diff --git a/src/.dir-locals.el b/.dir-locals.el
similarity index 100%
rename from src/.dir-locals.el
rename to .dir-locals.el
diff --git a/.travis.yml b/.travis.yml
index 4683eeba79d..6c2d69165be 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,23 +1,61 @@
 language: cpp
 
-matrix:
+jobs:
   include:
 
+    - &linter-stage
+      stage: Linter + Doxygen + non-debug Ubuntu/gcc-5 test
+      env: NAME="CPP-LINT"
+      install:
+      script: scripts/travis_lint.sh
+      before_cache:
+
+    - stage: Linter + Doxygen + non-debug Ubuntu/gcc-5 test
+      env: NAME="DOXYGEN-CHECK"
+      addons:
+        apt:
+          packages:
+            - doxygen
+      install:
+      script: scripts/travis_doxygen.sh
+      before_cache:
+
+    # Ubuntu Linux with glibc using g++-5
+    - stage: Linter + Doxygen + non-debug Ubuntu/gcc-5 test
+      os: linux
+      sudo: false
+      compiler: gcc
+      cache: ccache
+      addons:
+        apt:
+          sources:
+            - ubuntu-toolchain-r-test
+          packages:
+            - libwww-perl
+            - g++-5
+            - libubsan0
+      before_install:
+        - mkdir bin ; ln -s /usr/bin/gcc-5 bin/gcc
+      # env: COMPILER=g++-5 SAN_FLAGS="-fsanitize=undefined -fno-sanitize-recover -fno-omit-frame-pointer"
+      env: COMPILER="ccache g++-5"
+
     # Alpine Linux with musl-libc using g++
-    - os: linux
+    - stage: Test different OS/CXX/Flags
+      os: linux
       sudo: required
       compiler: gcc
       cache: ccache
       services:
         - docker
       before_install:
-        - docker pull diffblue/cbmc-builder:alpine-0.0.1
+        - docker pull diffblue/cbmc-builder:alpine-0.0.3
       env:
-        - PRE_COMMAND="docker run -v ${TRAVIS_BUILD_DIR}:/cbmc -v ${HOME}/.ccache:/root/.ccache diffblue/cbmc-builder:alpine-0.0.1"
+        - PRE_COMMAND="docker run -v ${TRAVIS_BUILD_DIR}:/cbmc -v ${HOME}/.ccache:/root/.ccache diffblue/cbmc-builder:alpine-0.0.3"
         - COMPILER="ccache g++"
 
     # OS X using g++
-    - os: osx
+    - stage: Test different OS/CXX/Flags
+      os: osx
       sudo: false
       compiler: gcc
       cache: ccache
@@ -26,42 +64,24 @@ matrix:
         - mkdir bin ; ln -s /usr/bin/gcc bin/gcc
         - HOMEBREW_NO_AUTO_UPDATE=1 brew install ccache
         - export PATH=/usr/local/opt/ccache/libexec:$PATH
-        - ccache -M 1G
-      env: COMPILER=g++
+      env: COMPILER="ccache g++"
 
     # OS X using clang++
-    - os: osx
+    - stage: Test different OS/CXX/Flags
+      os: osx
       sudo: false
       compiler: clang
       cache: ccache
       before_install:
         - HOMEBREW_NO_AUTO_UPDATE=1 brew install ccache
         - export PATH=/usr/local/opt/ccache/libexec:$PATH
-        - ccache -M 1G
       env:
         - COMPILER="ccache clang++ -Qunused-arguments -fcolor-diagnostics"
         - CCACHE_CPP2=yes
 
-    # Ubuntu Linux with glibc using g++-5
-    - os: linux
-      sudo: false
-      compiler: gcc
-      cache: ccache
-      addons:
-        apt:
-          sources:
-            - ubuntu-toolchain-r-test
-          packages:
-            - libwww-perl
-            - g++-5
-            - libubsan0
-      before_install:
-        - mkdir bin ; ln -s /usr/bin/gcc-5 bin/gcc
-      # env: COMPILER=g++-5 SAN_FLAGS="-fsanitize=undefined -fno-sanitize-recover -fno-omit-frame-pointer"
-      env: COMPILER="g++-5"
-
     # Ubuntu Linux with glibc using g++-5, debug mode
-    - os: linux
+    - stage: Test different OS/CXX/Flags
+      os: linux
       sudo: false
       compiler: gcc
       cache: ccache
@@ -77,12 +97,13 @@ matrix:
         - mkdir bin ; ln -s /usr/bin/gcc-5 bin/gcc
       # env: COMPILER=g++-5 SAN_FLAGS="-fsanitize=undefined -fno-sanitize-recover -fno-omit-frame-pointer"
       env:
-        - COMPILER="g++-5"
+        - COMPILER="ccache g++-5"
         - EXTRA_CXXFLAGS="-DDEBUG"
       script: echo "Not running any tests for a debug build."
 
     # Ubuntu Linux with glibc using clang++-3.7
-    - os: linux
+    - stage: Test different OS/CXX/Flags
+      os: linux
       sudo: false
       compiler: clang
       cache: ccache
@@ -105,7 +126,8 @@ matrix:
         - CCACHE_CPP2=yes
 
     # Ubuntu Linux with glibc using clang++-3.7, debug mode
-    - os: linux
+    - stage: Test different OS/CXX/Flags
+      os: linux
       sudo: false
       compiler: clang
       cache: ccache
@@ -129,27 +151,11 @@ matrix:
         - EXTRA_CXXFLAGS="-DDEBUG"
       script: echo "Not running any tests for a debug build."
 
-    - env: NAME="CPP-LINT"
-      install:
-      script: scripts/travis_lint.sh
-      before_cache:
-
-    - env: NAME="DOXYGEN-CHECK"
-      addons:
-        apt:
-          packages:
-            - doxygen
-      install:
-      script: scripts/travis_doxygen.sh
-      before_cache:
-
   allow_failures:
-    - env: NAME="CPP-LINT"
-      install:
-      script: scripts/travis_lint.sh
-      before_cache:
+    - <<: *linter-stage
 
 install:
+  - ccache --max-size=1G
   - COMMAND="make -C src minisat2-download" &&
     eval ${PRE_COMMAND} ${COMMAND}
   - COMMAND="make -C src boost-download" &&
diff --git a/README.md b/README.md
index e1c2b090091..8804b2f0b55 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,31 @@ and passing the resulting equation to a decision procedure.
 
 For full information see [cprover.org](http://www.cprover.org/cbmc).
 
+Versions
+========
+
+Get the [latest release](https://github.com/diffblue/cbmc/releases)
+* Releases are tested and for production use.
+
+Get the current *develop* version: `git clone https://github.com/diffblue/cbmc.git`
+* Develop versions are not recommended for production use.
+
+Report bugs
+===========
+
+If you encounter a problem please file a bug report:
+* Create an [issue](https://github.com/diffblue/cbmc/issues)
+
+Contributing to the code base
+=============================
+
+1. Fork the repository
+2. Clone the repository `git clone git@github.com:YOURNAME/cbmc.git`
+3. Create a branch from the `develop` branch (default branch)
+4. Make your changes (follow the [coding guidelines](https://github.com/diffblue/cbmc/blob/develop/CODING_STANDARD.md))
+5. Push your changes to your branch
+6. Create a Pull Request targeting the `develop` branch
+
 License
 =======
 4-clause BSD license, see `LICENSE` file.
diff --git a/regression/.gitignore b/regression/.gitignore
new file mode 100644
index 00000000000..750ecf9f446
--- /dev/null
+++ b/regression/.gitignore
@@ -0,0 +1 @@
+tests.log
diff --git a/regression/Makefile b/regression/Makefile
index 87dcd7c93f3..c69d85febc2 100644
--- a/regression/Makefile
+++ b/regression/Makefile
@@ -2,11 +2,14 @@ DIRS = ansi-c \
        cbmc \
        cpp \
        cbmc-java \
+       cbmc-java-inheritance \
        goto-analyzer \
+       goto-diff \
        goto-instrument \
        goto-instrument-typedef \
-       goto-diff \
        invariants \
+       strings \
+       strings-smoke-tests \
        test-script \
        # Empty last line
 
diff --git a/regression/cbmc-java-inheritance/Makefile b/regression/cbmc-java-inheritance/Makefile
new file mode 100644
index 00000000000..dcdf752aea1
--- /dev/null
+++ b/regression/cbmc-java-inheritance/Makefile
@@ -0,0 +1,38 @@
+default: tests.log
+
+test:
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+tests.log: ../test.pl
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+show:
+	@for dir in *; do \
+		if [ -d "$$dir" ]; then \
+			vim -o "$$dir/*.java" "$$dir/*.out"; \
+		fi; \
+	done;
+
+clean:
+	find -name '*.out' -execdir $(RM) '{}' \;
+	find -name '*.gb' -execdir $(RM) '{}' \;
+	$(RM) tests.log
+
+%.class: %.java ../../src/org.cprover.jar
+	javac -g -cp ../../src/org.cprover.jar:. $<
+
+nondet_java_files := $(shell find . -name "Nondet*.java")
+nondet_class_files := $(patsubst %.java, %.class, $(nondet_java_files))
+
+.PHONY: nondet-class-files
+nondet-class-files: $(nondet_class_files)
+
+.PHONY: clean-nondet-class-files
+clean-nondet-class-files:
+	-rm $(nondet_class_files)
diff --git a/regression/cbmc-java-inheritance/inheritance01/A.class b/regression/cbmc-java-inheritance/inheritance01/A.class
new file mode 100644
index 00000000000..90633af3927
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance01/A.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance01/B.class b/regression/cbmc-java-inheritance/inheritance01/B.class
new file mode 100644
index 00000000000..1ba2667c1e3
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance01/B.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance01/test.class b/regression/cbmc-java-inheritance/inheritance01/test.class
new file mode 100644
index 00000000000..c8b094f59ad
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance01/test.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance01/test.desc b/regression/cbmc-java-inheritance/inheritance01/test.desc
new file mode 100644
index 00000000000..61ed56c4b41
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance01/test.desc
@@ -0,0 +1,5 @@
+CORE
+test.class
+--function test.check
+^EXIT=0$
+^SIGNAL=0$
diff --git a/regression/cbmc-java-inheritance/inheritance01/test.java b/regression/cbmc-java-inheritance/inheritance01/test.java
new file mode 100644
index 00000000000..4038d8419f6
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance01/test.java
@@ -0,0 +1,20 @@
+class A
+{
+  public int toInt()
+  {
+    return 12345;
+  }
+}
+
+class B extends A
+{
+}
+
+class test
+{
+  void check()
+  {
+    B b=new B();
+    assert(b.toInt()==12345);
+  }
+}
diff --git a/regression/cbmc-java-inheritance/inheritance02/A.class b/regression/cbmc-java-inheritance/inheritance02/A.class
new file mode 100644
index 00000000000..20d9f12ec40
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance02/A.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance02/B.class b/regression/cbmc-java-inheritance/inheritance02/B.class
new file mode 100644
index 00000000000..cd5a6778035
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance02/B.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance02/test.class b/regression/cbmc-java-inheritance/inheritance02/test.class
new file mode 100644
index 00000000000..09d573eb971
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance02/test.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance02/test.desc b/regression/cbmc-java-inheritance/inheritance02/test.desc
new file mode 100644
index 00000000000..61ed56c4b41
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance02/test.desc
@@ -0,0 +1,5 @@
+CORE
+test.class
+--function test.check
+^EXIT=0$
+^SIGNAL=0$
diff --git a/regression/cbmc-java-inheritance/inheritance02/test.java b/regression/cbmc-java-inheritance/inheritance02/test.java
new file mode 100644
index 00000000000..1aae7f2ef63
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance02/test.java
@@ -0,0 +1,24 @@
+class A
+{
+  protected int toInt()
+  {
+    return 12345;
+  }
+}
+
+class B extends A
+{
+  public void secondary()
+  {
+    assert(toInt()==12345);
+  }
+}
+
+class test
+{
+  void check()
+  {
+    B b=new B();
+    b.secondary();
+  }
+}
diff --git a/regression/cbmc-java-inheritance/inheritance03/A.class b/regression/cbmc-java-inheritance/inheritance03/A.class
new file mode 100644
index 00000000000..1df27f96de7
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance03/A.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance03/B.class b/regression/cbmc-java-inheritance/inheritance03/B.class
new file mode 100644
index 00000000000..0d68ec19ee0
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance03/B.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance03/Z.class b/regression/cbmc-java-inheritance/inheritance03/Z.class
new file mode 100644
index 00000000000..49b6e283992
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance03/Z.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance03/test.class b/regression/cbmc-java-inheritance/inheritance03/test.class
new file mode 100644
index 00000000000..dfa16d22feb
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance03/test.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance03/test.desc b/regression/cbmc-java-inheritance/inheritance03/test.desc
new file mode 100644
index 00000000000..61ed56c4b41
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance03/test.desc
@@ -0,0 +1,5 @@
+CORE
+test.class
+--function test.check
+^EXIT=0$
+^SIGNAL=0$
diff --git a/regression/cbmc-java-inheritance/inheritance03/test.java b/regression/cbmc-java-inheritance/inheritance03/test.java
new file mode 100644
index 00000000000..0d965134877
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance03/test.java
@@ -0,0 +1,24 @@
+class Z 
+{
+  public int toInt()
+  {
+    return 12345;
+  }
+}
+
+class A extends Z
+{
+}
+
+class B extends A
+{
+}
+
+class test
+{
+  void check()
+  {
+    B b=new B();
+    assert(b.toInt()==12345);
+  }
+}
diff --git a/regression/cbmc-java-inheritance/inheritance04/A.class b/regression/cbmc-java-inheritance/inheritance04/A.class
new file mode 100644
index 00000000000..90633af3927
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance04/A.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance04/B.class b/regression/cbmc-java-inheritance/inheritance04/B.class
new file mode 100644
index 00000000000..b8d4c0dafbc
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance04/B.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance04/Z.class b/regression/cbmc-java-inheritance/inheritance04/Z.class
new file mode 100644
index 00000000000..74b27f055a5
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance04/Z.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance04/test.class b/regression/cbmc-java-inheritance/inheritance04/test.class
new file mode 100644
index 00000000000..7f4c18b5fde
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance04/test.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance04/test.desc b/regression/cbmc-java-inheritance/inheritance04/test.desc
new file mode 100644
index 00000000000..61ed56c4b41
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance04/test.desc
@@ -0,0 +1,5 @@
+CORE
+test.class
+--function test.check
+^EXIT=0$
+^SIGNAL=0$
diff --git a/regression/cbmc-java-inheritance/inheritance04/test.java b/regression/cbmc-java-inheritance/inheritance04/test.java
new file mode 100644
index 00000000000..783e0079c37
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance04/test.java
@@ -0,0 +1,28 @@
+class A
+{
+  public int toInt()
+  {
+    return 12345;
+  }
+}
+
+class B extends A
+{
+  public int toInt()
+  {
+    return 9999;
+  }
+}
+
+class Z extends B
+{
+}
+
+class test
+{
+  void check()
+  {
+    Z z=new Z();
+    assert(z.toInt()==9999);
+  }
+}
diff --git a/regression/cbmc-java-inheritance/inheritance05/A.class b/regression/cbmc-java-inheritance/inheritance05/A.class
new file mode 100644
index 00000000000..692fc625e18
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance05/A.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance05/B.class b/regression/cbmc-java-inheritance/inheritance05/B.class
new file mode 100644
index 00000000000..d1f3c3841a6
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance05/B.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance05/test.class b/regression/cbmc-java-inheritance/inheritance05/test.class
new file mode 100644
index 00000000000..549b549c5de
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance05/test.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance05/test.desc b/regression/cbmc-java-inheritance/inheritance05/test.desc
new file mode 100644
index 00000000000..61ed56c4b41
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance05/test.desc
@@ -0,0 +1,5 @@
+CORE
+test.class
+--function test.check
+^EXIT=0$
+^SIGNAL=0$
diff --git a/regression/cbmc-java-inheritance/inheritance05/test.java b/regression/cbmc-java-inheritance/inheritance05/test.java
new file mode 100644
index 00000000000..3d0c967b728
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance05/test.java
@@ -0,0 +1,21 @@
+interface A
+{
+  public int toInt();
+}
+
+class B implements A
+{
+  public int toInt()
+  {
+    return 12345;
+  }
+}
+
+class test
+{
+  void check()
+  {
+    B b=new B();
+    assert(b.toInt()==12345);
+  }
+}
diff --git a/regression/cbmc-java-inheritance/inheritance06/A.java b/regression/cbmc-java-inheritance/inheritance06/A.java
new file mode 100644
index 00000000000..d2f2e7b43dc
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance06/A.java
@@ -0,0 +1,10 @@
+package temp;
+
+class A
+{
+  int toint()
+  {
+    return 123456;
+  }
+}
+
diff --git a/regression/cbmc-java-inheritance/inheritance06/B.java b/regression/cbmc-java-inheritance/inheritance06/B.java
new file mode 100644
index 00000000000..4bd0f629038
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance06/B.java
@@ -0,0 +1,9 @@
+package temp;
+
+public class B extends A
+{
+  public int check()
+  {
+    return toint();
+  }
+}
diff --git a/regression/cbmc-java-inheritance/inheritance06/temp/A.class b/regression/cbmc-java-inheritance/inheritance06/temp/A.class
new file mode 100644
index 00000000000..8e5acf1693d
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance06/temp/A.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance06/temp/B.class b/regression/cbmc-java-inheritance/inheritance06/temp/B.class
new file mode 100644
index 00000000000..a4d9cfb5fb2
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance06/temp/B.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance06/test.class b/regression/cbmc-java-inheritance/inheritance06/test.class
new file mode 100644
index 00000000000..53ce4d575ca
Binary files /dev/null and b/regression/cbmc-java-inheritance/inheritance06/test.class differ
diff --git a/regression/cbmc-java-inheritance/inheritance06/test.desc b/regression/cbmc-java-inheritance/inheritance06/test.desc
new file mode 100644
index 00000000000..61ed56c4b41
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance06/test.desc
@@ -0,0 +1,5 @@
+CORE
+test.class
+--function test.check
+^EXIT=0$
+^SIGNAL=0$
diff --git a/regression/cbmc-java-inheritance/inheritance06/test.java b/regression/cbmc-java-inheritance/inheritance06/test.java
new file mode 100644
index 00000000000..fd8633b51bc
--- /dev/null
+++ b/regression/cbmc-java-inheritance/inheritance06/test.java
@@ -0,0 +1,11 @@
+import temp.B;
+
+public class test
+{
+  public void check()
+  {
+     B myObject = new B();
+     assert(myObject.check()==123456);
+  }
+}
+
diff --git a/regression/cbmc-java/ArithmeticException1/ArithmeticExceptionTest.class b/regression/cbmc-java/ArithmeticException1/ArithmeticExceptionTest.class
new file mode 100644
index 00000000000..3ad4e6ebe86
Binary files /dev/null and b/regression/cbmc-java/ArithmeticException1/ArithmeticExceptionTest.class differ
diff --git a/regression/cbmc-java/ArithmeticException1/ArithmeticExceptionTest.java b/regression/cbmc-java/ArithmeticException1/ArithmeticExceptionTest.java
new file mode 100644
index 00000000000..7988e85700e
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException1/ArithmeticExceptionTest.java
@@ -0,0 +1,11 @@
+public class ArithmeticExceptionTest {
+    public static void  main(String args[]) {
+        try {
+            int i=0;
+            int j=10/i;
+        }
+        catch(ArithmeticException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/ArithmeticException1/test.desc b/regression/cbmc-java/ArithmeticException1/test.desc
new file mode 100644
index 00000000000..e8f7c941fd4
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException1/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArithmeticExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArithmeticExceptionTest.java line 8 function.*: FAILURE$
+^VERIFICATION FAILED
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArithmeticException2/ArithmeticExceptionTest.class b/regression/cbmc-java/ArithmeticException2/ArithmeticExceptionTest.class
new file mode 100644
index 00000000000..3ac62d1ede5
Binary files /dev/null and b/regression/cbmc-java/ArithmeticException2/ArithmeticExceptionTest.class differ
diff --git a/regression/cbmc-java/ArithmeticException2/ArithmeticExceptionTest.java b/regression/cbmc-java/ArithmeticException2/ArithmeticExceptionTest.java
new file mode 100644
index 00000000000..0c83bf9a409
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException2/ArithmeticExceptionTest.java
@@ -0,0 +1,12 @@
+public class ArithmeticExceptionTest {
+    public static void  main(String args[]) {
+        try {
+            long denom=0;
+            long num=10;
+            long j=num/denom;
+        }
+        catch(ArithmeticException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/ArithmeticException2/test.desc b/regression/cbmc-java/ArithmeticException2/test.desc
new file mode 100644
index 00000000000..00820d86c6e
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException2/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArithmeticExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArithmeticExceptionTest.java line 9 function.*: FAILURE$
+^VERIFICATION FAILED
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArithmeticException3/ArithmeticExceptionTest.class b/regression/cbmc-java/ArithmeticException3/ArithmeticExceptionTest.class
new file mode 100644
index 00000000000..21c451e02f3
Binary files /dev/null and b/regression/cbmc-java/ArithmeticException3/ArithmeticExceptionTest.class differ
diff --git a/regression/cbmc-java/ArithmeticException3/ArithmeticExceptionTest.java b/regression/cbmc-java/ArithmeticException3/ArithmeticExceptionTest.java
new file mode 100644
index 00000000000..dfe7b031288
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException3/ArithmeticExceptionTest.java
@@ -0,0 +1,11 @@
+public class ArithmeticExceptionTest {
+    public static void  main(String args[]) {
+        try {
+            int i=0;
+            int j=10%i;
+        }
+        catch(ArithmeticException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/ArithmeticException3/test.desc b/regression/cbmc-java/ArithmeticException3/test.desc
new file mode 100644
index 00000000000..e8f7c941fd4
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException3/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArithmeticExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArithmeticExceptionTest.java line 8 function.*: FAILURE$
+^VERIFICATION FAILED
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArithmeticException4/ArithmeticExceptionTest.class b/regression/cbmc-java/ArithmeticException4/ArithmeticExceptionTest.class
new file mode 100644
index 00000000000..a4723d1d652
Binary files /dev/null and b/regression/cbmc-java/ArithmeticException4/ArithmeticExceptionTest.class differ
diff --git a/regression/cbmc-java/ArithmeticException4/ArithmeticExceptionTest.java b/regression/cbmc-java/ArithmeticException4/ArithmeticExceptionTest.java
new file mode 100644
index 00000000000..1e811e417f8
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException4/ArithmeticExceptionTest.java
@@ -0,0 +1,12 @@
+public class ArithmeticExceptionTest {
+    public static void  main(String args[]) {
+        try {
+          long denom=0;
+          long num=10;
+          long result=num%denom;
+        }
+        catch(ArithmeticException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/ArithmeticException4/test.desc b/regression/cbmc-java/ArithmeticException4/test.desc
new file mode 100644
index 00000000000..00820d86c6e
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException4/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArithmeticExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArithmeticExceptionTest.java line 9 function.*: FAILURE$
+^VERIFICATION FAILED
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArithmeticException5/ArithmeticExceptionTest.class b/regression/cbmc-java/ArithmeticException5/ArithmeticExceptionTest.class
new file mode 100644
index 00000000000..813391d04af
Binary files /dev/null and b/regression/cbmc-java/ArithmeticException5/ArithmeticExceptionTest.class differ
diff --git a/regression/cbmc-java/ArithmeticException5/ArithmeticExceptionTest.java b/regression/cbmc-java/ArithmeticException5/ArithmeticExceptionTest.java
new file mode 100644
index 00000000000..d32299a427f
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException5/ArithmeticExceptionTest.java
@@ -0,0 +1,11 @@
+public class ArithmeticExceptionTest {
+    public static void  main(String args[]) {
+        try {
+            double i=0;
+            double j=10/i;
+        }
+        catch(ArithmeticException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/ArithmeticException5/test.desc b/regression/cbmc-java/ArithmeticException5/test.desc
new file mode 100644
index 00000000000..d57ec32a9a9
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException5/test.desc
@@ -0,0 +1,8 @@
+CORE
+ArithmeticExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArithmeticException6/ArithmeticExceptionTest.class b/regression/cbmc-java/ArithmeticException6/ArithmeticExceptionTest.class
new file mode 100644
index 00000000000..fdcb29ad252
Binary files /dev/null and b/regression/cbmc-java/ArithmeticException6/ArithmeticExceptionTest.class differ
diff --git a/regression/cbmc-java/ArithmeticException6/ArithmeticExceptionTest.java b/regression/cbmc-java/ArithmeticException6/ArithmeticExceptionTest.java
new file mode 100644
index 00000000000..281f868b3e6
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException6/ArithmeticExceptionTest.java
@@ -0,0 +1,10 @@
+public class ArithmeticExceptionTest {
+    public static void  main(int denom) {
+        try {
+            int j=10/denom;
+        }
+        catch(ArithmeticException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/ArithmeticException6/test.desc b/regression/cbmc-java/ArithmeticException6/test.desc
new file mode 100644
index 00000000000..8cab5f69869
--- /dev/null
+++ b/regression/cbmc-java/ArithmeticException6/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArithmeticExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArithmeticExceptionTest.java line 7 function.*: FAILURE$
+^VERIFICATION FAILED
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArrayIndexOutOfBoundsException1/ArrayIndexOutOfBoundsExceptionTest.class b/regression/cbmc-java/ArrayIndexOutOfBoundsException1/ArrayIndexOutOfBoundsExceptionTest.class
new file mode 100644
index 00000000000..ca15fe999ec
Binary files /dev/null and b/regression/cbmc-java/ArrayIndexOutOfBoundsException1/ArrayIndexOutOfBoundsExceptionTest.class differ
diff --git a/regression/cbmc-java/ArrayIndexOutOfBoundsException1/ArrayIndexOutOfBoundsExceptionTest.java b/regression/cbmc-java/ArrayIndexOutOfBoundsException1/ArrayIndexOutOfBoundsExceptionTest.java
new file mode 100644
index 00000000000..2013694f875
--- /dev/null
+++ b/regression/cbmc-java/ArrayIndexOutOfBoundsException1/ArrayIndexOutOfBoundsExceptionTest.java
@@ -0,0 +1,11 @@
+public class ArrayIndexOutOfBoundsExceptionTest {
+  public static void main(String args[]) {
+      try {
+          int[] a=new int[4];
+          a[4]=0;
+      }
+      catch (ArrayIndexOutOfBoundsException exc) {
+          assert false;
+      }
+  }
+}
diff --git a/regression/cbmc-java/ArrayIndexOutOfBoundsException1/test.desc b/regression/cbmc-java/ArrayIndexOutOfBoundsException1/test.desc
new file mode 100644
index 00000000000..e6216e07c79
--- /dev/null
+++ b/regression/cbmc-java/ArrayIndexOutOfBoundsException1/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArrayIndexOutOfBoundsExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArrayIndexOutOfBoundsExceptionTest.java line 8 function.*: FAILURE$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ArrayIndexOutOfBoundsException2/ArrayIndexOutOfBoundsExceptionTest.class b/regression/cbmc-java/ArrayIndexOutOfBoundsException2/ArrayIndexOutOfBoundsExceptionTest.class
new file mode 100644
index 00000000000..3de63e25a0f
Binary files /dev/null and b/regression/cbmc-java/ArrayIndexOutOfBoundsException2/ArrayIndexOutOfBoundsExceptionTest.class differ
diff --git a/regression/cbmc-java/ArrayIndexOutOfBoundsException2/ArrayIndexOutOfBoundsExceptionTest.java b/regression/cbmc-java/ArrayIndexOutOfBoundsException2/ArrayIndexOutOfBoundsExceptionTest.java
new file mode 100644
index 00000000000..b1f8683115e
--- /dev/null
+++ b/regression/cbmc-java/ArrayIndexOutOfBoundsException2/ArrayIndexOutOfBoundsExceptionTest.java
@@ -0,0 +1,11 @@
+public class ArrayIndexOutOfBoundsExceptionTest {
+  public static void main(String args[]) {
+      try {
+          int[] a=new int[4];
+          int i=a[5];
+      }
+      catch (ArrayIndexOutOfBoundsException exc) {
+          assert false;
+      }
+  }
+}
diff --git a/regression/cbmc-java/ArrayIndexOutOfBoundsException2/test.desc b/regression/cbmc-java/ArrayIndexOutOfBoundsException2/test.desc
new file mode 100644
index 00000000000..e6216e07c79
--- /dev/null
+++ b/regression/cbmc-java/ArrayIndexOutOfBoundsException2/test.desc
@@ -0,0 +1,9 @@
+CORE
+ArrayIndexOutOfBoundsExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ArrayIndexOutOfBoundsExceptionTest.java line 8 function.*: FAILURE$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ClassCastException1/A.class b/regression/cbmc-java/ClassCastException1/A.class
new file mode 100644
index 00000000000..3618c09b4ef
Binary files /dev/null and b/regression/cbmc-java/ClassCastException1/A.class differ
diff --git a/regression/cbmc-java/ClassCastException1/B.class b/regression/cbmc-java/ClassCastException1/B.class
new file mode 100644
index 00000000000..e9257dc4427
Binary files /dev/null and b/regression/cbmc-java/ClassCastException1/B.class differ
diff --git a/regression/cbmc-java/ClassCastException1/ClassCastExceptionTest.class b/regression/cbmc-java/ClassCastException1/ClassCastExceptionTest.class
new file mode 100644
index 00000000000..f791d7e4fcd
Binary files /dev/null and b/regression/cbmc-java/ClassCastException1/ClassCastExceptionTest.class differ
diff --git a/regression/cbmc-java/ClassCastException1/ClassCastExceptionTest.java b/regression/cbmc-java/ClassCastException1/ClassCastExceptionTest.java
new file mode 100644
index 00000000000..e3a87f5a163
--- /dev/null
+++ b/regression/cbmc-java/ClassCastException1/ClassCastExceptionTest.java
@@ -0,0 +1,12 @@
+public class ClassCastExceptionTest {
+  public static void main(String args[]) {
+      try {
+          Object x = new Integer(0);
+          String y = (String)x;
+      }
+      catch (ClassCastException exc) {
+          assert false;
+      }
+    
+  }
+}
diff --git a/regression/cbmc-java/ClassCastException1/test.desc b/regression/cbmc-java/ClassCastException1/test.desc
new file mode 100644
index 00000000000..fa84bf185ab
--- /dev/null
+++ b/regression/cbmc-java/ClassCastException1/test.desc
@@ -0,0 +1,9 @@
+CORE
+ClassCastExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file ClassCastExceptionTest.java line 8 function.*: FAILURE$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/ClassCastException2/A.class b/regression/cbmc-java/ClassCastException2/A.class
new file mode 100644
index 00000000000..5400c088442
Binary files /dev/null and b/regression/cbmc-java/ClassCastException2/A.class differ
diff --git a/regression/cbmc-java/ClassCastException2/B.class b/regression/cbmc-java/ClassCastException2/B.class
new file mode 100644
index 00000000000..57c02bfbefd
Binary files /dev/null and b/regression/cbmc-java/ClassCastException2/B.class differ
diff --git a/regression/cbmc-java/ClassCastException2/C.class b/regression/cbmc-java/ClassCastException2/C.class
new file mode 100644
index 00000000000..3bff3313aa1
Binary files /dev/null and b/regression/cbmc-java/ClassCastException2/C.class differ
diff --git a/regression/cbmc-java/ClassCastException2/ClassCastExceptionTest.class b/regression/cbmc-java/ClassCastException2/ClassCastExceptionTest.class
new file mode 100644
index 00000000000..503940e149a
Binary files /dev/null and b/regression/cbmc-java/ClassCastException2/ClassCastExceptionTest.class differ
diff --git a/regression/cbmc-java/ClassCastException2/ClassCastExceptionTest.java b/regression/cbmc-java/ClassCastException2/ClassCastExceptionTest.java
new file mode 100644
index 00000000000..6b83050ca6a
--- /dev/null
+++ b/regression/cbmc-java/ClassCastException2/ClassCastExceptionTest.java
@@ -0,0 +1,18 @@
+class A {}
+
+class B extends A {}
+
+class C extends B {}
+
+public class ClassCastExceptionTest {
+  public static void main(String args[]) {
+      try {
+          A c = new C();
+          B b = (B)c;
+      }
+      catch (ClassCastException exc) {
+          assert false;
+      }
+    
+  }
+}
diff --git a/regression/cbmc-java/ClassCastException2/test.desc b/regression/cbmc-java/ClassCastException2/test.desc
new file mode 100644
index 00000000000..c593280efe5
--- /dev/null
+++ b/regression/cbmc-java/ClassCastException2/test.desc
@@ -0,0 +1,8 @@
+CORE
+ClassCastExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/Makefile b/regression/cbmc-java/Makefile
index a1b44c5a948..dcdf752aea1 100644
--- a/regression/cbmc-java/Makefile
+++ b/regression/cbmc-java/Makefile
@@ -23,3 +23,16 @@ clean:
 	find -name '*.out' -execdir $(RM) '{}' \;
 	find -name '*.gb' -execdir $(RM) '{}' \;
 	$(RM) tests.log
+
+%.class: %.java ../../src/org.cprover.jar
+	javac -g -cp ../../src/org.cprover.jar:. $<
+
+nondet_java_files := $(shell find . -name "Nondet*.java")
+nondet_class_files := $(patsubst %.java, %.class, $(nondet_java_files))
+
+.PHONY: nondet-class-files
+nondet-class-files: $(nondet_class_files)
+
+.PHONY: clean-nondet-class-files
+clean-nondet-class-files:
+	-rm $(nondet_class_files)
diff --git a/regression/cbmc-java/NegativeArraySizeException/NegativeArraySizeExceptionTest.class b/regression/cbmc-java/NegativeArraySizeException/NegativeArraySizeExceptionTest.class
new file mode 100644
index 00000000000..70adc3ee839
Binary files /dev/null and b/regression/cbmc-java/NegativeArraySizeException/NegativeArraySizeExceptionTest.class differ
diff --git a/regression/cbmc-java/NegativeArraySizeException/NegativeArraySizeExceptionTest.java b/regression/cbmc-java/NegativeArraySizeException/NegativeArraySizeExceptionTest.java
new file mode 100644
index 00000000000..d9c9859aa1f
--- /dev/null
+++ b/regression/cbmc-java/NegativeArraySizeException/NegativeArraySizeExceptionTest.java
@@ -0,0 +1,10 @@
+public class NegativeArraySizeExceptionTest {
+  public static void main(String args[]) {
+      try {
+          int a[]=new int[-1];
+      }
+      catch (NegativeArraySizeException exc) {
+          assert false;
+      }
+  }
+}
diff --git a/regression/cbmc-java/NegativeArraySizeException/test.desc b/regression/cbmc-java/NegativeArraySizeException/test.desc
new file mode 100644
index 00000000000..a203a79a628
--- /dev/null
+++ b/regression/cbmc-java/NegativeArraySizeException/test.desc
@@ -0,0 +1,9 @@
+CORE
+NegativeArraySizeExceptionTest.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file NegativeArraySizeExceptionTest.java line 7 function.*: FAILURE$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetArray/NondetArray.class b/regression/cbmc-java/NondetArray/NondetArray.class
new file mode 100644
index 00000000000..57858ac292f
Binary files /dev/null and b/regression/cbmc-java/NondetArray/NondetArray.class differ
diff --git a/regression/cbmc-java/NondetArray/NondetArray.java b/regression/cbmc-java/NondetArray/NondetArray.java
new file mode 100644
index 00000000000..21dd4416b4e
--- /dev/null
+++ b/regression/cbmc-java/NondetArray/NondetArray.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetArray
+{
+  void main()
+  {
+    Object[] obj = CProver.nondetWithoutNull();
+    assert obj != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetArray/test.desc b/regression/cbmc-java/NondetArray/test.desc
new file mode 100644
index 00000000000..63cf6d4cbc0
--- /dev/null
+++ b/regression/cbmc-java/NondetArray/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetArray.class
+--function NondetArray.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetArray2/NondetArray2.class b/regression/cbmc-java/NondetArray2/NondetArray2.class
new file mode 100644
index 00000000000..83eba68f03c
Binary files /dev/null and b/regression/cbmc-java/NondetArray2/NondetArray2.class differ
diff --git a/regression/cbmc-java/NondetArray2/NondetArray2.java b/regression/cbmc-java/NondetArray2/NondetArray2.java
new file mode 100644
index 00000000000..2ff2201ee5d
--- /dev/null
+++ b/regression/cbmc-java/NondetArray2/NondetArray2.java
@@ -0,0 +1,17 @@
+import org.cprover.CProver;
+
+class NondetArray2
+{
+  void main()
+  {
+    Integer[] ints = CProver.nondetWithoutNull();
+
+    int num = 0;
+    for (Integer i : ints) {
+      if(i == null)
+        continue;
+      num *= i.intValue();
+    }
+    assert num == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetArray2/test.desc b/regression/cbmc-java/NondetArray2/test.desc
new file mode 100644
index 00000000000..2a274211c6c
--- /dev/null
+++ b/regression/cbmc-java/NondetArray2/test.desc
@@ -0,0 +1,8 @@
+CORE
+NondetArray2.class
+--function NondetArray2.main --unwind 5
+^VERIFICATION SUCCESSFUL$
+--
+--
+Disabled pending fixing warnings for array-of with zero length:
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetArray3/NondetArray3.class b/regression/cbmc-java/NondetArray3/NondetArray3.class
new file mode 100644
index 00000000000..0e5a2532fd6
Binary files /dev/null and b/regression/cbmc-java/NondetArray3/NondetArray3.class differ
diff --git a/regression/cbmc-java/NondetArray3/NondetArray3.java b/regression/cbmc-java/NondetArray3/NondetArray3.java
new file mode 100644
index 00000000000..af5f8f7f111
--- /dev/null
+++ b/regression/cbmc-java/NondetArray3/NondetArray3.java
@@ -0,0 +1,18 @@
+import org.cprover.CProver;
+
+class NondetArray3
+{
+  void main()
+  {
+    Integer[] ints = CProver.nondetWithoutNull();
+    assert ints != null;
+
+    int num = 0;
+    for (Integer i : ints) {
+      if(i == null)
+        continue;
+      num *= i.intValue();
+    }
+    assert num == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetArray3/test.desc b/regression/cbmc-java/NondetArray3/test.desc
new file mode 100644
index 00000000000..de192436903
--- /dev/null
+++ b/regression/cbmc-java/NondetArray3/test.desc
@@ -0,0 +1,8 @@
+CORE
+NondetArray3.class
+--function NondetArray3.main --unwind 5
+^VERIFICATION SUCCESSFUL$
+--
+--
+Disabled pending fixing warnings for array-of with zero length:
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetArray4/NondetArray4.class b/regression/cbmc-java/NondetArray4/NondetArray4.class
new file mode 100644
index 00000000000..dbe5532ccfb
Binary files /dev/null and b/regression/cbmc-java/NondetArray4/NondetArray4.class differ
diff --git a/regression/cbmc-java/NondetArray4/NondetArray4.java b/regression/cbmc-java/NondetArray4/NondetArray4.java
new file mode 100644
index 00000000000..4b4e15aaad7
--- /dev/null
+++ b/regression/cbmc-java/NondetArray4/NondetArray4.java
@@ -0,0 +1,14 @@
+import org.cprover.CProver;
+
+class NondetArray4
+{
+  void main()
+  {
+    int a = 1;
+    int b = 2;
+    int c = 3;
+
+    Integer[] ints = CProver.nondetWithoutNull();
+    assert ints != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetArray4/test.desc b/regression/cbmc-java/NondetArray4/test.desc
new file mode 100644
index 00000000000..fd419bab2d4
--- /dev/null
+++ b/regression/cbmc-java/NondetArray4/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetArray4.class
+--function NondetArray4.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetAssume1/NondetAssume1.class b/regression/cbmc-java/NondetAssume1/NondetAssume1.class
new file mode 100644
index 00000000000..bcdca197547
Binary files /dev/null and b/regression/cbmc-java/NondetAssume1/NondetAssume1.class differ
diff --git a/regression/cbmc-java/NondetAssume1/NondetAssume1.java b/regression/cbmc-java/NondetAssume1/NondetAssume1.java
new file mode 100644
index 00000000000..9177bcece6b
--- /dev/null
+++ b/regression/cbmc-java/NondetAssume1/NondetAssume1.java
@@ -0,0 +1,11 @@
+import org.cprover.CProver;
+
+class NondetAssume1
+{
+  void main()
+  {
+    int x = CProver.nondetInt();
+    CProver.assume(x == 1);
+    assert x == 1;
+  }
+}
diff --git a/regression/cbmc-java/NondetAssume1/test.desc b/regression/cbmc-java/NondetAssume1/test.desc
new file mode 100644
index 00000000000..bbff9abb9f2
--- /dev/null
+++ b/regression/cbmc-java/NondetAssume1/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetAssume1.class
+--function NondetAssume1.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetAssume2/A.class b/regression/cbmc-java/NondetAssume2/A.class
new file mode 100644
index 00000000000..66636e271af
Binary files /dev/null and b/regression/cbmc-java/NondetAssume2/A.class differ
diff --git a/regression/cbmc-java/NondetAssume2/B.class b/regression/cbmc-java/NondetAssume2/B.class
new file mode 100644
index 00000000000..9978b0f14de
Binary files /dev/null and b/regression/cbmc-java/NondetAssume2/B.class differ
diff --git a/regression/cbmc-java/NondetAssume2/C.class b/regression/cbmc-java/NondetAssume2/C.class
new file mode 100644
index 00000000000..bbf6b9b7eae
Binary files /dev/null and b/regression/cbmc-java/NondetAssume2/C.class differ
diff --git a/regression/cbmc-java/NondetAssume2/NondetAssume2.class b/regression/cbmc-java/NondetAssume2/NondetAssume2.class
new file mode 100644
index 00000000000..45efb7811e2
Binary files /dev/null and b/regression/cbmc-java/NondetAssume2/NondetAssume2.class differ
diff --git a/regression/cbmc-java/NondetAssume2/NondetAssume2.java b/regression/cbmc-java/NondetAssume2/NondetAssume2.java
new file mode 100644
index 00000000000..1f8f74a3464
--- /dev/null
+++ b/regression/cbmc-java/NondetAssume2/NondetAssume2.java
@@ -0,0 +1,17 @@
+import org.cprover.CProver;
+
+class A { int x; }
+
+class B { A a; }
+
+class C { B b; }
+
+class NondetAssume2
+{
+  void main()
+  {
+    C c = CProver.nondetWithNull();
+    CProver.assume(c != null);
+    assert c != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetAssume2/test.desc b/regression/cbmc-java/NondetAssume2/test.desc
new file mode 100644
index 00000000000..19abaa63e8a
--- /dev/null
+++ b/regression/cbmc-java/NondetAssume2/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetAssume2.class
+--function NondetAssume2.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetBoolean/NondetBoolean.class b/regression/cbmc-java/NondetBoolean/NondetBoolean.class
new file mode 100644
index 00000000000..0b4ed3f7915
Binary files /dev/null and b/regression/cbmc-java/NondetBoolean/NondetBoolean.class differ
diff --git a/regression/cbmc-java/NondetBoolean/NondetBoolean.java b/regression/cbmc-java/NondetBoolean/NondetBoolean.java
new file mode 100644
index 00000000000..4b05ae056ea
--- /dev/null
+++ b/regression/cbmc-java/NondetBoolean/NondetBoolean.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetBoolean
+{
+  static void main()
+  {
+    boolean x = CProver.nondetBoolean();
+    assert x == false;
+  }
+}
diff --git a/regression/cbmc-java/NondetBoolean/test.desc b/regression/cbmc-java/NondetBoolean/test.desc
new file mode 100644
index 00000000000..c0bfc954449
--- /dev/null
+++ b/regression/cbmc-java/NondetBoolean/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetBoolean.class
+--function NondetBoolean.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetByte/NondetByte.class b/regression/cbmc-java/NondetByte/NondetByte.class
new file mode 100644
index 00000000000..d066e46704c
Binary files /dev/null and b/regression/cbmc-java/NondetByte/NondetByte.class differ
diff --git a/regression/cbmc-java/NondetByte/NondetByte.java b/regression/cbmc-java/NondetByte/NondetByte.java
new file mode 100644
index 00000000000..36b7b209014
--- /dev/null
+++ b/regression/cbmc-java/NondetByte/NondetByte.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetByte
+{
+  static void main()
+  {
+    byte x = CProver.nondetByte();
+    assert x == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetByte/test.desc b/regression/cbmc-java/NondetByte/test.desc
new file mode 100644
index 00000000000..d05a462245a
--- /dev/null
+++ b/regression/cbmc-java/NondetByte/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetByte.class
+--function NondetByte.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetCastToObject/NondetCastToObject.class b/regression/cbmc-java/NondetCastToObject/NondetCastToObject.class
new file mode 100644
index 00000000000..65e622d872c
Binary files /dev/null and b/regression/cbmc-java/NondetCastToObject/NondetCastToObject.class differ
diff --git a/regression/cbmc-java/NondetCastToObject/NondetCastToObject.java b/regression/cbmc-java/NondetCastToObject/NondetCastToObject.java
new file mode 100644
index 00000000000..133df3f9f4e
--- /dev/null
+++ b/regression/cbmc-java/NondetCastToObject/NondetCastToObject.java
@@ -0,0 +1,11 @@
+import org.cprover.CProver;
+
+class NondetCastToObject
+{
+  void main()
+  {
+    Object o = CProver.nondetWithNull();
+    CProver.assume(o != null);
+    assert o != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetCastToObject/test.desc b/regression/cbmc-java/NondetCastToObject/test.desc
new file mode 100644
index 00000000000..5d3b98bb583
--- /dev/null
+++ b/regression/cbmc-java/NondetCastToObject/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetCastToObject.class
+--function NondetCastToObject.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetChar/NondetChar.class b/regression/cbmc-java/NondetChar/NondetChar.class
new file mode 100644
index 00000000000..4d05d0b75dd
Binary files /dev/null and b/regression/cbmc-java/NondetChar/NondetChar.class differ
diff --git a/regression/cbmc-java/NondetChar/NondetChar.java b/regression/cbmc-java/NondetChar/NondetChar.java
new file mode 100644
index 00000000000..f9570d8a5d2
--- /dev/null
+++ b/regression/cbmc-java/NondetChar/NondetChar.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetChar
+{
+  static void main()
+  {
+    char x = CProver.nondetChar();
+    assert x == '\0';
+  }
+}
diff --git a/regression/cbmc-java/NondetChar/test.desc b/regression/cbmc-java/NondetChar/test.desc
new file mode 100644
index 00000000000..96ecd2f6735
--- /dev/null
+++ b/regression/cbmc-java/NondetChar/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetChar.class
+--function NondetChar.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetDirectFromMethod/A.class b/regression/cbmc-java/NondetDirectFromMethod/A.class
new file mode 100644
index 00000000000..6d3758b230a
Binary files /dev/null and b/regression/cbmc-java/NondetDirectFromMethod/A.class differ
diff --git a/regression/cbmc-java/NondetDirectFromMethod/NondetDirectFromMethod.class b/regression/cbmc-java/NondetDirectFromMethod/NondetDirectFromMethod.class
new file mode 100644
index 00000000000..6dafdc80b07
Binary files /dev/null and b/regression/cbmc-java/NondetDirectFromMethod/NondetDirectFromMethod.class differ
diff --git a/regression/cbmc-java/NondetDirectFromMethod/NondetDirectFromMethod.java b/regression/cbmc-java/NondetDirectFromMethod/NondetDirectFromMethod.java
new file mode 100644
index 00000000000..dbd7960c880
--- /dev/null
+++ b/regression/cbmc-java/NondetDirectFromMethod/NondetDirectFromMethod.java
@@ -0,0 +1,19 @@
+import org.cprover.CProver;
+
+class A
+{
+  int a;
+}
+
+class NondetDirectFromMethod
+{
+  A methodReturningA()
+  {
+    return CProver.nondetWithoutNull();
+  }
+
+  void main()
+  {
+    assert methodReturningA() != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetDirectFromMethod/test.desc b/regression/cbmc-java/NondetDirectFromMethod/test.desc
new file mode 100644
index 00000000000..10989391e46
--- /dev/null
+++ b/regression/cbmc-java/NondetDirectFromMethod/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetDirectFromMethod.class
+--function NondetDirectFromMethod.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetDouble/NondetDouble.class b/regression/cbmc-java/NondetDouble/NondetDouble.class
new file mode 100644
index 00000000000..5d298bcfa63
Binary files /dev/null and b/regression/cbmc-java/NondetDouble/NondetDouble.class differ
diff --git a/regression/cbmc-java/NondetDouble/NondetDouble.java b/regression/cbmc-java/NondetDouble/NondetDouble.java
new file mode 100644
index 00000000000..451fcf4db7e
--- /dev/null
+++ b/regression/cbmc-java/NondetDouble/NondetDouble.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetDouble
+{
+  static void main()
+  {
+    double x = CProver.nondetDouble();
+    assert x == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetDouble/test.desc b/regression/cbmc-java/NondetDouble/test.desc
new file mode 100644
index 00000000000..631edbe5024
--- /dev/null
+++ b/regression/cbmc-java/NondetDouble/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetDouble.class
+--function NondetDouble.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetFloat/NondetFloat.class b/regression/cbmc-java/NondetFloat/NondetFloat.class
new file mode 100644
index 00000000000..9b26f72c773
Binary files /dev/null and b/regression/cbmc-java/NondetFloat/NondetFloat.class differ
diff --git a/regression/cbmc-java/NondetFloat/NondetFloat.java b/regression/cbmc-java/NondetFloat/NondetFloat.java
new file mode 100644
index 00000000000..e461162d0d5
--- /dev/null
+++ b/regression/cbmc-java/NondetFloat/NondetFloat.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetFloat
+{
+  static void main()
+  {
+    float x = CProver.nondetFloat();
+    assert x == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetFloat/test.desc b/regression/cbmc-java/NondetFloat/test.desc
new file mode 100644
index 00000000000..27bc33761b6
--- /dev/null
+++ b/regression/cbmc-java/NondetFloat/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetFloat.class
+--function NondetFloat.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetGenericArray/A.class b/regression/cbmc-java/NondetGenericArray/A.class
new file mode 100644
index 00000000000..1323ce430e5
Binary files /dev/null and b/regression/cbmc-java/NondetGenericArray/A.class differ
diff --git a/regression/cbmc-java/NondetGenericArray/B.class b/regression/cbmc-java/NondetGenericArray/B.class
new file mode 100644
index 00000000000..730946d3d80
Binary files /dev/null and b/regression/cbmc-java/NondetGenericArray/B.class differ
diff --git a/regression/cbmc-java/NondetGenericArray/C.class b/regression/cbmc-java/NondetGenericArray/C.class
new file mode 100644
index 00000000000..27903564a63
Binary files /dev/null and b/regression/cbmc-java/NondetGenericArray/C.class differ
diff --git a/regression/cbmc-java/NondetGenericArray/NondetGenericArray.class b/regression/cbmc-java/NondetGenericArray/NondetGenericArray.class
new file mode 100644
index 00000000000..76c6f43ab08
Binary files /dev/null and b/regression/cbmc-java/NondetGenericArray/NondetGenericArray.class differ
diff --git a/regression/cbmc-java/NondetGenericArray/NondetGenericArray.java b/regression/cbmc-java/NondetGenericArray/NondetGenericArray.java
new file mode 100644
index 00000000000..1c7d62a5b73
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericArray/NondetGenericArray.java
@@ -0,0 +1,30 @@
+import org.cprover.CProver;
+
+class A
+{
+  int[] ints = new int[10];
+}
+
+class B
+{
+  A a;
+}
+
+class C
+{
+  B b;
+}
+
+class NondetGenericArray
+{
+  static void main()
+  {
+    C c = CProver.nondetWithNull();
+    CProver.assume(c != null);
+    CProver.assume(c.b != null);
+    CProver.assume(c.b.a != null);
+    CProver.assume(c.b.a.ints != null);
+    assert c.b.a != null;
+    assert c.b.a.ints != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetGenericArray/test.desc b/regression/cbmc-java/NondetGenericArray/test.desc
new file mode 100644
index 00000000000..9abfffc4b9f
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericArray/test.desc
@@ -0,0 +1,8 @@
+CORE
+NondetGenericArray.class
+--function NondetGenericArray.main
+^VERIFICATION SUCCESSFUL$
+--
+--
+Disabled pending fixing warnings for array-of with zero length:
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetGenericRecursive/A.class b/regression/cbmc-java/NondetGenericRecursive/A.class
new file mode 100644
index 00000000000..005c8063d51
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive/A.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive/B.class b/regression/cbmc-java/NondetGenericRecursive/B.class
new file mode 100644
index 00000000000..8a18024f50b
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive/B.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive/C.class b/regression/cbmc-java/NondetGenericRecursive/C.class
new file mode 100644
index 00000000000..acc2b11ef63
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive/C.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive/NondetGenericRecursive.class b/regression/cbmc-java/NondetGenericRecursive/NondetGenericRecursive.class
new file mode 100644
index 00000000000..c0040fb2f5f
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive/NondetGenericRecursive.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive/NondetGenericRecursive.java b/regression/cbmc-java/NondetGenericRecursive/NondetGenericRecursive.java
new file mode 100644
index 00000000000..33d2b8d68bc
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericRecursive/NondetGenericRecursive.java
@@ -0,0 +1,24 @@
+import org.cprover.CProver;
+
+class A
+{
+}
+
+class B
+{
+  A a;
+}
+
+class C
+{
+  B b;
+}
+
+class NondetGenericRecursive
+{
+  static void main()
+  {
+    C c = CProver.nondetWithNull();
+    assert c == null;
+  }
+}
diff --git a/regression/cbmc-java/NondetGenericRecursive/test.desc b/regression/cbmc-java/NondetGenericRecursive/test.desc
new file mode 100644
index 00000000000..34af1b2e6c1
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericRecursive/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetGenericRecursive.class
+--function NondetGenericRecursive.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetGenericRecursive2/A.class b/regression/cbmc-java/NondetGenericRecursive2/A.class
new file mode 100644
index 00000000000..5628564f73d
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive2/A.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive2/B.class b/regression/cbmc-java/NondetGenericRecursive2/B.class
new file mode 100644
index 00000000000..606067dcdb8
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive2/B.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive2/C.class b/regression/cbmc-java/NondetGenericRecursive2/C.class
new file mode 100644
index 00000000000..fe32a4afb54
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive2/C.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive2/NondetGenericRecursive2.class b/regression/cbmc-java/NondetGenericRecursive2/NondetGenericRecursive2.class
new file mode 100644
index 00000000000..ed328ac8e04
Binary files /dev/null and b/regression/cbmc-java/NondetGenericRecursive2/NondetGenericRecursive2.class differ
diff --git a/regression/cbmc-java/NondetGenericRecursive2/NondetGenericRecursive2.java b/regression/cbmc-java/NondetGenericRecursive2/NondetGenericRecursive2.java
new file mode 100644
index 00000000000..de5ef46c4cb
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericRecursive2/NondetGenericRecursive2.java
@@ -0,0 +1,27 @@
+import org.cprover.CProver;
+
+class A
+{
+}
+
+class B
+{
+  A a;
+}
+
+class C
+{
+  B b;
+}
+
+class NondetGenericRecursive2
+{
+  static void main()
+  {
+    C c = CProver.nondetWithNull();
+    CProver.assume(c != null);
+    CProver.assume(c.b != null);
+    CProver.assume(c.b.a != null);
+    assert c.b.a != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetGenericRecursive2/test.desc b/regression/cbmc-java/NondetGenericRecursive2/test.desc
new file mode 100644
index 00000000000..52558889313
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericRecursive2/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetGenericRecursive2.class
+--function NondetGenericRecursive2.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetGenericWithNull/B.class b/regression/cbmc-java/NondetGenericWithNull/B.class
new file mode 100644
index 00000000000..80c9824e519
Binary files /dev/null and b/regression/cbmc-java/NondetGenericWithNull/B.class differ
diff --git a/regression/cbmc-java/NondetGenericWithNull/NondetGenericWithNull.class b/regression/cbmc-java/NondetGenericWithNull/NondetGenericWithNull.class
new file mode 100644
index 00000000000..0b52a47bd0a
Binary files /dev/null and b/regression/cbmc-java/NondetGenericWithNull/NondetGenericWithNull.class differ
diff --git a/regression/cbmc-java/NondetGenericWithNull/NondetGenericWithNull.java b/regression/cbmc-java/NondetGenericWithNull/NondetGenericWithNull.java
new file mode 100644
index 00000000000..9c89b92b31f
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericWithNull/NondetGenericWithNull.java
@@ -0,0 +1,13 @@
+import org.cprover.CProver;
+
+class B { int a; }
+
+class NondetGenericWithNull
+{
+  static void main()
+  {
+    B b = CProver.nondetWithNull();
+    assert b != null;
+    assert b.a != 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetGenericWithNull/test.desc b/regression/cbmc-java/NondetGenericWithNull/test.desc
new file mode 100644
index 00000000000..c2feb23068d
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericWithNull/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetGenericWithNull.class
+--function NondetGenericWithNull.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetGenericWithoutNull/B.class b/regression/cbmc-java/NondetGenericWithoutNull/B.class
new file mode 100644
index 00000000000..c7e4fbbf832
Binary files /dev/null and b/regression/cbmc-java/NondetGenericWithoutNull/B.class differ
diff --git a/regression/cbmc-java/NondetGenericWithoutNull/NondetGenericWithoutNull.class b/regression/cbmc-java/NondetGenericWithoutNull/NondetGenericWithoutNull.class
new file mode 100644
index 00000000000..c369eae01fc
Binary files /dev/null and b/regression/cbmc-java/NondetGenericWithoutNull/NondetGenericWithoutNull.class differ
diff --git a/regression/cbmc-java/NondetGenericWithoutNull/NondetGenericWithoutNull.java b/regression/cbmc-java/NondetGenericWithoutNull/NondetGenericWithoutNull.java
new file mode 100644
index 00000000000..6a3ef4ad6f3
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericWithoutNull/NondetGenericWithoutNull.java
@@ -0,0 +1,12 @@
+import org.cprover.CProver;
+
+class B { int a; }
+
+class NondetGenericWithoutNull
+{
+  static void main()
+  {
+    B b = CProver.nondetWithoutNull();
+    assert b != null;
+  }
+}
diff --git a/regression/cbmc-java/NondetGenericWithoutNull/test.desc b/regression/cbmc-java/NondetGenericWithoutNull/test.desc
new file mode 100644
index 00000000000..e9ada8b935c
--- /dev/null
+++ b/regression/cbmc-java/NondetGenericWithoutNull/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetGenericWithoutNull.class
+--function NondetGenericWithoutNull.main
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetInt/NondetInt.class b/regression/cbmc-java/NondetInt/NondetInt.class
new file mode 100644
index 00000000000..0af2adcb608
Binary files /dev/null and b/regression/cbmc-java/NondetInt/NondetInt.class differ
diff --git a/regression/cbmc-java/NondetInt/NondetInt.java b/regression/cbmc-java/NondetInt/NondetInt.java
new file mode 100644
index 00000000000..f2ae6890fb0
--- /dev/null
+++ b/regression/cbmc-java/NondetInt/NondetInt.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetInt
+{
+  static void main()
+  {
+    int x = CProver.nondetInt();
+    assert x == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetInt/test.desc b/regression/cbmc-java/NondetInt/test.desc
new file mode 100644
index 00000000000..324d69b8c91
--- /dev/null
+++ b/regression/cbmc-java/NondetInt/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetInt.class
+--function NondetInt.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetLong/NondetLong.class b/regression/cbmc-java/NondetLong/NondetLong.class
new file mode 100644
index 00000000000..27a693dee6e
Binary files /dev/null and b/regression/cbmc-java/NondetLong/NondetLong.class differ
diff --git a/regression/cbmc-java/NondetLong/NondetLong.java b/regression/cbmc-java/NondetLong/NondetLong.java
new file mode 100644
index 00000000000..57707eb07cb
--- /dev/null
+++ b/regression/cbmc-java/NondetLong/NondetLong.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetLong
+{
+  static void main()
+  {
+    long x = CProver.nondetLong();
+    assert x == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetLong/test.desc b/regression/cbmc-java/NondetLong/test.desc
new file mode 100644
index 00000000000..f92db994e00
--- /dev/null
+++ b/regression/cbmc-java/NondetLong/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetLong.class
+--function NondetLong.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NondetShort/NondetShort.class b/regression/cbmc-java/NondetShort/NondetShort.class
new file mode 100644
index 00000000000..32e0868de3e
Binary files /dev/null and b/regression/cbmc-java/NondetShort/NondetShort.class differ
diff --git a/regression/cbmc-java/NondetShort/NondetShort.java b/regression/cbmc-java/NondetShort/NondetShort.java
new file mode 100644
index 00000000000..941ee23ffd2
--- /dev/null
+++ b/regression/cbmc-java/NondetShort/NondetShort.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class NondetShort
+{
+  static void main()
+  {
+    short x = CProver.nondetShort();
+    assert x == 0;
+  }
+}
diff --git a/regression/cbmc-java/NondetShort/test.desc b/regression/cbmc-java/NondetShort/test.desc
new file mode 100644
index 00000000000..24ac39c540b
--- /dev/null
+++ b/regression/cbmc-java/NondetShort/test.desc
@@ -0,0 +1,6 @@
+CORE
+NondetShort.class
+--function NondetShort.main
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NullPointer1/test.desc b/regression/cbmc-java/NullPointer1/test.desc
index d479356875a..64fd6a24f69 100644
--- a/regression/cbmc-java/NullPointer1/test.desc
+++ b/regression/cbmc-java/NullPointer1/test.desc
@@ -3,7 +3,7 @@ NullPointer1.class
 --pointer-check --stop-on-fail
 ^EXIT=10$
 ^SIGNAL=0$
-^  file NullPointer1.java line 16 function java::NullPointer1.main:\(\[Ljava/lang/String;\)V$
+^  file NullPointer1.java line 16 function java::NullPointer1.main:\(\[Ljava/lang/String;\)V bytecode-index 9$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/NullPointer4/test.desc b/regression/cbmc-java/NullPointer4/test.desc
index 2e1b728c1fc..fbe3588bfff 100644
--- a/regression/cbmc-java/NullPointer4/test.desc
+++ b/regression/cbmc-java/NullPointer4/test.desc
@@ -3,7 +3,7 @@ NullPointer4.class
 --pointer-check --stop-on-fail
 ^EXIT=10$
 ^SIGNAL=0$
-^  file NullPointer4.java line 6 function java::NullPointer4.main:\(\[Ljava/lang/String;\)V$
+^  file NullPointer4.java line 6 function java::NullPointer4.main:\(\[Ljava/lang/String;\)V bytecode-index 4$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/NullPointerException2/A.class b/regression/cbmc-java/NullPointerException2/A.class
new file mode 100644
index 00000000000..19526643bf2
Binary files /dev/null and b/regression/cbmc-java/NullPointerException2/A.class differ
diff --git a/regression/cbmc-java/NullPointerException2/B.class b/regression/cbmc-java/NullPointerException2/B.class
new file mode 100644
index 00000000000..f29cbafef50
Binary files /dev/null and b/regression/cbmc-java/NullPointerException2/B.class differ
diff --git a/regression/cbmc-java/NullPointerException2/Test.class b/regression/cbmc-java/NullPointerException2/Test.class
new file mode 100644
index 00000000000..9885d01cc77
Binary files /dev/null and b/regression/cbmc-java/NullPointerException2/Test.class differ
diff --git a/regression/cbmc-java/NullPointerException2/Test.java b/regression/cbmc-java/NullPointerException2/Test.java
new file mode 100644
index 00000000000..684e6725a70
--- /dev/null
+++ b/regression/cbmc-java/NullPointerException2/Test.java
@@ -0,0 +1,17 @@
+class B extends RuntimeException {}
+
+class A {
+    int i;
+}
+
+public class Test {
+    public static void main(String args[]) {
+        A a=null;
+        try {
+            a.i=0;
+        }
+        catch (NullPointerException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/NullPointerException2/test.desc b/regression/cbmc-java/NullPointerException2/test.desc
new file mode 100644
index 00000000000..e4ad2c5739d
--- /dev/null
+++ b/regression/cbmc-java/NullPointerException2/test.desc
@@ -0,0 +1,9 @@
+CORE
+Test.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file Test.java line 14 function.*: FAILURE$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/NullPointerException3/A.class b/regression/cbmc-java/NullPointerException3/A.class
new file mode 100644
index 00000000000..19526643bf2
Binary files /dev/null and b/regression/cbmc-java/NullPointerException3/A.class differ
diff --git a/regression/cbmc-java/NullPointerException3/B.class b/regression/cbmc-java/NullPointerException3/B.class
new file mode 100644
index 00000000000..f29cbafef50
Binary files /dev/null and b/regression/cbmc-java/NullPointerException3/B.class differ
diff --git a/regression/cbmc-java/NullPointerException3/Test.class b/regression/cbmc-java/NullPointerException3/Test.class
new file mode 100644
index 00000000000..7f90d2404b4
Binary files /dev/null and b/regression/cbmc-java/NullPointerException3/Test.class differ
diff --git a/regression/cbmc-java/NullPointerException3/Test.java b/regression/cbmc-java/NullPointerException3/Test.java
new file mode 100644
index 00000000000..398d90b0c21
--- /dev/null
+++ b/regression/cbmc-java/NullPointerException3/Test.java
@@ -0,0 +1,17 @@
+class B extends RuntimeException {}
+
+class A {
+    int i;
+}
+
+public class Test {
+    public static void main(String args[]) {
+        A a=null;
+        try {
+            int i=a.i;
+        }
+        catch (NullPointerException exc) {
+            assert false;
+        }
+    }
+}
diff --git a/regression/cbmc-java/NullPointerException3/test.desc b/regression/cbmc-java/NullPointerException3/test.desc
new file mode 100644
index 00000000000..e4ad2c5739d
--- /dev/null
+++ b/regression/cbmc-java/NullPointerException3/test.desc
@@ -0,0 +1,9 @@
+CORE
+Test.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+^.*assertion at file Test.java line 14 function.*: FAILURE$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/address_space_size_limit1/Test.class b/regression/cbmc-java/address_space_size_limit1/Test.class
new file mode 100644
index 00000000000..5f81fc826ff
Binary files /dev/null and b/regression/cbmc-java/address_space_size_limit1/Test.class differ
diff --git a/regression/cbmc-java/address_space_size_limit1/Test.java b/regression/cbmc-java/address_space_size_limit1/Test.java
new file mode 100644
index 00000000000..4f60b51e973
--- /dev/null
+++ b/regression/cbmc-java/address_space_size_limit1/Test.java
@@ -0,0 +1,13 @@
+public class Test {
+    int x;
+    Test(int x) { this.x = x; }
+
+    public static void main(String[] args) {
+        int i;
+        Test[] tests = new Test[30];
+        for(i = 0; i < 30; ++i) {
+            tests[i] = new Test(i);
+        }
+        assert i == tests[0].x;
+    }
+}
diff --git a/regression/cbmc-java/address_space_size_limit1/test.desc b/regression/cbmc-java/address_space_size_limit1/test.desc
new file mode 100644
index 00000000000..d08ff5b05c1
--- /dev/null
+++ b/regression/cbmc-java/address_space_size_limit1/test.desc
@@ -0,0 +1,5 @@
+CORE
+Test.class
+--object-bits 4
+too many addressed objects
+--
diff --git a/regression/cbmc-java/address_space_size_limit2/Test.class b/regression/cbmc-java/address_space_size_limit2/Test.class
new file mode 100644
index 00000000000..5f81fc826ff
Binary files /dev/null and b/regression/cbmc-java/address_space_size_limit2/Test.class differ
diff --git a/regression/cbmc-java/address_space_size_limit2/Test.java b/regression/cbmc-java/address_space_size_limit2/Test.java
new file mode 100644
index 00000000000..4f60b51e973
--- /dev/null
+++ b/regression/cbmc-java/address_space_size_limit2/Test.java
@@ -0,0 +1,13 @@
+public class Test {
+    int x;
+    Test(int x) { this.x = x; }
+
+    public static void main(String[] args) {
+        int i;
+        Test[] tests = new Test[30];
+        for(i = 0; i < 30; ++i) {
+            tests[i] = new Test(i);
+        }
+        assert i == tests[0].x;
+    }
+}
diff --git a/regression/cbmc-java/address_space_size_limit2/test.desc b/regression/cbmc-java/address_space_size_limit2/test.desc
new file mode 100644
index 00000000000..9cf9d12a7f7
--- /dev/null
+++ b/regression/cbmc-java/address_space_size_limit2/test.desc
@@ -0,0 +1,8 @@
+CORE
+Test.class
+--object-bits 8
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
+^\[java::Test.main:\(\[Ljava/lang/String;\)V.assertion.1\] .*: FAILURE$
+--
diff --git a/regression/cbmc-java/assume1/Assume1.class b/regression/cbmc-java/assume1/Assume1.class
new file mode 100644
index 00000000000..b9a49bc9971
Binary files /dev/null and b/regression/cbmc-java/assume1/Assume1.class differ
diff --git a/regression/cbmc-java/assume1/Assume1.java b/regression/cbmc-java/assume1/Assume1.java
new file mode 100644
index 00000000000..4de0afd025b
--- /dev/null
+++ b/regression/cbmc-java/assume1/Assume1.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class Assume1
+{
+  static void foo(int x)
+  {
+    CProver.assume(x>3);
+    assert x>0;
+  }
+}
diff --git a/regression/cbmc-java/assume1/test.desc b/regression/cbmc-java/assume1/test.desc
new file mode 100644
index 00000000000..1f80a1c1e86
--- /dev/null
+++ b/regression/cbmc-java/assume1/test.desc
@@ -0,0 +1,8 @@
+CORE
+Assume1.class
+--function Assume1.foo
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/assume2/Assume2.class b/regression/cbmc-java/assume2/Assume2.class
new file mode 100644
index 00000000000..36e09875d7d
Binary files /dev/null and b/regression/cbmc-java/assume2/Assume2.class differ
diff --git a/regression/cbmc-java/assume2/Assume2.java b/regression/cbmc-java/assume2/Assume2.java
new file mode 100644
index 00000000000..6991167bfb8
--- /dev/null
+++ b/regression/cbmc-java/assume2/Assume2.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class Assume2
+{
+  static void foo(int x)
+  {
+    CProver.assume(x>3);    
+    assert x>4;
+  }
+}
diff --git a/regression/cbmc-java/assume2/test.desc b/regression/cbmc-java/assume2/test.desc
new file mode 100644
index 00000000000..35a954116f8
--- /dev/null
+++ b/regression/cbmc-java/assume2/test.desc
@@ -0,0 +1,8 @@
+CORE
+Assume2.class
+--function Assume2.foo
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/assume3/Assume3.class b/regression/cbmc-java/assume3/Assume3.class
new file mode 100644
index 00000000000..916ad4065fb
Binary files /dev/null and b/regression/cbmc-java/assume3/Assume3.class differ
diff --git a/regression/cbmc-java/assume3/Assume3.java b/regression/cbmc-java/assume3/Assume3.java
new file mode 100644
index 00000000000..895deee9ca0
--- /dev/null
+++ b/regression/cbmc-java/assume3/Assume3.java
@@ -0,0 +1,10 @@
+import org.cprover.CProver;
+
+class Assume3
+{
+  public static void main(String[] args)
+  {
+    CProver.assume(false);
+    assert false;
+  }
+}
diff --git a/regression/cbmc-java/assume3/test.desc b/regression/cbmc-java/assume3/test.desc
new file mode 100644
index 00000000000..0ad8c00399f
--- /dev/null
+++ b/regression/cbmc-java/assume3/test.desc
@@ -0,0 +1,8 @@
+CORE
+Assume3.class
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/basic1/helloworld.class b/regression/cbmc-java/basic1/helloworld.class
index b1dabd1ca44..244d721feaa 100644
Binary files a/regression/cbmc-java/basic1/helloworld.class and b/regression/cbmc-java/basic1/helloworld.class differ
diff --git a/regression/cbmc-java/basic1/helloworld.java b/regression/cbmc-java/basic1/helloworld.java
index c76a0967f92..bfb08fce317 100644
--- a/regression/cbmc-java/basic1/helloworld.java
+++ b/regression/cbmc-java/basic1/helloworld.java
@@ -4,7 +4,14 @@
 /* Hello World Java Program */
 class helloworld  {
     public static void main(String[] args) {
+        assert(System.out != null);
         System.out.println("Hello World!");
+        assert(System.err != null);
+        System.err.println("Hello World!");
+        assert(System.in != null);
+        try {
+          int avail = System.in.available();
+        }
+        catch(java.io.IOException e) {}
     }
 }
-
diff --git a/regression/cbmc-java/cast_null1/test.class b/regression/cbmc-java/cast_null1/test.class
new file mode 100644
index 00000000000..efced7cc257
Binary files /dev/null and b/regression/cbmc-java/cast_null1/test.class differ
diff --git a/regression/cbmc-java/cast_null1/test.desc b/regression/cbmc-java/cast_null1/test.desc
new file mode 100644
index 00000000000..86a52fc73e7
--- /dev/null
+++ b/regression/cbmc-java/cast_null1/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+Dynamic cast check: FAILURE
+^warning: ignoring
diff --git a/regression/cbmc-java/cast_null1/test.java b/regression/cbmc-java/cast_null1/test.java
new file mode 100644
index 00000000000..b6eb1d11817
--- /dev/null
+++ b/regression/cbmc-java/cast_null1/test.java
@@ -0,0 +1,8 @@
+
+public class test {
+
+  public static void main() {
+    test t = (test)null;
+  }
+
+}
diff --git a/regression/cbmc-java/cast_null2/test.class b/regression/cbmc-java/cast_null2/test.class
new file mode 100644
index 00000000000..efced7cc257
Binary files /dev/null and b/regression/cbmc-java/cast_null2/test.class differ
diff --git a/regression/cbmc-java/cast_null2/test.desc b/regression/cbmc-java/cast_null2/test.desc
new file mode 100644
index 00000000000..c621e5854e5
--- /dev/null
+++ b/regression/cbmc-java/cast_null2/test.desc
@@ -0,0 +1,8 @@
+CORE
+test.class
+--java-throw-runtime-exceptions
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/cast_null2/test.java b/regression/cbmc-java/cast_null2/test.java
new file mode 100644
index 00000000000..b6eb1d11817
--- /dev/null
+++ b/regression/cbmc-java/cast_null2/test.java
@@ -0,0 +1,8 @@
+
+public class test {
+
+  public static void main() {
+    test t = (test)null;
+  }
+
+}
diff --git a/regression/cbmc-java/covered1/covered1.class b/regression/cbmc-java/covered1/covered1.class
new file mode 100644
index 00000000000..7cb91496b7d
Binary files /dev/null and b/regression/cbmc-java/covered1/covered1.class differ
diff --git a/regression/cbmc-java/covered1/covered1.java b/regression/cbmc-java/covered1/covered1.java
new file mode 100644
index 00000000000..018e65336a6
--- /dev/null
+++ b/regression/cbmc-java/covered1/covered1.java
@@ -0,0 +1,37 @@
+public class covered1
+{
+  // this is a variable
+  int x=1;
+  //these are two, one line off the first
+  int y=2;
+  int z=3;
+  //this is part of static init
+  static int z0=0;
+
+  //another non-static
+  int a;
+  int b;
+  static boolean odd;
+
+  static
+  {
+    odd=(z0+1)%2==0;
+  }
+
+  covered1(int a, int b)
+  {
+    this.a=a*b;
+    this.b=a+b;
+    if(this.a==a)
+      z0++;
+    else
+      odd=!odd;
+  }
+  // at the back
+  int z1=2;
+  int z2=3;
+  int z3=4;
+  //
+  static int z4=5;
+  int z5=5;
+}
diff --git a/regression/cbmc-java/covered1/test.desc b/regression/cbmc-java/covered1/test.desc
new file mode 100644
index 00000000000..6f78ed37e63
--- /dev/null
+++ b/regression/cbmc-java/covered1/test.desc
@@ -0,0 +1,18 @@
+CORE
+covered1.class
+--cover location --json-ui --show-properties
+^EXIT=0$
+^SIGNAL=0$
+.*\"coveredLines\": \"22\",$
+.*\"coveredLines\": \"4,6,7,23-25,31-33,36\",$
+.*\"coveredLines\": \"26\",$
+.*\"coveredLines\": \"28\",$
+.*\"coveredLines\": \"28\",$
+.*\"coveredLines\": \"28\",$
+.*\"coveredLines\": \"28\",$
+.*\"coveredLines\": \"29\",$
+.*\"coveredLines\": \"18\",$
+.*\"coveredLines\": \"18\",$
+.*\"coveredLines\": \"35\",$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/enum1/test.desc b/regression/cbmc-java/enum1/test.desc
index d9ca7a162db..eff2c2e6817 100644
--- a/regression/cbmc-java/enum1/test.desc
+++ b/regression/cbmc-java/enum1/test.desc
@@ -1,8 +1,9 @@
 CORE
 enum1.class
 --java-unwind-enum-static --unwind 3
-^EXIT=10$
+^VERIFICATION SUCCESSFUL$
+^EXIT=0$
 ^SIGNAL=0$
-^Unwinding loop java::enum1.<clinit>:\(\)V.0 iteration 5 \(6 max\) file enum1.java line 6 function java::enum1.<clinit>:\(\)V bytecode_index 78 thread 0$
+^Unwinding loop java::enum1.<clinit>:\(\)V.0 iteration 5 \(6 max\) file enum1.java line 6 function java::enum1.<clinit>:\(\)V bytecode-index 78 thread 0$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/exceptions19/exception_handler.class b/regression/cbmc-java/exceptions19/exception_handler.class
new file mode 100644
index 00000000000..39457a93971
Binary files /dev/null and b/regression/cbmc-java/exceptions19/exception_handler.class differ
diff --git a/regression/cbmc-java/exceptions19/exception_handler.j b/regression/cbmc-java/exceptions19/exception_handler.j
new file mode 100644
index 00000000000..04b3c177689
--- /dev/null
+++ b/regression/cbmc-java/exceptions19/exception_handler.j
@@ -0,0 +1,25 @@
+.class exception_handler
+.super java/lang/Object
+
+.method public <init>()V
+        aload_0
+        invokevirtual java/lang/Object/<init>()V
+        return
+.end method
+
+.method public f()V
+        .limit stack 4
+        .limit locals 4
+
+      begin:
+        new java/lang/Exception
+        dup
+        invokespecial java/lang/Exception.<init>()V
+        athrow
+      start:
+        dup
+      end:
+        astore_1
+        return
+.catch all from begin to end using start
+.end method
diff --git a/regression/cbmc-java/exceptions19/test.desc b/regression/cbmc-java/exceptions19/test.desc
new file mode 100644
index 00000000000..ed4bf5a2715
--- /dev/null
+++ b/regression/cbmc-java/exceptions19/test.desc
@@ -0,0 +1,8 @@
+CORE
+exception_handler.class
+--function exception_handler.f
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/exceptions20/A.class b/regression/cbmc-java/exceptions20/A.class
new file mode 100644
index 00000000000..eb19ef6be2b
Binary files /dev/null and b/regression/cbmc-java/exceptions20/A.class differ
diff --git a/regression/cbmc-java/exceptions20/B.class b/regression/cbmc-java/exceptions20/B.class
new file mode 100644
index 00000000000..47ae8f218e4
Binary files /dev/null and b/regression/cbmc-java/exceptions20/B.class differ
diff --git a/regression/cbmc-java/exceptions20/C.class b/regression/cbmc-java/exceptions20/C.class
new file mode 100644
index 00000000000..0c9779a4c2b
Binary files /dev/null and b/regression/cbmc-java/exceptions20/C.class differ
diff --git a/regression/cbmc-java/exceptions20/D.class b/regression/cbmc-java/exceptions20/D.class
new file mode 100644
index 00000000000..12179e84294
Binary files /dev/null and b/regression/cbmc-java/exceptions20/D.class differ
diff --git a/regression/cbmc-java/exceptions20/test.class b/regression/cbmc-java/exceptions20/test.class
new file mode 100644
index 00000000000..c76687b1bc7
Binary files /dev/null and b/regression/cbmc-java/exceptions20/test.class differ
diff --git a/regression/cbmc-java/exceptions20/test.desc b/regression/cbmc-java/exceptions20/test.desc
new file mode 100644
index 00000000000..72829197eb8
--- /dev/null
+++ b/regression/cbmc-java/exceptions20/test.desc
@@ -0,0 +1,11 @@
+CORE
+test.class
+--json-ui --trace
+^EXIT=10$
+^SIGNAL=0$
+.*VERIFICATION FAILED.*
+--
+^warning: ignoring
+--
+this fails with assertion error if nil values are not allowed in assignments in
+the JSON trace
diff --git a/regression/cbmc-java/exceptions20/test.java b/regression/cbmc-java/exceptions20/test.java
new file mode 100644
index 00000000000..bc925b32d65
--- /dev/null
+++ b/regression/cbmc-java/exceptions20/test.java
@@ -0,0 +1,30 @@
+class A extends Throwable {}
+class B extends A {}
+class C extends B {}
+class D extends C {}
+
+public class test {
+ public static void main (String arg[]) {
+   try {
+     D d = new D();
+     C c = new C();
+     B b = new B();
+     A a = new A();
+     A e = a;
+     throw e;
+   }
+   catch(D exc) {
+     assert false;
+   }
+   catch(C exc) {
+     assert false;
+   }
+   catch(B exc) {
+     assert false;
+   }
+   catch(A exc) {
+     assert false;
+   }  
+ }
+}
+
diff --git a/regression/cbmc-java/exceptions21/test.class b/regression/cbmc-java/exceptions21/test.class
new file mode 100644
index 00000000000..52c93d2bc4a
Binary files /dev/null and b/regression/cbmc-java/exceptions21/test.class differ
diff --git a/regression/cbmc-java/exceptions21/test.desc b/regression/cbmc-java/exceptions21/test.desc
new file mode 100644
index 00000000000..24040e046e4
--- /dev/null
+++ b/regression/cbmc-java/exceptions21/test.desc
@@ -0,0 +1,11 @@
+CORE
+test.class
+--function test.f --java-throw-runtime-exceptions
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+--
+reference is null in .*: FAILURE
+--
+This checks that the second use of a particular exception type in a given function is correctly initialised.
+In the failing case the #exception_value variable is nondet at the time it is thrown, so cbmc can set it to null and fail an assertion.
diff --git a/regression/cbmc-java/exceptions21/test.java b/regression/cbmc-java/exceptions21/test.java
new file mode 100644
index 00000000000..bc4c5570cc1
--- /dev/null
+++ b/regression/cbmc-java/exceptions21/test.java
@@ -0,0 +1,24 @@
+public class test {
+
+    int field;
+
+    public static void f() {
+
+        test testinstance = new test();
+        test testnull = null;
+        int x = 0;
+        try {
+            x = testinstance.field;
+        }
+        catch(NullPointerException e) {
+            x++;
+        }
+        try {
+            x = testnull.field;
+        }
+        catch(NullPointerException e) {
+            x++;
+        }
+    }
+
+}
diff --git a/regression/cbmc-java/exceptions22/test.class b/regression/cbmc-java/exceptions22/test.class
new file mode 100644
index 00000000000..38081aaa0f2
Binary files /dev/null and b/regression/cbmc-java/exceptions22/test.class differ
diff --git a/regression/cbmc-java/exceptions22/test.desc b/regression/cbmc-java/exceptions22/test.desc
new file mode 100644
index 00000000000..a3eaa698597
--- /dev/null
+++ b/regression/cbmc-java/exceptions22/test.desc
@@ -0,0 +1,11 @@
+CORE
+test.class
+
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+--
+^warning: ignoring
+--
+This test checks that a thrown exception is caught, and is not erroneously rethrown
+on function exit such that another surrounding try block can catch it again.
diff --git a/regression/cbmc-java/exceptions22/test.java b/regression/cbmc-java/exceptions22/test.java
new file mode 100644
index 00000000000..7ca29cddab9
--- /dev/null
+++ b/regression/cbmc-java/exceptions22/test.java
@@ -0,0 +1,20 @@
+public class test {
+  public static void main () {
+    try {
+      f();
+    }
+    catch(Exception e) {
+      assert(false); // Should be unreachable
+    }
+  }
+
+  public static void f() {
+    try {
+      throw new Exception();
+    }
+    catch(Exception e) {
+      // Should prevent main's catch handler from being invoked
+    }
+  }
+}
+
diff --git a/regression/cbmc-java/exceptions23/test.class b/regression/cbmc-java/exceptions23/test.class
new file mode 100644
index 00000000000..acfbe7b2551
Binary files /dev/null and b/regression/cbmc-java/exceptions23/test.class differ
diff --git a/regression/cbmc-java/exceptions23/test.desc b/regression/cbmc-java/exceptions23/test.desc
new file mode 100644
index 00000000000..fd651101086
--- /dev/null
+++ b/regression/cbmc-java/exceptions23/test.desc
@@ -0,0 +1,12 @@
+CORE
+test.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+VERIFICATION FAILED
+assertion at file test\.java line 9 function java::test\.main:\(\)V bytecode-index 12: FAILURE
+--
+^warning: ignoring
+--
+This test checks that accessing an array member, cf. a getfield or setfield bytecode,
+can produce a NullPointerException.
diff --git a/regression/cbmc-java/exceptions23/test.java b/regression/cbmc-java/exceptions23/test.java
new file mode 100644
index 00000000000..d50d7ac8356
--- /dev/null
+++ b/regression/cbmc-java/exceptions23/test.java
@@ -0,0 +1,12 @@
+
+public class test {
+ public static void main () {
+   try {
+     int[] array = null;
+     int x = array[0];
+   }
+   catch(NullPointerException e) {
+     assert false;
+   }
+ }
+}
diff --git a/regression/cbmc-java/exceptions24/A.class b/regression/cbmc-java/exceptions24/A.class
new file mode 100644
index 00000000000..3c3c1f09997
Binary files /dev/null and b/regression/cbmc-java/exceptions24/A.class differ
diff --git a/regression/cbmc-java/exceptions24/test.class b/regression/cbmc-java/exceptions24/test.class
new file mode 100644
index 00000000000..7c9e70f9925
Binary files /dev/null and b/regression/cbmc-java/exceptions24/test.class differ
diff --git a/regression/cbmc-java/exceptions24/test.desc b/regression/cbmc-java/exceptions24/test.desc
new file mode 100644
index 00000000000..1bf09a500d5
--- /dev/null
+++ b/regression/cbmc-java/exceptions24/test.desc
@@ -0,0 +1,12 @@
+CORE
+test.class
+--java-throw-runtime-exceptions
+^EXIT=10$
+^SIGNAL=0$
+VERIFICATION FAILED
+assertion at file test\.java line 9 function java::test\.main:\(\)V bytecode-index 10: FAILURE
+--
+^warning: ignoring
+--
+This test ensures that attempting a virtual call against a null pointer can produce a NullPointerException,
+even when there are no field accesses inside the method or inspection of its class identifier to trigger one.
diff --git a/regression/cbmc-java/exceptions24/test.java b/regression/cbmc-java/exceptions24/test.java
new file mode 100644
index 00000000000..9cefd50370a
--- /dev/null
+++ b/regression/cbmc-java/exceptions24/test.java
@@ -0,0 +1,18 @@
+
+public class test {
+ public static void main () {
+   try {
+     A a = null;
+     a.f();
+   }
+   catch(NullPointerException e) {
+     assert false;
+   }
+ }
+}
+
+class A {
+
+  public void f() {}
+
+}
diff --git a/regression/cbmc-java/external_getstatic1/test.class b/regression/cbmc-java/external_getstatic1/test.class
new file mode 100644
index 00000000000..ec38ad69385
Binary files /dev/null and b/regression/cbmc-java/external_getstatic1/test.class differ
diff --git a/regression/cbmc-java/external_getstatic1/test.desc b/regression/cbmc-java/external_getstatic1/test.desc
new file mode 100644
index 00000000000..dc5ca4fa5cb
--- /dev/null
+++ b/regression/cbmc-java/external_getstatic1/test.desc
@@ -0,0 +1,8 @@
+CORE
+test.class
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/external_getstatic1/test.java b/regression/cbmc-java/external_getstatic1/test.java
new file mode 100644
index 00000000000..5b3f3bdb9b2
--- /dev/null
+++ b/regression/cbmc-java/external_getstatic1/test.java
@@ -0,0 +1,16 @@
+class A
+{
+  public static A external_global;
+  public int i;
+};
+
+public class test
+{
+  public static void main()
+  {
+    if(A.external_global == null)
+      return;
+    A local = A.external_global;
+    assert(local instanceof A);
+  }
+}
diff --git a/regression/cbmc-java/finally1/test.class b/regression/cbmc-java/finally1/test.class
new file mode 100644
index 00000000000..73e239d42e5
Binary files /dev/null and b/regression/cbmc-java/finally1/test.class differ
diff --git a/regression/cbmc-java/finally1/test.desc b/regression/cbmc-java/finally1/test.desc
new file mode 100644
index 00000000000..a5fb4996899
--- /dev/null
+++ b/regression/cbmc-java/finally1/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 7 function java::test\.main:\(\)V bytecode-index 9: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally1/test.java b/regression/cbmc-java/finally1/test.java
new file mode 100644
index 00000000000..f1a964d83d3
--- /dev/null
+++ b/regression/cbmc-java/finally1/test.java
@@ -0,0 +1,11 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     throw new Exception();
+   }
+   finally {
+     assert(false);
+   }
+ }
+}
+
diff --git a/regression/cbmc-java/finally2/test.class b/regression/cbmc-java/finally2/test.class
new file mode 100644
index 00000000000..a7e4c2e4c22
Binary files /dev/null and b/regression/cbmc-java/finally2/test.class differ
diff --git a/regression/cbmc-java/finally2/test.desc b/regression/cbmc-java/finally2/test.desc
new file mode 100644
index 00000000000..ae317e016fe
--- /dev/null
+++ b/regression/cbmc-java/finally2/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 8 function java::test\.main:\(\)V bytecode-index 9: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally2/test.java b/regression/cbmc-java/finally2/test.java
new file mode 100644
index 00000000000..548936094dc
--- /dev/null
+++ b/regression/cbmc-java/finally2/test.java
@@ -0,0 +1,12 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     throw new Exception();
+   }
+   catch(Exception e) { }
+   finally {
+     assert(false);
+   }
+ }
+}
+
diff --git a/regression/cbmc-java/finally3/test.class b/regression/cbmc-java/finally3/test.class
new file mode 100644
index 00000000000..e73e96ce4ad
Binary files /dev/null and b/regression/cbmc-java/finally3/test.class differ
diff --git a/regression/cbmc-java/finally3/test.desc b/regression/cbmc-java/finally3/test.desc
new file mode 100644
index 00000000000..40c2fe0ab68
--- /dev/null
+++ b/regression/cbmc-java/finally3/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 7 function java::test\.main:\(\)V bytecode-index 9: SUCCESS
+assertion at file test\.java line 10 function java::test\.main:\(\)V bytecode-index 22: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally3/test.java b/regression/cbmc-java/finally3/test.java
new file mode 100644
index 00000000000..51d347c3327
--- /dev/null
+++ b/regression/cbmc-java/finally3/test.java
@@ -0,0 +1,14 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     throw new NullPointerException();
+   }
+   catch(ArithmeticException e) {
+     assert(false);
+   }
+   finally {
+     assert(false);
+   }
+ }
+}
+
diff --git a/regression/cbmc-java/finally4/test.class b/regression/cbmc-java/finally4/test.class
new file mode 100644
index 00000000000..f7989f80e54
Binary files /dev/null and b/regression/cbmc-java/finally4/test.class differ
diff --git a/regression/cbmc-java/finally4/test.desc b/regression/cbmc-java/finally4/test.desc
new file mode 100644
index 00000000000..eeba95d006c
--- /dev/null
+++ b/regression/cbmc-java/finally4/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 11 function java::test\.main:\(\)V bytecode-index 7: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally4/test.java b/regression/cbmc-java/finally4/test.java
new file mode 100644
index 00000000000..4943a8d251d
--- /dev/null
+++ b/regression/cbmc-java/finally4/test.java
@@ -0,0 +1,15 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     int x = 1;
+     x++;
+   }
+   catch(ArithmeticException e) {
+     assert(false);
+   }
+   finally {
+     assert(false);
+   }
+ }
+}
+
diff --git a/regression/cbmc-java/finally5/test.class b/regression/cbmc-java/finally5/test.class
new file mode 100644
index 00000000000..0bde735c6af
Binary files /dev/null and b/regression/cbmc-java/finally5/test.class differ
diff --git a/regression/cbmc-java/finally5/test.desc b/regression/cbmc-java/finally5/test.desc
new file mode 100644
index 00000000000..cc3b6780920
--- /dev/null
+++ b/regression/cbmc-java/finally5/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 7 function java::test\.main:\(\)V bytecode-index 12: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally5/test.java b/regression/cbmc-java/finally5/test.java
new file mode 100644
index 00000000000..3411b175943
--- /dev/null
+++ b/regression/cbmc-java/finally5/test.java
@@ -0,0 +1,15 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     f();
+   }
+   finally {
+     assert(false);
+   }
+ }
+
+ public static void f() throws Exception {
+   throw new Exception();
+ }
+}
+
diff --git a/regression/cbmc-java/finally6/test.class b/regression/cbmc-java/finally6/test.class
new file mode 100644
index 00000000000..5f4d1321761
Binary files /dev/null and b/regression/cbmc-java/finally6/test.class differ
diff --git a/regression/cbmc-java/finally6/test.desc b/regression/cbmc-java/finally6/test.desc
new file mode 100644
index 00000000000..91aca5d1b77
--- /dev/null
+++ b/regression/cbmc-java/finally6/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 8 function java::test\.main:\(\)V bytecode-index 12: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally6/test.java b/regression/cbmc-java/finally6/test.java
new file mode 100644
index 00000000000..e7c328bdf56
--- /dev/null
+++ b/regression/cbmc-java/finally6/test.java
@@ -0,0 +1,16 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     f();
+   }
+   catch(Exception e) { }
+   finally {
+     assert(false);
+   }
+ }
+
+ public static void f() throws Exception {
+   throw new Exception();
+ }
+}
+
diff --git a/regression/cbmc-java/finally7/test.class b/regression/cbmc-java/finally7/test.class
new file mode 100644
index 00000000000..94bdd643637
Binary files /dev/null and b/regression/cbmc-java/finally7/test.class differ
diff --git a/regression/cbmc-java/finally7/test.desc b/regression/cbmc-java/finally7/test.desc
new file mode 100644
index 00000000000..5772f2dea33
--- /dev/null
+++ b/regression/cbmc-java/finally7/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test\.java line 7 function java::test\.main:\(\)V bytecode-index 12: SUCCESS
+assertion at file test\.java line 10 function java::test\.main:\(\)V bytecode-index 25: FAILURE
+^VERIFICATION FAILED$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/finally7/test.java b/regression/cbmc-java/finally7/test.java
new file mode 100644
index 00000000000..b9e8e16380e
--- /dev/null
+++ b/regression/cbmc-java/finally7/test.java
@@ -0,0 +1,18 @@
+public class test {
+ public static void main() throws Exception {
+   try {
+     f();
+   }
+   catch(ArithmeticException e) {
+     assert(false);
+   }
+   finally {
+     assert(false);
+   }
+ }
+
+ public static void f() throws NullPointerException {
+   throw new NullPointerException();
+ }
+}
+
diff --git a/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Item.class b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Item.class
new file mode 100644
index 00000000000..bf9694b3f36
Binary files /dev/null and b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Item.class differ
diff --git a/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Item.java b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Item.java
new file mode 100644
index 00000000000..6e04c6f345a
--- /dev/null
+++ b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Item.java
@@ -0,0 +1,5 @@
+package com.diffblue.javatest.nestedobjects.subpackage;
+
+public class Item {
+  public int cost;
+}
diff --git a/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Order.class b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Order.class
new file mode 100644
index 00000000000..9c810453dec
Binary files /dev/null and b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Order.class differ
diff --git a/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Order.java b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Order.java
new file mode 100644
index 00000000000..012c3c7a355
--- /dev/null
+++ b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/Order.java
@@ -0,0 +1,25 @@
+package com.diffblue.javatest.nestedobjects.subpackage;
+
+public class Order {
+  public Item item;
+
+  /**
+   * Checks if this order has an item.
+   */
+  public boolean hasItem() {
+    if (item == null) {
+      return false;
+    } else {
+      return true;
+    }
+  }
+
+  /**
+   * Sets the item for this order.
+   */
+  public boolean setItem(Item item) {
+    boolean exists = hasItem();
+    this.item = item;
+    return exists;
+  }
+}
diff --git a/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/readme.txt b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/readme.txt
new file mode 100644
index 00000000000..2a237709812
--- /dev/null
+++ b/regression/cbmc-java/internal1/com/diffblue/javatest/nestedobjects/subpackage/readme.txt
@@ -0,0 +1,2 @@
+Source of benchmark:
+https://github.com/DiffBlue-benchmarks/java-test
\ No newline at end of file
diff --git a/regression/cbmc-java/internal1/test.desc b/regression/cbmc-java/internal1/test.desc
new file mode 100644
index 00000000000..09047367ca9
--- /dev/null
+++ b/regression/cbmc-java/internal1/test.desc
@@ -0,0 +1,13 @@
+CORE
+com/diffblue/javatest/nestedobjects/subpackage/Order.class
+--json-ui --function 'com.diffblue.javatest.nestedobjects.subpackage.Order.setItem:(Lcom/diffblue/javatest/nestedobjects/subpackage/Item;)Z' --cover location --trace
+activate-multi-line-match
+EXIT=0
+SIGNAL=0
+"identifier": "__CPROVER_initialize",\n *"sourceLocation": [{][}]\n *[}],\n *"hidden": false,\n *"internal": true,\n *"stepType": "function-call",
+"internal": true,\n *"lhs": "tmp_object_factory[$][0-9]+",
+"internal": false,\n *"sourceLocation": [{]\n *"file": "com/diffblue/javatest/nestedobjects/subpackage/Order.java",\n *"function": "java::com.diffblue.javatest.nestedobjects.subpackage.Order.setItem:[(]Lcom/diffblue/javatest/nestedobjects/subpackage/Item;[)]Z",\n *"line": "21"\n *[}],\n *"stepType": "function-call",
+"internal": false,\n *"lhs": "this",\n *"mode": "java",\n *"sourceLocation": [{]\n *"file": "com/diffblue/javatest/nestedobjects/subpackage/Order.java",\n *"function": "java::com.diffblue.javatest.nestedobjects.subpackage.Order.setItem:[(]Lcom/diffblue/javatest/nestedobjects/subpackage/Item;[)]Z",
+"internal": false,\n *"lhs": "item",\n *"mode": "java",\n *"sourceLocation": [{]\n *"file": "com/diffblue/javatest/nestedobjects/subpackage/Order.java",\n *"function": "java::com.diffblue.javatest.nestedobjects.subpackage.Order.setItem:[(]Lcom/diffblue/javatest/nestedobjects/subpackage/Item;[)]Z",
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/json_trace1/Test.class b/regression/cbmc-java/json_trace1/Test.class
new file mode 100644
index 00000000000..2f57ffa3c57
Binary files /dev/null and b/regression/cbmc-java/json_trace1/Test.class differ
diff --git a/regression/cbmc-java/json_trace1/Test.java b/regression/cbmc-java/json_trace1/Test.java
new file mode 100644
index 00000000000..79cb55bfdf9
--- /dev/null
+++ b/regression/cbmc-java/json_trace1/Test.java
@@ -0,0 +1,21 @@
+public class Test {
+
+  byte main(byte[] a) {
+    if (a.length != 9) {
+      return -1;
+    }
+
+    byte diff = 0;
+    for (byte i = 0; i < 9; i++) {
+      if (a[i] == 1) {
+        diff++;
+      } else if (a[i] == 2) {
+        diff--;
+      } else if (a[i] != 0) {
+        return -1;
+      }
+    }
+
+    return -1;
+  }
+}
diff --git a/regression/cbmc-java/json_trace1/test.desc b/regression/cbmc-java/json_trace1/test.desc
new file mode 100644
index 00000000000..c7596faa19d
--- /dev/null
+++ b/regression/cbmc-java/json_trace1/test.desc
@@ -0,0 +1,7 @@
+CORE
+Test.class
+--cover location --trace --json-ui
+^EXIT=0$
+^SIGNAL=0$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/json_trace2/Test.class b/regression/cbmc-java/json_trace2/Test.class
new file mode 100644
index 00000000000..68771db843a
Binary files /dev/null and b/regression/cbmc-java/json_trace2/Test.class differ
diff --git a/regression/cbmc-java/json_trace2/Test.java b/regression/cbmc-java/json_trace2/Test.java
new file mode 100644
index 00000000000..25608c219d3
--- /dev/null
+++ b/regression/cbmc-java/json_trace2/Test.java
@@ -0,0 +1,7 @@
+public class Test {
+  boolean test(Object x) {
+    if(x==null)
+      return false;
+    return true;
+  }
+}
diff --git a/regression/cbmc-java/json_trace2/test.desc b/regression/cbmc-java/json_trace2/test.desc
new file mode 100644
index 00000000000..13d8774fb25
--- /dev/null
+++ b/regression/cbmc-java/json_trace2/test.desc
@@ -0,0 +1,10 @@
+CORE
+Test.class
+--cover location --trace --json-ui --function Test.test
+activate-multi-line-match
+EXIT=0
+SIGNAL=0
+"outputID": "return",\n *"sourceLocation": \{\n *"file": "Test\.java",\n *"function": "java::Test\.test:\(Ljava/lang/Object;\)Z",\n *"line": "3"\n *\},\n *"stepType": "output",\n *"thread": 0,\n *"values": \[\n *\{\n *"binary": "00000000",\n *"data": "false",\n *"name": "integer",\n *"type": "boolean",\n *"width": 8
+"inputID": "arg1a",\n *"internal": true,\n *"mode": "java",\n *"sourceLocation": \{\n *"file": "Test\.java",\n *"function": "java::Test\.test:\(Ljava/lang/Object;\)Z",\n *"line": "3"\n *\},\n *"stepType": "input",\n *"thread": 0,\n *"values": \[\n *\{\n *"data": "null",\n *"name": "pointer",\n *"type": "struct java\.lang\.Object \{ __CPROVER_string @class_identifier; boolean @lock; \} \*"
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/json_trace3/Test.class b/regression/cbmc-java/json_trace3/Test.class
new file mode 100644
index 00000000000..86426242aaa
Binary files /dev/null and b/regression/cbmc-java/json_trace3/Test.class differ
diff --git a/regression/cbmc-java/json_trace3/Test.java b/regression/cbmc-java/json_trace3/Test.java
new file mode 100644
index 00000000000..02cc993c56e
--- /dev/null
+++ b/regression/cbmc-java/json_trace3/Test.java
@@ -0,0 +1,9 @@
+public class Test {
+  public static void main(long[] a) {
+    if(a.length<3)
+      return;
+    for(int i=0; i<a.length; i++) {
+      a[i]=(long)i;
+    }
+  }
+}
diff --git a/regression/cbmc-java/json_trace3/test.desc b/regression/cbmc-java/json_trace3/test.desc
new file mode 100644
index 00000000000..a8ae2a31a1e
--- /dev/null
+++ b/regression/cbmc-java/json_trace3/test.desc
@@ -0,0 +1,10 @@
+CORE
+Test.class
+--cover location --trace --json-ui --unwind 5
+activate-multi-line-match
+EXIT=0
+SIGNAL=0
+"lhs": "dynamic_2_array\[1L\]",\n *"mode": "java",\n *"sourceLocation": \{\n *"bytecodeIndex": "15",\n *"file": "Test\.java",\n *"function": "java::Test\.main:\(\[J\)V",\n *"line": "6"\n *\},\n *"stepType": "assignment",\n *"thread": 0,\n *"value": \{\n *"binary": "0000000000000000000000000000000000000000000000000000000000000001",\n *"data": "1L",\n *"name": "integer",\n *"type": "long",\n *"width": 64
+--
+"name": "unknown"
+^warning: ignoring
diff --git a/regression/cbmc-java/lazyloading10/test.class b/regression/cbmc-java/lazyloading10/test.class
new file mode 100644
index 00000000000..832bfbd07a8
Binary files /dev/null and b/regression/cbmc-java/lazyloading10/test.class differ
diff --git a/regression/cbmc-java/lazyloading10/test.desc b/regression/cbmc-java/lazyloading10/test.desc
new file mode 100644
index 00000000000..38fb7495a08
--- /dev/null
+++ b/regression/cbmc-java/lazyloading10/test.desc
@@ -0,0 +1,8 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.f --lazy-methods-extra-entry-point test.sety
+^EXIT=6$
+^SIGNAL=0$
+entry point 'test\.sety' is ambiguous between:
+test\.sety:\(I\)V
+test\.sety:\(F\)V
diff --git a/regression/cbmc-java/lazyloading10/test.java b/regression/cbmc-java/lazyloading10/test.java
new file mode 100644
index 00000000000..7c54eb7f2ec
--- /dev/null
+++ b/regression/cbmc-java/lazyloading10/test.java
@@ -0,0 +1,14 @@
+public class test {
+
+    int x;
+    int y;
+    
+    public test() { x = 1; y = 2; }
+    public void setx(int _x) { x = _x; }
+    public void sety(int _y) { y = _y; }
+    public void sety(float _y) { y = (int)_y; }
+    public void f() { }
+    
+}
+
+
diff --git a/regression/cbmc-java/lazyloading11/test.class b/regression/cbmc-java/lazyloading11/test.class
new file mode 100644
index 00000000000..832bfbd07a8
Binary files /dev/null and b/regression/cbmc-java/lazyloading11/test.class differ
diff --git a/regression/cbmc-java/lazyloading11/test.desc b/regression/cbmc-java/lazyloading11/test.desc
new file mode 100644
index 00000000000..c74260ce902
--- /dev/null
+++ b/regression/cbmc-java/lazyloading11/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.f --lazy-methods-extra-entry-point "test.sety:(I)V" --lazy-methods-extra-entry-point "test.sety:(F)V"
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+CI lazy methods: elaborate java::test\.sety:\(I\)V
+CI lazy methods: elaborate java::test\.sety:\(F\)V
+--
+CI lazy methods: elaborate java::test\.setx:\(I\)V
diff --git a/regression/cbmc-java/lazyloading11/test.java b/regression/cbmc-java/lazyloading11/test.java
new file mode 100644
index 00000000000..7c54eb7f2ec
--- /dev/null
+++ b/regression/cbmc-java/lazyloading11/test.java
@@ -0,0 +1,14 @@
+public class test {
+
+    int x;
+    int y;
+    
+    public test() { x = 1; y = 2; }
+    public void setx(int _x) { x = _x; }
+    public void sety(int _y) { y = _y; }
+    public void sety(float _y) { y = (int)_y; }
+    public void f() { }
+    
+}
+
+
diff --git a/regression/cbmc-java/lazyloading3/test.class b/regression/cbmc-java/lazyloading3/test.class
index 5df466fc9ea..eabb679daa5 100644
Binary files a/regression/cbmc-java/lazyloading3/test.class and b/regression/cbmc-java/lazyloading3/test.class differ
diff --git a/regression/cbmc-java/lazyloading3/test.java b/regression/cbmc-java/lazyloading3/test.java
index f69a9898472..2e967aea266 100644
--- a/regression/cbmc-java/lazyloading3/test.java
+++ b/regression/cbmc-java/lazyloading3/test.java
@@ -5,7 +5,7 @@ public class test
 {
   public static void main(C c)
   {
-    if(c==null)
+    if(c==null || c.a==null)
       return;
     c.a.f();
   }
diff --git a/regression/cbmc-java/lazyloading5/other.class b/regression/cbmc-java/lazyloading5/other.class
new file mode 100644
index 00000000000..88dbb5d67c2
Binary files /dev/null and b/regression/cbmc-java/lazyloading5/other.class differ
diff --git a/regression/cbmc-java/lazyloading5/test.class b/regression/cbmc-java/lazyloading5/test.class
new file mode 100644
index 00000000000..b2f426a182a
Binary files /dev/null and b/regression/cbmc-java/lazyloading5/test.class differ
diff --git a/regression/cbmc-java/lazyloading5/test.desc b/regression/cbmc-java/lazyloading5/test.desc
new file mode 100644
index 00000000000..a3226adccaa
--- /dev/null
+++ b/regression/cbmc-java/lazyloading5/test.desc
@@ -0,0 +1,6 @@
+CORE
+test.class
+--lazy-methods --function test.main
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
diff --git a/regression/cbmc-java/lazyloading5/test.java b/regression/cbmc-java/lazyloading5/test.java
new file mode 100644
index 00000000000..351f844655b
--- /dev/null
+++ b/regression/cbmc-java/lazyloading5/test.java
@@ -0,0 +1,21 @@
+
+public class test {
+
+  public static void main() {
+
+    assert(other.getx()==1);
+
+  }
+
+}
+
+class other {
+
+  public static int x;
+  public static int getx() { return x; }
+
+  static {
+    x=1;
+  }
+
+}
diff --git a/regression/cbmc-java/lazyloading6/test.class b/regression/cbmc-java/lazyloading6/test.class
new file mode 100644
index 00000000000..832bfbd07a8
Binary files /dev/null and b/regression/cbmc-java/lazyloading6/test.class differ
diff --git a/regression/cbmc-java/lazyloading6/test.desc b/regression/cbmc-java/lazyloading6/test.desc
new file mode 100644
index 00000000000..dd4bbf33bc9
--- /dev/null
+++ b/regression/cbmc-java/lazyloading6/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.f --lazy-methods-extra-entry-point test.setx
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+CI lazy methods: elaborate java::test\.setx:\(I\)V
+--
+CI lazy methods: elaborate java::test\.sety:\(I\)V
+CI lazy methods: elaborate java::test\.sety:\(F\)V
diff --git a/regression/cbmc-java/lazyloading6/test.java b/regression/cbmc-java/lazyloading6/test.java
new file mode 100644
index 00000000000..7c54eb7f2ec
--- /dev/null
+++ b/regression/cbmc-java/lazyloading6/test.java
@@ -0,0 +1,14 @@
+public class test {
+
+    int x;
+    int y;
+    
+    public test() { x = 1; y = 2; }
+    public void setx(int _x) { x = _x; }
+    public void sety(int _y) { y = _y; }
+    public void sety(float _y) { y = (int)_y; }
+    public void f() { }
+    
+}
+
+
diff --git a/regression/cbmc-java/lazyloading7/test.class b/regression/cbmc-java/lazyloading7/test.class
new file mode 100644
index 00000000000..832bfbd07a8
Binary files /dev/null and b/regression/cbmc-java/lazyloading7/test.class differ
diff --git a/regression/cbmc-java/lazyloading7/test.desc b/regression/cbmc-java/lazyloading7/test.desc
new file mode 100644
index 00000000000..2d26cc1dfdb
--- /dev/null
+++ b/regression/cbmc-java/lazyloading7/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.f --lazy-methods-extra-entry-point "test.sety:(I)V"
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+CI lazy methods: elaborate java::test\.sety:\(I\)V
+--
+CI lazy methods: elaborate java::test\.setx:\(I\)V
+CI lazy methods: elaborate java::test\.sety:\(F\)V
diff --git a/regression/cbmc-java/lazyloading7/test.java b/regression/cbmc-java/lazyloading7/test.java
new file mode 100644
index 00000000000..7c54eb7f2ec
--- /dev/null
+++ b/regression/cbmc-java/lazyloading7/test.java
@@ -0,0 +1,14 @@
+public class test {
+
+    int x;
+    int y;
+    
+    public test() { x = 1; y = 2; }
+    public void setx(int _x) { x = _x; }
+    public void sety(int _y) { y = _y; }
+    public void sety(float _y) { y = (int)_y; }
+    public void f() { }
+    
+}
+
+
diff --git a/regression/cbmc-java/lazyloading8/test.class b/regression/cbmc-java/lazyloading8/test.class
new file mode 100644
index 00000000000..832bfbd07a8
Binary files /dev/null and b/regression/cbmc-java/lazyloading8/test.class differ
diff --git a/regression/cbmc-java/lazyloading8/test.desc b/regression/cbmc-java/lazyloading8/test.desc
new file mode 100644
index 00000000000..afad44d2c8f
--- /dev/null
+++ b/regression/cbmc-java/lazyloading8/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.f --lazy-methods-extra-entry-point "test.sety:(F)V"
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+CI lazy methods: elaborate java::test\.sety:\(F\)V
+--
+CI lazy methods: elaborate java::test\.sety:\(I\)V
+CI lazy methods: elaborate java::test\.setx:\(I\)V
diff --git a/regression/cbmc-java/lazyloading8/test.java b/regression/cbmc-java/lazyloading8/test.java
new file mode 100644
index 00000000000..7c54eb7f2ec
--- /dev/null
+++ b/regression/cbmc-java/lazyloading8/test.java
@@ -0,0 +1,14 @@
+public class test {
+
+    int x;
+    int y;
+    
+    public test() { x = 1; y = 2; }
+    public void setx(int _x) { x = _x; }
+    public void sety(int _y) { y = _y; }
+    public void sety(float _y) { y = (int)_y; }
+    public void f() { }
+    
+}
+
+
diff --git a/regression/cbmc-java/lazyloading9/test.class b/regression/cbmc-java/lazyloading9/test.class
new file mode 100644
index 00000000000..832bfbd07a8
Binary files /dev/null and b/regression/cbmc-java/lazyloading9/test.class differ
diff --git a/regression/cbmc-java/lazyloading9/test.desc b/regression/cbmc-java/lazyloading9/test.desc
new file mode 100644
index 00000000000..aa4ccefe783
--- /dev/null
+++ b/regression/cbmc-java/lazyloading9/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.f --lazy-methods-extra-entry-point "test.*"
+^EXIT=0$
+^SIGNAL=0$
+VERIFICATION SUCCESSFUL
+CI lazy methods: elaborate java::test\.setx:\(I\)V
+CI lazy methods: elaborate java::test\.sety:\(I\)V
+CI lazy methods: elaborate java::test\.sety:\(F\)V
diff --git a/regression/cbmc-java/lazyloading9/test.java b/regression/cbmc-java/lazyloading9/test.java
new file mode 100644
index 00000000000..7c54eb7f2ec
--- /dev/null
+++ b/regression/cbmc-java/lazyloading9/test.java
@@ -0,0 +1,14 @@
+public class test {
+
+    int x;
+    int y;
+    
+    public test() { x = 1; y = 2; }
+    public void setx(int _x) { x = _x; }
+    public void sety(int _y) { y = _y; }
+    public void sety(float _y) { y = (int)_y; }
+    public void f() { }
+    
+}
+
+
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/Base.class b/regression/cbmc-java/lazyloading_cyclic_class/Base.class
new file mode 100644
index 00000000000..2b49611f3f8
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/Base.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/Derived.class b/regression/cbmc-java/lazyloading_cyclic_class/Derived.class
new file mode 100644
index 00000000000..1929d95d852
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/Derived.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/Foo.class b/regression/cbmc-java/lazyloading_cyclic_class/Foo.class
new file mode 100644
index 00000000000..e62a019129f
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/Foo.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/Middle.class b/regression/cbmc-java/lazyloading_cyclic_class/Middle.class
new file mode 100644
index 00000000000..0f7b62ab472
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/Middle.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/cycle1.class b/regression/cbmc-java/lazyloading_cyclic_class/cycle1.class
new file mode 100644
index 00000000000..c5b7361ff44
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/cycle1.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/cycle2.class b/regression/cbmc-java/lazyloading_cyclic_class/cycle2.class
new file mode 100644
index 00000000000..552bd28b0f2
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/cycle2.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/test.class b/regression/cbmc-java/lazyloading_cyclic_class/test.class
new file mode 100644
index 00000000000..c63ee7a51eb
Binary files /dev/null and b/regression/cbmc-java/lazyloading_cyclic_class/test.class differ
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/test.desc b/regression/cbmc-java/lazyloading_cyclic_class/test.desc
new file mode 100644
index 00000000000..c39c5e62349
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_cyclic_class/test.desc
@@ -0,0 +1,7 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.test
+^EXIT=0$
+^SIGNAL=0$
+elaborate java::Base\.f:\(\)V
+--
diff --git a/regression/cbmc-java/lazyloading_cyclic_class/test.java b/regression/cbmc-java/lazyloading_cyclic_class/test.java
new file mode 100644
index 00000000000..a2a9364ae9a
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_cyclic_class/test.java
@@ -0,0 +1,34 @@
+class cycle1
+{
+  Middle c;
+}
+
+class Base
+{
+  void f() { }
+}
+
+class Middle extends Base
+{
+  cycle1 c;
+}
+
+class Derived extends Middle
+{
+  void f() { }
+}
+
+class Foo
+{
+  public cycle1 entry;
+}
+
+public class test {
+
+  public static void test(Foo foo) {
+    if(foo != null && foo.entry != null && foo.entry.c != null) {
+      foo.entry.c.f();
+    }
+
+  }
+}
diff --git a/regression/cbmc-java/lazyloading_inheritance/Base.class b/regression/cbmc-java/lazyloading_inheritance/Base.class
new file mode 100644
index 00000000000..ed06e4a70d8
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance/Base.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance/Derived.class b/regression/cbmc-java/lazyloading_inheritance/Derived.class
new file mode 100644
index 00000000000..e1d760066ee
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance/Derived.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance/Middle.class b/regression/cbmc-java/lazyloading_inheritance/Middle.class
new file mode 100644
index 00000000000..7e66e35d9ab
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance/Middle.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance/test.class b/regression/cbmc-java/lazyloading_inheritance/test.class
new file mode 100644
index 00000000000..d83f91b8e6f
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance/test.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance/test.desc b/regression/cbmc-java/lazyloading_inheritance/test.desc
new file mode 100644
index 00000000000..12ef42a2183
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_inheritance/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.test
+^EXIT=0$
+^SIGNAL=0$
+elaborate java::Base\.f:\(\)V
+--
+elaborate java::Derived\.f:\(\)V
+elaborate java::Middle\.f:\(\)V
diff --git a/regression/cbmc-java/lazyloading_inheritance/test.java b/regression/cbmc-java/lazyloading_inheritance/test.java
new file mode 100644
index 00000000000..136d0d2d2a0
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_inheritance/test.java
@@ -0,0 +1,24 @@
+class Base
+{
+  void f() { }
+}
+
+class Middle extends Base
+{
+}
+
+class Derived extends Middle
+{
+  void f() { super.f(); }
+}
+
+
+public class test {
+
+  public static void test(Middle foo) {
+    if(foo != null ) {
+      foo.f();
+    }
+  }
+
+}
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/Base.class b/regression/cbmc-java/lazyloading_inheritance_field/Base.class
new file mode 100644
index 00000000000..ed06e4a70d8
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance_field/Base.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/Derived.class b/regression/cbmc-java/lazyloading_inheritance_field/Derived.class
new file mode 100644
index 00000000000..d9a3dc3776a
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance_field/Derived.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/Foo.class b/regression/cbmc-java/lazyloading_inheritance_field/Foo.class
new file mode 100644
index 00000000000..92c6645929a
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance_field/Foo.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/Middle.class b/regression/cbmc-java/lazyloading_inheritance_field/Middle.class
new file mode 100644
index 00000000000..7e66e35d9ab
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance_field/Middle.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/test.class b/regression/cbmc-java/lazyloading_inheritance_field/test.class
new file mode 100644
index 00000000000..80bef3aa5b7
Binary files /dev/null and b/regression/cbmc-java/lazyloading_inheritance_field/test.class differ
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/test.desc b/regression/cbmc-java/lazyloading_inheritance_field/test.desc
new file mode 100644
index 00000000000..c39c5e62349
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_inheritance_field/test.desc
@@ -0,0 +1,7 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.test
+^EXIT=0$
+^SIGNAL=0$
+elaborate java::Base\.f:\(\)V
+--
diff --git a/regression/cbmc-java/lazyloading_inheritance_field/test.java b/regression/cbmc-java/lazyloading_inheritance_field/test.java
new file mode 100644
index 00000000000..52f46dcc4bd
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_inheritance_field/test.java
@@ -0,0 +1,27 @@
+class Base
+{
+  void f() { }
+}
+
+class Middle extends Base
+{
+}
+
+class Derived extends Middle
+{
+  void f() { }
+}
+
+class Foo
+{
+  public Middle m;
+}
+
+public class test {
+
+  public static void test(Foo foo) {
+    if(foo != null && foo.m != null) {
+      foo.m.f();
+    }
+  }
+}
diff --git a/regression/cbmc-java/lazyloading_recursive_class/Base.class b/regression/cbmc-java/lazyloading_recursive_class/Base.class
new file mode 100644
index 00000000000..ed06e4a70d8
Binary files /dev/null and b/regression/cbmc-java/lazyloading_recursive_class/Base.class differ
diff --git a/regression/cbmc-java/lazyloading_recursive_class/Derived.class b/regression/cbmc-java/lazyloading_recursive_class/Derived.class
new file mode 100644
index 00000000000..d74705341cd
Binary files /dev/null and b/regression/cbmc-java/lazyloading_recursive_class/Derived.class differ
diff --git a/regression/cbmc-java/lazyloading_recursive_class/Foo.class b/regression/cbmc-java/lazyloading_recursive_class/Foo.class
new file mode 100644
index 00000000000..7107ca0b0c8
Binary files /dev/null and b/regression/cbmc-java/lazyloading_recursive_class/Foo.class differ
diff --git a/regression/cbmc-java/lazyloading_recursive_class/Middle.class b/regression/cbmc-java/lazyloading_recursive_class/Middle.class
new file mode 100644
index 00000000000..06ec16bfe87
Binary files /dev/null and b/regression/cbmc-java/lazyloading_recursive_class/Middle.class differ
diff --git a/regression/cbmc-java/lazyloading_recursive_class/test.class b/regression/cbmc-java/lazyloading_recursive_class/test.class
new file mode 100644
index 00000000000..beeec0a6cb9
Binary files /dev/null and b/regression/cbmc-java/lazyloading_recursive_class/test.class differ
diff --git a/regression/cbmc-java/lazyloading_recursive_class/test.desc b/regression/cbmc-java/lazyloading_recursive_class/test.desc
new file mode 100644
index 00000000000..c39c5e62349
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_recursive_class/test.desc
@@ -0,0 +1,7 @@
+CORE
+test.class
+--lazy-methods --verbosity 10 --function test.test
+^EXIT=0$
+^SIGNAL=0$
+elaborate java::Base\.f:\(\)V
+--
diff --git a/regression/cbmc-java/lazyloading_recursive_class/test.java b/regression/cbmc-java/lazyloading_recursive_class/test.java
new file mode 100644
index 00000000000..dbe237c6788
--- /dev/null
+++ b/regression/cbmc-java/lazyloading_recursive_class/test.java
@@ -0,0 +1,28 @@
+class Base
+{
+  void f() { }
+}
+
+class Middle extends Base
+{
+  Middle internal;
+}
+
+class Derived extends Middle
+{
+  void f() { }
+}
+
+class Foo
+{
+  public Middle m;
+}
+
+public class test {
+
+  public static void test(Foo foo) {
+    if(foo != null && foo.m != null) {
+      foo.m.f();
+    }
+  }
+}
diff --git a/regression/cbmc-java/lvt-groovy/DetectSplitPackagesTask.class b/regression/cbmc-java/lvt-groovy/DetectSplitPackagesTask.class
new file mode 100644
index 00000000000..a5ed80f3654
Binary files /dev/null and b/regression/cbmc-java/lvt-groovy/DetectSplitPackagesTask.class differ
diff --git a/regression/cbmc-java/lvt-groovy/test.desc b/regression/cbmc-java/lvt-groovy/test.desc
new file mode 100644
index 00000000000..050fcd09c7e
--- /dev/null
+++ b/regression/cbmc-java/lvt-groovy/test.desc
@@ -0,0 +1,7 @@
+CORE
+DetectSplitPackagesTask.class
+--show-symbol-table
+^EXIT=0$
+^SIGNAL=0$
+--
+--
diff --git a/regression/cbmc-java/lvt-unexpected/Makefile b/regression/cbmc-java/lvt-unexpected/Makefile
new file mode 100644
index 00000000000..8fb160582c0
--- /dev/null
+++ b/regression/cbmc-java/lvt-unexpected/Makefile
@@ -0,0 +1,7 @@
+
+T=unexpected
+
+all : $T.class
+
+%.class : %.j
+	jasmin $<
diff --git a/regression/cbmc-java/lvt-unexpected/test.desc b/regression/cbmc-java/lvt-unexpected/test.desc
new file mode 100644
index 00000000000..7164d59e21f
--- /dev/null
+++ b/regression/cbmc-java/lvt-unexpected/test.desc
@@ -0,0 +1,12 @@
+CORE
+unexpected.class
+--verbosity 10 --show-symbol-table
+^EXIT=0$
+^SIGNAL=0$
+--
+--
+The LVT in the only method in unexpected.class does not satisfy the constraints
+expected by the bytecode to goto conversion algorithms. Namely, the live range
+of parameter x in that method is not preceeded by a store_i instruction, which
+is perfectly possibly as per the JVM specs but currently additionally required
+in CBMC.
diff --git a/regression/cbmc-java/lvt-unexpected/unexpected.class b/regression/cbmc-java/lvt-unexpected/unexpected.class
new file mode 100644
index 00000000000..b7078721f99
Binary files /dev/null and b/regression/cbmc-java/lvt-unexpected/unexpected.class differ
diff --git a/regression/cbmc-java/lvt-unexpected/unexpected.j b/regression/cbmc-java/lvt-unexpected/unexpected.j
new file mode 100644
index 00000000000..91258c12ae5
--- /dev/null
+++ b/regression/cbmc-java/lvt-unexpected/unexpected.j
@@ -0,0 +1,34 @@
+.class public unexpected
+.super java/lang/Object
+
+.method public static test1(I)I
+  .limit stack 10
+  .limit locals 20
+
+  ; unexpected in previous code, as arg is the argument of the method and its
+  ; start_pc is != 0
+  .var 0 is arg I from Label1 to Label2
+  .var 1 is x   I from Label1 to Label2
+
+  ; say hello
+  getstatic      java/lang/System/out Ljava/io/PrintStream;
+  ldc            "Starting test1!"
+  invokevirtual  java/io/PrintStream/println(Ljava/lang/String;)V
+
+Label1:
+  ; x = arg + 3
+  iload_0
+  iconst_3
+  iadd
+  istore_1
+
+  ; say bye
+  getstatic      java/lang/System/out Ljava/io/PrintStream;
+  ldc            "Returning from test1!"
+  invokevirtual  java/io/PrintStream/println(Ljava/lang/String;)V
+
+  ; return x
+  iload_1
+  ireturn
+Label2:
+.end method
diff --git a/regression/cbmc-java/method_parmeters1/method_parameters.class b/regression/cbmc-java/method_parmeters1/method_parameters.class
new file mode 100644
index 00000000000..866f9b1c2da
Binary files /dev/null and b/regression/cbmc-java/method_parmeters1/method_parameters.class differ
diff --git a/regression/cbmc-java/method_parmeters1/method_parameters.java b/regression/cbmc-java/method_parmeters1/method_parameters.java
new file mode 100644
index 00000000000..10dfba1bbea
--- /dev/null
+++ b/regression/cbmc-java/method_parmeters1/method_parameters.java
@@ -0,0 +1,129 @@
+class method_parameters
+{
+  void test1()
+  {}
+
+  void test2(boolean b)
+  {}
+
+  void test3(byte b)
+  {}
+
+  void test3a(char c)
+  {}
+
+  void test4(int i)
+  {}
+
+  void test5(float f)
+  {}
+
+  void test6(String s)
+  {}
+
+  void test7(long l)
+  {}
+
+  void test8(double l)
+  {}
+
+  void test9(int i, long l)
+  {
+    int local = 123;
+  }
+
+  void test10(double i, String s)
+  {
+    int local = 123;
+  }
+
+  void test11(int a[][])
+  {}
+
+  double test12(double a[][], double d)
+  {
+    if (a.length < 1) return 0;
+    if (a[0].length < 1) return 0;
+    return d + a[0][0];
+  }
+
+  void test12a(double a[][][], int i, double d)
+  {}
+
+  double test12b(double a[][], double d)
+  {
+    return 123.123;
+  }
+
+  void test12c(double a[][][], double d)
+  {
+  }
+
+  void test13(double d, int i, byte b, char c)
+  {}
+
+  // Same as above but now static
+
+  static void ttest1()
+  {}
+
+  static void ttest2(boolean b)
+  {}
+
+  static void ttest3(byte b)
+  {}
+
+  static void ttest3a(char c)
+  {}
+
+  static void ttest4(int i)
+  {}
+
+  static void ttest5(float f)
+  {}
+
+  static void ttest6(String s)
+  {}
+
+  static void ttest7(long l)
+  {}
+
+  static void ttest8(double l)
+  {}
+
+  static void ttest9(int i, long l)
+  {
+    int local = 123;
+  }
+
+  static void ttest10(double i, String s)
+  {
+    int local = 123;
+  }
+
+  static void ttest11(int a[][])
+  {}
+
+  static double ttest12(double a[][], double d)
+  {
+    if (a.length < 1) return 0;
+    if (a[0].length < 1) return 0;
+    return d + a[0][0];
+  }
+
+  static void ttest12a(double a[][][], int i, double d)
+  {}
+
+  static double ttest12b(double a[][], double d)
+  {
+    return 123.123;
+  }
+
+  static void ttest12c(double a[][][], double d)
+  {
+  }
+
+  static void ttest13(double d, int i, byte b, char c)
+  {}
+
+}
diff --git a/regression/cbmc-java/method_parmeters1/test.desc b/regression/cbmc-java/method_parmeters1/test.desc
new file mode 100644
index 00000000000..909aa8ab6b4
--- /dev/null
+++ b/regression/cbmc-java/method_parmeters1/test.desc
@@ -0,0 +1,9 @@
+CORE
+method_parameters.class
+--verbosity 10 --show-symbol-table
+^EXIT=0$
+^SIGNAL=0$
+--
+--
+The purpose of the test is ensuring that the bytecode -> symbol table AST
+generation happens correctly. The generated .class file does not contain LVTs.
diff --git a/regression/cbmc-java/method_parmeters2/method_parameters.class b/regression/cbmc-java/method_parmeters2/method_parameters.class
new file mode 100644
index 00000000000..5f065c68585
Binary files /dev/null and b/regression/cbmc-java/method_parmeters2/method_parameters.class differ
diff --git a/regression/cbmc-java/method_parmeters2/method_parameters.java b/regression/cbmc-java/method_parmeters2/method_parameters.java
new file mode 100644
index 00000000000..10dfba1bbea
--- /dev/null
+++ b/regression/cbmc-java/method_parmeters2/method_parameters.java
@@ -0,0 +1,129 @@
+class method_parameters
+{
+  void test1()
+  {}
+
+  void test2(boolean b)
+  {}
+
+  void test3(byte b)
+  {}
+
+  void test3a(char c)
+  {}
+
+  void test4(int i)
+  {}
+
+  void test5(float f)
+  {}
+
+  void test6(String s)
+  {}
+
+  void test7(long l)
+  {}
+
+  void test8(double l)
+  {}
+
+  void test9(int i, long l)
+  {
+    int local = 123;
+  }
+
+  void test10(double i, String s)
+  {
+    int local = 123;
+  }
+
+  void test11(int a[][])
+  {}
+
+  double test12(double a[][], double d)
+  {
+    if (a.length < 1) return 0;
+    if (a[0].length < 1) return 0;
+    return d + a[0][0];
+  }
+
+  void test12a(double a[][][], int i, double d)
+  {}
+
+  double test12b(double a[][], double d)
+  {
+    return 123.123;
+  }
+
+  void test12c(double a[][][], double d)
+  {
+  }
+
+  void test13(double d, int i, byte b, char c)
+  {}
+
+  // Same as above but now static
+
+  static void ttest1()
+  {}
+
+  static void ttest2(boolean b)
+  {}
+
+  static void ttest3(byte b)
+  {}
+
+  static void ttest3a(char c)
+  {}
+
+  static void ttest4(int i)
+  {}
+
+  static void ttest5(float f)
+  {}
+
+  static void ttest6(String s)
+  {}
+
+  static void ttest7(long l)
+  {}
+
+  static void ttest8(double l)
+  {}
+
+  static void ttest9(int i, long l)
+  {
+    int local = 123;
+  }
+
+  static void ttest10(double i, String s)
+  {
+    int local = 123;
+  }
+
+  static void ttest11(int a[][])
+  {}
+
+  static double ttest12(double a[][], double d)
+  {
+    if (a.length < 1) return 0;
+    if (a[0].length < 1) return 0;
+    return d + a[0][0];
+  }
+
+  static void ttest12a(double a[][][], int i, double d)
+  {}
+
+  static double ttest12b(double a[][], double d)
+  {
+    return 123.123;
+  }
+
+  static void ttest12c(double a[][][], double d)
+  {
+  }
+
+  static void ttest13(double d, int i, byte b, char c)
+  {}
+
+}
diff --git a/regression/cbmc-java/method_parmeters2/test.desc b/regression/cbmc-java/method_parmeters2/test.desc
new file mode 100644
index 00000000000..507e8d4ef11
--- /dev/null
+++ b/regression/cbmc-java/method_parmeters2/test.desc
@@ -0,0 +1,10 @@
+CORE
+method_parameters.class
+--verbosity 10 --show-symbol-table
+^EXIT=0$
+^SIGNAL=0$
+--
+--
+The purpose of the test is ensuring that the bytecode -> symbol table AST
+generation happens correctly. The generated .class file DOES contain LVTs, i.e.,
+it has been compiled with with "javac -g".
diff --git a/regression/cbmc-java/putstatic_source_location/test.class b/regression/cbmc-java/putstatic_source_location/test.class
new file mode 100644
index 00000000000..5507bc508cd
Binary files /dev/null and b/regression/cbmc-java/putstatic_source_location/test.class differ
diff --git a/regression/cbmc-java/putstatic_source_location/test.desc b/regression/cbmc-java/putstatic_source_location/test.desc
new file mode 100644
index 00000000000..fdb85eb8ee7
--- /dev/null
+++ b/regression/cbmc-java/putstatic_source_location/test.desc
@@ -0,0 +1,6 @@
+CORE
+test.class
+--show-goto-functions
+^EXIT=0$
+^SIGNAL=0$
+test\.java line 5 function java::test.main:\(\)V bytecode-index 1
diff --git a/regression/cbmc-java/putstatic_source_location/test.java b/regression/cbmc-java/putstatic_source_location/test.java
new file mode 100644
index 00000000000..9f1b4f1ba06
--- /dev/null
+++ b/regression/cbmc-java/putstatic_source_location/test.java
@@ -0,0 +1,11 @@
+public class test {
+
+  public static int x;
+  public static void main() {
+    x = 1;
+  }
+  static {
+    x = 0;
+  }
+
+}
diff --git a/regression/cbmc-java/siblingobjects1/Other.class b/regression/cbmc-java/siblingobjects1/Other.class
new file mode 100644
index 00000000000..32b9ecbde03
Binary files /dev/null and b/regression/cbmc-java/siblingobjects1/Other.class differ
diff --git a/regression/cbmc-java/siblingobjects1/test.class b/regression/cbmc-java/siblingobjects1/test.class
new file mode 100644
index 00000000000..587eaab4feb
Binary files /dev/null and b/regression/cbmc-java/siblingobjects1/test.class differ
diff --git a/regression/cbmc-java/siblingobjects1/test.desc b/regression/cbmc-java/siblingobjects1/test.desc
new file mode 100644
index 00000000000..fd32dd3f006
--- /dev/null
+++ b/regression/cbmc-java/siblingobjects1/test.desc
@@ -0,0 +1,8 @@
+CORE
+test.class
+--function test.main
+^EXIT=10$
+^SIGNAL=0$
+VERIFICATION FAILED
+assertion at file test\.java line 10 .* FAILURE
+--
diff --git a/regression/cbmc-java/siblingobjects1/test.java b/regression/cbmc-java/siblingobjects1/test.java
new file mode 100644
index 00000000000..385f501d8f7
--- /dev/null
+++ b/regression/cbmc-java/siblingobjects1/test.java
@@ -0,0 +1,17 @@
+
+public class test {
+
+  public Other o1;
+  public Other o2;
+
+  public void main() {
+    if(o1 == null || o2 == null)
+      return;
+    assert(false);
+  }
+
+}
+
+class Other {
+  int x;
+}
diff --git a/regression/cbmc-java/siblingobjects2/Other.class b/regression/cbmc-java/siblingobjects2/Other.class
new file mode 100644
index 00000000000..e3b5e79fb89
Binary files /dev/null and b/regression/cbmc-java/siblingobjects2/Other.class differ
diff --git a/regression/cbmc-java/siblingobjects2/test.class b/regression/cbmc-java/siblingobjects2/test.class
new file mode 100644
index 00000000000..3f769495c3a
Binary files /dev/null and b/regression/cbmc-java/siblingobjects2/test.class differ
diff --git a/regression/cbmc-java/siblingobjects2/test.desc b/regression/cbmc-java/siblingobjects2/test.desc
new file mode 100644
index 00000000000..a6eefe5c7e5
--- /dev/null
+++ b/regression/cbmc-java/siblingobjects2/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--function test.main
+^EXIT=10$
+^SIGNAL=0$
+VERIFICATION FAILED
+assertion at file test.java line 23 function java::test\.toplevel_pointers_not_null.*: FAILURE
+assertion at file test.java line 18 function java::test\.next_pointers_not_null.*: FAILURE
+--
diff --git a/regression/cbmc-java/siblingobjects2/test.java b/regression/cbmc-java/siblingobjects2/test.java
new file mode 100644
index 00000000000..b48802655b5
--- /dev/null
+++ b/regression/cbmc-java/siblingobjects2/test.java
@@ -0,0 +1,31 @@
+
+public class test {
+
+  public Other o1;
+  public Other o2;
+
+  public void main() {
+    if(o1 != null && o2 != null) {
+      if(o1.next != null && o2.next != null) {
+        next_pointers_not_null();
+      }
+      toplevel_pointers_not_null();
+    }
+  }
+
+  public void next_pointers_not_null() {
+    // Should be possible to hit with --java-max-input-tree-depth >= 2
+    assert(false);
+  }
+
+  public void toplevel_pointers_not_null() {
+    // Should be possible to hit
+    assert(false);
+  }
+
+}
+
+class Other {
+  int x;
+  Other next;
+}
diff --git a/regression/cbmc-java/stack_var4/test.desc b/regression/cbmc-java/stack_var4/test.desc
index 805e44acccd..0f67b9755d8 100644
--- a/regression/cbmc-java/stack_var4/test.desc
+++ b/regression/cbmc-java/stack_var4/test.desc
@@ -3,8 +3,6 @@ stack_test.class
 
