35 #define forall_objects(it, map) \ 36 for(object_map_dt::const_iterator it=(map).begin(); \ 40 #define forall_valid_objects(it, map) \ 41 for(object_map_dt::const_iterator it=(map).begin(); \ 44 if((map).is_valid_at(it->first, from_function, from_target_index)) 46 #define Forall_objects(it, map) \ 47 for(object_map_dt::iterator it=(map).begin(); \ 51 #define Forall_valid_objects(it, map) \ 52 for(object_map_dt::iterator it=(map).begin(); \ 55 if((map).is_valid_at((it)->first, from_function, from_target_index)) 59 std::ostream &out)
const 61 for(valuest::const_iterator
68 const entryt &e=v_it->second;
99 identifier=symbol.
name;
106 out << display_name <<
"={ ";
116 std::string result=
"<";
118 if(o.
id()==ID_invalid)
122 if(o.
type().
id()==ID_unknown)
124 else if(o.
type().
id()==ID_invalid)
130 else if(o.
id()==ID_unknown)
134 if(o.
type().
id()==ID_unknown)
136 else if(o.
type().
id()==ID_invalid)
144 result+=
from_expr(ns, identifier, o)+
", ";
153 if(o.
type().
id()==ID_unknown)
157 if(o.
type().
id()==
"#REF#")
167 out << result <<
'\n';
170 object_map_dt::validity_rangest::const_iterator vr =
175 if(vr->second.empty())
176 std::cout <<
" Empty validity record\n";
179 for(object_map_dt::vrange_listt::const_iterator vit =
181 vit!=vr->second.end();
185 " [" << vit->from <<
"," << vit->to <<
"]";
188 from_target_index<=vit->to)
196 out <<
" No validity information\n";
200 width+=result.size();
205 if(next!=object_map.
read().
end())
227 std::cout <<
"FLATTEN: Done.\n";
235 unsigned at_function)
const 242 assert(seen.find(identifier + e.
suffix)==seen.end());
244 bool generalize_index=
false;
245 std::list<const object_map_dt::vrange_listt*> add_ranges;
247 seen.insert(identifier + e.
suffix);
253 if(o.
type().
id()==
"#REF#")
255 if(seen.find(o.
get(ID_identifier))!=seen.end())
257 generalize_index=
true;
259 object_map_dt::validity_rangest::const_iterator vit=
265 add_ranges.push_back(&vl);
270 valuest::const_iterator fi=
values.find(o.
get(ID_identifier));
282 object_map_dt::validity_rangest::const_iterator ranges_it =
286 for(object_map_dt::vrange_listt::const_iterator r_it =
287 ranges_it->second.begin();
288 r_it!=ranges_it->second.end();
293 if(r_it->function==at_function)
296 flatten_rec(fi->second, temp, seen, r_it->function);
302 if(t_it->second && it->second)
304 *t_it->second += *it->second;
307 t_it->second.reset();
326 for(std::list<const object_map_dt::vrange_listt*>::const_iterator vit =
328 vit!=add_ranges.end();
331 for(object_map_dt::vrange_listt::const_iterator lit =
340 seen.erase(identifier + e.
suffix);
347 if(
object.
id()==ID_invalid ||
348 object.
id()==ID_unknown)
360 return std::move(od);
399 dest.
write()[it->first]=it->second;
409 std::list<exprt> &value_set,
420 if(
object.type().id()==
"#REF#")
422 assert(
object.
id()==ID_symbol);
424 const irep_idt &ident=
object.get(ID_identifier);
425 valuest::const_iterator v_it=
values.find(ident);
436 if(t_it->second && it->second)
438 *t_it->second += *it->second;
441 t_it->second.reset();
443 flat_map.
write()[t_it->first]=t_it->second;
448 flat_map.
