in the CFG calling fS on each Stmt and fT on each TermStmt. These functions return a possible annotaition statement (which has access to the result of the statement, if any) along with a context diff which describes any new variables.crucibleThis appends two StmtSeq, throwing away the TermStmt from the first StmtSeq& It could probably be generalized to Ctx.Diff instead of an embedding.crucible0This is the annotation function. The resulting StmtSeq gets spliced in after the statement so that they can inspect the result if desired. The terminal statement is ignored.crucibleAs above but for the final term stmt, where the annotation will be _before_ the term stmt.crucibleThis is the annotation function. Annotation statements go after the statement so that they can inspect the result if desired. We use Diff here over CtxEmbedding as the remainder of the statements can't use the result of the annotation functioncrucibleAs above but for the final term stmt, where the annotation will be _before_ the term stmt.'Runtime representation of CFG registers(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred)*1&crucible)A set of registers in an execution frame.crucibleThe value of a register.crucibleCreate a new set of registers. crucibleMux two register entries. crucibleRegEntry to examinecrucible4calculate final value when the register is a SymExprcrucible9final value to use if the register entry is not a SymExpr    2Evaluation functions for Crucible core expressions(c) Galois, Inc 2014-2016BSD3!Joe Hendrix  provisional Safe-Inferred"()*.9 crucibleGiven a list of Booleans l, selectedIndices( returns the indices of true values in l.crucibleHelper method for implementing  crucible provisional Safe-Inferred")*01]j crucibleGiven the arguments, this returns the initial state, and an action for computing the return value. crucibleA generator is used for constructing a CFG from a sequence of monadic actions.The ext0 parameter indicates the syntax extension. The s3 parameter is the phantom parameter for CFGs. The t parameter is the parameterized type that allows user-defined state. The ret/ parameter is the return type of the CFG. The m> parameter is a monad over which the generator is lifted The a. parameter is the value returned by the monad.crucible+State for translating within a basic block.crucible5Information about block being generated in Generator.crucibleIdentifier for current blockcrucibleA sequence of statements.crucible+Statements translated so far in this block.crucibleLabel for entry block.crucible$List of previously processed blocks.crucible Information about current block.crucibleCurrent source position.crucible=User state for current block. This gets reset between blocks.crucible,List of functions seen by current generator.crucibleDefine the current block by defining the position and final statement. crucibleGet the current position. crucibleSet the current position. crucible>Set the current position temporarily, and reset it afterwards. crucibleCreate an atom equivalent to the given expression if it is not already an . crucibleRead a global variable. crucibleWrite to a global variable. crucible+Read the current value of a reference cell. crucible.Write the given value into the reference cell. crucibleDeallocate the given reference cell, returning it to an uninialized state. The reference cell can still be used; subsequent writes will succeed, and reads will succeed if some value is written first. crucible>Generate a new reference cell with the given initial contents. crucibleGenerate a new empty reference cell. If an unassigned reference is later read, it will generate a runtime error. crucible=Generate a new virtual register with the given initial value. crucibleProduce a new virtual register without giving it an initial value. NOTE! If you fail to initialize this register with a subsequent call to  assignReg*, errors will arise during SSA conversion. crucible$Get the current value of a register. crucibleUpdate the value of a register. crucibleModify the value of a register. crucibleModify the value of a register. crucible!Add a statement to print a value. crucibleAdd a breakpoint. crucibleAdd an assert statement. crucibleAdd an assume statement. crucibleStash the given CFG away for later retrieval. This is primarily used when translating inner and anonymous functions in the context of an outer function. crucibleCreate a new block label. crucibleCreate a new lambda label. crucible-Create a new lambda label, using an explicit . crucible,Return the label of the current basic block. crucibleEnd the translation of the current block, and then continue generating a new block with the given label. crucibleEnd the translation of the current block, and then continue generating a new lambda block with the given label. The return value is the argument to the lambda block. crucible&Define a block with an ordinary label. crucible'Define a block that has a lambda label. crucible7Define a block with a fresh label, returning the label. crucibleEvaluate an expression to an 0, so that it can be reused multiple times later. crucibleAdd a statement from the syntax extension to the current basic block. crucibleCall a function.crucibleCall a function.crucibleEnd the current block with the given terminal statement, and skip the rest of the   computation. crucibleJump to the given label. crucible$Jump to the given label with output. crucibleBranch between blocks. crucible6Return from this function with the given return value. crucibleReport an error message. crucible!Branch between blocks based on a Maybe value. crucibleSwitch on a variant value. Examine the tag of the variant and jump to the appropriate switch target. crucible+End a block with a tail call to a function. crucibleExpression-level if-then-else. crucibleStatement-level if-then-else. crucible7Expression-level if-then-else with a monadic condition. crucible+Run a computation when a condition is true. crucible,Run a computation when a condition is false. crucible&Compute an expression by cases over a Maybe value. crucible.Evaluate different statements by cases over a Maybe value. crucibleReturn the argument of a Just value, or call   if the value is Nothing. crucible3This asserts that the value in the expression is a Just* value, and returns the underlying value. crucible provisional Safe-Inferredecrucible Map new blocks to old block IDs.  "1Allows converting from RTL to SSA representation.(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred"()*01ncrucibleMaps values in mutable representation to the current value in the SSA form.crucibleMap each core SSA binding to the expression that generated it if it was generated by an expression.crucibleInformation that is statically inferred from the block structure.crucibleArguments expected by block.crucibleAn input is a wrapper around a value that also knows if the value was obtained as the output from a previous block.The first argument is true if the value was created from a previous blockThe second is the value itself.crucible;Stores true if the value was created from a previous block.crucibleGiven a list of pairs returns a map that maps each value appearing in the first element to the second element in the set of pairs containing it.crucible+Return labels that may jump to given label.crucible5Maps each block to the set of blocks that jump to it.crucible Return inputs expected by block.crucible>Define map that maps labels to the set of registers they need.crucible6Return map that stores arguments needed by each block.crucible2This infers the information given a set of blocks.crucibleResolve a registercrucibleResolve an atomcrucible1Assign existing register to atom in typed RegMap.crucible.Assign new register to value in typed reg map.crucible0Resolve a lambda label into a typed jump target.crucible2Resolve a lambda label into a typed switch target.crucible5Resolve an untyped terminal statement to a typed one.crucible-Resolve a list of statements to a typed list. crucible6Convert a CFG in RTL form into a Core CFG in SSA form.?This prunes the CFG so that only reachable blocks are returned.crucibleAssigncrucible)Maps registers to associated expressions.crucibleMaps registers back to the expression that generated them (if any)crucibleMaps applications to register that stores their value. Used to eliminate redundant operations.  #.Populates postdominator entries in CFG blocks.(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred)*pcrucibleConvert a block ID to a nodecrucibleCreatecrucibleFor a given block with out edges l, return edges from each block in l to b.crucible3Return subgraph of nodes reachable from given node. crucible%Compute posstdom information for CFG.crucibleIdentifier for error.cruciblePostdoms for source block.crucibleTarget  $/Data structure for call frames in the simulator(c) Galois, Inc 2014BSD3!Joe Hendrix  provisional Safe-Inferred)*/1v crucible1Custom code to execute, typically for "overrides" crucible+We are executing some Crucible instructions crucibleWe should return this value. crucibleFrame in call to override. crucibleArguments to override. crucible-Nominal type for identifying override frames. crucible-Nominal type for identifying override frames. crucible"A call frame for a crucible block. crucible3Handle to control flow graph for the current frame. cruciblePost-dominator map for control flow graph associated with this function. crucibleA   identifies a program location that is a potential join point. Each label is a merge point, and there is an additional implicit join point at function returns. crucible#List of statements to execute next. crucible#List of statements to execute next. crucibleCreate a new call frame. crucibleCreate a new call frame. crucible.Return program location associated with frame. crucibleExtend frame with new register. crucibleControl flow graphcruciblePost dominator information.crucibleInitial arguments crucibleControl flow graph crucible Entry point cruciblePost dominator information crucibleInitial arguments 2  2  %3Data structure the execution state of the simulator(c) Galois, Inc 2014-2018BSD3!Joe Hendrix  provisional Safe-Inferred)*/0179\ crucibleA simulator state that is currently executing Crucible instructions. crucibleA SimState contains the execution context, an error handler, and the current execution tree. It captures the entire state of the symbolic simulator. crucibleAn abort handler indicates to the simulator what actions to take when an abort occurs. Usually, one should simply use the defaultAbortHandler from Lang.Crucible.Simulator, which unwinds the tree context to the nearest branch point and correctly resumes simulation. However, for some use cases, it may be desirable to take additional or alternate actions on abort events; in which case, the library user may replace the default abort handler with their own. crucibleTop-level state record for the simulator. The state contained in this record remains persistent across all symbolic simulator actions. In particular, it is not rolled back when the simulator returns previous program points to explore additional paths, etc. crucibleClass dictionary for  sym crucibleAllocator for function handles crucibleHandle to write messages to. crucibleIn order to start executing a simulator, one must provide an implementation of the extension syntax. This includes an evaluator for the added expression forms, and an evaluator for the added statement forms. crucibleThe type of functions that interpret extension statements. These have access to the main simulator state, and can make fairly arbitrary changes to it. crucible/A map from function handles to their semantics. crucibleState used to indicate what to do when function is called. A function may either be defined by writing a Haskell  > or by giving a Crucible control-flow graph representation. crucibleA definition of a function's semantics, given as a Haskell action. crucibleAn active execution tree contains at least one active execution. The data structure is organized so that the current execution can be accessed rapidly. crucibleA   