 ^EXIT=0$
 ^SIGNAL=0$
-^.*assertion at file stack_test.java line 5 function.*: SUCCESS
-$
 ^VERIFICATION SUCCESSFUL$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/stack_var5/test.desc b/regression/cbmc-java/stack_var5/test.desc
index 805e44acccd..0f67b9755d8 100644
--- a/regression/cbmc-java/stack_var5/test.desc
+++ b/regression/cbmc-java/stack_var5/test.desc
@@ -3,8 +3,6 @@ stack_test.class
 
 ^EXIT=0$
 ^SIGNAL=0$
-^.*assertion at file stack_test.java line 5 function.*: SUCCESS
-$
 ^VERIFICATION SUCCESSFUL$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/stack_var6/test.desc b/regression/cbmc-java/stack_var6/test.desc
index 805e44acccd..0f67b9755d8 100644
--- a/regression/cbmc-java/stack_var6/test.desc
+++ b/regression/cbmc-java/stack_var6/test.desc
@@ -3,8 +3,6 @@ stack_test.class
 
 ^EXIT=0$
 ^SIGNAL=0$
-^.*assertion at file stack_test.java line 5 function.*: SUCCESS
-$
 ^VERIFICATION SUCCESSFUL$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/stack_var7/test.desc b/regression/cbmc-java/stack_var7/test.desc
index 805e44acccd..0f67b9755d8 100644
--- a/regression/cbmc-java/stack_var7/test.desc
+++ b/regression/cbmc-java/stack_var7/test.desc
@@ -3,8 +3,6 @@ stack_test.class
 