write()[it->first]=it->second;
452 value_set.push_back(
to_expr(fit));
456 for(std::list<exprt>::const_iterator it=value_set.begin();
459 assert(it->type().id()!=
"#REF");
463 for(std::list<exprt>::const_iterator it=value_set.begin();
466 std::cout <<
"GET_VALUE_SET: " <<
format(*it) <<
'\n';
485 const std::string &suffix,
486 const typet &original_type,
491 std::cout <<
"GET_VALUE_SET_REC EXPR: " << expr <<
'\n';
492 std::cout <<
"GET_VALUE_SET_REC SUFFIX: " << suffix <<
'\n';
496 if(expr.type().id()==
"#REF#")
498 valuest::const_iterator fi=
values.find(expr.get(ID_identifier));
504 original_type, ns, recursion_set);
513 else if(expr.id()==ID_unknown || expr.id()==ID_invalid)
518 else if(expr.id()==ID_index)
520 assert(expr.operands().size()==2);
525 type.id()==ID_incomplete_array ||
527 "operand 0 of index expression must be an array");
530 original_type, ns, recursion_set);
534 else if(expr.id()==ID_member)
536 assert(expr.operands().size()==1);
538 if(expr.op0().is_not_nil())
543 type.
id()==ID_union ||
544 type.
id()==ID_incomplete_struct ||
545 type.
id()==ID_incomplete_union,
546 "operand 0 of member expression must be struct or union");
548 const std::string &component_name=
549 expr.get_string(ID_component_name);
552 original_type, ns, recursion_set);
557 else if(expr.id()==ID_symbol)
561 irep_idt ident=expr.get_string(ID_identifier)+suffix;
570 valuest::const_iterator v_it=
values.find(ident);
582 else if(expr.id()==ID_if)
584 if(expr.operands().size()!=3)
585 throw "if takes three operands";
588 original_type, ns, recursion_set);
590 original_type, ns, recursion_set);
594 else if(expr.id()==ID_address_of)
596 if(expr.operands().size()!=1)
597 throw expr.id_string()+
" expected to have one operand";
603 else if(expr.id()==ID_dereference)
609 if(object_map.
begin()!=object_map.
end())
615 original_type, ns, recursion_set);
621 else if(expr.id()==
"reference_to")
629 if(object_map.
begin()!=object_map.
end())
635 original_type, ns, recursion_set);
641 else if(expr.is_constant())
644 if(expr.get(ID_value)==ID_NULL &&
645 expr.type().id()==ID_pointer)
651 else if(expr.id()==ID_typecast)
653 if(expr.operands().size()!=1)
654 throw "typecast takes one operand";
657 original_type, ns, recursion_set);
661 else if(expr.id()==ID_plus || expr.id()==ID_minus)
663 if(expr.operands().size()<2)
664 throw expr.id_string()+
" expected to have at least two operands";
666 if(expr.type().id()==ID_pointer)
669 const exprt *ptr_operand=
nullptr;
672 if(it->type().id()==ID_pointer)
674 if(ptr_operand==
nullptr)
677 throw "more than one pointer operand in pointer arithmetic";
680 if(ptr_operand==
nullptr)
681 throw "pointer type sum expected to have pointer operand";
685 ptr_operand->
type(), ns, recursion_set);
693 if(expr.op0().type().id()!=ID_pointer)
699 *offset = (expr.id() == ID_plus) ? i : -i;
707 *offset = (expr.id() == ID_plus) ? i : -i;
719 else if(expr.id()==ID_side_effect)
721 const irep_idt &statement=expr.get(ID_statement);
723 if(statement==ID_function_call)
726 throw "unexpected function_call sideeffect";
728 else if(statement==ID_allocate)
730 if(expr.type().id()!=ID_pointer)
731 throw "malloc expected to return pointer type";
735 const typet &dynamic_type=
736 static_cast<const typet &>(expr.find(ID_C_cxx_alloc_type));
747 else if(statement==ID_cpp_new ||
748 statement==ID_cpp_new_array)
751 assert(expr.type().id()==ID_pointer);
763 else if(expr.id()==ID_struct)
769 else if(expr.id()==ID_with ||
770 expr.id()==ID_array_of ||
774 throw "unexpected value in get_value_set: "+expr.id_string();
776 else if(expr.id()==ID_dynamic_object)
781 const std::string name=
782 "value_set::dynamic_object"+
787 valuest::const_iterator v_it=
values.find(name);
804 if(src.
id()==ID_typecast)
806 assert(src.
type().
id()==ID_pointer);
809 throw "typecast expects one operand";
829 if(
object.type().id() ==
"#REF#")
831 const irep_idt &ident =
object.get(ID_identifier);
832 valuest::const_iterator vit=
values.find(ident);
837 dest.insert(
exprt(ID_unknown,
object.type()));
848 if(t_it->second && it->second)
850 *t_it->second += *it->second;
853 t_it->second.reset();
883 std::cout <<
"GET_REFERENCE_SET_REC EXPR: " <<
format(expr) <<
'\n';
886 if(expr.
