35 #define forall_objects(it, map) \ 36 for(object_map_dt::const_iterator it=(map).begin(); \ 40 #define forall_valid_objects(it, map) \ 41 for(object_map_dt::const_iterator it=(map).begin(); \ 44 if((map).is_valid_at(it->first, from_function, from_target_index)) 46 #define Forall_objects(it, map) \ 47 for(object_map_dt::iterator it=(map).begin(); \ 51 #define Forall_valid_objects(it, map) \ 52 for(object_map_dt::iterator it=(map).begin(); \ 55 if((map).is_valid_at((it)->first, from_function, from_target_index)) 59 std::ostream &out)
const 61 for(valuest::const_iterator
68 const entryt &e=v_it->second;
99 identifier=symbol.
name;
106 out << display_name <<
"={ ";
116 std::string result=
"<";
118 if(o.
id()==ID_invalid)
122 if(o.
type().
id()==ID_unknown)
124 else if(o.
type().
id()==ID_invalid)
130 else if(o.
id()==ID_unknown)
134 if(o.
type().
id()==ID_unknown)
136 else if(o.
type().
id()==ID_invalid)
144 result+=
from_expr(ns, identifier, o)+
", ";
153 if(o.
type().
id()==ID_unknown)
157 if(o.
type().
id()==
"#REF#")
167 out << result <<
'\n';
170 object_map_dt::validity_rangest::const_iterator vr =
175 if(vr->second.empty())
176 std::cout <<
" Empty validity record\n";
179 for(object_map_dt::vrange_listt::const_iterator vit =
181 vit!=vr->second.end();
185 " [" << vit->from <<
"," << vit->to <<
"]";
188 from_target_index<=vit->to)
196 out <<
" No validity information\n";
200 width+=result.size();
205 if(next!=object_map.
read().
end())
227 std::cout <<
"FLATTEN: Done.\n";
235 unsigned at_function,
236 unsigned at_index)
const 243 assert(seen.find(identifier + e.
suffix)==seen.end());
245 bool generalize_index=
false;
246 std::list<const object_map_dt::vrange_listt*> add_ranges;
248 seen.insert(identifier + e.
suffix);
254 if(o.
type().
id()==
"#REF#")
256 if(seen.find(o.
get(ID_identifier))!=seen.end())
258 generalize_index=
true;
260 object_map_dt::validity_rangest::const_iterator vit=
266 add_ranges.push_back(&vl);
271 valuest::const_iterator fi=
values.find(o.
get(ID_identifier));
283 object_map_dt::validity_rangest::const_iterator ranges_it =
287 for(object_map_dt::vrange_listt::const_iterator r_it =
288 ranges_it->second.begin();
289 r_it!=ranges_it->second.end();
294 if(r_it->function==at_function)
297 flatten_rec(fi->second, temp, seen, r_it->function, r_it->from);
303 if(t_it->second && it->second)
305 *t_it->second += *it->second;
308 t_it->second.reset();
327 for(std::list<const object_map_dt::vrange_listt*>::const_iterator vit =
329 vit!=add_ranges.end();
332 for(object_map_dt::vrange_listt::const_iterator lit =
341 seen.erase(identifier + e.
suffix);
348 if(
object.
id()==ID_invalid ||
349 object.
id()==ID_unknown)
400 dest.
write()[it->first]=it->second;
410 std::list<exprt> &value_set,
421 if(
object.type().id()==
"#REF#")
423 assert(
object.
id()==ID_symbol);
425 const irep_idt &ident=
object.get(ID_identifier);
426 valuest::const_iterator v_it=
values.find(ident);
437 if(t_it->second && it->second)
439 *t_it->second += *it->second;
442 t_it->second.reset();
444 flat_map.
write()[t_it->first]=t_it->second;
449 flat_map.