 ^EXIT=0$
 ^SIGNAL=0$
-^.*assertion at file stack_test.java line 5 function.*: SUCCESS
-$
 ^VERIFICATION SUCCESSFUL$
 --
 ^warning: ignoring
diff --git a/regression/cbmc-java/static_init1/A.class b/regression/cbmc-java/static_init1/A.class
new file mode 100644
index 00000000000..cc4eabe9772
Binary files /dev/null and b/regression/cbmc-java/static_init1/A.class differ
diff --git a/regression/cbmc-java/static_init1/B.class b/regression/cbmc-java/static_init1/B.class
new file mode 100644
index 00000000000..448af921050
Binary files /dev/null and b/regression/cbmc-java/static_init1/B.class differ
diff --git a/regression/cbmc-java/static_init1/static_init.class b/regression/cbmc-java/static_init1/static_init.class
new file mode 100644
index 00000000000..92cc80f9170
Binary files /dev/null and b/regression/cbmc-java/static_init1/static_init.class differ
diff --git a/regression/cbmc-java/static_init1/static_init.java b/regression/cbmc-java/static_init1/static_init.java
new file mode 100644
index 00000000000..778b6926fcc
--- /dev/null
+++ b/regression/cbmc-java/static_init1/static_init.java
@@ -0,0 +1,32 @@
+public class static_init {
+
+  // A should be initialised first, then B will begin init
+  // after A.x is set.
+  public static void main() {
+    assert(A.x == 1 && B.x == 1 && B.y == 2 && A.y == 2);
+  }
+
+}
+
+class A {
+
+  public static int x;
+  public static int y;
+  static {
+    x = 1;
+    y = B.y;
+  }
+
+}
+
+class B {
+
+  public static int x;
+  public static int y;
+  static {
+    x = A.x;
+    y = 2;
+
+  }
+
+}
diff --git a/regression/cbmc-java/static_init1/test.desc b/regression/cbmc-java/static_init1/test.desc
new file mode 100644
index 00000000000..30868289dae
--- /dev/null
+++ b/regression/cbmc-java/static_init1/test.desc
@@ -0,0 +1,8 @@
+CORE
+static_init.class
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/static_init2/A.class b/regression/cbmc-java/static_init2/A.class
new file mode 100644
index 00000000000..cc4eabe9772
Binary files /dev/null and b/regression/cbmc-java/static_init2/A.class differ
diff --git a/regression/cbmc-java/static_init2/B.class b/regression/cbmc-java/static_init2/B.class
new file mode 100644
index 00000000000..448af921050
Binary files /dev/null and b/regression/cbmc-java/static_init2/B.class differ
diff --git a/regression/cbmc-java/static_init2/static_init.class b/regression/cbmc-java/static_init2/static_init.class
new file mode 100644
index 00000000000..6a0da38e029
Binary files /dev/null and b/regression/cbmc-java/static_init2/static_init.class differ
diff --git a/regression/cbmc-java/static_init2/static_init.java b/regression/cbmc-java/static_init2/static_init.java
new file mode 100644
index 00000000000..b0ec59c314e
--- /dev/null
+++ b/regression/cbmc-java/static_init2/static_init.java
@@ -0,0 +1,32 @@
+public class static_init {
+
+  // B will begin init first, but then begin A init before it
+  // has set B.y, leading to the unintuitive result given here.
+  public static void main() {
+    assert(B.x == 1 && B.y == 2 && A.x == 1 && A.y == 0);
+  }
+
+}
+
+class A {
+
+  public static int x;
+  public static int y;
+  static {
+    x = 1;
+    y = B.y;
+  }
+
+}
+
+class B {
+
+  public static int x;
+  public static int y;
+  static {
+    x = A.x;
+    y = 2;
+
+  }
+
+}
diff --git a/regression/cbmc-java/static_init2/test.desc b/regression/cbmc-java/static_init2/test.desc
new file mode 100644
index 00000000000..30868289dae
--- /dev/null
+++ b/regression/cbmc-java/static_init2/test.desc
@@ -0,0 +1,8 @@
+CORE
+static_init.class
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/swap1/Swap.class b/regression/cbmc-java/swap1/Swap.class
new file mode 100644
index 00000000000..9b070cbb7ad
Binary files /dev/null and b/regression/cbmc-java/swap1/Swap.class differ
diff --git a/regression/cbmc-java/swap1/Swap.java b/regression/cbmc-java/swap1/Swap.java
new file mode 100644
index 00000000000..3b6c100e15e
--- /dev/null
+++ b/regression/cbmc-java/swap1/Swap.java
@@ -0,0 +1,7 @@
+public class Swap {
+  public static void main(String[] args) {
+    int x = 5;
+    int result = x - 2;
+    assert result == -3;
+  }
+}
diff --git a/regression/cbmc-java/swap1/SwapDump.java b/regression/cbmc-java/swap1/SwapDump.java
new file mode 100644
index 00000000000..52503eaec99
--- /dev/null
+++ b/regression/cbmc-java/swap1/SwapDump.java
@@ -0,0 +1,108 @@
+import java.nio.file.Files;
+import java.nio.file.Paths;
+
+import org.objectweb.asm.*;
+public class SwapDump implements Opcodes {
+
+public static byte[] dump () throws Exception {
+
+ClassWriter cw = new ClassWriter(0);
+FieldVisitor fv;
+MethodVisitor mv;
+
+cw.visit(52, ACC_PUBLIC + ACC_SUPER, "Swap", null, "java/lang/Object", null);
+
+cw.visitSource("Swap.java", null);
+
+{
+fv = cw.visitField(ACC_FINAL + ACC_STATIC + ACC_SYNTHETIC, "$assertionsDisabled", "Z", null, null);
+fv.visitEnd();
+}
+{
+mv = cw.visitMethod(ACC_STATIC, "<clinit>", "()V", null, null);
+mv.visitCode();
+Label l0 = new Label();
+mv.visitLabel(l0);
+mv.visitLineNumber(1, l0);
+mv.visitLdcInsn(Type.getType("LSwap;"));
+mv.visitMethodInsn(INVOKEVIRTUAL, "java/lang/Class", "desiredAssertionStatus", "()Z", false);
+Label l1 = new Label();
+mv.visitJumpInsn(IFNE, l1);
+mv.visitInsn(ICONST_1);
+Label l2 = new Label();
+mv.visitJumpInsn(GOTO, l2);
+mv.visitLabel(l1);
+mv.visitFrame(Opcodes.F_SAME, 0, null, 0, null);
+mv.visitInsn(ICONST_0);
+mv.visitLabel(l2);
+mv.visitFrame(Opcodes.F_SAME1, 0, null, 1, new Object[] {Opcodes.INTEGER});
+mv.visitFieldInsn(PUTSTATIC, "Swap", "$assertionsDisabled", "Z");
+mv.visitInsn(RETURN);
+mv.visitMaxs(1, 0);
+mv.visitEnd();
+}
+{
+mv = cw.visitMethod(ACC_PUBLIC, "<init>", "()V", null, null);
+mv.visitCode();
+Label l0 = new Label();
+mv.visitLabel(l0);
+mv.visitLineNumber(1, l0);
+mv.visitVarInsn(ALOAD, 0);
+mv.visitMethodInsn(INVOKESPECIAL, "java/lang/Object", "<init>", "()V", false);
+mv.visitInsn(RETURN);
+Label l1 = new Label();
+mv.visitLabel(l1);
+mv.visitLocalVariable("this", "LSwap;", null, l0, l1, 0);
+mv.visitMaxs(1, 1);
+mv.visitEnd();
+}
+{
+mv = cw.visitMethod(ACC_PUBLIC + ACC_STATIC, "main", "([Ljava/lang/String;)V", null, null);
+mv.visitCode();
+Label l0 = new Label();
+mv.visitLabel(l0);
+mv.visitLineNumber(3, l0);
+mv.visitInsn(ICONST_5);
+mv.visitVarInsn(ISTORE, 1);
+Label l1 = new Label();
+mv.visitLabel(l1);
+mv.visitLineNumber(4, l1);
+mv.visitVarInsn(ILOAD, 1);
+mv.visitInsn(ICONST_2);
+mv.visitInsn(SWAP); // Manually added
+mv.visitInsn(ISUB);
+mv.visitVarInsn(ISTORE, 2);
+Label l2 = new Label();
+mv.visitLabel(l2);
+mv.visitLineNumber(5, l2);
+mv.visitFieldInsn(GETSTATIC, "Swap", "$assertionsDisabled", "Z");
+Label l3 = new Label();
+mv.visitJumpInsn(IFNE, l3);
+mv.visitVarInsn(ILOAD, 2);
+mv.visitIntInsn(BIPUSH, -3);
+mv.visitJumpInsn(IF_ICMPEQ, l3);
+mv.visitTypeInsn(NEW, "java/lang/AssertionError");
+mv.visitInsn(DUP);
+mv.visitMethodInsn(INVOKESPECIAL, "java/lang/AssertionError", "<init>", "()V", false);
+mv.visitInsn(ATHROW);
+mv.visitLabel(l3);
+mv.visitLineNumber(6, l3);
+mv.visitFrame(Opcodes.F_APPEND,2, new Object[] {Opcodes.INTEGER, Opcodes.INTEGER}, 0, null);
+mv.visitInsn(RETURN);
+Label l4 = new Label();
+mv.visitLabel(l4);
+mv.visitLocalVariable("args", "[Ljava/lang/String;", null, l0, l4, 0);
+mv.visitLocalVariable("x", "I", null, l1, l4, 1);
+mv.visitLocalVariable("result", "I", null, l2, l4, 2);
+mv.visitMaxs(2, 3);
+mv.visitEnd();
+}
+cw.visitEnd();
+
+return cw.toByteArray();
+}
+
+public static void main(String[] args) throws Exception {
+  Files.write(Paths.get("Swap.class"), dump());
+}
+}
diff --git a/regression/cbmc-java/swap1/test.desc b/regression/cbmc-java/swap1/test.desc
new file mode 100644
index 00000000000..8f803004f29
--- /dev/null
+++ b/regression/cbmc-java/swap1/test.desc
@@ -0,0 +1,8 @@
+CORE
+Swap.class
+
+^EXIT=0
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/swap2/org/springframework/build/gradle/MergePlugin$1$_execute_closure1$_closure2.class b/regression/cbmc-java/swap2/org/springframework/build/gradle/MergePlugin$1$_execute_closure1$_closure2.class
new file mode 100644
index 00000000000..a31f9a0bba4
Binary files /dev/null and b/regression/cbmc-java/swap2/org/springframework/build/gradle/MergePlugin$1$_execute_closure1$_closure2.class differ
diff --git a/regression/cbmc-java/swap2/org/springframework/build/gradle/MergePlugin.groovy b/regression/cbmc-java/swap2/org/springframework/build/gradle/MergePlugin.groovy
new file mode 100644
index 00000000000..6af1cf3b80c
--- /dev/null
+++ b/regression/cbmc-java/swap2/org/springframework/build/gradle/MergePlugin.groovy
@@ -0,0 +1,177 @@
+/*
+ * Copyright 2002-2015 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.build.gradle
+
+import org.gradle.api.*
+import org.gradle.api.artifacts.Configuration
+import org.gradle.api.artifacts.ProjectDependency;
+import org.gradle.api.artifacts.maven.Conf2ScopeMapping
+import org.gradle.api.plugins.MavenPlugin
+import org.gradle.plugins.ide.eclipse.EclipsePlugin
+import org.gradle.plugins.ide.idea.IdeaPlugin
+import org.gradle.api.invocation.*
+
+/**
+ * Gradle plugin that allows projects to merged together. Primarily developed to
+ * allow Spring to support multiple incompatible versions of third-party
+ * dependencies (for example Hibernate v3 and v4).
+ * <p>
+ * The 'merge' extension should be used to define how projects are merged, for example:
+ * <pre class="code">
+ * configure(subprojects) {
+ *     apply plugin: MergePlugin
+ * }
+ *
+ * project("myproject") {
+ * }
+ *
+ * project("myproject-extra") {
+ *     merge.into = project("myproject")
+ * }
+ * </pre>
+ * <p>
+ * This plugin adds two new configurations:
+ * <ul>
+ * <li>merging - Contains the projects being merged into this project<li>
+ * <li>runtimeMerge - Contains all dependencies that are merge projects. These are used
+ * to allow an IDE to reference merge projects.</li>
+ * <ul>
+ *
+ * @author Rob Winch
+ * @author Phillip Webb
+ */
+class MergePlugin implements Plugin<Project> {
+
+	private static boolean attachedProjectsEvaluated;
+
+	public void apply(Project project) {
+		project.plugins.apply(MavenPlugin)
+		project.plugins.apply(EclipsePlugin)
+		project.plugins.apply(IdeaPlugin)
+
+		MergeModel model = project.extensions.create("merge", MergeModel)
+		model.project = project
+		project.configurations.create("merging")
+		Configuration runtimeMerge = project.configurations.create("runtimeMerge")
+
+		// Ensure the IDE can reference merged projects
+		project.eclipse.classpath.plusConfigurations += [ runtimeMerge ]
+		project.idea.module.scopes.PROVIDED.plus += [ runtimeMerge ]
+
+		// Hook to perform the actual merge logic
+		project.afterEvaluate{
+			if (it.merge.into != null) {
+				setup(it)
+			}
+			setupIdeDependencies(it)
+		}
+
+		// Hook to build runtimeMerge dependencies
+		if (!attachedProjectsEvaluated) {
+			project.gradle.projectsEvaluated{
+				postProcessProjects(it)
+			}
+			attachedProjectsEvaluated  = true;
+		}
+	}
+
+	private void setup(Project project) {
+		project.merge.into.dependencies.add("merging", project)
+		project.dependencies.add("provided", project.merge.into.sourceSets.main.output)
+		project.dependencies.add("runtimeMerge", project.merge.into)
+		setupTaskDependencies(project)
+		setupMaven(project)
+	}
+
+	private void setupTaskDependencies(Project project) {
+		// invoking a task will invoke the task with the same name on 'into' project
+		["sourcesJar", "jar", "javadocJar", "javadoc", "install", "artifactoryPublish"].each {
+			def task = project.tasks.findByPath(it)
+			if (task) {
+				task.enabled = false
+				task.dependsOn(project.merge.into.tasks.findByPath(it))
+			}
+		}
+
+		// update 'into' project artifacts to contain the source artifact contents
+		project.merge.into.sourcesJar.from(project.sourcesJar.source)
+		project.merge.into.jar.from(project.sourceSets.main.output)
+		project.merge.into.javadoc {
+			source += project.javadoc.source
+			classpath += project.javadoc.classpath
+		}
+	}
+
+	private void setupIdeDependencies(Project project) {
+		project.configurations.each { c ->
+			c.dependencies.findAll( { it instanceof org.gradle.api.artifacts.ProjectDependency } ).each { d ->
+				d.dependencyProject.merge.from.each { from ->
+					project.dependencies.add("runtimeMerge", from)
+				}
+			}
+		}
+	}
+
+	private void setupMaven(Project project) {
+		project.configurations.each { configuration ->
+			Conf2ScopeMapping mapping = project.conf2ScopeMappings.getMapping([configuration])
+			if (mapping.scope) {
+				Configuration intoConfiguration = project.merge.into.configurations.create(
+					project.name + "-" + configuration.name)
+				configuration.excludeRules.each {
+					configuration.exclude([
+						(ExcludeRule.GROUP_KEY) : it.group,
+						(ExcludeRule.MODULE_KEY) : it.module])
+				}
+				configuration.dependencies.each {
+					def intoCompile = project.merge.into.configurations.getByName("compile")
+					// Protect against changing a compile scope dependency (SPR-10218)
+					if (!intoCompile.dependencies.contains(it)) {
+						intoConfiguration.dependencies.add(it)
+					}
+				}
+				def index = project.parent.childProjects.findIndexOf {p -> p.getValue() == project}
+				project.merge.into.install.repositories.mavenInstaller.pom.scopeMappings.addMapping(
+					mapping.priority + 100 + index, intoConfiguration, mapping.scope)
+			}
+		}
+	}
+
+	private postProcessProjects(Gradle gradle) {
+		gradle.allprojects(new Action<Project>() {
+			public void execute(Project project) {
+				project.configurations.getByName("runtime").allDependencies.withType(ProjectDependency).each{
+					Configuration dependsOnMergedFrom = it.dependencyProject.configurations.getByName("merging");
+					dependsOnMergedFrom.dependencies.each{ dep ->
+						project.dependencies.add("runtimeMerge", dep.dependencyProject)
+					}
+				}
+			}
+		});
+	}
+}
+
+class MergeModel {
+	Project project;
+	Project into;
+	List<Project> from = [];
+	
+	public void setInto(Project into) {
+		this.into = into;
+		into.merge.from.add(project);
+	}
+}
\ No newline at end of file
diff --git a/regression/cbmc-java/swap2/test.desc b/regression/cbmc-java/swap2/test.desc
new file mode 100644
index 00000000000..a7953d29a8b
--- /dev/null
+++ b/regression/cbmc-java/swap2/test.desc
@@ -0,0 +1,8 @@
+CORE
+org/springframework/build/gradle/MergePlugin$1$_execute_closure1$_closure2.class
+--function "org.springframework.build.gradle.MergePlugin\$1\$_execute_closure1\$_closure2.\$getCallSiteArray:()[Lorg/codehaus/groovy/runtime/callsite/CallSite;"
+^EXIT=0
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
diff --git a/regression/cbmc-java/synchronized/Sync.class b/regression/cbmc-java/synchronized/Sync.class
new file mode 100644
index 00000000000..0c493d5eea9
Binary files /dev/null and b/regression/cbmc-java/synchronized/Sync.class differ
diff --git a/regression/cbmc-java/synchronized/Sync.java b/regression/cbmc-java/synchronized/Sync.java
new file mode 100644
index 00000000000..2f8f91cc2ae
--- /dev/null
+++ b/regression/cbmc-java/synchronized/Sync.java
@@ -0,0 +1,11 @@
+public class Sync {
+  public static void main(String[] args) {
+    final Object o = null;
+    try {
+      synchronized (o) {}
+      assert false;
+    } catch (NullPointerException e) {
+      return;
+    }
+  }
+}
diff --git a/regression/cbmc-java/synchronized/test.desc b/regression/cbmc-java/synchronized/test.desc
new file mode 100644
index 00000000000..7155ff81375
--- /dev/null
+++ b/regression/cbmc-java/synchronized/test.desc
@@ -0,0 +1,10 @@
+KNOWNBUG
+Sync.class
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
+--
+See #1236 for details of this test.
diff --git a/regression/cbmc-java/virtual7/test.desc b/regression/cbmc-java/virtual7/test.desc
index 2e196d82e8c..b35404ac657 100644
--- a/regression/cbmc-java/virtual7/test.desc
+++ b/regression/cbmc-java/virtual7/test.desc
@@ -3,9 +3,9 @@ test.class
 --show-goto-functions
 ^EXIT=0$
 ^SIGNAL=0$
-IF "java::E".*THEN GOTO [67]
-IF "java::B".*THEN GOTO [67]
-IF "java::D".*THEN GOTO [67]
-IF "java::C".*THEN GOTO [67]
+IF "java::E".*THEN GOTO [12]
+IF "java::B".*THEN GOTO [12]
+IF "java::D".*THEN GOTO [12]
+IF "java::C".*THEN GOTO [12]
 --
 IF "java::A".*THEN GOTO
diff --git a/regression/cbmc-java/virtual_function_unwinding/Inner.class b/regression/cbmc-java/virtual_function_unwinding/Inner.class
new file mode 100644
index 00000000000..32974676994
Binary files /dev/null and b/regression/cbmc-java/virtual_function_unwinding/Inner.class differ
diff --git a/regression/cbmc-java/virtual_function_unwinding/Interface.class b/regression/cbmc-java/virtual_function_unwinding/Interface.class
new file mode 100644
index 00000000000..d05ac9d4a17
Binary files /dev/null and b/regression/cbmc-java/virtual_function_unwinding/Interface.class differ
diff --git a/regression/cbmc-java/virtual_function_unwinding/Outer.class b/regression/cbmc-java/virtual_function_unwinding/Outer.class
new file mode 100644
index 00000000000..a2e452ab1bf
Binary files /dev/null and b/regression/cbmc-java/virtual_function_unwinding/Outer.class differ
diff --git a/regression/cbmc-java/virtual_function_unwinding/Virtual.class b/regression/cbmc-java/virtual_function_unwinding/Virtual.class
new file mode 100644
index 00000000000..3c960cfabd4
Binary files /dev/null and b/regression/cbmc-java/virtual_function_unwinding/Virtual.class differ
diff --git a/regression/cbmc-java/virtual_function_unwinding/Virtual.java b/regression/cbmc-java/virtual_function_unwinding/Virtual.java
new file mode 100644
index 00000000000..2fd37dac136
--- /dev/null
+++ b/regression/cbmc-java/virtual_function_unwinding/Virtual.java
@@ -0,0 +1,19 @@
+interface Interface {
+  boolean b();
+}
+
+class Inner implements Interface {
+  public boolean b() { return false; }
+}
+
+class Outer implements Interface {
+  private Interface inner;
+  public Outer(Interface inner) { this.inner = inner; }
+  public boolean b() { return !inner.b(); }
+}
+
+public class Virtual {
+  public static void main(String[] args) {
+    assert new Outer(new Inner()).b();
+  }
+}
diff --git a/regression/cbmc-java/virtual_function_unwinding/test.desc b/regression/cbmc-java/virtual_function_unwinding/test.desc
new file mode 100644
index 00000000000..b72e982ae9c
--- /dev/null
+++ b/regression/cbmc-java/virtual_function_unwinding/test.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+Virtual.class
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+--
+See diffblue/test-gen#845 for details
diff --git a/regression/cbmc/address_space_size_limit1/test.desc b/regression/cbmc/address_space_size_limit1/test.desc
index 9dcfb8970aa..d0d0ed3c04e 100644
--- a/regression/cbmc/address_space_size_limit1/test.desc
+++ b/regression/cbmc/address_space_size_limit1/test.desc
@@ -1,5 +1,5 @@
 CORE
 test.c
---no-simplify --unwind 300
-too many variables
+--no-simplify --unwind 300 --object-bits 8
+too many addressed objects
 --
diff --git a/regression/cbmc/address_space_size_limit2/test.c b/regression/cbmc/address_space_size_limit2/test.c
new file mode 100644
index 00000000000..c35cc13da7f
--- /dev/null
+++ b/regression/cbmc/address_space_size_limit2/test.c
@@ -0,0 +1,10 @@
+#include <stdlib.h>
+#include <assert.h>
+
+int main(int argc, char** argv)
+{
+  char* c=(char*)malloc(10);
+  char* d=c;
+  for(char i=0; i<10; i++, d++);
+  assert((size_t)d==(size_t)c+10);
+}
diff --git a/regression/cbmc/address_space_size_limit2/test.desc b/regression/cbmc/address_space_size_limit2/test.desc
new file mode 100644
index 00000000000..63d05de2268
--- /dev/null
+++ b/regression/cbmc/address_space_size_limit2/test.desc
@@ -0,0 +1,5 @@
+KNOWNBUG
+test.c
+--32 --object-bits 31 --unwind 11 --no-simplify
+dynamic object too large
+--
diff --git a/regression/cbmc/address_space_size_limit3/main.c b/regression/cbmc/address_space_size_limit3/main.c
new file mode 100644
index 00000000000..6c62d538ee5
--- /dev/null
+++ b/regression/cbmc/address_space_size_limit3/main.c
@@ -0,0 +1,136 @@
+// copy of Pointer_Arithmetic12
+
+#include <stdint.h>
+
+#include <assert.h>
+
+uint32_t __stack[32];
+
+uint32_t eax;
+uint32_t ebp;
+uint32_t ebx;
+uint32_t ecx;
+uint32_t edi;
+uint32_t edx;
+uint32_t esi;
+uint32_t esp=(uint32_t)&(__stack[31]);
+uint32_t var0;
+uint32_t var1;
+uint32_t var10;
+uint32_t var11;
+uint32_t var12;
+uint32_t var13;
+uint32_t var14;
+uint32_t var15;
+uint32_t var16;
+uint32_t var2;
+uint32_t var3;
+uint32_t var4;
+uint32_t var5;
+uint32_t var6;
+uint32_t var7;
+uint32_t var8;
+uint32_t var9;
+
+void g__L_0x3b4_0()
+{
+  L_0x3b4_0: esp-=0x4;
+  L_0x3b4_1: *(uint32_t*)(esp)=ebp;
+  L_0x3b5_0: ebp=esp;
+  L_0x3b7_0: var4=ebp;
+  L_0x3b7_1: var4+=0xc;
+  L_0x3b7_2: eax=*(uint32_t*)(var4);
+  L_0x3ba_0: edx=eax;
+  L_0x3bc_0: edx&=0x3;
+  L_0x3bf_0: var5=ebp;
+  L_0x3bf_1: var5+=0x8;
+  L_0x3bf_2: eax=*(uint32_t*)(var5);
+  L_0x3c2_0: *(uint32_t*)(eax)=edx;
+  L_0x3c4_0: ebp=*(uint32_t*)(esp);
+  L_0x3c4_1: esp+=0x4;
+  L_0x3c5_0: return;
+}
+
+void f__L_0x3c6_0()
+{
+  L_0x3c6_0: esp-=0x4;
+  L_0x3c6_1: *(uint32_t*)(esp)=ebp;
+  L_0x3c7_0: ebp=esp;
+  L_0x3c9_0: esp-=0x18;
+  L_0x3cc_0: var6=ebp;
+  L_0x3cc_1: var6-=0x4;
+  L_0x3cc_2: *(uint32_t*)(var6)=0x0;
+  L_0x3d3_0: var7=ebp;
+  L_0x3d3_1: var7-=0x8;
+  L_0x3d3_2: *(uint32_t*)(var7)=0x0;
+  L_0x3da_0: var8=ebp;
+  L_0x3da_1: var8+=0x8;
+  L_0x3da_2: eax=*(uint32_t*)(var8);
+  L_0x3dd_0: var9=ebp;
+  L_0x3dd_1: var9-=0x4;
+  L_0x3dd_2: *(uint32_t*)(var9)=eax;
+  L_0x3e0_0: var10=ebp;
+  L_0x3e0_1: var10-=0x4;
+  L_0x3e0_2: eax=*(uint32_t*)(var10);
+  L_0x3e3_0: var11=esp;
+  L_0x3e3_1: var11+=0x4;
+  L_0x3e3_2: *(uint32_t*)(var11)=eax;
+  L_0x3e7_0: var12=ebp;
+  L_0x3e7_1: var12-=0x8;
+  L_0x3e7_2: eax=(uint32_t)&*(uint32_t*)(var12);
+  L_0x3ea_0: *(uint32_t*)(esp)=eax;
+  L_0x3ed_0: esp-=4; g__L_0x3b4_0(); esp+=4;
+  L_0x3f2_0: var13=ebp;
+  L_0x3f2_1: var13-=0x4;
+  L_0x3f2_2: *(uint32_t*)(var13)=0x5;
+  L_0x3f9_0: var14=ebp;
+  L_0x3f9_1: var14-=0x8;
+  L_0x3f9_2: eax=*(uint32_t*)(var14);
+  L_0x3fc_0: esp=ebp;
+  L_0x3fc_1: ebp=*(uint32_t*)(esp);
+  L_0x3fc_2: esp+=0x4;
+  L_0x3fd_0: return;
+}
+
+int main()
+{
+  L_0x3fe_0: esp-=0x4;
+  L_0x3fe_1: *(uint32_t*)(esp)=ebp;
+  L_0x3ff_0: ebp=esp;
+  L_0x401_0: esp-=0x14;
+  L_0x404_0: var15=ebp;
+  L_0x404_1: var15-=0x4;
+#ifdef NONDET
+  L_0x404_2: *(uint32_t*)(var15)=nondet_uint();
+#else
+  L_0x404_2: *(uint32_t*)(var15)=0xffffffff;
+#endif
+  L_0x40b_0: var16=ebp;
+  L_0x40b_1: var16-=0x4;
+  L_0x40b_2: eax=*(uint32_t*)(var16);
+  L_0x40e_0: *(uint32_t*)(esp)=eax;
+  L_0x411_0: esp-=4; f__L_0x3c6_0(); esp+=4;
+#if 1
+             uint32_t eax1=eax;
+  C_0x3ff_0: ebp=esp;
+  C_0x401_0: esp-=0x14;
+  C_0x404_0: var15=ebp;
+  C_0x404_1: var15-=0x4;
+#ifdef NONDET
+  C_0x404_2: *(uint32_t*)(var15)=nondet_uint();
+#else
+  C_0x404_2: *(uint32_t*)(var15)=0xffffffff;
+#endif
+  C_0x40b_0: var16=ebp;
+  C_0x40b_1: var16-=0x4;
+  C_0x40b_2: eax=*(uint32_t*)(var16);
+  C_0x40e_0: *(uint32_t*)(esp)=eax;
+  C_0x411_0: esp-=4; f__L_0x3c6_0(); esp+=4;
+             uint32_t eax2=eax;
+             assert(eax2==eax1);
+#endif
+  L_0x416_0: esp=ebp;
+  L_0x416_1: ebp=*(uint32_t*)(esp);
+  L_0x416_2: esp+=0x4;
+  L_0x417_0: return 0;
+}
diff --git a/regression/cbmc/address_space_size_limit3/test.desc b/regression/cbmc/address_space_size_limit3/test.desc
new file mode 100644
index 00000000000..ee7b4e94ab8
--- /dev/null
+++ b/regression/cbmc/address_space_size_limit3/test.desc
@@ -0,0 +1,11 @@
+CORE
+main.c
+--32 --little-endian --object-bits 25 --pointer-check
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
+^.* dereference failure: pointer outside object bounds in .*: FAILURE$
+--
+^warning: ignoring
+--
+requires at least 8 offset bits
diff --git a/regression/cbmc/bad_option/main.c b/regression/cbmc/bad_option/main.c
new file mode 100644
index 00000000000..4cce7f667ff
--- /dev/null
+++ b/regression/cbmc/bad_option/main.c
@@ -0,0 +1,3 @@
+int main() {
+  return 0;
+}
diff --git a/regression/cbmc/bad_option/test.desc b/regression/cbmc/bad_option/test.desc
new file mode 100644
index 00000000000..c7f22f5b873
--- /dev/null
+++ b/regression/cbmc/bad_option/test.desc
@@ -0,0 +1,7 @@
+CORE
+main.c
+-foo
+^EXIT=(64|1)$
+^SIGNAL=0$
+Unknown option: -foo
+--
diff --git a/regression/cbmc/bad_option/test_multiple.desc b/regression/cbmc/bad_option/test_multiple.desc
new file mode 100644
index 00000000000..30697b2267d
--- /dev/null
+++ b/regression/cbmc/bad_option/test_multiple.desc
@@ -0,0 +1,7 @@
+CORE
+main.c
+--trace --foo --refine-strings
+^EXIT=(64|1)$
+^SIGNAL=0$
+Unknown option: --foo
+--
diff --git a/regression/cbmc/fgets1/test.desc b/regression/cbmc/fgets1/test.desc
index 3a8c4e6a733..1551462c520 100644
--- a/regression/cbmc/fgets1/test.desc
+++ b/regression/cbmc/fgets1/test.desc
@@ -5,6 +5,6 @@ main.c
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
 \[main.assertion.3\] assertion p\[1\]=='b': FAILURE
-\*\* 1 of 38 failed \(2 iterations\)
+\*\* 1 of \d+ failed \(2 iterations\)
 --
 ^warning: ignoring
diff --git a/regression/cbmc/trace_class_identifier/TestGenTest.class b/regression/cbmc/trace_class_identifier/TestGenTest.class
new file mode 100644
index 00000000000..4238fc097d6
Binary files /dev/null and b/regression/cbmc/trace_class_identifier/TestGenTest.class differ
diff --git a/regression/cbmc/trace_class_identifier/TestGenTest.java b/regression/cbmc/trace_class_identifier/TestGenTest.java
new file mode 100644
index 00000000000..bfb5cdfeccc
--- /dev/null
+++ b/regression/cbmc/trace_class_identifier/TestGenTest.java
@@ -0,0 +1,7 @@
+public class TestGenTest
+{
+  public void f()
+  {
+    int a = 4;
+  }
+}
diff --git a/regression/cbmc/trace_class_identifier/test.desc b/regression/cbmc/trace_class_identifier/test.desc
new file mode 100644
index 00000000000..5514cd02ba0
--- /dev/null
+++ b/regression/cbmc/trace_class_identifier/test.desc
@@ -0,0 +1,8 @@
+CORE
+TestGenTest.class
+--function TestGenTest.f --trace --cover location --json-ui
+"data": "java::TestGenTest",$
+^EXIT=0$
+^SIGNAL=0$
+--
+^warning: ignoring
diff --git a/regression/cpp/pointer_to_member_conversion1/main.cpp b/regression/cpp/pointer_to_member_conversion1/main.cpp
new file mode 100644
index 00000000000..06457da223e
--- /dev/null
+++ b/regression/cpp/pointer_to_member_conversion1/main.cpp
@@ -0,0 +1,30 @@
+class B
+{
+};
+
+class D: public B
+{
+public:
+  int x;
+};
+
+class E
+{
+public:
+  int y;
+};
+
+
+int main(int argc, char** argv)
+{
+  int B::* xptr=static_cast<int B::*>(&D::x);
+#if 0
+  B b;
+  b.*xptr; // undefined
+#endif
+
+  D d;
+  d.*xptr; // valid
+
+  return 0;
+}
diff --git a/regression/cpp/pointer_to_member_conversion1/test.desc b/regression/cpp/pointer_to_member_conversion1/test.desc
new file mode 100644
index 00000000000..7851737adc1
--- /dev/null
+++ b/regression/cpp/pointer_to_member_conversion1/test.desc
@@ -0,0 +1,10 @@
+KNOWNBUG
+main.cpp
+
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+^warning: ignoring
+--
+should exercise cpp_typecheckt::standard_conversion_pointer_to_member, cpp/cpp_typecheck_conversion.cpp:610 once other bugs are fixed
diff --git a/regression/cpp/pointer_to_member_conversion2/main.cpp b/regression/cpp/pointer_to_member_conversion2/main.cpp
new file mode 100644
index 00000000000..c0f4ddf9df4
--- /dev/null
+++ b/regression/cpp/pointer_to_member_conversion2/main.cpp
@@ -0,0 +1,30 @@
+class B
+{
+};
+
+class D: public B
+{
+public:
+  int x;
+};
+
+class E
+{
+public:
+  int y;
+};
+
+
+int main(int argc, char** argv)
+{
+  int B::* xptr=static_cast<int B::*>(&D::x);
+#if 0
+  B b;
+  b.*xptr; // undefined
+#endif
+
+  E e;
+  e.*xptr; // compiler error
+
+  return 0;
+}
diff --git a/regression/cpp/pointer_to_member_conversion2/test.desc b/regression/cpp/pointer_to_member_conversion2/test.desc
new file mode 100644
index 00000000000..57b8cb22426
--- /dev/null
+++ b/regression/cpp/pointer_to_member_conversion2/test.desc
@@ -0,0 +1,11 @@
+KNOWNBUG
+main.cpp
+
+^EXIT=(64|1)$
+^SIGNAL=0$
+invalid implicit conversion
+^CONVERSION ERROR$
+--
+^warning: ignoring
+--
+should exercise cpp_typecheckt::standard_conversion_pointer_to_member, cpp/cpp_typecheck_conversion.cpp:610 once other bugs are fixed
diff --git a/regression/invariants/Makefile b/regression/invariants/Makefile
index b561a960830..96c4a9e8077 100644
--- a/regression/invariants/Makefile
+++ b/regression/invariants/Makefile
@@ -4,7 +4,8 @@ SRC = driver.cpp
 
 INCLUDES = -I ../../src
 
-OBJ += ../../src/util/util$(LIBEXT)
+OBJ += ../../src/big-int/big-int$(LIBEXT) \
+      ../../src/util/util$(LIBEXT)
 
 include ../../src/config.inc
 include ../../src/common
diff --git a/regression/invariants/driver.cpp b/regression/invariants/driver.cpp
index 824ae588c03..c0627bbd341 100644
--- a/regression/invariants/driver.cpp
+++ b/regression/invariants/driver.cpp
@@ -12,6 +12,8 @@ Author: Chris Smowton, chris.smowton@diffblue.com
 #include <string>
 #include <sstream>
 #include <util/invariant.h>
+#include <util/invariant_utils.h>
+#include <util/std_types.h>
 