type().
id()==
"#REF#")
888 valuest::const_iterator fi=
values.find(expr.
get(ID_identifier));
896 else if(expr.
id()==ID_symbol ||
897 expr.
id()==ID_dynamic_object ||
898 expr.
id()==ID_string_constant)
900 if(expr.
type().
id()==ID_array &&
908 else if(expr.
id()==ID_dereference)
911 throw expr.
id_string()+
" expected to have one operand";
921 if(obj.
type().
id()==
"#REF#")
924 valuest::const_iterator v_it=
values.find(ident);
935 if(t_it->second && it->second)
937 *t_it->second += *it->second;
940 t_it->second.reset();
954 for(expr_sett::const_iterator it=value_set.begin();
957 std::cout <<
"VALUE_SET: " <<
format(*it) <<
'\n';
962 else if(expr.
id()==ID_index)
965 throw "index expected to have two operands";
971 assert(array_type.
id()==ID_array ||
972 array_type.
id()==ID_incomplete_array);
983 if(
object.
id()==ID_unknown)
991 if(
object.type().id()!=
"#REF#" &&
992 ns.
follow(
object.type())!=array_type)
1012 else if(expr.
id()==ID_member)
1014 const irep_idt &component_name=expr.
get(ID_component_name);
1017 throw "member expected to have one operand";
1031 if(
object.
id()==ID_unknown)
1033 else if(
object.
id()==ID_dynamic_object &&
1034 obj_type.
id()!=ID_struct &&
1035 obj_type.
id()!=ID_union)
1057 else if(expr.
id()==ID_if)
1060 throw "if takes three operands";
1077 std::cout <<
"ASSIGN LHS: " << lhs <<
'\n';
1078 std::cout <<
"ASSIGN LTYPE: " <<
format(ns.
follow(lhs.type())) <<
'\n';
1079 std::cout <<
"ASSIGN RHS: " <<
format(rhs) <<
'\n';
1085 throw "if takes three operands";
1087 assign(lhs, rhs.
op1(), ns, add_to_sets);
1094 if(type.
id()==ID_struct ||
1095 type.
id()==ID_union)
1101 for(struct_typet::componentst::const_iterator
1106 const typet &subtype=c_it->type();
1107 const irep_idt &name = c_it->get_name();
1110 if(subtype.
id()==ID_code)
1117 if(rhs.
id()==ID_unknown ||
1118 rhs.
id()==ID_invalid)
1120 rhs_member=
exprt(rhs.
id(), subtype);
1126 "type mismatch:\nRHS: "+rhs.
type().
pretty()+
"\n"+
1129 if(rhs.
id()==ID_struct ||
1130 rhs.
id()==ID_constant)
1135 else if(rhs.
id()==ID_with)
1140 const exprt &member_operand=rhs.
op1();
1143 member_operand.get(ID_component_name);
1145 if(component_name==name)
1148 rhs_member=rhs.
op2();
1153 rhs_member=
exprt(ID_member, subtype);
1155 rhs_member.
set(ID_component_name, name);
1160 rhs_member=
exprt(ID_member, subtype);
1162 rhs_member.
set(ID_component_name, name);
1165 assign(lhs_member, rhs_member, ns, add_to_sets);
1169 else if(type.
id()==ID_array)
1174 if(rhs.
id()==ID_unknown ||
1175 rhs.
id()==ID_invalid)
1183 if(rhs.
id()==ID_array_of)
1187 assign(lhs_index, rhs.
op0(), ns, add_to_sets);
1189 else if(rhs.
id()==ID_array ||
1190 rhs.
id()==ID_constant)
1194 assign(lhs_index, *o_it, ns, add_to_sets);
1197 else if(rhs.
id()==ID_with)
1204 assign(lhs_index, op0_index, ns, add_to_sets);
1211 assign(lhs_index, rhs_index, ns,
true);
1223 assign_rec(lhs, values_rhs,
"", ns, recset, add_to_sets);
1230 const std::string &suffix,
1236 std::cout <<
"ASSIGN_REC LHS: " << lhs <<
'\n';
1237 std::cout <<
"ASSIGN_REC SUFFIX: " << suffix <<
'\n';
1240 it!=values_rhs.