indicates what actions to take to resume executing in a caller's context once a function call has completed and the return value is available.0The type parameters have the following meanings:ret2 is the type of the return value that is expected.p? is the personality of the simulator (i.e., custom user state).sym% is the simulator backend being used.ext specifies what extensions to the Crucible language are enabled.root5 is the global return type of the entire computation.f! is the stack type of the caller.args? is the type of the local variables in scope prior to the call. crucibleThe   constructor indicates that the calling context is primitive code written directly in Haskell. crucibleThe   constructor indicates that the calling context is an ordinary function call position from within a Crucible basic block. The included  is the remaining statements in the basic block to be executed following the return. crucibleThe   constructor indicates that the calling context is a tail call position from the end of a Crucible basic block. Upon receiving the return value, that value should be immediately returned in the caller's context as well. crucibleThis type contains information about the current state of the exploration of the branching structure of a program. The   states correspond to stack call frames in a more traditional simulator environment.0The type parameters have the following meanings:p? is the personality of the simulator (i.e., custom user state).sym% is the simulator backend being used.ext? specifies what extensions to the Crucible language are enabledret4 is the global return type of the entire computation top_return6 is the return type of the top-most call on the stack. crucible  denotes a call site in the outer context, and represents the point to which a function higher on the stack will eventually return. The three arguments are:'The context in which the call happened.The frame of the callerHow to modify the current sim frame and resume execution when we obtain the return value crucibleA partial value. The predicate indicates what needs to hold to avoid the partiality. The  AbortedResult describes what could go wrong if the predicate does not hold. crucibleThe top return value, indicating the program termination point. crucibleData about whether the surrounding context is expecting a merge to occur or not. If the context sill expects a merge, we need to take some actions to indicate that the merge will not occur; otherwise there is no special work to be done. crucible1Don't indicate an abort condition in the context crucibleIndicate an abort condition in the context when we get there again. crucibleThis type contains information about the current state of the exploration of the branching structure of a program. The   states correspond to the structure of symbolic branching that occurs within a single function call.0The type parameters have the following meanings:p? is the personality of the simulator (i.e., custom user state).sym% is the simulator backend being used.ext? specifies what extensions to the Crucible language are enabledret3 is the global return type of the entire execution.f is the type of the top frame. crucibleWe are working on a branch; this could be the first or the second of both branches (see the   field). crucibleWe are on a branch where the other branch was aborted before getting to the merge point. crucibleWhen we are finished with this branch we should return from the function. crucibleThis describes the state of the sibling path at a symbolic branch point. A symbolic branch point starts with the sibling in the   state, which indicates that the sibling path still needs to be executed. After the first path to be explored has reached the merge point, the places of the two paths are exchanged, and the completed path is stored in the   state until the second path also reaches its merge point. The two paths will then be merged, and execution will continue beyond the merge point. crucible=This corresponds the a path that still needs to be analyzed. crucible$This is a completed execution path. crucibleA   represents a path of execution that has been postponed while other paths are explored. It consists of a (potentially partial)   together with some information about how to resume execution of that frame. crucibleWhen a path of execution is paused by the symbolic simulator (while it first explores other paths), a   indicates what actions must later be taken in order to resume execution of that path. crucible$When resuming a paused frame with a ContinueResumption, no special work needs to be done, simply begin executing statements of the basic block. crucibleWhen resuming with a CheckMergeResumption, we must check for the presence of pending merge points before resuming. crucible$When resuming a paused frame with a SwitchResumption, we must continue branching to possible alternatives in a variant elimination statement. In other words, we are still in the process of transferring control away from the current basic block (which is now at a final  VariantElim terminal statement). crucible%When resuming a paused frame with an OverrideResumption, we simply return control to the included thunk, which represents the remaining computation for the override. crucibleA   is a block label together with a collection of actual arguments that are expected by that block. These data are sufficient to actually transfer control to the named label. crucible*Some additional information attached to a  RunningState4 that indicates how we got to this running state. crucible$This indicates that we are now in a  RunningState because we transferred execution to the start of a basic block. crucible This indicates that we are in a  RunningState? because we reached the terminal statement of a basic block. crucible This indicates that we are in a  RunningState8 because we returned from calling the named function. crucible$This indicates that we are now in a  RunningState because we finished branch merging prior to the start of a block. crucible"An action which will construct an   given a current  . Such continuations correspond to a single transition of the simulator transition system. crucibleAn   represents an intermediate state of executing a Crucible program. The Crucible simulator executes by transitioning between these different states until it results in a  *, indicating the program has completed. crucibleThe  5 is used to indicate that the program has completed. crucible+An abort state indicates that the included   encountered an abort event while executing its next step. The state needs to be unwound to its nearest enclosing branch point and resumed. crucibleAn unwind call state occurs when we are about to leave the context of a function call because of an abort. The included ValueFromValue is the context of the call site we are about to unwind into, and the  AbortedResult. indicates the reason we are aborting. crucibleA call state is entered when we are about to make a function call to the included call frame, which has already resolved the implementation and arguments to the function. crucibleA tail-call state is entered when we are about to make a function call to the included call frame, and this is the last action we need to take in the current caller. Note, we can only enter a tail-call state if there are no pending merge points in the caller. This means that sometimes calls that appear to be in tail-call position may nonetheless have to be treated as ordinary calls. crucibleA return state is entered after the final return value of a function is computed, and just before we resolve injecting the return value back into the caller's context. crucible'A running state indicates the included   is ready to enter and execute a Crucible basic block, or to resume a basic block from a call site. crucibleA symbolic branch state indicates that the execution needs to branch on a non-trivial symbolic condition. The included Pred3 is the condition to branch on. The first  PausedFrame- is the path that corresponds to the Pred8 being true, and the second is the false branch. crucibleA control transfer state is entered just prior to invoking a control resumption. Control resumptions are responsible for transitioning from the end of one basic block to another, although there are also some intermediate states related to resolving switch statements. crucible)An override state indicates the included  1 is prepared to execute a code override. crucible.A branch merge state occurs when the included   is in the process of transferring control to the included  . We enter a BranchMergeState every time we need to _check_ if there is a pending branch, even if no branch is pending. During this process, paths may have to be merged. If several branches must merge at the same control point, this state may be entered several times in succession before returning to a  . crucibleAn initial state indicates the state of a simulator just before execution begins. It specifies all the initial data necessary to begin simulating. The given ExecCont will be executed in a fresh SimState6 representing the default starting call frame. crucibleExecutions that have completed either due to (partial or total) successful completion or by some abort condition. crucible;At least one execution path resulted in some return result. crucibleAll execution paths resulted in an abort condition, and there is no result to return. crucibleAn execution stopped somewhere in the middle of a run because a timeout condition occurred. crucible(The result of resolving a function call. crucible(A resolved function call to an override. crucible0A resolved function call to a Crucible function. crucibleA   represents the result of a computation that might be only partially defined. If the result is a  TotalResult<, the the result is fully defined; however if it is a  , then some of the computation paths that led to this result aborted for some reason, and the resulting value is only defined if the associated condition is true. crucibleA  7 indicates that the the global pair is always defined. crucible  indicates that the global pair may be undefined under some circumstances. The predicate specifies under what conditions the   is defined. The   describes the circumstances under which the result would be partial. crucibleThis represents an execution frame where its frame type and arguments have been hidden. crucibleAn execution path that was prematurely aborted. Note, an abort does not necessarily indicate an error condition. An execution path might abort because it became infeasible (inconsistent path conditions), because the program called an exit primitive, or because of a true error condition (e.g., a failed assertion). crucibleA single aborted execution with the execution state at time of the abort and the reason. crucible1An aborted execution that was ended by a call to exit. crucibleTwo separate threads of execution aborted after a symbolic branch, possibly for different reasons. crucibleThe currently-executing frame plus the global state associated with it. crucibleA value of some type v together with a global state. crucible+Access the value stored in the global pair. crucible-Access the globals stored in the global pair. crucible(Access the Crucible call frame inside a  . crucible8Return the program locations of all the Crucible frames. crucible"Iterate over frames in the result. cruciblePrint an exception context crucible.Access the value stored in the partial result.crucible'Return parents frames in reverse order.crucible'Return parents frames in reverse order. crucible&Create a tree with a single top frame. crucible8Access the calling context of the currently-active frame crucible!Access the currently-active frame crucibleReturn the call stack of all active frames, in reverse activation order (i.e., with callees appearing before callers). crucibleTrivial implementation for the "empty" extension, which adds no additional syntactic forms. crucible Create a new   with the given bindings. crucible%Access the symbolic backend