 /// An example of structured invariants-- this contains fields to
 /// describe the error to a catcher, and also produces a human-readable
@@ -83,6 +85,8 @@ int main(int argc, char** argv)
     DATA_INVARIANT_STRUCTURED(false, structured_error_testt, 1, "Structured error"); // NOLINT
   else if(arg=="data-invariant-string")
     DATA_INVARIANT(false, "Test invariant failure");
+  else if(arg=="irep")
+    INVARIANT_WITH_IREP(false, "error with irep", pointer_typet(void_typet()));
   else
     return 1;
 }
diff --git a/regression/invariants/invariant-failure13/test.desc b/regression/invariants/invariant-failure13/test.desc
new file mode 100644
index 00000000000..331889e1eb7
--- /dev/null
+++ b/regression/invariants/invariant-failure13/test.desc
@@ -0,0 +1,14 @@
+CORE
+dummy_parameter.c
+irep
+^EXIT=(0|127|134|137)$
+^SIGNAL=0$
+--- begin invariant violation report ---
+Invariant check failed
+error with irep
+pointer
+0: empty
+^(Backtrace)|(Backtraces not supported)$
+--
+^warning: ignoring
+^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings-smoke-tests/Makefile b/regression/strings-smoke-tests/Makefile
new file mode 100644
index 00000000000..47653a6bb95
--- /dev/null
+++ b/regression/strings-smoke-tests/Makefile
@@ -0,0 +1,38 @@
+default: tests.log
+
+test:
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+testfuture:
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc -CF ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+testall:
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc -CFTK ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+tests.log: ../test.pl
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+show:
+	@for dir in *; do \
+		if [ -d "$$dir" ]; then \
+			vim -o "$$dir/*.c" "$$dir/*.out"; \
+		fi; \
+	done;
+
+clean:
+	find -name '*.out' -execdir $(RM) '{}' \;
+	find -name '*.gb' -execdir $(RM) '{}' \;
+	$(RM) tests.log
+
diff --git a/regression/strings-smoke-tests/java_append_char/test.desc b/regression/strings-smoke-tests/java_append_char/test.desc
new file mode 100644
index 00000000000..7fdd9f47961
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_char/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_append_char.class
+--refine-strings --string-max-length 1000
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_append_char/test_append_char.class b/regression/strings-smoke-tests/java_append_char/test_append_char.class
new file mode 100644
index 00000000000..00c40aef6f6
Binary files /dev/null and b/regression/strings-smoke-tests/java_append_char/test_append_char.class differ
diff --git a/regression/strings-smoke-tests/java_append_char/test_append_char.java b/regression/strings-smoke-tests/java_append_char/test_append_char.java
new file mode 100644
index 00000000000..3eec4f30abe
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_char/test_append_char.java
@@ -0,0 +1,17 @@
+public class test_append_char
+{
+   public static void main(/*String[] args*/)
+   {
+      char[] diff = {'d', 'i', 'f', 'f'};
+      char[] blue = {'b', 'l', 'u', 'e'};
+
+      StringBuilder buffer = new StringBuilder();
+
+      buffer.append(diff)
+            .append(blue);
+
+      String tmp=buffer.toString();
+      System.out.println(tmp);
+      assert tmp.equals("diffblue");
+   }
+}
diff --git a/regression/strings-smoke-tests/java_append_int/test.desc b/regression/strings-smoke-tests/java_append_int/test.desc
new file mode 100644
index 00000000000..e1455859470
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_int/test.desc
@@ -0,0 +1,7 @@
+FUTURE
+test_append_int.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_append_int/test_append_int.class b/regression/strings-smoke-tests/java_append_int/test_append_int.class
new file mode 100644
index 00000000000..16948397e03
Binary files /dev/null and b/regression/strings-smoke-tests/java_append_int/test_append_int.class differ
diff --git a/regression/strings-smoke-tests/java_append_int/test_append_int.java b/regression/strings-smoke-tests/java_append_int/test_append_int.java
new file mode 100644
index 00000000000..963f3d7c063
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_int/test_append_int.java
@@ -0,0 +1,11 @@
+public class test_append_int
+{
+   public static void main(/*String[] args*/)
+   {
+      StringBuilder diffblue = new StringBuilder();
+      diffblue.append("d");
+      diffblue.append(4);
+      String s = diffblue.toString();
+      assert s.equals("d4");
+   }
+}
diff --git a/regression/strings-smoke-tests/java_append_object/test.desc b/regression/strings-smoke-tests/java_append_object/test.desc
new file mode 100644
index 00000000000..787852963ed
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_object/test.desc
@@ -0,0 +1,8 @@
+FUTURE
+test_append_object.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+Issue: diffblue/test-gen#82
diff --git a/regression/strings-smoke-tests/java_append_object/test_append_object.class b/regression/strings-smoke-tests/java_append_object/test_append_object.class
new file mode 100644
index 00000000000..ed6942a1fa6
Binary files /dev/null and b/regression/strings-smoke-tests/java_append_object/test_append_object.class differ
diff --git a/regression/strings-smoke-tests/java_append_object/test_append_object.java b/regression/strings-smoke-tests/java_append_object/test_append_object.java
new file mode 100644
index 00000000000..121690451ca
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_object/test_append_object.java
@@ -0,0 +1,17 @@
+public class test_append_object
+{
+   public static void main(/*String[] args*/)
+   {
+      Object diff = "diff";
+      Object blue = "blue";
+
+      StringBuilder buffer = new StringBuilder();
+
+      buffer.append(diff)
+            .append(blue);
+
+      String tmp=buffer.toString();
+      System.out.println(tmp);
+      assert tmp.equals("diffblue");
+   }
+}
diff --git a/regression/strings-smoke-tests/java_append_string/test.desc b/regression/strings-smoke-tests/java_append_string/test.desc
new file mode 100644
index 00000000000..943ca820bcc
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_string/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_append_string.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_append_string/test_append_string.class b/regression/strings-smoke-tests/java_append_string/test_append_string.class
new file mode 100644
index 00000000000..622e08467f9
Binary files /dev/null and b/regression/strings-smoke-tests/java_append_string/test_append_string.class differ
diff --git a/regression/strings-smoke-tests/java_append_string/test_append_string.java b/regression/strings-smoke-tests/java_append_string/test_append_string.java
new file mode 100644
index 00000000000..e7f961172fa
--- /dev/null
+++ b/regression/strings-smoke-tests/java_append_string/test_append_string.java
@@ -0,0 +1,14 @@
+public class test_append_string
+{
+   public static void main(/*String[] args*/)
+   {
+      String di = new String("di");
+      StringBuilder diff = new StringBuilder();
+      diff.append(di);
+      diff.append("ff");
+      System.out.println(diff);
+      String s = diff.toString();
+      System.out.println(s);
+      assert s.equals("diff");
+   }
+}
diff --git a/regression/strings-smoke-tests/java_case/test.desc b/regression/strings-smoke-tests/java_case/test.desc
new file mode 100644
index 00000000000..2889787e47a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_case/test.desc
@@ -0,0 +1,12 @@
+CORE
+test_case.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* file test_case.java line 10 .* SUCCESS$
+assertion.* file test_case.java line 11 .* SUCCESS$
+assertion.* file test_case.java line 12 .* SUCCESS$
+assertion.* file test_case.java line 16 .* FAILURE$
+assertion.* file test_case.java line 20 .* SUCCESS$
+assertion.* file test_case.java line 24 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_case/test_case.class b/regression/strings-smoke-tests/java_case/test_case.class
new file mode 100644
index 00000000000..68e4955d131
Binary files /dev/null and b/regression/strings-smoke-tests/java_case/test_case.class differ
diff --git a/regression/strings-smoke-tests/java_case/test_case.java b/regression/strings-smoke-tests/java_case/test_case.java
new file mode 100644
index 00000000000..088ee70803e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_case/test_case.java
@@ -0,0 +1,27 @@
+public class test_case
+{
+    public static void main(int i)
+    {
+        String s = new String("Ab");
+        String l = s.toLowerCase();
+        String u = s.toUpperCase();
+        if(i==1)
+        {
+            assert(l.equals("ab"));
+            assert(u.equals("AB"));
+            assert(s.equalsIgnoreCase("aB"));
+        }
+        else if(i==2)
+        {
+            assert(!u.equals("AB"));
+        }
+        else if(i==3)
+        {
+            assert("ÖÇ".toLowerCase().equals("öç"));
+        }
+        else
+        {
+            assert(!"ÖÇ".toLowerCase().equals("öç"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_char_array/test.desc b/regression/strings-smoke-tests/java_char_array/test.desc
new file mode 100644
index 00000000000..d00a921a8c1
--- /dev/null
+++ b/regression/strings-smoke-tests/java_char_array/test.desc
@@ -0,0 +1,13 @@
+CORE
+test_char_array.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+.*assertion.* test_char_array.java line 9 .* SUCCESS$
+.*assertion.* test_char_array.java line 10 .* SUCCESS$
+.*assertion.* test_char_array.java line 11 .* SUCCESS$
+.*assertion.* test_char_array.java line 13 .* FAILURE$
+.*assertion.* test_char_array.java line 15 .* FAILURE$
+.*assertion.* test_char_array.java line 17 .* FAILURE$
+^VERIFICATION FAILED$
+--
diff --git a/regression/strings-smoke-tests/java_char_array/test_char_array.class b/regression/strings-smoke-tests/java_char_array/test_char_array.class
new file mode 100644
index 00000000000..e509fe289d3
Binary files /dev/null and b/regression/strings-smoke-tests/java_char_array/test_char_array.class differ
diff --git a/regression/strings-smoke-tests/java_char_array/test_char_array.java b/regression/strings-smoke-tests/java_char_array/test_char_array.java
new file mode 100644
index 00000000000..e0efe1777e7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_char_array/test_char_array.java
@@ -0,0 +1,19 @@
+public class test_char_array
+{
+   public static void main(int i)
+   {
+      String s = "abc";
+      char [] str = s.toCharArray();
+      char c = str[2];
+      char a = s.charAt(0);
+      assert(str.length == 3);
+      assert(a == 'a');
+      assert(c == 'c');
+      if(i==0)
+          assert(str.length != 3);
+      if(i==2)
+          assert(a != 'a');
+      if(i==3)
+          assert(c != 'c');
+   }
+}
diff --git a/regression/strings-smoke-tests/java_char_array_init/test.desc b/regression/strings-smoke-tests/java_char_array_init/test.desc
new file mode 100644
index 00000000000..04096a8a984
--- /dev/null
+++ b/regression/strings-smoke-tests/java_char_array_init/test.desc
@@ -0,0 +1,8 @@
+FUTURE
+test_init.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+cbmc/test-gen#259
diff --git a/regression/strings-smoke-tests/java_char_array_init/test_init.class b/regression/strings-smoke-tests/java_char_array_init/test_init.class
new file mode 100644
index 00000000000..48075eb9187
Binary files /dev/null and b/regression/strings-smoke-tests/java_char_array_init/test_init.class differ
diff --git a/regression/strings-smoke-tests/java_char_array_init/test_init.java b/regression/strings-smoke-tests/java_char_array_init/test_init.java
new file mode 100644
index 00000000000..8e0f656e3e8
--- /dev/null
+++ b/regression/strings-smoke-tests/java_char_array_init/test_init.java
@@ -0,0 +1,21 @@
+public class test_init {
+
+  public static void main(/*String[] argv*/)
+  {
+     char [] str = new char[10];
+     str[0] = 'H';
+     str[1] = 'e';
+     str[2] = 'l';
+     str[3] = 'l';
+     str[4] = 'o';
+     String s = new String(str);
+     String t = new String(str,1,2);
+
+     System.out.println(s.length());
+     assert(s.length() == 10);
+     System.out.println(s);
+     System.out.println(t);
+     assert(t.equals("el"));
+     assert(s.startsWith("Hello"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_char_at/test.desc b/regression/strings-smoke-tests/java_char_at/test.desc
new file mode 100644
index 00000000000..f2d5ecad6c7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_char_at/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_char_at.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_char_at/test_char_at.class b/regression/strings-smoke-tests/java_char_at/test_char_at.class
new file mode 100644
index 00000000000..de5fe888245
Binary files /dev/null and b/regression/strings-smoke-tests/java_char_at/test_char_at.class differ
diff --git a/regression/strings-smoke-tests/java_char_at/test_char_at.java b/regression/strings-smoke-tests/java_char_at/test_char_at.java
new file mode 100644
index 00000000000..3b8663d62ae
--- /dev/null
+++ b/regression/strings-smoke-tests/java_char_at/test_char_at.java
@@ -0,0 +1,7 @@
+public class test_char_at {
+
+  public static void main(/*String[] argv*/) {
+    String s = new String("abc");
+    assert(s.charAt(2)=='c');
+  }
+}
diff --git a/regression/strings-smoke-tests/java_code_point/test.desc b/regression/strings-smoke-tests/java_code_point/test.desc
new file mode 100644
index 00000000000..e3be9616fa5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_code_point/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_code_point.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_code_point/test_code_point.class b/regression/strings-smoke-tests/java_code_point/test_code_point.class
new file mode 100644
index 00000000000..1d5d2269325
Binary files /dev/null and b/regression/strings-smoke-tests/java_code_point/test_code_point.class differ
diff --git a/regression/strings-smoke-tests/java_code_point/test_code_point.java b/regression/strings-smoke-tests/java_code_point/test_code_point.java
new file mode 100644
index 00000000000..faf9a2051d5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_code_point/test_code_point.java
@@ -0,0 +1,14 @@
+public class test_code_point
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "!𐤇𐤄𐤋𐤋𐤅";
+      assert(s.codePointAt(1) == 67847);
+      assert(s.codePointBefore(3) == 67847);
+      assert(s.codePointCount(1,5) >= 2);
+      assert(s.offsetByCodePoints(1,2) >= 3);
+      StringBuilder sb = new StringBuilder();
+      sb.appendCodePoint(0x10907);
+      assert(s.charAt(1) == sb.charAt(0));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_compare/test.desc b/regression/strings-smoke-tests/java_compare/test.desc
new file mode 100644
index 00000000000..9e6810476b9
--- /dev/null
+++ b/regression/strings-smoke-tests/java_compare/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_compare.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_compare/test_compare.class b/regression/strings-smoke-tests/java_compare/test_compare.class
new file mode 100644
index 00000000000..3a807f4d203
Binary files /dev/null and b/regression/strings-smoke-tests/java_compare/test_compare.class differ
diff --git a/regression/strings-smoke-tests/java_compare/test_compare.java b/regression/strings-smoke-tests/java_compare/test_compare.java
new file mode 100644
index 00000000000..c052ed429bd
--- /dev/null
+++ b/regression/strings-smoke-tests/java_compare/test_compare.java
@@ -0,0 +1,9 @@
+public class test_compare
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s1 = "ab";
+      String s2 = "aa";
+      assert(s1.compareTo(s2) == 1);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_concat/test.desc b/regression/strings-smoke-tests/java_concat/test.desc
new file mode 100644
index 00000000000..2dcca464779
--- /dev/null
+++ b/regression/strings-smoke-tests/java_concat/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_concat.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 10.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_concat/test_concat.class b/regression/strings-smoke-tests/java_concat/test_concat.class
new file mode 100644
index 00000000000..e4143c15773
Binary files /dev/null and b/regression/strings-smoke-tests/java_concat/test_concat.class differ
diff --git a/regression/strings-smoke-tests/java_concat/test_concat.java b/regression/strings-smoke-tests/java_concat/test_concat.java
new file mode 100644
index 00000000000..b9909c723d4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_concat/test_concat.java
@@ -0,0 +1,13 @@
+public class test_concat
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("pi");
+      int i = s.length();
+      String t = new String("ppo");
+      String u = s.concat(t);
+      char c = u.charAt(i);
+      assert(c == 'p');
+      assert(c == 'o');
+   }
+}
diff --git a/regression/strings-smoke-tests/java_contains/test.desc b/regression/strings-smoke-tests/java_contains/test.desc
new file mode 100644
index 00000000000..158cf338c0a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_contains/test.desc
@@ -0,0 +1,11 @@
+CORE
+test_contains.class
+--refine-strings --string-max-length 100
+^EXIT=0$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 9.* SUCCESS$
+^VERIFICATION SUCCESSFUL$
+--
+--
+Issue: diffblue/test-gen#201
diff --git a/regression/strings-smoke-tests/java_contains/test_contains.class b/regression/strings-smoke-tests/java_contains/test_contains.class
new file mode 100644
index 00000000000..0319198566d
Binary files /dev/null and b/regression/strings-smoke-tests/java_contains/test_contains.class differ
diff --git a/regression/strings-smoke-tests/java_contains/test_contains.java b/regression/strings-smoke-tests/java_contains/test_contains.java
new file mode 100644
index 00000000000..0357b3d596b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_contains/test_contains.java
@@ -0,0 +1,19 @@
+public class test_contains
+{
+   public static void main(String x)
+   {
+      String s = new String("Abc");
+      String u = "bc";
+      String t = "ab";
+      assert(s.contains(u));
+      assert(!s.contains(t));
+
+      // Too slow now after constant unfolding was deleted due to invalidity.
+      // May be fast enough in the future though.
+      // String z = new String(x);
+      // if (z.length() > 3)
+      //  assert(t.contains(z));
+      // else
+      //  assert(z.contains(u));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_contains/test_string_printable.desc b/regression/strings-smoke-tests/java_contains/test_string_printable.desc
new file mode 100644
index 00000000000..ccd29948c26
--- /dev/null
+++ b/regression/strings-smoke-tests/java_contains/test_string_printable.desc
@@ -0,0 +1,12 @@
+KNOWNBUG
+test_contains.class
+--refine-strings --string-max-length 100 --string-printable
+^EXIT=0$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 9.* SUCCESS$
+^VERIFICATION SUCCESSFUL$
+--
+--
+This should create a huge formula and run out of memory.
+Issue: https://github.com/diffblue/test-gen/issues/745
diff --git a/regression/strings-smoke-tests/java_delete/test.desc b/regression/strings-smoke-tests/java_delete/test.desc
new file mode 100644
index 00000000000..f0c0aedda91
--- /dev/null
+++ b/regression/strings-smoke-tests/java_delete/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_delete.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_delete/test_delete.class b/regression/strings-smoke-tests/java_delete/test_delete.class
new file mode 100644
index 00000000000..f18891851b1
Binary files /dev/null and b/regression/strings-smoke-tests/java_delete/test_delete.class differ
diff --git a/regression/strings-smoke-tests/java_delete/test_delete.java b/regression/strings-smoke-tests/java_delete/test_delete.java
new file mode 100644
index 00000000000..13bd09cd075
--- /dev/null
+++ b/regression/strings-smoke-tests/java_delete/test_delete.java
@@ -0,0 +1,10 @@
+public class test_delete
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder s = new StringBuilder("Abc");
+      s.delete(1,2);
+      String str = s.toString();
+      assert(str.equals("Ac"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_delete_char_at/test.desc b/regression/strings-smoke-tests/java_delete_char_at/test.desc
new file mode 100644
index 00000000000..d415d16e9b6
--- /dev/null
+++ b/regression/strings-smoke-tests/java_delete_char_at/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_delete_char_at.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_delete_char_at/test_delete_char_at.class b/regression/strings-smoke-tests/java_delete_char_at/test_delete_char_at.class
new file mode 100644
index 00000000000..cfd8561e596
Binary files /dev/null and b/regression/strings-smoke-tests/java_delete_char_at/test_delete_char_at.class differ
diff --git a/regression/strings-smoke-tests/java_delete_char_at/test_delete_char_at.java b/regression/strings-smoke-tests/java_delete_char_at/test_delete_char_at.java
new file mode 100644
index 00000000000..94787c5283d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_delete_char_at/test_delete_char_at.java
@@ -0,0 +1,11 @@
+public class test_delete_char_at
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder s = new StringBuilder();
+      s.append("Abc");
+      s.deleteCharAt(1);
+      String str = s.toString();
+      assert(str.equals("Ac"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_empty/test.desc b/regression/strings-smoke-tests/java_empty/test.desc
new file mode 100644
index 00000000000..181ff4ee5fd
--- /dev/null
+++ b/regression/strings-smoke-tests/java_empty/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_empty.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_empty/test_empty.class b/regression/strings-smoke-tests/java_empty/test_empty.class
new file mode 100644
index 00000000000..8e9a17d387e
Binary files /dev/null and b/regression/strings-smoke-tests/java_empty/test_empty.class differ
diff --git a/regression/strings-smoke-tests/java_empty/test_empty.java b/regression/strings-smoke-tests/java_empty/test_empty.java
new file mode 100644
index 00000000000..47c335e16fa
--- /dev/null
+++ b/regression/strings-smoke-tests/java_empty/test_empty.java
@@ -0,0 +1,8 @@
+public class test_empty
+{
+   public static void main(/*String[] argv*/)
+   {
+      String empty = "";
+      assert(empty.isEmpty());
+   }
+}
diff --git a/regression/strings-smoke-tests/java_endswith/test.desc b/regression/strings-smoke-tests/java_endswith/test.desc
new file mode 100644
index 00000000000..002bd3015da
--- /dev/null
+++ b/regression/strings-smoke-tests/java_endswith/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_endswith.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 10.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_endswith/test_endswith.class b/regression/strings-smoke-tests/java_endswith/test_endswith.class
new file mode 100644
index 00000000000..1f86e94431d
Binary files /dev/null and b/regression/strings-smoke-tests/java_endswith/test_endswith.class differ
diff --git a/regression/strings-smoke-tests/java_endswith/test_endswith.java b/regression/strings-smoke-tests/java_endswith/test_endswith.java
new file mode 100644
index 00000000000..f7729ef6a40
--- /dev/null
+++ b/regression/strings-smoke-tests/java_endswith/test_endswith.java
@@ -0,0 +1,12 @@
+public class test_endswith
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Abcd");
+      String suff = "cd";
+      String bad_suff = "bc";
+
+      assert(s.endsWith(suff));
+      assert(s.endsWith(bad_suff));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_equal/test.desc b/regression/strings-smoke-tests/java_equal/test.desc
new file mode 100644
index 00000000000..964c3b72bae
--- /dev/null
+++ b/regression/strings-smoke-tests/java_equal/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_equal.class
+--refine-strings --string-max-length 100 --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* FAILURE$
+^\[.*assertion.2\].* line 9.* SUCCESS$
+--
diff --git a/regression/strings-smoke-tests/java_equal/test_2.desc b/regression/strings-smoke-tests/java_equal/test_2.desc
new file mode 100644
index 00000000000..bfa989a3695
--- /dev/null
+++ b/regression/strings-smoke-tests/java_equal/test_2.desc
@@ -0,0 +1,7 @@
+KNOWNBUG
+test_equal_2.class
+--refine-strings --string-max-length 100 --string-max-length 100
+^EXIT=0$
+^SIGNAL=0$
+--
+https://github.com/diffblue/test-gen/issues/856
diff --git a/regression/strings-smoke-tests/java_equal/test_equal.class b/regression/strings-smoke-tests/java_equal/test_equal.class
new file mode 100644
index 00000000000..e0fc6db8aaf
Binary files /dev/null and b/regression/strings-smoke-tests/java_equal/test_equal.class differ
diff --git a/regression/strings-smoke-tests/java_equal/test_equal.java b/regression/strings-smoke-tests/java_equal/test_equal.java
new file mode 100644
index 00000000000..a3acb0ebda5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_equal/test_equal.java
@@ -0,0 +1,11 @@
+public class test_equal
+{
+   public static void main(String[] argv)
+   {
+      String s = new String("pi");
+      String t = new String("po");
+      String u = "po";
+      assert(s.equals(t));
+      assert(t.equals(u));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_equal/test_equal_2.java b/regression/strings-smoke-tests/java_equal/test_equal_2.java
new file mode 100644
index 00000000000..931ed71471a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_equal/test_equal_2.java
@@ -0,0 +1,7 @@
+public class test_equal_2
+{
+   public static void main(String s)
+   {
+       assert(!(s.equals("pi") && s.equals("po")));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_float/test.desc b/regression/strings-smoke-tests/java_float/test.desc
new file mode 100644
index 00000000000..427d1fca836
--- /dev/null
+++ b/regression/strings-smoke-tests/java_float/test.desc
@@ -0,0 +1,7 @@
+FUTURE
+test_float.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_float/test_float.class b/regression/strings-smoke-tests/java_float/test_float.class
new file mode 100644
index 00000000000..e4448d41558
Binary files /dev/null and b/regression/strings-smoke-tests/java_float/test_float.class differ
diff --git a/regression/strings-smoke-tests/java_float/test_float.java b/regression/strings-smoke-tests/java_float/test_float.java
new file mode 100644
index 00000000000..d2791d5c343
--- /dev/null
+++ b/regression/strings-smoke-tests/java_float/test_float.java
@@ -0,0 +1,15 @@
+public class test_float
+{
+   public static void main(/*String[] arg*/)
+   {
+      float inf = 100.0f / 0.0f;
+      float minus_inf = -100.0f / 0.0f;
+      float nan = 0.0f / 0.0f;
+      String inf_string = Float.toString(inf);
+      String mininf_string = Float.toString(minus_inf);
+      String nan_string = Float.toString(nan);
+      assert(nan_string.equals("NaN"));
+      assert(inf_string.equals("Infinity"));
+      assert(mininf_string.equals("-Infinity"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_format/test.class b/regression/strings-smoke-tests/java_format/test.class
new file mode 100644
index 00000000000..a889c41e687
Binary files /dev/null and b/regression/strings-smoke-tests/java_format/test.class differ
diff --git a/regression/strings-smoke-tests/java_format/test.desc b/regression/strings-smoke-tests/java_format/test.desc
new file mode 100644
index 00000000000..8999b5b27ec
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--refine-strings --string-max-length 20
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 6.* SUCCESS$
+^\[.*assertion.2\].* line 7.* FAILURE$
+--
+^ignoring
diff --git a/regression/strings-smoke-tests/java_format/test.java b/regression/strings-smoke-tests/java_format/test.java
new file mode 100644
index 00000000000..9726153fbb3
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format/test.java
@@ -0,0 +1,10 @@
+public class test
+{
+    public static String main()
+    {
+        String s = String.format("foo %s", "bar");
+        assert(s.equals("foo bar"));
+        assert(!s.equals("foo bar"));
+        return s;
+    }
+}
diff --git a/regression/strings-smoke-tests/java_format2/test.class b/regression/strings-smoke-tests/java_format2/test.class
new file mode 100644
index 00000000000..e78ed5bb9df
Binary files /dev/null and b/regression/strings-smoke-tests/java_format2/test.class differ
diff --git a/regression/strings-smoke-tests/java_format2/test.desc b/regression/strings-smoke-tests/java_format2/test.desc
new file mode 100644
index 00000000000..f34840a743c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format2/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--refine-strings --string-max-length 20
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 6.* SUCCESS$
+^\[.*assertion.2\].* line 7.* FAILURE$
+--
+^warning
diff --git a/regression/strings-smoke-tests/java_format2/test.java b/regression/strings-smoke-tests/java_format2/test.java
new file mode 100644
index 00000000000..c197d5c6793
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format2/test.java
@@ -0,0 +1,10 @@
+public class test
+{
+    public static String main(String str)
+    {
+        String s = String.format("foo %s", str);
+        assert(s.equals("foo ".concat(str)));
+        assert(!s.equals("foo ".concat(str)));
+        return s;
+    }
+}
diff --git a/regression/strings-smoke-tests/java_format3/test.class b/regression/strings-smoke-tests/java_format3/test.class
new file mode 100644
index 00000000000..6d235dcccab
Binary files /dev/null and b/regression/strings-smoke-tests/java_format3/test.class differ
diff --git a/regression/strings-smoke-tests/java_format3/test.desc b/regression/strings-smoke-tests/java_format3/test.desc
new file mode 100644
index 00000000000..597b65ce183
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format3/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--refine-strings --string-max-length 20
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 7.* SUCCESS$
+^\[.*assertion.2\].* line 9.* FAILURE$
+--
+^warning
diff --git a/regression/strings-smoke-tests/java_format3/test.java b/regression/strings-smoke-tests/java_format3/test.java
new file mode 100644
index 00000000000..fd88ef5c3b5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format3/test.java
@@ -0,0 +1,12 @@
+public class test
+{
+    public static String main(int i)
+    {
+        String s = String.format("%3$sar", "a", "r", "b");
+        if(i==0)
+            assert(s.equals("bar"));
+        else
+            assert(!s.equals("bar"));
+        return s;
+    }
+}
diff --git a/regression/strings-smoke-tests/java_format4/test.class b/regression/strings-smoke-tests/java_format4/test.class
new file mode 100644
index 00000000000..8adb0b41ad8
Binary files /dev/null and b/regression/strings-smoke-tests/java_format4/test.class differ
diff --git a/regression/strings-smoke-tests/java_format4/test.desc b/regression/strings-smoke-tests/java_format4/test.desc
new file mode 100644
index 00000000000..120bf0cf11f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format4/test.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+test.class
+--refine-strings --string-max-length 20
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 13.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_format4/test.java b/regression/strings-smoke-tests/java_format4/test.java
new file mode 100644
index 00000000000..bc76a9ee416
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format4/test.java
@@ -0,0 +1,17 @@
+public class test
+{
+    public static String main(String str)
+    {
+        try
+        {
+            String s = String.format("%s %s", "a");
+            assert(false);
+            return s;
+        }
+        catch(java.util.IllegalFormatException e)
+        {
+            assert(false);
+            return str;
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_format5/test.class b/regression/strings-smoke-tests/java_format5/test.class
new file mode 100644
index 00000000000..66f386a8c3e
Binary files /dev/null and b/regression/strings-smoke-tests/java_format5/test.class differ
diff --git a/regression/strings-smoke-tests/java_format5/test.desc b/regression/strings-smoke-tests/java_format5/test.desc
new file mode 100644
index 00000000000..1a77e4be0a5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format5/test.desc
@@ -0,0 +1,8 @@
+THOROUGH
+test.class
+--refine-strings --string-max-length 20
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 7.* SUCCESS$
+^\[.*assertion.2\].* line 9.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_format5/test.java b/regression/strings-smoke-tests/java_format5/test.java
new file mode 100644
index 00000000000..5078791baa2
--- /dev/null
+++ b/regression/strings-smoke-tests/java_format5/test.java
@@ -0,0 +1,12 @@
+public class test
+{
+    public static String main(boolean b)
+    {
+        String s = String.format("%s%s%s%s%s%s%s%s", "a", "b", "c", "d", "e", "f", "g", "h");
+        if(b)
+            assert(s.equals("abcdefgh"));
+        else
+            assert(!s.equals("abcdefgh"));
+        return s;
+    }
+}
diff --git a/regression/strings-smoke-tests/java_hash_code/test.desc b/regression/strings-smoke-tests/java_hash_code/test.desc
new file mode 100644
index 00000000000..fc628393186
--- /dev/null
+++ b/regression/strings-smoke-tests/java_hash_code/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_hash_code.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 9.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_hash_code/test_hash_code.class b/regression/strings-smoke-tests/java_hash_code/test_hash_code.class
new file mode 100644
index 00000000000..21bc5d96ca9
Binary files /dev/null and b/regression/strings-smoke-tests/java_hash_code/test_hash_code.class differ
diff --git a/regression/strings-smoke-tests/java_hash_code/test_hash_code.java b/regression/strings-smoke-tests/java_hash_code/test_hash_code.java
new file mode 100644
index 00000000000..d9f42b7ff9d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_hash_code/test_hash_code.java
@@ -0,0 +1,11 @@
+public class test_hash_code
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s1 = "ab";
+      String s2 = "ab";
+      String s3 = "aa";
+      assert(s1.hashCode() == s2.hashCode());
+      assert(s1.hashCode() == s3.hashCode());
+   }
+}
diff --git a/regression/strings-smoke-tests/java_if/test.class b/regression/strings-smoke-tests/java_if/test.class
new file mode 100644
index 00000000000..11958bd6ce9
Binary files /dev/null and b/regression/strings-smoke-tests/java_if/test.class differ
diff --git a/regression/strings-smoke-tests/java_if/test.desc b/regression/strings-smoke-tests/java_if/test.desc
new file mode 100644
index 00000000000..382365ad33b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_if/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 12.* SUCCESS$
+^\[.*assertion.2\].* line 13.* FAILURE$
+--
+$ignoring\s*char\s*array
diff --git a/regression/strings-smoke-tests/java_if/test.java b/regression/strings-smoke-tests/java_if/test.java
new file mode 100644
index 00000000000..9760eb7bb2a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_if/test.java
@@ -0,0 +1,16 @@
+public class test
+{
+    public static String main()
+    {
+        Object t[] = new Object[5];
+        t[0] = "world!";
+        StringBuilder s = new StringBuilder("Hello ");
+        if(t[0] instanceof String)
+        {
+            s.append((String) t[0]);
+        }
+        assert(s.toString().equals("Hello world!"));
+        assert(!s.toString().equals("Hello world!"));
+        return s.toString();
+    }
+}
diff --git a/regression/strings-smoke-tests/java_index_of/test.desc b/regression/strings-smoke-tests/java_index_of/test.desc
new file mode 100644
index 00000000000..e0e7de66561
--- /dev/null
+++ b/regression/strings-smoke-tests/java_index_of/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_index_of.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_index_of/test_index_of.class b/regression/strings-smoke-tests/java_index_of/test_index_of.class
new file mode 100644
index 00000000000..8a989bdc95c
Binary files /dev/null and b/regression/strings-smoke-tests/java_index_of/test_index_of.class differ
diff --git a/regression/strings-smoke-tests/java_index_of/test_index_of.java b/regression/strings-smoke-tests/java_index_of/test_index_of.java
new file mode 100644
index 00000000000..3568dab9696
--- /dev/null
+++ b/regression/strings-smoke-tests/java_index_of/test_index_of.java
@@ -0,0 +1,13 @@
+public class test_index_of
+{
+    public static void main(/*String[] argv*/)
+    {
+        String s = "Abc";
+        String bc = "bc";
+        String ab = "ab";
+        int i = s.indexOf(bc);
+        int j = s.indexOf(ab);
+        assert(i == 1);
+        assert(j == -1);
+    }
+}
diff --git a/regression/strings-smoke-tests/java_index_of2/test.desc b/regression/strings-smoke-tests/java_index_of2/test.desc
new file mode 100644
index 00000000000..09a7398d4b7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_index_of2/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_index_of2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
+--
diff --git a/regression/strings-smoke-tests/java_index_of2/test_index_of2.class b/regression/strings-smoke-tests/java_index_of2/test_index_of2.class
new file mode 100644
index 00000000000..cb7aacc4a7a
Binary files /dev/null and b/regression/strings-smoke-tests/java_index_of2/test_index_of2.class differ
diff --git a/regression/strings-smoke-tests/java_index_of2/test_index_of2.java b/regression/strings-smoke-tests/java_index_of2/test_index_of2.java
new file mode 100644
index 00000000000..613ecefb75c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_index_of2/test_index_of2.java
@@ -0,0 +1,9 @@
+public class test_index_of2
+{
+   public static void main(String param)
+   {
+      String s = "abcdefg";
+      int i = s.indexOf(param);
+      assert(i != 1);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_index_of_char/test.desc b/regression/strings-smoke-tests/java_index_of_char/test.desc
new file mode 100644
index 00000000000..a95467b52e4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_index_of_char/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_index_of_char.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+Issue: cbmc/test-gen#77
diff --git a/regression/strings-smoke-tests/java_index_of_char/test_index_of_char.class b/regression/strings-smoke-tests/java_index_of_char/test_index_of_char.class
new file mode 100644
index 00000000000..f87a1026683
Binary files /dev/null and b/regression/strings-smoke-tests/java_index_of_char/test_index_of_char.class differ
diff --git a/regression/strings-smoke-tests/java_index_of_char/test_index_of_char.java b/regression/strings-smoke-tests/java_index_of_char/test_index_of_char.java
new file mode 100644
index 00000000000..6a5d3d60bd6
--- /dev/null
+++ b/regression/strings-smoke-tests/java_index_of_char/test_index_of_char.java
@@ -0,0 +1,10 @@
+public class test_index_of_char
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "Abc";
+      char c = 'c';
+      int i = s.indexOf(c);
+      assert(i == 2);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_insert_char/test.desc b/regression/strings-smoke-tests/java_insert_char/test.desc
new file mode 100644
index 00000000000..88200524d70
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_char/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_char.class
+--refine-strings  --string-max-length 1000
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_insert_char/test_insert_char.class b/regression/strings-smoke-tests/java_insert_char/test_insert_char.class
new file mode 100644
index 00000000000..481304a9f6d
Binary files /dev/null and b/regression/strings-smoke-tests/java_insert_char/test_insert_char.class differ
diff --git a/regression/strings-smoke-tests/java_insert_char/test_insert_char.java b/regression/strings-smoke-tests/java_insert_char/test_insert_char.java
new file mode 100644
index 00000000000..ac6beb4ffcf
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_char/test_insert_char.java
@@ -0,0 +1,10 @@
+public class test_insert_char
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ac");
+      sb.insert(1, 'b');
+      String s = sb.toString();
+      assert(s.equals("abc"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_insert_char_array/test.desc b/regression/strings-smoke-tests/java_insert_char_array/test.desc
new file mode 100644
index 00000000000..6fc7a12f439
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_char_array/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_char_array.class
+--refine-strings --string-max-length 1000
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_insert_char_array/test_insert_char_array.class b/regression/strings-smoke-tests/java_insert_char_array/test_insert_char_array.class
new file mode 100644
index 00000000000..3c0b5329230
Binary files /dev/null and b/regression/strings-smoke-tests/java_insert_char_array/test_insert_char_array.class differ
diff --git a/regression/strings-smoke-tests/java_insert_char_array/test_insert_char_array.java b/regression/strings-smoke-tests/java_insert_char_array/test_insert_char_array.java
new file mode 100644
index 00000000000..2c2840df672
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_char_array/test_insert_char_array.java
@@ -0,0 +1,14 @@
+public class test_insert_char_array
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ad");
+      char[] array = new char[2];
+      array[0] = 'b';
+      array[1] = 'c';
+      sb.insert(1, array);
+      String s = sb.toString();
+      System.out.println(s);
+      assert(s.equals("abcd"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_insert_int/test.desc b/regression/strings-smoke-tests/java_insert_int/test.desc
new file mode 100644
index 00000000000..488e2bc8766
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_int/test.desc
@@ -0,0 +1,7 @@
+FUTURE
+test_insert_int.class
+--refine-strings  --string-max-length 1000
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_insert_int/test_insert_int.class b/regression/strings-smoke-tests/java_insert_int/test_insert_int.class
new file mode 100644
index 00000000000..8b0121ec681
Binary files /dev/null and b/regression/strings-smoke-tests/java_insert_int/test_insert_int.class differ
diff --git a/regression/strings-smoke-tests/java_insert_int/test_insert_int.java b/regression/strings-smoke-tests/java_insert_int/test_insert_int.java
new file mode 100644
index 00000000000..b787141e51a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_int/test_insert_int.java
@@ -0,0 +1,10 @@
+public class test_insert_int
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ac");
+      sb.insert(1, 42);
+      String s = sb.toString();
+      assert(s.equals("a42c"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_insert_multiple/.test_insert.java.swp b/regression/strings-smoke-tests/java_insert_multiple/.test_insert.java.swp
new file mode 100644
index 00000000000..5596a2c906d
Binary files /dev/null and b/regression/strings-smoke-tests/java_insert_multiple/.test_insert.java.swp differ
diff --git a/regression/strings-smoke-tests/java_insert_multiple/test.desc b/regression/strings-smoke-tests/java_insert_multiple/test.desc
new file mode 100644
index 00000000000..d3236ab78ee
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_multiple/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_multiple.class
+--refine-strings --string-max-length 1000
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_insert_multiple/test_insert_multiple.class b/regression/strings-smoke-tests/java_insert_multiple/test_insert_multiple.class
new file mode 100644
index 00000000000..17ced6ec67c
Binary files /dev/null and b/regression/strings-smoke-tests/java_insert_multiple/test_insert_multiple.class differ
diff --git a/regression/strings-smoke-tests/java_insert_multiple/test_insert_multiple.java b/regression/strings-smoke-tests/java_insert_multiple/test_insert_multiple.java
new file mode 100644
index 00000000000..cce6881ca7d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_multiple/test_insert_multiple.java
@@ -0,0 +1,11 @@
+public class test_insert_multiple
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ad");
+      sb.insert(1, 'c');
+      sb.insert(1, "b");
+      String s = sb.toString();
+      assert(s.equals("abcd"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_insert_string/test.desc b/regression/strings-smoke-tests/java_insert_string/test.desc
new file mode 100644
index 00000000000..2b91905e17e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_string/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_string.class
+--refine-strings --string-max-length 1000
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_insert_string/test_insert_string.class b/regression/strings-smoke-tests/java_insert_string/test_insert_string.class
new file mode 100644
index 00000000000..39cc969a902
Binary files /dev/null and b/regression/strings-smoke-tests/java_insert_string/test_insert_string.class differ
diff --git a/regression/strings-smoke-tests/java_insert_string/test_insert_string.java b/regression/strings-smoke-tests/java_insert_string/test_insert_string.java
new file mode 100644
index 00000000000..7c161205131
--- /dev/null
+++ b/regression/strings-smoke-tests/java_insert_string/test_insert_string.java
@@ -0,0 +1,10 @@
+public class test_insert_string
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ad");
+      sb.insert(1, "bc");
+      String s = sb.toString();
+      assert(s.equals("abcd"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test1.class b/regression/strings-smoke-tests/java_int_to_string/Test1.class
new file mode 100644
index 00000000000..b4e1976927d
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string/Test1.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test1.java b/regression/strings-smoke-tests/java_int_to_string/Test1.java
new file mode 100644
index 00000000000..bc5f46a5761
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/Test1.java
@@ -0,0 +1,13 @@
+public class Test1
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(12);
+        if (b) {
+            assert(s.equals("12"));
+        }
+        else {
+            assert(!s.equals("12"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test2.class b/regression/strings-smoke-tests/java_int_to_string/Test2.class
new file mode 100644
index 00000000000..b5c286c4fca
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string/Test2.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test2.java b/regression/strings-smoke-tests/java_int_to_string/Test2.java
new file mode 100644
index 00000000000..b0feb6ae002
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/Test2.java
@@ -0,0 +1,13 @@
+public class Test2
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(-23);
+        if (b) {
+            assert(s.equals("-23"));
+        }
+        else {
+            assert(!s.equals("-23"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test3.class b/regression/strings-smoke-tests/java_int_to_string/Test3.class
new file mode 100644
index 00000000000..f3c171504dc
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string/Test3.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test3.java b/regression/strings-smoke-tests/java_int_to_string/Test3.java
new file mode 100644
index 00000000000..f2e4b9ee389
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/Test3.java
@@ -0,0 +1,13 @@
+public class Test3
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MAX_VALUE);
+        if (b) {
+            assert(s.equals("2147483647"));
+        }
+        else {
+            assert(!s.equals("2147483647"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test4.class b/regression/strings-smoke-tests/java_int_to_string/Test4.class
new file mode 100644
index 00000000000..299c653044e
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string/Test4.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test4.java b/regression/strings-smoke-tests/java_int_to_string/Test4.java
new file mode 100644
index 00000000000..e4a3bdb41bc
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/Test4.java
@@ -0,0 +1,13 @@
+public class Test4
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE + 1);
+        if (b) {
+            assert(s.equals("-2147483647"));
+        }
+        else {
+            assert(!s.equals("-2147483647"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test5.class b/regression/strings-smoke-tests/java_int_to_string/Test5.class
new file mode 100644
index 00000000000..eafc3cb9a78
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string/Test5.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string/Test5.java b/regression/strings-smoke-tests/java_int_to_string/Test5.java
new file mode 100644
index 00000000000..408b2eaad11
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/Test5.java
@@ -0,0 +1,13 @@
+public class Test5
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(0);
+        if (b) {
+            assert(s.equals("0"));
+        }
+        else {
+            assert(!s.equals("0"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string/test1.desc b/regression/strings-smoke-tests/java_int_to_string/test1.desc
new file mode 100644
index 00000000000..88f39d5eb12
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/test1.desc
@@ -0,0 +1,8 @@
+CORE
+Test1.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string/test2.desc b/regression/strings-smoke-tests/java_int_to_string/test2.desc
new file mode 100644
index 00000000000..5ff465a846e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/test2.desc
@@ -0,0 +1,8 @@
+CORE
+Test2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string/test3.desc b/regression/strings-smoke-tests/java_int_to_string/test3.desc
new file mode 100644
index 00000000000..97565815465
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/test3.desc
@@ -0,0 +1,8 @@
+CORE
+Test3.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string/test4.desc b/regression/strings-smoke-tests/java_int_to_string/test4.desc
new file mode 100644
index 00000000000..2106e2defa5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/test4.desc
@@ -0,0 +1,8 @@
+CORE
+Test4.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string/test5.desc b/regression/strings-smoke-tests/java_int_to_string/test5.desc
new file mode 100644
index 00000000000..524a176db3f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string/test5.desc
@@ -0,0 +1,8 @@
+CORE
+Test5.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_knownbug/Test.class b/regression/strings-smoke-tests/java_int_to_string_knownbug/Test.class
new file mode 100644
index 00000000000..f367a4884d7
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_knownbug/Test.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_knownbug/Test.java b/regression/strings-smoke-tests/java_int_to_string_knownbug/Test.java
new file mode 100644
index 00000000000..cd1f45d3caa
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_knownbug/Test.java
@@ -0,0 +1,13 @@
+public class Test
+{
+    public static void main(Boolean b)
+    {
+        String t = Integer.toString(Integer.MIN_VALUE);
+        if (b) {
+            assert(t.equals("-2147483648"));
+        }
+        else {
+            assert(!t.equals("-2147483648"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_knownbug/test.desc b/regression/strings-smoke-tests/java_int_to_string_knownbug/test.desc
new file mode 100644
index 00000000000..b1ed3bac24c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_knownbug/test.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+Test.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary1.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary1.class
new file mode 100644
index 00000000000..5623ec7b8fe
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary1.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary1.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary1.java
new file mode 100644
index 00000000000..7fc9c70f983
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary1.java
@@ -0,0 +1,13 @@
+public class Test_binary1
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(-23, 2);
+        if (b) {
+            assert(s.equals("-10111"));
+        }
+        else {
+            assert(!s.equals("-10111"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary2.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary2.class
new file mode 100644
index 00000000000..fcf394e2179
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary2.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary2.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary2.java
new file mode 100644
index 00000000000..c8f71309d6b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary2.java
@@ -0,0 +1,13 @@
+public class Test_binary2
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MAX_VALUE, 2);
+        if (b) {
+            assert(s.equals("1111111111111111111111111111111"));
+        }
+        else {
+            assert(!s.equals("1111111111111111111111111111111"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary3.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary3.class
new file mode 100644
index 00000000000..b6f7c61d4b2
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary3.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary3.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary3.java
new file mode 100644
index 00000000000..7319a279ff0
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_binary3.java
@@ -0,0 +1,13 @@
+public class Test_binary3
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE + 1, 2);
+        if (b) {
+            assert(s.equals("-1111111111111111111111111111111"));
+        }
+        else {
+            assert(!s.equals("-1111111111111111111111111111111"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_decimal.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_decimal.class
new file mode 100644
index 00000000000..114102c52a4
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_decimal.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_decimal.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_decimal.java
new file mode 100644
index 00000000000..36c973cecea
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_decimal.java
@@ -0,0 +1,13 @@
+public class Test_decimal
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(-27, 10);
+        if (b) {
+            assert(s.equals("-27"));
+        }
+        else {
+            assert(!s.equals("-27"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex1.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex1.class
new file mode 100644
index 00000000000..f4cb44e6360
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex1.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex1.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex1.java
new file mode 100644
index 00000000000..1fbc7f9974e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex1.java
@@ -0,0 +1,13 @@
+public class Test_hex1
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(-27, 16);
+        if (b) {
+            assert(s.equals("-1b"));
+        }
+        else {
+            assert(!s.equals("-1b"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex2.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex2.class
new file mode 100644
index 00000000000..34e32836b04
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex2.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex2.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex2.java
new file mode 100644
index 00000000000..169186c259a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex2.java
@@ -0,0 +1,13 @@
+public class Test_hex2
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MAX_VALUE, 16);
+        if (b) {
+            assert(s.equals("7fffffff"));
+        }
+        else {
+            assert(!s.equals("7fffffff"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex3.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex3.class
new file mode 100644
index 00000000000..f631570c22c
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex3.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex3.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex3.java
new file mode 100644
index 00000000000..b7fd403dcf9
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_hex3.java
@@ -0,0 +1,13 @@
+public class Test_hex3
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE + 1, 16);
+        if (b) {
+            assert(s.equals("-7fffffff"));
+        }
+        else {
+            assert(!s.equals("-7fffffff"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal1.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal1.class
new file mode 100644
index 00000000000..3a1c6f2c216
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal1.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal1.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal1.java
new file mode 100644
index 00000000000..337e09c27b4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal1.java
@@ -0,0 +1,13 @@
+public class Test_octal1
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(-23, 8);
+        if (b) {
+            assert(s.equals("-27"));
+        }
+        else {
+            assert(!s.equals("-27"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal2.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal2.class
new file mode 100644
index 00000000000..470a21e79de
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal2.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal2.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal2.java
new file mode 100644
index 00000000000..0402a5dd182
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal2.java
@@ -0,0 +1,13 @@
+public class Test_octal2
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MAX_VALUE, 8);
+        if (b) {
+            assert(s.equals("17777777777"));
+        }
+        else {
+            assert(!s.equals("17777777777"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal3.class b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal3.class
new file mode 100644
index 00000000000..f7b84bb2998
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal3.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal3.java b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal3.java
new file mode 100644
index 00000000000..b88d62ce67e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/Test_octal3.java
@@ -0,0 +1,13 @@
+public class Test_octal3
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE + 1, 8);
+        if (b) {
+            assert(s.equals("-17777777777"));
+        }
+        else {
+            assert(!s.equals("-17777777777"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary1.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary1.desc
new file mode 100644
index 00000000000..20bd5377109
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary1.desc
@@ -0,0 +1,8 @@
+CORE
+Test_binary1.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary2.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary2.desc
new file mode 100644
index 00000000000..370139d2c42
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary2.desc
@@ -0,0 +1,8 @@
+CORE
+Test_binary2.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary3.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary3.desc
new file mode 100644
index 00000000000..a4e6438623e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_binary3.desc
@@ -0,0 +1,8 @@
+CORE
+Test_binary3.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_decimal.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_decimal.desc
new file mode 100644
index 00000000000..7226334925f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_decimal.desc
@@ -0,0 +1,8 @@
+CORE
+Test_decimal.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex1.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex1.desc
new file mode 100644
index 00000000000..48d705734ac
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex1.desc
@@ -0,0 +1,8 @@
+CORE
+Test_hex1.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex2.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex2.desc
new file mode 100644
index 00000000000..89c4928e147
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex2.desc
@@ -0,0 +1,8 @@
+CORE
+Test_hex2.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex3.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex3.desc
new file mode 100644
index 00000000000..0c5ff51b802
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_hex3.desc
@@ -0,0 +1,8 @@
+CORE
+Test_hex3.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal1.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal1.desc
new file mode 100644
index 00000000000..9afe7b06279
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal1.desc
@@ -0,0 +1,8 @@
+CORE
+Test_octal1.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal2.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal2.desc
new file mode 100644
index 00000000000..aee4977a75f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal2.desc
@@ -0,0 +1,8 @@
+CORE
+Test_octal2.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal3.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal3.desc
new file mode 100644
index 00000000000..b7a5ceb3ce1
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix/test_octal3.desc
@@ -0,0 +1,8 @@
+CORE
+Test_octal3.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_binary.class b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_binary.class
new file mode 100644
index 00000000000..daae1fcce6c
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_binary.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_binary.java b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_binary.java
new file mode 100644
index 00000000000..727d93c7054
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_binary.java
@@ -0,0 +1,13 @@
+public class Test_binary
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE, 2);
+        if (b) {
+            assert(s.equals("-10000000000000000000000000000000"));
+        }
+        else {
+            assert(!s.equals("-10000000000000000000000000000000"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_hex.class b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_hex.class
new file mode 100644
index 00000000000..b568e5cab6c
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_hex.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_hex.java b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_hex.java
new file mode 100644
index 00000000000..e15bcc1d9e2
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_hex.java
@@ -0,0 +1,13 @@
+public class Test_hex
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE, 16);
+        if (b) {
+            assert(s.equals("-80000000"));
+        }
+        else {
+            assert(!s.equals("-80000000"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_octal.class b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_octal.class
new file mode 100644
index 00000000000..f8830a84878
Binary files /dev/null and b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_octal.class differ
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_octal.java b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_octal.java
new file mode 100644
index 00000000000..a6b3f53227b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/Test_octal.java
@@ -0,0 +1,13 @@
+public class Test_octal
+{
+    public static void main(Boolean b)
+    {
+        String s = Integer.toString(Integer.MIN_VALUE, 8);
+        if (b) {
+            assert(s.equals("-20000000000"));
+        }
+        else {
+            assert(!s.equals("-20000000000"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_binary.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_binary.desc
new file mode 100644
index 00000000000..d8959c329a7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_binary.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+Test_binary.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_hex.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_hex.desc
new file mode 100644
index 00000000000..324cd50051e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_hex.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+Test_hex.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_octal.desc b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_octal.desc
new file mode 100644
index 00000000000..ce0a5607186
--- /dev/null
+++ b/regression/strings-smoke-tests/java_int_to_string_with_radix_knownbug/test_octal.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+Test_octal.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_intern/test.desc b/regression/strings-smoke-tests/java_intern/test.desc
new file mode 100644
index 00000000000..c8d0eea43bd
--- /dev/null
+++ b/regression/strings-smoke-tests/java_intern/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_intern.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+--
diff --git a/regression/strings-smoke-tests/java_intern/test_intern.class b/regression/strings-smoke-tests/java_intern/test_intern.class
new file mode 100644
index 00000000000..894615c0a9a
Binary files /dev/null and b/regression/strings-smoke-tests/java_intern/test_intern.class differ
diff --git a/regression/strings-smoke-tests/java_intern/test_intern.java b/regression/strings-smoke-tests/java_intern/test_intern.java
new file mode 100644
index 00000000000..7f9d5283597
--- /dev/null
+++ b/regression/strings-smoke-tests/java_intern/test_intern.java
@@ -0,0 +1,11 @@
+public class test_intern
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s1 = "abc";
+      String s3 = "abc";
+      String x = s1.intern();
+      String y = s3.intern();
+      assert(x == y);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_last_index_of/test.desc b/regression/strings-smoke-tests/java_last_index_of/test.desc
new file mode 100644
index 00000000000..381078254cd
--- /dev/null
+++ b/regression/strings-smoke-tests/java_last_index_of/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_last_index_of.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 9.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_last_index_of/test_last_index_of.class b/regression/strings-smoke-tests/java_last_index_of/test_last_index_of.class
new file mode 100644
index 00000000000..26f5ec3a7c3
Binary files /dev/null and b/regression/strings-smoke-tests/java_last_index_of/test_last_index_of.class differ
diff --git a/regression/strings-smoke-tests/java_last_index_of/test_last_index_of.java b/regression/strings-smoke-tests/java_last_index_of/test_last_index_of.java
new file mode 100644
index 00000000000..59b9f5ab36d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_last_index_of/test_last_index_of.java
@@ -0,0 +1,11 @@
+public class test_last_index_of
+{
+    public static void main(/*String[] argv*/)
+    {
+        String s = "abcab";
+        String ab = "ab";
+        int i = s.lastIndexOf(ab);
+        assert(i == 3);
+        assert(i == 1);
+    }
+}
diff --git a/regression/strings-smoke-tests/java_last_index_of2/test.desc b/regression/strings-smoke-tests/java_last_index_of2/test.desc
new file mode 100644
index 00000000000..5348cbe7fce
--- /dev/null
+++ b/regression/strings-smoke-tests/java_last_index_of2/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_last_index_of2.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_last_index_of2/test_last_index_of2.class b/regression/strings-smoke-tests/java_last_index_of2/test_last_index_of2.class
new file mode 100644
index 00000000000..9c82a704075
Binary files /dev/null and b/regression/strings-smoke-tests/java_last_index_of2/test_last_index_of2.class differ
diff --git a/regression/strings-smoke-tests/java_last_index_of2/test_last_index_of2.java b/regression/strings-smoke-tests/java_last_index_of2/test_last_index_of2.java
new file mode 100644
index 00000000000..f533835fda4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_last_index_of2/test_last_index_of2.java
@@ -0,0 +1,8 @@
+public class test_last_index_of2
+{
+   public static void main(String[] args)
+   {
+      String letters = "automatictestcasegenerationatdiffblue";
+      assert(letters.lastIndexOf("diffblue", 25)==-1);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_last_index_of_char/test.desc b/regression/strings-smoke-tests/java_last_index_of_char/test.desc
new file mode 100644
index 00000000000..aa88fc5f6ef
--- /dev/null
+++ b/regression/strings-smoke-tests/java_last_index_of_char/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_last_index_of_char.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_last_index_of_char/test_last_index_of_char.class b/regression/strings-smoke-tests/java_last_index_of_char/test_last_index_of_char.class
new file mode 100644
index 00000000000..388717f4261
Binary files /dev/null and b/regression/strings-smoke-tests/java_last_index_of_char/test_last_index_of_char.class differ
diff --git a/regression/strings-smoke-tests/java_last_index_of_char/test_last_index_of_char.java b/regression/strings-smoke-tests/java_last_index_of_char/test_last_index_of_char.java
new file mode 100644
index 00000000000..029d59c9d68
--- /dev/null
+++ b/regression/strings-smoke-tests/java_last_index_of_char/test_last_index_of_char.java
@@ -0,0 +1,9 @@
+public class test_last_index_of_char
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "abcab";
+      int n = s.lastIndexOf('a');
+      assert(n == 3);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_length/test.desc b/regression/strings-smoke-tests/java_length/test.desc
new file mode 100644
index 00000000000..60c360eecb8
--- /dev/null
+++ b/regression/strings-smoke-tests/java_length/test.desc
@@ -0,0 +1,9 @@
+CORE
+test_length.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
+\[.*assertion\.1\] .* line 7 .*: SUCCESS
+\[.*assertion\.2\] .* line 8 .*: FAILURE
+--
diff --git a/regression/strings-smoke-tests/java_length/test_length.class b/regression/strings-smoke-tests/java_length/test_length.class
new file mode 100644
index 00000000000..9a1bd297761
Binary files /dev/null and b/regression/strings-smoke-tests/java_length/test_length.class differ
diff --git a/regression/strings-smoke-tests/java_length/test_length.java b/regression/strings-smoke-tests/java_length/test_length.java
new file mode 100644
index 00000000000..620bdc448e9
--- /dev/null
+++ b/regression/strings-smoke-tests/java_length/test_length.java
@@ -0,0 +1,10 @@
+public class test_length
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Abc");
+      int l = s.length();
+      assert(l == 3);
+      assert(l != 3);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_length2/test.class b/regression/strings-smoke-tests/java_length2/test.class
new file mode 100644
index 00000000000..8e9d3161fb5
Binary files /dev/null and b/regression/strings-smoke-tests/java_length2/test.class differ
diff --git a/regression/strings-smoke-tests/java_length2/test.desc b/regression/strings-smoke-tests/java_length2/test.desc
new file mode 100644
index 00000000000..e473b51d950
--- /dev/null
+++ b/regression/strings-smoke-tests/java_length2/test.desc
@@ -0,0 +1,10 @@
+FUTURE
+test.class
+--refine-strings --function test.check
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+This test currently fails because we do not handle the case where the argument
+'s' is null. This should be handled in the String model.
+The issue number for that is: diffblue/test-gen#500
diff --git a/regression/strings-smoke-tests/java_length2/test.java b/regression/strings-smoke-tests/java_length2/test.java
new file mode 100644
index 00000000000..e88464536e0
--- /dev/null
+++ b/regression/strings-smoke-tests/java_length2/test.java
@@ -0,0 +1,12 @@
+public class test
+{
+    public static int check(String s)
+    {
+        if(s.equals("abc")){
+            assert s.length() == 3;
+            return 0;
+        }
+        return 1;
+    }
+}
+
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test1.class b/regression/strings-smoke-tests/java_long_to_string/Test1.class
new file mode 100644
index 00000000000..5da6b2c60d9
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string/Test1.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test1.java b/regression/strings-smoke-tests/java_long_to_string/Test1.java
new file mode 100644
index 00000000000..87d68654663
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/Test1.java
@@ -0,0 +1,13 @@
+public class Test1
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(12);
+        if (b) {
+            assert(s.equals("12"));
+        }
+        else {
+            assert(!s.equals("12"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test2.class b/regression/strings-smoke-tests/java_long_to_string/Test2.class
new file mode 100644
index 00000000000..64f5f9c1d9b
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string/Test2.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test2.java b/regression/strings-smoke-tests/java_long_to_string/Test2.java
new file mode 100644
index 00000000000..501197a16cb
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/Test2.java
@@ -0,0 +1,13 @@
+public class Test2
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(-23);
+        if (b) {
+            assert(s.equals("-23"));
+        }
+        else {
+            assert(!s.equals("-23"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test3.class b/regression/strings-smoke-tests/java_long_to_string/Test3.class
new file mode 100644
index 00000000000..b191c01a7e2
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string/Test3.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test3.java b/regression/strings-smoke-tests/java_long_to_string/Test3.java
new file mode 100644
index 00000000000..9e99a48986f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/Test3.java
@@ -0,0 +1,13 @@
+public class Test3
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MAX_VALUE);
+        if (b) {
+            assert(s.equals("9223372036854775807"));
+        }
+        else {
+            assert(!s.equals("9223372036854775807"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test4.class b/regression/strings-smoke-tests/java_long_to_string/Test4.class
new file mode 100644
index 00000000000..53b23e0aaac
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string/Test4.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test4.java b/regression/strings-smoke-tests/java_long_to_string/Test4.java
new file mode 100644
index 00000000000..0436b667c4e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/Test4.java
@@ -0,0 +1,13 @@
+public class Test4
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MIN_VALUE + 1);
+        if (b) {
+            assert(s.equals("-9223372036854775807"));
+        }
+        else {
+            assert(!s.equals("-9223372036854775807"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test5.class b/regression/strings-smoke-tests/java_long_to_string/Test5.class
new file mode 100644
index 00000000000..68231cf010d
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string/Test5.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string/Test5.java b/regression/strings-smoke-tests/java_long_to_string/Test5.java
new file mode 100644
index 00000000000..ca50cb68168
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/Test5.java
@@ -0,0 +1,13 @@
+public class Test5
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(0);
+        if (b) {
+            assert(s.equals("0"));
+        }
+        else {
+            assert(!s.equals("0"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string/test1.desc b/regression/strings-smoke-tests/java_long_to_string/test1.desc
new file mode 100644
index 00000000000..88f39d5eb12
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/test1.desc
@@ -0,0 +1,8 @@
+CORE
+Test1.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string/test2.desc b/regression/strings-smoke-tests/java_long_to_string/test2.desc
new file mode 100644
index 00000000000..a4f7d628251
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/test2.desc
@@ -0,0 +1,8 @@
+THOROUGH
+Test2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string/test3.desc b/regression/strings-smoke-tests/java_long_to_string/test3.desc
new file mode 100644
index 00000000000..5e96ef2ae6d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/test3.desc
@@ -0,0 +1,8 @@
+THOROUGH
+Test3.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string/test4.desc b/regression/strings-smoke-tests/java_long_to_string/test4.desc
new file mode 100644
index 00000000000..aa12d7732f1
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/test4.desc
@@ -0,0 +1,8 @@
+THOROUGH
+Test4.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string/test5.desc b/regression/strings-smoke-tests/java_long_to_string/test5.desc
new file mode 100644
index 00000000000..08531bc36e0
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string/test5.desc
@@ -0,0 +1,8 @@
+CORE
+Test5.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary1.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary1.class
new file mode 100644
index 00000000000..1e4aab76f11
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary1.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary1.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary1.java
new file mode 100644
index 00000000000..24db3c01147
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary1.java
@@ -0,0 +1,13 @@
+public class Test_binary1
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(-23, 2);
+        if (b) {
+            assert(s.equals("-10111"));
+        }
+        else {
+            assert(!s.equals("-10111"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary2.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary2.class
new file mode 100644
index 00000000000..83a7057d5d8
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary2.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary2.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary2.java
new file mode 100644
index 00000000000..cb8d22d374d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary2.java
@@ -0,0 +1,13 @@
+public class Test_binary2
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MAX_VALUE, 2);
+        if (b) {
+            assert(s.equals("111111111111111111111111111111111111111111111111111111111111111"));
+        }
+        else {
+            assert(!s.equals("111111111111111111111111111111111111111111111111111111111111111"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary3.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary3.class
new file mode 100644
index 00000000000..aa17d8f76b6
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary3.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary3.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary3.java
new file mode 100644
index 00000000000..0e4da6d5a32
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_binary3.java
@@ -0,0 +1,13 @@
+public class Test_binary3
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MIN_VALUE + 1, 2);
+        if (b) {
+            assert(s.equals("-111111111111111111111111111111111111111111111111111111111111111"));
+        }
+        else {
+            assert(!s.equals("-111111111111111111111111111111111111111111111111111111111111111"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_decimal.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_decimal.class
new file mode 100644
index 00000000000..f69a22e0e1c
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_decimal.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_decimal.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_decimal.java
new file mode 100644
index 00000000000..1d9c9995d9b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_decimal.java
@@ -0,0 +1,13 @@
+public class Test_decimal
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(-27, 10);
+        if (b) {
+            assert(s.equals("-27"));
+        }
+        else {
+            assert(!s.equals("-27"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex1.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex1.class
new file mode 100644
index 00000000000..5b4bdc2e5f3
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex1.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex1.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex1.java
new file mode 100644
index 00000000000..87fcd77c908
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex1.java
@@ -0,0 +1,13 @@
+public class Test_hex1
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(-27, 16);
+        if (b) {
+            assert(s.equals("-1b"));
+        }
+        else {
+            assert(!s.equals("-1b"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex2.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex2.class
new file mode 100644
index 00000000000..c67d97d4ae1
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex2.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex2.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex2.java
new file mode 100644
index 00000000000..a337367ec9e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex2.java
@@ -0,0 +1,13 @@
+public class Test_hex2
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MAX_VALUE, 16);
+        if (b) {
+            assert(s.equals("7fffffffffffffff"));
+        }
+        else {
+            assert(!s.equals("7fffffffffffffff"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex3.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex3.class
new file mode 100644
index 00000000000..e8439e883d8
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex3.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex3.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex3.java
new file mode 100644
index 00000000000..5803911a06c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_hex3.java
@@ -0,0 +1,13 @@
+public class Test_hex3
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MIN_VALUE + 1, 16);
+        if (b) {
+            assert(s.equals("-7fffffffffffffff"));
+        }
+        else {
+            assert(!s.equals("-7fffffffffffffff"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal1.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal1.class
new file mode 100644
index 00000000000..964eec8439c
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal1.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal1.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal1.java
new file mode 100644
index 00000000000..a39f0877692
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal1.java
@@ -0,0 +1,13 @@
+public class Test_octal1
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(-23, 8);
+        if (b) {
+            assert(s.equals("-27"));
+        }
+        else {
+            assert(!s.equals("-27"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal2.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal2.class
new file mode 100644
index 00000000000..d71ea9a161a
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal2.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal2.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal2.java
new file mode 100644
index 00000000000..abe3c9b5379
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal2.java
@@ -0,0 +1,13 @@
+public class Test_octal2
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MAX_VALUE, 8);
+        if (b) {
+            assert(s.equals("777777777777777777777"));
+        }
+        else {
+            assert(!s.equals("777777777777777777777"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal3.class b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal3.class
new file mode 100644
index 00000000000..15b78163b62
Binary files /dev/null and b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal3.class differ
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal3.java b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal3.java
new file mode 100644
index 00000000000..ef675fa7946
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/Test_octal3.java
@@ -0,0 +1,13 @@
+public class Test_octal3
+{
+    public static void main(Boolean b)
+    {
+        String s = Long.toString(Long.MIN_VALUE + 1, 8);
+        if (b) {
+            assert(s.equals("-777777777777777777777"));
+        }
+        else {
+            assert(!s.equals("-777777777777777777777"));
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary1.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary1.desc
new file mode 100644
index 00000000000..bfdddd48786
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary1.desc
@@ -0,0 +1,8 @@
+THOROUGH
+Test_binary1.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary2.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary2.desc
new file mode 100644
index 00000000000..7cabc082721
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary2.desc
@@ -0,0 +1,8 @@
+THOROUGH
+Test_binary2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary3.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary3.desc
new file mode 100644
index 00000000000..cd10cf15647
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_binary3.desc
@@ -0,0 +1,8 @@
+THOROUGH
+Test_binary3.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_decimal.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_decimal.desc
new file mode 100644
index 00000000000..7226334925f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_decimal.desc
@@ -0,0 +1,8 @@
+CORE
+Test_decimal.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex1.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex1.desc
new file mode 100644
index 00000000000..48d705734ac
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex1.desc
@@ -0,0 +1,8 @@
+CORE
+Test_hex1.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex2.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex2.desc
new file mode 100644
index 00000000000..d21d067e620
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex2.desc
@@ -0,0 +1,8 @@
+CORE
+Test_hex2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex3.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex3.desc
new file mode 100644
index 00000000000..0c5ff51b802
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_hex3.desc
@@ -0,0 +1,8 @@
+CORE
+Test_hex3.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal1.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal1.desc
new file mode 100644
index 00000000000..8188ebc0ee9
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal1.desc
@@ -0,0 +1,8 @@
+CORE
+Test_octal1.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal2.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal2.desc
new file mode 100644
index 00000000000..3884ae1fa9f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal2.desc
@@ -0,0 +1,8 @@
+CORE
+Test_octal2.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal3.desc b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal3.desc
new file mode 100644
index 00000000000..527357b801e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_long_to_string_with_radix/test_octal3.desc
@@ -0,0 +1,8 @@
+CORE
+Test_octal3.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+assertion.* line 7 .* SUCCESS$
+assertion.* line 10 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_object_allocation/test.class b/regression/strings-smoke-tests/java_object_allocation/test.class
new file mode 100644
index 00000000000..fce0d46166d
Binary files /dev/null and b/regression/strings-smoke-tests/java_object_allocation/test.class differ
diff --git a/regression/strings-smoke-tests/java_object_allocation/test.desc b/regression/strings-smoke-tests/java_object_allocation/test.desc
new file mode 100644
index 00000000000..fe10bf71202
--- /dev/null
+++ b/regression/strings-smoke-tests/java_object_allocation/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--refine-strings --show-goto-functions
+// Enable multi-line checking
+activate-multi-line-match
+EXIT=0
+SIGNAL=0
+char \([*]malloc_site.[0-9]*\)\[INFINITY\(\)\];\n\s*//.*\n\s*malloc_site.[0-9]*\s*=\s*MALLOC\(char \[INFINITY\(\)\], 2ull? \* INFINITY\(\)\);\n\s*//.*\n\s*cprover_string_array.[0-9]*\s*=\s*malloc_site.\d*;
+--
diff --git a/regression/strings-smoke-tests/java_object_allocation/test.java b/regression/strings-smoke-tests/java_object_allocation/test.java
new file mode 100644
index 00000000000..9122dd4dfaf
--- /dev/null
+++ b/regression/strings-smoke-tests/java_object_allocation/test.java
@@ -0,0 +1,9 @@
+public class test
+{
+   public static void check()
+   {
+      String s = new String("foo");
+      String t = new String("bar");
+      String u = s.concat(t);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_parseint/Test1.class b/regression/strings-smoke-tests/java_parseint/Test1.class
new file mode 100644
index 00000000000..9394e390d14
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint/Test1.class differ
diff --git a/regression/strings-smoke-tests/java_parseint/Test1.java b/regression/strings-smoke-tests/java_parseint/Test1.java
new file mode 100644
index 00000000000..13041ba4f85
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint/Test1.java
@@ -0,0 +1,14 @@
+public class Test1
+{
+    public static void main(Boolean b)
+    {
+        String twelve = new String("12");
+        int parsed1 = Integer.parseInt(twelve);
+        if (b) {
+            assert(parsed1 == 12);
+        }
+        else {
+            assert(parsed1 != 12);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint/Test2.class b/regression/strings-smoke-tests/java_parseint/Test2.class
new file mode 100644
index 00000000000..8c1238fe288
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint/Test2.class differ
diff --git a/regression/strings-smoke-tests/java_parseint/Test2.java b/regression/strings-smoke-tests/java_parseint/Test2.java
new file mode 100644
index 00000000000..38d17372ed1
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint/Test2.java
@@ -0,0 +1,15 @@
+public class Test2
+{
+    public static void main(Boolean b)
+    {
+        // 2^31-1, max value of Integer
+        String max_int = new String("2147483647");
+        int parsed2 = Integer.parseInt(max_int);
+        if (b) {
+            assert(parsed2 == 2147483647);
+        }
+        else{
+            assert(parsed2 != 2147483647);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint/Test3.class b/regression/strings-smoke-tests/java_parseint/Test3.class
new file mode 100644
index 00000000000..c3b2e364a6c
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint/Test3.class differ
diff --git a/regression/strings-smoke-tests/java_parseint/Test3.java b/regression/strings-smoke-tests/java_parseint/Test3.java
new file mode 100644
index 00000000000..946e63adc12
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint/Test3.java
@@ -0,0 +1,10 @@
+public class Test3
+{
+    public static void main(String input_string)
+    {
+        int parsed1 = Integer.parseInt(input_string);
+        if (parsed1 == 2) {
+            assert(false);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint/test1.desc b/regression/strings-smoke-tests/java_parseint/test1.desc
new file mode 100644
index 00000000000..5d48a0d6aad
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint/test1.desc
@@ -0,0 +1,7 @@
+CORE
+Test1.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
diff --git a/regression/strings-smoke-tests/java_parseint/test2.desc b/regression/strings-smoke-tests/java_parseint/test2.desc
new file mode 100644
index 00000000000..16f6de423bf
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint/test2.desc
@@ -0,0 +1,7 @@
+CORE
+Test2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 12.* FAILURE$
diff --git a/regression/strings-smoke-tests/java_parseint/test3.desc b/regression/strings-smoke-tests/java_parseint/test3.desc
new file mode 100644
index 00000000000..bb643427dd2
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint/test3.desc
@@ -0,0 +1,6 @@
+CORE
+Test3.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 7.* FAILURE$
diff --git a/regression/strings-smoke-tests/java_parseint_knownbug/Test.class b/regression/strings-smoke-tests/java_parseint_knownbug/Test.class
new file mode 100644
index 00000000000..cdeb074b580
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_knownbug/Test.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_knownbug/Test.java b/regression/strings-smoke-tests/java_parseint_knownbug/Test.java
new file mode 100644
index 00000000000..92d0ababf6c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_knownbug/Test.java
@@ -0,0 +1,16 @@
+public class Test
+{
+    public static void main(Boolean b)
+    {
+        // -2^31, min value of Integer, and longest string we could have without
+        // leading zeroes
+        String min_int = new String("-2147483648");
+        int parsed3 = Integer.parseInt(min_int);
+        if (b) {
+            assert(parsed3 == -2147483648);
+        }
+        else {
+            assert(parsed3 != -2147483648);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_knownbug/test.desc b/regression/strings-smoke-tests/java_parseint_knownbug/test.desc
new file mode 100644
index 00000000000..76feb55c355
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_knownbug/test.desc
@@ -0,0 +1,10 @@
+KNOWNBUG
+Test.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 10.* SUCCESS$
+^\[.*assertion.2\].* line 13.* FAILURE$
+--
+--
+Issue #664 is about turning these tests on
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test1.class b/regression/strings-smoke-tests/java_parseint_with_radix/Test1.class
new file mode 100644
index 00000000000..357e4e8aa62
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix/Test1.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test1.java b/regression/strings-smoke-tests/java_parseint_with_radix/Test1.java
new file mode 100644
index 00000000000..d909b13c746
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/Test1.java
@@ -0,0 +1,14 @@
+public class Test1
+{
+    public static void main(Boolean b)
+    {
+        String str1 = new String("F");
+        int parsed1 = Integer.parseInt(str1, 16);
+        if (b) {
+            assert(parsed1 == 15);
+        }
+        else {
+            assert(parsed1 != 15);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test2.class b/regression/strings-smoke-tests/java_parseint_with_radix/Test2.class
new file mode 100644
index 00000000000..56be994524e
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix/Test2.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test2.java b/regression/strings-smoke-tests/java_parseint_with_radix/Test2.java
new file mode 100644
index 00000000000..5a67b9f22b8
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/Test2.java
@@ -0,0 +1,14 @@
+public class Test2
+{
+    public static void main(Boolean b)
+    {
+        String str2 = new String("123");
+        int parsed2 = Integer.parseInt(str2, 10);
+        if (b) {
+            assert(parsed2 == 123);
+        }
+        else {
+            assert(parsed2 != 123);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test3.class b/regression/strings-smoke-tests/java_parseint_with_radix/Test3.class
new file mode 100644
index 00000000000..6c6390c1dbb
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix/Test3.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test3.java b/regression/strings-smoke-tests/java_parseint_with_radix/Test3.java
new file mode 100644
index 00000000000..1ad62071461
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/Test3.java
@@ -0,0 +1,14 @@
+public class Test3
+{
+    public static void main(Boolean b)
+    {
+        String str3 = new String("77");
+        int parsed3 = Integer.parseInt(str3, 8);
+        if (b) {
+            assert(parsed3 == 63);
+        }
+        else {
+            assert(parsed3 != 63);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test4.class b/regression/strings-smoke-tests/java_parseint_with_radix/Test4.class
new file mode 100644
index 00000000000..5a6d40acd40
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix/Test4.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test4.java b/regression/strings-smoke-tests/java_parseint_with_radix/Test4.java
new file mode 100644
index 00000000000..06e69e10938
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/Test4.java
@@ -0,0 +1,14 @@
+public class Test4
+{
+    public static void main(Boolean b)
+    {
+        String str4 = new String("-101");
+        int parsed4 = Integer.parseInt(str4, 2);
+        if (b) {
+            assert(parsed4 == -5);
+        }
+        else {
+            assert(parsed4 != -5);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test5.class b/regression/strings-smoke-tests/java_parseint_with_radix/Test5.class
new file mode 100644
index 00000000000..06d65ec696e
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix/Test5.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test5.java b/regression/strings-smoke-tests/java_parseint_with_radix/Test5.java
new file mode 100644
index 00000000000..0769189ce4c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/Test5.java
@@ -0,0 +1,14 @@
+public class Test5
+{
+    public static void main(Boolean b)
+    {
+        String str5 = new String("00aB");
+        int parsed5 = Integer.parseInt(str5, 16);
+        if (b) {
+            assert(parsed5 == 171);
+        }
+        else {
+            assert(parsed5 != 171);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test6.class b/regression/strings-smoke-tests/java_parseint_with_radix/Test6.class
new file mode 100644
index 00000000000..1309be8b84f
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix/Test6.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/Test6.java b/regression/strings-smoke-tests/java_parseint_with_radix/Test6.java
new file mode 100644
index 00000000000..73dbc1703e7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/Test6.java
@@ -0,0 +1,15 @@
+public class Test6
+{
+    public static void main(Boolean b)
+    {
+        // 2^31-1, max value of Integer
+        String str1 = new String("7FFFFFFF");
+        int parsed1 = Integer.parseInt(str1, 16);
+        if (b) {
+            assert(parsed1 == 2147483647);
+        }
+        else{
+            assert(parsed1 != 2147483647);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/test1.desc b/regression/strings-smoke-tests/java_parseint_with_radix/test1.desc
new file mode 100644
index 00000000000..0ab380c3cde
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/test1.desc
@@ -0,0 +1,8 @@
+CORE
+Test1.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/test2.desc b/regression/strings-smoke-tests/java_parseint_with_radix/test2.desc
new file mode 100644
index 00000000000..0b6a1a2dd97
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/test2.desc
@@ -0,0 +1,8 @@
+CORE
+Test2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/test3.desc b/regression/strings-smoke-tests/java_parseint_with_radix/test3.desc
new file mode 100644
index 00000000000..7b68147d90b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/test3.desc
@@ -0,0 +1,8 @@
+CORE
+Test3.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/test4.desc b/regression/strings-smoke-tests/java_parseint_with_radix/test4.desc
new file mode 100644
index 00000000000..8c775500aaa
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/test4.desc
@@ -0,0 +1,8 @@
+CORE
+Test4.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/test5.desc b/regression/strings-smoke-tests/java_parseint_with_radix/test5.desc
new file mode 100644
index 00000000000..2b0338b1c0c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/test5.desc
@@ -0,0 +1,8 @@
+CORE
+Test5.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix/test6.desc b/regression/strings-smoke-tests/java_parseint_with_radix/test6.desc
new file mode 100644
index 00000000000..71b3d8423e4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix/test6.desc
@@ -0,0 +1,9 @@
+CORE
+Test6.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 12.* FAILURE$
+--
+--
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/Test.class b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/Test.class
new file mode 100644
index 00000000000..5e30e2f707e
Binary files /dev/null and b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/Test.class differ
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/Test.java b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/Test.java
new file mode 100644
index 00000000000..6967518352e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/Test.java
@@ -0,0 +1,15 @@
+public class Test
+{
+    public static void main(Boolean b)
+    {
+        // -2^31, min value of Integer, and longest string we could have
+        String str = new String("-100000000000000000000000000000000");
+        int parsed = Integer.parseInt(str, 2);
+        if (b) {
+            assert(parsed == -2147483648);
+        }
+        else {
+            assert(parsed != -2147483648);
+        }
+   }
+}
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/output b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/output
new file mode 100644
index 00000000000..dfb2f48b2cf
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/output
@@ -0,0 +1,164 @@
+CBMC version 5.7 64-bit x86_64 linux
+Parsing test_parseint_with_radix.class
+Java main class: test_parseint_with_radix
+Converting
+Generating GOTO Program
+Adding CPROVER library (x86_64)
+Removal of function pointers and virtual functions
+Partial Inlining
+Generic Property Instrumentation
+Starting Bounded Model Checking
+Unwinding loop __CPROVER__start.0 iteration 1  thread 0
+Unwinding loop __CPROVER__start.0 iteration 2  thread 0
+Unwinding loop __CPROVER__start.0 iteration 3  thread 0
+Unwinding loop __CPROVER__start.0 iteration 4  thread 0
+Unwinding loop __CPROVER__start.0 iteration 5  thread 0
+Unwinding recursion java::test_parseint_with_radix::clinit_wrapper iteration 1
+Unwinding recursion java::test_parseint_with_radix::clinit_wrapper iteration 1
+size of program expression: 530 steps
+simple slicing removed 50 assignments
+Generated 68 VCC(s), 9 remaining after simplification
+Passing problem to string refinement loop with MiniSAT 2.2.1 without simplifier
+converting SSA
+Running string refinement loop with MiniSAT 2.2.1 without simplifier
+BV-Refinement: post-processing
+BV-Refinement: iteration 1
+54337 variables, 39117 clauses
+SAT checker inconsistent: instance is UNSATISFIABLE
+BV-Refinement: got UNSAT, and the proof passes => UNSAT
+Total iterations: 1
+BV-Refinement: post-processing
+BV-Refinement: iteration 1
+54337 variables, 39117 clauses
+SAT checker inconsistent: instance is UNSATISFIABLE
+BV-Refinement: got UNSAT, and the proof passes => UNSAT
+Total iterations: 1
+Runtime decision procedure: 0.386s
+
+** Results:
+[pointer_dereference.1] reference is null in *stub_ignored_arg1: SUCCESS
+[pointer_dereference.2] reference is null in *stub_ignored_arg1->data: SUCCESS
+[pointer_dereference.3] reference is null in *cprover_string_array$7: SUCCESS
+[pointer_dereference.4] reference is null in *this: SUCCESS
+[pointer_dereference.5] reference is null in *stub_ignored_arg0: SUCCESS
+[pointer_dereference.6] reference is null in *stub_ignored_arg0->data: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.1] reference is null in *args: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.2] reference is null in *new_tmp0: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.3] reference is null in *new_tmp2: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.assertion.1] assertion at file test_parseint_with_radix.java line 9 function java::test_parseint_with_radix.main:([Ljava/lang/String;)V bytecode-index 20: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.null-pointer-exception.1] Throw null: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.4] reference is null in *new_tmp3: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.assertion.2] assertion at file test_parseint_with_radix.java line 10 function java::test_parseint_with_radix.main:([Ljava/lang/String;)V bytecode-index 29: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.null-pointer-exception.2] Throw null: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.5] reference is null in *args: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.6] reference is null in *new_tmp4: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.7] reference is null in *new_tmp6: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.assertion.3] assertion at file test_parseint_with_radix.java line 16 function java::test_parseint_with_radix.main:([Ljava/lang/String;)V bytecode-index 52: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.null-pointer-exception.3] Throw null: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.8] reference is null in *new_tmp7: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.assertion.4] assertion at file test_parseint_with_radix.java line 17 function java::test_parseint_with_radix.main:([Ljava/lang/String;)V bytecode-index 61: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.null-pointer-exception.4] Throw null: SUCCESS
+[pointer_dereference.7] reference is null in *this: SUCCESS
+[array-create-negative-size.1] Array size should be >= 0: SUCCESS
+[pointer_dereference.8] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.9] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.10] reference is null in *this: SUCCESS
+[pointer_dereference.11] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.12] reference is null in *this: SUCCESS
+[pointer_dereference.13] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.14] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.15] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.16] reference is null in *this: SUCCESS
+[array-create-negative-size.2] Array size should be >= 0: SUCCESS
+[pointer_dereference.17] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.18] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.19] reference is null in *this: SUCCESS
+[pointer_dereference.20] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.21] reference is null in *this: SUCCESS
+[pointer_dereference.22] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.23] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.24] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.25] reference is null in *this: SUCCESS
+[array-create-negative-size.3] Array size should be >= 0: SUCCESS
+[pointer_dereference.26] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.27] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.28] reference is null in *this: SUCCESS
+[pointer_dereference.29] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.30] reference is null in *this: SUCCESS
+[pointer_dereference.31] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.32] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.33] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.34] reference is null in *this: SUCCESS
+[array-create-negative-size.4] Array size should be >= 0: SUCCESS
+[pointer_dereference.35] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.36] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.37] reference is null in *this: SUCCESS
+[pointer_dereference.38] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.39] reference is null in *this: SUCCESS
+[pointer_dereference.40] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.41] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.42] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.43] reference is null in *this: SUCCESS
+[array-create-negative-size.5] Array size should be >= 0: SUCCESS
+[pointer_dereference.44] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.45] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.46] reference is null in *this: SUCCESS
+[pointer_dereference.47] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.48] reference is null in *this: SUCCESS
+[pointer_dereference.49] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.50] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.51] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.52] reference is null in *this: SUCCESS
+[array-create-negative-size.6] Array size should be >= 0: SUCCESS
+[pointer_dereference.53] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.54] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.55] reference is null in *this: SUCCESS
+[pointer_dereference.56] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.57] reference is null in *this: SUCCESS
+[pointer_dereference.58] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.59] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.60] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.61] reference is null in *this: SUCCESS
+[array-create-negative-size.7] Array size should be >= 0: SUCCESS
+[pointer_dereference.62] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.63] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.64] reference is null in *this: SUCCESS
+[pointer_dereference.65] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.66] reference is null in *this: SUCCESS
+[pointer_dereference.67] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.68] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.69] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.70] reference is null in *this: SUCCESS
+[array-create-negative-size.8] Array size should be >= 0: SUCCESS
+[pointer_dereference.71] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.72] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.73] reference is null in *this: SUCCESS
+[pointer_dereference.74] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.75] reference is null in *this: SUCCESS
+[pointer_dereference.76] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.77] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.78] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.79] reference is null in *this: SUCCESS
+[array-create-negative-size.9] Array size should be >= 0: SUCCESS
+[pointer_dereference.80] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.81] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.82] reference is null in *this: SUCCESS
+[pointer_dereference.83] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.84] reference is null in *this: SUCCESS
+[pointer_dereference.85] reference is null in *cloned_array: SUCCESS
+[pointer_dereference.86] reference is null in cloned_array->data[index]: SUCCESS
+[pointer_dereference.87] reference is null in this->data[index]: SUCCESS
+[pointer_dereference.88] reference is null in *args: SUCCESS
+[pointer_dereference.89] reference is null in *args: SUCCESS
+[pointer_dereference.90] reference is null in *args: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.9] reference is null in *args: SUCCESS
+[pointer_dereference.91] reference is null in *args: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.10] reference is null in array_data_init$10[array_init_iter$11]: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.11] reference is null in *malloc_site$12: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.12] reference is null in *malloc_site$12: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.13] reference is null in *malloc_site$12: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.14] reference is null in *malloc_site$12: SUCCESS
+[java::test_parseint_with_radix.main:([Ljava/lang/String;)V.pointer_dereference.15] reference is null in *malloc_site$13: SUCCESS
+
+** 0 of 123 failed (1 iteration)
+VERIFICATION SUCCESSFUL
diff --git a/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/test.desc b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/test.desc
new file mode 100644
index 00000000000..b0af402d3bd
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parseint_with_radix_knownbug/test.desc
@@ -0,0 +1,10 @@
+KNOWNBUG
+Test2.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 12.* FAILURE$
+--
+--
+Issue #664 is about turning these tests on
diff --git a/regression/strings-smoke-tests/java_parselong/Test_binary_min.class b/regression/strings-smoke-tests/java_parselong/Test_binary_min.class
new file mode 100644
index 00000000000..8ad0ba0388b
Binary files /dev/null and b/regression/strings-smoke-tests/java_parselong/Test_binary_min.class differ
diff --git a/regression/strings-smoke-tests/java_parselong/Test_binary_min.java b/regression/strings-smoke-tests/java_parselong/Test_binary_min.java
new file mode 100644
index 00000000000..01f265c364c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/Test_binary_min.java
@@ -0,0 +1,15 @@
+public class Test_binary_min
+{
+    public static void main(boolean b)
+    {
+        // -2^63+1, because we currently can't cope with -2^63
+        String str = new String("-111111111111111111111111111111111111111111111111111111111111111");
+        long parsed = Long.parseLong(str, 2);
+        if (b) {
+            assert(parsed == -9223372036854775807L);
+        }
+        else {
+            assert(parsed != -9223372036854775807L);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parselong/Test_decimal_max.class b/regression/strings-smoke-tests/java_parselong/Test_decimal_max.class
new file mode 100644
index 00000000000..35313e14aea
Binary files /dev/null and b/regression/strings-smoke-tests/java_parselong/Test_decimal_max.class differ
diff --git a/regression/strings-smoke-tests/java_parselong/Test_decimal_max.java b/regression/strings-smoke-tests/java_parselong/Test_decimal_max.java
new file mode 100644
index 00000000000..ec7bfd25266
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/Test_decimal_max.java
@@ -0,0 +1,15 @@
+public class Test_decimal_max
+{
+    public static void main(boolean b)
+    {
+        // 2^63+1
+        String str = new String("9223372036854775807");
+        long parsed = Long.parseLong(str);
+        if (b) {
+            assert(parsed == 9223372036854775807L);
+        }
+        else {
+            assert(parsed != 9223372036854775807L);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parselong/Test_decimal_min.class b/regression/strings-smoke-tests/java_parselong/Test_decimal_min.class
new file mode 100644
index 00000000000..8260f5d3e60
Binary files /dev/null and b/regression/strings-smoke-tests/java_parselong/Test_decimal_min.class differ
diff --git a/regression/strings-smoke-tests/java_parselong/Test_decimal_min.java b/regression/strings-smoke-tests/java_parselong/Test_decimal_min.java
new file mode 100644
index 00000000000..0d7c53694f7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/Test_decimal_min.java
@@ -0,0 +1,15 @@
+public class Test_decimal_min
+{
+    public static void main(boolean b)
+    {
+        // -2^63+1, because we currently can't cope with -2^63
+        String str = new String("-9223372036854775807");
+        long parsed = Long.parseLong(str, 10);
+        if (b) {
+            assert(parsed == -9223372036854775807L);
+        }
+        else {
+            assert(parsed != -9223372036854775807L);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parselong/Test_hex.class b/regression/strings-smoke-tests/java_parselong/Test_hex.class
new file mode 100644
index 00000000000..e65697c2635
Binary files /dev/null and b/regression/strings-smoke-tests/java_parselong/Test_hex.class differ
diff --git a/regression/strings-smoke-tests/java_parselong/Test_hex.java b/regression/strings-smoke-tests/java_parselong/Test_hex.java
new file mode 100644
index 00000000000..f42b5319f7b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/Test_hex.java
@@ -0,0 +1,14 @@
+public class Test_hex
+{
+    public static void main(boolean b)
+    {
+        String str = new String("+00AbCdEf0123");
+        long parsed = Long.parseLong(str, 16);
+        if (b) {
+            assert(parsed == 737894400291L);
+        }
+        else {
+            assert(parsed != 737894400291L);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parselong/Test_octal.class b/regression/strings-smoke-tests/java_parselong/Test_octal.class
new file mode 100644
index 00000000000..3b368c7b9cd
Binary files /dev/null and b/regression/strings-smoke-tests/java_parselong/Test_octal.class differ
diff --git a/regression/strings-smoke-tests/java_parselong/Test_octal.java b/regression/strings-smoke-tests/java_parselong/Test_octal.java
new file mode 100644
index 00000000000..c7358417154
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/Test_octal.java
@@ -0,0 +1,14 @@
+public class Test_octal
+{
+    public static void main(boolean b)
+    {
+        String str = new String("7654321076543210");
+        long parsed = Long.parseLong(str, 8);
+        if (b) {
+            assert(parsed == 275730608604808L);
+        }
+        else {
+            assert(parsed != 275730608604808L);
+        }
+    }
+}
diff --git a/regression/strings-smoke-tests/java_parselong/test_binary_min.desc b/regression/strings-smoke-tests/java_parselong/test_binary_min.desc
new file mode 100644
index 00000000000..9fa189f76cf
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/test_binary_min.desc
@@ -0,0 +1,9 @@
+CORE
+Test_binary_min.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 12.* FAILURE$
+--
+--
diff --git a/regression/strings-smoke-tests/java_parselong/test_decimal_max.desc b/regression/strings-smoke-tests/java_parselong/test_decimal_max.desc
new file mode 100644
index 00000000000..25795287397
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/test_decimal_max.desc
@@ -0,0 +1,9 @@
+CORE
+Test_decimal_max.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 12.* FAILURE$
+--
+--
diff --git a/regression/strings-smoke-tests/java_parselong/test_decimal_min.desc b/regression/strings-smoke-tests/java_parselong/test_decimal_min.desc
new file mode 100644
index 00000000000..95a847bf862
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/test_decimal_min.desc
@@ -0,0 +1,9 @@
+CORE
+Test_decimal_min.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 9.* SUCCESS$
+^\[.*assertion.2\].* line 12.* FAILURE$
+--
+--
diff --git a/regression/strings-smoke-tests/java_parselong/test_hex.desc b/regression/strings-smoke-tests/java_parselong/test_hex.desc
new file mode 100644
index 00000000000..efae1994f9e
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/test_hex.desc
@@ -0,0 +1,9 @@
+CORE
+Test_hex.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
+--
diff --git a/regression/strings-smoke-tests/java_parselong/test_octal.desc b/regression/strings-smoke-tests/java_parselong/test_octal.desc
new file mode 100644
index 00000000000..72dc00545cb
--- /dev/null
+++ b/regression/strings-smoke-tests/java_parselong/test_octal.desc
@@ -0,0 +1,9 @@
+CORE
+Test_octal.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
+--
+--
diff --git a/regression/strings-smoke-tests/java_replace/test.desc b/regression/strings-smoke-tests/java_replace/test.desc
new file mode 100644
index 00000000000..542ed1630b5
--- /dev/null
+++ b/regression/strings-smoke-tests/java_replace/test.desc
@@ -0,0 +1,10 @@
+FUTURE
+test_replace.class
+--refine-strings --string-max-length 100
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
+diffblue/test-gen#256
+This test is only effective with a model of
+java.lang.String.replace(LCharSequence; LCharSequence).
diff --git a/regression/strings-smoke-tests/java_replace/test_replace.class b/regression/strings-smoke-tests/java_replace/test_replace.class
new file mode 100644
index 00000000000..d15509ee8ac
Binary files /dev/null and b/regression/strings-smoke-tests/java_replace/test_replace.class differ
diff --git a/regression/strings-smoke-tests/java_replace/test_replace.java b/regression/strings-smoke-tests/java_replace/test_replace.java
new file mode 100644
index 00000000000..07e7ac036b9
--- /dev/null
+++ b/regression/strings-smoke-tests/java_replace/test_replace.java
@@ -0,0 +1,13 @@
+public class test_replace
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("abcabd");
+      String u = s.replace("d","z");
+      System.out.println(u);
+      assert(u.equals("abcabz"));
+      String v = u.replace("ab","w");
+      System.out.println(v);
+      assert(v.equals("wcwz"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_replace_char/test.desc b/regression/strings-smoke-tests/java_replace_char/test.desc
new file mode 100644
index 00000000000..5c336326e5d
--- /dev/null
+++ b/regression/strings-smoke-tests/java_replace_char/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_replace_char.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_replace_char/test_replace_char.class b/regression/strings-smoke-tests/java_replace_char/test_replace_char.class
new file mode 100644
index 00000000000..64626b3b09d
Binary files /dev/null and b/regression/strings-smoke-tests/java_replace_char/test_replace_char.class differ
diff --git a/regression/strings-smoke-tests/java_replace_char/test_replace_char.java b/regression/strings-smoke-tests/java_replace_char/test_replace_char.java
new file mode 100644
index 00000000000..82a023924e2
--- /dev/null
+++ b/regression/strings-smoke-tests/java_replace_char/test_replace_char.java
@@ -0,0 +1,9 @@
+public class test_replace_char
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("abcabd");
+      String t = s.replace('b','m');
+      assert(t.equals("amcamd"));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_set_char_at/test.desc b/regression/strings-smoke-tests/java_set_char_at/test.desc
new file mode 100644
index 00000000000..1c471d0194a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_set_char_at/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_set_char_at.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_set_char_at/test_set_char_at.class b/regression/strings-smoke-tests/java_set_char_at/test_set_char_at.class
new file mode 100644
index 00000000000..6e843afbe2a
Binary files /dev/null and b/regression/strings-smoke-tests/java_set_char_at/test_set_char_at.class differ
diff --git a/regression/strings-smoke-tests/java_set_char_at/test_set_char_at.java b/regression/strings-smoke-tests/java_set_char_at/test_set_char_at.java
new file mode 100644
index 00000000000..fd1d1fbf9e2
--- /dev/null
+++ b/regression/strings-smoke-tests/java_set_char_at/test_set_char_at.java
@@ -0,0 +1,13 @@
+public class test_set_char_at
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Abc");
+      char c = s.charAt(1);
+      StringBuilder sb = new StringBuilder(s);
+      sb.setCharAt(1,'w');
+      s = sb.toString();
+      assert(s.equals("Awc"));
+      assert(s.charAt(2)=='c');
+   }
+}
diff --git a/regression/strings-smoke-tests/java_set_length/test.desc b/regression/strings-smoke-tests/java_set_length/test.desc
new file mode 100644
index 00000000000..d19eb265fa4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_set_length/test.desc
@@ -0,0 +1,9 @@
+CORE
+test_set_length.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 9.* SUCCESS$
+^\[.*assertion.3\].* line 10.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_set_length/test_set_length.class b/regression/strings-smoke-tests/java_set_length/test_set_length.class
new file mode 100644
index 00000000000..8cb9e416191
Binary files /dev/null and b/regression/strings-smoke-tests/java_set_length/test_set_length.class differ
diff --git a/regression/strings-smoke-tests/java_set_length/test_set_length.java b/regression/strings-smoke-tests/java_set_length/test_set_length.java
new file mode 100644
index 00000000000..5894b27beeb
--- /dev/null
+++ b/regression/strings-smoke-tests/java_set_length/test_set_length.java
@@ -0,0 +1,12 @@
+public class test_set_length
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder s = new StringBuilder("abc");
+      s.setLength(10);
+      String t = s.toString();
+      assert(t.startsWith("abc"));
+      assert(t.length() == 10);
+      assert(t.length() == 3);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_starts_with/test.desc b/regression/strings-smoke-tests/java_starts_with/test.desc
new file mode 100644
index 00000000000..ec6b84102f2
--- /dev/null
+++ b/regression/strings-smoke-tests/java_starts_with/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_starts_with.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 8.* SUCCESS$
+^\[.*assertion.2\].* line 9.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_starts_with/test_starts_with.class b/regression/strings-smoke-tests/java_starts_with/test_starts_with.class
new file mode 100644
index 00000000000..da1decd8d35
Binary files /dev/null and b/regression/strings-smoke-tests/java_starts_with/test_starts_with.class differ
diff --git a/regression/strings-smoke-tests/java_starts_with/test_starts_with.java b/regression/strings-smoke-tests/java_starts_with/test_starts_with.java
new file mode 100644
index 00000000000..aba79d846c0
--- /dev/null
+++ b/regression/strings-smoke-tests/java_starts_with/test_starts_with.java
@@ -0,0 +1,11 @@
+public class test_starts_with
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Abcd");
+      String pref = "Ab";
+      String bad_pref = "bc";
+      assert(s.startsWith(pref));
+      assert(s.startsWith(bad_pref));
+   }
+}
diff --git a/regression/strings-smoke-tests/java_string_builder_length/test.desc b/regression/strings-smoke-tests/java_string_builder_length/test.desc
new file mode 100644
index 00000000000..2a37e02a36c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_string_builder_length/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_sb_length.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_string_builder_length/test_sb_length.class b/regression/strings-smoke-tests/java_string_builder_length/test_sb_length.class
new file mode 100644
index 00000000000..cfc35874d26
Binary files /dev/null and b/regression/strings-smoke-tests/java_string_builder_length/test_sb_length.class differ
diff --git a/regression/strings-smoke-tests/java_string_builder_length/test_sb_length.java b/regression/strings-smoke-tests/java_string_builder_length/test_sb_length.java
new file mode 100644
index 00000000000..b616749ffb4
--- /dev/null
+++ b/regression/strings-smoke-tests/java_string_builder_length/test_sb_length.java
@@ -0,0 +1,9 @@
+public class test_sb_length
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder x = new StringBuilder("abc");
+      x.append("de");
+      assert(x.length() == 5);
+   }
+}
diff --git a/regression/strings-smoke-tests/java_subsequence/test.desc b/regression/strings-smoke-tests/java_subsequence/test.desc
new file mode 100644
index 00000000000..df3cc28619f
--- /dev/null
+++ b/regression/strings-smoke-tests/java_subsequence/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_subsequence.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_subsequence/test_subsequence.class b/regression/strings-smoke-tests/java_subsequence/test_subsequence.class
new file mode 100644
index 00000000000..0f8410939e1
Binary files /dev/null and b/regression/strings-smoke-tests/java_subsequence/test_subsequence.class differ
diff --git a/regression/strings-smoke-tests/java_subsequence/test_subsequence.java b/regression/strings-smoke-tests/java_subsequence/test_subsequence.java
new file mode 100644
index 00000000000..4d8d79cb381
--- /dev/null
+++ b/regression/strings-smoke-tests/java_subsequence/test_subsequence.java
@@ -0,0 +1,14 @@
+public class test_subsequence
+{
+   public static void main(/*String[] argv*/)
+   {
+      String abcdef = "AbcDef";
+      CharSequence cde = abcdef.subSequence(2,5);
+      char c = cde.charAt(0);
+      char d = cde.charAt(1);
+      char e = cde.charAt(2);
+      assert(c == 'c');
+      assert(d == 'D');
+      assert(e == 'e');
+  }
+}
diff --git a/regression/strings-smoke-tests/java_substring/test.desc b/regression/strings-smoke-tests/java_substring/test.desc
new file mode 100644
index 00000000000..26ec800cfac
--- /dev/null
+++ b/regression/strings-smoke-tests/java_substring/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_substring.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings-smoke-tests/java_substring/test_substring.class b/regression/strings-smoke-tests/java_substring/test_substring.class
new file mode 100644
index 00000000000..3ba0b60e7f2
Binary files /dev/null and b/regression/strings-smoke-tests/java_substring/test_substring.class differ
diff --git a/regression/strings-smoke-tests/java_substring/test_substring.java b/regression/strings-smoke-tests/java_substring/test_substring.java
new file mode 100644
index 00000000000..03a33fdbebd
--- /dev/null
+++ b/regression/strings-smoke-tests/java_substring/test_substring.java
@@ -0,0 +1,14 @@
+public class test_substring
+{
+   public static void main(/*String[] argv*/)
+   {
+      String abcdef = "AbcDef";
+      String cde = abcdef.substring(2,5);
+      char c = cde.charAt(0);
+      char d = cde.charAt(1);
+      char e = cde.charAt(2);
+      assert(c == 'c');
+      assert(d == 'D');
+      assert(e == 'e');
+   }
+}
diff --git a/regression/strings-smoke-tests/java_trim/test.desc b/regression/strings-smoke-tests/java_trim/test.desc
new file mode 100644
index 00000000000..171ada28356
--- /dev/null
+++ b/regression/strings-smoke-tests/java_trim/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_trim.class
+--refine-strings --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 6.* SUCCESS$
+^\[.*assertion.2\].* line 7.* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_trim/test_trim.class b/regression/strings-smoke-tests/java_trim/test_trim.class
new file mode 100644
index 00000000000..33b34714ae2
Binary files /dev/null and b/regression/strings-smoke-tests/java_trim/test_trim.class differ
diff --git a/regression/strings-smoke-tests/java_trim/test_trim.java b/regression/strings-smoke-tests/java_trim/test_trim.java
new file mode 100644
index 00000000000..20dd7ba2796
--- /dev/null
+++ b/regression/strings-smoke-tests/java_trim/test_trim.java
@@ -0,0 +1,9 @@
+public class test_trim
+{
+   public static void main(/*String[] argv*/)
+   {
+      String empty = "   ";
+      assert(empty.trim().isEmpty());
+      assert(empty.isEmpty());
+   }
+}
diff --git a/regression/strings-smoke-tests/java_value_of_float/test.class b/regression/strings-smoke-tests/java_value_of_float/test.class
new file mode 100644
index 00000000000..ddb0cfbdc0b
Binary files /dev/null and b/regression/strings-smoke-tests/java_value_of_float/test.class differ
diff --git a/regression/strings-smoke-tests/java_value_of_float/test.desc b/regression/strings-smoke-tests/java_value_of_float/test.desc
new file mode 100644
index 00000000000..4e3e8769be6
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float/test.desc
@@ -0,0 +1,8 @@
+CORE
+test.class
+--refine-strings --function test.check --string-max-length 100
+^EXIT=10$
+^SIGNAL=0$
+assertion.* file test.java line 7 .* SUCCESS$
+assertion.* file test.java line 9 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_value_of_float/test.java b/regression/strings-smoke-tests/java_value_of_float/test.java
new file mode 100644
index 00000000000..ff05337b112
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float/test.java
@@ -0,0 +1,11 @@
+public class test
+{
+    public static void check(int i)
+    {
+        String s = String.valueOf(123.456f);
+        if(i == 1)
+            assert(s.equals("123.456"));
+        else
+            assert(!s.equals("123.456"));
+    }
+}
\ No newline at end of file
diff --git a/regression/strings-smoke-tests/java_value_of_float_2/test.class b/regression/strings-smoke-tests/java_value_of_float_2/test.class
new file mode 100644
index 00000000000..7e8016e0b84
Binary files /dev/null and b/regression/strings-smoke-tests/java_value_of_float_2/test.class differ
diff --git a/regression/strings-smoke-tests/java_value_of_float_2/test.desc b/regression/strings-smoke-tests/java_value_of_float_2/test.desc
new file mode 100644
index 00000000000..370b9327f58
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_2/test.desc
@@ -0,0 +1,8 @@
+KNOWNBUG
+test.class
+--refine-strings --function test.check --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* file test.java line 6 .* SUCCESS$
+assertion.* file test.java line 7 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_value_of_float_2/test.java b/regression/strings-smoke-tests/java_value_of_float_2/test.java
new file mode 100644
index 00000000000..7967e6f3668
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_2/test.java
@@ -0,0 +1,9 @@
+public class test
+{
+    public static void check()
+    {
+        String s3=String.valueOf(7.89e12f);
+        assert(s3.equals("7.89E12"));
+        assert(!s3.equals("7.89E12"));
+    }
+}
diff --git a/regression/strings-smoke-tests/java_value_of_float_3/test.class b/regression/strings-smoke-tests/java_value_of_float_3/test.class
new file mode 100644
index 00000000000..3572c20abb1
Binary files /dev/null and b/regression/strings-smoke-tests/java_value_of_float_3/test.class differ
diff --git a/regression/strings-smoke-tests/java_value_of_float_3/test.desc b/regression/strings-smoke-tests/java_value_of_float_3/test.desc
new file mode 100644
index 00000000000..771fdebe7cc
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_3/test.desc
@@ -0,0 +1,9 @@
+KNOWNBUG
+test.class
+--refine-strings --function test.check
+^EXIT=10$
+^SIGNAL=0$
+assertion.* file test.java line 7 .* SUCCESS$
+assertion.* file test.java line 8 .* FAILURE$
+
+--
diff --git a/regression/strings-smoke-tests/java_value_of_float_3/test.java b/regression/strings-smoke-tests/java_value_of_float_3/test.java
new file mode 100644
index 00000000000..47bfa2b43cf
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_3/test.java
@@ -0,0 +1,10 @@
+public class test
+{
+    public static void check()
+    {
+        String s5=String.valueOf(5.67e-9f);
+        // The result may not be exactly 5.67E-9 as 5.66999...E-9 is also valid
+        assert(s5.startsWith("5.6") && s5.endsWith("E-9"));
+        assert(!s5.startsWith("5.6") || !s5.endsWith("E-9"));
+    }
+ }
diff --git a/regression/strings-smoke-tests/java_value_of_float_4/test.class b/regression/strings-smoke-tests/java_value_of_float_4/test.class
new file mode 100644
index 00000000000..b9330858ee9
Binary files /dev/null and b/regression/strings-smoke-tests/java_value_of_float_4/test.class differ
diff --git a/regression/strings-smoke-tests/java_value_of_float_4/test.desc b/regression/strings-smoke-tests/java_value_of_float_4/test.desc
new file mode 100644
index 00000000000..7f1e0f8819a
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_4/test.desc
@@ -0,0 +1,10 @@
+THOROUGH
+test.class
+--refine-strings --function test.check
+^EXIT=10$
+^SIGNAL=0$
+assertion.* test.java line 8 .* SUCCESS$
+assertion.* test.java line 9 .* SUCCESS$
+assertion.* test.java line 10 .* SUCCESS$
+assertion.* test.java line 11 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_value_of_float_4/test.java b/regression/strings-smoke-tests/java_value_of_float_4/test.java
new file mode 100644
index 00000000000..13c1151eb7b
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_4/test.java
@@ -0,0 +1,13 @@
+public class test
+{
+    public static void check()
+    {
+        String s7=String.valueOf(java.lang.Float.POSITIVE_INFINITY);
+        String s8=String.valueOf(java.lang.Float.NEGATIVE_INFINITY);
+        String s9=String.valueOf(java.lang.Float.NaN);
+        assert(s7.equals("Infinity"));
+        assert(s8.equals("-Infinity"));
+        assert(s9.equals("NaN"));
+        assert(!s7.equals("Infinity") || !s8.equals("-Infinity") || !s9.equals("NaN"));
+    }
+}
diff --git a/regression/strings-smoke-tests/java_value_of_float_5/test.class b/regression/strings-smoke-tests/java_value_of_float_5/test.class
new file mode 100644
index 00000000000..576229eef26
Binary files /dev/null and b/regression/strings-smoke-tests/java_value_of_float_5/test.class differ
diff --git a/regression/strings-smoke-tests/java_value_of_float_5/test.desc b/regression/strings-smoke-tests/java_value_of_float_5/test.desc
new file mode 100644
index 00000000000..7a279ade453
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_5/test.desc
@@ -0,0 +1,8 @@
+THOROUGH
+test.class
+--refine-strings --function test.check
+^EXIT=10$
+^SIGNAL=0$
+assertion.* file test.java line 6 .* SUCCESS$
+assertion.* file test.java line 7 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_value_of_float_5/test.java b/regression/strings-smoke-tests/java_value_of_float_5/test.java
new file mode 100644
index 00000000000..d64f033c86c
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_float_5/test.java
@@ -0,0 +1,9 @@
+public class test
+{
+    public static void check()
+    {
+        String s1=String.valueOf(-123.456f);
+        assert(s1.equals("-123.456"));
+        assert(!s1.equals("-123.456"));
+    }
+}
diff --git a/regression/strings-smoke-tests/java_value_of_long/test.class b/regression/strings-smoke-tests/java_value_of_long/test.class
new file mode 100644
index 00000000000..b559af818fb
Binary files /dev/null and b/regression/strings-smoke-tests/java_value_of_long/test.class differ
diff --git a/regression/strings-smoke-tests/java_value_of_long/test.desc b/regression/strings-smoke-tests/java_value_of_long/test.desc
new file mode 100644
index 00000000000..c7ea25ab2f8
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_long/test.desc
@@ -0,0 +1,8 @@
+CORE
+test.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+assertion.* file test.java line 9 .* SUCCESS$
+assertion.* file test.java line 14 .* FAILURE$
+--
diff --git a/regression/strings-smoke-tests/java_value_of_long/test.java b/regression/strings-smoke-tests/java_value_of_long/test.java
new file mode 100644
index 00000000000..a9ceaa964a7
--- /dev/null
+++ b/regression/strings-smoke-tests/java_value_of_long/test.java
@@ -0,0 +1,17 @@
+public class test
+{
+   public static void main(int i)
+   {
+      long l1=12345678901234L;
+      if(i == 0)
+      {
+          String s = String.valueOf(l1);
+          assert(s.equals("12345678901234"));
+      }
+      else
+      {
+          String s = String.valueOf(-l1);
+          assert(!s.equals("-12345678901234"));
+      }
+   }
+}
diff --git a/regression/strings-smoke-tests/jsonArrays/test.class b/regression/strings-smoke-tests/jsonArrays/test.class
new file mode 100644
index 00000000000..e1e896095a3
Binary files /dev/null and b/regression/strings-smoke-tests/jsonArrays/test.class differ
diff --git a/regression/strings-smoke-tests/jsonArrays/test.desc b/regression/strings-smoke-tests/jsonArrays/test.desc
new file mode 100644
index 00000000000..71edef45763
--- /dev/null
+++ b/regression/strings-smoke-tests/jsonArrays/test.desc
@@ -0,0 +1,10 @@
+CORE
+test.class
+--refine-strings --function test.check --json-ui --trace --string-max-length 100 --cover location
+^EXIT=0$
+^SIGNAL=0$
+\"data\".*\"tmp_object_factory\$\d+.*\"
+--
+This checks that tmp_object_factory$6 gets affected to the data field
+of some strings, which was not the case in previous versions of cbmc,
+as it was just ignored by the json output.
\ No newline at end of file
diff --git a/regression/strings-smoke-tests/jsonArrays/test.java b/regression/strings-smoke-tests/jsonArrays/test.java
new file mode 100644
index 00000000000..c7b07e0fdec
--- /dev/null
+++ b/regression/strings-smoke-tests/jsonArrays/test.java
@@ -0,0 +1,8 @@
+public class test
+{
+    public static int check(String s)
+    {
+        int i=Integer.parseInt(s);
+        return i;
+    }
+}
diff --git a/regression/strings-smoke-tests/performance.py b/regression/strings-smoke-tests/performance.py
new file mode 100755
index 00000000000..9e7b5a93279
--- /dev/null
+++ b/regression/strings-smoke-tests/performance.py
@@ -0,0 +1,34 @@
+#!/usr/bin/python
+
+'''
+This script collects the running times of the tests present in the current
+directory.
+
+It does not run the tests but reads the already present output files.
+
+Usage:
+    python performance.py
+
+Dependencies:
+    gnuplot http://www.gnuplot.info/
+'''
+
+import time
+from subprocess import check_output
+from subprocess import check_call
+
+git_output = check_output(['git', 'show', 'HEAD'])
+commit = git_output.split('\n')[0]
+commit_id = time.strftime('%Y_%m_%d__%H_%M_%S')+'__'+commit[7:]
+
+process = check_output(['grep', '^Runtime decision procedure', '-R'])
+file_name = 'performance_'+commit_id+'.out'
+
+print 'writing to file', file_name
+
+with open(file_name, 'w') as f:
+    f.write(process)
+
+print('drawing to file', file_name+'.png')
+check_call(['gnuplot', '-e', 'file="'+file_name+'"', '-e',
+            'outputfile="'+file_name+'.png"', 'performance_draw.gp'])
diff --git a/regression/strings-smoke-tests/performance_draw.gp b/regression/strings-smoke-tests/performance_draw.gp
new file mode 100644
index 00000000000..9f57ad24742
--- /dev/null
+++ b/regression/strings-smoke-tests/performance_draw.gp
@@ -0,0 +1,7 @@
+set datafile separator ":"
+set term png
+set output outputfile
+set logscale y 10
+set yrange  [0.01:100]
+
+plot file using 3 with lines
diff --git a/regression/strings/CharacterGetNumericValue/test.class b/regression/strings/CharacterGetNumericValue/test.class
new file mode 100644
index 00000000000..565d2d522b7
Binary files /dev/null and b/regression/strings/CharacterGetNumericValue/test.class differ
diff --git a/regression/strings/CharacterGetNumericValue/test.desc b/regression/strings/CharacterGetNumericValue/test.desc
new file mode 100644
index 00000000000..9f34df46fd6
--- /dev/null
+++ b/regression/strings/CharacterGetNumericValue/test.desc
@@ -0,0 +1,9 @@
+CORE
+test.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+assertion at file test.java line 8 .* SUCCESS$
+assertion at file test.java line 10 .* FAILURE$
+--
+^warning: ignoring
diff --git a/regression/strings/CharacterGetNumericValue/test.java b/regression/strings/CharacterGetNumericValue/test.java
new file mode 100644
index 00000000000..b4fe441de04
--- /dev/null
+++ b/regression/strings/CharacterGetNumericValue/test.java
@@ -0,0 +1,12 @@
+public class test
+{
+
+    public static void main(String[] args)
+    {
+        char c = 'a';
+        if(args.length>1)
+            assert Character.getNumericValue(c) == 10;
+        else
+            assert Character.getNumericValue(c) != 10;
+    }
+}
diff --git a/regression/strings/Makefile b/regression/strings/Makefile
index f9aee8c563e..47653a6bb95 100644
--- a/regression/strings/Makefile
+++ b/regression/strings/Makefile
@@ -1,6 +1,38 @@
+default: tests.log
 
 test:
-	@../test.pl -c ../../../src/cbmc/cbmc
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
 