read().
end(); it++)
1241 std::cout <<
"ASSIGN_REC RHS: " <<
to_expr(it) <<
'\n';
1244 if(lhs.type().id()==
"#REF#")
1246 const irep_idt &ident=lhs.get(ID_identifier);
1251 if(recursion_set.find(ident)!=recursion_set.end())
1253 recursion_set.insert(ident);
1257 suffix, ns, recursion_set, add_to_sets);
1259 recursion_set.erase(ident);
1262 else if(lhs.id()==ID_symbol)
1264 const irep_idt &identifier=lhs.get(ID_identifier);
1267 "value_set::dynamic_object") ||
1269 "value_set::return_value") ||
1289 else if(lhs.id()==ID_dynamic_object)
1294 const std::string name=
1295 "value_set::dynamic_object"+
1311 make_union(temp_entry.object_map, values_rhs);
1313 else if(lhs.id()==ID_dereference)
1315 if(lhs.operands().size()!=1)
1316 throw lhs.id_string()+
" expected to have one operand";
1325 if(
object.
id()!=ID_unknown)
1326 assign_rec(
object, values_rhs, suffix, ns, recursion_set, add_to_sets);
1329 else if(lhs.id()==ID_index)
1331 if(lhs.operands().size()!=2)
1332 throw "index expected to have two operands";
1337 type.
id()==ID_incomplete_array ||
1339 "operand 0 of index expression must be an array");
1342 lhs.op0(), values_rhs,
"[]"+suffix, ns, recursion_set, add_to_sets);
1344 else if(lhs.id()==ID_member)
1346 if(lhs.operands().size()!=1)
1347 throw "member expected to have one operand";
1349 if(lhs.op0().is_nil())
1352 const std::string &component_name=lhs.get_string(ID_component_name);
1357 type.
id()==ID_union ||
1358 type.
id()==ID_incomplete_struct ||
1359 type.
id()==ID_incomplete_union,
1360 "operand 0 of member expression must be struct or union");
1362 assign_rec(lhs.op0(), values_rhs,
"."+component_name+suffix,
1363 ns, recursion_set, add_to_sets);
1365 else if(lhs.id()==
"valid_object" ||
1366 lhs.id()==
"dynamic_size" ||
1367 lhs.id()==
"dynamic_type")
1371 else if(lhs.id()==ID_string_constant)
1376 else if(lhs.id() == ID_null_object)
1380 else if(lhs.id()==ID_typecast)
1385 ns, recursion_set, add_to_sets);
1387 else if(lhs.id()==
"zero_string" ||
1388 lhs.id()==
"is_zero_string" ||
1389 lhs.id()==
"zero_string_length")
1393 else if(lhs.id()==ID_byte_extract_little_endian ||
1394 lhs.id()==ID_byte_extract_big_endian)
1396 assert(lhs.operands().size()==2);
1397 assign_rec(lhs.op0(), values_rhs, suffix, ns, recursion_set,
true);
1400 throw "assign NYI: `"+lhs.id_string()+
"'";
1425 for(std::size_t i=0; i<arguments.size(); i++)
1427 const std::string identifier=
"value_set::" +
id2string(
function) +
"::" +
1430 const symbol_exprt dummy_lhs(identifier, arguments[i].type());
1432 assign(dummy_lhs, arguments[i], ns,
true);
1448 for(code_typet::parameterst::const_iterator
1449 it=parameter_types.begin();
1450 it!=parameter_types.end();
1453 const irep_idt &identifier=it->get_identifier();
1464 assign(actual_lhs, v_expr, ns,
true);
1488 if(statement==ID_block)
1493 else if(statement==ID_function_call)
1498 else if(statement==ID_assign)
1501 throw "assignment expected to have two operands";
1505 else if(statement==ID_decl)
1508 throw "decl expected to have one operand";
1512 if(lhs.