inside a  . crucible/A map from function handles to their semantics. crucible(Access the custom user-state inside the  . crucibleCreate an initial  crucible Access the   inside a  crucible,Access the current abort handler of a state. crucible/Access the active tree associated with a state. crucible(Access the Crucible call frame inside a  crucible#Access the override frame inside a  crucibleAccess the globals inside a  crucible$Get the symbolic interface out of a  crucible$Get the intrinsic type map out of a  crucible&Get the configuration object out of a  crucible Provide the  typeclass dictionary from a   crucibleSymbolic backend crucible#Implementations of intrinsic types crucible3Handle allocator for creating new function handles crucibleHandle to write output to crucible&Initial bindings for function handles crucibleSemantics for extension syntax crucible$Initial value for custom user state crucibleinitial   state crucible#state of Crucible global variables crucibleinitial abort handler   &#Basic operations on execution trees(c) Galois, Inc 2014-2018BSD3!Joe Hendrix  provisional Safe-Inferred"()*/01۾ crucibleThis exception is thrown if a  cannot be resolved to a callable function. This usually indicates a programming error, but might also be used to allow on-demand function loading.The  argument references the call site for the unresolved function call.The [ ] argument is the active call stack at the time of the exception.crucibleMerge two globals together.crucibleUtility function that packs the tail of a collection of arguments into a vector of ANY type values for passing to varargs functions. crucibleGiven a set of function bindings, a function- value (which is possibly a closure) and a collection of arguments, resolve the identity of the function to call, and set it up to be called.Will throw an   exception if the underlying function handle is not found in the   map. crucibleImmediately transtition to an  . On the next execution step, the simulator will execute the given override. crucibleImmediately transition to a  . On the next execution step, the simulator will interpret the next basic block. crucibleImmediately transition to an  . On the next execution step, the simulator will unwind the   and resolve the abort. crucibleAbort the current thread of execution with an error. This adds a proof obligation that requires the current execution path to be infeasible, and unwids to the nearest branch point to resume. crucibleAbort the current thread of execution with an error. This adds a proof obligation that requires the current execution path to be infeasible, and unwids to the nearest branch point to resume. crucibleTransfer control to the given resolved jump, after first checking for any pending symbolic merges at the destination of the jump. cruciblePerform a conditional branch on the given predicate. If the predicate is symbolic, this will record a symbolic branch state. crucibleExecute the next branch of a sequence of branch cases. These arise from the implementation of the  construct. The predicates are expected to be mutually disjoint. However, the construct still has well defined semantics even in the case where they overlap; in this case, the first branch with a true  is taken. In other words, each branch assumes the negation of all the predicates of branches appearing before it.In the final default case (corresponding to an empty list of branches), a  abort will be executed. crucible/Return a value from current Crucible execution.crucibleImmediately transition to the  . On the next simulator step, this will checks for the opportunity to merge within a frame.This should be called everytime the current control flow location changes to a potential merge point. cruciblePerform a single instance of path merging at a join point. This will resume an alternate branch, if it is pending, or merge result values if a completed branch has alread reached this point. If there are no pending merge points at this location, continue executing by transfering control to the given target. crucible The default abort handler calls  . crucibleAbort the current execution and roll back to the nearest symbolic branch point. When verbosity is 3 or more, a message will be logged indicating the reason for the abort..The default abort handler calls this function. crucibleAbort the current execution and roll back to the nearest symbolic branch point.crucible1Resolve the fact that the current branch aborted. crucibleRun rest of execution given a value from value context and an aborted result. crucibleResume a paused frame.crucibleTransition immediately to a  ReturnState. We are done with all intercall merges, and are ready to resmue execution in the caller's context. crucibleResolve the return value, and begin executing in the caller's context again. crucible,Return the context of the current top frame.crucible2Return assertion where predicate equals a constantcrucible,Branch with a merge point inside this frame. crucible,Branch with a merge point inside this frame. crucible=Returns true if tree contains a single non-aborted execution. crucibleAttempt to unwind a frame context into a value context. This succeeds only if there are no pending symbolic merges.crucibleGet the context for when returning (assumes no intra-procedural merges are possible). crucibleReplace the given frame with a new frame. Succeeds only if there are no pending symbolic merge points. crucibleCreate a tree that contains just a single path with no branches.2All branch conditions are converted to assertions.crucible+Program location of control-flow branching crucibleBranch predicate crucible+Program location of control-flow branching crucible/This needs to hold to avoid the aborted result crucibleTarget of branch crucible'Map from function handles to semantics crucible*Function handle and any closure variables crucibleArguments to the function crucibleLocation of the call crucible$current call stack (for exceptions) crucibleOverride to execute crucible#Description of the abort condition crucible#Simulator state prior to the abort crucibleDescription of the error crucible#Simulator state prior to the abort crucible+Generic description of the error condition crucible#Simulator state prior to the abort crucibleJump target and arguments cruciblePredicate to branch on crucible True branch crucible False branch crucibleVariant branches to execute crucible return value crucible*Function handle and any closure variables crucibleArguments to the function crucible7How to modify the caller's scope with the return value cruciblelocation of call crucible*Function handle and any closure variables crucibleArguments to the function cruciblelocation of call crucible1The location of the block we are transferring to crucible1The location of the block we are transferring to crucible%The execution that is being aborted. crucible+Name of the function we are returning from crucibleContext to return to. crucibleValue that is being returned. crucible+Name of the function we are returning from crucibleContext to return to. crucibleValue that is being returned. cruciblepostdominator target crucible if branch crucibleoptional if branch location crucible else branch crucibleoptional else branch location crucibleBranch condition branch crucible true branch. cruciblefalse branch. crucible;Postdominator merge point, where both branches meet again. crucibleBranch condition crucibleactive branch. crucibleother branch. crucible;Postdominator merge point, where both branches meet again. crucible+What to do with the result of the function crucibleThe code to run % % '-Provides functions for evaluating statements.(c) Galois, Inc 2013-2018BSD3!Joe Hendrix  provisional Safe-Inferred)*01 crucibleA generic execution feature is an execution feature that is agnostic to the execution environment, and is therefore polymorphic over the p, ext and rtp variables. crucibleAn execution feature represents a computation that is allowed to intercept the processing of execution states to perform additional processing at each intermediate state. A list of execution features is accepted by  . After each step of the simulator, the execution features are consulted, each in turn. After all the execution features have run, the main simulator code is executed to advance the simulator one step.If an execution feature wishes to make changes to the execution state before further execution happens, the return value can be used to return a modified state. If this happens, the current stack of execution features is abandoned and a fresh step starts over immediately from the top of the execution features. In essence, each execution feature can preempt all following execution features and the main simulator loop. In other words, the main simulator only gets reached if every execution feature returns Nothing. It is important, therefore, that execution features make only a bounded number of modification in a row, or the main simulator loop will be starved out. crucibleThis datatype indicates the possible results that an execution feature can have. crucibleThis execution feature result indicates that no state changes were made. crucibleThis execution feature indicates that the state was modified but not changed in an "essential" way. For example, internal bookkeeping datastructures for the execution feature might be modified, but the state is not transitioned to a fundamentally different state.When this result is returned, later execution features in the installed stack will be executed, until the main simulator loop is encountered. Contrast with the "new state" result. crucibleThis execution feature result indicates that the state was modified in an essential way that transforms it into new state altogether. When this result is returned, it preempts any later execution features and the main simulator loop and instead returns to the head of the execution feature stack.NOTE: In particular, the execution feature will encounter the state again before the simulator loop. It is therefore very important that the execution feature be prepared to immediately encounter the same state again and make significant execution progress on it, or ignore it so it makes it to the main simulator loop. Otherwise, the execution feature will loop back to itself infinitely, starving out useful work. crucible!Retrieve the value of a register. crucible.Retrieve the value of a register, returning a . crucibleEvaluate an expression. crucibleEvaluate the actual arguments for a function call or block transfer. crucible!Resolve the arguments for a jump. crucible*Resolve the arguments for a switch target. crucibleUpdate a reference cell with a new value. Writing an unassigned value resets the reference cell to an uninitialized state. crucibleRead from a reference cell. crucibleEvaluation operation for evaluating a single straight-line statement of the Crucible evaluator.,This is allowed to throw user exceptions or s. crucibleEvaluation operation for evaluating a single block-terminator statement of the Crucible evaluator.,This is allowed to throw user exceptions or s.crucibleChecks whether the StmtSeq is a Cons or a Term, to give callers another chance to jump into Crucible's control flow crucibleMain evaluation operation for running a single step of basic block evaluation.,This is allowed to throw user exceptions or s. crucible Given an  , examine it and either enter the continuation for final results, or construct the appropriate   for continuing the computation and enter the provided intermediate continuation. crucibleRun the given ExecCont on the given SimState, being careful to catch any simulator abort exceptions that are thrown and dispatch them to the abort handler. crucible5Run a single step of the Crucible symbolic simulator. crucibleGiven a   and an execution continuation, apply the continuation and execute the resulting computation until completion.