 testfuture:
-	@../test.pl -c ../../../src/cbmc/cbmc -F
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc -CF ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+testall:
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc -CFTK ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+tests.log: ../test.pl
+	@if ! ../test.pl -c ../../../src/cbmc/cbmc ; then \
+		../failed-tests-printer.pl ; \
+		exit 1 ; \
+	fi
+
+show:
+	@for dir in *; do \
+		if [ -d "$$dir" ]; then \
+			vim -o "$$dir/*.c" "$$dir/*.out"; \
+		fi; \
+	done;
+
+clean:
+	find -name '*.out' -execdir $(RM) '{}' \;
+	find -name '*.gb' -execdir $(RM) '{}' \;
+	$(RM) tests.log
+
diff --git a/regression/strings/RegexMatches01/test.desc b/regression/strings/RegexMatches01/test.desc
index 45cc542b352..e4259466e6b 100644
--- a/regression/strings/RegexMatches01/test.desc
+++ b/regression/strings/RegexMatches01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 RegexMatches01.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/RegexMatches02/test.desc b/regression/strings/RegexMatches02/test.desc
index 86353d9a54c..006922c3d6a 100644
--- a/regression/strings/RegexMatches02/test.desc
+++ b/regression/strings/RegexMatches02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 RegexMatches02.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/RegexSubstitution01/test.desc b/regression/strings/RegexSubstitution01/test.desc
index bc7ed3648f3..ccf24b2e8fa 100644
--- a/regression/strings/RegexSubstitution01/test.desc
+++ b/regression/strings/RegexSubstitution01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 RegexSubstitution01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/RegexSubstitution02/test.desc b/regression/strings/RegexSubstitution02/test.desc
index 0645c3ac9b8..7064bcc0333 100644
--- a/regression/strings/RegexSubstitution02/test.desc
+++ b/regression/strings/RegexSubstitution02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 RegexSubstitution02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/RegexSubstitution03/test.desc b/regression/strings/RegexSubstitution03/test.desc
index 20da1478b1a..4b0d5739c42 100644
--- a/regression/strings/RegexSubstitution03/test.desc
+++ b/regression/strings/RegexSubstitution03/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 RegexSubstitution03.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StaticCharMethods01/test.desc b/regression/strings/StaticCharMethods01/test.desc
index 4b633e92bcf..0440fc98273 100644
--- a/regression/strings/StaticCharMethods01/test.desc
+++ b/regression/strings/StaticCharMethods01/test.desc
@@ -1,6 +1,6 @@
-FUTURE
+CORE
 StaticCharMethods01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StaticCharMethods02/test.desc b/regression/strings/StaticCharMethods02/test.desc
index 00aaaba8964..d537da812c9 100644
--- a/regression/strings/StaticCharMethods02/test.desc
+++ b/regression/strings/StaticCharMethods02/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StaticCharMethods02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 --
 ^warning: ignoring
diff --git a/regression/strings/StaticCharMethods03/test.desc b/regression/strings/StaticCharMethods03/test.desc
index 6f3d3bc5607..174071ed1da 100644
--- a/regression/strings/StaticCharMethods03/test.desc
+++ b/regression/strings/StaticCharMethods03/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StaticCharMethods03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StaticCharMethods04/test.desc b/regression/strings/StaticCharMethods04/test.desc
index 0c9484ef337..ecc807f2d31 100644
--- a/regression/strings/StaticCharMethods04/test.desc
+++ b/regression/strings/StaticCharMethods04/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StaticCharMethods04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 --
 ^warning: ignoring
diff --git a/regression/strings/StaticCharMethods05/test.desc b/regression/strings/StaticCharMethods05/test.desc
index 5b4a6b4b622..f8abd67fc57 100644
--- a/regression/strings/StaticCharMethods05/test.desc
+++ b/regression/strings/StaticCharMethods05/test.desc
@@ -1,8 +1,11 @@
-FUTURE
+CORE
 StaticCharMethods05.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+null-pointer-exception\.14\] Throw null: FAILURE
+^\[.*assertion\.1\] .* line 12 .* FAILURE$
+^\[.*assertion\.2\] .* line 22 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StaticCharMethods06/test.desc b/regression/strings/StaticCharMethods06/test.desc
index 6f351b2c7cf..3caa6a7b878 100644
--- a/regression/strings/StaticCharMethods06/test.desc
+++ b/regression/strings/StaticCharMethods06/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StaticCharMethods06.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringBuilderAppend01/test.desc b/regression/strings/StringBuilderAppend01/test.desc
index f1f89b629be..d0207fc9ea7 100644
--- a/regression/strings/StringBuilderAppend01/test.desc
+++ b/regression/strings/StringBuilderAppend01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderAppend01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringBuilderAppend02/test.desc b/regression/strings/StringBuilderAppend02/test.desc
index 1336c45c3d2..70357b670d8 100644
--- a/regression/strings/StringBuilderAppend02/test.desc
+++ b/regression/strings/StringBuilderAppend02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderAppend02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderCapLen01/test.desc b/regression/strings/StringBuilderCapLen01/test.desc
index 05516f08da2..4186f2534ac 100644
--- a/regression/strings/StringBuilderCapLen01/test.desc
+++ b/regression/strings/StringBuilderCapLen01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderCapLen01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringBuilderCapLen02/test.desc b/regression/strings/StringBuilderCapLen02/test.desc
index 72a0bbd72c2..f9db006ed0b 100644
--- a/regression/strings/StringBuilderCapLen02/test.desc
+++ b/regression/strings/StringBuilderCapLen02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderCapLen02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderCapLen03/test.desc b/regression/strings/StringBuilderCapLen03/test.desc
index 474bdc661ab..c35dfb33871 100644
--- a/regression/strings/StringBuilderCapLen03/test.desc
+++ b/regression/strings/StringBuilderCapLen03/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderCapLen03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderCapLen04/test.desc b/regression/strings/StringBuilderCapLen04/test.desc
index fa342b79518..78930851e45 100644
--- a/regression/strings/StringBuilderCapLen04/test.desc
+++ b/regression/strings/StringBuilderCapLen04/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderCapLen04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderChars01/test.desc b/regression/strings/StringBuilderChars01/test.desc
index 41dfe54abeb..48acfb25a5d 100644
--- a/regression/strings/StringBuilderChars01/test.desc
+++ b/regression/strings/StringBuilderChars01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderChars01.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringBuilderChars02/test.desc b/regression/strings/StringBuilderChars02/test.desc
index 50e49d474bc..d9006ab74ba 100644
--- a/regression/strings/StringBuilderChars02/test.desc
+++ b/regression/strings/StringBuilderChars02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderChars02.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderChars03/test.desc b/regression/strings/StringBuilderChars03/test.desc
index 23dda39df4e..d6f1cb4155c 100644
--- a/regression/strings/StringBuilderChars03/test.desc
+++ b/regression/strings/StringBuilderChars03/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderChars03.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderChars04/test.desc b/regression/strings/StringBuilderChars04/test.desc
index a68edd89395..37009795a48 100644
--- a/regression/strings/StringBuilderChars04/test.desc
+++ b/regression/strings/StringBuilderChars04/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderChars04.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderChars05/test.desc b/regression/strings/StringBuilderChars05/test.desc
index eeac328e02b..49aed9d48fd 100644
--- a/regression/strings/StringBuilderChars05/test.desc
+++ b/regression/strings/StringBuilderChars05/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderChars05.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderChars06/test.desc b/regression/strings/StringBuilderChars06/test.desc
index a3dc3712a5a..5ccf470590e 100644
--- a/regression/strings/StringBuilderChars06/test.desc
+++ b/regression/strings/StringBuilderChars06/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderChars06.class
---string-refine --unwind 100
+--refine-strings --unwind 100
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderConstructors01/test.desc b/regression/strings/StringBuilderConstructors01/test.desc
index 2c60f9bbbda..3e27d46c329 100644
--- a/regression/strings/StringBuilderConstructors01/test.desc
+++ b/regression/strings/StringBuilderConstructors01/test.desc
@@ -1,6 +1,6 @@
 KNOWNBUG
 StringBuilderConstructors01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringBuilderConstructors02/test.desc b/regression/strings/StringBuilderConstructors02/test.desc
index 5e951bc8079..f6c0cded34e 100644
--- a/regression/strings/StringBuilderConstructors02/test.desc
+++ b/regression/strings/StringBuilderConstructors02/test.desc
@@ -1,6 +1,6 @@
 KNOWNBUG
 StringBuilderConstructors02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderInsertDelete01/test.desc b/regression/strings/StringBuilderInsertDelete01/test.desc
index 4c3000d6a97..b2f927ad3b7 100644
--- a/regression/strings/StringBuilderInsertDelete01/test.desc
+++ b/regression/strings/StringBuilderInsertDelete01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderInsertDelete01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringBuilderInsertDelete02/test.desc b/regression/strings/StringBuilderInsertDelete02/test.desc
index ae4d0ca5b81..1e67f7eb3c0 100644
--- a/regression/strings/StringBuilderInsertDelete02/test.desc
+++ b/regression/strings/StringBuilderInsertDelete02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderInsertDelete02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringBuilderInsertDelete03/test.desc b/regression/strings/StringBuilderInsertDelete03/test.desc
index 3dfa92f0338..084038f4465 100644
--- a/regression/strings/StringBuilderInsertDelete03/test.desc
+++ b/regression/strings/StringBuilderInsertDelete03/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringBuilderInsertDelete03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringCompare01/test.desc b/regression/strings/StringCompare01/test.desc
index 52b1d6d084c..2140f3a0c48 100644
--- a/regression/strings/StringCompare01/test.desc
+++ b/regression/strings/StringCompare01/test.desc
@@ -1,8 +1,10 @@
 FUTURE
 StringCompare01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
 --
 ^warning: ignoring
+--
+Fails because string.regionMatches is not implemented
diff --git a/regression/strings/StringCompare02/test.desc b/regression/strings/StringCompare02/test.desc
index eb52d1f1a58..d20bfb7eb5c 100644
--- a/regression/strings/StringCompare02/test.desc
+++ b/regression/strings/StringCompare02/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringCompare02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 12 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringCompare03/test.desc b/regression/strings/StringCompare03/test.desc
index bd0f3177acf..afc9b9b5307 100644
--- a/regression/strings/StringCompare03/test.desc
+++ b/regression/strings/StringCompare03/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringCompare03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 12 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringCompare04/test.desc b/regression/strings/StringCompare04/test.desc
index 88ecddbfcf6..afc70f4933b 100644
--- a/regression/strings/StringCompare04/test.desc
+++ b/regression/strings/StringCompare04/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringCompare04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringCompare05/test.desc b/regression/strings/StringCompare05/test.desc
index 1358a05a36b..0f24821dee6 100644
--- a/regression/strings/StringCompare05/test.desc
+++ b/regression/strings/StringCompare05/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringCompare05.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
+^\[.*assertion\.1\] .* line 9 .* FAILURE$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringConcatenation01/test.desc b/regression/strings/StringConcatenation01/test.desc
index a229b504571..29244c24734 100644
--- a/regression/strings/StringConcatenation01/test.desc
+++ b/regression/strings/StringConcatenation01/test.desc
@@ -1,6 +1,6 @@
-KNOWNBUG
+CORE
 StringConcatenation01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringConcatenation02/test.desc b/regression/strings/StringConcatenation02/test.desc
index 0e1faf53d5e..ad9402eaec9 100644
--- a/regression/strings/StringConcatenation02/test.desc
+++ b/regression/strings/StringConcatenation02/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 StringConcatenation02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringConcatenation03/test.desc b/regression/strings/StringConcatenation03/test.desc
index 3c01a4ee0a9..c5798d1ae1d 100644
--- a/regression/strings/StringConcatenation03/test.desc
+++ b/regression/strings/StringConcatenation03/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringConcatenation03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
+^\[.*assertion\.1\] .* line 11 .* FAILURE$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringConcatenation04/test.desc b/regression/strings/StringConcatenation04/test.desc
index 3dbecf065ba..a781c7887b1 100644
--- a/regression/strings/StringConcatenation04/test.desc
+++ b/regression/strings/StringConcatenation04/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringConcatenation04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 8 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringConstructors01/test.desc b/regression/strings/StringConstructors01/test.desc
index ed57bdfdde5..b1465868c19 100644
--- a/regression/strings/StringConstructors01/test.desc
+++ b/regression/strings/StringConstructors01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringConstructors01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringConstructors02/test.desc b/regression/strings/StringConstructors02/test.desc
index e3904d1d557..37838aafbc9 100644
--- a/regression/strings/StringConstructors02/test.desc
+++ b/regression/strings/StringConstructors02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringConstructors02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringConstructors03/test.desc b/regression/strings/StringConstructors03/test.desc
index 0caf75f41ea..10193fc66c2 100644
--- a/regression/strings/StringConstructors03/test.desc
+++ b/regression/strings/StringConstructors03/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringConstructors03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringConstructors04/test.desc b/regression/strings/StringConstructors04/test.desc
index 75364dcde22..2e6e88fa862 100644
--- a/regression/strings/StringConstructors04/test.desc
+++ b/regression/strings/StringConstructors04/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringConstructors04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringConstructors05/test.desc b/regression/strings/StringConstructors05/test.desc
index e74dfc73f6c..a3c6a6c0437 100644
--- a/regression/strings/StringConstructors05/test.desc
+++ b/regression/strings/StringConstructors05/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringConstructors05.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/StringContains01/test.class b/regression/strings/StringContains01/test.class
new file mode 100644
index 00000000000..ce12a0ee470
Binary files /dev/null and b/regression/strings/StringContains01/test.class differ
diff --git a/regression/strings/StringContains01/test.desc b/regression/strings/StringContains01/test.desc
new file mode 100644
index 00000000000..2e66f73126f
--- /dev/null
+++ b/regression/strings/StringContains01/test.desc
@@ -0,0 +1,6 @@
+FUTURE
+test.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
diff --git a/regression/strings/StringContains01/test.java b/regression/strings/StringContains01/test.java
new file mode 100644
index 00000000000..de588381d8a
--- /dev/null
+++ b/regression/strings/StringContains01/test.java
@@ -0,0 +1,8 @@
+public class test
+{
+    public static void main(String s)
+    {
+        String ab = "abc";
+        assert(ab.contains(s));
+    }
+}
diff --git a/regression/strings/StringContains02/test.class b/regression/strings/StringContains02/test.class
new file mode 100644
index 00000000000..c1b575d8c6e
Binary files /dev/null and b/regression/strings/StringContains02/test.class differ
diff --git a/regression/strings/StringContains02/test.desc b/regression/strings/StringContains02/test.desc
new file mode 100644
index 00000000000..2e66f73126f
--- /dev/null
+++ b/regression/strings/StringContains02/test.desc
@@ -0,0 +1,6 @@
+FUTURE
+test.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
diff --git a/regression/strings/StringContains02/test.java b/regression/strings/StringContains02/test.java
new file mode 100644
index 00000000000..77fa0284700
--- /dev/null
+++ b/regression/strings/StringContains02/test.java
@@ -0,0 +1,7 @@
+public class test
+{
+    public static void main(String s)
+    {
+        assert(s.contains("Hello"));
+    }
+}
diff --git a/regression/strings/StringIndexMethods01/test.desc b/regression/strings/StringIndexMethods01/test.desc
index 005d4459f12..4bdc0d39b71 100644
--- a/regression/strings/StringIndexMethods01/test.desc
+++ b/regression/strings/StringIndexMethods01/test.desc
@@ -1,6 +1,6 @@
-FUTURE
+THOROUGH
 StringIndexMethods01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringIndexMethods02/test.desc b/regression/strings/StringIndexMethods02/test.desc
index 28df14f0145..05518537f78 100644
--- a/regression/strings/StringIndexMethods02/test.desc
+++ b/regression/strings/StringIndexMethods02/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringIndexMethods02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringIndexMethods03/test.desc b/regression/strings/StringIndexMethods03/test.desc
index 02f9934726b..17a62282b22 100644
--- a/regression/strings/StringIndexMethods03/test.desc
+++ b/regression/strings/StringIndexMethods03/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringIndexMethods03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringIndexMethods04/test.desc b/regression/strings/StringIndexMethods04/test.desc
index cb94fecb6a6..5902a92be18 100644
--- a/regression/strings/StringIndexMethods04/test.desc
+++ b/regression/strings/StringIndexMethods04/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringIndexMethods04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringIndexMethods05/test.desc b/regression/strings/StringIndexMethods05/test.desc
index cb43b009246..29dee098ac7 100644
--- a/regression/strings/StringIndexMethods05/test.desc
+++ b/regression/strings/StringIndexMethods05/test.desc
@@ -1,8 +1,9 @@
 FUTURE
 StringIndexMethods05.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringMiscellaneous01/test.desc b/regression/strings/StringMiscellaneous01/test.desc
index 050c3e99e90..624c8028cb3 100644
--- a/regression/strings/StringMiscellaneous01/test.desc
+++ b/regression/strings/StringMiscellaneous01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringMiscellaneous01.class
---string-refine --unwind 30
+--refine-strings --unwind 30
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringMiscellaneous02/test.desc b/regression/strings/StringMiscellaneous02/test.desc
index 8f1a1d9475f..7fd0118b93a 100644
--- a/regression/strings/StringMiscellaneous02/test.desc
+++ b/regression/strings/StringMiscellaneous02/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringMiscellaneous02.class
---string-refine --unwind 30
+--refine-strings --unwind 30
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 6 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringMiscellaneous03/test.desc b/regression/strings/StringMiscellaneous03/test.desc
index 341867d536f..d19fcdfaa5e 100644
--- a/regression/strings/StringMiscellaneous03/test.desc
+++ b/regression/strings/StringMiscellaneous03/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringMiscellaneous03.class
---string-refine --unwind 30
+--refine-strings --unwind 30
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 11 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringMiscellaneous04/test.desc b/regression/strings/StringMiscellaneous04/test.desc
index 737ab3b0f8c..9eb355cd0d2 100644
--- a/regression/strings/StringMiscellaneous04/test.desc
+++ b/regression/strings/StringMiscellaneous04/test.desc
@@ -1,6 +1,6 @@
-FUTURE
+CORE
 StringMiscellaneous04.class
---string-refine --unwind 30
+--refine-strings --unwind 30
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringStartEnd01/test.desc b/regression/strings/StringStartEnd01/test.desc
index a5463d5b5ea..123429bd623 100644
--- a/regression/strings/StringStartEnd01/test.desc
+++ b/regression/strings/StringStartEnd01/test.desc
@@ -1,6 +1,6 @@
-KNOWNBUG
+THOROUGH
 StringStartEnd01.class
---string-refine --unwind 30
+--refine-strings --unwind 30
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringStartEnd02/test.desc b/regression/strings/StringStartEnd02/test.desc
index 8e623622f72..deddbb5b902 100644
--- a/regression/strings/StringStartEnd02/test.desc
+++ b/regression/strings/StringStartEnd02/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 StringStartEnd02.class
---string-refine --unwind 30
+--refine-strings --unwind 30 --string-max-length 1000
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 13 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringStartEnd03/test.desc b/regression/strings/StringStartEnd03/test.desc
index 2903ec98e3e..b7727fd8b91 100644
--- a/regression/strings/StringStartEnd03/test.desc
+++ b/regression/strings/StringStartEnd03/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+THOROUGH
 StringStartEnd03.class
---string-refine --unwind 15
+--refine-strings --unwind 15
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 13 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf01/test.desc b/regression/strings/StringValueOf01/test.desc
index 341f5e98975..c6098401ba0 100644
--- a/regression/strings/StringValueOf01/test.desc
+++ b/regression/strings/StringValueOf01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringValueOf01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/StringValueOf02/test.desc b/regression/strings/StringValueOf02/test.desc
index a10b398bf41..906d983e34f 100644
--- a/regression/strings/StringValueOf02/test.desc
+++ b/regression/strings/StringValueOf02/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringValueOf02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf03/test.desc b/regression/strings/StringValueOf03/test.desc
index 4ed709a2404..ffde4e2de6f 100644
--- a/regression/strings/StringValueOf03/test.desc
+++ b/regression/strings/StringValueOf03/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringValueOf03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf04/test.desc b/regression/strings/StringValueOf04/test.desc
index 0d8442e9de1..e73f1492261 100644
--- a/regression/strings/StringValueOf04/test.desc
+++ b/regression/strings/StringValueOf04/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 StringValueOf04.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf05/test.desc b/regression/strings/StringValueOf05/test.desc
index f77cdef0b8e..494b6779cc2 100644
--- a/regression/strings/StringValueOf05/test.desc
+++ b/regression/strings/StringValueOf05/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 StringValueOf05.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf06/test.desc b/regression/strings/StringValueOf06/test.desc
index 56551c4a14b..29fe55a89f2 100644
--- a/regression/strings/StringValueOf06/test.desc
+++ b/regression/strings/StringValueOf06/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 StringValueOf06.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf07/test.desc b/regression/strings/StringValueOf07/test.desc
index 6dde9de229d..e1d94ae7025 100644
--- a/regression/strings/StringValueOf07/test.desc
+++ b/regression/strings/StringValueOf07/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 StringValueOf07.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 8 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf08/test.desc b/regression/strings/StringValueOf08/test.desc
index 21d64075aaf..3746e46471f 100644
--- a/regression/strings/StringValueOf08/test.desc
+++ b/regression/strings/StringValueOf08/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+CORE
 StringValueOf08.class
---string-refine
+--refine-strings --string-max-length 100
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf09/test.desc b/regression/strings/StringValueOf09/test.desc
index 4ff97a7caef..d1bad9a12b6 100644
--- a/regression/strings/StringValueOf09/test.desc
+++ b/regression/strings/StringValueOf09/test.desc
@@ -1,8 +1,9 @@
-FUTURE
+THOROUGH
 StringValueOf09.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/StringValueOf10/test.desc b/regression/strings/StringValueOf10/test.desc
index 10e7f184189..3f8c5d6d60f 100644
--- a/regression/strings/StringValueOf10/test.desc
+++ b/regression/strings/StringValueOf10/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 StringValueOf10.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/SubString01/test.desc b/regression/strings/SubString01/test.desc
index 8eea70cf458..975eaa118f3 100644
--- a/regression/strings/SubString01/test.desc
+++ b/regression/strings/SubString01/test.desc
@@ -1,6 +1,6 @@
-KNOWNBUG
+CORE
 SubString01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/SubString02/test.desc b/regression/strings/SubString02/test.desc
index 063ce88f0f2..2003191a147 100644
--- a/regression/strings/SubString02/test.desc
+++ b/regression/strings/SubString02/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 SubString02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/SubString03/test.desc b/regression/strings/SubString03/test.desc
index f985329ce2d..22143857480 100644
--- a/regression/strings/SubString03/test.desc
+++ b/regression/strings/SubString03/test.desc
@@ -1,8 +1,9 @@
-KNOWNBUG
+CORE
 SubString03.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
+^\[.*assertion\.1\] .* line 7 .* FAILURE$
 ^VERIFICATION FAILED$
 --
 ^warning: ignoring
diff --git a/regression/strings/TokenTest01/test.desc b/regression/strings/TokenTest01/test.desc
index 02a11e8e392..122e6a8830a 100644
--- a/regression/strings/TokenTest01/test.desc
+++ b/regression/strings/TokenTest01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 TokenTest01.class
---string-refine --unwind 30
+--refine-strings --unwind 30
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/TokenTest02/test.desc b/regression/strings/TokenTest02/test.desc
index 48e6b0c1ab6..6d1dabed602 100644
--- a/regression/strings/TokenTest02/test.desc
+++ b/regression/strings/TokenTest02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 TokenTest02.class
---string-refine --unwind 15
+--refine-strings --unwind 15
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/Validate01/test.desc b/regression/strings/Validate01/test.desc
index e797b2735aa..649136a2956 100644
--- a/regression/strings/Validate01/test.desc
+++ b/regression/strings/Validate01/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 Validate01.class
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/Validate02/test.desc b/regression/strings/Validate02/test.desc
index a5a3a6f1d20..22251c38a95 100644
--- a/regression/strings/Validate02/test.desc
+++ b/regression/strings/Validate02/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 Validate02.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/bug-test-gen-095/test.class b/regression/strings/bug-test-gen-095/test.class
new file mode 100644
index 00000000000..3895d218c3d
Binary files /dev/null and b/regression/strings/bug-test-gen-095/test.class differ
diff --git a/regression/strings/bug-test-gen-095/test.desc b/regression/strings/bug-test-gen-095/test.desc
new file mode 100644
index 00000000000..9f39bb3f26c
--- /dev/null
+++ b/regression/strings/bug-test-gen-095/test.desc
@@ -0,0 +1,8 @@
+FUTURE
+test.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+\[.*assertion\.1\] .* line 8 .* FAILURE
+^VERIFICATION FAILED$
+--
diff --git a/regression/strings/bug-test-gen-095/test.java b/regression/strings/bug-test-gen-095/test.java
new file mode 100644
index 00000000000..a6910527551
--- /dev/null
+++ b/regression/strings/bug-test-gen-095/test.java
@@ -0,0 +1,10 @@
+public class test
+{
+   public static void main(String[] args)
+   {
+      StringBuilder sb = new StringBuilder(args[0]);
+      sb.append("Z");
+      String s = sb.toString();
+      assert(s.equals("fg"));
+   }
+}
diff --git a/regression/strings/bug-test-gen-119-2/StringValueOfLong.class b/regression/strings/bug-test-gen-119-2/StringValueOfLong.class
new file mode 100644
index 00000000000..821230a7f7f
Binary files /dev/null and b/regression/strings/bug-test-gen-119-2/StringValueOfLong.class differ
diff --git a/regression/strings/bug-test-gen-119-2/StringValueOfLong.java b/regression/strings/bug-test-gen-119-2/StringValueOfLong.java
new file mode 100644
index 00000000000..21f21cec9f7
--- /dev/null
+++ b/regression/strings/bug-test-gen-119-2/StringValueOfLong.java
@@ -0,0 +1,9 @@
+public class StringValueOfLong
+{
+    public static void main()
+    {
+        long longValue = 10000000000L; // L suffix indicates long
+        String tmp=String.valueOf(longValue);
+        assert tmp.equals("10000000000");
+    }
+}
diff --git a/regression/strings/bug-test-gen-119-2/test.desc b/regression/strings/bug-test-gen-119-2/test.desc
new file mode 100644
index 00000000000..312601b835d
--- /dev/null
+++ b/regression/strings/bug-test-gen-119-2/test.desc
@@ -0,0 +1,7 @@
+CORE
+StringValueOfLong.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings/bug-test-gen-119/StringValueOfBool.class b/regression/strings/bug-test-gen-119/StringValueOfBool.class
new file mode 100644
index 00000000000..150b1840b64
Binary files /dev/null and b/regression/strings/bug-test-gen-119/StringValueOfBool.class differ
diff --git a/regression/strings/bug-test-gen-119/StringValueOfBool.java b/regression/strings/bug-test-gen-119/StringValueOfBool.java
new file mode 100644
index 00000000000..0452785fede
--- /dev/null
+++ b/regression/strings/bug-test-gen-119/StringValueOfBool.java
@@ -0,0 +1,10 @@
+public class StringValueOfBool
+{
+    public static void main()
+    {
+        boolean booleanValue = false;
+
+        String tmp=String.valueOf(booleanValue);
+        assert tmp.equals("false");
+    }
+}
diff --git a/regression/strings/bug-test-gen-119/test.desc b/regression/strings/bug-test-gen-119/test.desc
new file mode 100644
index 00000000000..c5672ad9702
--- /dev/null
+++ b/regression/strings/bug-test-gen-119/test.desc
@@ -0,0 +1,7 @@
+CORE
+StringValueOfBool.class
+--refine-strings
+^EXIT=0$
+^SIGNAL=0$
+^VERIFICATION SUCCESSFUL$
+--
diff --git a/regression/strings/cprover-string-hack.h b/regression/strings/cprover-string-hack.h
index 1ec17bca535..86af21533f8 100644
--- a/regression/strings/cprover-string-hack.h
+++ b/regression/strings/cprover-string-hack.h
@@ -1,18 +1,32 @@
-typedef struct __CPROVER_string { char *s; } __CPROVER_string;
-//typedef struct __CPROVER_char { char c; } __CPROVER_char;
-typedef unsigned char __CPROVER_char;
+/*******************************************************************\
+
+Module: Hack for C string tests
+
+Author: Romain Brenguier
+
+\*******************************************************************/
+
+#ifndef CPROVER_ESSION_STRINGS_CPROVER_STRING_HACK_H
+#define CPROVER_ESSION_STRINGS_CPROVER_STRING_HACK_H
+
+typedef struct __attribute__((__packed__)) __CPROVER_refined_string_type // NOLINT
+  { int length; char content[]; } __CPROVER_refined_string_type;
+typedef __CPROVER_refined_string_type __CPROVER_string;                  //NOLINT
 
 /******************************************************************************
  * CPROVER string functions
  ******************************************************************************/
 /* returns s[p] */
-#define __CPROVER_char_at(s, p) __CPROVER_uninterpreted_string_char_at_func(s, p)
+#define __CPROVER_char_at(s, p) \
+  __CPROVER_uninterpreted_string_char_at_func(s, p)
 
 /* string equality */
-#define __CPROVER_string_equal(s1, s2) __CPROVER_uninterpreted_string_equal_func(s1, s2)
+#define __CPROVER_string_equal(s1, s2) \
+  __CPROVER_uninterpreted_string_equal_func(s1, s2)
 
 /* defines a string literal, e.g. __CPROVER_string_literal("foo") */
-#define __CPROVER_string_literal(s) __CPROVER_uninterpreted_string_literal_func(s)
+#define __CPROVER_string_literal(s) \
+  __CPROVER_uninterpreted_string_literal_func(s)
 
 /* defines a char literal, e.g. __CPROVER_char_literal("c"). NOTE: you
  * *must* use a C string literal as argument (i.e. double quotes "c", not
@@ -20,30 +34,39 @@ typedef unsigned char __CPROVER_char;
 #define __CPROVER_char_literal(c) __CPROVER_uninterpreted_char_literal_func(c)
 
 /* produces the concatenation of s1 and s2 */
-#define __CPROVER_string_concat(s1, s2) __CPROVER_uninterpreted_string_concat_func(s1, s2)
+#define __CPROVER_string_concat(s1, s2) \
+  __CPROVER_uninterpreted_string_concat_func(s1, s2)
 
 /* return the length of s */
-#define __CPROVER_string_length(s) __CPROVER_uninterpreted_string_length_func(s)
+#define __CPROVER_string_length(s) \
+  __CPROVER_uninterpreted_string_length_func(s)
 
 /* extracts the substring between positions i and j (j not included) */
-#define __CPROVER_string_substring(s, i, j) __CPROVER_uninterpreted_string_substring_func(s, i, j)
+#define __CPROVER_string_substring(s, i, j) \
+  __CPROVER_uninterpreted_string_substring_func(s, i, j)
 
 /* test whether p is a prefix of s */
-#define __CPROVER_string_isprefix(p, s) __CPROVER_uninterpreted_string_is_prefix_func(p, s)
+#define __CPROVER_string_isprefix(p, s) \
+  __CPROVER_uninterpreted_string_is_prefix_func(p, s)
 
 /* test whether p is a suffix of s */
-#define __CPROVER_string_issuffix(p, s) __CPROVER_uninterpreted_string_is_suffix_func(p, s)
+#define __CPROVER_string_issuffix(p, s) \
+  __CPROVER_uninterpreted_string_is_suffix_func(p, s)
 /* test whether p contains s */
-#define __CPROVER_string_contains(p, s) __CPROVER_uninterpreted_string_contains_func(p, s)
+#define __CPROVER_string_contains(p, s) \
+  __CPROVER_uninterpreted_string_contains_func(p, s)
 
 /* first index where character c appears, -1 if not found */
-#define __CPROVER_string_index_of(s, c) __CPROVER_uninterpreted_string_index_of_func(s, c)
+#define __CPROVER_string_index_of(s, c) \
+  __CPROVER_uninterpreted_string_index_of_func(s, c)
 
 /* last index where character c appears */
-#define __CPROVER_string_last_index_of(s, c) __CPROVER_uninterpreted_string_last_index_of_func(s, c)
+#define __CPROVER_string_last_index_of(s, c) \
+  __CPROVER_uninterpreted_string_last_index_of_func(s, c)
 
 /* returns a new string obtained from s by setting s[p] = c */
-#define __CPROVER_char_set(s, p, c) __CPROVER_uninterpreted_string_char_set_func(s, p, c)
+#define __CPROVER_char_set(s, p, c) \
+  __CPROVER_uninterpreted_string_char_set_func(s, p, c)
 
 
 #define __CPROVER_string_copy(s) __CPROVER_uninterpreted_string_copy_func(s)
@@ -54,19 +77,32 @@ typedef unsigned char __CPROVER_char;
 /******************************************************************************
  * don't use these directly
  ******************************************************************************/
-extern __CPROVER_char __CPROVER_uninterpreted_string_char_at_func(__CPROVER_string str, int pos);
-extern __CPROVER_bool __CPROVER_uninterpreted_string_equal_func(__CPROVER_string str1, __CPROVER_string str2);
+extern char __CPROVER_uninterpreted_string_char_at_func(
+  __CPROVER_string str, int pos);
+extern __CPROVER_bool __CPROVER_uninterpreted_string_equal_func(
+  __CPROVER_string str1, __CPROVER_string str2);
 extern __CPROVER_string __CPROVER_uninterpreted_string_literal_func(char * str);
-extern __CPROVER_char __CPROVER_uninterpreted_char_literal_func();
-extern __CPROVER_string __CPROVER_uninterpreted_string_concat_func(__CPROVER_string str1, __CPROVER_string str2);
+extern char __CPROVER_uninterpreted_char_literal_func();
+extern __CPROVER_string __CPROVER_uninterpreted_string_concat_func(
+  __CPROVER_string str1, __CPROVER_string str2);
 extern int __CPROVER_uninterpreted_string_length_func(__CPROVER_string str);
-extern __CPROVER_string __CPROVER_uninterpreted_string_substring_func(__CPROVER_string str, int i, int j);
-extern __CPROVER_bool __CPROVER_uninterpreted_string_is_prefix_func(__CPROVER_string pref, __CPROVER_string str);
-extern __CPROVER_bool __CPROVER_uninterpreted_string_is_suffix_func(__CPROVER_string suff, __CPROVER_string str);
-extern __CPROVER_bool __CPROVER_uninterpreted_string_contains_func(__CPROVER_string str1, __CPROVER_string str2);
-extern int __CPROVER_uninterpreted_string_index_of_func(__CPROVER_string str, __CPROVER_char c);
-extern int __CPROVER_uninterpreted_string_last_index_of_func(__CPROVER_string str, __CPROVER_char c);
-extern __CPROVER_string __CPROVER_uninterpreted_string_char_set_func(__CPROVER_string str, int pos, __CPROVER_char c);
-extern __CPROVER_string __CPROVER_uninterpreted_string_copy_func(__CPROVER_string str);
+extern __CPROVER_string __CPROVER_uninterpreted_string_substring_func(
+  __CPROVER_string str, int i, int j);
+extern __CPROVER_bool __CPROVER_uninterpreted_string_is_prefix_func(
+  __CPROVER_string pref, __CPROVER_string str);
+extern __CPROVER_bool __CPROVER_uninterpreted_string_is_suffix_func(
+  __CPROVER_string suff, __CPROVER_string str);
+extern __CPROVER_bool __CPROVER_uninterpreted_string_contains_func(
+  __CPROVER_string str1, __CPROVER_string str2);
+extern int __CPROVER_uninterpreted_string_index_of_func(
+  __CPROVER_string str, char c);
+extern int __CPROVER_uninterpreted_string_last_index_of_func(
+  __CPROVER_string str, char c);
+extern __CPROVER_string __CPROVER_uninterpreted_string_char_set_func(
+  __CPROVER_string str, int pos, char c);
+extern __CPROVER_string __CPROVER_uninterpreted_string_copy_func(
+  __CPROVER_string str);
 extern int __CPROVER_uninterpreted_string_parse_int_func(__CPROVER_string str);
 extern __CPROVER_string __CPROVER_uninterpreted_string_of_int_func(int i);
+
+#endif
diff --git a/regression/strings/java_append_char/test.desc b/regression/strings/java_append_char/test.desc
new file mode 100644
index 00000000000..1c583f7be2d
--- /dev/null
+++ b/regression/strings/java_append_char/test.desc
@@ -0,0 +1,8 @@
+CORE
+test_append_char.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+^VERIFICATION FAILED$
+^\[.*assertion\.1\].* line 15.* FAILURE$
+--
diff --git a/regression/strings/java_append_char/test_append_char.class b/regression/strings/java_append_char/test_append_char.class
new file mode 100644
index 00000000000..c0b1491423b
Binary files /dev/null and b/regression/strings/java_append_char/test_append_char.class differ
diff --git a/regression/strings/java_append_char/test_append_char.java b/regression/strings/java_append_char/test_append_char.java
new file mode 100644
index 00000000000..90e9ab089a2
--- /dev/null
+++ b/regression/strings/java_append_char/test_append_char.java
@@ -0,0 +1,17 @@
+public class test_append_char
+{
+   public static void main(/*String[] args*/)
+   {
+      char[] diff = {'d', 'i', 'f', 'f'};
+      char[] blue = {'b', 'l', 'u', 'e'};
+
+      StringBuilder buffer = new StringBuilder();
+
+      buffer.append(diff)
+            .append(blue);
+
+      String tmp=buffer.toString();
+      System.out.println(tmp);
+      assert(!tmp.equals("diffblue"));
+   }
+}
diff --git a/regression/strings/java_append_int/test.desc b/regression/strings/java_append_int/test.desc
new file mode 100644
index 00000000000..1d3e387d278
--- /dev/null
+++ b/regression/strings/java_append_int/test.desc
@@ -0,0 +1,9 @@
+KNOWNBUG
+test_append_int.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 9.* FAILURE$
+--
+--
+Requires private library, should be moved to test-gen suite
diff --git a/regression/strings/java_append_int/test_append_int.class b/regression/strings/java_append_int/test_append_int.class
new file mode 100644
index 00000000000..d9ee5046e7d
Binary files /dev/null and b/regression/strings/java_append_int/test_append_int.class differ
diff --git a/regression/strings/java_append_int/test_append_int.java b/regression/strings/java_append_int/test_append_int.java
new file mode 100644
index 00000000000..cf550211ad7
--- /dev/null
+++ b/regression/strings/java_append_int/test_append_int.java
@@ -0,0 +1,11 @@
+public class test_append_int
+{
+   public static void main(/*String[] args*/)
+   {
+      StringBuilder diffblue = new StringBuilder();
+      diffblue.append("d");
+      diffblue.append(4);
+      String s = diffblue.toString();
+      assert(!s.equals("d4"));
+   }
+}
diff --git a/regression/strings/java_append_object/test.desc b/regression/strings/java_append_object/test.desc
new file mode 100644
index 00000000000..23ad1a81be4
--- /dev/null
+++ b/regression/strings/java_append_object/test.desc
@@ -0,0 +1,7 @@
+KNOWNBUG
+test_append_object.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 15.* FAILURE$
+--
diff --git a/regression/strings/java_append_object/test_append_object.class b/regression/strings/java_append_object/test_append_object.class
new file mode 100644
index 00000000000..fbfec51a3f5
Binary files /dev/null and b/regression/strings/java_append_object/test_append_object.class differ
diff --git a/regression/strings/java_append_object/test_append_object.java b/regression/strings/java_append_object/test_append_object.java
new file mode 100644
index 00000000000..e139a01679a
--- /dev/null
+++ b/regression/strings/java_append_object/test_append_object.java
@@ -0,0 +1,17 @@
+public class test_append_object
+{
+   public static void main(/*String[] args*/)
+   {
+      Object diff = "diff";
+      Object blue = "blue";
+
+      StringBuilder buffer = new StringBuilder();
+
+      buffer.append(diff)
+            .append(blue);
+
+      String tmp=buffer.toString();
+      System.out.println(tmp);
+      assert(!tmp.equals("diffblue"));
+   }
+}
diff --git a/regression/strings/java_append_string/test.desc b/regression/strings/java_append_string/test.desc
new file mode 100644
index 00000000000..7b6ea8ccae7
--- /dev/null
+++ b/regression/strings/java_append_string/test.desc
@@ -0,0 +1,7 @@
+FUTURE
+test_append_string.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion.1\].* line 12.* FAILURE$
+--
diff --git a/regression/strings/java_append_string/test_append_string.class b/regression/strings/java_append_string/test_append_string.class
new file mode 100644
index 00000000000..f2cb5cf8bea
Binary files /dev/null and b/regression/strings/java_append_string/test_append_string.class differ
diff --git a/regression/strings/java_append_string/test_append_string.java b/regression/strings/java_append_string/test_append_string.java
new file mode 100644
index 00000000000..54665da29cc
--- /dev/null
+++ b/regression/strings/java_append_string/test_append_string.java
@@ -0,0 +1,14 @@
+public class test_append_string
+{
+   public static void main(/*String[] args*/)
+   {
+      String di = new String("di");
+      StringBuilder diff = new StringBuilder();
+      diff.append(di);
+      diff.append("ff");
+      System.out.println(diff);
+      String s = diff.toString();
+      System.out.println(s);
+      assert (!s.equals("diff"));
+   }
+}
diff --git a/regression/strings/java_case/test.desc b/regression/strings/java_case/test.desc
index 9f48288c694..22d58ddb3ac 100644
--- a/regression/strings/java_case/test.desc
+++ b/regression/strings/java_case/test.desc
@@ -1,10 +1,7 @@
-FUTURE
+CORE
 test_case.class
---string-refine
+--refine-strings --string-max-length 1000
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_case.java line 11: SUCCESS$
-^\[assertion.2\] assertion at file test_case.java line 12: SUCCESS$
-^\[assertion.3\] assertion at file test_case.java line 13: SUCCESS$
-^\[assertion.4\] assertion at file test_case.java line 14: FAILURE$
+^\[.*assertion\.1\].* line 8.* FAILURE$
 --
diff --git a/regression/strings/java_case/test_case.class b/regression/strings/java_case/test_case.class
index 8579881de17..5887b496986 100644
Binary files a/regression/strings/java_case/test_case.class and b/regression/strings/java_case/test_case.class differ
diff --git a/regression/strings/java_case/test_case.java b/regression/strings/java_case/test_case.java
index ce3a51814c8..309abfc07b9 100644
--- a/regression/strings/java_case/test_case.java
+++ b/regression/strings/java_case/test_case.java
@@ -1,16 +1,12 @@
-public class test_case {
-
-    public static void main(String[] argv) {
-
-	String s = new String("AbcCdE");
-	String l = s.toLowerCase();
-	System.out.println(l);
-	
-	String u = s.toUpperCase();
-	System.out.println(u);
-	assert(l.equals("abccde"));
-	assert(u.equals("ABCCDE"));
-	assert(s.equalsIgnoreCase("ABccDe"));
-	assert(!l.equals("abccde") || !u.equals("ABCCDE"));
-    }
+public class test_case
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Ab");
+      String l = s.toLowerCase();
+      String u = s.toUpperCase();
+      assert(!l.equals("ab") ||
+             !u.equals("AB") ||
+             !s.equalsIgnoreCase("aB"));
+   }
 }
diff --git a/regression/strings/java_char_array/test.desc b/regression/strings/java_char_array/test.desc
index 8282b808b84..0acb4c57e47 100644
--- a/regression/strings/java_char_array/test.desc
+++ b/regression/strings/java_char_array/test.desc
@@ -1,9 +1,7 @@
-FUTURE
+CORE
 test_char_array.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_char_array.java line 11: SUCCESS$
-^\[assertion.2\] assertion at file test_char_array.java line 12: SUCCESS$
-^\[assertion.3\] assertion at file test_char_array.java line 13: FAILURE$
+^\[.*assertion\.1\].* line 9.* FAILURE$
 --
diff --git a/regression/strings/java_char_array/test_char_array.class b/regression/strings/java_char_array/test_char_array.class
index 836942da134..38a7ecf41ed 100644
Binary files a/regression/strings/java_char_array/test_char_array.class and b/regression/strings/java_char_array/test_char_array.class differ
diff --git a/regression/strings/java_char_array/test_char_array.java b/regression/strings/java_char_array/test_char_array.java
index 3cfd4000d3a..96e250fb030 100644
--- a/regression/strings/java_char_array/test_char_array.java
+++ b/regression/strings/java_char_array/test_char_array.java
@@ -1,15 +1,13 @@
-public class test_char_array {
-
-    public static void main(String[] argv)
-    {
-        String s = "abc";
-        char [] str = s.toCharArray();
-        int[] test = new int[312];
-        char c = str[2];
-        String t = argv[0];
-        char d = t.charAt(0);
-        assert(str.length == 3);
-        assert(c == 'c');
-        assert(c == d || d < 'a' || d > 'z' );
-    }
+public class test_char_array
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "abc";
+      char [] str = s.toCharArray();
+      char c = str[2];
+      char a = s.charAt(0);
+      assert(str.length != 3 ||
+             a != 'a' ||
+             c != 'c');
+   }
 }
diff --git a/regression/strings/java_char_array_init/test.desc b/regression/strings/java_char_array_init/test.desc
index fe5ffae7238..61a71f5034f 100644
--- a/regression/strings/java_char_array_init/test.desc
+++ b/regression/strings/java_char_array_init/test.desc
@@ -1,11 +1,7 @@
-FUTURE
+CORE
 test_init.class
---string-refine
+--refine-strings --string-max-length 1000
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_init.java line 16: SUCCESS$
-^\[assertion.2\] assertion at file test_init.java line 17: SUCCESS$
-^\[assertion.3\] assertion at file test_init.java line 18: SUCCESS$
-^\[assertion.4\] assertion at file test_init.java line 20: SUCCESS$
-^\[assertion.5\] assertion at file test_init.java line 21: FAILURE$
+^\[.*assertion.1\].* line 14.* FAILURE$
 --
diff --git a/regression/strings/java_char_array_init/test_init.class b/regression/strings/java_char_array_init/test_init.class
index be3baee56bd..ff9c64510da 100644
Binary files a/regression/strings/java_char_array_init/test_init.class and b/regression/strings/java_char_array_init/test_init.class differ
diff --git a/regression/strings/java_char_array_init/test_init.java b/regression/strings/java_char_array_init/test_init.java
index 5f4e220844c..b27030b1306 100644
--- a/regression/strings/java_char_array_init/test_init.java
+++ b/regression/strings/java_char_array_init/test_init.java
@@ -1,23 +1,18 @@
 public class test_init {
 
-    public static void main(String[] argv)
-    {
-	char [] str = new char[10];
-	str[0] = 'H';
-	str[1] = 'e';
-	str[2] = 'l';
-	str[3] = 'l';
-	str[4] = 'o';
-	String s = new String(str);
-	String t = new String(str,1,2);
+  public static void main(/*String[] argv*/)
+  {
+     char [] str = new char[10];
+     str[0] = 'H';
+     str[1] = 'e';
+     str[2] = 'l';
+     str[3] = 'l';
+     str[4] = 'o';
+     String s = new String(str);
+     String t = new String(str,1,2);
 
-	System.out.println(s);
-	System.out.println(s.length());
-	assert(s.startsWith("Hello"));
-	assert(s.length() == 10);
-	assert(t.equals("el"));
-	String u = String.valueOf(str,3,2);
-	assert(u.equals("lo"));
-	assert(s.equals("Hello") || !t.equals("el") || !u.equals("lo"));
-    }
+     assert(s.length() != 10 || 
+            !t.equals("el") ||
+            !s.startsWith("Hello"));
+   }
 }
diff --git a/regression/strings/java_char_at/test.desc b/regression/strings/java_char_at/test.desc
index 6f206a0f22f..b9f7706b7e2 100644
--- a/regression/strings/java_char_at/test.desc
+++ b/regression/strings/java_char_at/test.desc
@@ -1,9 +1,7 @@
-FUTURE
+CORE
 test_char_at.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_char_at.java line 11: SUCCESS$
-^\[assertion.2\] assertion at file test_char_at.java line 13: FAILURE$
-^\[assertion.3\] assertion at file test_char_at.java line 15: SUCCESS$
+^\[.*assertion\.1\].* line 5.* FAILURE$
 --
diff --git a/regression/strings/java_char_at/test_char_at.class b/regression/strings/java_char_at/test_char_at.class
index 7d1f07fad7d..dc9ed32f19f 100644
Binary files a/regression/strings/java_char_at/test_char_at.class and b/regression/strings/java_char_at/test_char_at.class differ
diff --git a/regression/strings/java_char_at/test_char_at.java b/regression/strings/java_char_at/test_char_at.java
index 337c6524099..9ae02733fb8 100644
--- a/regression/strings/java_char_at/test_char_at.java
+++ b/regression/strings/java_char_at/test_char_at.java
@@ -1,17 +1,7 @@
 public class test_char_at {
 
-    public static void main(String[] argv) {
-	String s = new String("Hello World!");
-	char c = s.charAt(4);
-	StringBuilder sb = new StringBuilder(s);
-	sb.setCharAt(5,'-');
-	s = sb.toString();
-
-	if(argv.length==1)
-	    assert(c == 'o');
-	else if(argv.length==2)
-	    assert(c == 'p');
-	else
-	    assert(s.equals("Hello-World!"));
-    }
+  public static void main(/*String[] argv*/) {
+    String s = new String("abc");
+    assert(s.charAt(2)!='c');
+  }
 }
diff --git a/regression/strings/java_code_point/test.desc b/regression/strings/java_code_point/test.desc
index 35ca0cd6f4b..b8571739ab9 100644
--- a/regression/strings/java_code_point/test.desc
+++ b/regression/strings/java_code_point/test.desc
@@ -1,11 +1,7 @@
-FUTURE
+CORE
 test_code_point.class
---string-refine
-^EXIT=0$
+--refine-strings
+^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_code_point.java line 5: SUCCESS$
-^\[assertion.2\] assertion at file test_code_point.java line 6: SUCCESS$
-^\[assertion.3\] assertion at file test_code_point.java line 7: SUCCESS$
-^\[assertion.4\] assertion at file test_code_point.java line 8: SUCCESS$
-^\[assertion.5\] assertion at file test_code_point.java line 11: SUCCESS$
+^\[.*assertion\.1\].* line 8.* FAILURE$
 --
diff --git a/regression/strings/java_code_point/test_code_point.class b/regression/strings/java_code_point/test_code_point.class
index c257f0633ec..f2f5fbad63a 100644
Binary files a/regression/strings/java_code_point/test_code_point.class and b/regression/strings/java_code_point/test_code_point.class differ
diff --git a/regression/strings/java_code_point/test_code_point.java b/regression/strings/java_code_point/test_code_point.java
index c27a56f575c..345dc1fa08b 100644
--- a/regression/strings/java_code_point/test_code_point.java
+++ b/regression/strings/java_code_point/test_code_point.java
@@ -1,13 +1,14 @@
-public class test_code_point {
-
-    public static void main(String[] argv) {
-	String s = "!𐤇𐤄𐤋𐤋𐤅"; 
-	assert(s.codePointAt(1) == 67847);
-	assert(s.codePointBefore(3) == 67847);
-	assert(s.codePointCount(1,5) >= 2);
-	assert(s.offsetByCodePoints(1,2) >= 3);
-	StringBuilder sb = new StringBuilder();
-	sb.appendCodePoint(0x10907);
-	assert(s.charAt(1) == sb.charAt(0));
-    }
+public class test_code_point
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "!𐤇𐤄𐤋𐤋𐤅";
+      StringBuilder sb = new StringBuilder();
+      sb.appendCodePoint(0x10907);
+      assert(s.codePointAt(1) != 67847 ||
+             s.codePointBefore(3) != 67847 ||
+             s.codePointCount(1,5) < 2 ||
+             s.offsetByCodePoints(1,2) < 3  ||
+             s.charAt(1) != sb.charAt(0));
+   }
 }
diff --git a/regression/strings/java_compare/test.desc b/regression/strings/java_compare/test.desc
index 517b208c3e4..c409e58fadc 100644
--- a/regression/strings/java_compare/test.desc
+++ b/regression/strings/java_compare/test.desc
@@ -1,10 +1,7 @@
-FUTURE
+CORE
 test_compare.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_compare.java line 6: SUCCESS$
-^\[assertion.2\] assertion at file test_compare.java line 8: FAILURE$
-^\[assertion.3\] assertion at file test_compare.java line 11: SUCCESS$
-^\[assertion.4\] assertion at file test_compare.java line 12: FAILURE$
+^\[.*assertion\.1\].* line 7.* FAILURE$
 --
diff --git a/regression/strings/java_compare/test_compare.class b/regression/strings/java_compare/test_compare.class
index 5616013c523..67f18914ea6 100644
Binary files a/regression/strings/java_compare/test_compare.class and b/regression/strings/java_compare/test_compare.class differ
diff --git a/regression/strings/java_compare/test_compare.java b/regression/strings/java_compare/test_compare.java
index 8c1d4b71a0c..0a535fd0bf3 100644
--- a/regression/strings/java_compare/test_compare.java
+++ b/regression/strings/java_compare/test_compare.java
@@ -1,18 +1,9 @@
-public class test_compare {
-
-    public static void main(String[] argv) {
-	String s1 = "abc";
-	String s2 = "aac";
-	assert(s1.compareTo(s2) == 1);
-
-	assert(s2.compareTo(argv[0]) != -1);
-	
-	String s3 = "abc";
-	assert(s3.hashCode() == s1.hashCode());
-	assert(s3.hashCode() == s2.hashCode());
-			  
-	/*String x = s1.intern();
-	String y = s3.intern();
-	assert(x == y);*/
-    }
+public class test_compare
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s1 = "ab";
+      String s2 = "aa";
+      assert(s1.compareTo(s2) != 1);
+   }
 }
diff --git a/regression/strings/java_concat/test.desc b/regression/strings/java_concat/test.desc
index 8ef2898e0d7..2dcca464779 100644
--- a/regression/strings/java_concat/test.desc
+++ b/regression/strings/java_concat/test.desc
@@ -1,8 +1,8 @@
-FUTURE
+CORE
 test_concat.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_concat.java line 9: SUCCESS$
-^\[assertion.2\] assertion at file test_concat.java line 10: FAILURE$
+^\[.*assertion.1\].* line 10.* SUCCESS$
+^\[.*assertion.2\].* line 11.* FAILURE$
 --
diff --git a/regression/strings/java_concat/test_concat.class b/regression/strings/java_concat/test_concat.class
index a6d4008aa26..a69c05921f6 100644
Binary files a/regression/strings/java_concat/test_concat.class and b/regression/strings/java_concat/test_concat.class differ
diff --git a/regression/strings/java_concat/test_concat.java b/regression/strings/java_concat/test_concat.java
index d714ea89538..6bbe753b2e4 100644
--- a/regression/strings/java_concat/test_concat.java
+++ b/regression/strings/java_concat/test_concat.java
@@ -1,12 +1,13 @@
-public class test_concat {
-
-    public static void main(String[] argv) {
-	String s = new String("pi");
-	int i = s.length();
-	String t = new String("ppo");
-	String u = s.concat(t);
-	char c = u.charAt(i);
-	assert(c == 'p');
-	assert(c == 'o');
-    }
+public class test_concat
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("pi");
+      int i = s.length();
+      String t = new String("ppo");
+      String u = s.concat(t);
+      char c = u.charAt(i);
+      assert(c == 'p');
+      assert(c != 'p');
+   }
 }
diff --git a/regression/strings/java_contains/test.desc b/regression/strings/java_contains/test.desc
index 4e7a3bd4f7d..e5bb1edbc3b 100644
--- a/regression/strings/java_contains/test.desc
+++ b/regression/strings/java_contains/test.desc
@@ -1,8 +1,7 @@
-FUTURE
+CORE
 test_contains.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_contains.java line 7: SUCCESS$
-^\[assertion.2\] assertion at file test_contains.java line 8: FAILURE$
+^\[.*assertion\.1\].* line 7.* FAILURE$
 --
diff --git a/regression/strings/java_contains/test_contains.class b/regression/strings/java_contains/test_contains.class
index 855ab828393..9bbccb03775 100644
Binary files a/regression/strings/java_contains/test_contains.class and b/regression/strings/java_contains/test_contains.class differ
diff --git a/regression/strings/java_contains/test_contains.java b/regression/strings/java_contains/test_contains.java
index fce2ee63047..6f4c60a1a2e 100644
--- a/regression/strings/java_contains/test_contains.java
+++ b/regression/strings/java_contains/test_contains.java
@@ -1,10 +1,9 @@
-public class test_contains {
-
-    public static void main(String[] argv) {
-	String s = new String("Hello World!");
-	String u = "o W";
-	String t = "W o";
-	assert(s.contains(u));	
-	assert(s.contains(t));
-    }
+public class test_contains
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Abc");
+      String u = "bc";
+      assert(!s.contains(u));
+   }
 }
diff --git a/regression/strings/java_delete/test.desc b/regression/strings/java_delete/test.desc
index c6c608c0955..964669b6896 100644
--- a/regression/strings/java_delete/test.desc
+++ b/regression/strings/java_delete/test.desc
@@ -1,8 +1,7 @@
-FUTURE
+CORE
 test_delete.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_delete.java line 11: SUCCESS$
-^\[assertion.2\] assertion at file test_delete.java line 12: FAILURE$
+^\[.*assertion\.1\].* line 8.* FAILURE$
 --
diff --git a/regression/strings/java_delete/test_delete.class b/regression/strings/java_delete/test_delete.class
index 6d30024f108..7036ce13c90 100644
Binary files a/regression/strings/java_delete/test_delete.class and b/regression/strings/java_delete/test_delete.class differ
diff --git a/regression/strings/java_delete/test_delete.java b/regression/strings/java_delete/test_delete.java
index c91b16c5b89..ea846cd215a 100644
--- a/regression/strings/java_delete/test_delete.java
+++ b/regression/strings/java_delete/test_delete.java
@@ -1,15 +1,10 @@
-public class test_delete {
-
-    public static void main(String[] argv) {
-	StringBuilder s = new StringBuilder();
-	s.append("Hello World!");
-	s.delete(4,6);
-	s.deleteCharAt(1);
-
-	String str = s.toString();
-	System.out.println(str);
-	assert(str.equals("HllWorld!"));
-	assert(!str.equals("HllWorld!"));
-
-    }
+public class test_delete
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder s = new StringBuilder("Abc");
+      s.delete(1,2);
+      String str = s.toString();
+      assert(!str.equals("Ac"));
+   }
 }
diff --git a/regression/strings/java_delete_char_at/test.desc b/regression/strings/java_delete_char_at/test.desc
new file mode 100644
index 00000000000..8450851614c
--- /dev/null
+++ b/regression/strings/java_delete_char_at/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_delete_char_at.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 9.* FAILURE$
+--
diff --git a/regression/strings/java_delete_char_at/test_delete_char_at.class b/regression/strings/java_delete_char_at/test_delete_char_at.class
new file mode 100644
index 00000000000..ed3148e2f7e
Binary files /dev/null and b/regression/strings/java_delete_char_at/test_delete_char_at.class differ
diff --git a/regression/strings/java_delete_char_at/test_delete_char_at.java b/regression/strings/java_delete_char_at/test_delete_char_at.java
new file mode 100644
index 00000000000..5f2c995b56b
--- /dev/null
+++ b/regression/strings/java_delete_char_at/test_delete_char_at.java
@@ -0,0 +1,11 @@
+public class test_delete_char_at
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder s = new StringBuilder();
+      s.append("Abc");
+      s.deleteCharAt(1);
+      String str = s.toString();
+      assert(!str.equals("Ac"));
+   }
+}
diff --git a/regression/strings/java_easychair/easychair.class b/regression/strings/java_easychair/easychair.class
index e47900cc0b2..e6c5f66c42d 100644
Binary files a/regression/strings/java_easychair/easychair.class and b/regression/strings/java_easychair/easychair.class differ
diff --git a/regression/strings/java_easychair/easychair.java b/regression/strings/java_easychair/easychair.java
index 55ca2a31bb3..caed962fb46 100644
--- a/regression/strings/java_easychair/easychair.java
+++ b/regression/strings/java_easychair/easychair.java
@@ -1,34 +1,34 @@
-public class easychair {
+public class easychair
+{
+   public static void main(String[] argv)
+   {
+      if(argv.length > 1)
+      {
+         String str = new String(argv[1]);
+         if(str.length() < 40)
+         {
+            // containing "/" and containing "EasyChair"
+            int lastSlash = str.lastIndexOf('/');
+            if(lastSlash < 0) return ;
 
-    public static void main(String[] argv) {
-	if(argv.length > 1){
-	    String str = new String(argv[1]);
-	    if(str.length() < 40){
-
-		// containing "/" and containing "EasyChair"
-		int lastSlash = str.lastIndexOf('/');
-		if(lastSlash < 0) return ;
-		
-		String rest = str.substring(lastSlash + 1);
-		// warning: removed this because contains is not efficient at the moment
-		if(! rest.contains("EasyChair")) return ;
-		// (2) Check that str starts with "http://"
-		if(! str.startsWith("http://")) return ;
-		// (3) Take the string between "http://" and the last "/".
-		// if it starts with "www." strip the "www." off
-		String t = str.substring("http://".length(),lastSlash - "http://".length());
-		if(t.startsWith("www."))
-		    t = t.substring("www.".length());
-		
-		//
-		//(4) Check that after stripping we have either "live.com"
-		// or "google.com"
-		if(!t.equals("live.com") && !t.equals("google.com"))
-		    return ;
-		// s survived all checks
-		assert(false); //return true;
-	    }
-	}
-    }
+            String rest = str.substring(lastSlash + 1);
+            // warning: removed this because contains is not efficient at the moment
+            if(! rest.contains("EasyChair")) return ;
+            // (2) Check that str starts with "http://"
+            if(! str.startsWith("http://")) return ;
+            // (3) Take the string between "http://" and the last "/".
+            // if it starts with "www." strip the "www." off
+            String t = str.substring("http://".length(),lastSlash - "http://".length());
+            if(t.startsWith("www."))
+            t = t.substring("www.".length());
 