id()!=ID_symbol)
1513 throw "decl expected to have symbol on lhs";
1517 else if(statement==ID_expression)
1521 else if(statement==ID_cpp_delete ||
1522 statement==ID_cpp_delete_array)
1526 else if(statement==
"lock" || statement==
"unlock")
1530 else if(statement==ID_asm)
1534 else if(statement==ID_nondet)
1538 else if(statement==ID_printf)
1542 else if(statement==ID_return)
1552 else if(statement==ID_input || statement==ID_output)
1560 "value_set_fivrt: unexpected statement: "+
id2string(statement);
1584 if(old_offset && offset)
1586 if(*old_offset == *offset)
1594 else if(!old_offset)
1625 if(old_offset && offset)
1627 if(*old_offset == *offset)
1635 else if(!old_offset)
1651 for(
unsigned i=vr.
from; i<=vr.
to; i++)
1663 if(is_valid_at(inx, f, line))
1667 vrange_listt::iterator it=ranges.begin();
1669 while(it->function!=f && it!=ranges.end()) it++;
1672 it!=ranges.end() && it->function==f && it->from <= line;
1677 if( line == it->to+1)
1682 vrange_listt::iterator n_it=it; n_it++;
1683 if(n_it!=ranges.end() &&
1684 it->function == n_it->function &&
1685 it->to+1 == n_it->from)
1687 n_it->from=it->from;
1688 it=ranges.erase(it);
1698 if(it!=ranges.end())
1702 if( line == it->from - 1)
1707 if(it!=ranges.begin())
1709 vrange_listt::iterator p_it=it; p_it--;
1710 if(p_it->function == it->function &&
1711 p_it->to+1 == it->from)
1714 it=ranges.erase(it);
1724 ranges.insert(it, insr);
1732 unsigned line)
const 1735 std::cout <<
"IS_VALID_AT: " << inx <<
", " << f <<
", line " << line <<
1739 validity_rangest::const_iterator vrs=validity_ranges.find(inx);
1740 if(vrs!=validity_ranges.end())
1744 object_map_dt::vrange_listt::const_iterator it=ranges.begin();
1746 while(it->function!=f &&
1751 it!=ranges.end() && it->function==f && it->from<=line;
1753 if(it->contains(f, line))
1768 if(o.
id()==ID_symbol && o.
get(ID_identifier)==ident)
1770 else if(o.
type().
id()==
"#REF#")
1774 if(recursion_set.find(oid)!=recursion_set.end())
1781 valuest::const_iterator vit=
values.find(oid);
1784 const entryt &e=vit->second;
1786 recursion_set.insert(oid);
1789 recursion_set.erase(oid);
1802 for(valuest::iterator it=
values.begin();
1825 if(
make_union(state_map, t_it->second.object_map))
The type of an expression, extends irept.
irep_idt name
The unique identifier.
Semantic type conversion.
void get_reference_set(const exprt &expr, expr_sett &expr_set, const namespacet &ns) const
const std::string & id2string(const irep_idt &d)
const std::string integer2string(const mp_integer &n, unsigned base)
void dereference_rec(const exprt &src, exprt &dest) const
std::string pretty(unsigned indent=0, unsigned max_indent=0) const
#define forall_objects(it, map)
void do_end_function(const exprt &lhs, const namespacet &ns)
const dynamic_object_exprt & to_dynamic_object_expr(const exprt &expr)
Cast an exprt to a dynamic_object_exprt.
bool base_type_eq(const typet &type1, const typet &type2, const namespacet &ns)
Check types for equality across all levels of hierarchy.
std::string to_string(const string_not_contains_constraintt &expr)
Used for debug printing.
const code_typet & to_code_type(const typet &type)
Cast a typet to a code_typet.
void copy_to_operands(const exprt &expr)
Copy the given argument to the end of exprt's operands.
std::string from_expr(const namespacet &ns, const irep_idt &identifier, const exprt &expr)
std::vector< parametert > parameterst
bool recursive_find(const irep_idt &ident, const object_mapt &rhs, recfind_recursion_sett &recursion_set) const
const componentst & components() const
#define Forall_objects(it, map)
bool make_union(object_mapt &dest, const object_mapt &src) const
objmapt::iterator iterator
typet & type()
Return the type of the expression.
void copy_objects(object_mapt &dest, const object_mapt &src) const
void output(const namespacet &ns, std::ostream &out) const
std::unordered_set< exprt, irep_hash > expr_sett
Structure type, corresponds to C style structs.
unsigned from_target_index
bool offset_is_zero(const offsett &offset) const
Extract member of struct or union.