write()[it->first]=it->second;
453 value_set.push_back(
to_expr(fit));
457 for(std::list<exprt>::const_iterator it=value_set.begin();
460 assert(it->type().id()!=
"#REF");
464 for(std::list<exprt>::const_iterator it=value_set.begin();
467 std::cout <<
"GET_VALUE_SET: " <<
format(*it) <<
'\n';
486 const std::string &suffix,
487 const typet &original_type,
492 std::cout <<
"GET_VALUE_SET_REC EXPR: " << expr <<
'\n';
493 std::cout <<
"GET_VALUE_SET_REC SUFFIX: " << suffix <<
'\n';
497 if(expr.type().id()==
"#REF#")
499 valuest::const_iterator fi=
values.find(expr.get(ID_identifier));
505 original_type, ns, recursion_set);
514 else if(expr.id()==ID_unknown || expr.id()==ID_invalid)
519 else if(expr.id()==ID_index)
521 assert(expr.operands().size()==2);
526 type.id()==ID_incomplete_array ||
528 "operand 0 of index expression must be an array");
531 original_type, ns, recursion_set);
535 else if(expr.id()==ID_member)
537 assert(expr.operands().size()==1);
539 if(expr.op0().is_not_nil())
544 type.
id()==ID_union ||
545 type.
id()==ID_incomplete_struct ||
546 type.
id()==ID_incomplete_union,
547 "operand 0 of member expression must be struct or union");
549 const std::string &component_name=
550 expr.get_string(ID_component_name);
553 original_type, ns, recursion_set);
558 else if(expr.id()==ID_symbol)
562 irep_idt ident=expr.get_string(ID_identifier)+suffix;
571 valuest::const_iterator v_it=
values.find(ident);
583 else if(expr.id()==ID_if)
585 if(expr.operands().size()!=3)
586 throw "if takes three operands";
589 original_type, ns, recursion_set);
591 original_type, ns, recursion_set);
595 else if(expr.id()==ID_address_of)
597 if(expr.operands().size()!=1)
598 throw expr.id_string()+
" expected to have one operand";
604 else if(expr.id()==ID_dereference)
610 if(object_map.
begin()!=object_map.
end())
616 original_type, ns, recursion_set);
622 else if(expr.id()==
"reference_to")
630 if(object_map.
begin()!=object_map.
end())
636 original_type, ns, recursion_set);
642 else if(expr.is_constant())
645 if(expr.get(ID_value)==ID_NULL &&
646 expr.type().id()==ID_pointer)
652 else if(expr.id()==ID_typecast)
654 if(expr.operands().size()!=1)
655 throw "typecast takes one operand";
658 original_type, ns, recursion_set);
662 else if(expr.id()==ID_plus || expr.id()==ID_minus)
664 if(expr.operands().size()<2)
665 throw expr.id_string()+
" expected to have at least two operands";
667 if(expr.type().id()==ID_pointer)
670 const exprt *ptr_operand=
nullptr;
673 if(it->type().id()==ID_pointer)
675 if(ptr_operand==
nullptr)
678 throw "more than one pointer operand in pointer arithmetic";
681 if(ptr_operand==
nullptr)
682 throw "pointer type sum expected to have pointer operand";
686 ptr_operand->
type(), ns, recursion_set);
694 if(expr.op0().type().id()!=ID_pointer)
700 *offset = (expr.id() == ID_plus) ? i : -i;
708 *offset = (expr.id() == ID_plus) ? i : -i;
720 else if(expr.id()==ID_side_effect)
722 const irep_idt &statement=expr.get(ID_statement);
724 if(statement==ID_function_call)
727 throw "unexpected function_call sideeffect";
729 else if(statement==ID_allocate)
731 if(expr.type().id()!=ID_pointer)
732 throw "malloc expected to return pointer type";
736 const typet &dynamic_type=
737 static_cast<const typet &
>(expr.find(ID_C_cxx_alloc_type));
748 else if(statement==ID_cpp_new ||
749 statement==ID_cpp_new_array)
752 assert(expr.type().id()==ID_pointer);
764 else if(expr.id()==ID_struct)
770 else if(expr.id()==ID_with ||
771 expr.id()==ID_array_of ||
775 throw "unexpected value in get_value_set: "+expr.id_string();
777 else if(expr.id()==ID_dynamic_object)
782 const std::string name=
783 "value_set::dynamic_object"+
788 valuest::const_iterator v_it=
values.find(name);
805 if(src.
id()==ID_typecast)
807 assert(src.
type().
id()==ID_pointer);
810 throw "typecast expects one operand";
830 if(expr.
type().
id()==
"#REF#")
833 valuest::const_iterator vit=
values.find(ident);
838 dest.insert(
exprt(ID_unknown, expr.