+            //(4) Check that after stripping we have either "live.com"
+            // or "google.com"
+            if(!t.equals("live.com") && !t.equals("google.com"))
+               return ;
+            // s survived all checks
+            assert(false); //return true;
+         }
+      }
+   }
 }
diff --git a/regression/strings/java_easychair/test.desc b/regression/strings/java_easychair/test.desc
index 8680af72c5a..004b61e2b18 100644
--- a/regression/strings/java_easychair/test.desc
+++ b/regression/strings/java_easychair/test.desc
@@ -1,7 +1,7 @@
-FUTURE
+THOROUGH
 easychair.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file easychair.java line 29: FAILURE$
+^\[.*assertion\.1\].* line 30.* FAILURE$
 --
diff --git a/regression/strings/java_empty/test.desc b/regression/strings/java_empty/test.desc
index cab514b80b5..0d2635c6963 100644
--- a/regression/strings/java_empty/test.desc
+++ b/regression/strings/java_empty/test.desc
@@ -1,8 +1,7 @@
-FUTURE
+CORE
 test_empty.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_empty.java line 4: SUCCESS$
-^\[assertion.2\] assertion at file test_empty.java line 5: FAILURE$
+^\[.*assertion\.1\].* line 6.* FAILURE$
 --
diff --git a/regression/strings/java_empty/test_empty.class b/regression/strings/java_empty/test_empty.class
index f0ced290ee3..147a2b628fe 100644
Binary files a/regression/strings/java_empty/test_empty.class and b/regression/strings/java_empty/test_empty.class differ
diff --git a/regression/strings/java_empty/test_empty.java b/regression/strings/java_empty/test_empty.java
index 2465fb16e41..18fde4a115e 100644
--- a/regression/strings/java_empty/test_empty.java
+++ b/regression/strings/java_empty/test_empty.java
@@ -1,7 +1,8 @@
-public class test_empty {
-    public static void main(String[] argv) {
-	String empty = "   ";
-	assert(empty.trim().isEmpty());
-	assert(empty.isEmpty());
-    }
+public class test_empty
+{
+   public static void main(/*String[] argv*/)
+   {
+      String empty = "";
+      assert(!empty.isEmpty());
+   }
 }
diff --git a/regression/strings/java_endswith/test.desc b/regression/strings/java_endswith/test.desc
new file mode 100644
index 00000000000..8d6444b75bd
--- /dev/null
+++ b/regression/strings/java_endswith/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_endswith.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 7.* FAILURE$
+--
diff --git a/regression/strings/java_endswith/test_endswith.class b/regression/strings/java_endswith/test_endswith.class
new file mode 100644
index 00000000000..e3d453c444f
Binary files /dev/null and b/regression/strings/java_endswith/test_endswith.class differ
diff --git a/regression/strings/java_endswith/test_endswith.java b/regression/strings/java_endswith/test_endswith.java
new file mode 100644
index 00000000000..fabf6f8dde0
--- /dev/null
+++ b/regression/strings/java_endswith/test_endswith.java
@@ -0,0 +1,9 @@
+public class test_endswith
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = new String("Abcd");
+      String suff = "cd";
+      assert(!s.endsWith(suff));
+   }
+}
diff --git a/regression/strings/java_equal/test.desc b/regression/strings/java_equal/test.desc
index d66c30b26fe..3e744a2eb05 100644
--- a/regression/strings/java_equal/test.desc
+++ b/regression/strings/java_equal/test.desc
@@ -1,8 +1,7 @@
-FUTURE
+CORE
 test_equal.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_equal.java line 7: FAILURE$
-^\[assertion.2\] assertion at file test_equal.java line 8: SUCCESS$
+^\[.*assertion\.1\].* line 8.* FAILURE$
 --
diff --git a/regression/strings/java_equal/test_equal.class b/regression/strings/java_equal/test_equal.class
index 26ee19e6cb1..e0fc6db8aaf 100644
Binary files a/regression/strings/java_equal/test_equal.class and b/regression/strings/java_equal/test_equal.class differ
diff --git a/regression/strings/java_equal/test_equal.java b/regression/strings/java_equal/test_equal.java
index 151162a106d..e8c9ac7cb1a 100644
--- a/regression/strings/java_equal/test_equal.java
+++ b/regression/strings/java_equal/test_equal.java
@@ -1,10 +1,9 @@
-public class test_equal {
-
-    public static void main(String[] argv) {
-	String s = new String("pi");
-	String t = new String("po");
-	String u = "po";
-	assert(s.equals(t));
-	assert(t.equals(u));
-    }
+public class test_equal
+{
+   public static void main(String[] argv)
+   {
+      String s = new String("pi");
+      String t = new String("po");
+      assert(!s.equals(t));
+   }
 }
diff --git a/regression/strings/java_float/test.desc b/regression/strings/java_float/test.desc
index 955f0358eab..7a560bf3ccf 100644
--- a/regression/strings/java_float/test.desc
+++ b/regression/strings/java_float/test.desc
@@ -1,10 +1,7 @@
-FUTURE
+THOROUGH
 test_float.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_float.java line 14: SUCCESS$
-^\[assertion.2\] assertion at file test_float.java line 15: SUCCESS$
-^\[assertion.3\] assertion at file test_float.java line 16: SUCCESS$
-^\[assertion.4\] assertion at file test_float.java line 17: FAILURE$
+^\[.*assertion\.1\].* line 15.* FAILURE$
 --
diff --git a/regression/strings/java_float/test_float.class b/regression/strings/java_float/test_float.class
index 356d0e17871..00e8622e2ac 100644
Binary files a/regression/strings/java_float/test_float.class and b/regression/strings/java_float/test_float.class differ
diff --git a/regression/strings/java_float/test_float.java b/regression/strings/java_float/test_float.java
index e59c631d91e..312f1aeaf10 100644
--- a/regression/strings/java_float/test_float.java
+++ b/regression/strings/java_float/test_float.java
@@ -1,20 +1,17 @@
-public class test_float {
-
-    public static void main(String[] arg) {
-	float inf = 100.0f / 0.0f;
-	float minus_inf = -100.0f / 0.0f;
-	float nan = 0.0f / 0.0f;
-	String inf_string = Float.toString(inf);
-	String mininf_string = Float.toString(minus_inf);
-	String nan_string = Float.toString(nan);
-	//String arg1 = arg[0];
-	System.out.println(nan_string);
-	System.out.println(inf_string);
-	System.out.println(mininf_string);
-	assert(nan_string.equals("NaN"));
-	assert(inf_string.equals("Infinity"));
-	assert(mininf_string.equals("-Infinity"));
-	assert(!nan_string.equals("NaN") || !inf_string.equals("Infinity")
-	       || !mininf_string.equals("-Infinity"));
-    }
+public class test_float
+{
+   public static void main(/*String[] arg*/)
+   {
+      float inf = 100.0f / 0.0f;
+      float minus_inf = -100.0f / 0.0f;
+      float nan = 0.0f / 0.0f;
+      String inf_string = Float.toString(inf);
+      String mininf_string = Float.toString(minus_inf);
+      String nan_string = Float.toString(nan);
+      System.out.println(nan_string);
+      System.out.println(inf_string);
+      System.out.println(mininf_string);
+      assert(!nan_string.equals("NaN") || !inf_string.equals("Infinity")
+             || !mininf_string.equals("-Infinity"));
+   }
 }
diff --git a/regression/strings/java_hash_code/test.desc b/regression/strings/java_hash_code/test.desc
new file mode 100644
index 00000000000..b8893f4a9b0
--- /dev/null
+++ b/regression/strings/java_hash_code/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_hash_code.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 7.* FAILURE$
+--
diff --git a/regression/strings/java_hash_code/test_hash_code.class b/regression/strings/java_hash_code/test_hash_code.class
new file mode 100644
index 00000000000..d9b3e2b2f3d
Binary files /dev/null and b/regression/strings/java_hash_code/test_hash_code.class differ
diff --git a/regression/strings/java_hash_code/test_hash_code.java b/regression/strings/java_hash_code/test_hash_code.java
new file mode 100644
index 00000000000..fbc15f0b4c2
--- /dev/null
+++ b/regression/strings/java_hash_code/test_hash_code.java
@@ -0,0 +1,9 @@
+public class test_hash_code
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s1 = "ab";
+      String s2 = "ab";
+      assert(s1.hashCode() != s2.hashCode());
+   }
+}
diff --git a/regression/strings/java_index_of/test.desc b/regression/strings/java_index_of/test.desc
index daa6c32493b..67ff3297142 100644
--- a/regression/strings/java_index_of/test.desc
+++ b/regression/strings/java_index_of/test.desc
@@ -1,16 +1,7 @@
-FUTURE
+CORE
 test_index_of.class
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[assertion.1\] assertion at file test_index_of.java line 13: SUCCESS$
-^\[assertion.2\] assertion at file test_index_of.java line 14: FAILURE$
-^\[assertion.3\] assertion at file test_index_of.java line 17: SUCCESS$
-^\[assertion.4\] assertion at file test_index_of.java line 18: FAILURE$
-^\[assertion.5\] assertion at file test_index_of.java line 21: SUCCESS$
-^\[assertion.6\] assertion at file test_index_of.java line 22: FAILURE$
-^\[assertion.7\] assertion at file test_index_of.java line 25: SUCCESS$
-^\[assertion.8\] assertion at file test_index_of.java line 26: FAILURE$
-^\[assertion.9\] assertion at file test_index_of.java line 28: SUCCESS$
-^\[assertion.10\] assertion at file test_index_of.java line 29: SUCCESS$
+^\[.*assertion\.1\].* line 8.* FAILURE$
 --
diff --git a/regression/strings/java_index_of/test_index_of.class b/regression/strings/java_index_of/test_index_of.class
index 8b3b7525f1a..cae397a79fb 100644
Binary files a/regression/strings/java_index_of/test_index_of.class and b/regression/strings/java_index_of/test_index_of.class differ
diff --git a/regression/strings/java_index_of/test_index_of.java b/regression/strings/java_index_of/test_index_of.java
index bbe06d279ec..b607ba79570 100644
--- a/regression/strings/java_index_of/test_index_of.java
+++ b/regression/strings/java_index_of/test_index_of.java
@@ -1,32 +1,10 @@
-public class test_index_of {
-
-    public static void main(String[] argv) {
-	String s = "Hello World!"; 
-	char c = 'o';
-	int i = s.indexOf(c);
-	int j = s.lastIndexOf('o');
-	int k = s.indexOf(c,5);
-	int l = s.lastIndexOf(c,5);
-	int m = s.indexOf("lo");
-	int n = s.lastIndexOf("lo");
-	if(argv.length == 1){
-	    assert(i == 4);
-	    assert(i != 4);
-	}
-	else if(argv.length == 2){
-	    assert(j == 7);	
-	    assert(j != 7);
-	}
-	else if(argv.length == 3){
-	    assert(k == 7);
-	    assert(k != 7);
-	}
-	else if(argv.length == 4){
-	    assert(l == 4);
-	    assert(l != 4);
-	} else {
-	    assert(m != 2);
-	    assert(n != 2);
-	}
-    }
+public class test_index_of
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "Abc";
+      String bc = "bc";
+      int i = s.indexOf(bc);
+      assert(i != 1);
+   }
 }
diff --git a/regression/strings/java_index_of_char/test.desc b/regression/strings/java_index_of_char/test.desc
new file mode 100644
index 00000000000..83fbccc0515
--- /dev/null
+++ b/regression/strings/java_index_of_char/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_index_of_char.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 8.* FAILURE$
+--
diff --git a/regression/strings/java_index_of_char/test_index_of_char.class b/regression/strings/java_index_of_char/test_index_of_char.class
new file mode 100644
index 00000000000..bf4fa6e946e
Binary files /dev/null and b/regression/strings/java_index_of_char/test_index_of_char.class differ
diff --git a/regression/strings/java_index_of_char/test_index_of_char.java b/regression/strings/java_index_of_char/test_index_of_char.java
new file mode 100644
index 00000000000..92d75b3b07d
--- /dev/null
+++ b/regression/strings/java_index_of_char/test_index_of_char.java
@@ -0,0 +1,10 @@
+public class test_index_of_char
+{
+   public static void main(/*String[] argv*/)
+   {
+      String s = "Abc";
+      char c = 'c';
+      int i = s.indexOf(c);
+      assert(i != 2);
+   }
+}
diff --git a/regression/strings/java_insert/test_insert.class b/regression/strings/java_insert/test_insert.class
deleted file mode 100644
index 5fa0f425061..00000000000
Binary files a/regression/strings/java_insert/test_insert.class and /dev/null differ
diff --git a/regression/strings/java_insert/test_insert.java b/regression/strings/java_insert/test_insert.java
deleted file mode 100644
index 6871a51716c..00000000000
--- a/regression/strings/java_insert/test_insert.java
+++ /dev/null
@@ -1,19 +0,0 @@
-public class test_insert {
-
-    public static void main(String[] argv) {
-	int i = 123;
-	long j = 123;
-	char c = '/';
-	boolean b = true;
-	StringBuilder sb = new StringBuilder("hello");
-	sb.insert(2,i);
-	sb.insert(2,c);
-	sb.insert(2,j);
-	sb.insert(2,b);
-	sb.insert(2,"abc");
-	String s = sb.toString();
-	System.out.println(s);
-	assert(s.equals("heabctrue123/123llo"));
-	assert(!s.equals("heabctrue123/123llo"));
-    }
-}
diff --git a/regression/strings/java_insert/test_insert1.class b/regression/strings/java_insert/test_insert1.class
deleted file mode 100644
index 80091936cea..00000000000
Binary files a/regression/strings/java_insert/test_insert1.class and /dev/null differ
diff --git a/regression/strings/java_insert/test_insert1.java b/regression/strings/java_insert/test_insert1.java
deleted file mode 100644
index 54e754302c5..00000000000
--- a/regression/strings/java_insert/test_insert1.java
+++ /dev/null
@@ -1,23 +0,0 @@
-public class test_insert1 {
-
-    public static void main(String[] argv) {
-	int i = 123;
-	long j = 123;
-	char c = '/';
-	boolean b = true;
-	StringBuilder sb = new StringBuilder("hello");
-	sb.insert(2,i);
-
-	/*
-	sb.insert(2,c);
-	sb.insert(2,j);
-	sb.insert(2,b);
-	sb.insert(2,"abc");
-	*/
-	String s = sb.toString();
-	System.out.println(s);
-	assert(s.equals("he123llo"));
-	//assert(s.equals("heabctrue123/123llo"));
-	//assert(!s.equals("heabctrue123/123llo"));
-    }
-}
diff --git a/regression/strings/java_insert_char/test.desc b/regression/strings/java_insert_char/test.desc
new file mode 100644
index 00000000000..cdda3eeae95
--- /dev/null
+++ b/regression/strings/java_insert_char/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_char.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 8.* FAILURE$
+--
diff --git a/regression/strings/java_insert_char/test_insert_char.class b/regression/strings/java_insert_char/test_insert_char.class
new file mode 100644
index 00000000000..fbf4a82070b
Binary files /dev/null and b/regression/strings/java_insert_char/test_insert_char.class differ
diff --git a/regression/strings/java_insert_char/test_insert_char.java b/regression/strings/java_insert_char/test_insert_char.java
new file mode 100644
index 00000000000..3a83f03b332
--- /dev/null
+++ b/regression/strings/java_insert_char/test_insert_char.java
@@ -0,0 +1,10 @@
+public class test_insert_char
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ac");
+      sb.insert(1, 'b');
+      String s = sb.toString();
+      assert(!s.equals("abc"));
+   }
+}
diff --git a/regression/strings/java_insert_char_array/test.desc b/regression/strings/java_insert_char_array/test.desc
new file mode 100644
index 00000000000..648fec2fa7d
--- /dev/null
+++ b/regression/strings/java_insert_char_array/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_char_array.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 12.* FAILURE$
+--
diff --git a/regression/strings/java_insert_char_array/test_insert_char_array.class b/regression/strings/java_insert_char_array/test_insert_char_array.class
new file mode 100644
index 00000000000..bc1a23a7496
Binary files /dev/null and b/regression/strings/java_insert_char_array/test_insert_char_array.class differ
diff --git a/regression/strings/java_insert_char_array/test_insert_char_array.java b/regression/strings/java_insert_char_array/test_insert_char_array.java
new file mode 100644
index 00000000000..079dbd2fee6
--- /dev/null
+++ b/regression/strings/java_insert_char_array/test_insert_char_array.java
@@ -0,0 +1,14 @@
+public class test_insert_char_array
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ad");
+      char[] array = new char[2];
+      array[0] = 'b';
+      array[1] = 'c';
+      sb.insert(1, array);
+      String s = sb.toString();
+      System.out.println(s);
+      assert(!s.equals("abcd"));
+   }
+}
diff --git a/regression/strings/java_insert_int/test.desc b/regression/strings/java_insert_int/test.desc
new file mode 100644
index 00000000000..bc25e9abf3c
--- /dev/null
+++ b/regression/strings/java_insert_int/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_int.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 8.* FAILURE$
+--
diff --git a/regression/strings/java_insert_int/test_insert_int.class b/regression/strings/java_insert_int/test_insert_int.class
new file mode 100644
index 00000000000..cd355c86546
Binary files /dev/null and b/regression/strings/java_insert_int/test_insert_int.class differ
diff --git a/regression/strings/java_insert_int/test_insert_int.java b/regression/strings/java_insert_int/test_insert_int.java
new file mode 100644
index 00000000000..15a7a2d53f6
--- /dev/null
+++ b/regression/strings/java_insert_int/test_insert_int.java
@@ -0,0 +1,10 @@
+public class test_insert_int
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ac");
+      sb.insert(1, 42);
+      String s = sb.toString();
+      assert(!s.equals("a42c"));
+   }
+}
diff --git a/regression/strings/java_insert_multiple/test.desc b/regression/strings/java_insert_multiple/test.desc
new file mode 100644
index 00000000000..3ad6df9d1e2
--- /dev/null
+++ b/regression/strings/java_insert_multiple/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_multiple.class
+--refine-strings
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 9.* FAILURE$
+--
diff --git a/regression/strings/java_insert_multiple/test_insert_multiple.class b/regression/strings/java_insert_multiple/test_insert_multiple.class
new file mode 100644
index 00000000000..d6b470a1f72
Binary files /dev/null and b/regression/strings/java_insert_multiple/test_insert_multiple.class differ
diff --git a/regression/strings/java_insert_multiple/test_insert_multiple.java b/regression/strings/java_insert_multiple/test_insert_multiple.java
new file mode 100644
index 00000000000..c976ddd807f
--- /dev/null
+++ b/regression/strings/java_insert_multiple/test_insert_multiple.java
@@ -0,0 +1,11 @@
+public class test_insert_multiple
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ad");
+      sb.insert(1, 'c');
+      sb.insert(1, "b");
+      String s = sb.toString();
+      assert(!s.equals("abcd"));
+   }
+}
diff --git a/regression/strings/java_insert_string/test.desc b/regression/strings/java_insert_string/test.desc
new file mode 100644
index 00000000000..79fa2931c93
--- /dev/null
+++ b/regression/strings/java_insert_string/test.desc
@@ -0,0 +1,7 @@
+CORE
+test_insert_string.class
+--refine-strings --string-max-length 1000
+^EXIT=10$
+^SIGNAL=0$
+^\[.*assertion\.1\].* line 8.* FAILURE$
+--
diff --git a/regression/strings/java_insert_string/test_insert_string.class b/regression/strings/java_insert_string/test_insert_string.class
new file mode 100644
index 00000000000..be8f7ad0f79
Binary files /dev/null and b/regression/strings/java_insert_string/test_insert_string.class differ
diff --git a/regression/strings/java_insert_string/test_insert_string.java b/regression/strings/java_insert_string/test_insert_string.java
new file mode 100644
index 00000000000..028a348122b
--- /dev/null
+++ b/regression/strings/java_insert_string/test_insert_string.java
@@ -0,0 +1,10 @@
+public class test_insert_string
+{
+   public static void main(/*String[] argv*/)
+   {
+      StringBuilder sb = new StringBuilder("ad");
+      sb.insert(1, "bc");
+      String s = sb.toString();
+      assert(!s.equals("abcd"));
+   }
+}
diff --git a/regression/strings/java_int/test.desc b/regression/strings/java_int/test.desc
deleted file mode 100644
index ae60dd78af0..00000000000
--- a/regression/strings/java_int/test.desc
+++ /dev/null
@@ -1,13 +0,0 @@
-FUTURE
-test_int.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_int.java line 8: SUCCESS$
-^\[assertion.2\] assertion at file test_int.java line 9: SUCCESS$
-^\[assertion.3\] assertion at file test_int.java line 12: SUCCESS$
-^\[assertion.4\] assertion at file test_int.java line 15: SUCCESS$
-^\[assertion.5\] assertion at file test_int.java line 18: SUCCESS$
-^\[assertion.6\] assertion at file test_int.java line 21: SUCCESS$
-^\[assertion.7\] assertion at file test_int.java line 23: FAILURE$
---
diff --git a/regression/strings/java_int/test_int.class b/regression/strings/java_int/test_int.class
deleted file mode 100644
index 643d7eca09c..00000000000
Binary files a/regression/strings/java_int/test_int.class and /dev/null differ
diff --git a/regression/strings/java_int/test_int.java b/regression/strings/java_int/test_int.java
deleted file mode 100644
index 620ae638dce..00000000000
--- a/regression/strings/java_int/test_int.java
+++ /dev/null
@@ -1,25 +0,0 @@
-public class test_int {
-
-    public static void main(String[] argv) {
-	String s = Integer.toString(2345);
-	char c = s.charAt(1);
-	char d = s.charAt(2);
-	char e = s.charAt(3);
-	assert(c == '3');
-	assert(d == '4');
-
-	int i = Integer.parseInt("1234");
-	assert(i == 1234);
-
-	String t = Integer.toString(-2345);
-	assert(t.charAt(0) == '-');
-	
-	int j = Integer.parseInt("-4231");
-	assert(j == -4231);
-
-	String u = Integer.toHexString(43981);
-	assert(u.equals("abcd"));
-
-	assert(e == '2' || i < 1234 || t.charAt(0) != '-' || j != -4231 || !u.equals("abcd"));
-    }
-}
diff --git a/regression/strings/java_prefix/test.desc b/regression/strings/java_prefix/test.desc
deleted file mode 100644
index 175f934ca1d..00000000000
--- a/regression/strings/java_prefix/test.desc
+++ /dev/null
@@ -1,10 +0,0 @@
-FUTURE
-test_prefix.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_prefix.java line 14: SUCCESS$
-^\[assertion.2\] assertion at file test_prefix.java line 16: FAILURE$
-^\[assertion.3\] assertion at file test_prefix.java line 18: SUCCESS$
-^\[assertion.4\] assertion at file test_prefix.java line 20: FAILURE$
---
diff --git a/regression/strings/java_prefix/test_prefix.class b/regression/strings/java_prefix/test_prefix.class
deleted file mode 100644
index 6f5f4025932..00000000000
Binary files a/regression/strings/java_prefix/test_prefix.class and /dev/null differ
diff --git a/regression/strings/java_prefix/test_prefix.java b/regression/strings/java_prefix/test_prefix.java
deleted file mode 100644
index c9b5fa72fcf..00000000000
--- a/regression/strings/java_prefix/test_prefix.java
+++ /dev/null
@@ -1,23 +0,0 @@
-public class test_prefix {
-
-    public static void main(String[] argv) {
-	String s = new String("Hello World!");
-	//String t = new String("Hello");
-	//String u = new String("Wello");
-	String u = "Wello";
-	boolean b = s.startsWith("Hello");
-	//boolean c = s.startsWith("Wello");
-	//boolean b = s.startsWith(t);
-	boolean c = s.startsWith(u);
-	boolean d = s.startsWith("lo",3);
-	if(argv.length == 1){
-	    assert(b);	
-	} else if(argv.length == 2){
-	    assert(c);
-	} else if(argv.length == 3){
-	    assert(d);
-	} else if(argv.length == 4){	
-	    assert(!d);
-	}
-    }
-}
diff --git a/regression/strings/java_replace/test.desc b/regression/strings/java_replace/test.desc
deleted file mode 100644
index 1e89ebe37b4..00000000000
--- a/regression/strings/java_replace/test.desc
+++ /dev/null
@@ -1,8 +0,0 @@
-FUTURE
-test_replace.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_replace.java line 6: SUCCESS$
-^\[assertion.2\] assertion at file test_replace.java line 8: FAILURE$
---
diff --git a/regression/strings/java_replace/test_replace.class b/regression/strings/java_replace/test_replace.class
deleted file mode 100644
index c795826dc15..00000000000
Binary files a/regression/strings/java_replace/test_replace.class and /dev/null differ
diff --git a/regression/strings/java_replace/test_replace.java b/regression/strings/java_replace/test_replace.java
deleted file mode 100644
index 342bf9afddc..00000000000
--- a/regression/strings/java_replace/test_replace.java
+++ /dev/null
@@ -1,10 +0,0 @@
-public class test_replace {
-
-    public static void main(String[] argv) {
-	String s = new String("Hello World!");
-	String t = s.replace('o','u');
-	assert(t.equals("Hellu Wurld!"));
-	System.out.println(t);
-	assert(!t.equals("Hellu Wurld!"));
-    }
-}
diff --git a/regression/strings/java_set_length/test.desc b/regression/strings/java_set_length/test.desc
deleted file mode 100644
index 43f82a648fd..00000000000
--- a/regression/strings/java_set_length/test.desc
+++ /dev/null
@@ -1,9 +0,0 @@
-FUTURE
-test_set_length.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_set_length.java line 8: SUCCESS$
-^\[assertion.2\] assertion at file test_set_length.java line 9: SUCCESS$
-^\[assertion.3\] assertion at file test_set_length.java line 10: FAILURE$
---
diff --git a/regression/strings/java_set_length/test_set_length.class b/regression/strings/java_set_length/test_set_length.class
deleted file mode 100644
index 8836640967a..00000000000
Binary files a/regression/strings/java_set_length/test_set_length.class and /dev/null differ
diff --git a/regression/strings/java_set_length/test_set_length.java b/regression/strings/java_set_length/test_set_length.java
deleted file mode 100644
index 97b20f2332d..00000000000
--- a/regression/strings/java_set_length/test_set_length.java
+++ /dev/null
@@ -1,12 +0,0 @@
-public class test_set_length {
-
-    public static void main(String[] argv) {
-
-	StringBuilder s = new StringBuilder("abc");
-	s.setLength(10);
-	String t = s.toString();
-	assert(t.startsWith("abc"));
-	assert(t.length() == 10);
-	assert(t.length() == 3);
-    }
-}
diff --git a/regression/strings/java_string_builder/test.desc b/regression/strings/java_string_builder/test.desc
deleted file mode 100644
index 9712205b104..00000000000
--- a/regression/strings/java_string_builder/test.desc
+++ /dev/null
@@ -1,9 +0,0 @@
-FUTURE
-test_string_builder.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_string_builder.java line 11: SUCCESS$
-^\[assertion.2\] assertion at file test_string_builder.java line 12: SUCCESS$
-^\[assertion.3\] assertion at file test_string_builder.java line 13: FAILURE$
---
diff --git a/regression/strings/java_string_builder/test_string_builder.class b/regression/strings/java_string_builder/test_string_builder.class
deleted file mode 100644
index 7a61d1f02be..00000000000
Binary files a/regression/strings/java_string_builder/test_string_builder.class and /dev/null differ
diff --git a/regression/strings/java_string_builder/test_string_builder.java b/regression/strings/java_string_builder/test_string_builder.java
deleted file mode 100644
index 1d76b34e9f8..00000000000
--- a/regression/strings/java_string_builder/test_string_builder.java
+++ /dev/null
@@ -1,16 +0,0 @@
-public class test_string_builder {
-    public static void main(String[] argv) {
-	if(argv.length > 2) {
-	    StringBuilder tmp = new StringBuilder(); 
-	    tmp.append("prefix ");
-	    tmp.append(argv[1]);
-	    tmp.append(" middle ").append(argv[2]).append(" end");
-	    //StringBuilder tmp1 = tmp.append(argv[2]);
-	    //tmp1.append(" end");
-	    String r = tmp.toString();
-	    assert(r.startsWith("pref"));	    
-	    assert(r.endsWith("end"));
-	    assert(r.startsWith("pr3f"));
-	}
-    }
-}
diff --git a/regression/strings/java_string_builder_insert/test.desc b/regression/strings/java_string_builder_insert/test.desc
deleted file mode 100644
index 2655f846da1..00000000000
--- a/regression/strings/java_string_builder_insert/test.desc
+++ /dev/null
@@ -1,8 +0,0 @@
-FUTURE
-test_insert.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_insert.java line 17: SUCCESS$
-^\[assertion.2\] assertion at file test_insert.java line 18: FAILURE$
---
diff --git a/regression/strings/java_string_builder_insert/test_insert.class b/regression/strings/java_string_builder_insert/test_insert.class
deleted file mode 100644
index 69a32d7f93f..00000000000
Binary files a/regression/strings/java_string_builder_insert/test_insert.class and /dev/null differ
diff --git a/regression/strings/java_string_builder_insert/test_insert.java b/regression/strings/java_string_builder_insert/test_insert.java
deleted file mode 100644
index 1fac897c5ed..00000000000
--- a/regression/strings/java_string_builder_insert/test_insert.java
+++ /dev/null
@@ -1,20 +0,0 @@
-public class test_insert {
-
-    public static void main(String[] argv)
-    {
-	char [] str = new char[5];
-	str[0] = 'H';
-	str[1] = 'e';
-	str[2] = 'l';
-	str[3] = 'l';
-	str[4] = 'o';
-
-
-	StringBuilder sb = new StringBuilder(" world");
-	sb.insert(0,str);
-	String s = sb.toString();
-	System.out.println(s);
-	assert(s.equals("Hello world"));
-	assert(!s.equals("Hello world"));
-    }
-}
diff --git a/regression/strings/java_string_builder_length/test.desc b/regression/strings/java_string_builder_length/test.desc
deleted file mode 100644
index c4720992571..00000000000
--- a/regression/strings/java_string_builder_length/test.desc
+++ /dev/null
@@ -1,8 +0,0 @@
-FUTURE
-test_sb_length.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-\[assertion.1\] assertion at file test_sb_length.java line 6: SUCCESS$
-\[assertion.2\] assertion at file test_sb_length.java line 8: FAILURE$
---
diff --git a/regression/strings/java_string_builder_length/test_sb_length.class b/regression/strings/java_string_builder_length/test_sb_length.class
deleted file mode 100644
index 586e8f71935..00000000000
Binary files a/regression/strings/java_string_builder_length/test_sb_length.class and /dev/null differ
diff --git a/regression/strings/java_string_builder_length/test_sb_length.java b/regression/strings/java_string_builder_length/test_sb_length.java
deleted file mode 100644
index 652b72cdc90..00000000000
--- a/regression/strings/java_string_builder_length/test_sb_length.java
+++ /dev/null
@@ -1,11 +0,0 @@
-public class test_sb_length {
-    public static void main(String[] argv) {
-	StringBuilder tmp = new StringBuilder("prefix"); 
-	//tmp.append("prefix");
-	tmp.append("end");
-	assert(tmp.length() == 9);	    
-	if(argv.length > 1) {
-	    assert(tmp.length() == 12);	    
-	}
-    }
-}
diff --git a/regression/strings/java_strlen/test.desc b/regression/strings/java_strlen/test.desc
deleted file mode 100644
index b98e6f76f0a..00000000000
--- a/regression/strings/java_strlen/test.desc
+++ /dev/null
@@ -1,8 +0,0 @@
-FUTURE
-test_length.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_length.java line 10: SUCCESS$
-^\[assertion.2\] assertion at file test_length.java line 11: FAILURE$
---
diff --git a/regression/strings/java_strlen/test_length.class b/regression/strings/java_strlen/test_length.class
deleted file mode 100644
index 7f1c10c02ca..00000000000
Binary files a/regression/strings/java_strlen/test_length.class and /dev/null differ
diff --git a/regression/strings/java_strlen/test_length.java b/regression/strings/java_strlen/test_length.java
deleted file mode 100644
index 9410315db38..00000000000
--- a/regression/strings/java_strlen/test_length.java
+++ /dev/null
@@ -1,14 +0,0 @@
-public class test_length {
-
-    public static void main(String[] argv) {
-	String s = new String("hello");
-	if(argv.length > 1) {
-	    String t = argv[1];
-	    int i = t.length();
-	    String u = t.concat(s);
-	    char c = u.charAt(i);
-	    assert(c == 'h');
-	    assert(c == 'o');
-	}
-    }
-}
diff --git a/regression/strings/java_substring/test.desc b/regression/strings/java_substring/test.desc
deleted file mode 100644
index bd54a8204fe..00000000000
--- a/regression/strings/java_substring/test.desc
+++ /dev/null
@@ -1,10 +0,0 @@
-FUTURE
-test_substring.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_substring.java line 12: SUCCESS$
-^\[assertion.2\] assertion at file test_substring.java line 13: FAILURE$
-^\[assertion.3\] assertion at file test_substring.java line 20: SUCCESS$
-^\[assertion.4\] assertion at file test_substring.java line 21: FAILURE$
---
diff --git a/regression/strings/java_substring/test_substring.class b/regression/strings/java_substring/test_substring.class
deleted file mode 100644
index e6532aca43e..00000000000
Binary files a/regression/strings/java_substring/test_substring.class and /dev/null differ
diff --git a/regression/strings/java_substring/test_substring.java b/regression/strings/java_substring/test_substring.java
deleted file mode 100644
index 8a2ac883cca..00000000000
--- a/regression/strings/java_substring/test_substring.java
+++ /dev/null
@@ -1,27 +0,0 @@
-public class test_substring {
-
-    public static void main(String[] argv) {
-	if(argv.length > 1) {
-	    String t = argv[1];
-
-	    if(t.length() == 6) {
-		String u = t.substring(2,4);
-		char c = u.charAt(1);
-		char d = t.charAt(3);
-		char e = t.charAt(4);
-		assert(c == d);
-		assert(c == e);
-	    }
-	    else if(t.length() == 5){
-		CharSequence u = t.subSequence(2,4);
-		char c = u.charAt(1);
-		char d = t.charAt(3);
-		char e = t.charAt(4);
-		assert(c == d);
-		assert(c == e);
-	    }
-		
-
-	}
-    }
-}
diff --git a/regression/strings/java_suffix/test.desc b/regression/strings/java_suffix/test.desc
deleted file mode 100644
index 2740e87d6e4..00000000000
--- a/regression/strings/java_suffix/test.desc
+++ /dev/null
@@ -1,8 +0,0 @@
-FUTURE
-test_suffix.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_suffix.java line 12: SUCCESS$
-^\[assertion.2\] assertion at file test_suffix.java line 13: FAILURE$
---
diff --git a/regression/strings/java_suffix/test_suffix.class b/regression/strings/java_suffix/test_suffix.class
deleted file mode 100644
index 557acd02653..00000000000
Binary files a/regression/strings/java_suffix/test_suffix.class and /dev/null differ
diff --git a/regression/strings/java_suffix/test_suffix.java b/regression/strings/java_suffix/test_suffix.java
deleted file mode 100644
index f61b0b8ba36..00000000000
--- a/regression/strings/java_suffix/test_suffix.java
+++ /dev/null
@@ -1,15 +0,0 @@
-public class test_suffix {
-
-    public static void main(String[] argv) {
-	String s = new String("Hello World!");
-	//String t = new String("Hello");
-	//String u = new String("Wello");
-	String u = "Wello!";
-	boolean b = s.endsWith("World!");
-	//boolean c = s.startsWith("Wello");
-	//boolean b = s.startsWith(t);
-	boolean c = s.startsWith(u);
-	assert(b);	
-	assert(c);
-    }
-}
diff --git a/regression/strings/java_trim/test.desc b/regression/strings/java_trim/test.desc
deleted file mode 100644
index 7c0f1a87978..00000000000
--- a/regression/strings/java_trim/test.desc
+++ /dev/null
@@ -1,8 +0,0 @@
-FUTURE
-test_trim.class
---string-refine
-^EXIT=10$
-^SIGNAL=0$
-^\[assertion.1\] assertion at file test_trim.java line 5: SUCCESS$
-^\[assertion.2\] assertion at file test_trim.java line 6: FAILURE$
---
diff --git a/regression/strings/java_trim/test_trim.class b/regression/strings/java_trim/test_trim.class
deleted file mode 100644
index 8e6a923dcbc..00000000000
Binary files a/regression/strings/java_trim/test_trim.class and /dev/null differ
diff --git a/regression/strings/java_trim/test_trim.java b/regression/strings/java_trim/test_trim.java
deleted file mode 100644
index 8d8d41cb29a..00000000000
--- a/regression/strings/java_trim/test_trim.java
+++ /dev/null
@@ -1,8 +0,0 @@
-public class test_trim {
-    public static void main(String[] argv) {
-	String t = "  a b c  ";
-	String x = t.trim();
-	assert(x.equals("a b c"));
-	assert(x.equals("abc "));
-    }
-}
diff --git a/regression/strings/test1/test.desc b/regression/strings/test1/test.desc
index b86ded86c18..2e0b38c3ae3 100644
--- a/regression/strings/test1/test.desc
+++ b/regression/strings/test1/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion c1 == c2: SUCCESS$
diff --git a/regression/strings/test2/test.desc b/regression/strings/test2/test.desc
index b322a1d0d33..809cbcdaa29 100644
--- a/regression/strings/test2/test.desc
+++ b/regression/strings/test2/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion n == 5: SUCCESS$
diff --git a/regression/strings/test3.1/test.desc b/regression/strings/test3.1/test.desc
index c88a62b6704..6fddff4c129 100644
--- a/regression/strings/test3.1/test.desc
+++ b/regression/strings/test3.1/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/test3.2/test.desc b/regression/strings/test3.2/test.desc
index c88a62b6704..6fddff4c129 100644
--- a/regression/strings/test3.2/test.desc
+++ b/regression/strings/test3.2/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/test3.3/test.desc b/regression/strings/test3.3/test.desc
index c88a62b6704..6fddff4c129 100644
--- a/regression/strings/test3.3/test.desc
+++ b/regression/strings/test3.3/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/test3.4/test.desc b/regression/strings/test3.4/test.desc
index d88e1c83744..fc1cde2392c 100644
--- a/regression/strings/test3.4/test.desc
+++ b/regression/strings/test3.4/test.desc
@@ -1,7 +1,7 @@
 FUTURE
-test.c
---string-refine
-^EXIT=10$
+test_init.class
+--refine-strings
+^EXIT=0$
 ^SIGNAL=0$
-^VERIFICATION FAILED$
+^VERIFICATION SUCCESSFUL$
 --
diff --git a/regression/strings/test3/test.desc b/regression/strings/test3/test.desc
index 24ed719acc2..f6f9a63520a 100644
--- a/regression/strings/test3/test.desc
+++ b/regression/strings/test3/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion __CPROVER_string_length\(s\) == i \+ 5: SUCCESS$
diff --git a/regression/strings/test4/test.desc b/regression/strings/test4/test.desc
index c88a62b6704..6fddff4c129 100644
--- a/regression/strings/test4/test.desc
+++ b/regression/strings/test4/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=0$
 ^SIGNAL=0$
 ^VERIFICATION SUCCESSFUL$
diff --git a/regression/strings/test5/test.desc b/regression/strings/test5/test.desc
index d88e1c83744..303defd9de4 100644
--- a/regression/strings/test5/test.desc
+++ b/regression/strings/test5/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^VERIFICATION FAILED$
diff --git a/regression/strings/test_char_set/test.desc b/regression/strings/test_char_set/test.desc
index 99f3cfd81de..360759faf98 100644
--- a/regression/strings/test_char_set/test.desc
+++ b/regression/strings/test_char_set/test.desc
@@ -1,8 +1,8 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[main.assertion.1\] assertion __CPROVER_string_equal\(t, __CPROVER_string_literal\("apc"\)): SUCCESS$
-^\[main.assertion.2\] assertion __CPROVER_string_equal\(t, __CPROVER_string_literal\("abc"\)): FAILURE$
+^\[.*assertion.1\].* SUCCESS$
+^\[.*assertion.2\].* FAILURE$
 --
diff --git a/regression/strings/test_concat/test.desc b/regression/strings/test_concat/test.desc
index 8df68c18bc3..317a4d1b4dd 100644
--- a/regression/strings/test_concat/test.desc
+++ b/regression/strings/test_concat/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion c == .p.: SUCCESS$
diff --git a/regression/strings/test_contains/test.desc b/regression/strings/test_contains/test.desc
index f2414880794..b0e33ce2b43 100644
--- a/regression/strings/test_contains/test.desc
+++ b/regression/strings/test_contains/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion !__CPROVER_uninterpreted_string_contains_func\(t, __CPROVER_uninterpreted_string_literal_func\(\"3\"\)): SUCCESS$
diff --git a/regression/strings/test_equal/test.desc b/regression/strings/test_equal/test.desc
index 5fbe05f8fdd..34297ec50f5 100644
--- a/regression/strings/test_equal/test.desc
+++ b/regression/strings/test_equal/test.desc
@@ -1,8 +1,8 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[main.assertion.1\] assertion __CPROVER_string_equal\(s, __CPROVER_string_literal\("pippo"\)): SUCCESS$
-^\[main.assertion.2\] assertion __CPROVER_string_equal\(s, __CPROVER_string_literal\("mippo"\)): FAILURE$
+^\[.*.assertion.1\].* SUCCESS$
+^\[.*.assertion.2\].* FAILURE$
 --
diff --git a/regression/strings/test_index_of/test.desc b/regression/strings/test_index_of/test.desc
index edc8e09c4ed..a2c12c3d259 100644
--- a/regression/strings/test_index_of/test.desc
+++ b/regression/strings/test_index_of/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion firstSlash == 3: SUCCESS$
diff --git a/regression/strings/test_int/test.desc b/regression/strings/test_int/test.desc
index 8d78e11e71b..fcce43ca76c 100644
--- a/regression/strings/test_int/test.desc
+++ b/regression/strings/test_int/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion __CPROVER_char_at\(s,0\) == .1.: SUCCESS$
diff --git a/regression/strings/test_pass1/test.desc b/regression/strings/test_pass1/test.desc
index 9bb75eda5b6..f2f54e69921 100644
--- a/regression/strings/test_pass1/test.desc
+++ b/regression/strings/test_pass1/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion __CPROVER_uninterpreted_string_equal_func\(t, __CPROVER_uninterpreted_string_literal_func\(\"a\"\)): SUCCESS
diff --git a/regression/strings/test_pass_pc3/test.desc b/regression/strings/test_pass_pc3/test.desc
index 3edb9f68f7a..f1f3d1618c8 100644
--- a/regression/strings/test_pass_pc3/test.desc
+++ b/regression/strings/test_pass_pc3/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion __CPROVER_string_length\(s3\) == 0: FAILURE$
diff --git a/regression/strings/test_prefix/test.desc b/regression/strings/test_prefix/test.desc
index 6c62a2fa466..be0ed5dc69e 100644
--- a/regression/strings/test_prefix/test.desc
+++ b/regression/strings/test_prefix/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion b: SUCCESS$
diff --git a/regression/strings/test_strlen/test.desc b/regression/strings/test_strlen/test.desc
index 30c3f4066ed..28ed1b7e698 100644
--- a/regression/strings/test_strlen/test.desc
+++ b/regression/strings/test_strlen/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion len_s == len_t: SUCCESS$
diff --git a/regression/strings/test_substring/test.desc b/regression/strings/test_substring/test.desc
index a32376aca23..f0e4b5832b2 100644
--- a/regression/strings/test_substring/test.desc
+++ b/regression/strings/test_substring/test.desc
@@ -1,10 +1,10 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
-^\[main.assertion.1\] assertion __CPROVER_string_equal\(t,__CPROVER_string_literal\("cd"\)): SUCCESS$
-^\[main.assertion.2\] assertion __CPROVER_string_equal\(t,__CPROVER_string_literal\("cc"\)): FAILURE$
-^\[main.assertion.3\] assertion !__CPROVER_string_equal\(t,__CPROVER_string_literal\("bc"\)): SUCCESS$
-^\[main.assertion.4\] assertion !__CPROVER_string_equal\(t,__CPROVER_string_literal\("cd"\)): FAILURE$
+^\[.*assertion.1\].* SUCCESS$
+^\[.*assertion.2\].* FAILURE$
+^\[.*assertion.3\].* SUCCESS$
+^\[.*assertion.4\].* FAILURE$
 --
diff --git a/regression/strings/test_suffix/test.desc b/regression/strings/test_suffix/test.desc
index 9f425595434..e7e8c1e36be 100644
--- a/regression/strings/test_suffix/test.desc
+++ b/regression/strings/test_suffix/test.desc
@@ -1,6 +1,6 @@
 FUTURE
 test.c
---string-refine
+--refine-strings
 ^EXIT=10$
 ^SIGNAL=0$
 ^\[main.assertion.1\] assertion __CPROVER_string_issuffix\(__CPROVER_string_literal\("po"\),s\): SUCCESS$
diff --git a/regression/test.pl b/regression/test.pl
index f309a293ba9..3118fd375f6 100755
--- a/regression/test.pl
+++ b/regression/test.pl
@@ -3,6 +3,7 @@
 use subs;
 use strict;
 use warnings;
+use File::Basename;
 
 use Cwd;
 
@@ -71,8 +72,7 @@ ($$$$$)
 
   $options =~ s/$ign//g if(defined($ign));
 
-  my $descriptor = $test;
-  $descriptor =~ s/^.*\///;
+  my $descriptor = basename($test);
   my $output = $descriptor;
   $output =~ s/\.[^.]*$/.out/;
 
diff --git a/scripts/bash-autocomplete/.gitignore b/scripts/bash-autocomplete/.gitignore
new file mode 100644
index 00000000000..1e0acedc4f2
--- /dev/null
+++ b/scripts/bash-autocomplete/.gitignore
@@ -0,0 +1 @@
+cbmc.sh
diff --git a/scripts/bash-autocomplete/Readme.md b/scripts/bash-autocomplete/Readme.md
new file mode 100644
index 00000000000..a56074561da
--- /dev/null
+++ b/scripts/bash-autocomplete/Readme.md
@@ -0,0 +1,49 @@
+# CBMC Autocomplete Scripts for Bash
+This directory contains an autocomplete script for bash.
+
+## Installation for bash
+1. Compile cbmc and
+
+2. `cd scripts/bash-autocomplete`
+
+3.  `./extract-switches.sh`
+
+4. Put the following at the end of your `~/.bashrc`, with the directories adapted to your directory structure:
+    ```bash
+    cbmcautocomplete=~/diffblue/cbmc/scripts/bash-autocomplete/cbmc.sh
+    if [ -f $cbmcautocomplete ]; then
+      . $cbmcautocomplete
+    fi
+    ```
+
+5. `source ~/.bashrc`
+
+## Installation for zsh
+Follow 1. 2. and 3. as above.
+
+4. Put the following at the end of your `~/.zshrc`, with the directories adapted to your directory structure:
+    ```bash
+    autoload bashcompinit
+    bashcompinit
+    cbmcautocomplete=~/diffblue/cbmc/scripts/bash-autocomplete/cbmc.sh
+    if [ -f $cbmcautocomplete ]; then
+      . $cbmcautocomplete
+    fi
+    ```
+5. `source ~/.zshrc`
+
+## Usage
+As with the usual autocomplete in bash, start typing a switch to complete it, for example:
+```
+cbmc --clas<TAB>
+```
+will complete to
+```
+cbmc --classpath
+```
+
+## Features implemented
+
+* Completing all switches
+* Completing values for `--cover`, `--mm` and `--arch`
+* When completing a name of a file to analyze, only files with supported extensions are shown.
diff --git a/scripts/bash-autocomplete/cbmc.sh.template b/scripts/bash-autocomplete/cbmc.sh.template
new file mode 100644
index 00000000000..0e241d0b3bf
--- /dev/null
+++ b/scripts/bash-autocomplete/cbmc.sh.template
@@ -0,0 +1,43 @@
+#!/bin/bash
+_cbmc_autocomplete()
+{
+  #list of all switches cbmc has. IMPORTANT: in the template file, this variable must be defined on line 5.
+  local switches=""
+  #word on which the cursor is
+  local cur=${COMP_WORDS[COMP_CWORD]}
+  #previous word (in case it is a switch with a parameter)
+  local prev=${COMP_WORDS[COMP_CWORD-1]}
+ 
+  #check if the command before cursor is a switch that takes parameters, if yes,
+  #offer a choice of parameters
+  case "$prev" in
+   --cover) #for coverage we list the options explicitly
+     COMPREPLY=( $( compgen -W "assertion path branch location decision condition mcdc cover" -- $cur ) )
+     return 0
+     ;;
+   --mm) #for memory models we list the options explicitly
+     COMPREPLY=( $( compgen -W "sc tso pso" -- $cur ) )
+     return 0
+     ;;
+   --arch) #for architecture we list the options explicitly
+     COMPREPLY=( $( compgen -W "i386 x86_64" -- $cur ) )
+     return 0
+     ;;
+   -I|--classpath|-cp|--outfile|--existing-coverage|--graphml-cex)
+     #a switch that takes a file parameter of which we don't know an extension
+     #TODO probably we can do more for -I, --classpath, -cp
+     COMPREPLY=( $(compgen -f -- $cur) )
+     return 0
+     ;;
+  esac
+ 
+  #complete a switch from a standard list, if the parameter under cursor starts with a hyphen
+  if [[ "$cur" == -* ]]; then
+     COMPREPLY=( $( compgen -W "$switches" -- $cur ) )
+     return 0
+  fi
+
+  #if none of the above applies, offer directories and files that we can analyze
+  COMPREPLY=( $(compgen -G '*.class|*.jar|*.cpp|*.cc|*.c\+\+|*.ii|*.cxx|*.c|*.i|*.gb' -- $cur) )
+}
+complete -F _cbmc_autocomplete cbmc
diff --git a/scripts/bash-autocomplete/extract_switches.sh b/scripts/bash-autocomplete/extract_switches.sh
new file mode 100755
index 00000000000..e000b469bea
--- /dev/null
+++ b/scripts/bash-autocomplete/extract_switches.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+echo "Compiling the helper file to extract the raw list of parameters from cbmc"
+g++ -c -MMD -MP -std=c++11 -Wall -I ../../src/ -ftrack-macro-expansion=0 -fno-diagnostics-show-caret switch_extractor_helper.c  -o tmp.o 2> pragma.txt
+
+retval=$?
+
+#clean up compiled files, we don't need them.
+rm tmp.o 2> /dev/null
+rm tmp.d 2> /dev/null
+
+#check if compilation went fine
+if [ $retval -ne 0 ]; then
+  echo "Problem compiling the helper file, parameter list not extracted."
+  exit 1;
+fi
+
+echo "Converting the raw parameter list to the format required by autocomplete scripts"
+rawstring=`sed "s/^.*pragma message: \(.*\)/\1/" pragma.txt`
+#delete pragma file, we won't need it
+rm pragma.txt 2> /dev/null
+
+#now the main bit, convert from raw format to a proper list of switches
+cleanstring=`(
+  #extract 2-hyphen switches, such as --foo
+  #grep for '(foo)' expressions, and then use sed to remove parantheses and put '--' at the start
+  (echo $rawstring | grep -o "([^)]*)" | sed "s/^.\(.*\).$/--\1/") ;
+  #extract 1-hyphen switches, such as -F
+  #use sed to remove all (foo) expressions, then you're left with switches and ':', so grep the colons out and then use sed to include the '-'
+  (echo $rawstring | sed "s/([^)]*)//g" | grep -o "[a-zA-Z0-9]" | sed "s/\(.*\)/-\1/")
+ ) | tr '\n' ' '`
+
+#sanity check that there is only one line of output
+if [ `echo $cleanstring | wc -l | awk '{print $1}'` -ne 1 ]; then
+ echo "Problem converting the parameter list to the correct format, I was expecting one line but either got 0 or >2. This is likely to be an error in this conversion script."
+ exit 1;
+fi
+
+#sanity check that there are no dangerous characters
+echo $cleanstring | grep -q "[^a-zA-Z0-9 -]"
+if [ $? -eq 0 ]; then
+ echo "Problem converting the parameter list to the correct format, illegal characters detected. This is likely to be an error in this conversion script."
+ exit 1;
+fi
+
+echo "Injecting the parameter list to the autocomplete file."
+sed "5 s/.*/  local switches=\"$cleanstring\"/" cbmc.sh.template > cbmc.sh
+
+rm pragma.txt 2> /dev/null
diff --git a/scripts/bash-autocomplete/switch_extractor_helper.c b/scripts/bash-autocomplete/switch_extractor_helper.c
new file mode 100644
index 00000000000..4d9cc2e56fe
--- /dev/null
+++ b/scripts/bash-autocomplete/switch_extractor_helper.c
@@ -0,0 +1,3 @@
+#include "cbmc/cbmc_parse_options.h"
+
+#pragma message CBMC_OPTIONS
diff --git a/scripts/cpplint.py b/scripts/cpplint.py
index 84da2ae8ac9..e3ab0505e9a 100755
--- a/scripts/cpplint.py
+++ b/scripts/cpplint.py
@@ -1377,7 +1377,8 @@ def CleanseRawStrings(raw_lines):
 def FindNextMultiLineCommentStart(lines, lineix):
   """Find the beginning marker for a multiline comment."""
   while lineix < len(lines):
-    if lines[lineix].strip().startswith('/*'):
+    if (lines[lineix].strip().startswith('/*') or
+       lines[lineix].strip().startswith('#if 0')):
       # Only return this marker if the comment goes beyond this line
       if lines[lineix].strip().find('*/', 2) < 0:
         return lineix
@@ -1388,7 +1389,8 @@ def FindNextMultiLineCommentStart(lines, lineix):
 def FindNextMultiLineCommentEnd(lines, lineix):
   """We are inside a comment, find the end marker."""
   while lineix < len(lines):
-    if lines[lineix].strip().endswith('*/'):
+    if (lines[lineix].strip().endswith('*/') or
+       lines[lineix].strip().endswith('#endif')):
       return lineix
     lineix += 1
   return len(lines)
@@ -1923,11 +1925,11 @@ def CheckForCopyright(filename, lines, error):
   # We'll say it should occur by line 10. Don't forget there's a
   # dummy line at the front.
   for line in xrange(1, min(len(lines), 11)):
-    if re.search(r'Author', lines[line], re.I): break
+    if re.search(r'Author|Copyright', lines[line], re.I): break
   else:                       # means no copyright line was found
     error(filename, 0, 'legal/copyright', 5,
           'No copyright message found.  '
-          'You should have a line: "Author: <name>"')
+          'You should have a line: "Author: <name>" or "Copyright <year> ..."')
 
 
 def GetIndentLevel(line):
@@ -6514,6 +6516,9 @@ def ProcessFile(filename, vlevel, extra_check_functions=[]):
   if Search(r'_builtin_headers(_[a-z0-9_-]+)?\.h$', filename):
     return
 
+  if Search(r'regression/.*\.cpp', filename):
+    return
+
   if not ProcessConfigOverrides(filename):
     _RestoreFilters()
     return
diff --git a/scripts/run_diff.sh b/scripts/run_diff.sh
index 43d43f7577a..0e388537fb4 100755
--- a/scripts/run_diff.sh
+++ b/scripts/run_diff.sh
@@ -38,6 +38,8 @@ then
   doxygen=doxygen
   doxygenlogdir="doc/html"
   doxygenlog="$doxygenlogdir/doxygen.log"
+  suppress_warnings=(
+    "warning: Included by graph for .* not generated, too many nodes. Consider increasing DOT_GRAPH_MAX_NODES.")
   if ! $doxygen --version &>/dev/null
   then
     echo "Lint script could not be found in the $script_folder directory"
@@ -45,7 +47,8 @@ then
     exit 1
   else
     mkdir -p $doxygenlogdir && cd src && $doxygen &> ../$doxygenlog && cd ..
-    cmd='cat $doxygenlog'
+    suppress_warnings_regex=$(IFS="|" ; echo "${suppress_warnings[*]}")
+    cmd='grep -Ev "$suppress_warnings_regex" $doxygenlog'
   fi
 else
   echo "Mode $mode not recognized"
diff --git a/scripts/travis_doxygen.sh b/scripts/travis_doxygen.sh
index 78adcff3c13..359de72ff60 100755
--- a/scripts/travis_doxygen.sh
+++ b/scripts/travis_doxygen.sh
@@ -8,5 +8,9 @@ pip install --user unidiff
 if [ "$TRAVIS_PULL_REQUEST" == "false" ]; then
   $script_folder/run_diff.sh DOXYGEN HEAD~1 # Check for errors introduced in last commit
 else
-  $script_folder/run_diff.sh DOXYGEN $TRAVIS_BRANCH # Check for errors compared to merge target
+  TMP_HEAD=$(git rev-parse HEAD)
+  git config remote.origin.fetch +refs/heads/$TRAVIS_BRANCH:refs/remotes/origin/$TRAVIS_BRANCH
+  git fetch --unshallow
+  git checkout $TMP_HEAD
+  $script_folder/run_diff.sh DOXYGEN origin/$TRAVIS_BRANCH # Check for errors compared to merge target
 fi
diff --git a/scripts/travis_lint.sh b/scripts/travis_lint.sh
index 036605237ee..6592a3ebdfa 100755
--- a/scripts/travis_lint.sh
+++ b/scripts/travis_lint.sh
@@ -8,5 +8,9 @@ pip install --user unidiff
 if [ "$TRAVIS_PULL_REQUEST" == "false" ]; then
   $script_folder/run_diff.sh CPPLINT HEAD~1 # Check for errors introduced in last commit
 else
-  $script_folder/run_diff.sh CPPLINT $TRAVIS_BRANCH # Check for errors compared to merge target
+  TMP_HEAD=$(git rev-parse HEAD)
+  git config remote.origin.fetch +refs/heads/$TRAVIS_BRANCH:refs/remotes/origin/$TRAVIS_BRANCH
+  git fetch --unshallow
+  git checkout $TMP_HEAD
+  $script_folder/run_diff.sh CPPLINT origin/$TRAVIS_BRANCH # Check for errors compared to merge target
 fi
diff --git a/src/Makefile b/src/Makefile
index 2d6b4eedb98..e90c402c819 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -84,6 +84,14 @@ glucose-download:
 	@(cd ../glucose-syrup; patch -p1 < ../scripts/glucose-syrup-patch)
 	@rm glucose-syrup.tgz
 
+cprover-jar-build:
+	@echo "Building org.cprover.jar"
+	@(cd java_bytecode/library/; \
+	mkdir -p target; \
+	javac -d target/ `find src/ -name "*.java"`; \
+	cd target; jar cf org.cprover.jar `find . -name "*.class"`; \
+	mv org.cprover.jar ../../../)
+
 boost-download:
 	@echo "Downloading boost headers"
 	@lwp-download "http://storage.googleapis.com/diffblue-mirror/boost/boost_1.63_headers.tar.bz2?GoogleAccessId=diffbluemaster@diffblue-cr.iam.gserviceaccount.com&Expires=1542631994&Signature=X2GwPSm1dR8IPGP0D5JoyDmOnL%2Br4F7AI7NUA7SbmOAowMC0JS7Q5A6%2BkQziUzQa88zpddr5gSRbDOLqdoGzwLrYgPNtURS5dJ7l1q6xfJWSS%2FYf8be%2FSbdfLVN8qcXKCsfDe05Hqf%2Bz2cksqjQ1H6L0syj43rftbW4%2F7tp355%2BkinCeE466ulJeyru3CK%2F3RGX2Ul6ZQV6lNxkit1m6QM5BRtLbUQ1GOW0GCK9fWH2fry2n7kRVBCM3oz8fX62kLdKYlaXCf%2BvvXs9hOOmcQurL%2Fa4DCJYoClX%2BpznqXVmjUY%2FI3pD4HlRKbCeiPnoC6de2i1uxFNSVTBpG3w%2BtfA%3D%3D"
@@ -93,4 +101,4 @@ boost-download:
 	@mv boost ../boost-include/boost
 	@rm boost_1.63_headers.tar.bz2
 
-.PHONY: minisat2-download glucose-download
+.PHONY: minisat2-download glucose-download cprover-jar-build
diff --git a/src/analyses/Makefile b/src/analyses/Makefile
index 690b119e83c..77c7d7f92d0 100644
--- a/src/analyses/Makefile
+++ b/src/analyses/Makefile
@@ -24,6 +24,7 @@ SRC = ai.cpp \
       reaching_definitions.cpp \
       replace_symbol_ext.cpp \
       static_analysis.cpp \
+      uncaught_exceptions_analysis.cpp \
       uninitialized_domain.cpp \
       # Empty last line
 
diff --git a/src/analyses/ai.h b/src/analyses/ai.h
index 5e0d1db3b2e..a04c60547d0 100644
--- a/src/analyses/ai.h
+++ b/src/analyses/ai.h
@@ -12,12 +12,14 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_ANALYSES_AI_H
 #define CPROVER_ANALYSES_AI_H
 
-#include <map>
 #include <iosfwd>
+#include <map>
+#include <memory>
 
 #include <util/json.h>
 #include <util/xml.h>
 #include <util/expr.h>
+#include <util/make_unique.h>
 
 #include <goto-programs/goto_model.h>
 
@@ -334,7 +336,7 @@ class ai_baset
     const namespacet &ns)=0;
   virtual statet &get_state(locationt l)=0;
   virtual const statet &find_state(locationt l) const=0;
-  virtual statet* make_temporary_state(const statet &s)=0;
+  virtual std::unique_ptr<statet> make_temporary_state(const statet &s)=0;
 };
 
 // domainT is expected to be derived from ai_domain_baseT
@@ -400,9 +402,9 @@ class ait:public ai_baset
       static_cast<const domainT &>(src), from, to);
   }
 
-  statet *make_temporary_state(const statet &s) override
+  std::unique_ptr<statet> make_temporary_state(const statet &s) override
   {
-    return new domainT(static_cast<const domainT &>(s));
+    return util_make_unique<domainT>(static_cast<const domainT &>(s));
   }
 
   void fixedpoint(
diff --git a/src/analyses/call_graph.cpp b/src/analyses/call_graph.cpp
index 26d144af4b4..91b8c3e6a15 100644
--- a/src/analyses/call_graph.cpp
+++ b/src/analyses/call_graph.cpp
@@ -79,6 +79,16 @@ void call_grapht::add(
     std::back_inserter(map_from_edges_to_call_locations[{caller, callee}]));
 }
 
+/// Returns an inverted copy of this call graph
+/// \return Inverted (callee -> caller) call graph
+call_grapht call_grapht::get_inverted() const
+{
+  call_grapht result;
+  for(const auto &caller_callee : graph)
+    result.add(caller_callee.second, caller_callee.first);
+  return result;
+}
+
 void call_grapht::output_dot(std::ostream &out) const
 {
   out << "digraph call_graph {\n"
diff --git a/src/analyses/call_graph.h b/src/analyses/call_graph.h
index d55a4f46812..f3e5b581883 100644
--- a/src/analyses/call_graph.h
+++ b/src/analyses/call_graph.h
@@ -35,6 +35,7 @@ class call_grapht
   void swap(call_grapht &other);
 
   void add(const irep_idt &caller, const irep_idt &callee);
+  call_grapht get_inverted() const;
 
   /**
    * The type provides a mapping from edges of the call-graph to particular
diff --git a/src/analyses/constant_propagator.cpp b/src/analyses/constant_propagator.cpp
index 02913f9360a..aef07c8d3f1 100644
--- a/src/analyses/constant_propagator.cpp
+++ b/src/analyses/constant_propagator.cpp
@@ -79,7 +79,7 @@ void constant_propagator_domaint::assign_rec(
         cond = simplify_expr(cond,ns);
       }
       else
-        assert(0);
+        UNREACHABLE;
 
       assign(values, to_symbol_expr(lhs), cond, ns);
 	}
diff --git a/src/analyses/custom_bitvector_analysis.cpp b/src/analyses/custom_bitvector_analysis.cpp
index da5bd52fb61..a81a08e6e67 100644
--- a/src/analyses/custom_bitvector_analysis.cpp
+++ b/src/analyses/custom_bitvector_analysis.cpp
@@ -296,7 +296,7 @@ void custom_bitvector_domaint::transform(
             else if(identifier=="__CPROVER_clear_may")
               mode=modet::CLEAR_MAY;
             else
-              assert(false);
+              UNREACHABLE;
 
             exprt lhs=code_function_call.arguments()[0];
 
@@ -411,7 +411,7 @@ void custom_bitvector_domaint::transform(
         else if(statement=="clear_may")
           mode=modet::CLEAR_MAY;
         else
-          assert(false);
+          UNREACHABLE;
 
         exprt lhs=instruction.code.op0();
 
diff --git a/src/analyses/goto_check.cpp b/src/analyses/goto_check.cpp
index be4edbf288f..b6ee194dd9f 100644
--- a/src/analyses/goto_check.cpp
+++ b/src/analyses/goto_check.cpp
@@ -833,7 +833,7 @@ void goto_checkt::nan_check(
           equal_exprt(expr.op1(), minus_inf)));
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   isnan.make_not();
 
@@ -909,7 +909,7 @@ void goto_checkt::pointer_validity_check(
   const exprt &access_ub,
   const irep_idt &mode)
 {
-  if(mode!=ID_java && !enable_pointer_check)
+  if(!enable_pointer_check)
     return;
 
   const exprt &pointer=expr.op0();
@@ -1702,6 +1702,10 @@ void goto_checkt::goto_check(
 
         if(!it->source_location.get_column().empty())
           i_it->source_location.set_column(it->source_location.get_column());
+
+        if(!it->source_location.get_java_bytecode_index().empty())
+          i_it->source_location.set_java_bytecode_index(
+            it->source_location.get_java_bytecode_index());
       }
 
       if(i_it->function.empty())
diff --git a/src/analyses/goto_rw.cpp b/src/analyses/goto_rw.cpp
index 49827bd2bd3..571d8bd0ad1 100644
--- a/src/analyses/goto_rw.cpp
+++ b/src/analyses/goto_rw.cpp
@@ -10,8 +10,9 @@ Date: April 2010
 
 #include "goto_rw.h"
 
-#include <limits>
 #include <algorithm>
+#include <limits>
+#include <memory>
 
 #include <util/std_code.h>
 #include <util/std_expr.h>
@@ -20,6 +21,7 @@ Date: April 2010
 #include <util/endianness_map.h>
 #include <util/arith_tools.h>
 #include <util/simplify_expr.h>
+#include <util/make_unique.h>
 
 #include <goto-programs/goto_functions.h>
 
@@ -49,12 +51,12 @@ rw_range_sett::~rw_range_sett()
   for(rw_range_sett::objectst::iterator it=r_range_set.begin();
       it!=r_range_set.end();
       ++it)
-    delete it->second;
+    it->second=nullptr;
 
   for(rw_range_sett::objectst::iterator it=w_range_set.begin();
       it!=w_range_set.end();
       ++it)
-    delete it->second;
+    it->second=nullptr;
 }
 
 void rw_range_sett::output(std::ostream &out) const
@@ -461,16 +463,18 @@ void rw_range_sett::add(
   const range_spect &range_start,
   const range_spect &range_end)
 {
-  objectst::iterator entry=(mode==get_modet::LHS_W ? w_range_set : r_range_set).
-    insert(
-      std::pair<const irep_idt&, range_domain_baset*>(
-        identifier, nullptr)).first;
+  objectst::iterator entry=
+    (mode==get_modet::LHS_W?w_range_set:r_range_set)
+       .insert(
+         std::pair<const irep_idt &, std::unique_ptr<range_domain_baset>>(
+           identifier, nullptr))
+       .first;
 
   if(entry->second==nullptr)
-    entry->second=new range_domaint();
+    entry->second=util_make_unique<range_domaint>();
 
-  static_cast<range_domaint*>(entry->second)->push_back(
-    std::make_pair(range_start, range_end));
+  static_cast<range_domaint&>(*entry->second).push_back(
+    {range_start, range_end});
 }
 
 void rw_range_sett::get_objects_rec(
@@ -662,17 +666,18 @@ void rw_guarded_range_set_value_sett::add(
   const range_spect &range_start,
   const range_spect &range_end)
 {
-  objectst::iterator entry=(mode==get_modet::LHS_W ? w_range_set : r_range_set).
-    insert(
-      std::pair<const irep_idt&, range_domain_baset*>(
-        identifier, nullptr)).first;
+  objectst::iterator entry=
+    (mode==get_modet::LHS_W?w_range_set:r_range_set)
+      .insert(
+        std::pair<const irep_idt &, std::unique_ptr<range_domain_baset>>(
+          identifier, nullptr))
+      .first;
 
   if(entry->second==nullptr)
-    entry->second=new guarded_range_domaint();
+    entry->second=util_make_unique<guarded_range_domaint>();
 
-  static_cast<guarded_range_domaint*>(entry->second)->insert(
-    std::make_pair(range_start,
-                   std::make_pair(range_end, guard.as_expr())));
+  static_cast<guarded_range_domaint&>(*entry->second).insert(
+    {range_start, {range_end, guard.as_expr()}});
 }
 
 void goto_rw(goto_programt::const_targett target,
@@ -708,7 +713,7 @@ void goto_rw(goto_programt::const_targett target,
   switch(target->type)
   {
   case NO_INSTRUCTION_TYPE:
-    assert(false);
+    UNREACHABLE;
     break;
 
   case GOTO:
diff --git a/src/analyses/goto_rw.h b/src/analyses/goto_rw.h
index 1f92c3e0e14..38bc4d2e61a 100644
--- a/src/analyses/goto_rw.h
+++ b/src/analyses/goto_rw.h
@@ -15,6 +15,7 @@ Date: April 2010
 #include <map>
 #include <ostream>
 #include <limits>
+#include <memory> // unique_ptr
 
 #include <util/guard.h>
 
@@ -44,6 +45,14 @@ void goto_rw(const goto_functionst &goto_functions,
 class range_domain_baset
 {
 public:
+  range_domain_baset()=default;
+
+  range_domain_baset(const range_domain_baset &rhs)=delete;
+  range_domain_baset &operator=(const range_domain_baset &rhs)=delete;
+
+  range_domain_baset(range_domain_baset &&rhs)=delete;
+  range_domain_baset &operator=(range_domain_baset &&rhs)=delete;
+
   virtual ~range_domain_baset();
 
   virtual void output(const namespacet &ns, std::ostream &out) const=0;
@@ -61,12 +70,29 @@ inline range_spect to_range_spect(const mp_integer &size)
 }
 
 // each element x represents a range of bits [x.first, x.second.first)
-class range_domaint:
-  public range_domain_baset,
-  public std::list<std::pair<range_spect, range_spect> >
+class range_domaint:public range_domain_baset
 {
+  typedef std::list<std::pair<range_spect, range_spect>> sub_typet;
+  sub_typet data;
+
 public:
-  virtual void output(const namespacet &ns, std::ostream &out) const;
+  void output(const namespacet &ns, std::ostream &out) const override;
+
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef sub_typet::iterator iterator;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef sub_typet::const_iterator const_iterator;
+
+  iterator begin() { return data.begin(); }
+  const_iterator begin() const { return data.begin(); }
+  const_iterator cbegin() const { return data.begin(); }
+
+  iterator end() { return data.end(); }
+  const_iterator end() const { return data.end(); }
+  const_iterator cend() const { return data.end(); }
+
+  void push_back(const sub_typet::value_type &v) { data.push_back(v); }
+  void push_back(sub_typet::value_type &&v) { data.push_back(std::move(v)); }
 };
 
 class array_exprt;
@@ -83,10 +109,10 @@ class rw_range_sett
 {
 public:
   #ifdef USE_DSTRING
-  typedef std::map<irep_idt, range_domain_baset*> objectst;
+  typedef std::map<irep_idt, std::unique_ptr<range_domain_baset>> objectst;
   #else
-  typedef std::unordered_map<irep_idt, range_domain_baset*, string_hash>
-    objectst;
+  typedef std::unordered_map<
+    irep_idt, std::unique_ptr<range_domain_baset>, string_hash> objectst;
   #endif
 
   virtual ~rw_range_sett();
@@ -108,8 +134,8 @@ class rw_range_sett
 
   const range_domaint &get_ranges(objectst::const_iterator it) const
   {
-    PRECONDITION(dynamic_cast<range_domaint*>(it->second)!=nullptr);
-    return *static_cast<range_domaint*>(it->second);
+    PRECONDITION(dynamic_cast<range_domaint*>(it->second.get())!=nullptr);
+    return static_cast<const range_domaint &>(*it->second);
   }
 
   enum class get_modet { LHS_W, READ };
@@ -257,12 +283,36 @@ class rw_range_set_value_sett:public rw_range_sett
     const range_spect &size);
 };
 
-class guarded_range_domaint:
-  public range_domain_baset,
-  public std::multimap<range_spect, std::pair<range_spect, exprt> >
+class guarded_range_domaint:public range_domain_baset
 {
+  typedef std::multimap<range_spect, std::pair<range_spect, exprt>> sub_typet;
+  sub_typet data;
+
 public:
-  virtual void output(const namespacet &ns, std::ostream &out) const;
+  virtual void output(const namespacet &ns, std::ostream &out) const override;
+
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef sub_typet::iterator iterator;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef sub_typet::const_iterator const_iterator;
+
+  iterator begin() { return data.begin(); }
+  const_iterator begin() const { return data.begin(); }
+  const_iterator cbegin() const { return data.begin(); }
+
+  iterator end() { return data.end(); }
+  const_iterator end() const { return data.end(); }
+  const_iterator cend() const { return data.end(); }
+
+  iterator insert(const sub_typet::value_type &v)
+  {
+    return data.insert(v);
+  }
+
+  iterator insert(sub_typet::value_type &&v)
+  {
+    return data.insert(std::move(v));
+  }
 };
 
 class rw_guarded_range_set_value_sett:public rw_range_set_value_sett
@@ -277,8 +327,9 @@ class rw_guarded_range_set_value_sett:public rw_range_set_value_sett
 
   const guarded_range_domaint &get_ranges(objectst::const_iterator it) const
   {
-    PRECONDITION(dynamic_cast<guarded_range_domaint*>(it->second)!=nullptr);
-    return *static_cast<guarded_range_domaint*>(it->second);
+    PRECONDITION(
+      dynamic_cast<guarded_range_domaint*>(it->second.get())!=nullptr);
+    return static_cast<const guarded_range_domaint &>(*it->second);
   }
 
   virtual void get_objects_rec(
diff --git a/src/analyses/invariant_set.cpp b/src/analyses/invariant_set.cpp
index a91c0349bbb..718df977b33 100644
--- a/src/analyses/invariant_set.cpp
+++ b/src/analyses/invariant_set.cpp
@@ -474,7 +474,7 @@ void invariant_sett::strengthen_rec(const exprt &expr)
       }
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
   else if(expr.id()==ID_equal)
   {
@@ -673,7 +673,7 @@ tvt invariant_sett::implies_rec(const exprt &expr) const
     else if(expr.id()==ID_notequal)
       return is_ne(p);
     else
-      assert(false);
+      UNREACHABLE;
   }
 
   return tvt::unknown();
diff --git a/src/analyses/local_bitvector_analysis.cpp b/src/analyses/local_bitvector_analysis.cpp
index f48b34a760d..341eab33d42 100644
--- a/src/analyses/local_bitvector_analysis.cpp
+++ b/src/analyses/local_bitvector_analysis.cpp
@@ -41,16 +41,16 @@ void local_bitvector_analysist::flagst::print(std::ostream &out) const
     out << "+integer_address";
 }
 
-bool local_bitvector_analysist::loc_infot::merge(const loc_infot &src)
+bool local_bitvector_analysist::merge(points_tot &a, points_tot &b)
 {
   bool result=false;
 
   std::size_t max_index=
-    std::max(src.points_to.size(), points_to.size());
+    std::max(a.size(), b.size());
 
   for(std::size_t i=0; i<max_index; i++)
   {
-    if(points_to[i].merge(src.points_to[i]))
+    if(a[i].merge(b[i]))
       result=true;
   }
 
@@ -72,8 +72,8 @@ bool local_bitvector_analysist::is_tracked(const irep_idt &identifier)
 void local_bitvector_analysist::assign_lhs(
   const exprt &lhs,
   const exprt &rhs,
-  const loc_infot &loc_info_src,
-  loc_infot &loc_info_dest)
+  points_tot &loc_info_src,
+  points_tot &loc_info_dest)
 {
   if(lhs.id()==ID_symbol)
   {
@@ -83,7 +83,7 @@ void local_bitvector_analysist::assign_lhs(
     {
       unsigned dest_pointer=pointers.number(identifier);
       flagst rhs_flags=get_rec(rhs, loc_info_src);
-      loc_info_dest.points_to[dest_pointer]=rhs_flags;
+      loc_info_dest[dest_pointer]=rhs_flags;
     }
   }
   else if(lhs.id()==ID_dereference)
@@ -117,14 +117,12 @@ local_bitvector_analysist::flagst local_bitvector_analysist::get(
 
   assert(loc_it!=cfg.loc_map.end());
 
-  const loc_infot &loc_info_src=loc_infos[loc_it->second];
-
-  return get_rec(rhs, loc_info_src);
+  return get_rec(rhs, loc_infos[loc_it->second]);
 }
 
 local_bitvector_analysist::flagst local_bitvector_analysist::get_rec(
   const exprt &rhs,
-  const loc_infot &loc_info_src)
+  points_tot &loc_info_src)
 {
   if(rhs.id()==ID_constant)
   {
@@ -139,7 +137,7 @@ local_bitvector_analysist::flagst local_bitvector_analysist::get_rec(
     if(is_tracked(identifier))
     {
       unsigned src_pointer=pointers.number(identifier);
-      return loc_info_src.points_to[src_pointer];
+      return loc_info_src[src_pointer];
     }
     else
       return flagst::mk_unknown();
@@ -258,7 +256,7 @@ void local_bitvector_analysist::build(const goto_functiont &goto_function)
   // in the entry location.
   for(const auto &local : locals.locals_map)
     if(is_tracked(local.first))
-      loc_infos[0].points_to[pointers.number(local.first)]=flagst::mk_unknown();
+      loc_infos[0][pointers.number(local.first)]=flagst::mk_unknown();
 
   while(!work_queue.empty())
   {
@@ -267,8 +265,8 @@ void local_bitvector_analysist::build(const goto_functiont &goto_function)
     const goto_programt::instructiont &instruction=*node.t;
     work_queue.pop();
 
-    const loc_infot &loc_info_src=loc_infos[loc_nr];
-    loc_infot loc_info_dest=loc_infos[loc_nr];
+    auto &loc_info_src=loc_infos[loc_nr];
+    auto loc_info_dest=loc_infos[loc_nr];
 
     switch(instruction.type)
     {
@@ -320,7 +318,7 @@ void local_bitvector_analysist::build(const goto_functiont &goto_function)
     for(const auto &succ : node.successors)
     {
       assert(succ<loc_infos.size());
-      if(loc_infos[succ].merge(loc_info_dest))
+      if(merge(loc_infos[succ], (loc_info_dest)))
         work_queue.push(succ);
     }
   }
@@ -337,14 +335,14 @@ void local_bitvector_analysist::output(
   {
     out << "**** " << i_it->source_location << "\n";
 
-    const loc_infot &loc_info=loc_infos[l];
+    const auto &loc_info=loc_infos[l];
 
     for(points_tot::const_iterator
-        p_it=loc_info.points_to.begin();
-        p_it!=loc_info.points_to.end();
+        p_it=loc_info.begin();
+        p_it!=loc_info.end();
         p_it++)
     {
-      out << "  " << pointers[p_it-loc_info.points_to.begin()]
+      out << "  " << pointers[p_it-loc_info.begin()]
           << ": "
           << *p_it
           << "\n";
diff --git a/src/analyses/local_bitvector_analysis.h b/src/analyses/local_bitvector_analysis.h
index a88b38fb1c6..4a750d8cf32 100644
--- a/src/analyses/local_bitvector_analysis.h
+++ b/src/analyses/local_bitvector_analysis.h
@@ -186,27 +186,20 @@ class local_bitvector_analysist
   // This is a vector, so it's fast.
   typedef expanding_vectort<flagst> points_tot;
 
-  // the information tracked per program location
-  class loc_infot
-  {
-  public:
-    points_tot points_to;
-
-    bool merge(const loc_infot &src);
-  };
+  static bool merge(points_tot &a, points_tot &b);
 
-  typedef std::vector<loc_infot> loc_infost;
+  typedef std::vector<points_tot> loc_infost;
   loc_infost loc_infos;
 
   void assign_lhs(
     const exprt &lhs,
     const exprt &rhs,
-    const loc_infot &loc_info_src,
-    loc_infot &loc_info_dest);
+    points_tot &loc_info_src,
+    points_tot &loc_info_dest);
 
   flagst get_rec(
     const exprt &rhs,
-    const loc_infot &loc_info_src);
+    points_tot &loc_info_src);
 
   bool is_tracked(const irep_idt &identifier);
 };
diff --git a/src/analyses/local_may_alias.h b/src/analyses/local_may_alias.h
index 5e04ff01a75..307513a64eb 100644
--- a/src/analyses/local_may_alias.h
+++ b/src/analyses/local_may_alias.h
@@ -12,10 +12,11 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_ANALYSES_LOCAL_MAY_ALIAS_H
 #define CPROVER_ANALYSES_LOCAL_MAY_ALIAS_H
 
-#include <stack>
 #include <memory>
+#include <stack>
 
 #include <util/union_find.h>
+#include <util/make_unique.h>
 
 #include "locals.h"
 #include "dirty.h"
@@ -117,8 +118,7 @@ class local_may_alias_factoryt
     goto_functionst::function_mapt::const_iterator f_it2=
       goto_functions->function_map.find(fkt);
     assert(f_it2!=goto_functions->function_map.end());
-    return *(fkt_map[fkt]=std::unique_ptr<local_may_aliast>(
-              new local_may_aliast(f_it2->second)));
+    return *(fkt_map[fkt]=util_make_unique<local_may_aliast>(f_it2->second));
   }
 
   local_may_aliast &operator()(goto_programt::const_targett t)
diff --git a/src/analyses/natural_loops.h b/src/analyses/natural_loops.h
index ce27a306882..9eb24ccc0ed 100644
--- a/src/analyses/natural_loops.h
+++ b/src/analyses/natural_loops.h
@@ -93,23 +93,21 @@ void natural_loops_templatet<P, T>::compute(P &program)
   {
     if(m_it->is_backwards_goto())
     {
-      for(const auto &target : m_it->targets)
+      const auto &target=m_it->get_target();
+
+      if(target->location_number<=m_it->location_number)
       {
-        if(target->location_number<=m_it->location_number)
-        {
-          const nodet &node=
-            cfg_dominators.cfg[cfg_dominators.cfg.entry_map[m_it]];
+        const nodet &node=
+          cfg_dominators.cfg[cfg_dominators.cfg.entry_map[m_it]];
 
-#ifdef DEBUG
-          std::cout << "Computing loop for "
-                    << m_it->location_number << " -> "
-                    << target->location_number << "\n";
-#endif
-          if(node.dominators.find(target)!=node.dominators.end())
-          {
-            compute_natural_loop(m_it, target);
-          }
-        }
+        #ifdef DEBUG
+        std::cout << "Computing loop for "
+                  << m_it->location_number << " -> "
+                  << target->location_number << "\n";
+        #endif
+
+        if(node.dominators.find(target)!=node.dominators.end())
+          compute_natural_loop(m_it, target);
       }
     }
   }
diff --git a/src/analyses/reaching_definitions.cpp b/src/analyses/reaching_definitions.cpp
index 89b31da543b..c3242849511 100644
--- a/src/analyses/reaching_definitions.cpp
+++ b/src/analyses/reaching_definitions.cpp
@@ -15,14 +15,26 @@ Date: February 2013
 
 #include "reaching_definitions.h"
 
+#include <memory>
+
 #include <util/pointer_offset_size.h>
 #include <util/prefix.h>
+#include <util/make_unique.h>
 
 #include <pointer-analysis/value_set_analysis_fi.h>
 
 #include "is_threaded.h"
 #include "dirty.h"
 
+reaching_definitions_analysist::reaching_definitions_analysist(
+  const namespacet &_ns):
+    concurrency_aware_ait<rd_range_domaint>(),
+    ns(_ns)
+{
+}
+
+reaching_definitions_analysist::~reaching_definitions_analysist()=default;
+
 void rd_range_domaint::populate_cache(const irep_idt &identifier) const
 {
   assert(bv_container);
@@ -717,26 +729,16 @@ const rd_range_domaint::ranges_at_loct &rd_range_domaint::get(
     return entry->second;
 }
 
-reaching_definitions_analysist::~reaching_definitions_analysist()
-{
-  if(is_dirty)
-    delete is_dirty;
-  if(is_threaded)
-    delete is_threaded;
-  if(value_sets)
-    delete value_sets;
-}
-
 void reaching_definitions_analysist::initialize(
   const goto_functionst &goto_functions)
 {
-  value_set_analysis_fit *value_sets_=new value_set_analysis_fit(ns);
+  auto value_sets_=util_make_unique<value_set_analysis_fit>(ns);
   (*value_sets_)(goto_functions);
-  value_sets=value_sets_;
+  value_sets=std::move(value_sets_);
 
-  is_threaded=new is_threadedt(goto_functions);
+  is_threaded=util_make_unique<is_threadedt>(goto_functions);
 
-  is_dirty=new dirtyt(goto_functions);
+  is_dirty=util_make_unique<dirtyt>(goto_functions);
 
   concurrency_aware_ait<rd_range_domaint>::initialize(goto_functions);
 }
diff --git a/src/analyses/reaching_definitions.h b/src/analyses/reaching_definitions.h
index 21cbd1ed377..c62bd5e4b51 100644
--- a/src/analyses/reaching_definitions.h
+++ b/src/analyses/reaching_definitions.h
@@ -241,14 +241,7 @@ class reaching_definitions_analysist:
 {
 public:
   // constructor
-  explicit reaching_definitions_analysist(const namespacet &_ns):
-    concurrency_aware_ait<rd_range_domaint>(),
-    ns(_ns),
-    value_sets(nullptr),
-    is_threaded(nullptr),
-    is_dirty(nullptr)
-  {
-  }
+  explicit reaching_definitions_analysist(const namespacet &_ns);
 
   virtual ~reaching_definitions_analysist();
 
@@ -290,9 +283,9 @@ class reaching_definitions_analysist:
 
 protected:
   const namespacet &ns;
-  value_setst * value_sets;
-  is_threadedt * is_threaded;
-  dirtyt * is_dirty;
+  std::unique_ptr<value_setst> value_sets;
+  std::unique_ptr<is_threadedt> is_threaded;
+  std::unique_ptr<dirtyt> is_dirty;
 };
 
 #endif // CPROVER_ANALYSES_REACHING_DEFINITIONS_H
diff --git a/src/analyses/static_analysis.h b/src/analyses/static_analysis.h
index ed54cf783af..37dff029936 100644
--- a/src/analyses/static_analysis.h
+++ b/src/analyses/static_analysis.h
@@ -16,10 +16,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #error Deprecated, use ai.h instead
 #endif
 
-#include <map>
 #include <iosfwd>
+#include <map>
+#include <memory>
 #include <unordered_set>
 
+#include <util/make_unique.h>
+
 #include <goto-programs/goto_functions.h>
 
 // don't use me -- I am just a base class
@@ -264,7 +267,7 @@ class static_analysis_baset
   virtual void generate_state(locationt l)=0;
   virtual statet &get_state(locationt l)=0;
   virtual const statet &get_state(locationt l) const=0;
-  virtual statet* make_temporary_state(statet &s)=0;
+  virtual std::unique_ptr<statet> make_temporary_state(statet &s)=0;
 
   typedef domain_baset::expr_sett expr_sett;
 
@@ -346,9 +349,9 @@ class static_analysist:public static_analysis_baset
     return static_cast<T &>(a).merge(static_cast<const T &>(b), to);
   }
 
-  virtual statet *make_temporary_state(statet &s)
+  virtual std::unique_ptr<statet> make_temporary_state(statet &s)
   {
-    return new T(static_cast<T &>(s));
+    return util_make_unique<T>(static_cast<T &>(s));
   }
 
   virtual void generate_state(locationt l)
diff --git a/src/analyses/uncaught_exceptions_analysis.cpp b/src/analyses/uncaught_exceptions_analysis.cpp
new file mode 100644
index 00000000000..65baa49e082
--- /dev/null
+++ b/src/analyses/uncaught_exceptions_analysis.cpp
@@ -0,0 +1,229 @@
+/*******************************************************************\
+
+Module: Over-approximating uncaught exceptions analysis
+
+Author: Cristina David
+
+\*******************************************************************/
+
+/// \file
+/// Over-approximating uncaught exceptions analysis
+
+#ifdef DEBUG
+#include <iostream>
+#endif
+#include "uncaught_exceptions_analysis.h"
+
+/// Returns the compile type of an exception
+irep_idt uncaught_exceptions_domaint::get_exception_type(const typet &type)
+{
+  PRECONDITION(type.id()==ID_pointer);
+
+  if(type.subtype().id()==ID_symbol)
+  {
+    return to_symbol_type(type.subtype()).get_identifier();
+  }
+  return ID_empty;
+}
+
+/// Returns the symbol corresponding to an exception
+exprt uncaught_exceptions_domaint::get_exception_symbol(const exprt &expr)
+{
+  if(expr.id()!=ID_symbol && expr.has_operands())
+    return get_exception_symbol(expr.op0());
+
+  return expr;
+}
+
+/// The join operator for the uncaught exceptions domain
+void uncaught_exceptions_domaint::join(
+  const irep_idt &element)
+{
+  thrown.insert(element);
+}
+
+void uncaught_exceptions_domaint::join(
+  const std::set<irep_idt> &elements)
+{
+  thrown.insert(elements.begin(), elements.end());
+}
+
+void uncaught_exceptions_domaint::join(
+  const std::vector<irep_idt> &elements)
+{
+  thrown.insert(elements.begin(), elements.end());
+}
+
+
+/// The transformer for the uncaught exceptions domain
+void uncaught_exceptions_domaint::transform(
+  const goto_programt::const_targett from,
+  uncaught_exceptions_analysist &uea,
+  const namespacet &ns)
+{
+  const goto_programt::instructiont &instruction=*from;
+
+  switch(instruction.type)
+  {
+  case THROW:
+  {
+    const exprt &exc_symbol=get_exception_symbol(instruction.code);
+    // retrieve the static type of the thrown exception
+    const irep_idt &type_id=get_exception_type(exc_symbol.type());
+    bool assertion_error=
+      id2string(type_id).find("java.lang.AssertionError")!=std::string::npos;
+    if(!assertion_error)
+    {
+      join(type_id);
+      // we must consider all the subtypes given that
+      // the runtime type is a subtype of the static type
+      std::vector<irep_idt> subtypes=
+        class_hierarchy.get_children_trans(type_id);
+      join(subtypes);
+    }
+    break;
+  }
+  case CATCH:
+  {
+    if(!instruction.code.has_operands())
+    {
+      if(!instruction.targets.empty()) // push
+      {
+        std::set<irep_idt> caught;
+        stack_caught.push_back(caught);
+        std::set<irep_idt> &last_caught=stack_caught.back();
+        const irept::subt &exception_list=
+          instruction.code.find(ID_exception_list).get_sub();
+
+        for(const auto &exc : exception_list)
+        {
+          last_caught.insert(exc.id());
+          std::vector<irep_idt> subtypes=
+            class_hierarchy.get_children_trans(exc.id());
+          last_caught.insert(subtypes.begin(), subtypes.end());
+        }
+      }
+      else // pop
+      {
+        if(!stack_caught.empty())
+        {
+          const std::set<irep_idt> &caught=stack_caught.back();
+          join(caught);
+          // remove the caught exceptions
+          for(const auto &exc_id : caught)
+            thrown.erase(exc_id);
+          stack_caught.pop_back();
+        }
+      }
+    }
+    break;
+  }
+  case FUNCTION_CALL:
+  {
+    const exprt &function_expr=
+      to_code_function_call(instruction.code).function();
+    DATA_INVARIANT(
+      function_expr.id()==ID_symbol,
+      "identifier expected to be a symbol");
+    const irep_idt &function_name=
+      to_symbol_expr(function_expr).get_identifier();
+    // use the current information about the callee
+    join(uea.exceptions_map[function_name]);
+    break;
+  }
+  default:
+  {}
+  }
+}
+
+/// Returns the value of the private member thrown
+const std::set<irep_idt> &uncaught_exceptions_domaint::get_elements() const
+{
+  return thrown;
+}
+
+/// Constructs the class hierarchy
+void uncaught_exceptions_domaint::operator()(
+  const namespacet &ns)
+{
+  class_hierarchy(ns.get_symbol_table());
+}
+
+/// Runs the uncaught exceptions analysis, which  populates the exceptions map
+void uncaught_exceptions_analysist::collect_uncaught_exceptions(
+  const goto_functionst &goto_functions,
+  const namespacet &ns)
+{
+  bool change=true;
+
+  while(change)
+  {
+    change=false;
+    // add all the functions to the worklist
+    forall_goto_functions(current_function, goto_functions)
+    {
+      domain.make_top();
+      const goto_programt &goto_program=current_function->second.body;
+
+      if(goto_program.empty())
+        continue;
+
+      forall_goto_program_instructions(instr_it, goto_program)
+      {
+        domain.transform(instr_it, *this, ns);
+      }
+      // did our estimation for the current function improve?
+      const std::set<irep_idt> &elements=domain.get_elements();
+      if(exceptions_map[current_function->first].size()<elements.size())
+      {
+        change=true;
+        exceptions_map[current_function->first]=elements;
+      }
+    }
+  }
+}
+
+/// Prints the exceptions map that maps each method to the  set of exceptions
+/// that may escape it
+void uncaught_exceptions_analysist::output(
+  const goto_functionst &goto_functions)
+{
+#ifdef DEBUG
+  forall_goto_functions(it, goto_functions)
+  {
+    if(exceptions_map[it->first].size()>0)
+    {
+      std::cout << "Uncaught exceptions in function " <<
+        it->first << ": " << std::endl;
+      INVARIANT(
+        exceptions_map.find(it->first)!=exceptions_map.end(),
+        "each function expected to be recorded in `exceptions_map`");
+      for(auto exc_id : exceptions_map[it->first])
+        std::cout << id2string(exc_id) << " ";
+      std::cout << std::endl;
+    }
+  }
+#endif
+}
+
+/// Applies the uncaught exceptions analysis and  outputs the result
+void uncaught_exceptions_analysist::operator()(
+  const goto_functionst &goto_functions,
+  const namespacet &ns,
+  exceptions_mapt &exceptions)
+{
+  domain(ns);
+  collect_uncaught_exceptions(goto_functions, ns);
+  exceptions=exceptions_map;
+  output(goto_functions);
+}
+
+/// Applies the uncaught exceptions analysis and  outputs the result
+void uncaught_exceptions(
+  const goto_functionst &goto_functions,
+  const namespacet &ns,
+  std::map<irep_idt, std::set<irep_idt>> &exceptions_map)
+{
+  uncaught_exceptions_analysist exceptions;
+  exceptions(goto_functions, ns, exceptions_map);
+}
diff --git a/src/analyses/uncaught_exceptions_analysis.h b/src/analyses/uncaught_exceptions_analysis.h
new file mode 100644
index 00000000000..a53998b4bd2
--- /dev/null
+++ b/src/analyses/uncaught_exceptions_analysis.h
@@ -0,0 +1,86 @@
+/*******************************************************************\
+
+Module: Over-approximative uncaught exceptions analysis
+
+Author: Cristina David
+
+\*******************************************************************/
+
+/// \file
+/// Over-approximative uncaught exceptions analysis
+
+#ifndef CPROVER_ANALYSES_UNCAUGHT_EXCEPTIONS_ANALYSIS_H
+#define CPROVER_ANALYSES_UNCAUGHT_EXCEPTIONS_ANALYSIS_H
+
+#include <algorithm>
+#include <map>
+#include <set>
+#include <goto-programs/goto_functions.h>
+#include <goto-programs/class_hierarchy.h>
+
+/// defines the domain used by the uncaught  exceptions analysis
+class uncaught_exceptions_analysist;
+
+class uncaught_exceptions_domaint
+{
+ public:
+  void transform(const goto_programt::const_targett,
+                 uncaught_exceptions_analysist &,
+                 const namespacet &);
+
+  void join(const irep_idt &);
+  void join(const std::set<irep_idt> &);
+  void join(const std::vector<irep_idt> &);
+
+  void make_top()
+  {
+    thrown.clear();
+    stack_caught.clear();
+  }
+
+  static irep_idt get_exception_type(const typet &type);
+
+  static exprt get_exception_symbol(const exprt &exor);
+
+  const std::set<irep_idt>  &get_elements() const;
+
+  void operator()(const namespacet &ns);
+
+ private:
+  typedef std::vector<std::set<irep_idt>> stack_caughtt;
+  stack_caughtt stack_caught;
+  std::set<irep_idt> thrown;
+  class_hierarchyt class_hierarchy;
+};
+
+/// computes in exceptions_map an overapproximation of the  exceptions thrown by
+/// each method
+class uncaught_exceptions_analysist
+{
+public:
+  typedef std::map<irep_idt, std::set<irep_idt>> exceptions_mapt;
+
+  void collect_uncaught_exceptions(
+    const goto_functionst &,
+    const namespacet &);
+
+  void output(const goto_functionst &);
+
+  void operator()(
+    const goto_functionst &,
+    const namespacet &,
+    exceptions_mapt &);
+
+  friend class uncaught_exceptions_domaint;
+
+ private:
+  uncaught_exceptions_domaint domain;
+  exceptions_mapt exceptions_map;
+};
+
+void uncaught_exceptions(
+  const goto_functionst &,
+  const namespacet &,
+  std::map<irep_idt, std::set<irep_idt>> &);
+
+#endif
diff --git a/src/ansi-c/ansi_c_convert_type.cpp b/src/ansi-c/ansi_c_convert_type.cpp
index 23be0fdb935..1a67c80c4fa 100644
--- a/src/ansi-c/ansi_c_convert_type.cpp
+++ b/src/ansi-c/ansi_c_convert_type.cpp
@@ -460,7 +460,7 @@ void ansi_c_convert_typet::write(typet &type)
         else
           type=unsigned_long_long_int_type();
       else
-        assert(false);
+        UNREACHABLE;
     }
     else if(gcc_int128_cnt)
     {
diff --git a/src/ansi-c/ansi_c_declaration.cpp b/src/ansi-c/ansi_c_declaration.cpp
index 00beb3a92cf..a0ef86cffe0 100644
--- a/src/ansi-c/ansi_c_declaration.cpp
+++ b/src/ansi-c/ansi_c_declaration.cpp
@@ -16,6 +16,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <util/config.h>
 #include <util/std_types.h>
+#include <util/invariant.h>
 
 void ansi_c_declaratort::build(irept &src)
 {
@@ -36,7 +37,7 @@ void ansi_c_declaratort::build(irept &src)
     else if(t.id().empty() ||
             t.is_nil())
     {
-      assert(0);
+      UNREACHABLE;
     }
     else if(t.id()==ID_abstract)
     {
@@ -108,7 +109,7 @@ typet ansi_c_declarationt::full_type(
       p=&(p->subtypes().back());
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
 