-This function is responsible for catching  exceptions and  UserError exceptions and invoking the  errorHandler contained in the state. crucibleThis feature will terminate the execution of a crucible simulator with a  TimeoutResult: after a given interval of wall-clock time has elapsed. cruciblecurrent verbosity crucibleJump target to evaluate crucibleSwitch target to evaluate crucibleValue inside the variant crucibleCurrent verbosity crucibleStatement to evaluate crucible"Remaining statements in the block crucible Verbosity crucible"Terminating statement to evaluate crucibleCurrent verbosity crucibleCurrent verbosity crucibleCurrent verbosity crucible&Action to query the current verbosity crucible)Current execution state of the simulator crucibleFinal continuation for results crucible-Intermediate continuation for running states crucibleCurrent verbosity crucibleExecution features to install crucible#Execution state to begin executing   (#Profiling support for the simulator(c) Galois, Inc 2018BSD3!Rob Dockins  provisional Safe-Inferred)*016<, crucibleAn  & that enables only Crucible profiling. crucibleWrite a profiling report file in the JS/JSON format expected by tye symProUI front end. crucibleThis feature will pay attention to function call entry/exit events and track the elapsed time and various other metrics in the given profiling table. The ProfilingOptions can be used to export intermediate profiling data at regular intervals, if desired. crucibleFile to write crucible"name" for the report crucible"source" for the report crucible&profiling data to populate the report : : )0Execution feature for tracking program positions(c) Galois, Inc 2021BSD3!Rob Dockins  provisional Safe-Inferred)*01{ crucibleThis execution feature adds a LocationReachedEvent to the backend assumption tracking whenever execution reaches the head of a basic block.  *'Support for implementing path splitting(c) Galois, Inc 2019BSD3!Rob Dockins  provisional Safe-Inferred)*016<i crucibleA   represents a sequence of  WorkItems# that still need to be explored. crucibleA   represents a suspended symbolic execution path that can later be resumed. It captures all the relevant context that is required to recreate the simulator state at the point when the path was suspended. crucible7The predicate we branched on to generate this work item crucible#The location of the symbolic branch crucibleThe paused execution frame crucible(The overall execution state of this path crucibleThe assumption state of the symbolic backend when we suspended this work item crucible0Put a work item onto the front of the work list. cruciblePull a work item off the front of the work list, if there are any left. When used with  , this function uses the work list as a stack and will explore paths in a depth-first manner. crucibleGiven a work item, restore the simulator state so that it is ready to resume exploring the path that it represents. crucibleThe path splitting execution feature always selects the "true" branch of a symbolic branch to explore first, and pushes the "false" branch onto the front of the given work list. With this feature enabled, a single path will be explored with no symbolic branching until it is finished, and all remaining unexplored paths will be suspended in the work list, where they can be later resumed. crucibleThis function executes a state using the path splitting execution feature. Each time a path is completed, the given result continuation is executed on it. If the continuation returns , additional paths will be executed; otherwise, we exit early and exploration stops.If exploration continues, the next work item will be popped of the front of the work list and will be executed in turn. If a timeout result is encountered, we instead stop executing paths early. The return value of this function is the number of paths that were completed, and a list of remaining paths (if any) that were not explored due to timeout or early exit. crucibleExecution features to install crucible#Execution state to begin executing crucible!Path result continuation, return  to explore more paths +Support for performing path satisfiability checks at symbolic branch points(c) Galois, Inc 2018BSD3!Rob Dockins  provisional Safe-Inferred)*01U crucibleAn action for considering the satisfiability of a predicate. In the current state of the symbolic interface, indicate what we can determine about the given predicate.   ,The main simulation monad(c) Galois, Inc 2014-2018BSD3!Joe Hendrix  Safe-Inferred)*16'% crucibleA   with the type parameters args, ret existentially quantified crucible An action in  , together with s for its arguments and return values. This type is used across several frontends to define overrides for built-in functions, e.g., malloc in the LLVM frontend..For maximal reusability, frontends may define  $s that are polymorphic in (any of) p, sym, and ext. crucibleThis quantifies over function bindings that can work for any symbolic interface. crucibleA pair containing a handle and the state associated to execute it. crucible%Monad for running symbolic simulator.Type parameters:p the "personality", i.e. user-defined state parameterized by symsym the symbolic backendext the syntax extension (Lang.Crucible.CFG.Extension)rtp global return typeargs% argument types for the current frameret" return type of the current framea the value type crucibleExit from the current execution by ignoring the continuation and immediately returning an aborted execution result. crucible"Associate a definition (either an   or a ) with the given handle. crucibleBind a CFG to its handle.#Computes postdominator information. crucible Read the whole sym global state. crucible$Overwrite the whole sym global state crucibleRead a particular global variable from the global variable state. crucible.Set the value of a particular global variable. crucible3Run an action to compute the new value of a global. crucibleCreate a new reference cell. crucible-Create a new reference cell with no contents. crucible+Read the current value of a reference cell. crucible$Write a value into a reference cell. crucible8Read the current value of a mux tree of reference cells. crucible1Write a value into a mux tree of reference cells. crucibleTurn an   action into an   that can be executed using standard Crucible execution primitives like executeCrucible. crucibleCreate an override from an explicit return type and definition using  . crucibleCreate an override from a statically inferrable return type and definition using  . crucibleReturn override arguments. crucible)Call a function with the given arguments. crucibleCall a function with the given arguments. Provide the arguments as an  Assignment instead of as a RegMap. crucibleCall a control flow graph from  .Note that this computes the postdominator information, so there is some performance overhead in the call. crucible*Call a block of a control flow graph from  .Note that this computes the postdominator information, so there is some performance overhead in the call. crucible%Call an override in a new call frame. crucibleAdd a failed assertion. This aborts execution along the current evaluation path, and adds a proof obligation ensuring that we can't get here in the first place. crucibleAbort the current thread of execution for the given reason. Unlike  overrideError, this operation will not add proof obligation, even if the given abort reason is due to an assertion failure. Use  overrideError6 instead if a proof obligation should be generated. cruciblePerform a symbolic branch on the given predicate. If we can determine that the predicate must be either true or false, we will exeucte only the "then" or the "else" branch. Otherwise, both branches will be executed and the results merged when a value is returned from the override. NOTE! this means the code following this symbolic branch may be executed more than once; in particular, side effects may happen more than once.In order to ensure that pushabortmux bookeeping is done properly, all symbolic values that will be used in the branches should be inserted into the RegMap argument of this function, and retrieved in the branches using the getOverrideArgs function. Otherwise mux errors may later occur, which will be very confusing. In other words, don't directly use symbolic values computed before calling this function; you must instead first put them into the RegMap and get them out again later. cruciblePerform a series of symbolic branches. This operation will evaluate a series of branches, one for each element of the list. The semantics of this construct is that the predicates are evaluated in order, until the first one that evaluates true; this branch will be the taken branch. In other words, this operates like a chain of if-then-else statements; later branches assume that earlier branches were not taken.9If no predicate is true, the construct will abort with a VariantOptionsExhausted reason. If you wish to report an error condition instead, you should add a final default case with a true predicate that calls  overrideError . As with symbolicBranch, be aware that code following this operation may be called several times, and side effects may occur more than once.As with symbolicBranch, any symbolic values needed by the branches should be placed into the RegMap< argument and retrieved when needed. See the comment on symbolicBranch. crucible=Non-deterministically choose among several feasible branches.Unlike  , this function does not take only the first branch with a predicate that evaluates to true; instead it takes all branches with predicates that are not syntactically false (or cannot be proved unreachable with path satisfiability checking, if enabled). Each branch will not+ assume that other branches weren't taken.As with  , any symbolic values needed by the branches should be placed into the RegMap9 argument and retrieved when needed. See the comment on  .Operationally, this works by by numbering all of the branches from 0 to n, inventing a symbolic integer variable z, and adding z = i (where i ranges from 0 to n) to the branch condition for each branch, and calling  2 on the result. Even though each branch given to   assumes earlier branches are not taken, each branch condition has the form  (z = i) and p, so the negation ~((z = i) and p) is equivalent to (z != i) or ~p, so later branches don't assume the negation of the branch condition of earlier branches (i.e., ~p).crucibleAdd function binding to map. crucibleBuild a map of function bindings from a list of handle/binding pairs. crucible5Make an IntrinsicImpl from an explicit implementation crucibleCreate an override from a  . crucibleglobal variable cruciblecurrent value crucibleglobal variable cruciblenew value crucibleglobal variable to modify cruciblemodification action crucibleType of the reference cell crucibleInitial value of the cell crucibleType of the reference cell crucibleReference cell to read crucibleReference cell to write crucibleValue to write into the cell crucibleReference cell to modify cruciblemodification action crucibleReference cell to read crucibleReference cell to write crucibleValue to write into the cell crucible return type crucibleaction to execute crucibleFunction to call crucibleArguments to the function crucibleFunction to call crucibleArguments to the function crucibleFunction to run crucibleArguments to the function crucibleFunction to run crucible Block to run crucibleArguments to the block cruciblePredicate to branch on crucible$argument values for the then branch crucible then branch crucible"optional location for then branch crucible$argument values for the else branch crucible else branch crucible"optional location for else branch crucible!argument values for the branches crucibleBranches to consider crucible!argument values for the branches crucibleBranches to consider crucibleOverride implementation, given a proxy value to fix the type, a reference to the symbolic engine, and a curried arguments 8 8 --Support for bounding function recursion depth(c) Galois, Inc 2019BSD3!Rob Dockins  provisional Safe-Inferred")*01, crucibleThis execution feature allows users to place a bound on the number of recursive calls that a function can execute. Each time a function is called, the number of activations of the functions is incremented, and the path is aborted if the bound is exceeded.The boolean argument indicates if we should generate proof obligations when we cut off recursion. If true, recursion cutoffs will generate proof obligations which will be provable only if the function actually could not have executed that number of times. If false, the execution of recursive functions will be aborted without generating side conditions. crucibleAction for computing what recursion depth to allow for the given function crucible9Produce a proof obligation when resources are exhausted?   :)Reexports of relevant parts of submodules(c) Galois, Inc 2018BSD3!Joe Hendrix  provisional Safe-Inferred)*/01-y w|xyz{stuv   w|xyz{stuv  .*Support for symbolic execution breakpoints(c) Galois, Inc 2019BSD3%Andrei Stefanescu  provisional Safe-Inferred%&)*1 crucibleThis execution feature registers an override for a breakpoint. The override summarizes the execution from the breakpoint to the return from the function (similar to a tail call). This feature requires a map from each function handle to the list of breakpoints in the respective function with this execution feature.  /(Compute weak topological ordering of CFG(c) Galois, Inc 2015BSD3$Tristan Ravitch  provisional Safe-Inferred9:;8crucible1The successor relation for the control flow graphcrucible The partition we are building upcrucibleA stack of visited nodes crucible>Compute a weak topological ordering over a control flow graph.Weak topological orderings provide an efficient iteration order for chaotic iterations in abstract interpretation and dataflow analysis. crucible(Useful for creating a first argument to   . See also  . crucible)Useful for creating a second argument to   . See also  . crucible-Compute a weak topological order for the CFG.crucible0Unwind the stack until we reach the target node vcrucibleMake a component with the given head element by visiting everything in the SCC and recursively creating a new partition.crucible$Visit successors of a node and find:1) The minimum label number of any reachable (indirect) successor and 2) If the node is in a loopcrucibleAssign a label to a vertex.This generates the next available label and assigns it to the vertex. Note that labels effectively start at 1, since 0 is used to denote unassigned. The actual labels are never exposed to users, so that isn't a big deal.crucibleLook up the label of a vertexcrucible;Mark a vertex as processed by setting its Label to maxBoundcrucible0Reset a label on a vertex to the unlabeled statecrucible(Add a component to the current partitioncrucibleCurrent top of the stackcrucibleTarget element 0Support for bounding loop depth(c) Galois, Inc 2018BSD3!Rob Dockins  provisional Safe-Inferred")*01@crucibleThis function takes weak topological order data and computes a mapping from block ID number to (position, depth) pair. The position value indicates which the position in the WTO listing in which the block ID appears, and the depth indicates the number of nested components the block ID appears in. Loop backedges occur exactly at places where control flows from a higher position number to a lower position number. Jumps that exit inner loops to the next iteration of an outer loop are identified by backedges that pass from higher depths to lower depths.crucibleThis function updates the loop bound count at the given depth. Any loop bounds deeper than this are discarded. If the given sequence is too short to accommodate the given depth, the sequence is extended with 0 counters to the correct depth. crucibleThis execution feature allows users to place a bound on the number of iterations that a loop will execute. Each time a function is called, the included action is called to determine if the loops in that function should be bounded, and what their iteration bound should be.The boolean argument indicates if we should generate proof obligations when we cut off loop execution. If true, loop cutoffs will generate proof obligations which will be provable only if the loop actually could not have executed that number of iterations. If false, the execution of loops will be aborted without generating side conditions.Note that we compute a weak topological ordering on control flow graphs to determine loop heads and loop nesting structure. Loop bounds for inner loops are reset on every iteration through an outer loop. crucibleAction for computing loop bounds for functions when they are called crucible9Produce a proof obligation when resources are exhausted?   1.Abstract interpretation over SSA function CFGs(c) Galois, Inc 2015BSD3$Tristan Ravitch provisional Abstract interpretation over the Crucible IR Supports widening with an iteration order based on weak topological orderings. Some basic tests on hand-written IR programs are included. Safe-Inferred)*016^+ crucible5The Pointed wrapper that adds Top and Bottom elements crucible8Turn a non paramaterized type into a parameterized type.For when you want to use a parameterized-utils style data structure with a type that doesn't have a parameter.The same definition as , but with a different  instance. crucibleA CFG-scoped SSA temp register.We don't care about the type params yet, hence the existential quantification. We may want to look up the instruction corresponding to a  : after analysis though, and we'll surely want to compare  s for equality, and use them to look up values in point abstractions after analysis.crucibleThe  contains the abstractions for the entry point of each basic block in the function, as well as the final abstract value for the returned register.crucible>Mapping from blocks to point abstractions at entry to blocks.crucibleMapping from blocks to point abstractions at exit from blocks. Blocks are indexed by their entry context, but not by there exit contexts, so we wrap the point abstraction in  Ignore . Some* to hide the context of SSA tmps at exit.crucible'Abstract value at return from function. crucible"This is a wrapper around a set of s that name allocation sites of references. We need the wrapper to correctly position the tp/ type parameter so that we can put them in an .crucible0This type names an allocation site in a program.Allocation sites are named by their basic block and their index into that containing basic block. We have to carry around the type repr for inspection later (especially in instances).crucibleThis is a wrapper around ( that exposes the underlying type of a =, and is needed to define the abstract value we carry around. crucibleThis abstraction contains the abstract values of each register at the program point represented by the abstraction. It also contains a map of abstractions for all of the global variables currently known. crucible*In this map, the keys are really just the s in  <, but with a newtype wrapper that unwraps a level of their  type rep. crucibleThis mapping records the *set* of references (named by allocation site) that each register could hold. crucible*Transfer functions for each statement type;Interpretation functions for some statement types -- e.g.  interpExpr and  interpExt -- receive   arguments corresponding to the SSA tmp that the result of the interpreted statement get assigned to. Some interpretation functions that could receive this argument do not -- e.g.  interpCall1 -- because conathan didn't have a use for that. crucible9A domain of abstract values, parameterized by a term type crucible>The iteration strategies available for computing fixed points.Algorithmically, the best strategies seem to be based on Weak Topological Orders (WTOs). The WTO approach also naturally supports widening (with a specified widening strategy and widening operator).-A simple worklist approach is also available.crucibleA wrapper around widening operators. This is mostly here to avoid requiring impredicative types later.crucible$A wrapper around widening strategies crucible;Look up the abstract value of a register at a program point crucible:Modify the abstract value of a register at a program pointcrucibleExtend the abstraction with a domain value for the next register.The set of references that the register can point to is set to the empty setcrucibleJoin two point abstractions using the join operation of the domain.We join registers pointwise. For globals, we explicitly call join when the global is in both maps. If a global is only in one map, there is an implicit join with bottom, which always results in the same element. Since it is a no-op, we just skip it and keep the one present element.crucible,Compare two point abstractions for equality.Note that the globals maps are converted to a list and the lists are checked for equality. This should be safe if order is preserved properly in the list functions... crucible>Lookup the abstract value of scoped reg in an exit assignment. crucibleLookup the abstract value of scoped reg -- specified by 0-based int indices -- in an exit assignment.crucibleLookup a value in an assignment based on it's 0-based int index.crucibleApply the transfer functions from an interpretation to a block, given a starting set of abstract values.&Return a set of blocks to visit later. crucibleCompute a fixed point via abstract interpretation over a control flow graph () given 1) an interpretation + domain, 2) initial assignments of domain values to global variables, and 3) initial assignments of domain values to function arguments.This is an intraprocedural analysis. To handle function calls, the transfer function for call statements must know how to supply summaries or compute an appropriate conservative approximation.7There are two results from the fixed point computation:1) For each block in the CFG, the abstraction computed at the *entry* to the block2) For each block in the CFG, the abstraction computed at the *exit* from the block. The , for these "exit" abstractions ignores the ctx index on the blocks, since that context is for *entry* to the blocks.3) The final abstract value for the value returned by the functioncrucible Inspect the   definition to determine which iteration strategy the caller requested.crucibleIterate over blocks using a worklist (i.e., after a block is processed and abstract values change, put the block successors on the worklist).The worklist is actually processed by taking the lowest-numbered block in a set as the next work item.crucibleIterate over the blocks in the control flow graph in weak topological order until a fixed point is reached.The weak topological order essentially formalizes the idea of breaking the graph on back edges and putting the result in topological order. The blocks that serve as loop heads are the heads of their respective strongly connected components. Those block heads are suitable locations to apply widening operators (which can be provided to this iterator). crucible Construct a    4 from a pointed join function and an equality test. crucibleThe domain of abstract valuescrucible.The transfer functions for each statement typecrucibleThe function to analyzecrucibleAssignments of abstract values to global variables at the function startcrucible8Assignments of abstract values to the function argumentscrucibleAn optional widening operator crucible!Join of contained domain elementscrucibleEquality for domain elements/ / 2-Depth-first search algorithm on Crucible CFGs(c) Galois, Inc 2015BSD3!Rob Dockins  provisional Safe-Inferred)*1n crucible?Function to update the traversal state when traversing an edge.crucibleFunction to update the traversal state when we have finished visiting all of a nodes's reachable children.crucible9This edge is on the spanning forrest computed by this DFScrucibleThis edge is either a forward (to a direct decendent in the spanning tree) or a cross edge (to a cousin node)crucibleThis edge is a back edge (to an ancestor in the spanning tree). Every cycle in the graph must traverse at least one back edge.crucibleUse depth-first search to calculate a set of all the block IDs that are the target of some back-edge, i.e., a set of nodes through