type()));
849 if(t_it->second && it->second)
851 *t_it->second += *it->second;
854 t_it->second.reset();
884 std::cout <<
"GET_REFERENCE_SET_REC EXPR: " <<
format(expr) <<
'\n';
887 if(expr.
type().
id()==
"#REF#")
889 valuest::const_iterator fi=
values.find(expr.
get(ID_identifier));
897 else if(expr.
id()==ID_symbol ||
898 expr.
id()==ID_dynamic_object ||
899 expr.
id()==ID_string_constant)
901 if(expr.
type().
id()==ID_array &&
909 else if(expr.
id()==ID_dereference)
912 throw expr.
id_string()+
" expected to have one operand";
922 if(obj.
type().
id()==
"#REF#")
925 valuest::const_iterator v_it=
values.find(ident);
936 if(t_it->second && it->second)
938 *t_it->second += *it->second;
941 t_it->second.reset();
955 for(expr_sett::const_iterator it=value_set.begin();
958 std::cout <<
"VALUE_SET: " <<
format(*it) <<
'\n';
963 else if(expr.
id()==ID_index)
966 throw "index expected to have two operands";
972 assert(array_type.
id()==ID_array ||
973 array_type.
id()==ID_incomplete_array);
984 if(
object.
id()==ID_unknown)
992 if(
object.type().id()!=
"#REF#" &&
993 ns.
follow(
object.type())!=array_type)
1013 else if(expr.
id()==ID_member)
1015 const irep_idt &component_name=expr.
get(ID_component_name);
1018 throw "member expected to have one operand";
1032 if(
object.
id()==ID_unknown)
1034 else if(
object.
id()==ID_dynamic_object &&
1035 obj_type.
id()!=ID_struct &&
1036 obj_type.
id()!=ID_union)
1058 else if(expr.
id()==ID_if)
1061 throw "if takes three operands";
1078 std::cout <<
"ASSIGN LHS: " << lhs <<
'\n';
1079 std::cout <<
"ASSIGN LTYPE: " <<
format(ns.
follow(lhs.type())) <<
'\n';
1080 std::cout <<
"ASSIGN RHS: " <<
format(rhs) <<
'\n';
1086 throw "if takes three operands";
1088 assign(lhs, rhs.
op1(), ns, add_to_sets);
1095 if(type.
id()==ID_struct ||
1096 type.
id()==ID_union)
1102 for(struct_typet::componentst::const_iterator
1107 const typet &subtype=c_it->type();
1108 const irep_idt &name=c_it->get(ID_name);
1111 if(subtype.
id()==ID_code)
1118 if(rhs.
id()==ID_unknown ||
1119 rhs.
id()==ID_invalid)
1121 rhs_member=
exprt(rhs.
id(), subtype);
1127 "type mismatch:\nRHS: "+rhs.
type().
pretty()+
"\n"+
1130 if(rhs.
id()==ID_struct ||
1131 rhs.
id()==ID_constant)
1136 else if(rhs.
id()==ID_with)
1141 const exprt &member_operand=rhs.
op1();
1144 member_operand.get(ID_component_name);
1146 if(component_name==name)
1149 rhs_member=rhs.
op2();
1154 rhs_member=
exprt(ID_member, subtype);
1156 rhs_member.
set(ID_component_name, name);
1161 rhs_member=
exprt(ID_member, subtype);
1163 rhs_member.
set(ID_component_name, name);
1166 assign(lhs_member, rhs_member, ns, add_to_sets);
1170 else if(type.
id()==ID_array)
1175 if(rhs.
id()==ID_unknown ||
1176 rhs.
id()==ID_invalid)
1184 if(rhs.
id()==ID_array_of)
1188 assign(lhs_index, rhs.
op0(), ns, add_to_sets);
1190 else if(rhs.
id()==ID_array ||
1191 rhs.
id()==ID_constant)
1195 assign(lhs_index, *o_it, ns, add_to_sets);
1198 else if(rhs.
id()==ID_with)
1205 assign(lhs_index, op0_index, ns, add_to_sets);
1212 assign(lhs_index, rhs_index, ns,
true);
1224 assign_rec(lhs, values_rhs,
"", ns, recset, add_to_sets);
1233 if(op.
type().
id()!=ID_pointer)
1234 throw "free expected to have pointer-type operand";
1252 if(
object.
