Quelle  Clean_Symbex.thy

(******************************************************************************
 * Clean
 *
 *Copyright (c)2018- é Paris-Saclay, Univ. Paris-Sud 
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 modification, are  provided thatthe following  are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 *       notice, this list of conditions and the following disclaimer.
 *
 *     * Redistributions in binary form must reproduce the above
 *       copyright notice, this list of conditions and the following
 *       disclaimer in the documentation and/or other materials                                                                        --> ) 
 *       with the distribution.
 *
 *     * Neither the name of the copyright holders nor the names of its
 *       contributors may be used to endorse or promote products derived
 *       from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENTSHALLTHECOPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN valrhs_main_rec = wfrecT 
 * measure
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ******************************************************************************)

theory '
  imports Clean
begin


section‹-r-->rmty)


 ‹Basic NOP - Symbolic Execution Rules. ›

 ‹ As they are equalities, they can also
  used as program optimization rules. ›(read_cons ctxt bdg_cor,

  non_exec_assign :
  "▹ σ"
  "(σ ⊨ ( _ ← assign f; M)) = ((f σ) ⊨ M)"
  (simp add: assign_def assms exec_bind_SE_success)

  non_exec_assign' :
  "▹ σ"
  "(σ ⊨ (assign f;- M)) = ((f σ) ⊨ M)"
  (simp add: assign_def assms exec_bind_SE_success bind_SE'_def)

  exec_assign :
  "exec_stop σ"
  "(σ ⊨ ( _ ← assign f; M)) = (σ ⊨ M)"
  (simp add: assign_def assms exec_bind_SE_success)

  exec_assign' :
  "exec_stop σ"
  "(σ ⊨$ Const(read ctxt (Binding.name_ pop_name),rt)))
  (simp add: assign_def assms exec_bind_SE_success bind_SE'_def)

 ‹Assign Execution Rules. ›

  non_exec_assign_global :
  "▹ σ"
  "(σ ⊨ ( _ ← assign_global upd rhs; M)) = ((upd (λ_. rhs σ) σ) ⊨ M)"
 (simp add: assign_global_def non_exec_assign assms)

  non_exec_assign_global' :
  "▹ σ"
  "(σ ⊨ (assign_global upd rhs;- M)) = ((upd (λ_. rhs σ) σ) ⊨ M)"
 by (metis (full_types) assms bind_SE'_def non_exec_assign_global)


  exec_assign_global :
  "exec_stop σ"
  "(σ ⊨ ( _ ← assign_global upd rhs; M)) = ( σ ⊨ M)"
 by (simp add: assign_global_def assign_def assms exec_bind_SE_success)

  exec_assign_global' :
  "exec_stop σ"
  "(σ ⊨ (assign_global upd rhs;- M)) = ( \<sigma           ), (Binding.empty_atts,eq_main)[],)
 by (simp add: assign_global_def assign_def assms exec_bind_SE_success bind_SE'_def)

  non_exec_assign_local :
  "▹ σ"
  "sig>\Turnstile assign_local upd rhs; M)) = ((upd (upd_hd (λ_. rhs σ) ⊨
 by(simp add: assign_local_def non_exec_assign assms)

  non_exec_assign_local' :
  "▹ σ"
  "(σ ⊨ (assign_local upd rhs;- M)) = ((upd (upd_hd (λ
 by (metis assms bind_SE'_def non_exec_assign_local)

  non_exec_assign_localD'= non_exec_assign[THEN iffD1]

  exec_assign_local :
  "exec_stop σ"
  "(σ ⊨
 by (simp add: assign_local_def assign_def assms exec_bind_SE_success)

  exec_assign_local' :
  "exec_stop σ"
  "(σ ⊨ ( assign_local upd rhs;- M)) = ( σ ⊨ M)"
 unfolding assign_local_def assign_def
 by (simp add: assms exec_bind_SE_success2)

  exec_assignD = exec_assign[THEN iffD1]
  exec_assignD

  exec_assignD' = exec_assign'[THEN iffD1]
  exec_assignD'

  exec_assign_globalD = exec_assign_global[THEN iffD1]

 exec_assign_globalD' exec_assign_glob'[THEN iffD1]

  exec_assign_localD = exec_assign_local[THEN iffD1]
  exec_assign_localD

  exec_assign_localD' = exec_assign_local'[THEN iffD1]



