fix exprt::opX accesses in simplifier

This improves type safety.

Author: Daniel Kroening

src/util/simplify_expr.cpp

@@ -547,13 +547,12 @@ simplify_exprt::simplify_typecast(const typecast_exprt &expr)
   // (void*)(intX)expr -> (void*)expr
   if(
     expr_type.id() == ID_pointer && expr.op().id() == ID_typecast &&
-    expr.op().operands().size() == 1 &&
     (op_type.id() == ID_signedbv || op_type.id() == ID_unsignedbv) &&
     to_bitvector_type(op_type).get_width() >=
       to_bitvector_type(expr_type).get_width())
   {
     auto new_expr = expr;
-    new_expr.op() = expr.op().op0();
+    new_expr.op() = to_typecast_expr(expr.op()).op();
     return changed(simplify_typecast(new_expr)); // rec. call
   }
 
@@ -634,10 +633,10 @@ simplify_exprt::simplify_typecast(const typecast_exprt &expr)
   // (T1 *)(T2 *)x -> (T1 *)x
   if(
     expr_type.id() == ID_pointer && expr.op().id() == ID_typecast &&
-    op_type.id() == ID_pointer && expr.op().operands().size() == 1)
+    op_type.id() == ID_pointer)
   {
     auto new_expr = expr;
-    new_expr.op() = expr.op().op0();
+    new_expr.op() = to_typecast_expr(expr.op()).op();
     return changed(simplify_typecast(new_expr)); // recursive call
   }
 
@@ -1360,25 +1359,27 @@ simplify_exprt::resultt<> simplify_exprt::simplify_object(const exprt &expr)
       const exprt &casted_expr = typecast_expr.op();
       if(casted_expr.id() == ID_plus && casted_expr.operands().size() == 2)
       {
-        const exprt &cand = casted_expr.op0().id() == ID_typecast
-                              ? casted_expr.op0()
-                              : casted_expr.op1();
+        const auto &plus_expr = to_plus_expr(casted_expr);
 
-        if(cand.id()==ID_typecast &&
-           cand.operands().size()==1 &&
-           cand.op0().id()==ID_address_of)
-        {
-          return cand.op0();
-        }
-        else if(cand.id()==ID_typecast &&
-                cand.operands().size()==1 &&
-                cand.op0().id()==ID_plus &&
-                cand.op0().operands().size()==2 &&
-                cand.op0().op0().id()==ID_typecast &&
-                cand.op0().op0().operands().size()==1 &&
-                cand.op0().op0().op0().id()==ID_address_of)
+        const exprt &cand = plus_expr.op0().id() == ID_typecast
+                              ? plus_expr.op0()
+                              : plus_expr.op1();
+
+        if(cand.id() == ID_typecast)
         {
-          return cand.op0().op0().op0();
+          const auto &typecast_op = to_typecast_expr(cand).op();
+
+          if(typecast_op.id() == ID_address_of)
+          {
+            return typecast_op;
+          }
+          else if(
+            typecast_op.id() == ID_plus && typecast_op.operands().size() == 2 &&
+            typecast_op.op0().id() == ID_typecast &&
+            to_typecast_expr(typecast_op.op0()).op().id() == ID_address_of)
+          {
+            return cand.op0().op0().op0();
+          }
         }
       }
     }

src/util/simplify_expr_array.cpp

@@ -9,6 +9,7 @@ Author: Daniel Kroening, [email protected]
 #include "simplify_expr_class.h"
 
 #include "arith_tools.h"
+#include "byte_operators.h"
 #include "namespace.h"
 #include "pointer_offset_size.h"
 #include "replace_expr.h"
@@ -163,6 +164,8 @@ simplify_exprt::simplify_index(const index_exprt &expr)
   else if(array.id()==ID_byte_extract_little_endian ||
           array.id()==ID_byte_extract_big_endian)
   {
+    const auto &byte_extract_expr = to_byte_extract_expr(array);
+
     if(array.type().id() == ID_array || array.type().id() == ID_vector)
     {
       optionalt<typet> subtype;
@@ -179,12 +182,13 @@ simplify_exprt::simplify_index(const index_exprt &expr)
         return unchanged(expr);
 