   *p=type();
diff --git a/src/ansi-c/ansi_c_entry_point.cpp b/src/ansi-c/ansi_c_entry_point.cpp
index b22896bd7f7..af1f6c1cb51 100644
--- a/src/ansi-c/ansi_c_entry_point.cpp
+++ b/src/ansi-c/ansi_c_entry_point.cpp
@@ -305,7 +305,7 @@ bool ansi_c_entry_point(
           max=to_unsignedbv_type(envp_size_symbol.type).largest();
         }
         else
-          assert(false);
+          UNREACHABLE;
 
         exprt max_minus_one=from_integer(max-1, envp_size_symbol.type);
 
@@ -431,7 +431,7 @@ bool ansi_c_entry_point(
       }
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
   else
   {
diff --git a/src/ansi-c/ansi_c_language.cpp b/src/ansi-c/ansi_c_language.cpp
index 3a2f52f25fd..b262b46d7d5 100644
--- a/src/ansi-c/ansi_c_language.cpp
+++ b/src/ansi-c/ansi_c_language.cpp
@@ -129,6 +129,8 @@ bool ansi_c_languaget::final(
   symbol_tablet &symbol_table,
   bool generate_start_function)
 {
+  generate_opaque_method_stubs(symbol_table);
+
   if(generate_start_function)
   {
     if(ansi_c_entry_point(symbol_table, "main", get_message_handler()))
@@ -143,9 +145,9 @@ void ansi_c_languaget::show_parse(std::ostream &out)
   parse_tree.output(out);
 }
 
-languaget *new_ansi_c_language()
+std::unique_ptr<languaget> new_ansi_c_language()
 {
-  return new ansi_c_languaget;
+  return util_make_unique<ansi_c_languaget>();
 }
 
 bool ansi_c_languaget::from_expr(
diff --git a/src/ansi-c/ansi_c_language.h b/src/ansi-c/ansi_c_language.h
index ba2aa0f8e32..a06cf4d3645 100644
--- a/src/ansi-c/ansi_c_language.h
+++ b/src/ansi-c/ansi_c_language.h
@@ -10,7 +10,12 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_ANSI_C_ANSI_C_LANGUAGE_H
 #define CPROVER_ANSI_C_ANSI_C_LANGUAGE_H
 
+/*! \defgroup gr_ansi_c ANSI-C front-end */
+
+#include <memory>
+
 #include <util/language.h>
+#include <util/make_unique.h>
 
 #include "ansi_c_parse_tree.h"
 
@@ -63,8 +68,8 @@ class ansi_c_languaget:public languaget
     exprt &expr,
     const namespacet &ns) override;
 
-  languaget *new_language() override
-  { return new ansi_c_languaget; }
+  std::unique_ptr<languaget> new_language() override
+  { return util_make_unique<ansi_c_languaget>(); }
 
   std::string id() const override { return "C"; }
   std::string description() const override { return "ANSI-C 99"; }
@@ -77,6 +82,6 @@ class ansi_c_languaget:public languaget
   std::string parse_path;
 };
 
-languaget *new_ansi_c_language();
+std::unique_ptr<languaget> new_ansi_c_language();
 
 #endif // CPROVER_ANSI_C_ANSI_C_LANGUAGE_H
diff --git a/src/ansi-c/c_preprocess.cpp b/src/ansi-c/c_preprocess.cpp
index 927a928b187..26fb22355ff 100644
--- a/src/ansi-c/c_preprocess.cpp
+++ b/src/ansi-c/c_preprocess.cpp
@@ -106,7 +106,7 @@ static std::string type_max(const typet &src)
     return integer2string(
       power(2, to_unsignedbv_type(src).get_width()-1)-1);
   else
-    assert(false);
+    UNREACHABLE;
 }
 
 /// quote a string for bash and CMD
@@ -766,7 +766,7 @@ bool c_preprocess_gcc_clang(
     else if(config.ansi_c.wchar_t_width==config.ansi_c.char_width)
       command+=" -D__WCHAR_TYPE__=\""+sig+" char\"";
     else
-      assert(false);
+      UNREACHABLE;
   }
 
   if(config.ansi_c.char_is_unsigned)
@@ -804,7 +804,7 @@ bool c_preprocess_gcc_clang(
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 
   // Standard Defines, ANSI9899 6.10.8
diff --git a/src/ansi-c/c_typecast.cpp b/src/ansi-c/c_typecast.cpp
index ce451e79f75..edf95e5379e 100644
--- a/src/ansi-c/c_typecast.cpp
+++ b/src/ansi-c/c_typecast.cpp
@@ -378,11 +378,11 @@ void c_typecastt::implicit_typecast_arithmetic(
     }
     return;
 
-  case BOOL:       assert(false); // should always be promoted to int
-  case CHAR:       assert(false); // should always be promoted to int
-  case UCHAR:      assert(false); // should always be promoted to int
-  case SHORT:      assert(false); // should always be promoted to int
-  case USHORT:     assert(false); // should always be promoted to int
+  case BOOL:       UNREACHABLE; // should always be promoted to int
+  case CHAR:       UNREACHABLE; // should always be promoted to int
+  case UCHAR:      UNREACHABLE; // should always be promoted to int
+  case SHORT:      UNREACHABLE; // should always be promoted to int
+  case USHORT:     UNREACHABLE; // should always be promoted to int
   case INT:        new_type=signed_int_type(); break;
   case UINT:       new_type=unsigned_int_type(); break;
   case LONG:       new_type=signed_long_int_type(); break;
diff --git a/src/ansi-c/c_typecheck_expr.cpp b/src/ansi-c/c_typecheck_expr.cpp
index fee4e8685d1..54eab363d7b 100644
--- a/src/ansi-c/c_typecheck_expr.cpp
+++ b/src/ansi-c/c_typecheck_expr.cpp
@@ -77,7 +77,7 @@ void c_typecheck_baset::add_rounding_mode(exprt &expr)
       else if(expr.id()==ID_minus)
         expr.id(ID_floatbv_minus);
       else
-        assert(false);
+        UNREACHABLE;
 
       expr.op2()=from_integer(0, unsigned_int_type());
     }
@@ -875,7 +875,7 @@ void c_typecheck_baset::typecheck_side_effect_statement_expression(
   else if(last_statement==ID_function_call)
   {
     // this is suspected to be dead
-    assert(false);
+    UNREACHABLE;
 
     // make the last statement an expression
 
@@ -2852,7 +2852,7 @@ void c_typecheck_baset::typecheck_expr_binary_arithmetic(exprt &expr)
         else if(expr.id()==ID_bitxor)
           expr.id(ID_xor);
         else
-          assert(false);
+          UNREACHABLE;
         expr.type()=type0;
         return;
       }
@@ -3010,7 +3010,7 @@ void c_typecheck_baset::typecheck_expr_pointer_arithmetic(exprt &expr)
     else
     {
       p_op=int_op=nullptr;
-      assert(false);
+      UNREACHABLE;
     }
 
     const typet &int_op_type=follow(int_op->type());
diff --git a/src/ansi-c/c_typecheck_initializer.cpp b/src/ansi-c/c_typecheck_initializer.cpp
index 1bc494c8d4a..7d388cc68dd 100644
--- a/src/ansi-c/c_typecheck_initializer.cpp
+++ b/src/ansi-c/c_typecheck_initializer.cpp
@@ -344,7 +344,7 @@ void c_typecheck_baset::designator_enter(
     entry.subtype=vector_type.subtype();
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   designator.push_entry(entry);
 }
@@ -478,7 +478,7 @@ exprt::operandst::const_iterator c_typecheck_baset::do_designated_initializer(
       dest=&(dest->op0());
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
 
   // second phase: assign value
diff --git a/src/ansi-c/c_typecheck_type.cpp b/src/ansi-c/c_typecheck_type.cpp
index 5195e653364..393be7dbf54 100644
--- a/src/ansi-c/c_typecheck_type.cpp
+++ b/src/ansi-c/c_typecheck_type.cpp
@@ -380,7 +380,7 @@ void c_typecheck_baset::typecheck_custom_type(typet &type)
     type.set(ID_f, integer2string(f_int));
   }
   else
-    assert(false);
+    UNREACHABLE;
 }
 
 void c_typecheck_baset::typecheck_code_type(code_typet &type)
@@ -759,7 +759,7 @@ void c_typecheck_baset::typecheck_compound_type(struct_union_typet &type)
       else if(compound_symbol.type.id()==ID_union)
         compound_symbol.type.id(ID_incomplete_union);
       else
-        assert(false);
+        UNREACHABLE;
 
       symbolt *new_symbol;
       move_symbol(compound_symbol, new_symbol);
diff --git a/src/ansi-c/expr2c.cpp b/src/ansi-c/expr2c.cpp
index 4db1985b07e..22f39ce7a46 100644
--- a/src/ansi-c/expr2c.cpp
+++ b/src/ansi-c/expr2c.cpp
@@ -114,7 +114,7 @@ void expr2ct::get_shorthands(const exprt &expr)
     ns_collision[symbol->location.get_function()].insert(sh);
 
     if(!shorthands.insert(std::make_pair(*it, sh)).second)
-      assert(false);
+      UNREACHABLE;
   }
 
   for(find_symbols_sett::const_iterator
@@ -465,28 +465,40 @@ std::string expr2ct::convert_rec(
   }
   else if(src.id()==ID_symbol)
   {
-    const typet &followed=ns.follow(src);
+    symbol_typet symbolic_type=to_symbol_type(src);
+    const irep_idt &typedef_identifer=symbolic_type.get(ID_typedef);
 
-    if(followed.id()==ID_struct)
+    // Providing we have a valid identifer, we can just use that rather than
+    // trying to find the concrete type
+    if(typedef_identifer!="")
     {
-      std::string dest=q+"struct";
-      const irep_idt &tag=to_struct_type(followed).get_tag();
-      if(tag!="")
-        dest+=" "+id2string(tag);
-      dest+=d;
-      return dest;
+      return q+id2string(typedef_identifer)+d;
     }
-    else if(followed.id()==ID_union)
+    else
     {
-      std::string dest=q+"union";
-      const irep_idt &tag=to_union_type(followed).get_tag();
-      if(tag!="")
-        dest+=" "+id2string(tag);
-      dest+=d;
-      return dest;
+      const typet &followed=ns.follow(src);
+
+      if(followed.id()==ID_struct)
+      {
+        std::string dest=q+"struct";
+        const irep_idt &tag=to_struct_type(followed).get_tag();
+        if(tag!="")
+          dest+=" "+id2string(tag);
+        dest+=d;
+        return dest;
+      }
+      else if(followed.id()==ID_union)
+      {
+        std::string dest=q+"union";
+        const irep_idt &tag=to_union_type(followed).get_tag();
+        if(tag!="")
+          dest+=" "+id2string(tag);
+        dest+=d;
+        return dest;
+      }
+      else
+        return convert_rec(followed, new_qualifiers, declarator);
     }
-    else
-      return convert_rec(followed, new_qualifiers, declarator);
   }
   else if(src.id()==ID_struct_tag)
   {
diff --git a/src/cbmc/all_properties_class.h b/src/cbmc/all_properties_class.h
index 89c4614cc12..42b95de39f4 100644
--- a/src/cbmc/all_properties_class.h
+++ b/src/cbmc/all_properties_class.h
@@ -56,7 +56,7 @@ class bmc_all_propertiest:
       }
 
       // make some poor compilers happy
-      assert(false);
+      UNREACHABLE;
       return "";
     }
 
diff --git a/src/cbmc/bmc.cpp b/src/cbmc/bmc.cpp
index 4f55b1a7315..ab5d6883ab0 100644
--- a/src/cbmc/bmc.cpp
+++ b/src/cbmc/bmc.cpp
@@ -55,15 +55,16 @@ void bmct::error_trace()
   switch(ui)
   {
   case ui_message_handlert::uit::PLAIN:
-    std::cout << "\n" << "Counterexample:" << "\n";
-    show_goto_trace(std::cout, ns, goto_trace);
+    status() << "Counterexample:" << eom;
+    show_goto_trace(status(), ns, goto_trace);
+    status() << eom;
     break;
 
   case ui_message_handlert::uit::XML_UI:
     {
       xmlt xml;
       convert(ns, goto_trace, xml);
-      std::cout << xml << "\n";
+      status() << preformatted_output << xml << eom;
     }
     break;
 
@@ -80,7 +81,7 @@ void bmct::error_trace()
       result["status"]=json_stringt("failed");
       jsont &json_trace=result["trace"];
       convert(ns, goto_trace, json_trace);
-      std::cout << ",\n" << json_result;
+      status() << preformatted_output << json_result << eom;
     }
     break;
   }
@@ -313,11 +314,11 @@ safety_checkert::resultt bmct::run(
   std::unique_ptr<memory_model_baset> memory_model;
 
   if(mm.empty() || mm=="sc")
-    memory_model=std::unique_ptr<memory_model_baset>(new memory_model_sct(ns));
+    memory_model=util_make_unique<memory_model_sct>(ns);
   else if(mm=="tso")
-    memory_model=std::unique_ptr<memory_model_baset>(new memory_model_tsot(ns));
+    memory_model=util_make_unique<memory_model_tsot>(ns);
   else if(mm=="pso")
-    memory_model=std::unique_ptr<memory_model_baset>(new memory_model_psot(ns));
+    memory_model=util_make_unique<memory_model_psot>(ns);
   else
   {
     error() << "Invalid memory model " << mm
diff --git a/src/cbmc/bmc.h b/src/cbmc/bmc.h
index e05a4de62f6..4c69fab527c 100644
--- a/src/cbmc/bmc.h
+++ b/src/cbmc/bmc.h
@@ -113,6 +113,8 @@ class bmct:public safety_checkert
 
   friend class bmc_all_propertiest;
   friend class bmc_covert;
+  template <template <class goalt> class covert>
+  friend class bmc_goal_covert;
   friend class fault_localizationt;
 };
 
diff --git a/src/cbmc/cbmc_main.cpp b/src/cbmc/cbmc_main.cpp
index 3a35c6bb197..bcf6c764c68 100644
--- a/src/cbmc/cbmc_main.cpp
+++ b/src/cbmc/cbmc_main.cpp
@@ -34,7 +34,9 @@ extern unsigned long long irep_cmp_ne_cnt;
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
diff --git a/src/cbmc/cbmc_parse_options.cpp b/src/cbmc/cbmc_parse_options.cpp
index 0e12193ce38..702a27a0bef 100644
--- a/src/cbmc/cbmc_parse_options.cpp
+++ b/src/cbmc/cbmc_parse_options.cpp
@@ -48,6 +48,8 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <goto-programs/link_to_library.h>
 #include <goto-programs/remove_skip.h>
 #include <goto-programs/show_goto_functions.h>
+#include <goto-programs/replace_java_nondet.h>
+#include <goto-programs/convert_nondet.h>
 
 #include <goto-symex/rewrite_union.h>
 #include <goto-symex/adjust_float_expressions.h>
@@ -60,6 +62,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <langapi/mode.h>
 
+#include "java_bytecode/java_bytecode_language.h"
+
 #include "cbmc_solvers.h"
 #include "bmc.h"
 #include "version.h"
@@ -271,6 +275,16 @@ void cbmc_parse_optionst::get_command_line_options(optionst &options)
     options.set_option("refine-arithmetic", true);
   }
 
+  if(cmdline.isset("refine-strings"))
+  {
+    options.set_option("refine-strings", true);
+    options.set_option("string-non-empty", cmdline.isset("string-non-empty"));
+    options.set_option("string-printable", cmdline.isset("string-printable"));
+    if(cmdline.isset("string-max-length"))
+      options.set_option(
+        "string-max-length", cmdline.get_value("string-max-length"));
+  }
+
   if(cmdline.isset("max-node-refinement"))
     options.set_option(
       "max-node-refinement",
@@ -417,7 +431,23 @@ int cbmc_parse_optionst::doit()
   //
 
   optionst options;
-  get_command_line_options(options);
+  try
+  {
+    get_command_line_options(options);
+  }
+
+  catch(const char *error_msg)
+  {
+    error() << error_msg << eom;
+    return 6; // should contemplate EX_SOFTWARE from sysexits.h
+  }
+
+  catch(const std::string error_msg)
+  {
+    error() << error_msg << eom;
+    return 6; // should contemplate EX_SOFTWARE from sysexits.h
+  }
+
   eval_verbosity();
 
   //
@@ -475,7 +505,11 @@ int cbmc_parse_optionst::doit()
   // unwinds <clinit> loops to number of enum elements
   // side effect: add this as explicit unwind to unwind set
   if(options.get_bool_option("java-unwind-enum-static"))
-    remove_static_init_loops(symbol_table, goto_functions, options);
+    remove_static_init_loops(
+      symbol_table,
+      goto_functions,
+      options,
+      ui_message_handler);
 
   // get solver
   cbmc_solverst cbmc_solvers(options, symbol_table, ui_message_handler);
@@ -570,7 +604,8 @@ int cbmc_parse_optionst::get_goto_program(
         return 6;
       }
 
-      languaget *language=get_language_from_filename(filename);
+      std::unique_ptr<languaget> language=get_language_from_filename(filename);
+      language->get_language_options(cmdline);
 
       if(language==nullptr)
       {
@@ -641,9 +676,6 @@ int cbmc_parse_optionst::get_goto_program(
       }
     }
 
-    if(!binaries.empty())
-      config.set_from_symbol_table(symbol_table);
-
     if(cmdline.isset("show-symbol-table"))
     {
       show_symbol_table();
@@ -671,6 +703,8 @@ int cbmc_parse_optionst::get_goto_program(
       show_goto_functions(ns, get_ui(), goto_functions);
       return 0;
     }
+
+    status() << config.object_bits_info() << eom;
   }
 
   catch(const char *e)
@@ -719,17 +753,16 @@ void cbmc_parse_optionst::preprocessing()
       return;
     }
 
-    languaget *ptr=get_language_from_filename(filename);
+    std::unique_ptr<languaget> language=get_language_from_filename(filename);
+    language->get_language_options(cmdline);
 
-    if(ptr==nullptr)
+    if(language==nullptr)
     {
       error() << "failed to figure out type of file" << eom;
       return;
     }
 
-    ptr->set_message_handler(get_message_handler());
-
-    std::unique_ptr<languaget> language(ptr);
+    language->set_message_handler(get_message_handler());
 
     if(language->preprocess(infile, filename, std::cout))
       error() << "PREPROCESSING ERROR" << eom;
@@ -783,7 +816,7 @@ bool cbmc_parse_optionst::process_goto_program(
       cmdline.isset("pointer-check"));
     // Java virtual functions -> explicit dispatch tables:
     remove_virtual_functions(symbol_table, goto_functions);
-    // remove catch and throw
+    // remove catch and throw (introduces instanceof)
     remove_exceptions(symbol_table, goto_functions);
     // Similar removal of RTTI inspection:
     remove_instanceof(symbol_table, goto_functions);
@@ -800,6 +833,25 @@ bool cbmc_parse_optionst::process_goto_program(
     remove_complex(symbol_table, goto_functions);
     rewrite_union(goto_functions, ns);
 
+    // Similar removal of java nondet statements:
+    // TODO Should really get this from java_bytecode_language somehow, but we
+    // don't have an instance of that here.
+    const size_t max_nondet_array_length=
+      cmdline.isset("java-max-input-array-length")
+        ? std::stoul(cmdline.get_value("java-max-input-array-length"))
+        : MAX_NONDET_ARRAY_LENGTH_DEFAULT;
+    const size_t max_nondet_tree_depth=
+      cmdline.isset("java-max-input-tree-depth")
+        ? std::stoul(cmdline.get_value("java-max-input-tree-depth"))
+        : MAX_NONDET_TREE_DEPTH;
+    replace_java_nondet(goto_functions);
+    convert_nondet(
+      goto_functions,
+      symbol_table,
+      ui_message_handler,
+      max_nondet_array_length,
+      max_nondet_tree_depth);
+
     // add generic checks
     status() << "Generic Property Instrumentation" << eom;
     goto_check(ns, options, goto_functions);
@@ -842,6 +894,10 @@ bool cbmc_parse_optionst::process_goto_program(
       remove_unused_functions(goto_functions, ui_message_handler);
     }
 
+    // remove skips such that trivial GOTOs are deleted and not considered
+    // for coverage annotation:
+    remove_skip(goto_functions);
+
     // instrument cover goals
     if(cmdline.isset("cover"))
     {
@@ -870,7 +926,7 @@ bool cbmc_parse_optionst::process_goto_program(
         full_slicer(goto_functions, ns);
     }
 
-    // remove skips
+    // remove any skips introduced since coverage instrumentation
     remove_skip(goto_functions);
     goto_functions.update();
   }
@@ -1018,14 +1074,14 @@ void cbmc_parse_optionst::help()
     "Java Bytecode frontend options:\n"
     " --classpath dir/jar          set the classpath\n"
     " --main-class class-name      set the name of the main class\n"
-    // NOLINTNEXTLINE(whitespace/line_length)
-    " --java-max-vla-length        limit the length of user-code-created arrays\n"
-    // NOLINTNEXTLINE(whitespace/line_length)
-    " --java-cp-include-files      regexp or JSON list of files to load (with '@' prefix)\n"
+    JAVA_BYTECODE_LANGUAGE_OPTIONS_HELP
+    // This one is handled by cbmc_parse_options not by the Java frontend,
+    // hence its presence here:
     " --java-unwind-enum-static    try to unwind loops in static initialization of enums\n"
     "\n"
     "Semantic transformations:\n"
-    " --nondet-static              add nondeterministic initialization of variables with static lifetime\n" // NOLINT(*)
+    // NOLINTNEXTLINE(whitespace/line_length)
+    " --nondet-static              add nondeterministic initialization of variables with static lifetime\n"
     "\n"
     "BMC options:\n"
     " --program-only               only show program expression\n"
@@ -1042,6 +1098,7 @@ void cbmc_parse_optionst::help()
     " --graphml-witness filename   write the witness in GraphML format to filename\n" // NOLINT(*)
     "\n"
     "Backend options:\n"
+    " --object-bits n              number of bits used for object addresses\n"
     " --dimacs                     generate CNF in DIMACS format\n"
     " --beautify                   beautify the counterexample (greedy heuristic)\n" // NOLINT(*)
     " --localize-faults            localize faults (experimental)\n"
@@ -1053,6 +1110,10 @@ void cbmc_parse_optionst::help()
     " --yices                      use Yices\n"
     " --z3                         use Z3\n"
     " --refine                     use refinement procedure (experimental)\n"
+    " --refine-strings             use string refinement (experimental)\n"
+    " --string-non-empty           add constraint that strings are non empty (experimental)\n" // NOLINT(*)
+    " --string-printable           add constraint that strings are printable (experimental)\n" // NOLINT(*)
+    " --string-max-length          add constraint on the length of strings (experimental)\n" // NOLINT(*)
     " --outfile filename           output formula to given file\n"
     " --arrays-uf-never            never turn arrays into uninterpreted functions\n" // NOLINT(*)
     " --arrays-uf-always           always turn arrays into uninterpreted functions\n" // NOLINT(*)
diff --git a/src/cbmc/cbmc_parse_options.h b/src/cbmc/cbmc_parse_options.h
index 4d8e6753476..ef91683ee0e 100644
--- a/src/cbmc/cbmc_parse_options.h
+++ b/src/cbmc/cbmc_parse_options.h
@@ -19,6 +19,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <analyses/goto_check.h>
 
+#include <java_bytecode/java_bytecode_language.h>
+
 #include "xml_interface.h"
 
 class bmct;
@@ -31,6 +33,7 @@ class optionst;
   "(debug-level):(no-propagation)(no-simplify-if)" \
   "(document-subgoals)(outfile):(test-preprocessor)" \
   "D:I:(c89)(c99)(c11)(cpp89)(cpp99)(cpp11)" \
+  "(object-bits):" \
   "(classpath):(cp):(main-class):" \
   "(depth):(partial-loops)(no-unwinding-assertions)(unwinding-assertions)" \
   OPT_GOTO_CHECK \
@@ -41,6 +44,10 @@ class optionst;
   "(no-sat-preprocessor)" \
   "(no-pretty-names)(beautify)" \
   "(dimacs)(refine)(max-node-refinement):(refine-arrays)(refine-arithmetic)"\
+  "(refine-strings)" \
+  "(string-non-empty)" \
+  "(string-printable)" \
+  "(string-max-length):" \
   "(aig)(16)(32)(64)(LP64)(ILP64)(LLP64)(ILP32)(LP32)" \
   "(little-endian)(big-endian)" \
   "(show-goto-functions)(show-loops)" \
@@ -59,10 +66,9 @@ class optionst;
   "(string-abstraction)(no-arch)(arch):" \
   "(round-to-nearest)(round-to-plus-inf)(round-to-minus-inf)(round-to-zero)" \
   "(graphml-witness):" \
-  "(java-max-vla-length):(java-unwind-enum-static)" \
-  "(java-cp-include-files):" \
+  JAVA_BYTECODE_LANGUAGE_OPTIONS \
+  "(java-unwind-enum-static)" \
   "(localize-faults)(localize-faults-method):" \
-  "(lazy-methods)" \
   "(fixedbv)(floatbv)(all-claims)(all-properties)" // legacy, and will eventually disappear // NOLINT(whitespace/line_length)
 
 class cbmc_parse_optionst:
diff --git a/src/cbmc/cbmc_solvers.cpp b/src/cbmc/cbmc_solvers.cpp
index d3198249558..d98b8b3dcca 100644
--- a/src/cbmc/cbmc_solvers.cpp
+++ b/src/cbmc/cbmc_solvers.cpp
@@ -11,14 +11,16 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "cbmc_solvers.h"
 
-#include <memory>
-#include <iostream>
 #include <fstream>
+#include <iostream>
+#include <memory>
 
 #include <util/unicode.h>
+#include <util/make_unique.h>
 
 #include <solvers/sat/satcheck.h>
 #include <solvers/refinement/bv_refinement.h>
+#include <solvers/refinement/string_refinement.h>
 #include <solvers/smt1/smt1_dec.h>
 #include <solvers/smt2/smt2_dec.h>
 #include <solvers/cvc/cvc_dec.h>
@@ -86,81 +88,111 @@ smt2_dect::solvert cbmc_solverst::get_smt2_solver_type() const
   return s;
 }
 
-/// Get the default decision procedure
-cbmc_solverst::solvert* cbmc_solverst::get_default()
+std::unique_ptr<cbmc_solverst::solvert> cbmc_solverst::get_default()
 {
-  solvert *solver=new solvert;
+  auto solver=util_make_unique<solvert>();
 
   if(options.get_bool_option("beautify") ||
      !options.get_bool_option("sat-preprocessor")) // no simplifier
   {
     // simplifier won't work with beautification
-    solver->set_prop(new satcheck_no_simplifiert());
+    solver->set_prop(util_make_unique<satcheck_no_simplifiert>());
   }
   else // with simplifier
   {
-    solver->set_prop(new satcheckt());
+    solver->set_prop(util_make_unique<satcheckt>());
   }
 
   solver->prop().set_message_handler(get_message_handler());
 
-  bv_cbmct *bv_cbmc=new bv_cbmct(ns, solver->prop());
+  auto bv_cbmc=util_make_unique<bv_cbmct>(ns, solver->prop());
 
   if(options.get_option("arrays-uf")=="never")
     bv_cbmc->unbounded_array=bv_cbmct::unbounded_arrayt::U_NONE;
   else if(options.get_option("arrays-uf")=="always")
     bv_cbmc->unbounded_array=bv_cbmct::unbounded_arrayt::U_ALL;
 
-  solver->set_prop_conv(bv_cbmc);
+  solver->set_prop_conv(std::move(bv_cbmc));
 
   return solver;
 }
 
-cbmc_solverst::solvert* cbmc_solverst::get_dimacs()
+std::unique_ptr<cbmc_solverst::solvert> cbmc_solverst::get_dimacs()
 {
   no_beautification();
   no_incremental_check();
 
-  dimacs_cnft *prop=new dimacs_cnft();
+  auto prop=util_make_unique<dimacs_cnft>();
   prop->set_message_handler(get_message_handler());
 
   std::string filename=options.get_option("outfile");
 
-  return new solvert(new cbmc_dimacst(ns, *prop, filename), prop);
+  auto cbmc_dimacs=util_make_unique<cbmc_dimacst>(ns, *prop, filename);
+  return util_make_unique<solvert>(std::move(cbmc_dimacs), std::move(prop));
 }
 
-cbmc_solverst::solvert* cbmc_solverst::get_bv_refinement()
+std::unique_ptr<cbmc_solverst::solvert> cbmc_solverst::get_bv_refinement()
 {
-  propt *prop;
-
-  // We offer the option to disable the SAT preprocessor
-  if(options.get_bool_option("sat-preprocessor"))
+  std::unique_ptr<propt> prop=[this]() -> std::unique_ptr<propt>
   {
-    no_beautification();
-    prop=new satcheckt();
-  }
-  else
-    prop=new satcheck_no_simplifiert();
+    // We offer the option to disable the SAT preprocessor
+    if(options.get_bool_option("sat-preprocessor"))
+    {
+      no_beautification();
+      return util_make_unique<satcheckt>();
+    }
+    return util_make_unique<satcheck_no_simplifiert>();
+  }();
 
   prop->set_message_handler(get_message_handler());
 
-  bv_refinementt *bv_refinement=new bv_refinementt(ns, *prop);
-  bv_refinement->set_ui(ui);
+  bv_refinementt::infot info;
+  info.ns=&ns;
+  info.prop=prop.get();
+  info.ui=ui;
 
   // we allow setting some parameters
-  if(options.get_option("max-node-refinement")!="")
-    bv_refinement->max_node_refinement =
+  if(options.get_bool_option("max-node-refinement"))
+    info.max_node_refinement=
       options.get_unsigned_int_option("max-node-refinement");
 
-  bv_refinement->do_array_refinement =
-    options.get_bool_option("refine-arrays");
-  bv_refinement->do_arithmetic_refinement =
-    options.get_bool_option("refine-arithmetic");
+  info.refine_arrays=options.get_bool_option("refine-arrays");
+  info.refine_arithmetic=options.get_bool_option("refine-arithmetic");
+
+  return util_make_unique<solvert>(
+    util_make_unique<bv_refinementt>(info),
+    std::move(prop));
+}
+
+/// the string refinement adds to the bit vector refinement specifications for
+/// functions from the Java string library
+/// \return a solver for cbmc
+std::unique_ptr<cbmc_solverst::solvert> cbmc_solverst::get_string_refinement()
+{
+  string_refinementt::infot info;
+  info.ns=&ns;
+  auto prop=util_make_unique<satcheck_no_simplifiert>();
+  prop->set_message_handler(get_message_handler());
+  info.prop=prop.get();
+  info.refinement_bound=MAX_NB_REFINEMENT;
+  info.ui=ui;
+  if(options.get_bool_option("string-max-length"))
+    info.string_max_length=options.get_signed_int_option("string-max-length");
+  info.string_non_empty=options.get_bool_option("string-non-empty");
+  info.trace=options.get_bool_option("trace");
+  info.string_printable=options.get_bool_option("string-printable");
+  if(options.get_bool_option("max-node-refinement"))
+    info.max_node_refinement=
+      options.get_unsigned_int_option("max-node-refinement");
+  info.refine_arrays=options.get_bool_option("refine-arrays");
+  info.refine_arithmetic=options.get_bool_option("refine-arithmetic");
 
-  return new solvert(bv_refinement, prop);
+  return util_make_unique<solvert>(
+    util_make_unique<string_refinementt>(info), std::move(prop));
 }
 
-cbmc_solverst::solvert* cbmc_solverst::get_smt1(smt1_dect::solvert solver)
+std::unique_ptr<cbmc_solverst::solvert> cbmc_solverst::get_smt1(
+  smt1_dect::solvert solver)
 {
   no_beautification();
   no_incremental_check();
@@ -175,20 +207,20 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt1(smt1_dect::solvert solver)
       throw 0;
     }
 
-    smt1_dect *smt1_dec=
-      new smt1_dect(
+    auto smt1_dec=
+      util_make_unique<smt1_dect>(
         ns,
         "cbmc",
         "Generated by CBMC " CBMC_VERSION,
         "QF_AUFBV",
         solver);
 
-    return new solvert(smt1_dec);
+    return util_make_unique<solvert>(std::move(smt1_dec));
   }
   else if(filename=="-")
   {
-    smt1_convt *smt1_conv=
-      new smt1_convt(
+    auto smt1_conv=
+      util_make_unique<smt1_convt>(
         ns,
         "cbmc",
         "Generated by CBMC " CBMC_VERSION,
@@ -198,14 +230,14 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt1(smt1_dect::solvert solver)
 
     smt1_conv->set_message_handler(get_message_handler());
 
-    return new solvert(smt1_conv);
+    return util_make_unique<solvert>(std::move(smt1_conv));
   }
   else
   {
     #ifdef _MSC_VER
-    std::ofstream *out=new std::ofstream(widen(filename));
+    auto out=util_make_unique<std::ofstream>(widen(filename));
     #else
-    std::ofstream *out=new std::ofstream(filename);
+    auto out=util_make_unique<std::ofstream>(filename);
     #endif
 
     if(!out)
@@ -214,8 +246,8 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt1(smt1_dect::solvert solver)
       throw 0;
     }
 
-    smt1_convt *smt1_conv=
-      new smt1_convt(
+    auto smt1_conv=
+      util_make_unique<smt1_convt>(
         ns,
         "cbmc",
         "Generated by CBMC " CBMC_VERSION,
@@ -225,11 +257,12 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt1(smt1_dect::solvert solver)
 
     smt1_conv->set_message_handler(get_message_handler());
 
-    return new solvert(smt1_conv, out);
+    return util_make_unique<solvert>(std::move(smt1_conv), std::move(out));
   }
 }
 
-cbmc_solverst::solvert* cbmc_solverst::get_smt2(smt2_dect::solvert solver)
+std::unique_ptr<cbmc_solverst::solvert> cbmc_solverst::get_smt2(
+  smt2_dect::solvert solver)
 {
   no_beautification();
 
@@ -243,8 +276,8 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt2(smt2_dect::solvert solver)
       throw 0;
     }
 
-    smt2_dect *smt2_dec=
-      new smt2_dect(
+    auto smt2_dec=
+      util_make_unique<smt2_dect>(
         ns,
         "cbmc",
         "Generated by CBMC " CBMC_VERSION,
@@ -254,12 +287,12 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt2(smt2_dect::solvert solver)
     if(options.get_bool_option("fpa"))
       smt2_dec->use_FPA_theory=true;
 
-    return new solvert(smt2_dec);
+    return util_make_unique<solvert>(std::move(smt2_dec));
   }
   else if(filename=="-")
   {
-    smt2_convt *smt2_conv=
-      new smt2_convt(
+    auto smt2_conv=
+      util_make_unique<smt2_convt>(
         ns,
         "cbmc",
         "Generated by CBMC " CBMC_VERSION,
@@ -272,14 +305,14 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt2(smt2_dect::solvert solver)
 
     smt2_conv->set_message_handler(get_message_handler());
 
-    return new solvert(smt2_conv);
+    return util_make_unique<solvert>(std::move(smt2_conv));
   }
   else
   {
     #ifdef _MSC_VER
-    std::ofstream *out=new std::ofstream(widen(filename));
+    auto out=util_make_unique<std::ofstream>(widen(filename));
     #else
-    std::ofstream *out=new std::ofstream(filename);
+    auto out=util_make_unique<std::ofstream>(filename);
     #endif
 
     if(!*out)
@@ -288,8 +321,8 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt2(smt2_dect::solvert solver)
       throw 0;
     }
 
-    smt2_convt *smt2_conv=
-      new smt2_convt(
+    auto smt2_conv=
+      util_make_unique<smt2_convt>(
         ns,
         "cbmc",
         "Generated by CBMC " CBMC_VERSION,
@@ -302,7 +335,7 @@ cbmc_solverst::solvert* cbmc_solverst::get_smt2(smt2_dect::solvert solver)
 
     smt2_conv->set_message_handler(get_message_handler());
 
-    return new solvert(smt2_conv, out);
+    return util_make_unique<solvert>(std::move(smt2_conv), std::move(out));
   }
 }
 
diff --git a/src/cbmc/cbmc_solvers.h b/src/cbmc/cbmc_solvers.h
index 1af31cdc03c..02bbb8b5db9 100644
--- a/src/cbmc/cbmc_solvers.h
+++ b/src/cbmc/cbmc_solvers.h
@@ -54,19 +54,19 @@ class cbmc_solverst:public messaget
     {
     }
 
-    explicit solvert(prop_convt *p):prop_conv_ptr(p)
+    explicit solvert(std::unique_ptr<prop_convt> p):prop_conv_ptr(std::move(p))
     {
     }
 
-    solvert(prop_convt *p1, propt *p2):
-      prop_ptr(p2),
-      prop_conv_ptr(p1)
+    solvert(std::unique_ptr<prop_convt> p1, std::unique_ptr<propt> p2):
+      prop_ptr(std::move(p2)),
+      prop_conv_ptr(std::move(p1))
     {
     }
 
-    solvert(prop_convt *p1, std::ofstream *p2):
-      ofstream_ptr(p2),
-      prop_conv_ptr(p1)
+    solvert(std::unique_ptr<prop_convt> p1, std::unique_ptr<std::ofstream> p2):
+      ofstream_ptr(std::move(p2)),
+      prop_conv_ptr(std::move(p1))
     {
     }
 
@@ -82,19 +82,19 @@ class cbmc_solverst:public messaget
       return *prop_ptr;
     }
 
-    void set_prop_conv(prop_convt *p)
+    void set_prop_conv(std::unique_ptr<prop_convt> p)
     {
-      prop_conv_ptr=std::unique_ptr<prop_convt>(p);
+      prop_conv_ptr=std::move(p);
     }
 
-    void set_prop(propt *p)
+    void set_prop(std::unique_ptr<propt> p)
     {
-      prop_ptr=std::unique_ptr<propt>(p);
+      prop_ptr=std::move(p);
     }
 
-    void set_ofstream(std::ofstream *p)
+    void set_ofstream(std::unique_ptr<std::ofstream> p)
     {
-      ofstream_ptr=std::unique_ptr<std::ofstream>(p);
+      ofstream_ptr=std::move(p);
     }
 
     // the objects are deleted in the opposite order they appear below
@@ -106,20 +106,17 @@ class cbmc_solverst:public messaget
   // returns a solvert object
   virtual std::unique_ptr<solvert> get_solver()
   {
-    solvert *solver;
-
     if(options.get_bool_option("dimacs"))
-      solver = get_dimacs();
-    else if(options.get_bool_option("refine"))
-      solver = get_bv_refinement();
-    else if(options.get_bool_option("smt1"))
-      solver = get_smt1(get_smt1_solver_type());
-    else if(options.get_bool_option("smt2"))
-      solver = get_smt2(get_smt2_solver_type());
-    else
-      solver = get_default();
-
-    return std::unique_ptr<solvert>(solver);
+      return get_dimacs();
+    if(options.get_bool_option("refine"))
+      return get_bv_refinement();
+    else if(options.get_bool_option("refine-strings"))
+      return get_string_refinement();
+    if(options.get_bool_option("smt1"))
+      return get_smt1(get_smt1_solver_type());
+    if(options.get_bool_option("smt2"))
+      return get_smt2(get_smt2_solver_type());
+    return get_default();
   }
 
   virtual ~cbmc_solverst()
@@ -136,11 +133,12 @@ class cbmc_solverst:public messaget
   // use gui format
   language_uit::uit ui;
 
-  solvert *get_default();
-  solvert *get_dimacs();
-  solvert *get_bv_refinement();
-  solvert *get_smt1(smt1_dect::solvert solver);
-  solvert *get_smt2(smt2_dect::solvert solver);
+  std::unique_ptr<solvert> get_default();
+  std::unique_ptr<solvert> get_dimacs();
+  std::unique_ptr<solvert> get_bv_refinement();
+  std::unique_ptr<solvert> get_string_refinement();
+  std::unique_ptr<solvert> get_smt1(smt1_dect::solvert solver);
+  std::unique_ptr<solvert> get_smt2(smt2_dect::solvert solver);
 
   smt1_dect::solvert get_smt1_solver_type() const;
   smt2_dect::solvert get_smt2_solver_type() const;
diff --git a/src/cbmc/counterexample_beautification.cpp b/src/cbmc/counterexample_beautification.cpp
index 3cee2da664b..9522107d922 100644
--- a/src/cbmc/counterexample_beautification.cpp
+++ b/src/cbmc/counterexample_beautification.cpp
@@ -74,7 +74,7 @@ counterexample_beautificationt::get_failed_property(
        prop_conv.l_get(it->cond_literal).is_false())
       return it;
 
-  assert(false);
+  UNREACHABLE;
   return equation.SSA_steps.end();
 }
 
diff --git a/src/cbmc/fault_localization.cpp b/src/cbmc/fault_localization.cpp
index 414c30e5e9a..adcfd3dff20 100644
--- a/src/cbmc/fault_localization.cpp
+++ b/src/cbmc/fault_localization.cpp
@@ -17,11 +17,13 @@ Author: Peter Schrammel
 #include <util/std_expr.h>
 #include <util/message.h>
 #include <util/time_stopping.h>
+#include <util/xml_expr.h>
 
 #include <solvers/prop/minimize.h>
 #include <solvers/prop/literal_expr.h>
 
 #include <goto-symex/build_goto_trace.h>
+#include <goto-programs/xml_goto_trace.h>
 
 #include "counterexample_beautification.h"
 
@@ -71,7 +73,7 @@ fault_localizationt::get_failed_property()
        bmc.prop_conv.l_get(it->cond_literal).is_false())
       return it;
 
-  assert(false);
+  UNREACHABLE;
   return bmc.equation.SSA_steps.end();
 }
 
@@ -144,7 +146,7 @@ void fault_localizationt::run(irep_idt goal_id)
 
   if(goal_id==ID_nil)
     goal_id=failed->source.pc->source_location.get_property_id();
-  lpointst &lpoints = lpoints_map[goal_id];
+  lpointst &lpoints=lpoints_map[goal_id];
 
   // collect lpoints
   collect_guards(lpoints);
@@ -168,7 +170,7 @@ void fault_localizationt::report(irep_idt goal_id)
   if(goal_id==ID_nil)
     goal_id=failed->source.pc->source_location.get_property_id();
 
-  lpointst &lpoints = lpoints_map[goal_id];
+  lpointst &lpoints=lpoints_map[goal_id];
 
   if(lpoints.empty())
   {
@@ -192,6 +194,41 @@ void fault_localizationt::report(irep_idt goal_id)
                    << eom;
 }
 
+xmlt fault_localizationt::report_xml(irep_idt goal_id)
+{
+  xmlt xml_diagnosis("diagnosis");
+  xml_diagnosis.new_element("method").data="linear fault localization";
+
+  if(goal_id==ID_nil)
+    goal_id=failed->source.pc->source_location.get_property_id();
+
+  xml_diagnosis.set_attribute("property", id2string(goal_id));
+
+  const lpointst &lpoints=lpoints_map[goal_id];
+
+  if(lpoints.empty())
+  {
+    xml_diagnosis.new_element("result").data="unable to localize fault";
+    return xml_diagnosis;
+  }
+
+  debug() << "Fault localization scores:" << eom;
+  const lpointt *max=&lpoints.begin()->second;
+  for(const auto &pair : lpoints)
+  {
+    const auto &value=pair.second;
+    debug() << value.target->source_location
+            << "\n  score: " << value.score << eom;
+    if(max->score<value.score)
+      max=&value;
+  }
+
+  xmlt xml_location=xml(max->target->source_location);
+  xml_diagnosis.new_element("result").new_element().swap(xml_location);
+
+  return xml_diagnosis;
+}
+
 safety_checkert::resultt fault_localizationt::operator()()
 {
   if(options.get_bool_option("stop-on-fail"))
@@ -250,8 +287,27 @@ safety_checkert::resultt fault_localizationt::stop_on_fail()
 
     // localize faults
     run(ID_nil);
-    status() << "\n** Most likely fault location:" << eom;
-    report(ID_nil);
+
+    switch(bmc.ui)
+    {
+    case ui_message_handlert::uit::PLAIN:
+    {
+      status() << "\n** Most likely fault location:" << eom;
+      report(ID_nil);
+      break;
+    }
+    case ui_message_handlert::uit::XML_UI:
+    {
+      xmlt dest("fault-localization");
+      xmlt xml_diagnosis=report_xml(ID_nil);
+      dest.new_element().swap(xml_diagnosis);
+      status() << preformatted_output << dest << eom;
+      break;
+    }
+    case ui_message_handlert::uit::JSON_UI:
+      // not implemented
+      break;
+    }
 
     bmc.report_failure();
     return safety_checkert::resultt::UNSAFE;
@@ -266,27 +322,27 @@ safety_checkert::resultt fault_localizationt::stop_on_fail()
 void fault_localizationt::goal_covered(
   const cover_goalst::goalt &)
 {
-  for(auto &g : goal_map)
+  for(auto &goal_pair : goal_map)
   {
     // failed already?
-    if(g.second.status==goalt::statust::FAILURE)
+    if(goal_pair.second.status==goalt::statust::FAILURE)
       continue;
 
     // check whether failed
-    for(auto &c : g.second.instances)
+    for(auto &inst : goal_pair.second.instances)
     {
-      literalt cond=c->cond_literal;
+      literalt cond=inst->cond_literal;
 
       if(solver.l_get(cond).is_false())
       {
-        g.second.status=goalt::statust::FAILURE;
-        symex_target_equationt::SSA_stepst::iterator next=c;
+        goal_pair.second.status=goalt::statust::FAILURE;
+        symex_target_equationt::SSA_stepst::iterator next=inst;
         next++; // include the assertion
-        build_goto_trace(bmc.equation, next, solver, bmc.ns,
-                         g.second.goto_trace);
+        build_goto_trace(
+          bmc.equation, next, solver, bmc.ns, goal_pair.second.goto_trace);
 
         // localize faults
-        run(g.first);
+        run(goal_pair.first);
 
         break;
       }
@@ -305,17 +361,29 @@ void fault_localizationt::report(
     if(cover_goals.number_covered()>0)
     {
       status() << "\n** Most likely fault location:" << eom;
-      for(auto &g : goal_map)
+      for(auto &goal_pair : goal_map)
       {
-        if(g.second.status!=goalt::statust::FAILURE)
+        if(goal_pair.second.status!=goalt::statust::FAILURE)
           continue;
-        report(g.first);
+        report(goal_pair.first);
       }
     }
     break;
   case ui_message_handlert::uit::XML_UI:
+    {
+      xmlt dest("fault-localization");
+      for(auto &goal_pair : goal_map)
+      {
+        if(goal_pair.second.status!=goalt::statust::FAILURE)
+          continue;
+        xmlt xml_diagnosis=report_xml(goal_pair.first);
+        dest.new_element().swap(xml_diagnosis);
+      }
+      status() << preformatted_output << dest << eom;
+    }
     break;
   case ui_message_handlert::uit::JSON_UI:
+    // not implemented
     break;
   }
 }
diff --git a/src/cbmc/fault_localization.h b/src/cbmc/fault_localization.h
index 0c3ec090153..008bb819b1e 100644
--- a/src/cbmc/fault_localization.h
+++ b/src/cbmc/fault_localization.h
@@ -90,6 +90,8 @@ class fault_localizationt:
 
   void report(irep_idt goal_id);
 
+  xmlt report_xml(irep_idt goal_id);
+
   // override bmc_all_propertiest
   virtual void report(const cover_goalst &cover_goals);
 
diff --git a/src/cbmc/symex_coverage.cpp b/src/cbmc/symex_coverage.cpp
index f9ac9cc207d..dc9fef60567 100644
--- a/src/cbmc/symex_coverage.cpp
+++ b/src/cbmc/symex_coverage.cpp
@@ -247,7 +247,7 @@ void goto_program_coverage_recordt::compute_coverage_lines(
       branches_total+=2;
       if(!entry.first->second.conditions.insert(
           {it, coverage_conditiont()}).second)
-        assert(false);
+        UNREACHABLE;
     }
 
     symex_coveraget::coveraget::const_iterator c_entry=
diff --git a/src/cbmc/version.h b/src/cbmc/version.h
index 58bdccf0018..535f7027b8c 100644
--- a/src/cbmc/version.h
+++ b/src/cbmc/version.h
@@ -1,3 +1,11 @@
+/*******************************************************************\
+
+Module: Bounded Model Checking for ANSI-C + HDL
+
+Author: Daniel Kroening, kroening@kroening.com
+
+\*******************************************************************/
+
 #ifndef CPROVER_CBMC_VERSION_H
 #define CPROVER_CBMC_VERSION_H
 
diff --git a/src/clobber/clobber_main.cpp b/src/clobber/clobber_main.cpp
index e63a9d63e49..c52099efb6d 100644
--- a/src/clobber/clobber_main.cpp
+++ b/src/clobber/clobber_main.cpp
@@ -16,14 +16,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
-  clobber_parse_optionst parse_options(argc, argv);
-  return parse_options.main();
-}
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
+#endif
   clobber_parse_optionst parse_options(argc, argv);
   return parse_options.main();
 }
-#endif
diff --git a/src/clobber/clobber_parse_options.cpp b/src/clobber/clobber_parse_options.cpp
index 8c2b2dc1f50..66fc8fb6896 100644
--- a/src/clobber/clobber_parse_options.cpp
+++ b/src/clobber/clobber_parse_options.cpp
@@ -209,8 +209,6 @@ bool clobber_parse_optionst::get_goto_program(
            symbol_table, goto_functions, get_message_handler()))
         return true;
 
-      config.set_from_symbol_table(symbol_table);
-
       if(cmdline.isset("show-symbol-table"))
       {
         show_symbol_table();
@@ -248,7 +246,8 @@ bool clobber_parse_optionst::get_goto_program(
         return true;
       }
 
-      languaget *language=get_language_from_filename(filename);
+      std::unique_ptr<languaget> language=get_language_from_filename(filename);
+      language->get_language_options(cmdline);
 
       if(language==nullptr)
       {
@@ -434,7 +433,7 @@ void clobber_parse_optionst::report_success()
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -459,7 +458,7 @@ void clobber_parse_optionst::show_counterexample(
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -482,7 +481,7 @@ void clobber_parse_optionst::report_failure()
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -537,6 +536,8 @@ void clobber_parse_optionst::help()
     " --round-to-minus-inf         IEEE floating point rounding mode\n"
     " --round-to-zero              IEEE floating point rounding mode\n"
     "\n"
+    JAVA_BYTECODE_LANGUAGE_OPTIONS_HELP
+    "\n"
     "Program instrumentation options:\n"
     HELP_GOTO_CHECK
     " --show-properties            show the properties\n"
diff --git a/src/clobber/clobber_parse_options.h b/src/clobber/clobber_parse_options.h
index 89faff353f0..5148bc759af 100644
--- a/src/clobber/clobber_parse_options.h
+++ b/src/clobber/clobber_parse_options.h
@@ -20,6 +20,8 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <analyses/goto_check.h>
 #include <goto-programs/show_goto_functions.h>
 
+#include <java_bytecode/java_bytecode_language.h>
+
 class goto_functionst;
 class optionst;
 
@@ -32,7 +34,8 @@ class optionst;
   "(version)" \
   "(string-abstraction)" \
   "(show-locs)(show-vcc)(show-properties)(show-trace)" \
-  "(property):"
+  "(property):" \
+  JAVA_BYTECODE_LANGUAGE_OPTIONS
 
 class clobber_parse_optionst:
   public parse_options_baset,
diff --git a/src/cpp/cpp_constructor.cpp b/src/cpp/cpp_constructor.cpp
index 9be6e8c3f01..e2eeaae1ca6 100644
--- a/src/cpp/cpp_constructor.cpp
+++ b/src/cpp/cpp_constructor.cpp
@@ -18,6 +18,7 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 
 #include "cpp_util.h"
 
+/// \param source_location: source location for generated code
 /// \param object: non-typechecked object
 /// \param operands: non-typechecked operands
 /// \return typechecked code
@@ -182,7 +183,7 @@ codet cpp_typecheckt::cpp_constructor(
   }
   else if(tmp_type.id()==ID_union)
   {
-    assert(0); // Todo: union
+    UNREACHABLE; // Todo: union
   }
   else if(tmp_type.id()==ID_struct)
   {
@@ -300,7 +301,7 @@ codet cpp_typecheckt::cpp_constructor(
     }
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   codet nil;
   nil.make_nil();
diff --git a/src/cpp/cpp_convert_type.cpp b/src/cpp/cpp_convert_type.cpp
index b98845964e0..ae5853d07b3 100644
--- a/src/cpp/cpp_convert_type.cpp
+++ b/src/cpp/cpp_convert_type.cpp
@@ -13,11 +13,11 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 
 #include <cassert>
 
-#include <util/config.h>
 #include <util/arith_tools.h>
-#include <util/std_types.h>
-
 #include <util/c_types.h>
+#include <util/config.h>
+#include <util/invariant.h>
+#include <util/std_types.h>
 
 #include "cpp_declaration.h"
 #include "cpp_name.h"
@@ -285,7 +285,7 @@ void cpp_convert_typet::read_function_type(const typet &type)
       throw "ellipsis only allowed as last parameter";
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
 
   // if we just have one parameter of type void, remove it
diff --git a/src/cpp/cpp_declarator_converter.cpp b/src/cpp/cpp_declarator_converter.cpp
index 9d7ee9b3121..e01b7bacaf3 100644
--- a/src/cpp/cpp_declarator_converter.cpp
+++ b/src/cpp/cpp_declarator_converter.cpp
@@ -91,7 +91,7 @@ symbolt &cpp_declarator_convertert::convert(
     // adjust template type
     if(final_type.id()==ID_template)
     {
-      assert(0);
+      UNREACHABLE;
       typet tmp;
       tmp.swap(final_type.subtype());
       final_type.swap(tmp);
diff --git a/src/cpp/cpp_language.cpp b/src/cpp/cpp_language.cpp
index cc84b5fb489..3d6efd64f71 100644
--- a/src/cpp/cpp_language.cpp
+++ b/src/cpp/cpp_language.cpp
@@ -211,9 +211,9 @@ void cpp_languaget::show_parse(
     out << "UNKNOWN: " << item.pretty() << '\n';
 }
 
-languaget *new_cpp_language()
+std::unique_ptr<languaget> new_cpp_language()
 {
-  return new cpp_languaget;
+  return util_make_unique<cpp_languaget>();
 }
 
 bool cpp_languaget::from_expr(
diff --git a/src/cpp/cpp_language.h b/src/cpp/cpp_language.h
index 7e050271300..0cce6c0f7dd 100644
--- a/src/cpp/cpp_language.h
+++ b/src/cpp/cpp_language.h
@@ -12,7 +12,12 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 #ifndef CPROVER_CPP_CPP_LANGUAGE_H
 #define CPROVER_CPP_CPP_LANGUAGE_H
 
+/*! \defgroup gr_cpp C++ front-end */
+
+#include <memory>
+
 #include <util/language.h>
+#include <util/make_unique.h> // unique_ptr
 
 #include "cpp_parse_tree.h"
 
@@ -75,8 +80,8 @@ class cpp_languaget:public languaget
     exprt &expr,
     const namespacet &ns) override;
 
-  languaget *new_language() override
-  { return new cpp_languaget; }
+  std::unique_ptr<languaget> new_language() override
+  { return util_make_unique<cpp_languaget>(); }
 
   std::string id() const override { return "cpp"; }
   std::string description() const override { return "C++"; }
@@ -96,6 +101,6 @@ class cpp_languaget:public languaget
   }
 };
 
-languaget *new_cpp_language();
+std::unique_ptr<languaget> new_cpp_language();
 
 #endif // CPROVER_CPP_CPP_LANGUAGE_H
diff --git a/src/cpp/cpp_scope.cpp b/src/cpp/cpp_scope.cpp
index c3849384d67..1521472ccd3 100644
--- a/src/cpp/cpp_scope.cpp
+++ b/src/cpp/cpp_scope.cpp
@@ -20,7 +20,7 @@ std::ostream &operator << (std::ostream &out, cpp_scopet::lookup_kindt kind)
   case cpp_scopet::QUALIFIED: return out << "QUALIFIED";
   case cpp_scopet::SCOPE_ONLY: return out << "SCOPE_ONLY";
   case cpp_scopet::RECURSIVE: return out << "RECURSIVE";
-  default: assert(false);
+  default: UNREACHABLE;
   }
 
   return out;
diff --git a/src/cpp/cpp_typecheck.cpp b/src/cpp/cpp_typecheck.cpp
index e87efb885fb..b1be4281d3b 100644
--- a/src/cpp/cpp_typecheck.cpp
+++ b/src/cpp/cpp_typecheck.cpp
@@ -250,7 +250,7 @@ void cpp_typecheckt::do_not_typechecked()
           cont=true;
         }
         else
-          assert(0); // Don't know what to do!
+          UNREACHABLE; // Don't know what to do!
       }
     }
   }
diff --git a/src/cpp/cpp_typecheck.h b/src/cpp/cpp_typecheck.h
index 5c0a6afe285..29a2a7e0efc 100644
--- a/src/cpp/cpp_typecheck.h
+++ b/src/cpp/cpp_typecheck.h
@@ -380,7 +380,7 @@ class cpp_typecheckt:public c_typecheck_baset
 
   void put_compound_into_scope(const struct_union_typet::componentt &component);
   void typecheck_compound_body(symbolt &symbol);
-  void typecheck_compound_body(struct_union_typet &type) { assert(false); }
+  void typecheck_compound_body(struct_union_typet &type) { UNREACHABLE; }
   void typecheck_enum_body(symbolt &symbol);
   void typecheck_method_bodies(method_bodiest &);
   void typecheck_compound_bases(struct_typet &type);
diff --git a/src/cpp/cpp_typecheck_bases.cpp b/src/cpp/cpp_typecheck_bases.cpp
index c076d1e131b..26d2efb210e 100644
--- a/src/cpp/cpp_typecheck_bases.cpp
+++ b/src/cpp/cpp_typecheck_bases.cpp
@@ -209,7 +209,7 @@ void cpp_typecheckt::add_base_components(
         component.set_access(ID_private);
     }
     else
-      assert(false);
+      UNREACHABLE;
 
     // put into scope
   }
diff --git a/src/cpp/cpp_typecheck_conversions.cpp b/src/cpp/cpp_typecheck_conversions.cpp
index f2c5d04f36f..e3d314f44aa 100644
--- a/src/cpp/cpp_typecheck_conversions.cpp
+++ b/src/cpp/cpp_typecheck_conversions.cpp
@@ -1750,7 +1750,7 @@ bool cpp_typecheckt::dynamic_typecast(
     {
       if(!e.get_bool(ID_C_lvalue))
         return false;
-      assert(0); // currently not supported
+      UNREACHABLE; // currently not supported
     }
     else if(follow(type.subtype()).id()==ID_struct)
     {
diff --git a/src/cpp/cpp_typecheck_expr.cpp b/src/cpp/cpp_typecheck_expr.cpp
index 88b26461482..cac26bd5dc3 100644
--- a/src/cpp/cpp_typecheck_expr.cpp
+++ b/src/cpp/cpp_typecheck_expr.cpp
@@ -1021,7 +1021,7 @@ void cpp_typecheckt::typecheck_expr_delete(exprt &expr)
   {
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   typet pointer_type=follow(expr.op0().type());
 
@@ -1065,7 +1065,7 @@ void cpp_typecheckt::typecheck_expr_typecast(exprt &expr)
   // should not be called
   #if 0
   std::cout << "E: " << expr.pretty() << '\n';
-  assert(0);
+  UNREACHABLE;
   #endif
 }
 
@@ -1392,7 +1392,7 @@ void cpp_typecheckt::typecheck_cast_expr(exprt &expr)
     }
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   expr.swap(new_expr);
 }
diff --git a/src/cpp/cpp_typecheck_initializer.cpp b/src/cpp/cpp_typecheck_initializer.cpp
index e492a170cbf..7795b71e4c0 100644
--- a/src/cpp/cpp_typecheck_initializer.cpp
+++ b/src/cpp/cpp_typecheck_initializer.cpp
@@ -121,7 +121,7 @@ void cpp_typecheckt::convert_initializer(symbolt &symbol)
         symbol.value.type().add("to-member") = resolved_expr.op0().type();
       }
       else
-        assert(false);
+        UNREACHABLE;
 
       if(symbol.type != symbol.value.type())
       {
diff --git a/src/cpp/cpp_typecheck_resolve.cpp b/src/cpp/cpp_typecheck_resolve.cpp
index 0b49853f5fd..c323794f10b 100644
--- a/src/cpp/cpp_typecheck_resolve.cpp
+++ b/src/cpp/cpp_typecheck_resolve.cpp
@@ -405,7 +405,7 @@ void cpp_typecheck_resolvet::filter(
       break;
 
     default:
-      assert(false);
+      UNREACHABLE;
     }
 
     if(match)
@@ -2078,7 +2078,7 @@ void cpp_typecheck_resolvet::apply_template_args(
 
   // We never try 'unassigned' template arguments.
   if(template_args_tc.has_unassigned())
-    assert(false);
+    UNREACHABLE;
 
   // a template is always a declaration
   const cpp_declarationt &cpp_declaration=
diff --git a/src/cpp/parse.cpp b/src/cpp/parse.cpp
index 494f9e48ff5..bcdc444de36 100644
--- a/src/cpp/parse.cpp
+++ b/src/cpp/parse.cpp
@@ -1026,7 +1026,7 @@ bool Parser::rTemplateDecl(cpp_declarationt &decl)
     break;
 
    default:
-    assert(0);
+    UNREACHABLE;
     break;
   }
 
@@ -1941,7 +1941,7 @@ bool Parser::optMemberSpec(cpp_member_spect &member_spec)
     case TOK_VIRTUAL:  member_spec.set_virtual(true); break;
     case TOK_FRIEND:   member_spec.set_friend(true); break;
     case TOK_EXPLICIT: member_spec.set_explicit(true); break;
-    default: assert(false);
+    default: UNREACHABLE;
     }
 
     t=lex.LookAhead(0);
@@ -1978,7 +1978,7 @@ bool Parser::optStorageSpec(cpp_storage_spect &storage_spec)
     case TOK_MUTABLE: storage_spec.set_mutable(); break;
     case TOK_GCC_ASM: storage_spec.set_asm(); break;
     case TOK_THREAD_LOCAL: storage_spec.set_thread_local(); break;
-    default: assert(false);
+    default: UNREACHABLE;
     }
 
     set_location(storage_spec, tk);
@@ -2048,7 +2048,7 @@ bool Parser::optCvQualify(typet &cv)
         break;
 
       default:
-        assert(false);
+        UNREACHABLE;
         break;
       }
     }
@@ -4205,7 +4205,7 @@ bool Parser::rClassSpec(typet &spec)
   else if(t==TOK_UNION)
     spec=typet(ID_union);
   else
-    assert(false);
+    UNREACHABLE;
 
   set_location(spec, tk);
 
@@ -4314,7 +4314,7 @@ bool Parser::rBaseSpecifiers(irept &bases)
         break;
 
        default:
-        assert(0);
+        UNREACHABLE;
       }
 
       t=lex.LookAhead(0);
@@ -4438,7 +4438,7 @@ bool Parser::rClassMember(cpp_itemt &member)
       break;
 
     default:
-      assert(0);
+      UNREACHABLE;
     }
 
     set_location(member, tk1);
@@ -5487,7 +5487,7 @@ bool Parser::rUnaryExpr(exprt &exp)
       break;
 
     default:
-      assert(0);
+      UNREACHABLE;
     }
 
     exp.move_to_operands(right);
@@ -6393,7 +6393,7 @@ bool Parser::rTypePredicate(exprt &expr)
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 
   return true;
diff --git a/src/cpp/template_map.cpp b/src/cpp/template_map.cpp
index 4df80e3a089..16949d7aaa7 100644
--- a/src/cpp/template_map.cpp
+++ b/src/cpp/template_map.cpp
@@ -13,6 +13,8 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 
 #include <ostream>
 
+#include <util/invariant.h>
+
 void template_mapt::apply(typet &type) const
 {
   if(type.id()==ID_array)
@@ -190,7 +192,7 @@ void template_mapt::set(
   if(parameter.id()==ID_type)
   {
     if(parameter.id()!=ID_type)
-      assert(false); // typechecked before!
+      UNREACHABLE; // typechecked before!
 
     typet tmp=value.type();
 
@@ -202,7 +204,7 @@ void template_mapt::set(
     // must be non-type
 
     if(value.id()==ID_type)
-      assert(false); // typechecked before!
+      UNREACHABLE; // typechecked before!
 
     irep_idt identifier=parameter.get(ID_identifier);
     expr_map[identifier]=value;
diff --git a/src/doxyfile b/src/doxyfile
index f339f070eec..22fe04986b9 100644
--- a/src/doxyfile
+++ b/src/doxyfile
@@ -1474,7 +1474,7 @@ FORMULA_TRANSPARENT    = YES
 # The default value is: NO.
 # This tag requires that the tag GENERATE_HTML is set to YES.
 