#define Forall_valid_objects(it, map)
void get_reference_set_sharing_rec(const exprt &expr, object_mapt &dest, const namespacet &ns) const
const irep_idt & id() const
The Boolean constant true.
void get_value_set_rec(const exprt &expr, object_mapt &dest, const std::string &suffix, const typet &original_type, const namespacet &ns, gvs_recursion_sett &recursion_set) const
bool insert_from(object_mapt &dest, object_map_dt::const_iterator it) const
bool is_valid_at(unsigned inx, unsigned f, unsigned line) const
API to expression classes.
const irep_idt & get(const irep_namet &name) const
void apply_code(const exprt &code, const namespacet &ns)
A namespacet is essentially one or two symbol tables bound together, to allow for symbol lookups in t...
std::list< validity_ranget > vrange_listt
void do_function_call(const irep_idt &function, const exprt::operandst &arguments, const namespacet &ns)
bool has_prefix(const std::string &s, const std::string &prefix)
Split an expression into a base object and a (byte) offset.
void get_reference_set_sharing(const exprt &expr, expr_sett &expr_set, const namespacet &ns) const
#define forall_operands(it, expr)
std::unordered_set< idt, string_hash > gvs_recursion_sett
void assign(const exprt &lhs, const exprt &rhs, const namespacet &ns, bool add_to_sets=false)
void get_value_set(const exprt &expr, std::list< exprt > &expr_set, const namespacet &ns) const
const typet & follow(const typet &) const
Resolve type symbol to the type it points to.
bitvector_typet index_type()
const struct_typet & to_struct_type(const typet &type)
Cast a typet to a struct_typet.
bool make_valid_union(object_mapt &dest, const object_mapt &src) const
dstringt has one field, an unsigned integer no which is an index into a static table of strings.
entryt & get_entry(const idt &id, const std::string &suffix)
static object_numberingt object_numbering
typename Map::mapped_type number_type
Operator to return the address of an object.
void flatten(const entryt &e, object_mapt &dest) const
static const object_map_dt blank
std::string from_type(const namespacet &ns, const irep_idt &identifier, const typet &type)
void flatten_rec(const entryt &, object_mapt &, flatten_seent &, unsigned from_function) const
entryt & get_temporary_entry(const idt &id, const std::string &suffix)
std::vector< exprt > operandst
bool set_valid_at(unsigned inx, unsigned f, unsigned line)
const irep_idt & display_name() const
Return language specific display name if present.
static const char * alloc_adapter_prefix
validity_rangest validity_ranges
typet type
Type of symbol.
exprt to_expr(object_map_dt::const_iterator it) const
optionalt< mp_integer > offsett
Represents the offset into an object: either a unique integer offset, or an unknown value,...
objmapt::const_iterator const_iterator
void assign_rec(const exprt &lhs, const object_mapt &values_rhs, const std::string &suffix, const namespacet &ns, assign_recursion_sett &recursion_set, bool add_to_sets)
bool insert_to(object_mapt &dest, object_map_dt::const_iterator it) const
Base class for all expressions.
const parameterst & parameters() const
#define forall_valid_objects(it, map)
Value Set (Flow Insensitive, Sharing, Validity Regions)
static hash_numbering< irep_idt, irep_id_hash > function_numbering
std::unordered_set< idt, string_hash > flatten_seent
#define UNREACHABLE
This should be used to mark dead code.
const typecast_exprt & to_typecast_expr(const exprt &expr)
Cast an exprt to a typecast_exprt.
const std::string & id_string() const
bool is_zero() const
Return whether the expression is a constant representing 0.
void add_var(const idt &id, const std::string &suffix)
Expression to hold a symbol (variable)
exprt dynamic_object(const exprt &pointer)
std::unordered_set< idt, string_hash > assign_recursion_sett
const typet & subtype() const
#define DATA_INVARIANT(CONDITION, REASON)
This condition should be used to document that assumptions that are made on goto_functions,...
Representation of heap-allocated objects.
void make_typecast(const typet &_type)
Create a typecast_exprt to the given type.
std::unordered_set< idt, string_hash > recfind_recursion_sett
bool lookup(const irep_idt &name, const symbolt *&symbol) const override
See documentation for namespace_baset::lookup().
const_iterator find(object_numberingt::number_type k)
void set(const irep_namet &name, const irep_idt &value)
bool simplify(exprt &expr, const namespacet &ns)