       // add offset to index
-      mult_exprt offset(from_integer(*sub_size, array.op1().type()), index);
-      plus_exprt final_offset(array.op1(), offset);
+      mult_exprt offset(
+        from_integer(*sub_size, byte_extract_expr.offset().type()), index);
+      plus_exprt final_offset(byte_extract_expr.offset(), offset);
       simplify_node(final_offset);
 
       exprt result_expr(array.id(), expr.type());
-      result_expr.add_to_operands(array.op0(), final_offset);
+      result_expr.add_to_operands(byte_extract_expr.op(), final_offset);
 
       return changed(simplify_rec(result_expr));
     }

src/util/simplify_expr_boolean.cpp

@@ -136,10 +136,9 @@ simplify_exprt::resultt<> simplify_exprt::simplify_boolean(const exprt &expr)
 
     // search for a and !a
     for(const exprt &op : new_operands)
-      if(op.id()==ID_not &&
-         op.operands().size()==1 &&
-         op.type().id()==ID_bool &&
-         expr_set.find(op.op0())!=expr_set.end())
+      if(
+        op.id() == ID_not && op.type().id() == ID_bool &&
+        expr_set.find(to_not_expr(op).op()) != expr_set.end())
       {
         return make_boolean_expr(expr.id() == ID_or);
       }

src/util/simplify_expr_pointer.cpp

@@ -313,7 +313,8 @@ simplify_exprt::simplify_pointer_offset(const unary_exprt &expr)
              tmp.op0().operands().size()==1 &&
              tmp.op0().op0().id()==ID_address_of)
           {
-            auto new_expr = typecast_exprt::conditional_cast(tmp.op1(), type);
+            auto new_expr =
+              typecast_exprt::conditional_cast(to_plus_expr(tmp).op1(), type);
 
             simplify_node(new_expr);
             return new_expr;

src/util/simplify_expr_struct.cpp

@@ -130,6 +130,8 @@ simplify_exprt::simplify_member(const member_exprt &expr)
   else if(op.id()==ID_byte_extract_little_endian ||
           op.id()==ID_byte_extract_big_endian)
   {
+    const auto &byte_extract_expr = to_byte_extract_expr(op);
+
     if(op_type.id()==ID_struct)
     {
       // This rewrites byte_extract(s, o, struct_type).member
@@ -151,20 +153,20 @@ simplify_exprt::simplify_member(const member_exprt &expr)
       if(!offset_int.has_value())
         return unchanged(expr);
 
-      const exprt &struct_offset=op.op1();
+      const exprt &struct_offset = byte_extract_expr.offset();
       exprt member_offset = from_integer(*offset_int, struct_offset.type());
       plus_exprt final_offset(struct_offset, member_offset);
       simplify_node(final_offset);
 
-      byte_extract_exprt result(op.id(), op.op0(), final_offset, expr.type());
+      byte_extract_exprt result(
+        op.id(), byte_extract_expr.op(), final_offset, expr.type());
 
       return changed(simplify_rec(result)); // recursive call
     }
     else if(op_type.id() == ID_union)
     {
       // rewrite byte_extract(X, 0).member to X
       // if the type of X is that of the member
-      const auto &byte_extract_expr = to_byte_extract_expr(op);
       if(byte_extract_expr.offset().is_zero())
       {
         const union_typet &union_type = to_union_type(op_type);
@@ -204,12 +206,14 @@ simplify_exprt::simplify_member(const member_exprt &expr)
   }
   else if(op.id() == ID_typecast)
   {
+    const auto &typecast_expr = to_typecast_expr(op);
+
     // Try to look through member(cast(x)) if the cast is between structurally
     // identical types:
-    if(op_type == op.op0().type())
+    if(op_type == typecast_expr.op().type())
     {
       auto new_expr = expr;
-      new_expr.struct_op() = op.op0();
+      new_expr.struct_op() = typecast_expr.op();
       return changed(simplify_member(new_expr));
     }
 
@@ -224,7 +228,7 @@ simplify_exprt::simplify_member(const member_exprt &expr)
       if(requested_offset.has_value())
       {
         auto equivalent_member = get_subexpression_at_offset(
-          op.op0(), *requested_offset, expr.type(), ns);
+          typecast_expr.op(), *requested_offset, expr.type(), ns);
 
         // Guess: turning this into a byte-extract operation is not really an
         // optimisation.