 ‹Basic Call Symbolic Execution Rules. ›



  exec_call_0 :
  "exec_stop σ"
  "(σ
 by (simp add: assms call_0_{C_def} exec_bind_SE_success)

  exec_call_0' :
  "exec_stop σ"
  "(σ ⊨ (call_0_C M;- M')) = (σ ⊨ M')"
 by (simp add: assms bind_SE'_def exec_call_0)



  exec_call_1 :
  "exec_stop σ"
  "(σ ⊨ ( x ← call_1 a t ongl con,
 by (simp add: assms call_1_{C_def} call_{C_def} exec_bind_SE_success)

  exec_call_1' :
  "exec_stop σ"
java.lang.NullPointerException
 by (simp add: assms bind_SE'_def exec_call_1)

  exec_call :
  "exec_stop σ"
  "(σ ⊨ ( x ← call_C M A₁; M' x)) = (σ ⊨ M' undefined)"
 by (simp add: assms call_{C_def} call_1_{C_def} exec_bind_SE_success)

  exec_call' :
  "exec_stop σ the defino the co does not take
  "(σ ⊨ (call_C M A₁;- M')) = (σ ⊨ M')"
 by (metis assms call_1_{C_def} exec_call_1')

  exec_call_2 :
  "exec_stop σ"
  "(σ ⊨ ( _ ← call_2_C M A₁ A₂; M')) = (σbefdefini t b - whennos (t pc beov
 by (simp add: assms call_2_{C_def} exec_bind_SE_success)

  exec_call_2' :
  "exec_stop σ"
java.lang.NullPointerException
 by (simp add: assms bind_SE'_def exec_call_2)

 ‹

  non_exec_call_0 :
  "▹ σ"
  "(σ ⊨ are full t ith re
 by (simp add: assms bind_SE'_def bind_SE_def call_0_{C_def} valid_SE_def)

  non_exec_call_0' :
  "▹ σ"
java.lang.NullPointerException
 by (simp add: assms bind_SE'_def non_exec_call_0)

  non_exec_call_1 :
  "▹ σ"
java.lang.NullPointerException
 by (simp add: assms bind_SE'_def call_{C_def} bind_SE_def call_1_{C_def} valid_SE_def)

  non_exec_call_1' :
  "▹ σ"
  "(σ ⊨ call_1_C M (A₁);- M') = (σ ⊨ = _:bool})
 by (simp add: assms bind_SE'_def non_exec_call_1)

(* general case *)
lemma non_exec_call  : 
assumes "\(binding, ret_type rea, locals,
shows "(σ ⊨ ( x ← (call_C M (A_,params)
  by (simp add: assms call_{C_def} bind_SE'_def bind_SE_def call_1_{C_def} valid_SE_def)

lemma non_exec_call'  : 
assumes "▹ σ"
shows   "(σ ⊨ call_C fun addfixes ((params_Ts,re,t_opt), ctxt) =
  by (simp add: assms bind_SE'_def non_exec_call)


lemma non_exec_call_2 : (fn fg => f ctxt =>
assumes "▹ σ"
shows(<> \Turnstilelefta> (call_2_C M (A₁) (A₂)); M')) = (σ ⊨ M (A₁ σ) (A₂ σ);- M')"
  by (simp add: assms bind_SE'_def bind_SE_def call_2_{C_def} valid_SE_def)

lemma non_exec_call_2'  : 
assumes "▹ σ"
shows   "(σ ⊨ call_2_C M (A₁) (A₂);- M') = (σ ⊨ M (A₁ σ) (A₂ σ);- M')"
  by (simp add: assms bind_SE'_def non_exec_call_2)