id()==ID_dynamic_object)
1264 for(valuest::iterator v_it=
values.begin();
1271 v_it->second.object_map.read();
1279 if(
object.
id()==ID_dynamic_object)
1285 set(new_object_map, o_it);
1297 set(new_object_map, o_it);
1303 v_it->second.suffix);
1312 const std::string &suffix,
1318 std::cout <<
"ASSIGN_REC LHS: " << lhs <<
'\n';
1319 std::cout <<
"ASSIGN_REC SUFFIX: " << suffix <<
'\n';
1322 it!=values_rhs.
read().
end(); it++)
1323 std::cout <<
"ASSIGN_REC RHS: " <<
to_expr(it) <<
'\n';
1326 if(lhs.type().id()==
"#REF#")
1328 const irep_idt &ident=lhs.get(ID_identifier);
1333 if(recursion_set.find(ident)!=recursion_set.end())
1335 recursion_set.insert(ident);
1339 suffix, ns, recursion_set, add_to_sets);
1341 recursion_set.erase(ident);
1344 else if(lhs.id()==ID_symbol)
1346 const irep_idt &identifier=lhs.get(ID_identifier);
1349 "value_set::dynamic_object") ||
1351 "value_set::return_value") ||
1371 else if(lhs.id()==ID_dynamic_object)
1376 const std::string name=
1377 "value_set::dynamic_object"+
1393 make_union(temp_entry.object_map, values_rhs);
1395 else if(lhs.id()==ID_dereference)
1397 if(lhs.operands().size()!=1)
1398 throw lhs.id_string()+
" expected to have one operand";
1407 if(
object.
id()!=ID_unknown)
1408 assign_rec(
object, values_rhs, suffix, ns, recursion_set, add_to_sets);
1411 else if(lhs.id()==ID_index)
1413 if(lhs.operands().size()!=2)
1414 throw "index expected to have two operands";
1419 type.
id()==ID_incomplete_array ||
1421 "operand 0 of index expression must be an array");
1424 lhs.op0(), values_rhs,
"[]"+suffix, ns, recursion_set, add_to_sets);
1426 else if(lhs.id()==ID_member)
1428 if(lhs.operands().size()!=1)
1429 throw "member expected to have one operand";
1431 if(lhs.op0().is_nil())
1434 const std::string &component_name=lhs.get_string(ID_component_name);
1439 type.
id()==ID_union ||
1440 type.
id()==ID_incomplete_struct ||
1441 type.
id()==ID_incomplete_union,
1442 "operand 0 of member expression must be struct or union");
1444 assign_rec(lhs.op0(), values_rhs,
"."+component_name+suffix,
1445 ns, recursion_set, add_to_sets);
1447 else if(lhs.id()==
"valid_object" ||
1448 lhs.id()==
"dynamic_size" ||
1449 lhs.id()==
"dynamic_type")
1453 else if(lhs.id()==ID_string_constant)
1458 else if(lhs.id() == ID_null_object)
1462 else if(lhs.id()==ID_typecast)
1467 ns, recursion_set, add_to_sets);
1469 else if(lhs.id()==
"zero_string" ||
1470 lhs.id()==
"is_zero_string" ||
1471 lhs.id()==
"zero_string_length")
1475 else if(lhs.id()==ID_byte_extract_little_endian ||
1476 lhs.id()==ID_byte_extract_big_endian)
1478 assert(lhs.operands().size()==2);
1479 assign_rec(lhs.op0(), values_rhs, suffix, ns, recursion_set,
true);
1482 throw "assign NYI: `"+lhs.id_string()+
"'";
1507 for(std::size_t i=0; i<arguments.size(); i++)
1509 const std::string identifier=
"value_set::" +
id2string(
function) +
"::" +
1512 const symbol_exprt dummy_lhs(identifier, arguments[i].type());
1514 assign(dummy_lhs, arguments[i], ns,
true);
1530 for(code_typet::parameterst::const_iterator
1531 it=parameter_types.begin();
1532 it!=parameter_types.end();
1535 const irep_idt &identifier=it->get_identifier();
1546 assign(actual_lhs, v_expr, ns,
true);
1570 if(statement==ID_block)
1575 else if(statement==ID_function_call)
1580 else if(statement==ID_assign ||
1584 throw "assignment expected to have two operands";
1588 else if(statement==ID_decl)
1591 throw "decl expected to have one operand";
1595 if(lhs.