which every loop passes.crucibleCompute a sequence of all the back edges found in a depth-first search of the given CFG.crucibleCompute a sequence of all the edges visited in a depth-first search of the given CFG.crucibleCompute a postorder traversal of all the reachable nodes in the CFGcrucibleCompute a preorder traversal of all the reachable nodes in the CFGcrucible.A depth-first search algorithm on a block map.The DFSNodeFunc and DFSEdgeFunc define what we are computing. The DFSEdgeFunc is called on each edge. The edges are classified according to standard depth-first search terminology. A tree edge is an edge in the discovered spanning tree. A back edge goes from a child to an ancestor in the spanning tree. A ForwardOrCross edge travels either from an ancestor to a child (but not a tree edge), or between two unrelated nodes. The forward/cross case can be distinguished, if desired, by tracking the order in which nodes are found. A forward edge goes from a low numbered node to a high numbered node, but a cross edge goes from a high node to a low node.The DFSNodeFunc is called on each block _after_ the DFS has processed all its fresh reachable children; that is, as the search is leaving the given node. In particular, using the DFSNodeFunc to put the blocks in a queue will give a postorder traversal of the discovered nodes. Contrarywise, using the DFSEdgeFunc to place blocks in a queue when they occur in a TreeEdge will give a preorder traversal of the discovered nodes.We track the lifecycle of nodes by using two sets; an ancestor set and a black set. Nodes are added to the ancestor set as we pass down into recursive calls, and changes to this set are discarded upon return. The black set records black nodes (those whose visit is completed), and changes are threaded through the search.In the standard parlance, a node is white if it has not yet been discovered; it is in neither the ancestor nor black set. A node is grey if it has been discovered, but not yet completed; such a node is in the ancestor set, but not the black set. A node is black if its visit has been completed; it is in the black set and not in the ancestor set. INVARIANT: at all times, the ancestor set and black set are disjoint. After a DFS is completed, all visited nodes will be in the black set; any nodes not in the black set are unreachable from the initial node.crucibleLow-level depth-first search function. This exposes more of the moving parts than 2 for algorithms that need more access to the guts.crucible(action to take after a visit is finishedcrucibleaction to take for each edgecrucibleCFG blocks to searchcrucibleancestor nodescruciblea white node to visitcrucible.Partially-computed value and initial black setcrucible%Computed value and modified black set  3Forward dataflow analysis framework based on Kildall's algorithm(c) Galois, Inc 2015BSD3!Rob Dockins  provisional Safe-Inferred)*01o  4 Safe-Inferred )*1scrucibleJoin the bit-vectors in a vector into a single large bit-vector. The Endian4 parameter indicates which way to join the elemnts:  LittleEndian9 indicates that low vector indexes are less significant. crucible$Earlier indexes are more signficant.crucible$Earlier indexes are less signficant.crucible0Split a bit-vector into a vector of bit-vectors.crucibleTurn a vector of bit-vectors, into a shorter vector of longer bit-vectors.crucibleTurn a vector of large bit-vectors, into a longer vector of shorter bit-vectors.crucibleHow to append bit-vectors crucibleWidth of bit-vectors in input crucible&Number of bit-vectors to join togeter crucible%Split bit-vectors in this many parts crucible$Length of bit-vectors in the result 6;<=;<>;<?;<@ABC;DE;DFGHHIJKIJLIJMNOPNOQNORNOSNOTNOUNOVNOWNXYNZ[NZ\NZ]NZ^NZ_NZ`NabNabNacNadNaeNafNghNgiNgjNgkNglNgmNgnNgoNgpNgqNgrNgsNgtNguNgvNgwNxyNz{Nz| } } ~                                                                                                      6 7     89                                                                                                ! " " " " " # # # $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % % & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & & ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ) * * * * * * * * * * * * * + + + , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , - - . / / / / / / / / / / / / / / / //// / / / / / / / 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 4 4 4 4 A  A  A        A  A  NNIJIJIJIJIJIJIJIJIJIJIJLIJMIJA A A AAAAAIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIAIIIIIIIIINNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIAIIIIIIIIIIIIN I !""""""""""""""""""""""#####%%NX&&N&&&&&&&&&&'',///////////00AA11111I1111111111144IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII#crucible-0.7-8cOLouRuT7vG1hxVUUUvChLang.Crucible.Utils.StateContTLang.Crucible.PanicLang.Crucible.CFG.GeneratorLang.Crucible.Backend.SimpleLang.Crucible.CFG.ExprLang.Crucible.BackendLang.Crucible.TypesLang.Crucible.Backend.Online Lang.Crucible.Backend.ProofGoals%Lang.Crucible.Backend.AssumptionStack Lang.Crucible.Simulator.SimError#Lang.Crucible.Simulator.SymSequence"Lang.Crucible.Simulator.IntrinsicsLang.Crucible.FunctionHandleLang.Crucible.CFG.ExtensionLang.Crucible.CFG.CommonLang.Crucible.Utils.BitSet"Lang.Crucible.Utils.MonadVerbosityLang.Crucible.Utils.MuxTree Lang.Crucible.Simulator.RegValueLang.Crucible.Utils.PrettyPrintLang.Crucible.Utils.StructuralLang.Crucible.SyntaxLang.Crucible.CFG.RegLang.Crucible.Utils.RegRewrite!Lang.Crucible.CFG.EarlyMergeLoopsLang.Crucible.CFG.CoreLang.Crucible.Utils.CoreRewriteLang.Crucible.Simulator.RegMap"Lang.Crucible.Simulator.Evaluation#Lang.Crucible.Simulator.GlobalState!Lang.Crucible.CFG.ExtractSubgraph Lang.Crucible.Analysis.ReachableLang.Crucible.CFG.SSAConversionLang.Crucible.Analysis.Postdom!Lang.Crucible.Simulator.CallFrame%Lang.Crucible.Simulator.ExecutionTree"Lang.Crucible.Simulator.Operations Lang.Crucible.Simulator.EvalStmt!Lang.Crucible.Simulator.Profiling(Lang.Crucible.Simulator.PositionTracking%Lang.Crucible.Simulator.PathSplitting*Lang.Crucible.Simulator.PathSatisfiability#Lang.Crucible.Simulator.OverrideSim(Lang.Crucible.Simulator.BoundedRecursion"Lang.Crucible.Simulator.Breakpoint*Lang.Crucible.Analysis.Fixpoint.Components#Lang.Crucible.Simulator.BoundedExecLang.Crucible.Analysis.FixpointLang.Crucible.Analysis.DFS&Lang.Crucible.Analysis.ForwardDataflowLang.Crucible.VectorcrucibleIntrinsicClass Intrinsic RollRecursiveUnrollRecursiveLang.Crucible.Simulator mtl-2.3.1Control.Monad.State.Class MonadStategetputstatebaseGHC.Stack.Types HasCallStackControl.Monad.Cont.Class MonadContcallCC$panic-0.4.0.1-FWYjq7jLIkeK5O5MPaqaP5Panic2parameterized-utils-2.1.8.0-3Oj4E4r5QB4DPs7EFGrHodData.Parameterized.CtxCtxEmptyCtx::>"what4-1.5.1-6GimHtONvd1LMJIg4FyjIhWhat4.FloatMode FloatModeRepr FloatIEEEReprFloatUninterpretedRepr FloatRealRepr FloatRealFloatUninterpreted FloatIEEE FloatModeWhat4.ProgramLocPositionWhat4.Utils.FloatHelpers RoundingModeRNERNARTPRTNRTZWhat4.LabeledPred LabeledPred _labeledPred_labeledPredMsg labeledPredlabeledPredMsgWhat4.InterpretedFloatingPoint FloatInfoRepr HalfFloatReprSingleFloatReprDoubleFloatRepr QuadFloatReprX86_80FloatReprDoubleDoubleFloatReprDoubleDoubleFloat X86_80Float QuadFloat DoubleFloat SingleFloat HalfFloat FloatInfoFloatInfoToBitWidthfloatInfoToBVTypeReprWhat4.Expr.BuilderFlagsWhat4.Protocol.OnlinecheckSatisfiablecheckSatisfiableWithModelAssumptionFrames baseFrame pushedFrames GoalCollectorFrameIdentifierGoalsAssumingProve ProveConj ProofGoalproofAssumptions proofGoalproveAll goalsConj goalsToList traverseGoalstraverseOnlyGoalstraverseGoalsSeqtraverseGoalsWithAssumptionsemptyGoalCollectortraverseGoalCollector$traverseGoalCollectorWithAssumptionsgcFramesgcPush gcAddGoalsgcProve gcAddAssumesgcPopgcFinishgcReset gcRestoregcRemoveObligations$fEqFrameIdentifier$fOrdFrameIdentifier $fShowGoalsCruciblepanic$fPanicComponentCrucibleAssumptionStackassumeStackGenproofObligationsAssumptionFrameassumeFrameIdentassumeFrameCondallAssumptionFramesinitAssumptionStacksaveAssumptionStackrestoreAssumptionStackappendAssumptionsaddProofObligationcollectAssumptionsgetProofObligationsclearProofObligations resetStack pushFramepopFramesUntilpopFramepopFrameAndGoals inFreshFrameSimError simErrorLocsimErrorReasonSimErrorReasonGenericSimError UnsupportedReadBeforeWriteSimErrorAssertFailureSimErrorResourceExhaustedsimErrorReasonMsgsimErrorDetailsMsg ppSimError$fShowSimErrorReason$fIsStringSimErrorReason$fExceptionSimError$fShowSimError IsSymBackendpushAssumptionFramepopAssumptionFramepopUntilAssumptionFrame popAssumptionFrameAndObligations addAssumptionaddAssumptionsgetPathConditionaddDurableProofObligationsaveAssumptionStaterestoreAssumptionStateresetAssumptionStateHasSymInterface backendGetSym SomeBackendIsSymInterfaceAbortExecReasonInfeasibleBranchAssertionFailureVariantOptionsExhausted EarlyExitAssumptionStateProofObligationsProofObligation Assumptions Assumption AssertionCrucibleAssumptionsSingleAssumption SingleEventManyAssumptionsMergeAssumptions CrucibleEventCreateVariableEventLocationReachedEventCrucibleAssumptionGenericAssumptionBranchConditionAssumingNoErrorppEventeventLoc assumptionLocassumptionPredimpossibleAssumptionforgetAssumptionsingleAssumption singleEventassumptionsTopLevelLocsassumptionsPredconcretizeEventsflattenAssumptionsmergeAssumptionsppAbortExecReason ppAssumptionthrowUnsupportedtrivialAssumptionassertThenAssumeConfigOptionbackendOptions addAssertionaddDurableAssertionabortExecBecauseassertaddFailedAssertion addAssertionMassertIsInteger readPartExprppProofObligation$fMonoidCrucibleAssumptions$fSemigroupCrucibleAssumptions$fExceptionAbortExecReason$fShowAbortExecReason SimpleBackendnewSimpleBackend&$fIsSymBackendExprBuilderSimpleBackend)$fHasSymInterfaceExprBuilderSimpleBackend BranchResultIndeterminateBranchResultNoBranchUnsatisfiableContextSTPOnlineBackendCVC5OnlineBackendCVC4OnlineBackendBoolectorOnlineBackendZ3OnlineBackendYicesOnlineBackend OnlineBackend UnsatFeaturesNoUnsatFeaturesProduceUnsatCoresProduceUnsatAssumptionsunsatFeaturesToProblemFeaturessolverInteractionFileenableOnlineBackendonlineBackendOptionsnewOnlineBackendwithOnlineBackendwithYicesOnlineBackendwithZ3OnlineBackendwithBoolectorOnlineBackendwithCVC4OnlineBackendwithCVC5OnlineBackendwithSTPOnlineBackendresetSolverProcessrestoreSolverStatewithSolverProcessconsiderSatisfiability&$fIsSymBackendExprBuilderOnlineBackend)$fHasSymInterfaceExprBuilderOnlineBackend$fDataBranchResult$fEqBranchResult$fGenericBranchResult$fOrdBranchResultTypeReprAnyReprUnitReprBoolReprNatRepr IntegerRepr RealValReprComplexRealReprBVRepr IntrinsicRepr RecursiveRepr FloatRepr IEEEFloatReprCharRepr StringReprFunctionHandleRepr MaybeRepr SequenceRepr VectorRepr StructRepr VariantRepr ReferenceRepr WordMapRepr StringMapReprSymbolicArrayReprSymbolicStructRepr AsBaseType NotBaseType WordMapType SequenceType VectorType VariantTypeNatTypeUnitType StructType StringMapType MaybeType ReferenceType IntrinsicType RecursiveTypeFunctionHandleType FloatTypeCharTypeAnyTypeSymbolicStructTypeSymbolicArrayType IEEEFloatType RealValType StringType IntegerTypeComplexRealTypeBVTypeBoolType BaseToType CrucibleTypeCtxReprIsRecursiveType UnrollType unrollTypeKnownBV baseToType asBaseType,$fKnownReprCrucibleTypeTypeReprStringMapType($fKnownReprCrucibleTypeTypeReprMaybeType+$fKnownReprCrucibleTypeTypeReprSequenceType)$fKnownReprCrucibleTypeTypeReprVectorType)$fKnownReprCrucibleTypeTypeReprBaseToType($fKnownReprCrucibleTypeTypeReprFloatType1$fKnownReprCrucibleTypeTypeReprFunctionHandleType*$fKnownReprCrucibleTypeTypeReprWordMapType,$fKnownReprCrucibleTypeTypeReprRecursiveType,$fKnownReprCrucibleTypeTypeReprIntrinsicType,$fKnownReprCrucibleTypeTypeReprReferenceType*$fKnownReprCrucibleTypeTypeReprVariantType)$fKnownReprCrucibleTypeTypeReprStructType*$fKnownReprCrucibleTypeTypeReprBaseToType0&$fKnownReprCrucibleTypeTypeReprNatType'$fKnownReprCrucibleTypeTypeReprCharType'$fKnownReprCrucibleTypeTypeReprUnitType&$fKnownReprCrucibleTypeTypeReprAnyType$fOrdFCrucibleTypeTypeRepr $fEqTypeRepr"$fTestEqualityCrucibleTypeTypeRepr$fShowFCrucibleTypeTypeRepr$fShowTypeRepr$fPrettyTypeRepr$fHashableTypeRepr$fHashableFCrucibleTypeTypeRepr SymSequenceSymSequenceNilSymSequenceConsSymSequenceAppendSymSequenceMergemuxSymSequence newSeqCacheevalWithFreshCache evalWithCachenilSymSequenceconsSymSequenceappendSymSequenceisNilSymSequencelengthSymSequenceheadSymSequenceunconsSymSequencetailSymSequencetraverseSymSequenceconcreteizeSymSequenceprettySymSequence$fPrettySymSequence$fEqSymSequenceIntrinsicTypesIntrinsicMuxFn GetIntrinsicpushBranchIntrinsicabortBranchIntrinsic muxIntrinsicemptyIntrinsicTypes typeError FnHandleMapRefCellHandleAllocator SomeHandleFnHandlehandleID handleNamehandleArgTypeshandleReturnType handleType haCounternewHandleAllocatorwithHandleAllocatormkHandle mkHandle'refType freshRefCellemptyHandleMapinsertHandleMaplookupHandleMapsearchHandleMaphandleMapToHandles$fHashableFnHandle$fShowFnHandle $fOrdFnHandle $fEqFnHandle$fShowSomeHandle$fHashableSomeHandle$fOrdSomeHandle$fEqSomeHandle $fOrdRefCell $fEqRefCell$fOrdFCrucibleTypeRefCell!