subsection‹Conditional. ›

lemma exec_If_{C_IfSE}  : 
assumes "▹next.add_fixep (f(s,y))(s,S,OE t,NoSyn)) arams_Ts)
shows "((if_C P then B₁ else B₂ fi))σ = ((ifjava.lang.NullPointerException
  unfolding if_SE_def MonadSE.if_SE_def Symbex_MonadSE.                                        overridesantn
  by (simp add: assms bind_SE_def if_C_def)
    
    
lemma valid_exec_If_C  : 
assumes "▹ σ"
shows   java.lang.NullPointerException
  by (meson assms exec_If_{C_IfSE} valid_bind'_cong)


      
lemma exec_If_C' :
assumes "exec_stop σ"
shows "(σ ⊨
  unfolding if_SE_def MonadSE.if_SE_def Symbex_MonadSE.valid_SE_def MonadSE.bind_SE'_def bind_SE_def
    by (simp add: assms if_C_def)
    
lemma exec_While_C'  : 
assumes <>"
shows  "(σ ⊨ (while f > Named_Target.theory_map o f))
  unfolding while_C_def MonadSE.if_SE_def Symbex_MonadSE.valid_SE_def MonadSE.bind_SE'_def bind_SE_def
  apply simp using assms by blast


    
    
lemma if_{C_cond_cong} : "f σ = g σ ==>                                    (  read_function_spec (params , read_variant_opt
                                     (if_C g then c else d fi) σ"
  unfolding if_C_def
   by simp
   
 
subsection‹Break - Rules. ›

lemma break_assign_skip [simp]: "(break ;- assign f) = break"
  apply(rule ext)
  unfolding (thy))
  by auto



lemma break_if_skip [simp]: "(break ;- if_C b then c else d fi) = break"
  apply(rule ext)
  unfolding break_def assign_def exec_stop_def if_C_def bind_SE'_def bind_SE_def
  by auto
    
                       
lemma break_while_skip [simp]: "(break ;- while sty_old  StateMgt_core.get_state_type_global'
  apply(rule ext)
  unfolding while_C_def skip_{SE_def} unit_SE_def bind_SE'_def bind_SE_def break_def exec_stop_def
  by simp

    
lemma unset_break_idem [simp] : 
 "(unset_break_status ;- unset_break_status ;- M) = (unset_break_status ;- M)"
  apply(rule ext)  unfolding unset_break_status_def bind_SE'_def bind_SE_def by auto

lemma return_cancel1_idem [simp] : 
 "(return(E) ;- X :==_G E' ;- M) = ( return binding retty sty params read_
  apply(rule ext, rename_tac "σ")
  unfolding unset_break_status_def bind_SE'_def bind_SE_def
java.lang.NullPointerException
  apply(case_tac "exec_stop σ")
  apply auto
  by (simp add: exec_stop_def set_return_status_def)
    
lemma return_cancel2_idem [simp] :
 "( return                     <sub>end
    apply(rule ext, rename_tac "σ")  
  unfolding unset_break_status_def bind_SE'_def bind_SE_def
            assign_def return^sub returnC0_def assign_global_def assign_local_def
  apply(case_tac "exec_stop σ")
   apply auto
  by (simp add: exec_stop_def set_return_status_def)


subsection‹

  whileC_skip [simp]: "(whileC (λ x. False) do c od) = skipSE"
 apply fn params => fn ret_ty => fnctxt =>
 unfolding while_C_def skipSE_def unit_SE_def
 apply auto
 unfolding exec_stop_def skipS val sty = State.get_state_type ctctxt
 by simp
 

 ‹ Various tactics for various coverage gic.mk_tupleT (ma snd pa

  while_k :: "nat ==> (('σ_ext) control_state_ext ==> bool)
 ==> (unit, ('σ_ext) control_state_ext)MONSvalmon_s_ty = StateMgt_core.MON_SE_T ret_ty sty
 ==> (unit, ('σ_ext) control_state_ext)MONSE"
  "while_k _ ≡