id()!=ID_symbol)
1596 throw "decl expected to have symbol on lhs";
1600 else if(statement==ID_expression)
1604 else if(statement==ID_cpp_delete ||
1605 statement==ID_cpp_delete_array)
1609 else if(statement==ID_free)
1614 throw "free expected to have one operand";
1618 else if(statement==
"lock" || statement==
"unlock")
1622 else if(statement==ID_asm)
1626 else if(statement==ID_nondet)
1630 else if(statement==ID_printf)
1634 else if(statement==ID_return)
1644 else if(statement==ID_input || statement==ID_output)
1652 "value_set_fivrt: unexpected statement: "+
id2string(statement);
1676 if(old_offset && offset)
1678 if(*old_offset == *offset)
1686 else if(!old_offset)
1717 if(old_offset && offset)
1719 if(*old_offset == *offset)
1727 else if(!old_offset)
1743 for(
unsigned i=vr.
from; i<=vr.
to; i++)
1755 if(is_valid_at(inx, f, line))
1759 vrange_listt::iterator it=ranges.begin();
1761 while(it->function!=f && it!=ranges.end()) it++;
1764 it!=ranges.end() && it->function==f && it->from <= line;
1769 if( line == it->to+1)
1774 vrange_listt::iterator n_it=it; n_it++;
1775 if(n_it!=ranges.end() &&
1776 it->function == n_it->function &&
1777 it->to+1 == n_it->from)
1779 n_it->from=it->from;
1780 it=ranges.erase(it);
1790 if(it!=ranges.end())
1794 if( line == it->from - 1)
1799 if(it!=ranges.begin())
1801 vrange_listt::iterator p_it=it; p_it--;
1802 if(p_it->function == it->function &&
1803 p_it->to+1 == it->from)
1806 it=ranges.erase(it);
1816 ranges.insert(it, insr);
1824 unsigned line)
const 1827 std::cout <<
"IS_VALID_AT: " << inx <<
", " << f <<
", line " << line <<
1831 validity_rangest::const_iterator vrs=validity_ranges.find(inx);
1832 if(vrs!=validity_ranges.end())
1836 object_map_dt::vrange_listt::const_iterator it=ranges.begin();
1838 while(it->function!=f &&
1843 it!=ranges.end() && it->function==f && it->from<=line;
1845 if(it->contains(f, line))
1860 if(o.
id()==ID_symbol && o.
get(ID_identifier)==ident)
1862 else if(o.
type().
id()==
"#REF#")
1866 if(recursion_set.find(oid)!=recursion_set.end())
1873 valuest::const_iterator vit=
values.find(oid);
1876 const entryt &e=vit->second;
1878 recursion_set.insert(oid);
1881 recursion_set.erase(oid);
1894 for(valuest::iterator it=
values.begin();
1917 if(
make_union(state_map, t_it->second.object_map))
The type of an expression.
irep_idt name
The unique identifier.
void get_reference_set(const exprt &expr, expr_sett &expr_set, const namespacet &ns) const
const std::string & id2string(const irep_idt &d)
const std::string integer2string(const mp_integer &n, unsigned base)
void dereference_rec(const exprt &src, exprt &dest) const
std::string pretty(unsigned indent=0, unsigned max_indent=0) const
#define forall_objects(it, map)
void do_end_function(const exprt &lhs, const namespacet &ns)
const dynamic_object_exprt & to_dynamic_object_expr(const exprt &expr)
Cast a generic exprt to a dynamic_object_exprt.
bool base_type_eq(const typet &type1, const typet &type2, const namespacet &ns)
const code_typet & to_code_type(const typet &type)
Cast a generic typet to a code_typet.
void copy_to_operands(const exprt &expr)
std::string from_expr(const namespacet &ns, const irep_idt &identifier, const exprt &expr)
std::vector< parametert > parameterst
bool recursive_find(const irep_idt &ident, const object_mapt &rhs, recfind_recursion_sett &recursion_set) const
const componentst & components() const
#define Forall_objects(it, map)
bool make_union(object_mapt &dest, const object_mapt &src) const
objmapt::iterator iterator
void copy_objects(object_mapt &dest, const object_mapt &src) const
void output(const namespacet &ns, std::ostream &out) const
std::unordered_set< exprt, irep_hash > expr_sett
Symbol table entry.This is a symbol in the symbol table, stored in an object of type symbol_tablet...
unsigned from_target_index
bool offset_is_zero(const offsett &offset) const
Extract member of struct or union.
