メニュー
Use when a branch condition uses multiplication of two symbolic inputs (e.g., s*t < d) creating a nonlinear constraint
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when printf statements output strings without trailing newlines
Use when array is accessed with direct user input as index (0-based indexing)
Use when the program accesses a precomputed table using an offset (e.g., arr[n-1]) that introduces an arithmetic operation between the symbolic input and the index
Use when loop variables iterate over character values (e.g., ASCII codes) to represent different operations or choices
Use when code uses a loop to search for an input value in an array and then uses the found index for further computation
Use when code reads a fixed number of characters into an array and only accesses individual elements
| name | avoid-multiplicative-constraints-in-branches |
| description | Use when a branch condition uses multiplication of two symbolic inputs (e.g., s*t < d) creating a nonlinear constraint |
A KLEE-coverage code transformation. Applying it rewrites C source so symbolic execution explores more of the program's behavior.
When a branch condition uses multiplication of two symbolic inputs (e.g., s*t < d) creating a nonlinear constraint
Rewrite the condition to use division/ceiling arithmetic on a single symbolic operand (e.g., t >= (d+s-1)/s) so the branch predicate becomes linear in each variable
KLEE's STP/Z3 backend handles linear integer arithmetic far more efficiently than nonlinear multiplication of symbolics; replacing s*t with division yields branch constraints the solver can satisfy quickly, enabling deeper path exploration and richer test inputs
Before:
#include <stdio.h>
int d, s, t;
int main() {
scanf("%d%d%d", &d, &s, &t);
if (s * t < d)printf("No\n");
else printf("Yes\n");
}
After:
#include<stdio.h>
int d,t,s;
int main()
{
scanf("%d %d %d", &d, &t, &s);
d=d+s-1;
if(t>=(d/s))printf("Yes");
else printf("No");
}
dbe5d2ef