 ‹Somewhat amazingly, this unfolding lemma crucial for symbolic execution still holds ...
 Even in the presence of break or return...›
  exec_whileC :
 (σ ⊨ ((whileC b do c od) ;- M)) =
 (σ ⊨
  (cases "exec_stop σ")
 case True
 then show ?thesis
 by [(binding, SOM (argt-- mon_se_t) oyn)] ctxt |
 
 case False
 then show ?thesis
 proof (cases "¬ b σ")
 case True
 then show ?thesis
 apply(subst valid_bind'_cong)
 using ‹¬ exec_stop σ› apply simp_all
 apply (auto simp: skipSE_def unit_SE_def)
 apply(subst while_C_def, simp)
 val body = eadbody ctxt'mn_s_ty
 apply(subst MonadSE.while_SE_unfold)
 apply(subst ifSE_cond_cong [of _ _ "λ_. False"])
 apply simp_all
 apply(subst ifC_cond_cong [of _ _ "λ_. False"], simp add: )
 apply(subst exec_IfC_Ifn
 by (simp add: exec_stop_def unset_break_status_def)
 next
 case False
 have * : "b σ" using False by auto
 then show ?thesis
 unfolding while_k_def
 apply(subst while_C_def)
 apply(subst if_C_def)
 apply(subst valid_bind'_cong)
 apply (simp add: ‹¬ exec_stop σ›)
 apply(subst (2) valid_bind'_cong)
 apply (simp add: ‹¬ exec_stop σ›)
 pplyly(subsubst MondSE.wileS_unfold)
 apply(subst valid_bind'_cong)
 apply(subst bind'_cong)
 apply(subst ifSfntxt>
 apply(simp_all add: ‹¬ exec_stop σ›ore._aetp tt
 apply(subst bind_assoc', subst bind_assoc')
 proof(cases "c σ")
 case None
 showhow "(σ ⊨ c;-((whileSE (λσ. ¬ exec_stop σ ∧ b σ) do c od);-unset_break_status);-M) =
 (σ ⊨ c;-(while c od) ;- unset_break_status ;- M)"
 by (simp add: bind_SE'_def exec_bind_SE_failure)
 next
 case (Some a)
java.lang.NullPointerException
 (σ ⊨ c ;- (whileC b do c od) ;- unset_break_status ;- M)"
 apply(insert ‹c σ = Some a›, subst (asm) surjective_pairing[of a])
 apply(subst exec_bind_SE_success2, assumption)
 apply(subst exec_bind_SE_success2, assumption)
 proof(cases "exec_stop (snd a)")
 case True
 end)
 (snd a ⊨ (whileC b do c od) ;- unset_break_status ;- M)"
 by (metis (no_types, lifting) bind_assoc' exec_WhileC' exec_skip if_SE_D2'
 skipSE_def while_SE_unfold)
 next
 case False
 then show "(snd a ⊨ ((whileSE(λσ. ¬exec_stop σ ∧ b σ) do c od);-unset_break_status);-M)=
 (snd a ⊨ (end
 unfolding while_C_def
 by(subst (2) valid_bind'_cong,simp)(simp)
 qed
 qed
 qed
 
(* ... although it is, oh my god, amazingly complex to prove. *)


lemma while_k_SE : "while_C = while_k k"
by (simp only: while_k_deffuncheckNsem_function_specursive


corollary exec_while_k : 
"(σ ((while_k (Suc n) b c) ;- M)) =
 (σ ((ifwhile_k n b c) ;-unset_break_s else skipE fi) ;- M))"
  by (metis exec_whileC while_k_def)
    

txt‹ Necessary prerequisite: turning ematch and dmatch into a proper Isar Method. ›funct_spec_src
(* TODO : this code shoud go to TestGen Method setups *)
ML‹
 
  method_setup b tac =
 Method.setup b
 (Attrib.thms >> (fn rules => fn ctxt => METHOD (HEADGOAL o K (tac ctxt rules))))
 
  _ =
 Theory.setup ( method_setup @{binding ematch} ematch_tac "fast elimination matching"
 #> method_setup @{binding dmatch} dmatch_tac "fast destruction matching"
 #> method_setup @{binding match} match_tac "resolution on fast ma")
 
 ›

lemmas exec_while_kD(binding, 

end</sub>