#define Forall_valid_objects(it, map)
void get_reference_set_sharing_rec(const exprt &expr, object_mapt &dest, const namespacet &ns) const
const irep_idt & id() const
The boolean constant true.
void get_value_set_rec(const exprt &expr, object_mapt &dest, const std::string &suffix, const typet &original_type, const namespacet &ns, gvs_recursion_sett &recursion_set) const
bool insert_from(object_mapt &dest, object_map_dt::const_iterator it) const
bool is_valid_at(unsigned inx, unsigned f, unsigned line) const
void flatten_rec(const entryt &, object_mapt &, flatten_seent &, unsigned from_function, unsigned from_index) const
API to expression classes.
const irep_idt & get(const irep_namet &name) const
void apply_code(const exprt &code, const namespacet &ns)
std::list< validity_ranget > vrange_listt
void do_function_call(const irep_idt &function, const exprt::operandst &arguments, const namespacet &ns)
bool has_prefix(const std::string &s, const std::string &prefix)
split an expression into a base object and a (byte) offset
void get_reference_set_sharing(const exprt &expr, expr_sett &expr_set, const namespacet &ns) const
#define forall_operands(it, expr)
std::unordered_set< idt, string_hash > gvs_recursion_sett
void assign(const exprt &lhs, const exprt &rhs, const namespacet &ns, bool add_to_sets=false)
void get_value_set(const exprt &expr, std::list< exprt > &expr_set, const namespacet &ns) const
const typet & follow(const typet &) const
bitvector_typet index_type()
const struct_typet & to_struct_type(const typet &type)
Cast a generic typet to a struct_typet.
bool make_valid_union(object_mapt &dest, const object_mapt &src) const
entryt & get_entry(const idt &id, const std::string &suffix)
static object_numberingt object_numbering
typename Map::mapped_type number_type
Operator to return the address of an object.
void flatten(const entryt &e, object_mapt &dest) const
static const object_map_dt blank
std::unordered_set< unsigned int > dynamic_object_id_sett
std::string from_type(const namespacet &ns, const irep_idt &identifier, const typet &type)
entryt & get_temporary_entry(const idt &id, const std::string &suffix)
std::vector< exprt > operandst
bool set_valid_at(unsigned inx, unsigned f, unsigned line)
const irep_idt & display_name() const
static const char * alloc_adapter_prefix
validity_rangest validity_ranges
typet type
Type of symbol.
exprt to_expr(object_map_dt::const_iterator it) const
optionalt< mp_integer > offsett
Represents the offset into an object: either a unique integer offset, or an unknown value...
objmapt::const_iterator const_iterator
void assign_rec(const exprt &lhs, const object_mapt &values_rhs, const std::string &suffix, const namespacet &ns, assign_recursion_sett &recursion_set, bool add_to_sets)
bool insert_to(object_mapt &dest, object_map_dt::const_iterator it) const
Base class for all expressions.
const parameterst & parameters() const
#define forall_valid_objects(it, map)
Value Set (Flow Insensitive, Sharing, Validity Regions)
static hash_numbering< irep_idt, irep_id_hash > function_numbering
std::string to_string(const string_constraintt &expr)
Used for debug printing.
std::unordered_set< idt, string_hash > flatten_seent
const typecast_exprt & to_typecast_expr(const exprt &expr)
Cast a generic exprt to a typecast_exprt.
const std::string & id_string() const
void add_var(const idt &id, const std::string &suffix)
Expression to hold a symbol (variable)
exprt dynamic_object(const exprt &pointer)
std::unordered_set< idt, string_hash > assign_recursion_sett
const typet & subtype() const
#define DATA_INVARIANT(CONDITION, REASON)
void do_free(const exprt &op, const namespacet &ns)
void make_typecast(const typet &_type)
std::unordered_set< idt, string_hash > recfind_recursion_sett
bool lookup(const irep_idt &name, const symbolt *&symbol) const override
See namespace_baset::lookup().
const_iterator find(object_numberingt::number_type k)
void set(const irep_namet &name, const irep_idt &value)
bool simplify(exprt &expr, const namespacet &ns)