$fTestEqualityCrucibleTypeRefCell$fShowFCrucibleTypeRefCell $fShowRefCellEmptyStmtExtensionEmptyExprExtensionIsSyntaxExtension TraverseExt PrettyExt StmtExtension ExprExtensionTypeAppappType PrettyAppppApp$fIsSyntaxExtension()$fTypeAppEmptyExprExtension)$fPrettyAppCrucibleTypeEmptyExprExtension9$fTraversableFCCrucibleTypeCrucibleTypeEmptyExprExtension6$fFoldableFCCrucibleTypeCrucibleTypeEmptyExprExtension5$fFunctorFCCrucibleTypeCrucibleTypeEmptyExprExtension6$fHashableFCCrucibleTypeCrucibleTypeEmptyExprExtension1$fOrdFCCrucibleTypeCrucibleTypeEmptyExprExtension:$fTestEqualityFCCrucibleTypeCrucibleTypeEmptyExprExtension2$fShowFCCrucibleTypeCrucibleTypeEmptyExprExtension$fTypeAppEmptyStmtExtension)$fPrettyAppCrucibleTypeEmptyStmtExtension9$fTraversableFCCrucibleTypeCrucibleTypeEmptyStmtExtension6$fFoldableFCCrucibleTypeCrucibleTypeEmptyStmtExtension5$fFunctorFCCrucibleTypeCrucibleTypeEmptyStmtExtension6$fHashableFCCrucibleTypeCrucibleTypeEmptyStmtExtension1$fOrdFCCrucibleTypeCrucibleTypeEmptyStmtExtension:$fTestEqualityFCCrucibleTypeCrucibleTypeEmptyStmtExtension2$fShowFCCrucibleTypeCrucibleTypeEmptyStmtExtension$fShowEmptyStmtExtension$fShowEmptyExprExtensionBreakpointNamebreakpointNameText GlobalVar globalNonce globalName globalTypefreshGlobalVar$fPrettyGlobalVar$fShowFCrucibleTypeGlobalVar$fShowGlobalVar$fOrdFCrucibleTypeGlobalVar#$fTestEqualityCrucibleTypeGlobalVar$fPrettyBreakpointName$fEqBreakpointName$fOrdBreakpointName$fShowBreakpointNameBitSetgetBitsemptynull singletoninsertremoveunion intersection difference isSubsetOfmembersizetoListfoldl'foldlfoldr$fHashableBitSet $fShowBitSet $fEqBitSet $fOrdBitSetMonadVerbosity getVerbosity whenVerbositygetLogFunctiongetLogLnFunction showWarningshowWarningWhen withVerbosity$fMonadVerbosityReaderTMuxTree toMuxTree viewMuxTree muxTreeCmpOp muxTreeEq muxTreeLt muxTreeLe muxTreeGt muxTreeGecollapseMuxTreemuxTreeUnaryOp muxTreeBinOp mergeMuxTree VariantBranchVBunVB RolledTypeunrollAnyValueCanMuxmuxRegValMuxFnFnVal ClosureFnVal VarargsFnVal HandleFnVal RegValue'RVunRVRegValueMuxFn fnValType eqMergeFn muxVector mergePartExpr muxHandle muxStringMap muxRecursive muxStruct injectVariant muxVariant $fShowFnVal$fCanMuxsymFunctionHandleType$fCanMuxsymMaybeType$fCanMuxsymCharType$fCanMuxsymWordMapType$fCanMuxsymVectorType$fCanMuxsymBaseToType$fCanMuxsymBaseToType0$fCanMuxsymBaseToType1$fCanMuxsymFloatType$fCanMuxsymBaseToType2$fCanMuxsymBaseToType3$fCanMuxsymNatType$fCanMuxsymBaseToType4$fCanMuxsymUnitTypeppFncommas StateContT runStateContT$fMonadCatchStateContT$fMonadThrowStateContT$fMonadReadervStateContT$fMonadSTsStateContT$fMonadIOStateContT$fMonadTransStateContT$fMonadStatesStateContT$fMonadContStateContT$fMonadFailStateContT$fMonadStateContT$fApplicativeStateContT$fFunctorStateContTstructuralPrettyApp ExtensionAppBaseIsEqBaseIteEmptyAppPackAny UnpackAnyBoolLitNotAndOrBoolXorNatLitNatEqNatIteNatLtNatLeNatAddNatSubNatMulNatDivNatModIntLitIntLtIntLeIntNegIntAddIntSubIntMulIntDivIntModIntAbs RationalLitRealLtRealLeRealNegRealAddRealSubRealMulRealDivRealMod RealIsInteger FloatUndefFloatLit DoubleLit X86_80LitFloatNaN FloatPInf FloatNInf FloatPZero FloatNZeroFloatNegFloatAbs FloatSqrtFloatAddFloatSubFloatMulFloatDivFloatRemFloatMinFloatMaxFloatFMAFloatEq FloatFpEqFloatGtFloatGeFloatLtFloatLeFloatNe FloatFpApartFloatIte FloatCastFloatFromBinary FloatToBinary FloatFromBV FloatFromSBV FloatFromReal FloatToBV FloatToSBV FloatToReal FloatIsNaNFloatIsInfinite FloatIsZeroFloatIsPositiveFloatIsNegativeFloatIsSubnormal FloatIsNormal JustValue NothingValue FromJustValue SequenceNil SequenceConsSequenceAppend SequenceIsNilSequenceLength SequenceHead SequenceTailSequenceUncons VectorLitVectorReplicate VectorIsEmpty VectorSizeVectorGetEntryVectorSetEntry VectorCons HandleLitClosure NatToInteger IntegerToReal RealRound RealFloorRealCeil IntegerToBV RealToNatComplexRealPartImagPartBVUndefBVLitBVConcatBVSelectBVTruncBVZextBVSextBVNotBVAndBVOrBVXorBVNegBVAddBVSubBVMulBVUdivBVSdivBVUremBVSremBVUleBVUltBVSleBVSltBVCarryBVSCarry BVSBorrowBVShlBVLshrBVAshrBVRolBVRorBVCountLeadingZerosBVCountTrailingZeros BVPopcountBVUMinBVUMaxBVSMinBVSMaxBoolToBV BvToInteger SbvToIntegerBvToNat BVNonzero EmptyWordMap InsertWordMap LookupWordMapLookupWordMapWithDefault InjectVariantProjectVariantMkStruct GetStruct SetStructEmptyStringMapLookupStringMapEntryInsertStringMapEntry StringLit StringEmpty StringConcat StringLengthStringContainsStringIsPrefixOfStringIsSuffixOf StringIndexOfStringSubstring ShowValue ShowFloatSymArrayLookupSymArrayUpdate IsConcrete ReferenceEqBaseTerm baseTermType baseTermValBVIteRealIteIntIteBoolIteBVEqRealEqIntEqBoolEq testVector compareVector+$fTraversableFCCrucibleTypeBaseTypeBaseTerm($fFoldableFCCrucibleTypeBaseTypeBaseTerm'$fFunctorFCCrucibleTypeBaseTypeBaseTerm$fOrdFBaseTypeBaseTerm#$fOrdFCCrucibleTypeBaseTypeBaseTerm$fTestEqualityBaseTypeBaseTerm,$fTestEqualityFCCrucibleTypeBaseTypeBaseTerm $fTypeAppApp traverseAppfoldAppmapApp*$fTraversableFCCrucibleTypeCrucibleTypeApp'$fFoldableFCCrucibleTypeCrucibleTypeApp&$fFunctorFCCrucibleTypeCrucibleTypeApp$fOrdFCrucibleTypeApp"$fOrdFCCrucibleTypeCrucibleTypeApp$fTestEqualityCrucibleTypeApp+$fTestEqualityFCCrucibleTypeCrucibleTypeApp$fPrettyAppCrucibleTypeAppConvertableToNattoNatNumExpr.+.-.*OrdExpr.<.<=.>.>=EqExpr.==./=LitExprlitExprIsExprExprExtappasAppexprTypeeappasEapptruefalsenotExpr.&&.|| rationalLit integerToReal natToReal realToCplx imagToCplxrealPartimagPartrealLitimagLit natToCplx nothingValue justValue vectorSize vectorIsEmpty vectorLitvectorGetEntryvectorSetEntry vecReplicateclosureemptyIdentValueMap setIdentValuemkStruct getStruct setStructbigEndianStorelittleEndianStore concatExprs bigEndianLoadbigEndianLoadDeflittleEndianLoadlittleEndianLoadDef$$fLitExpreFunctionHandleTypeFnHandle$fLitExpreBaseToTypeText$fLitExpreBaseToTypeInteger$fLitExpreNatTypeNatural$fLitExpreBaseToTypeBool$fEqExpreBaseToType$fEqExpreNatType$fOrdExpreBaseToType$fOrdExpreNatType$fNumExpreNatType$fConvertableToNateBaseToType$fConvertableToNateBaseToType0AnyCFGSomeCFGCFG cfgHandle cfgEntryLabel cfgBlocksBlockblockID blockStmts blockTermblockExtraInputsblockKnownInputsblockAssignedValuesTermStmtJumpBr MaybeBranch VariantElimReturnTailCall ErrorStmtOutputStmtSetReg WriteGlobalWriteRefDropRef DefineAtomPrintAssertAssume Breakpoint AtomValueEvalAppReadRegEvalExt ReadGlobalReadRefNewRef NewEmptyRef FreshConstant FreshFloatFreshNatCallExprAtomExprValueSetValueReg regPositionregId typeOfRegAtom atomPositionatomId atomSource typeOfAtom AtomSourceAssignedFnInput LambdaArgBlockIDLabelIDLambdaID LambdaLabellambdaId lambdaAtomLabellabelId substLabelsubstLambdaLabel substBlockIDsubstAtomSource mkInputAtoms substAtomsubstReg typeOfValue substValue substValueSet substExprtypeOfAtomValuesubstAtomValuefoldStmtInputs substStmt mapStmtAtom substPosdStmt substTermStmtsubstPosdTermStmttermStmtInputstermNextLabelsmkBlock substBlock cfgEntryBlock cfgInputTypes cfgArgTypes cfgReturnTypesubstCFG traverseCFG $fPrettyLabel $fShowLabel $fOrdLabel $fEqLabel$fOrdFCrucibleTypeLambdaLabel%$fTestEqualityCrucibleTypeLambdaLabel $fPrettyAtom $fShowAtom$fOrdFCrucibleTypeAtom$fTestEqualityCrucibleTypeAtom$fPrettyLambdaLabel$fShowLambdaLabel $fOrdBlockID $fEqBlockID $fShowBlockID$fOrdFCrucibleTypeReg$fTestEqualityCrucibleTypeReg$fShowFCrucibleTypeReg $fShowReg $fPrettyReg$fShowFCrucibleTypeValue $fShowValue $fPrettyValue$fOrdFCrucibleTypeValue$fTestEqualityCrucibleTypeValue $fPrettySet$fIsStringExpr $fIsExprExpr$fShowFCrucibleTypeExpr $fShowExpr $fPrettyExpr$fPrettyAtomValue$fShowAtomValue $fPrettyStmt $fShowStmt$fPrettyTermStmt$fShowTermStmt $fPrettyBlock $fShowBlock $fOrdBlock $fEqBlock $fPrettyCFG $fShowCFG $fShowAnyCFGRewriterannotateCFGStmtsaddStmtaddInternalStmtifte freshAtom$fFunctorRewriter$fApplicativeRewriter$fMonadRewriter$fMonadStateuRewriter$fMonadWriterSeqRewriterearlyMergeLoops$fShowBlockIDPair$fShowBlockSwitchInfo $fEqLoopInfo$fShowLoopInfo HasSomeCFGgetCFG cfgBlockMapcfgEntryBlockIDcfgBreakpointsBlockMap blockInputs _blockStmts CFGPostdomStmtSeqConsStmt ExtendAssign CallHandle NewRefCellNewEmptyRefCell ReadRefCell WriteRefCell DropRefCell SwitchTarget JumpTarget blockIDIndexregIndexlastReg extendReg extendBlockIDextendBlockID' jumpTargetIDextendJumpTargetswitchTargetIDextendSwitchTargettermStmtNextBlocksapplyEmbeddingStmt firstStmtLocstmtSeqTermStmtnextStmtHeightppStmtblockLocwithBlockTermStmt nextBlocksgetBlockextendBlockMapppCFGppCFG'+$fExtendContext'CrucibleTypeCrucibleTypeReg,$fApplyEmbedding'CrucibleTypeCrucibleTypeReg,$fExtendContext'CrucibleTypeCrucibleTypeExpr-$fApplyEmbedding'CrucibleTypeCrucibleTypeExpr$fShowFCtxBlockID$fPrettyBlockID$fOrdFCtxBlockID$fTestEqualityCtxBlockID%$fExtendContextCrucibleTypeJumpTarget&$fApplyEmbeddingCrucibleTypeJumpTarget$fPrettyJumpTarget4$fExtendContext'CrucibleTypeCrucibleTypeSwitchTarget5$fApplyEmbedding'CrucibleTypeCrucibleTypeSwitchTarget#$fExtendContextCrucibleTypeTermStmt$$fApplyEmbeddingCrucibleTypeTermStmt#$fApplyEmbeddingCrucibleTypeStmtSeq$fShowFCtxBlock $fShowSomeCFG$fEqReg$fOrdRegRegMapregMapRegEntryregTyperegValue regMapSize emptyRegMap assignReg assignReg' appendRegs unconsRegtakeRegsregregValregVal' muxReference eqReferencepushBranchForTypeabortBranchForType muxRegForType muxRegEntrypushBranchRegEntryabortBranchRegEntry mergeRegspushBranchRegsabortBranchRegs asSymExpr EvalAppFuncselectedIndices integerAsCharcomplexRealAsChar indexSymbolicindexVectorWithSymNatupdateVectorWithSymNatadjustVectorWithSymNatevalAppSymGlobalState GlobalEntryglobalEntryValue emptyGlobals lookupGlobal insertGlobal lookupRef insertRef updateRefdropRefglobalPushBranchglobalAbortBranch globalMuxFn FunctionDef MatchMaybeonJust onNothing Generator getPosition setPosition withPositionmkFresh mkFreshFloatmkAtom readGlobal writeGlobalreadRefwriteRefnewRef newEmptyRefnewRegnewUnassignedRegreadReg modifyReg modifyRegM addPrintStmtaddBreakpointStmt assertExpr assumeExpr recordCFGnewLabelnewLambdaLabelnewLambdaLabel'currentBlockIDcontinuecontinueLambda defineBlockdefineLambdaBlockdefineBlockLabelforceEvaluation extensionStmtcalljump jumpToLambdabranchreturnFromFunction reportError branchMaybe branchVarianttailCallifte'ifte_ifteMwhenCond unlessCond caseMaybe caseMaybe_ fromJustExprassertedJustExprwhiledefineFunctiondefineFunctionOpt$fMonadIOGenerator$fMonadStatetGenerator$fMonadFailGenerator$fMonadGenerator$fMonadTransGenerator$fFunctorGenerator$fApplicativeGenerator$fMonadThrowGenerator$fMonadCatchGeneratorextractSubgraph reachableCFGtoSSA $fOrdInput $fEqInput $fShowInput $fShowPredMap postdomInfobreakpointPostdomInfovalidatePostdomSimFrameOFMFRF FrameRetType OverrideFrame _override_overrideHandle_overrideRegMap OverrideLang CrucibleLang CallFrame _frameCFG_framePostdomMap _frameBlockID _frameRegs _frameStmts _framePostdomCrucibleBranchTarget BlockTarget ReturnTargetppBranchTarget frameBlockMap frameHandleframeReturnTypeframePostdomMap frameBlockID frameStmts frameRegs framePostdom mkCallFrame mkBlockFrameframeProgramLoc setFrameBlocksetFrameBreakpointPostdomInfo updateFrame extendFramemergeCallFrameoverrideoverrideHandleoverrideRegMapoverrideSimFramecrucibleSimFrame fromCallFramefromReturnFrameframeFunctionName'$fTestEqualityMaybeCrucibleBranchTarget CrucibleState SomeSimStateSimState _stateContext _abortHandler _stateTree AbortHandlerAHrunAH SimContext _ctxBackendctxSolverProofctxIntrinsicTypessimHandleAllocator printHandle extensionImpl_functionBindings_cruciblePersonality_profilingMetricsMetric runMetricIsSymInterfaceProof ExtensionImpl extensionEval extensionExec EvalStmtFuncFunctionBindings FnBindings fnBindingsFnState UseOverrideUseCFGOverride overrideNameoverrideHandler ActiveTree _actContext _actResultPartialResultFrame ReturnHandlerReturnToOverrideReturnToCrucibleTailReturnToCrucibleValueFromValueVFVCall VFVPartialVFVEndPendingPartialMerges NoNeedToAbortNeedsToBeAbortedValueFromFrame VFFBranch VFFPartialVFFEnd VFFOtherPath VFFActivePathVFFCompletePath PausedFrame pausedFrameresume pausedLocControlResumptionContinueResumptionCheckMergeResumptionSwitchResumptionOverrideResumption ResolvedJumpRunningStateInfo RunBlockStart RunBlockEnd RunReturnFromRunPostBranchMergeExecCont ExecState ResultState AbortStateUnwindCallState CallState TailCallState ReturnState RunningStateSymbolicBranchStateControlTransferState OverrideStateBranchMergeState InitialState ExecResultFinishedResult AbortedResult TimeoutResult ResolvedCall OverrideCall CrucibleCall PartialResultTotalRes PartialRes SomeFrame AbortedExec AbortedExit AbortedBranchTopFrame GlobalPair_gpValue _gpGlobalsgpValue gpGlobalscrucibleTopFrameoverrideTopFramefilterCrucibleFramesarFramesppExceptionContext partialValueresolvedCallHandleexecResultContextexecStateContextexecStateSimState singletonTree actContextactFrame activeFramesemptyExtensionImplinitSimContext withBackendctxSymInterfacefunctionBindingscruciblePersonalityprofilingMetrics initSimState stateLocation stateContext abortHandler stateTreestateCrucibleFramestateOverrideFrame stateGlobalsstateSymInterfacestateIntrinsicTypesstateConfigurationstateSolverProof$fPrettyVFFOtherPath$fPrettyValueFromFrame$fPrettyValueFromValueUnresolvableFunctionforgetPostdomFrame resolveCallresolvedCallName runOverriderunAbortHandlerrunErrorHandlerrunGenericErrorHandler jumpToBlockperformControlTransferconditionalBranch variantCases returnValue callFunctiontailCallFunctionperformIntraFrameMergedefaultAbortHandlerabortExecAndLog abortExecresumeValueFromValueAbort resumeFrame performReturnoverrideSymbolicBranch asContFrameperformIntraFrameSplitperformFunctionCallperformTailCall isSingleCont unwindContextreplaceTailFrame pushCallFrameextractCurrentPath$fShowUnresolvableFunction$fExceptionUnresolvableFunctionGenericExecutionFeaturerunGenericExecutionFeatureExecutionFeaturerunExecutionFeatureExecutionFeatureResultExecutionFeatureNoChangeExecutionFeatureModifiedStateExecutionFeatureNewStateevalRegevalReg'evalExprevalArgsevalJumpTargetevalSwitchTargetalterRefstepStmtstepTermstepBasicBlockdispatchExecStateadvanceCrucibleStatesingleStepCruciblegenericToExecutionFeatureexecuteCrucibletimeoutFeatureProfilingOptionsperiodicProfileIntervalperiodicProfileActionCrucibleProfilecrucibleProfileTimecrucibleProfileCGEventscrucibleProfileSolverEvents EventFilterrecordProfilingrecordCoverageProfilingTablecallGraphEvents eventDedupsmetrics eventIDRef solverEventsCGEventcgEvent_fnNamecgEvent_sourcecgEvent_callsite cgEvent_typecgEvent_blockscgEvent_metrics cgEvent_time cgEvent_id CGEventTypeENTEREXITBLOCKBRANCHMetrics metricSplits metricMerges metricAbortsmetricSolverStatsmetricExtraMetricssymProUIString symProUIJSONprofilingEventFilterreadProfilingStatenewProfilingTablerecordSolverEventstartRecordingSolverEventsinProfilingFrame enterEvent readMetrics exitEventwriteProfileReportprofilingFeature$fTraversableFTYPEMetrics$fFoldableFTYPEMetrics$fFunctorFTYPEMetrics$fHashableEventDedup$fEqEventDedup$fGenericEventDedup$fShowCrucibleProfile$fGenericCrucibleProfile $fShowCGEvent$fGenericCGEvent$fShowCGEventType$fEqCGEventType$fOrdCGEventType$fGenericCGEventType$fGenericMetrics $fShowMetricspositionTrackingFeatureWorkListWorkItem workItemPred workItemLoc workItemFrame workItemStateworkItemAssumes queueWorkItemdequeueWorkItemrestoreWorkItempathSplittingFeatureexecuteCrucibleDFSPathscheckPathSatisfiabilitypathSatisfiabilityFeaturecheckSatToConsiderBranchSomeTypedOverride TypedOverridetypedOverrideHandlertypedOverrideArgstypedOverrideRet IntrinsicImpl AnyFnBindings FnBinding OverrideSimSimunSim exitExecution getContextgetSymInterfaceovrWithBackend bindFnHandlebindCFG readGlobals writeGlobals modifyGlobal modifyRefreadMuxTreeRefwriteMuxTreeRefrunOverrideSim mkOverride' mkOverridegetOverrideArgswithSimContext callFnVal callFnVal'callCFG callBlock callOverride overrideError overrideAbortoverrideReturnoverrideReturn'symbolicBranchsymbolicBranchesnondetBranchesfnBindingsFromListregisterFnBinding useIntrinsic mkIntrinsicrunTypedOverride$fMonadVerbosityOverrideSim$fMonadThrowOverrideSim$fMonadContOverrideSim$fMonadSTRealWorldOverrideSim$fMonadIOOverrideSim$fMonadFailOverrideSim$fMonadOverrideSim$fFunctorOverrideSim$fApplicativeOverrideSim$fMonadStateSimStateOverrideSimboundedRecursionFeature)$fIntrinsicClasssym"BoundedRecursionData"breakAndReturnSCCSCCDatawtoHeadwtoComps WTOComponentVertexweakTopologicalOrdering cfgSuccessorscfgStartcfgWeakTopologicalOrdering $fFunctorM$fMonadM$fMonadStateWTOStateM$fApplicativeM $fFunctorSCC $fFoldableSCC$fTraversableSCC $fShowSCC$fFunctorWTOComponent$fFoldableWTOComponent$fTraversableWTOComponent$fShowWTOComponentboundedExecFeature)$fIntrinsicClasssym"BoundedExecFrameData"PointedTopBottomIgnore _ignoreOut ScopedRegRefSetPointAbstraction _paGlobals _paRegisters_paRefs_paRegisterRefsInterpretation interpExpr interpExt interpCallinterpReadGlobalinterpWriteGlobalinterpBr interpMaybeDomaindomTop domBottomdomJoindomIterdomEqIterationStrategyWTO WTOWideningWorklist emptyRefSetlookupAbstractRegValuemodifyAbstractRegValuelookupAbstractScopedRegValue#lookupAbstractScopedRegValueByIndexforwardFixpoint'forwardFixpoint paGlobals paRegisterspointed $fOrdStmtId $fEqStmtId$fOrdFCrucibleTypeRefStmtId#$fTestEqualityCrucibleTypeRefStmtId$fShowFCtxPointAbstraction$fShowPointAbstraction$fOrdScopedReg $fEqScopedReg$fShowScopedReg$fShowFkIgnore $fShowIgnore$fShowFCrucibleTypePointed $fShowPointed$fMonadStateIterationStateM $fEqIgnore $fOrdIgnore $fShowStmtId $fEqPointed DFSEdgeFunc DFSNodeFunc DFSEdgeTypeTreeEdgeForwardOrCrossEdgeBackEdgedfs_backedge_targets dfs_backedgesdfs_list dfs_postorder dfs_preorderdfsrun_dfs$fEqDFSEdgeType$fOrdDFSEdgeType$fShowDFSEdgeTypeKildallForwardkfwd_lubkfwd_bot kfwd_club kfwd_cbot kfwd_same kfwd_csamekfwd_br kfwd_maybekfwd_reg kfwd_expr kfwd_call kfwd_rdglobal kfwd_onentry ignoreOut KildallPairKPSymDomDeadSymbolicConcretesymbolicResultssymlubsym_reg_transfersym_expr_transfersym_call_transfersymbolicAnalysiskildall_transferkildall_forward$fShowFkKildallPair$fShowKildallPair $fEqSymDom $fOrdSymDom $fShowSymDomtoBVfromBV joinVecBV splitVecBVassuming GHC.MaybeNothing Data.EitherLeftRightassumeAssertionAS solverProc onlineEnabled SolverStatewithSolverConn GHC.TypeNatsNatMaybeghc-prim GHC.TypesSymbolWhat4.BaseTypesBaseType StringInfo<+> CtxFlatten CtxUpdate CtxLookupCtxUpdateRightCtxLookupRightFromLeftValidIxCheckIxCtxSize SingleCtx-+* Data.Type.Ord<=Data.Type.Equality TestEquality testEquality:~:Refl#Data.Parameterized.NatRepr.InternalnatValue NatComparisonNatLTNatEQNatGTData.Parameterized.SomeSomeData.Parameterized.NatReprNatCases NatCaseLT NatCaseEQ NatCaseGTLeqProof IsZeroNatZeroNat NonZeroNat withKnownNatknownNat minUnsigned maxUnsigned minSigned maxSigned unsignedClamp signedClampmaxNatdivNat compareNatintValuewidthVal isZeroNat isZeroOrGT1decNatpredNatincNathalfNataddNatsubNat withDivModNat natMultiply toUnsignedtoSignedsomeNat mkNatReprplusComm plusAssocmulCommmul2PlusplusMinusCancelminusPlusCanceladdMulDistribRightwithAddMulDistribRightwithSubMulDistribRight decideLeq testStrictLeq testNatCaseslessThanIrreflexivelessThanAsymmetrictestLeqleqReflleqSuccleqTransleqZeroleqAdd2leqSub2leqProof withLeqProofisPosNat leqMulCongr leqMulPos leqMulMonoleqAdd leqAddPosleqSubaddIsLeqaddPrefixIsLeq dblPosIsPos addIsLeqLeft1withAddPrefixLeq withAddLeq natForEach natFromZeronatRec natRecStrong natRecBoundednatRecStrictlyBounded mulCancelRlemmaMul GHC.TypeLits KnownSymbolData.Parameterized.SymbolReprSomeSym SymbolRepr symbolRepr someSymbol knownSymbol viewSomeSymData.Parameterized.Classes KnownRepr knownReprStringInfoRepr Char8Repr Char16Repr UnicodeReprFloatPrecisionReprFloatingPointPrecisionRepr BaseTypeRepr BaseBoolRepr BaseBVReprBaseIntegerRepr BaseRealRepr BaseFloatReprBaseStringReprBaseComplexReprBaseStructRepr BaseArrayReprPrec128Prec80Prec64Prec32Prec16FloatPrecisionBitsFloatingPointPrecisionFloatPrecision BaseArrayTypeBaseStructTypeBaseComplexTypeBaseStringType BaseFloatType BaseBVType BaseRealTypeBaseIntegerType BaseBoolTypeUnicodeChar16Char8KnownCtxarrayTypeIndicesarrayTypeResultfloatPrecisionToBVTypelemmaFloatPrecisionIsPossymSequenceNonce GHC.ClassesEqOrd matchPretty Data.Parameterized.TraversableFC TraversableFCfoldAtomValueInputsstmtAssignedValuefoldTermStmtAtoms traverseStepgather BlockIDPairBlockSwitchInfoValueToPartialMapLoopInfoliFooterliHeader liMembers liEarlyExits liFooterIn liDominatorscfgLoopsisNestedloopsloop loopMemberstoNodeblockSuccessors blockEdgeslowerUndefPass lowerBlocklowerBlockIDValueslowerTermStmtValueslowerValueWriteslowerValueReadslowerAtomReads lowerAtom lowerRegReadmkPartialRegMapmakePartialRegearlyMergeLoop funnelPathsmkBlockSwitchInfo routePaths routerBlockrouterEntryBlockppBlock'hashable-1.4.3.0-Cy9XuTuozCgAdsdKEf3KNiData.Hashable.ClassHashable hashWithSalthashTypeAp HashableF hashWithSaltFhashFAtFatFIxedF'ixF'IxedFixFIxValueFIndexFShowFwithShowshowF showsPrecFOrdFcompareFleqFltFgeqFgtF OrderingFLTFEQFGTFPolyEqpolyEqFpolyEqEqFeqF CoercibleFcoerceF Data.MaybeisJustorderingF_refl toOrdering fromOrdering joinOrderingF lexCompareF ordFComposeshowsFviewSomemapSome traverseSome traverseSome_someLens appendStmtSeqannotateBlockStmtsindexSymbolic'evalBase globalFramesglobalIntrinsics GlobalFrames BranchFrame GlobalUpdatesGlobalContents RefCellUpdateRefCellContents What4.Partial UnassignedemptyGlobalTablemergeGlobalTableapplyGlobalUpdatesglobalPendingBranchesemptyGlobalFramesneedsNotificationabortBranchFramemuxGlobalContentsmuxGlobalUpdatesIxGeneratorStateCurrentBlockState cbsBlockIDcbsStmts gsEntryLabelgsBlocks gsCurrent gsPositiongsState seenFunctionsterminateBlockcall'terminateEarlySubgraphIntermediateData.Parameterized.MapextractSubgraph' remapBlockMap TypedRegMapRegExprs BlockInfo binputArgsInputinputGeneratedPrev nextSetMapgetPredecessorLabels blockPredMapinputsForBlockinitialInputMapcompleteInputsinferBlockInfo resolveReg resolveAtom bindValueRegassignRegisterresolveLambdaAsJumpresolveLambdaAsSwitchresolveTermStmt resolveStmts copyValue reverseEdgeinEdgesreachableSubgraphvalidateTarget parentFrames vfvParents ProgramLocmergeGlobalPair packVarargsWhat4.InterfacePredcheckForIntraFrameMergeresumeValueFromFrameAborthandleSimReturn predEqConst intra_branch returnContextmergeAbortedResultmergePartialAndAbortedResultmergeCrucibleFramecruciblePausedFrame checkConsTermperformStateRunTrueinsertFnBinding wtoSuccessors wtoPartitionwtoStack unwindStack makeComponentvisitSuccessors labelVertex lookupLabelmarkDone resetLabel addComponent buildWTOMapincrementBoundCountData.Functor.ConstConstGHC.ShowShowFunctionAbstraction _faEntryRegs _faExitRegs_faRetStmtId!Data.Parameterized.Context.Unsafe Assignment RefStmtIdWideningOperatorWideningStrategyextendRegistersjoinPointAbstractionsequalPointAbstractionsassignmentLookupByIndextransferiterationStrategyworklistIteration wtoIterationjnBigjnLittleData.Parameterized.VectorVectorjointakezipWithlengthunfoldrfromListunconsreverseshiftLshiftRrotateLrotateRzipWithM zipWithM_nonEmptyconsappendsnocunsnocsplit splitWithelemAtiterateNinsertAt interleavegenerate generateM lengthInt elemAtMaybe elemAtUnsafe indicesUpTo indicesOf insertAtMaybefromAssignment toAssignmentslicemapAtMmapAtreplaceshuffleunfoldrWithIndexMunfoldrWithIndexunfoldrM iterateNM joinWithMjoinWith splitWithA