-USE_MATHJAX            = NO
+USE_MATHJAX            = YES
 
 # When MathJax is enabled you can set the default output format to be used for
 # the MathJax output. See the MathJax site (see:
diff --git a/src/goto-analyzer/goto_analyzer_main.cpp b/src/goto-analyzer/goto_analyzer_main.cpp
index 8e367dd7ebc..f2192925ab4 100644
--- a/src/goto-analyzer/goto_analyzer_main.cpp
+++ b/src/goto-analyzer/goto_analyzer_main.cpp
@@ -16,7 +16,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
diff --git a/src/goto-analyzer/goto_analyzer_parse_options.cpp b/src/goto-analyzer/goto_analyzer_parse_options.cpp
index 91e7694aba4..66d31053220 100644
--- a/src/goto-analyzer/goto_analyzer_parse_options.cpp
+++ b/src/goto-analyzer/goto_analyzer_parse_options.cpp
@@ -356,6 +356,7 @@ bool goto_analyzer_parse_optionst::process_goto_program(
     // Java virtual functions -> explicit dispatch tables:
     remove_virtual_functions(goto_model);
     // remove Java throw and catch
+    // This introduces instanceof, so order is important:
     remove_exceptions(goto_model);
     // remove rtti
     remove_instanceof(goto_model);
@@ -492,6 +493,7 @@ void goto_analyzer_parse_optionst::help()
     "Java Bytecode frontend options:\n"
     " --classpath dir/jar          set the classpath\n"
     " --main-class class-name      set the name of the main class\n"
+    JAVA_BYTECODE_LANGUAGE_OPTIONS_HELP
     "\n"
     "Program representations:\n"
     " --show-parse-tree            show parse tree\n"
diff --git a/src/goto-analyzer/goto_analyzer_parse_options.h b/src/goto-analyzer/goto_analyzer_parse_options.h
index 30cf150fc2a..5d61256b1f2 100644
--- a/src/goto-analyzer/goto_analyzer_parse_options.h
+++ b/src/goto-analyzer/goto_analyzer_parse_options.h
@@ -22,6 +22,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <analyses/goto_check.h>
 
+#include <java_bytecode/java_bytecode_language.h>
+
 class bmct;
 class goto_functionst;
 class optionst;
@@ -45,7 +47,8 @@ class optionst;
   "(unreachable-instructions)(unreachable-functions)" \
   "(reachable-functions)" \
   "(intervals)(show-intervals)" \
-  "(non-null)(show-non-null)"
+  "(non-null)(show-non-null)" \
+  JAVA_BYTECODE_LANGUAGE_OPTIONS
 
 class goto_analyzer_parse_optionst:
   public parse_options_baset,
diff --git a/src/goto-cc/compile.cpp b/src/goto-cc/compile.cpp
index 0a6e3c4dd58..c54b6b60f6b 100644
--- a/src/goto-cc/compile.cpp
+++ b/src/goto-cc/compile.cpp
@@ -457,7 +457,7 @@ bool compilet::parse(const std::string &file_name)
     return true;
   }
 
-  languaget *languagep;
+  std::unique_ptr<languaget> languagep;
 
   // Using '-x', the type of a file can be overridden;
   // otherwise, it's guessed from the extension.
@@ -478,8 +478,7 @@ bool compilet::parse(const std::string &file_name)
     return true;
   }
 
-  languaget &language=*languagep;
-  language.set_message_handler(get_message_handler());
+  languagep->set_message_handler(get_message_handler());
 
   language_filet language_file;
 
@@ -489,7 +488,7 @@ bool compilet::parse(const std::string &file_name)
 
   language_filet &lf=res.first->second;
   lf.filename=file_name;
-  lf.language=languagep;
+  lf.language=std::move(languagep);
 
   if(mode==PREPROCESS_ONLY)
   {
@@ -511,13 +510,13 @@ bool compilet::parse(const std::string &file_name)
       }
     }
 
-    language.preprocess(infile, file_name, *os);
+    lf.language->preprocess(infile, file_name, *os);
   }
   else
   {
     statistics() << "Parsing: " << file_name << eom;
 
-    if(language.parse(infile, file_name))
+    if(lf.language->parse(infile, file_name))
     {
       if(get_ui()==ui_message_handlert::uit::PLAIN)
         error() << "PARSING ERROR" << eom;
diff --git a/src/goto-cc/goto_cc_cmdline.cpp b/src/goto-cc/goto_cc_cmdline.cpp
index 8691b9db770..ac86ee38551 100644
--- a/src/goto-cc/goto_cc_cmdline.cpp
+++ b/src/goto-cc/goto_cc_cmdline.cpp
@@ -18,6 +18,7 @@ Date:   April 2010
 #include <iostream>
 #include <cstdio>
 
+#include <util/invariant.h>
 #include <util/prefix.h>
 #include <util/tempfile.h>
 
@@ -101,7 +102,7 @@ std::size_t goto_cc_cmdlinet::get_optnr(const std::string &opt_string)
   }
   else
   {
-    assert(false);
+    UNREACHABLE;
     return -1;
   }
 
diff --git a/src/goto-cc/goto_cc_main.cpp b/src/goto-cc/goto_cc_main.cpp
index 8d3e4222194..8d76e897c77 100644
--- a/src/goto-cc/goto_cc_main.cpp
+++ b/src/goto-cc/goto_cc_main.cpp
@@ -45,7 +45,9 @@ int main(int argc, const char **argv)
 #endif
 {
   #ifdef _MSC_VER
-  const char **argv=narrow_argv(argc, argv_wide);
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
   #endif
 
   if(argv==nullptr || argc<1)
diff --git a/src/goto-diff/change_impact.cpp b/src/goto-diff/change_impact.cpp
index 44946ab2f4c..cec37680a53 100644
--- a/src/goto-diff/change_impact.cpp
+++ b/src/goto-diff/change_impact.cpp
@@ -591,7 +591,7 @@ void change_impactt::output_change_impact(
     else if(mod_flags&DEL_CTRL_DEP)
       prefix='c';
     else
-      assert(false);
+      UNREACHABLE;
 
     output_instruction(prefix, goto_program, ns, function, target);
   }
@@ -653,12 +653,12 @@ void change_impactt::output_change_impact(
       else if(old_mod_flags&DEL_CTRL_DEP)
         prefix='c';
       else
-        assert(false);
+        UNREACHABLE;
 
       ++o_target;
     }
     else if(mod_flags&DELETED)
-      assert(false);
+      UNREACHABLE;
     else if(mod_flags&NEW)
       prefix='+';
     else if(mod_flags&NEW_DATA_DEP)
@@ -680,7 +680,7 @@ void change_impactt::output_change_impact(
       ++o_target;
     }
     else
-      assert(false);
+      UNREACHABLE;
 
     output_instruction(prefix, goto_program, n_ns, function, target);
   }
@@ -697,17 +697,17 @@ void change_impactt::output_change_impact(
     // syntactic changes are preferred over data/control-dependence
     // modifications
     if(old_mod_flags==SAME)
-      assert(false);
+      UNREACHABLE;
     else if(old_mod_flags&DELETED)
       prefix='-';
     else if(old_mod_flags&NEW)
-      assert(false);
+      UNREACHABLE;
     else if(old_mod_flags&DEL_DATA_DEP)
       prefix='d';
     else if(old_mod_flags&DEL_CTRL_DEP)
       prefix='c';
     else
-      assert(false);
+      UNREACHABLE;
 
     output_instruction(prefix, goto_program, o_ns, function, o_target);
   }
diff --git a/src/goto-diff/goto_diff_main.cpp b/src/goto-diff/goto_diff_main.cpp
index 8affa718746..b2ba7e211d6 100644
--- a/src/goto-diff/goto_diff_main.cpp
+++ b/src/goto-diff/goto_diff_main.cpp
@@ -26,7 +26,9 @@ extern unsigned long long irep_cmp_ne_cnt;
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
diff --git a/src/goto-diff/goto_diff_parse_options.cpp b/src/goto-diff/goto_diff_parse_options.cpp
index 146fe27eb1c..8fd0f19ca06 100644
--- a/src/goto-diff/goto_diff_parse_options.cpp
+++ b/src/goto-diff/goto_diff_parse_options.cpp
@@ -11,8 +11,8 @@ Author: Peter Schrammel
 
 #include "goto_diff_parse_options.h"
 
-#include <fstream>
 #include <cstdlib> // exit()
+#include <fstream>
 #include <iostream>
 #include <memory>
 
@@ -20,6 +20,7 @@ Author: Peter Schrammel
 #include <util/config.h>
 #include <util/language.h>
 #include <util/options.h>
+#include <util/make_unique.h>
 
 #include <goto-programs/goto_convert_functions.h>
 #include <goto-programs/remove_function_pointers.h>
@@ -318,9 +319,9 @@ int goto_diff_parse_optionst::doit()
     return 0;
   }
 
-  std::unique_ptr<goto_difft> goto_diff;
-  goto_diff = std::unique_ptr<goto_difft>(
-    new syntactic_difft(goto_model1, goto_model2, get_message_handler()));
+  std::unique_ptr<goto_difft> goto_diff=
+    util_make_unique<syntactic_difft>(
+      goto_model1, goto_model2, get_message_handler());
   goto_diff->set_ui(get_ui());
 
   (*goto_diff)();
@@ -347,7 +348,6 @@ int goto_diff_parse_optionst::get_goto_program(
       return 6;
 
     config.set(cmdline);
-    config.set_from_symbol_table(goto_model.symbol_table);
 
     // This one is done.
     cmdline.args.erase(cmdline.args.begin());
diff --git a/src/goto-instrument/accelerate/enumerating_loop_acceleration.h b/src/goto-instrument/accelerate/enumerating_loop_acceleration.h
index f84d3fbd23b..a9d03b7ad69 100644
--- a/src/goto-instrument/accelerate/enumerating_loop_acceleration.h
+++ b/src/goto-instrument/accelerate/enumerating_loop_acceleration.h
@@ -12,6 +12,10 @@ Author: Matt Lewis
 #ifndef CPROVER_GOTO_INSTRUMENT_ACCELERATE_ENUMERATING_LOOP_ACCELERATION_H
 #define CPROVER_GOTO_INSTRUMENT_ACCELERATE_ENUMERATING_LOOP_ACCELERATION_H
 
+#include <memory>
+
+#include <util/make_unique.h>
+
 #include <goto-programs/goto_program.h>
 
 #include <analyses/natural_loops.h>
@@ -39,17 +43,10 @@ class enumerating_loop_accelerationt:public loop_accelerationt
     loop(_loop),
     loop_header(_loop_header),
     polynomial_accelerator(symbol_table, goto_functions),
-    path_limit(_path_limit)
-  {
-    // path_enumerator = new all_paths_enumeratort(goto_program, loop,
-    // loop_header);
-    path_enumerator = new sat_path_enumeratort(symbol_table, goto_functions,
-        goto_program, loop, loop_header);
-  }
-
-  ~enumerating_loop_accelerationt()
+    path_limit(_path_limit),
+    path_enumerator(util_make_unique<sat_path_enumeratort>(
+      symbol_table, goto_functions, goto_program, loop, loop_header))
   {
-    delete path_enumerator;
   }
 
   virtual bool accelerate(path_acceleratort &accelerator);
@@ -63,7 +60,7 @@ class enumerating_loop_accelerationt:public loop_accelerationt
   polynomial_acceleratort polynomial_accelerator;
   int path_limit;
 
-  path_enumeratort *path_enumerator;
+  std::unique_ptr<path_enumeratort> path_enumerator;
 };
 
 #endif // CPROVER_GOTO_INSTRUMENT_ACCELERATE_ENUMERATING_LOOP_ACCELERATION_H
diff --git a/src/goto-instrument/accelerate/scratch_program.h b/src/goto-instrument/accelerate/scratch_program.h
index da860f39e1a..a132f597c3a 100644
--- a/src/goto-instrument/accelerate/scratch_program.h
+++ b/src/goto-instrument/accelerate/scratch_program.h
@@ -12,8 +12,10 @@ Author: Matt Lewis
 #ifndef CPROVER_GOTO_INSTRUMENT_ACCELERATE_SCRATCH_PROGRAM_H
 #define CPROVER_GOTO_INSTRUMENT_ACCELERATE_SCRATCH_PROGRAM_H
 
+#include <memory>
 #include <string>
 
+#include <util/make_unique.h>
 #include <util/symbol_table.h>
 
 #include <goto-programs/goto_program.h>
@@ -38,18 +40,13 @@ class scratch_programt:public goto_programt
     ns(symbol_table),
     equation(ns),
     symex(ns, symbol_table, equation),
-    satcheck(new satcheckt),
+    satcheck(util_make_unique<satcheckt>()),
     satchecker(ns, *satcheck),
     z3(ns, "accelerate", "", "", smt2_dect::solvert::Z3),
     checker(&z3) // checker(&satchecker)
   {
   }
 
-  ~scratch_programt()
-  {
-    delete satcheck;
-  }
-
   void append(goto_programt::instructionst &instructions);
   void append(goto_programt &program);
   void append_path(patht &path);
@@ -79,7 +76,7 @@ class scratch_programt:public goto_programt
   symex_target_equationt equation;
   goto_symext symex;
 
-  propt *satcheck;
+  std::unique_ptr<propt> satcheck;
   bv_pointerst satchecker;
   smt2_dect z3;
   prop_convt *checker;
diff --git a/src/goto-instrument/cover.cpp b/src/goto-instrument/cover.cpp
index 5baadcb9a8f..2c3abfe2108 100644
--- a/src/goto-instrument/cover.cpp
+++ b/src/goto-instrument/cover.cpp
@@ -15,8 +15,15 @@ Date: May 2016
 
 #include <algorithm>
 #include <iterator>
+#include <unordered_set>
 
+#include <util/format_number_range.h>
 #include <util/prefix.h>
+#include <util/string2int.h>
+#include <util/cprover_prefix.h>
+#include <util/config.h>
+
+#include <json/json_parser.h>
 #include <util/message.h>
 
 class basic_blockst
@@ -32,6 +39,11 @@ class basic_blockst
       if(next_is_target || it->is_target())
         block_count++;
 
+      const irep_idt &line=it->source_location.get_line();
+      if(!line.empty())
+        block_line_cover_map[block_count]
+          .insert(unsafe_string2unsigned(id2string(line)));
+
       block_map[it]=block_count;
 
       if(!it->source_location.is_nil() &&
@@ -39,7 +51,27 @@ class basic_blockst
         source_location_map[block_count]=it->source_location;
 
       next_is_target=
+#if 0
+        // Disabled for being too messy
         it->is_goto() || it->is_function_call() || it->is_assume();
+#else
+        it->is_goto() || it->is_function_call();
+#endif
+    }
+
+    // create list of covered lines as CSV string and set as property of source
+    // location of basic block, compress to ranges if applicable
+    format_number_ranget format_lines;
+    for(const auto &cover_set : block_line_cover_map)
+    {
+      INVARIANT(!cover_set.second.empty(),
+        "covered lines set must not be empty");
+      std::vector<unsigned>
+        line_list{cover_set.second.begin(), cover_set.second.end()};
+
+      std::string covered_lines=format_lines(line_list);
+      source_location_map[cover_set.first]
+        .set_basic_block_covered_lines(covered_lines);
     }
   }
 
@@ -51,6 +83,11 @@ class basic_blockst
   typedef std::map<unsigned, source_locationt> source_location_mapt;
   source_location_mapt source_location_map;
 
+  // map block numbers to set of line numbers
+  typedef std::map<unsigned, std::unordered_set<unsigned> >
+    block_line_cover_mapt;
+  block_line_cover_mapt block_line_cover_map;
+
   inline unsigned operator[](goto_programt::const_targett t)
   {
     return block_map[t];
@@ -68,6 +105,145 @@ class basic_blockst
   }
 };
 
+bool coverage_goalst::get_coverage_goals(
+  const std::string &coverage_file,
+  message_handlert &message_handler,
+  coverage_goalst &goals,
+  const irep_idt &mode)
+{
+  jsont json;
+  source_locationt source_location;
+
+  // check coverage file
+  if(parse_json(coverage_file, message_handler, json))
+  {
+    messaget message(message_handler);
+    message.error() << coverage_file << " file is not a valid json file"
+                    << messaget::eom;
+    return true;
+  }
+
+  // make sure that we have an array of elements
+  if(!json.is_array())
+  {
+    messaget message(message_handler);
+    message.error() << "expecting an array in the " <<  coverage_file
+                    << " file, but got "
+                    << json << messaget::eom;
+    return true;
+  }
+
+  // traverse the given JSON file
+  for(const auto &goals_in_json : json.array)
+  {
+    // get the set of goals
+    if(goals_in_json["goals"].is_array())
+    {
+      // store the source location for each existing goal
+      for(const auto &each_goal : goals_in_json["goals"].array)
+      {
+        // ensure minimal requirements for a goal entry
+        PRECONDITION(
+          (!each_goal["goal"].is_null()) ||
+          (!each_goal["sourceLocation"]["bytecodeIndex"].is_null()) ||
+          (!each_goal["sourceLocation"]["file"].is_null() &&
+           !each_goal["sourceLocation"]["function"].is_null() &&
+           !each_goal["sourceLocation"]["line"].is_null()));
+
+        // check whether bytecodeIndex is provided for Java programs
+        if(mode==ID_java &&
+          each_goal["sourceLocation"]["bytecodeIndex"].is_null())
+        {
+          messaget message(message_handler);
+          message.error() << coverage_file
+                          << " file does not contain bytecodeIndex"
+                          << messaget::eom;
+          return true;
+        }
+
+        if(!each_goal["sourceLocation"]["bytecodeIndex"].is_null())
+        {
+          // get and set the bytecodeIndex
+          irep_idt bytecode_index=
+            each_goal["sourceLocation"]["bytecodeIndex"].value;
+          source_location.set_java_bytecode_index(bytecode_index);
+        }
+
+        if(!each_goal["sourceLocation"]["file"].is_null())
+        {
+          // get and set the file
+          irep_idt file=each_goal["sourceLocation"]["file"].value;
+          source_location.set_file(file);
+        }
+
+        if(!each_goal["sourceLocation"]["function"].is_null())
+        {
+          // get and set the function
+          irep_idt function=each_goal["sourceLocation"]["function"].value;
+          source_location.set_function(function);
+        }
+
+        if(!each_goal["sourceLocation"]["line"].is_null())
+        {
+          // get and set the line
+          irep_idt line=each_goal["sourceLocation"]["line"].value;
+          source_location.set_line(line);
+        }
+
+        // store the existing goal
+        goals.add_goal(source_location);
+      }
+    }
+  }
+  return false;
+}
+
+/// store existing goal
+/// \param goal: source location of the existing goal
+void coverage_goalst::add_goal(source_locationt goal)
+{
+  existing_goals[goal]=false;
+}
+
+/// check whether we have an existing goal that is uncovered
+/// \param msg: message to be printed about the uncovered goal
+void coverage_goalst::check_uncovered_goals(messaget &msg)
+{
+  for(const auto &existing_loc : existing_goals)
+  {
+    if(!existing_loc.second)
+    {
+      msg.warning()
+        << "Warning: existing goal in file "
+        << existing_loc.first.get_file()
+        << " line " << existing_loc.first.get_line()
+        << " function " << existing_loc.first.get_function()
+        << " is uncovered" << messaget::eom;
+    }
+  }
+}
+
+/// compare the value of the current goal to the existing ones
+/// \param source_loc: source location of the current goal
+/// \return true : if the current goal exists false : otherwise
+bool coverage_goalst::is_existing_goal(source_locationt source_loc)
+{
+  for(const auto &existing_loc : existing_goals)
+  {
+    if((source_loc.get_file()==existing_loc.first.get_file()) &&
+       (source_loc.get_function()==existing_loc.first.get_function()) &&
+       (source_loc.get_line()==existing_loc.first.get_line()) &&
+       (source_loc.get_java_bytecode_index().empty() ||
+         (source_loc.get_java_bytecode_index()==
+           existing_loc.first.get_java_bytecode_index())))
+    {
+      existing_goals[existing_loc.first]=true;
+      return true;
+    }
+  }
+  return false;
+}
+
 const char *as_string(coverage_criteriont c)
 {
   switch(c)
@@ -299,7 +475,7 @@ std::set<exprt> collect_mcdc_controlling_nested(
   const std::set<exprt> &decisions)
 {
   // To obtain the 1st-level controlling conditions
-  std::set<exprt> controlling = collect_mcdc_controlling(decisions);
+  std::set<exprt> controlling=collect_mcdc_controlling(decisions);
 
   std::set<exprt> result;
   // For each controlling condition, to check if it contains
@@ -490,7 +666,7 @@ void remove_repetition(std::set<exprt> &exprs)
      **/
     for(auto &y : new_exprs)
     {
-      bool iden = true;
+      bool iden=true;
       for(auto &c : conditions)
       {
         std::set<signed> signs1=sign_of_expr(c, x);
@@ -532,7 +708,7 @@ void remove_repetition(std::set<exprt> &exprs)
   }
 
   // update the original ''exprs''
-  exprs = new_exprs;
+  exprs=new_exprs;
 }
 
 /// To evaluate the value of expr ''src'', according to the atomic expr values
@@ -667,7 +843,8 @@ bool is_mcdc_pair(
 
   if(diff_count==1)
     return true;
-  else return false;
+  else
+    return false;
 }
 
 /// To check if we can find the mcdc pair of the input ''expr_set'' regarding
@@ -769,7 +946,8 @@ void minimize_mcdc_controlling(
     {
       controlling=new_controlling;
     }
-    else break;
+    else
+      break;
   }
 }
 
@@ -832,8 +1010,57 @@ std::set<exprt> collect_decisions(const goto_programt::const_targett t)
 void instrument_cover_goals(
   const symbol_tablet &symbol_table,
   goto_programt &goto_program,
-  coverage_criteriont criterion)
+  coverage_criteriont criterion,
+  bool function_only)
 {
+  coverage_goalst goals; // empty already covered goals
+  instrument_cover_goals(
+    symbol_table,
+    goto_program,
+    criterion,
+    goals,
+    function_only,
+    false);
+}
+
+/// Call a goto_program trivial unless it has: * Any declarations * At least 2
+/// branches * At least 5 assignments
+/// \par parameters: Program `goto_program`
+/// \return Returns true if trivial
+bool program_is_trivial(const goto_programt &goto_program)
+{
+  unsigned long count_assignments=0, count_goto=0;
+  forall_goto_program_instructions(i_it, goto_program)
+  {
+    if(i_it->is_goto())
+    {
+      if((++count_goto)>=2)
+        return false;
+    }
+    else if(i_it->is_assign())
+    {
+      if((++count_assignments)>=5)
+        return false;
+    }
+    else if(i_it->is_decl())
+      return false;
+  }
+
+  return true;
+}
+
+void instrument_cover_goals(
+  const symbol_tablet &symbol_table,
+  goto_programt &goto_program,
+  coverage_criteriont criterion,
+  coverage_goalst &goals,
+  bool function_only,
+  bool ignore_trivial)
+{
+  // exclude trivial coverage goals of a goto program
+  if(ignore_trivial && program_is_trivial(goto_program))
+    return;
+
   const namespacet ns(symbol_table);
   basic_blockst basic_blocks(goto_program);
   std::set<unsigned> blocks_done;
@@ -848,21 +1075,30 @@ void instrument_cover_goals(
 
   Forall_goto_program_instructions(i_it, goto_program)
   {
+    std::string curr_function=id2string(i_it->function);
+
+    // if the --cover-function-only flag is set, then we only add coverage
+    // instrumentation for the entry function
+    bool cover_curr_function=
+      !function_only ||
+      curr_function.find(config.main)!=std::string::npos;
+
     switch(criterion)
     {
     case coverage_criteriont::ASSERTION:
       // turn into 'assert(false)' to avoid simplification
-      if(i_it->is_assert())
+      if(i_it->is_assert() && cover_curr_function)
       {
         i_it->guard=false_exprt();
         i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
         i_it->source_location.set_property_class(property_class);
+        i_it->source_location.set_function(i_it->function);
       }
       break;
 
     case coverage_criteriont::COVER:
       // turn __CPROVER_cover(x) into 'assert(!x)'
-      if(i_it->is_function_call())
+      if(i_it->is_function_call() && cover_curr_function)
       {
         const code_function_callt &code_function_call=
           to_code_function_call(i_it->code);
@@ -879,6 +1115,7 @@ void instrument_cover_goals(
           i_it->source_location.set_comment(comment);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(i_it->function);
         }
       }
       else if(i_it->is_assert())
@@ -898,10 +1135,15 @@ void instrument_cover_goals(
           source_locationt source_location=
             basic_blocks.source_location_map[block_nr];
 
-          if(!source_location.get_file().empty() &&
-             !source_location.is_built_in())
+          // check whether the current goal already exists
+          if(!goals.is_existing_goal(source_location) &&
+             !source_location.get_file().empty() &&
+             !source_location.is_built_in() &&
+             cover_curr_function)
           {
-            std::string comment="block "+b;
+            std::string comment=
+              "function "+id2string(i_it->function)+" block "+b;
+            const irep_idt function=i_it->function;
             goto_program.insert_before_swap(i_it);
             i_it->make_assertion(false_exprt());
             i_it->source_location=source_location;
@@ -909,7 +1151,7 @@ void instrument_cover_goals(
             i_it->source_location.set(
               ID_coverage_criterion, coverage_criterion);
             i_it->source_location.set_property_class(property_class);
-
+            i_it->source_location.set_function(function);
             i_it++;
           }
         }
@@ -920,7 +1162,8 @@ void instrument_cover_goals(
       if(i_it->is_assert())
         i_it->make_skip();
 
-      if(i_it==goto_program.instructions.begin())
+      if(i_it==goto_program.instructions.begin() &&
+         cover_curr_function)
       {
         // we want branch coverage to imply 'entry point of function'
         // coverage
@@ -935,9 +1178,10 @@ void instrument_cover_goals(
         t->source_location.set_comment(comment);
         t->source_location.set(ID_coverage_criterion, coverage_criterion);
         t->source_location.set_property_class(property_class);
+        t->source_location.set_function(i_it->function);
       }
 
-      if(i_it->is_goto() && !i_it->guard.is_true() &&
+      if(i_it->is_goto() && !i_it->guard.is_true() && cover_curr_function &&
          !i_it->source_location.is_built_in())
       {
         std::string b=std::to_string(basic_blocks[i_it]);
@@ -948,6 +1192,7 @@ void instrument_cover_goals(
 
         exprt guard=i_it->guard;
         source_locationt source_location=i_it->source_location;
+        source_location.set_function(i_it->function);
 
         goto_program.insert_before_swap(i_it);
         i_it->make_assertion(not_exprt(guard));
@@ -973,7 +1218,7 @@ void instrument_cover_goals(
         i_it->make_skip();
 
       // Conditions are all atomic predicates in the programs.
-      if(!i_it->source_location.is_built_in())
+      if(cover_curr_function && !i_it->source_location.is_built_in())
       {
         const std::set<exprt> conditions=collect_conditions(i_it);
 
@@ -984,12 +1229,14 @@ void instrument_cover_goals(
           const std::string c_string=from_expr(ns, "", c);
 
           const std::string comment_t="condition `"+c_string+"' true";
+          const irep_idt function=i_it->function;
           goto_program.insert_before_swap(i_it);
           i_it->make_assertion(c);
           i_it->source_location=source_location;
           i_it->source_location.set_comment(comment_t);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
 
           const std::string comment_f="condition `"+c_string+"' false";
           goto_program.insert_before_swap(i_it);
@@ -998,6 +1245,7 @@ void instrument_cover_goals(
           i_it->source_location.set_comment(comment_f);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
         }
 
         for(std::size_t i=0; i<conditions.size()*2; i++)
@@ -1010,7 +1258,7 @@ void instrument_cover_goals(
         i_it->make_skip();
 
       // Decisions are maximal Boolean combinations of conditions.
-      if(!i_it->source_location.is_built_in())
+      if(cover_curr_function && !i_it->source_location.is_built_in())
       {
         const std::set<exprt> decisions=collect_decisions(i_it);
 
@@ -1021,12 +1269,14 @@ void instrument_cover_goals(
           const std::string d_string=from_expr(ns, "", d);
 
           const std::string comment_t="decision `"+d_string+"' true";
+          const irep_idt function=i_it->function;
           goto_program.insert_before_swap(i_it);
           i_it->make_assertion(d);
           i_it->source_location=source_location;
           i_it->source_location.set_comment(comment_t);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
 
           const std::string comment_f="decision `"+d_string+"' false";
           goto_program.insert_before_swap(i_it);
@@ -1035,6 +1285,7 @@ void instrument_cover_goals(
           i_it->source_location.set_comment(comment_f);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
         }
 
         for(std::size_t i=0; i<decisions.size()*2; i++)
@@ -1051,15 +1302,18 @@ void instrument_cover_goals(
       // 3. Each condition in a decision takes every possible outcome
       // 4. Each condition in a decision is shown to independently
       //    affect the outcome of the decision.
-      if(!i_it->source_location.is_built_in())
+      if(cover_curr_function && !i_it->source_location.is_built_in())
       {
         const std::set<exprt> conditions=collect_conditions(i_it);
         const std::set<exprt> decisions=collect_decisions(i_it);
 
         std::set<exprt> both;
-        std::set_union(conditions.begin(), conditions.end(),
-                       decisions.begin(), decisions.end(),
-                       inserter(both, both.end()));
+        std::set_union(
+          conditions.begin(),
+          conditions.end(),
+          decisions.begin(),
+          decisions.end(),
+          inserter(both, both.end()));
 
         const source_locationt source_location=i_it->source_location;
 
@@ -1075,6 +1329,7 @@ void instrument_cover_goals(
           std::string p_string=from_expr(ns, "", p);
 
           std::string comment_t=description+" `"+p_string+"' true";
+          const irep_idt function=i_it->function;
           goto_program.insert_before_swap(i_it);
           // i_it->make_assertion(p);
           i_it->make_assertion(not_exprt(p));
@@ -1082,6 +1337,7 @@ void instrument_cover_goals(
           i_it->source_location.set_comment(comment_t);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
 
           std::string comment_f=description+" `"+p_string+"' false";
           goto_program.insert_before_swap(i_it);
@@ -1091,6 +1347,7 @@ void instrument_cover_goals(
           i_it->source_location.set_comment(comment_f);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
         }
 
         std::set<exprt> controlling;
@@ -1108,6 +1365,7 @@ void instrument_cover_goals(
           std::string description=
             "MC/DC independence condition `"+p_string+"'";
 
+          const irep_idt function=i_it->function;
           goto_program.insert_before_swap(i_it);
           i_it->make_assertion(not_exprt(p));
           // i_it->make_assertion(p);
@@ -1115,6 +1373,7 @@ void instrument_cover_goals(
           i_it->source_location.set_comment(description);
           i_it->source_location.set(ID_coverage_criterion, coverage_criterion);
           i_it->source_location.set_property_class(property_class);
+          i_it->source_location.set_function(function);
         }
 
         for(std::size_t i=0; i<both.size()*2+controlling.size(); i++)
@@ -1137,19 +1396,45 @@ void instrument_cover_goals(
 void instrument_cover_goals(
   const symbol_tablet &symbol_table,
   goto_functionst &goto_functions,
-  coverage_criteriont criterion)
+  coverage_criteriont criterion,
+  coverage_goalst &goals,
+  bool function_only,
+  bool ignore_trivial)
 {
   Forall_goto_functions(f_it, goto_functions)
   {
     if(f_it->first==goto_functions.entry_point() ||
-       f_it->first=="__CPROVER_initialize" ||
+       f_it->first==(CPROVER_PREFIX "initialize") ||
        f_it->second.is_hidden())
       continue;
 
-    instrument_cover_goals(symbol_table, f_it->second.body, criterion);
+    instrument_cover_goals(
+      symbol_table,
+      f_it->second.body,
+      criterion,
+      goals,
+      function_only,
+      ignore_trivial);
   }
 }
 
+void instrument_cover_goals(
+  const symbol_tablet &symbol_table,
+  goto_functionst &goto_functions,
+  coverage_criteriont criterion,
+  bool function_only)
+{
+  // empty set of existing goals
+  coverage_goalst goals;
+  instrument_cover_goals(
+    symbol_table,
+    goto_functions,
+    criterion,
+    goals,
+    function_only,
+    false);
+}
+
 bool instrument_cover_goals(
   const cmdlinet &cmdline,
   const symbol_tablet &symbol_table,
@@ -1219,11 +1504,83 @@ bool instrument_cover_goals(
     }
   }
 
+  // check existing test goals
+  coverage_goalst existing_goals;
+  if(cmdline.isset("existing-coverage"))
+  {
+    // get the mode to ensure invariants
+    // (e.g., bytecodeIndex for Java programs)
+    namespacet ns(symbol_table);
+    const irep_idt &mode=ns.lookup(goto_functions.entry_point()).mode;
+
+    msg.status() << "Add existing coverage goals" << messaget::eom;
+    // get file with covered test goals
+    const std::string coverage=cmdline.get_value("existing-coverage");
+    // get a coverage_goalst object
+    if(coverage_goalst::get_coverage_goals(
+       coverage, msgh, existing_goals, mode))
+    {
+      msg.error() << "get_coverage_goals failed" << messaget::eom;
+      return true;
+    }
+  }
+
   msg.status() << "Instrumenting coverage goals" << messaget::eom;
 
   for(const auto &criterion : criteria)
-    instrument_cover_goals(symbol_table, goto_functions, criterion);
+  {
+    instrument_cover_goals(
+      symbol_table,
+      goto_functions,
+      criterion,
+      existing_goals,
+      cmdline.isset("cover-function-only"),
+      cmdline.isset("no-trivial-tests"));
+  }
+
+  // check whether all existing goals have been covered
+  msg.status() << "Checking uncovered goals" << messaget::eom;
+  existing_goals.check_uncovered_goals(msg);
+
+  if(cmdline.isset("cover-traces-must-terminate"))
+  {
+    // instrument an additional goal in CPROVER_START. This will rephrase
+    // the reachability problem  by asking BMC to provide a solution that
+    // satisfies a goal while getting to the end of the program-under-test.
+    const auto sf_it=
+      goto_functions.function_map.find(goto_functions.entry_point());
+    if(sf_it==goto_functions.function_map.end())
+    {
+      msg.error() << "cover-traces-must-terminate: invalid entry point ["
+        << goto_functions.entry_point() << "]"
+        << messaget::eom;
+      return true;
+    }
+    auto if_it=sf_it->second.body.instructions.end();
+    while(!if_it->is_function_call())
+      if_it--;
+    if_it++;
+    const std::string &comment=
+      "additional goal to ensure complete trace coverage.";
+    sf_it->second.body.insert_before_swap(if_it);
+    if_it->make_assertion(false_exprt());
+    if_it->source_location.set_comment(comment);
+    if_it->source_location.set_property_class("reachability_constraint");
+    if_it->source_location.set_function(if_it->function);
+  }
 
   goto_functions.update();
   return false;
 }
+
+bool instrument_cover_goals(
+  const cmdlinet &cmdline,
+  goto_modelt &goto_model,
+  message_handlert &message_handler)
+{
+  return instrument_cover_goals(
+    cmdline,
+    goto_model.symbol_table,
+    goto_model.goto_functions,
+    message_handler);
+}
diff --git a/src/goto-instrument/cover.h b/src/goto-instrument/cover.h
index c2dd453b289..47086714737 100644
--- a/src/goto-instrument/cover.h
+++ b/src/goto-instrument/cover.h
@@ -18,26 +18,70 @@ Date: May 2016
 #include <util/cmdline.h>
 
 class message_handlert;
+class messaget;
+
+class coverage_goalst
+{
+public:
+  static bool get_coverage_goals(
+    const std::string &coverage,
+    message_handlert &message_handler,
+    coverage_goalst &goals,
+    const irep_idt &mode);
+  void add_goal(source_locationt goal);
+  bool is_existing_goal(source_locationt source_loc);
+  void check_uncovered_goals(messaget &msg);
+
+private:
+  std::map<source_locationt, bool> existing_goals;
+};
 
 enum class coverage_criteriont
 {
   LOCATION, BRANCH, DECISION, CONDITION,
   PATH, MCDC, ASSERTION, COVER };
 
+bool consider_goals(
+  const goto_programt &,
+  coverage_goalst &);
+
+void instrument_cover_goals(
+  const symbol_tablet &,
+  goto_functionst &,
+  coverage_criteriont,
+  bool function_only=false);
+
+void instrument_cover_goals(
+  const symbol_tablet &,
+  goto_programt &,
+  coverage_criteriont,
+  bool function_only=false);
+
 void instrument_cover_goals(
-  const symbol_tablet &symbol_table,
-  goto_programt &goto_program,
-  coverage_criteriont);
+  const symbol_tablet &,
+  goto_functionst &,
+  coverage_criteriont,
+  coverage_goalst &,
+  bool function_only=false,
+  bool ignore_trivial=false);
 
 void instrument_cover_goals(
-  const symbol_tablet &symbol_table,
-  goto_functionst &goto_functions,
-  coverage_criteriont);
+  const symbol_tablet &,
+  goto_programt &,
+  coverage_criteriont,
+  coverage_goalst &goals,
+  bool function_only=false,
+  bool ignore_trivial=false);
+
+bool instrument_cover_goals(
+  const cmdlinet &,
+  const symbol_tablet &,
+  goto_functionst &,
+  message_handlert &);
 
 bool instrument_cover_goals(
-  const cmdlinet &cmdline,
-  const symbol_tablet &symbol_table,
-  goto_functionst &goto_functions,
-  message_handlert &msgh);
+  const cmdlinet &,
+  goto_modelt &,
+  message_handlert &);
 
 #endif // CPROVER_GOTO_INSTRUMENT_COVER_H
diff --git a/src/goto-instrument/dump_c.cpp b/src/goto-instrument/dump_c.cpp
index 78c06b79ebb..099586d69fe 100644
--- a/src/goto-instrument/dump_c.cpp
+++ b/src/goto-instrument/dump_c.cpp
@@ -148,7 +148,8 @@ void dump_ct::operator()(std::ostream &os)
 
     // we don't want to dump in full all definitions; in particular
     // do not dump anonymous types that are defined in system headers
-    if((!tag_added || symbol.is_type) && ignore(symbol))
+    if((!tag_added || symbol.is_type) &&
+       system_symbols.is_symbol_internal_symbol(symbol, system_headers))
       continue;
 
     bool inserted=symbols_sorted.insert(name_str).second;
@@ -175,7 +176,7 @@ void dump_ct::operator()(std::ostream &os)
         type_id==ID_incomplete_union ||
         type_id==ID_c_enum))
     {
-      if(!ignore(symbol))
+      if(!system_symbols.is_symbol_internal_symbol(symbol, system_headers))
       {
         global_decl_stream << "// " << symbol.name << '\n';
         global_decl_stream << "// " << symbol.location << '\n';
@@ -317,7 +318,7 @@ void dump_ct::convert_compound(
       ns.lookup(to_symbol_type(type).get_identifier());
     DATA_INVARIANT(symbol.is_type, "symbol expected to be type symbol");
 
-    if(!ignore(symbol))
+    if(!system_symbols.is_symbol_internal_symbol(symbol, system_headers))
       convert_compound(symbol.type, unresolved, recursive, os);
   }
   else if(type.id()==ID_c_enum_tag)
@@ -326,7 +327,7 @@ void dump_ct::convert_compound(
       ns.lookup(to_c_enum_tag_type(type).get_identifier());
     DATA_INVARIANT(symbol.is_type, "symbol expected to be type symbol");
 
-    if(!ignore(symbol))
+    if(!system_symbols.is_symbol_internal_symbol(symbol, system_headers))
       convert_compound(symbol.type, unresolved, recursive, os);
   }
   else if(type.id()==ID_array || type.id()==ID_pointer)
@@ -581,266 +582,6 @@ void dump_ct::convert_compound_enum(
   os << ";\n\n";
 }
 
-#define ADD_TO_SYSTEM_LIBRARY(v, header) \
-  for(size_t i=0; i<sizeof(v)/sizeof(char*); ++i) \
-    system_library_map.insert( \
-      std::make_pair(v[i], header))
-
-void dump_ct::init_system_library_map()
-{
-  // ctype.h
-  const char* ctype_syms[]=
-  {
-    "isalnum", "isalpha", "isblank", "iscntrl", "isdigit", "isgraph",
-    "islower", "isprint", "ispunct", "isspace", "isupper", "isxdigit",
-    "tolower", "toupper"
-  };
-  ADD_TO_SYSTEM_LIBRARY(ctype_syms, "ctype.h");
-
-  // fcntl.h
-  const char* fcntl_syms[]=
-  {
-    "creat", "fcntl", "open"
-  };
-  ADD_TO_SYSTEM_LIBRARY(fcntl_syms, "fcntl.h");
-
-  // locale.h
-  const char* locale_syms[]=
-  {
-    "setlocale"
-  };
-  ADD_TO_SYSTEM_LIBRARY(locale_syms, "locale.h");
-
-  // math.h
-  const char* math_syms[]=
-  {
-    "acos", "acosh", "asin", "asinh", "atan", "atan2", "atanh",
-    "cbrt", "ceil", "copysign", "cos", "cosh", "erf", "erfc", "exp",
-    "exp2", "expm1", "fabs", "fdim", "floor", "fma", "fmax", "fmin",
-    "fmod", "fpclassify", "frexp", "hypot", "ilogb", "isfinite",
-    "isinf", "isnan", "isnormal", "j0", "j1", "jn", "ldexp", "lgamma",
-    "llrint", "llround", "log", "log10", "log1p", "log2", "logb",
-    "lrint", "lround", "modf", "nan", "nearbyint", "nextafter", "pow",
-    "remainder", "remquo", "rint", "round", "scalbln", "scalbn",
-    "signbit", "sin", "sinh", "sqrt", "tan", "tanh", "tgamma",
-    "trunc", "y0", "y1", "yn"
-  };
-  ADD_TO_SYSTEM_LIBRARY(math_syms, "math.h");
-
-  // pthread.h
-  const char* pthread_syms[]=
-  {
-    "pthread_cleanup_pop", "pthread_cleanup_push",
-    "pthread_cond_broadcast", "pthread_cond_destroy",
-    "pthread_cond_init", "pthread_cond_signal",
-    "pthread_cond_timedwait", "pthread_cond_wait", "pthread_create",
-    "pthread_detach", "pthread_equal", "pthread_exit",
-    "pthread_getspecific", "pthread_join", "pthread_key_delete",
-    "pthread_mutex_destroy", "pthread_mutex_init",
-    "pthread_mutex_lock", "pthread_mutex_trylock",
-    "pthread_mutex_unlock", "pthread_once", "pthread_rwlock_destroy",
-    "pthread_rwlock_init", "pthread_rwlock_rdlock",
-    "pthread_rwlock_unlock", "pthread_rwlock_wrlock",
-    "pthread_rwlockattr_destroy", "pthread_rwlockattr_getpshared",
-    "pthread_rwlockattr_init", "pthread_rwlockattr_setpshared",
-    "pthread_self", "pthread_setspecific",
-    /* non-public struct types */
-    "tag-__pthread_internal_list", "tag-__pthread_mutex_s",
-    "pthread_mutex_t"
-  };
-  ADD_TO_SYSTEM_LIBRARY(pthread_syms, "pthread.h");
-
-  // setjmp.h
-  const char* setjmp_syms[]=
-  {
-    "_longjmp", "_setjmp", "longjmp", "longjmperror", "setjmp",
-    "siglongjmp", "sigsetjmp"
-  };
-  ADD_TO_SYSTEM_LIBRARY(setjmp_syms, "setjmp.h");
-
-  // stdio.h
-  const char* stdio_syms[]=
-  {
-    "asprintf", "clearerr", "fclose", "fdopen", "feof", "ferror",
-    "fflush", "fgetc", "fgetln", "fgetpos", "fgets", "fgetwc",
-    "fgetws", "fileno", "fopen", "fprintf", "fpurge", "fputc",
-    "fputs", "fputwc", "fputws", "fread", "freopen", "fropen",
-    "fscanf", "fseek", "fsetpos", "ftell", "funopen", "fwide",
-    "fwopen", "fwprintf", "fwrite", "getc", "getchar", "getdelim",
-    "getline", "gets", "getw", "getwc", "getwchar", "mkdtemp",
-    "mkstemp", "mktemp", "perror", "printf", "putc", "putchar",
-    "puts", "putw", "putwc", "putwchar", "remove", "rewind", "scanf",
-    "setbuf", "setbuffer", "setlinebuf", "setvbuf", "snprintf",
-    "sprintf", "sscanf", "swprintf", "sys_errlist",
-    "sys_nerr", "tempnam", "tmpfile", "tmpnam", "ungetc", "ungetwc",
-    "vasprintf", "vfprintf", "vfscanf", "vfwprintf", "vprintf",
-    "vscanf", "vsnprintf", "vsprintf", "vsscanf", "vswprintf",
-    "vwprintf", "wprintf",
-    /* non-public struct types */
-    "tag-__sFILE", "tag-__sbuf", // OS X
-    "tag-_IO_FILE", "tag-_IO_marker", // Linux
-  };
-  ADD_TO_SYSTEM_LIBRARY(stdio_syms, "stdio.h");
-
-  // stdlib.h
-  const char* stdlib_syms[]=
-  {
-    "abort", "abs", "atexit", "atof", "atoi", "atol", "atoll",
-    "bsearch", "calloc", "div", "exit", "free", "getenv", "labs",
-    "ldiv", "llabs", "lldiv", "malloc", "mblen", "mbstowcs", "mbtowc",
-    "qsort", "rand", "realloc", "srand", "strtod", "strtof", "strtol",
-    "strtold", "strtoll", "strtoul", "strtoull", "system", "wcstombs",
-    "wctomb"
-  };
-  ADD_TO_SYSTEM_LIBRARY(stdlib_syms, "stdlib.h");
-
-  // string.h
-  const char* string_syms[]=
-  {
-    "strcat", "strncat", "strchr", "strrchr", "strcmp", "strncmp",
-    "strcpy", "strncpy", "strerror", "strlen", "strpbrk", "strspn",
-    "strcspn", "strstr", "strtok"
-  };
-  ADD_TO_SYSTEM_LIBRARY(string_syms, "string.h");
-
-  // time.h
-  const char* time_syms[]=
-  {
-    "asctime", "asctime_r", "ctime", "ctime_r", "difftime", "gmtime",
-    "gmtime_r", "localtime", "localtime_r", "mktime", "strftime",
-    /* non-public struct types */
-    "tag-timespec", "tag-timeval", "tag-tm"
-  };
-  ADD_TO_SYSTEM_LIBRARY(time_syms, "time.h");
-
-  // unistd.h
-  const char* unistd_syms[]=
-  {
-    "_exit", "access", "alarm", "chdir", "chown", "close", "dup",
-    "dup2", "execl", "execle", "execlp", "execv", "execve", "execvp",
-    "fork", "fpathconf", "getcwd", "getegid", "geteuid", "getgid",
-    "getgroups", "getlogin", "getpgrp", "getpid", "getppid", "getuid",
-    "isatty", "link", "lseek", "pathconf", "pause", "pipe", "read",
-    "rmdir", "setgid", "setpgid", "setsid", "setuid", "sleep",
-    "sysconf", "tcgetpgrp", "tcsetpgrp", "ttyname", "ttyname_r",
-    "unlink", "write"
-  };
-  ADD_TO_SYSTEM_LIBRARY(unistd_syms, "unistd.h");
-
-  // sys/select.h
-  const char* sys_select_syms[]=
-  {
-    "select",
-    /* non-public struct types */
-    "fd_set"
-  };
-  ADD_TO_SYSTEM_LIBRARY(sys_select_syms, "sys/select.h");
-
-  // sys/socket.h
-  const char* sys_socket_syms[]=
-  {
-    "accept", "bind", "connect",
-    /* non-public struct types */
-    "tag-sockaddr"
-  };
-  ADD_TO_SYSTEM_LIBRARY(sys_socket_syms, "sys/socket.h");
-
-  // sys/stat.h
-  const char* sys_stat_syms[]=
-  {
-    "fstat", "lstat", "stat",
-    /* non-public struct types */
-    "tag-stat"
-  };
-  ADD_TO_SYSTEM_LIBRARY(sys_stat_syms, "sys/stat.h");
-
-  /*
-  // sys/types.h
-  const char* sys_types_syms[]=
-  {
-  };
-  ADD_TO_SYSTEM_LIBRARY(sys_types_syms, "sys/types.h");
-  */
-
-  // sys/wait.h
-  const char* sys_wait_syms[]=
-  {
-    "wait", "waitpid"
-  };
-  ADD_TO_SYSTEM_LIBRARY(sys_wait_syms, "sys/wait.h");
-}
-
-/// Ignore selected types as they are covered via system headers
-/// \par parameters: type  input to check whether it should not be dumped
-/// \return true, iff the type should not be printed
-bool dump_ct::ignore(const typet &type)
-{
-  symbolt symbol;
-  symbol.type=type;
-
-  return ignore(symbol);
-}
-
-/// Ignore selected symbols as they are covered via system headers
-/// \par parameters: type  input to check whether it should not be dumped
-/// \return true, iff the symbol should not be printed
-bool dump_ct::ignore(const symbolt &symbol)
-{
-  const std::string &name_str=id2string(symbol.name);
-
-  if(has_prefix(name_str, CPROVER_PREFIX) ||
-     name_str=="__func__" ||
-     name_str=="__FUNCTION__" ||
-     name_str=="__PRETTY_FUNCTION__" ||
-     name_str=="argc'" ||
-     name_str=="argv'" ||
-     name_str=="envp'" ||
-     name_str=="envp_size'")
-    return true;
-
-  if(has_suffix(name_str, "$object"))
-    return true;
-
-  const std::string &file_str=id2string(symbol.location.get_file());
-
-  // don't dump internal GCC builtins
-  if(has_prefix(file_str, "gcc_builtin_headers_") &&
-     has_prefix(name_str, "__builtin_"))
-    return true;
-
-  if(name_str=="__builtin_va_start" ||
-     name_str=="__builtin_va_end" ||
-     symbol.name==ID_gcc_builtin_va_arg)
-  {
-    system_headers.insert("stdarg.h");
-    return true;
-  }
-
-  system_library_mapt::const_iterator it=
-    system_library_map.find(symbol.name);
-
-  if(it!=system_library_map.end())
-  {
-    system_headers.insert(it->second);
-    return true;
-  }
-
-  if(use_all_headers &&
-     has_prefix(file_str, "/usr/include/"))
-  {
-    if(file_str.find("/bits/")==std::string::npos)
-    {
-      // Do not include transitive includes of system headers!
-      std::string::size_type prefix_len=std::string("/usr/include/").size();
-      system_headers.insert(file_str.substr(prefix_len));
-    }
-
-    return true;
-  }
-
-  return false;
-}
-
 void dump_ct::cleanup_decl(
   code_declt &decl,
   std::list<irep_idt> &local_static,
@@ -908,7 +649,7 @@ void dump_ct::collect_typedefs_rec(
   bool early,
   std::unordered_set<irep_idt, irep_id_hash> &dependencies)
 {
-  if(ignore(type))
+  if(system_symbols.is_type_internal(type, system_headers))
     return;
 
   std::unordered_set<irep_idt, irep_id_hash> local_deps;
@@ -1000,7 +741,7 @@ void dump_ct::gather_global_typedefs()
       const irep_idt &typedef_str=symbol.type.get(ID_C_typedef);
       PRECONDITION(!typedef_str.empty());
       typedef_types[symbol.type]=typedef_str;
-      if(ignore(symbol))
+      if(system_symbols.is_symbol_internal_symbol(symbol, system_headers))
         typedef_map.insert({typedef_str, typedef_infot(typedef_str)});
       else
         collect_typedefs(symbol.type, false);
diff --git a/src/goto-instrument/dump_c_class.h b/src/goto-instrument/dump_c_class.h
index 255cb88677e..26a89242aa5 100644
--- a/src/goto-instrument/dump_c_class.h
+++ b/src/goto-instrument/dump_c_class.h
@@ -14,10 +14,12 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <set>
 #include <string>
+#include <memory> // unique_ptr
 
 #include <util/language.h>
 
 #include <langapi/mode.h>
+#include <goto-programs/system_library_symbols.h>
 
 class dump_ct
 {
@@ -31,17 +33,14 @@ class dump_ct
     goto_functions(_goto_functions),
     copied_symbol_table(_ns.get_symbol_table()),
     ns(copied_symbol_table),
-    language(factory()),
-    use_all_headers(use_all_headers)
+    language(factory())
   {
     if(use_system_headers)
-      init_system_library_map();
+      system_symbols=system_library_symbolst();
+    system_symbols.set_use_all_headers(use_all_headers);
   }
 
-  virtual ~dump_ct()
-  {
-    delete language;
-  }
+  virtual ~dump_ct()=default;
 
   void operator()(std::ostream &out);
 
@@ -49,17 +48,14 @@ class dump_ct
   const goto_functionst &goto_functions;
   symbol_tablet copied_symbol_table;
   const namespacet ns;
-  languaget *language;
-  const bool use_all_headers;
+  std::unique_ptr<languaget> language;
 
   typedef std::unordered_set<irep_idt, irep_id_hash> convertedt;
   convertedt converted_compound, converted_global, converted_enum;
 
   std::set<std::string> system_headers;
 
-  typedef std::unordered_map<irep_idt, std::string, irep_id_hash>
-    system_library_mapt;
-  system_library_mapt system_library_map;
+  system_library_symbolst system_symbols;
 
   typedef std::unordered_map<irep_idt, irep_idt, irep_id_hash>
     declared_enum_constants_mapt;
@@ -84,14 +80,9 @@ class dump_ct
   typedef std::unordered_map<typet, irep_idt, irep_hash> typedef_typest;
   typedef_typest typedef_types;
 
-  void init_system_library_map();
-
   std::string type_to_string(const typet &type);
   std::string expr_to_string(const exprt &expr);
 
-  bool ignore(const symbolt &symbol);
-  bool ignore(const typet &type);
-
   static std::string indent(const unsigned n)
   {
     return std::string(2*n, ' ');
diff --git a/src/goto-instrument/full_slicer.cpp b/src/goto-instrument/full_slicer.cpp
index 4b37e2da833..67994855cb6 100644
--- a/src/goto-instrument/full_slicer.cpp
+++ b/src/goto-instrument/full_slicer.cpp
@@ -382,6 +382,13 @@ void full_slicer(
   full_slicert()(goto_functions, ns, a);
 }
 
+void full_slicer(goto_modelt &goto_model)
+{
+  assert_criteriont a;
+  const namespacet ns(goto_model.symbol_table);
+  full_slicert()(goto_model.goto_functions, ns, a);
+}
+
 void property_slicer(
   goto_functionst &goto_functions,
   const namespacet &ns,
@@ -391,6 +398,14 @@ void property_slicer(
   full_slicert()(goto_functions, ns, p);
 }
 
+void property_slicer(
+  goto_modelt &goto_model,
+  const std::list<std::string> &properties)
+{
+  const namespacet ns(goto_model.symbol_table);
+  property_slicer(goto_model.goto_functions, ns, properties);
+}
+
 slicing_criteriont::~slicing_criteriont()
 {
 }
diff --git a/src/goto-instrument/full_slicer.h b/src/goto-instrument/full_slicer.h
index 9e39786c5a2..41caa34666f 100644
--- a/src/goto-instrument/full_slicer.h
+++ b/src/goto-instrument/full_slicer.h
@@ -12,15 +12,21 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_GOTO_INSTRUMENT_FULL_SLICER_H
 #define CPROVER_GOTO_INSTRUMENT_FULL_SLICER_H
 
-#include <goto-programs/goto_functions.h>
+#include <goto-programs/goto_model.h>
 
 void full_slicer(
-  goto_functionst &goto_functions,
-  const namespacet &ns);
+  goto_functionst &,
+  const namespacet &);
+
+void full_slicer(goto_modelt &);
 
 void property_slicer(
-  goto_functionst &goto_functions,
-  const namespacet &ns,
+  goto_functionst &,
+  const namespacet &,
+  const std::list<std::string> &properties);
+
+void property_slicer(
+  goto_modelt &,
   const std::list<std::string> &properties);
 
 class slicing_criteriont
diff --git a/src/goto-instrument/goto_instrument_main.cpp b/src/goto-instrument/goto_instrument_main.cpp
index 0782ab6352b..a317f471cec 100644
--- a/src/goto-instrument/goto_instrument_main.cpp
+++ b/src/goto-instrument/goto_instrument_main.cpp
@@ -16,7 +16,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
diff --git a/src/goto-instrument/goto_instrument_parse_options.cpp b/src/goto-instrument/goto_instrument_parse_options.cpp
index 888853c6dc4..8991ab985d3 100644
--- a/src/goto-instrument/goto_instrument_parse_options.cpp
+++ b/src/goto-instrument/goto_instrument_parse_options.cpp
@@ -540,7 +540,7 @@ int goto_instrument_parse_optionst::doit()
     if(cmdline.isset("interpreter"))
     {
       status() << "Starting interpreter" << eom;
-      interpreter(symbol_table, goto_functions);
+      interpreter(symbol_table, goto_functions, get_message_handler());
       return 0;
     }
 
@@ -806,6 +806,7 @@ void goto_instrument_parse_optionst::do_indirect_call_and_rtti_removal(
   status() << "Virtual function removal" << eom;
   remove_virtual_functions(symbol_table, goto_functions);
   status() << "Catch and throw removal" << eom;
+  // This introduces instanceof, so order is important:
   remove_exceptions(symbol_table, goto_functions);
   status() << "Java instanceof removal" << eom;
   remove_instanceof(symbol_table, goto_functions);
@@ -867,7 +868,6 @@ void goto_instrument_parse_optionst::get_goto_program()
     throw 0;
 
   config.set(cmdline);
-  config.set_from_symbol_table(symbol_table);
 }
 
 void goto_instrument_parse_optionst::instrument_goto_program()
diff --git a/src/goto-instrument/goto_program2code.cpp b/src/goto-instrument/goto_program2code.cpp
index 1a96eb4ee34..e773b91cd02 100644
--- a/src/goto-instrument/goto_program2code.cpp
+++ b/src/goto-instrument/goto_program2code.cpp
@@ -88,7 +88,7 @@ void goto_program2codet::build_loop_map()
       }
 
     if(!loop_map.insert(std::make_pair(loop_start, loop_end)).second)
-      assert(false);
+      UNREACHABLE;
   }
 }
 
@@ -249,11 +249,11 @@ goto_programt::const_targett goto_program2codet::convert_instruction(
       return convert_catch(target, upper_bound, dest);
 
     case NO_INSTRUCTION_TYPE:
-      assert(false);
+      UNREACHABLE;
   }
 
   // not reached
-  assert(false);
+  UNREACHABLE;
   return target;
 }
 
@@ -817,7 +817,7 @@ bool goto_program2codet::set_block_end_points(
         break;
 
       if(!processed_locations.insert(case_end->location_number).second)
-        assert(false);
+        UNREACHABLE;
 
       it->case_last=case_end;
     }
@@ -1022,7 +1022,7 @@ goto_programt::const_targett goto_program2codet::convert_goto_switch(
       // this improves convergence
       if(it->case_start!=(--cases.end())->case_start)
       {
-        assert(false);
+        UNREACHABLE;
         goto_programt::instructiont i=*(it->case_selector);
         i.guard=true_exprt();
         goto_programt tmp;
@@ -1416,7 +1416,7 @@ goto_programt::const_targett goto_program2codet::convert_throw(
     codet &dest)
 {
   // this isn't really clear as throw is not supported in expr2cpp either
-  assert(false);
+  UNREACHABLE;
   return target;
 }
 
@@ -1426,7 +1426,7 @@ goto_programt::const_targett goto_program2codet::convert_catch(
     codet &dest)
 {
   // this isn't really clear as catch is not supported in expr2cpp either
-  assert(false);
+  UNREACHABLE;
   return target;
 }
 
diff --git a/src/goto-instrument/model_argc_argv.cpp b/src/goto-instrument/model_argc_argv.cpp
index 7e01d66e62a..319acf8674c 100644
--- a/src/goto-instrument/model_argc_argv.cpp
+++ b/src/goto-instrument/model_argc_argv.cpp
@@ -136,7 +136,7 @@ bool model_argc_argv(
     else if(has_prefix(id2string(it->first),
                        CPROVER_PREFIX "initialize::") &&
             symbol_table.add(it->second))
-      assert(false);
+      UNREACHABLE;
   }
 
   assert(value.is_not_nil());
diff --git a/src/goto-instrument/nondet_static.cpp b/src/goto-instrument/nondet_static.cpp
index e5e3b7649cf..2d0cd7cd055 100644
--- a/src/goto-instrument/nondet_static.cpp
+++ b/src/goto-instrument/nondet_static.cpp
@@ -19,6 +19,7 @@ Date: November 2011
 #include <util/cprover_prefix.h>
 #include <util/prefix.h>
 
+#include <goto-programs/goto_model.h>
 #include <goto-programs/goto_functions.h>
 
 void nondet_static(
@@ -70,7 +71,6 @@ void nondet_static(
   }
 }
 
-
 void nondet_static(
   const namespacet &ns,
   goto_functionst &goto_functions)
@@ -80,3 +80,9 @@ void nondet_static(
   // update counters etc.
   goto_functions.update();
 }
+
+void nondet_static(goto_modelt &goto_model)
+{
+  const namespacet ns(goto_model.symbol_table);
+  nondet_static(ns, goto_model.goto_functions);
+}
diff --git a/src/goto-instrument/nondet_static.h b/src/goto-instrument/nondet_static.h
index 97f3f0e683b..16114584849 100644
--- a/src/goto-instrument/nondet_static.h
+++ b/src/goto-instrument/nondet_static.h
@@ -17,9 +17,12 @@ Date: November 2011
 
 class goto_functionst;
 class namespacet;
+class goto_modelt;
 
 void nondet_static(
-  const namespacet &ns,
-  goto_functionst &goto_functions);
+  const namespacet &,
+  goto_functionst &);
+
+void nondet_static(goto_modelt &);
 
 #endif // CPROVER_GOTO_INSTRUMENT_NONDET_STATIC_H
diff --git a/src/goto-instrument/show_locations.cpp b/src/goto-instrument/show_locations.cpp
index b02dcb1b099..2b9580add2f 100644
--- a/src/goto-instrument/show_locations.cpp
+++ b/src/goto-instrument/show_locations.cpp
@@ -57,7 +57,7 @@ void show_locations(
       break;
 
     default:
-      assert(false);
+      UNREACHABLE;
     }
   }
 }
diff --git a/src/goto-instrument/unwind.cpp b/src/goto-instrument/unwind.cpp
index 78015b22e6f..81f19d30c7a 100644
--- a/src/goto-instrument/unwind.cpp
+++ b/src/goto-instrument/unwind.cpp
@@ -177,7 +177,7 @@ void goto_unwindt::unwind(
     else if(unwind_strategy==unwind_strategyt::ASSUME)
       new_t->make_assumption(exit_cond);
     else
-      assert(false);
+      UNREACHABLE;
 
     new_t->source_location=loop_head->source_location;
     new_t->function=loop_head->function;
diff --git a/src/goto-instrument/wmm/cycle_collection.cpp b/src/goto-instrument/wmm/cycle_collection.cpp
index 64b619c4369..24bceab723c 100644
--- a/src/goto-instrument/wmm/cycle_collection.cpp
+++ b/src/goto-instrument/wmm/cycle_collection.cpp
@@ -25,7 +25,7 @@ void event_grapht::graph_explorert::filter_thin_air(
   {
     std::set<critical_cyclet>::const_iterator next=it;
     ++next;
-    critical_cyclet::const_iterator e_it=it->begin();
+    auto e_it=it->begin();
     /* is there an event in the cycle not in thin-air events? */
     for(; e_it!=it->end(); ++e_it)
       if(thin_air_events.find(*e_it)==thin_air_events.end())
diff --git a/src/goto-instrument/wmm/data_dp.cpp b/src/goto-instrument/wmm/data_dp.cpp
index d24b17d9651..d88f20859eb 100644
--- a/src/goto-instrument/wmm/data_dp.cpp
+++ b/src/goto-instrument/wmm/data_dp.cpp
@@ -13,6 +13,7 @@ Date: 2012
 
 #include "data_dp.h"
 
+#include <util/invariant.h>
 #include <util/message.h>
 
 #include "abstract_event.h"
@@ -24,13 +25,13 @@ void data_dpt::dp_analysis(
   const datat &write,
   bool local_write)
 {
-  const_iterator it;
+  data_typet::const_iterator it;
 
-  for(it=begin(); it!=end(); ++it)
+  for(it=data.cbegin(); it!=data.cend(); ++it)
   {
     if(local_read && it->id==read.id)
     {
-      insert(
+      data.insert(
         datat(
           write.id,
           (local_write?source_locationt():write.loc),
@@ -40,7 +41,7 @@ void data_dpt::dp_analysis(
 
     if(local_write && it->id==write.id)
     {
-      insert(
+      data.insert(
         datat(
           read.id,
           (local_read?source_locationt():read.loc),
@@ -49,12 +50,12 @@ void data_dpt::dp_analysis(
     }
   }
 
-  if(it==end())
+  if(it==data.cend())
   {
     ++class_nb;
-    insert(
+    data.insert(
       datat(read.id, (local_read?source_locationt():read.loc), class_nb));
-    insert(
+    data.insert(
       datat(write.id, (local_write?source_locationt():write.loc), class_nb));
   }
 }
@@ -71,11 +72,11 @@ void data_dpt::dp_analysis(
 /// search in N^2
 bool data_dpt::dp(const abstract_eventt &e1, const abstract_eventt &e2) const
 {
-  for(const_iterator it1=begin(); it1!=end(); ++it1)
+  for(auto it1=data.cbegin(); it1!=data.cend(); ++it1)
   {
-    const_iterator it2=it1;
+    auto it2=it1;
     ++it2;
-    if(it2==end())
+    if(it2==data.cend())
       break;
 
     if(e1.local)
@@ -89,7 +90,7 @@ bool data_dpt::dp(const abstract_eventt &e1, const abstract_eventt &e2) const
         continue;
     }
 
-    for(; it2!=end(); ++it2)
+    for(; it2!=data.cend(); ++it2)
     {
       if(e2.local)
       {
@@ -116,42 +117,42 @@ bool data_dpt::dp(const abstract_eventt &e1, const abstract_eventt &e2) const
 /// merge in N^3
 void data_dpt::dp_merge()
 {
-  if(size()<2)
+  if(data.size()<2)
     return;
 
-  unsigned initial_size=size();
+  unsigned initial_size=data.size();
 
   unsigned from=0;
   unsigned to=0;
 
   /* look for similar elements */
-  for(const_iterator it1=begin(); it1!=end(); ++it1)
+  for(auto it1=data.cbegin(); it1!=data.cend(); ++it1)
   {
-    const_iterator it2=it1;
+    auto it2=it1;
     ++it2;
     /* all ok -- ends */
-    if(it2==end())
+    if(it2==data.cend())
       return;
 
-    for(; it2!=end(); ++it2)
+    for(; it2!=data.cend(); ++it2)
     {
       if(it1 == it2)
       {
         from=it2->eq_class;
         to=it1->eq_class;
-        erase(it2);
+        data.erase(it2);
         break;
       }
     }
   }
 
   /* merge */
-  for(iterator it3=begin(); it3!=end(); ++it3)
+  for(auto it3=data.begin(); it3!=data.end(); ++it3)
     if(it3->eq_class==from)
       it3->eq_class=to;
 
   /* strictly monotonous => converges */
-  assert(initial_size>size());
+  INVARIANT(initial_size>data.size(), "strictly monotonous => converges");
 
   /* repeat until classes are disjunct */
   dp_merge();
@@ -160,10 +161,10 @@ void data_dpt::dp_merge()
 void data_dpt::print(messaget &message)
 {
 #ifdef DEBUG
-  const_iterator it;
+  data_typet::const_iterator it;
   std::map<unsigned, std::set<source_locationt> > classed;
 
-  for(it=begin(); it!=end(); ++it)
+  for(it=data.cbegin(); it!=data.cend(); ++it)
   {
     if(classed.find(it->eq_class)==classed.end())
     {
diff --git a/src/goto-instrument/wmm/data_dp.h b/src/goto-instrument/wmm/data_dp.h
index abd7641fb9c..bdd3e1705c6 100644
--- a/src/goto-instrument/wmm/data_dp.h
+++ b/src/goto-instrument/wmm/data_dp.h
@@ -48,11 +48,13 @@ struct datat
   }
 };
 
-class data_dpt:public std::set<datat>
+class data_dpt final
 {
-public:
+  typedef std::set<datat> data_typet;
+  data_typet data;
   unsigned class_nb;
 
+public:
   /* add this dependency in the structure */
   void dp_analysis(const abstract_eventt &read, const abstract_eventt &write);
   void dp_analysis(
diff --git a/src/goto-instrument/wmm/event_graph.cpp b/src/goto-instrument/wmm/event_graph.cpp
index d5d9df2aff4..110a3618ea2 100644
--- a/src/goto-instrument/wmm/event_graph.cpp
+++ b/src/goto-instrument/wmm/event_graph.cpp
@@ -1427,7 +1427,7 @@ std::string event_grapht::critical_cyclet::print_name(
 
   if(first_done)
   {
-    critical_cyclet::size_type n_events=extra_fence_count;
+    auto n_events=extra_fence_count;
     for(std::string::const_iterator it=name.begin();
         it!=name.end();
         ++it)
diff --git a/src/goto-instrument/wmm/event_graph.h b/src/goto-instrument/wmm/event_graph.h
index e77a7e92d3a..69eb502760d 100644
--- a/src/goto-instrument/wmm/event_graph.h
+++ b/src/goto-instrument/wmm/event_graph.h
@@ -20,6 +20,7 @@ Date: 2012
 #include <iosfwd>
 
 #include <util/graph.h>
+#include <util/invariant.h>
 
 #include "abstract_event.h"
 #include "data_dp.h"
@@ -35,9 +36,11 @@ class event_grapht
 {
 public:
   /* critical cycle */
-  class critical_cyclet:public std::list<event_idt>
+  class critical_cyclet final
   {
-  protected:
+    typedef std::list<event_idt> data_typet;
+    data_typet data;
+
     event_grapht &egraph;
 
     bool is_not_uniproc() const;
@@ -50,16 +53,48 @@ class event_grapht
     std::string print_name(const critical_cyclet &redyced,
       memory_modelt model) const;
 
-    bool check_AC(const_iterator s_it, const abstract_eventt &first,
+    bool check_AC(
+      data_typet::const_iterator s_it,
+      const abstract_eventt &first,
       const abstract_eventt &second) const;
-    bool check_BC(const_iterator it, const abstract_eventt &first,
+    bool check_BC(
+      data_typet::const_iterator it,
+      const abstract_eventt &first,
       const abstract_eventt &second) const;
 
   public:
     unsigned id;
-
     bool has_user_defined_fence;
 
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::iterator iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::const_iterator const_iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::value_type value_type;
+
+    iterator begin() { return data.begin(); }
+    const_iterator begin() const { return data.begin(); }
+    const_iterator cbegin() const { return data.cbegin(); }
+
+    iterator end() { return data.end(); }
+    const_iterator end() const { return data.end(); }
+    const_iterator cend() const { return data.cend(); }
+
+    template <typename T>
+    void push_front(T &&t) { data.push_front(std::forward<T>(t)); }
+
+    template <typename T>
+    void push_back(T &&t) { data.push_back(std::forward<T>(t)); }
+
+    value_type &front() { return data.front(); }
+    const value_type &front() const { return data.front(); }
+
+    value_type &back() { return data.back(); }
+    const value_type &back() const { return data.back(); }
+
+    size_t size() const { return data.size(); }
+
     critical_cyclet(event_grapht &_egraph, unsigned _id)
       :egraph(_egraph), id(_id), has_user_defined_fence(false)
     {
@@ -67,23 +102,25 @@ class event_grapht
 
     void operator()(const critical_cyclet &cyc)
     {
-      clear();
-      for(const_iterator it=cyc.begin(); it!=cyc.end(); it++)
-        push_back(*it);
+      data.clear();
+      for(auto it=cyc.data.cbegin();
+          it!=cyc.data.cend();
+          ++it)
+        data.push_back(*it);
       has_user_defined_fence=cyc.has_user_defined_fence;
     }
 
     bool is_cycle()
     {
       /* size check */
-      if(size()<4)
+      if(data.size()<4)
         return false;
 
       /* po order check */
-      const_iterator it=begin();
-      const_iterator n_it=it;
+      auto it=data.cbegin();
+      auto n_it=it;
       ++n_it;
-      for(; it!=end() && n_it!=end(); ++it, ++n_it)
+      for(; it!=data.cend() && n_it!=data.cend(); ++it, ++n_it)
       {
         if(egraph[*it].thread==egraph[*n_it].thread
           && !egraph.are_po_ordered(*it, *n_it))
@@ -177,7 +214,7 @@ class event_grapht
       {
         critical_cyclet reduced(egraph, id);
         this->hide_internals(reduced);
-        assert(!reduced.empty());
+        INVARIANT(!reduced.data.empty(), "reduced must not be empty");
         return print_name(reduced, model);
       }
       else
@@ -196,7 +233,7 @@ class event_grapht
 
     bool operator<(const critical_cyclet &other) const
     {
-      return ( ((std::list<event_idt>) *this) < (std::list<event_idt>)other);
+      return data<other.data;
     }
   };
 
diff --git a/src/goto-instrument/wmm/instrumenter_strategies.cpp b/src/goto-instrument/wmm/instrumenter_strategies.cpp
index df22da52540..97ad9888f80 100644
--- a/src/goto-instrument/wmm/instrumenter_strategies.cpp
+++ b/src/goto-instrument/wmm/instrumenter_strategies.cpp
@@ -136,10 +136,10 @@ void inline instrumentert::instrument_one_event_per_cycle_inserter(
       continue;
 
     /* instruments the first pair */
-    for(std::set<event_grapht::critical_cyclet::delayt>::iterator
-      p_it=it->unsafe_pairs.begin();
-      p_it!=it->unsafe_pairs.end(); ++p_it)
+    if(!it->unsafe_pairs.empty())
     {
+      std::set<event_grapht::critical_cyclet::delayt>::iterator
+        p_it=it->unsafe_pairs.begin();
       delayed.insert(*p_it);
       const abstract_eventt &first_ev=egraph[p_it->first];
       var_to_instr.insert(first_ev.variable);
@@ -154,7 +154,6 @@ void inline instrumentert::instrument_one_event_per_cycle_inserter(
           std::pair<irep_idt, source_locationt>(
             second_ev.variable, second_ev.source_location));
       }
-      break;
     }
   }
 }
@@ -273,9 +272,9 @@ void inline instrumentert::instrument_minimum_interference_inserter(
   const std::size_t mat_size=set_of_cycles.size()*edges.size();
   message.debug() << "size of the system: " << mat_size
     << messaget::eom;
-  int *imat=new int[mat_size+1];
-  int *jmat=new int[mat_size+1];
-  double *vmat=new double[mat_size+1];
+  std::vector<int> imat(mat_size+1);
+  std::vector<int> jmat(mat_size+1);
+  std::vector<double> vmat(mat_size+1);
 
   /* fills the constraints coeff */
   /* tables read from 1 in glpk -- first row/column ignored */
@@ -344,9 +343,6 @@ void inline instrumentert::instrument_minimum_interference_inserter(
   }
 
   glp_delete_prob(lp);
-  delete[] imat;
-  delete[] jmat;
-  delete[] vmat;
 #else
   throw "sorry, minimum interference option requires glpk; "
         "please recompile goto-instrument with glpk";
diff --git a/src/goto-programs/Makefile b/src/goto-programs/Makefile
index a66b408a3c9..b164beef079 100644
--- a/src/goto-programs/Makefile
+++ b/src/goto-programs/Makefile
@@ -3,6 +3,7 @@ SRC = basic_blocks.cpp \
       class_hierarchy.cpp \
       class_identifier.cpp \
       compute_called_functions.cpp \
+      convert_nondet.cpp \
       destructor.cpp \
       elf_reader.cpp \
       format_strings.cpp \
@@ -25,6 +26,7 @@ SRC = basic_blocks.cpp \
       interpreter.cpp \
       interpreter_evaluate.cpp \
       json_goto_trace.cpp \
+      link_goto_model.cpp \
       link_to_library.cpp \
       loop_ids.cpp \
       mm_io.cpp \
@@ -47,6 +49,8 @@ SRC = basic_blocks.cpp \
       remove_unused_functions.cpp \
       remove_vector.cpp \
       remove_virtual_functions.cpp \
+      replace_java_nondet.cpp \
+      resolve_concrete_function_call.cpp \
       safety_checker.cpp \
       set_properties.cpp \
       show_goto_functions.cpp \
@@ -57,6 +61,7 @@ SRC = basic_blocks.cpp \
       slice_global_inits.cpp \
       string_abstraction.cpp \
       string_instrumentation.cpp \
+      system_library_symbols.cpp \
       vcd_goto_trace.cpp \
       wp.cpp \
       write_goto_binary.cpp \
diff --git a/src/goto-programs/basic_blocks.cpp b/src/goto-programs/basic_blocks.cpp
index 44e1ff7bacb..75b91b82bd6 100644
--- a/src/goto-programs/basic_blocks.cpp
+++ b/src/goto-programs/basic_blocks.cpp
@@ -89,6 +89,6 @@ void basic_blocks(goto_programt &goto_program,
       }
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
 }
diff --git a/src/goto-programs/builtin_functions.cpp b/src/goto-programs/builtin_functions.cpp
index 530e5e31574..f1a103e2428 100644
--- a/src/goto-programs/builtin_functions.cpp
+++ b/src/goto-programs/builtin_functions.cpp
@@ -221,7 +221,7 @@ void goto_convertt::do_printf(
     }
   }
   else
-    assert(false);
+    UNREACHABLE;
 }
 
 void goto_convertt::do_scanf(
@@ -326,7 +326,7 @@ void goto_convertt::do_scanf(
     }
   }
   else
-    assert(false);
+    UNREACHABLE;
 }
 
 void goto_convertt::do_input(
@@ -664,14 +664,21 @@ void goto_convertt::do_java_new_array(
   t_n->code=code_assignt(lhs, malloc_expr);
   t_n->source_location=location;
 
-  // multi-dimensional?
-
   assert(ns.follow(object_type).id()==ID_struct);
   const struct_typet &struct_type=to_struct_type(ns.follow(object_type));
   assert(struct_type.components().size()==3);
 
-  // if it's an array, we need to set the length field
+  // Init base class:
   dereference_exprt deref(lhs, object_type);
+  exprt zero_object=
+    zero_initializer(object_type, location, ns, get_message_handler());
+  set_class_identifier(
+    to_struct_expr(zero_object), ns, to_symbol_type(object_type));
+  goto_programt::targett t_i=dest.add_instruction(ASSIGN);
+  t_i->code=code_assignt(deref, zero_object);
+  t_i->source_location=location;
+
+  // if it's an array, we need to set the length field
   member_exprt length(
     deref,
     struct_type.components()[1].get_name(),
@@ -685,7 +692,20 @@ void goto_convertt::do_java_new_array(
     deref,
     struct_type.components()[2].get_name(),
     struct_type.components()[2].type());
-  side_effect_exprt data_cpp_new_expr(ID_cpp_new_array, data.type());
+
+  // Allocate a (struct realtype**) instead of a (void**) if possible.
+  const irept &given_element_type=object_type.find(ID_C_element_type);
+  typet allocate_data_type;
+  exprt cast_data_member;
+  if(given_element_type.is_not_nil())
+  {
+    allocate_data_type=
+      pointer_type(static_cast<const typet &>(given_element_type));
+  }
+  else
+    allocate_data_type=data.type();
+
+  side_effect_exprt data_java_new_expr(ID_java_new_array, allocate_data_type);
 
   // The instruction may specify a (hopefully small) upper bound on the
   // array size, in which case we allocate a fixed-length array that may
@@ -694,25 +714,48 @@ void goto_convertt::do_java_new_array(
   // backend.
   const irept size_bound=rhs.find(ID_length_upper_bound);
   if(size_bound.is_nil())
-    data_cpp_new_expr.set(ID_size, rhs.op0());
+    data_java_new_expr.set(ID_size, rhs.op0());
   else
-    data_cpp_new_expr.set(ID_size, size_bound);
+    data_java_new_expr.set(ID_size, size_bound);
+
+  // Must directly assign the new array to a temporary
+  // because goto-symex will notice `x=side_effect_exprt` but not
+  // `x=typecast_exprt(side_effect_exprt(...))`
+  symbol_exprt new_array_data_symbol=
+    new_tmp_symbol(
+      data_java_new_expr.type(),
+      "new_array_data",
+      dest,
+      location)
+    .symbol_expr();
+  goto_programt::targett t_p2=dest.add_instruction(ASSIGN);
+  t_p2->code=code_assignt(new_array_data_symbol, data_java_new_expr);
+  t_p2->source_location=location;
+
   goto_programt::targett t_p=dest.add_instruction(ASSIGN);
-  t_p->code=code_assignt(data, data_cpp_new_expr);
+  exprt cast_java_new=new_array_data_symbol;
+  if(cast_java_new.type()!=data.type())
+    cast_java_new=typecast_exprt(cast_java_new, data.type());
+  t_p->code=code_assignt(data, cast_java_new);
   t_p->source_location=location;
 
   // zero-initialize the data
-  exprt zero_element=
-    zero_initializer(
-      data.type().subtype(),
-      location,
-      ns,
-      get_message_handler());
-  codet array_set(ID_array_set);
-  array_set.copy_to_operands(data, zero_element);
-  goto_programt::targett t_d=dest.add_instruction(OTHER);
-  t_d->code=array_set;
-  t_d->source_location=location;
+  if(!rhs.get_bool(ID_skip_initialize))
+  {
+    exprt zero_element=
+      zero_initializer(
+        data.type().subtype(),
+        location,
+        ns,
+        get_message_handler());
+    codet array_set(ID_array_set);
+    array_set.copy_to_operands(new_array_data_symbol, zero_element);
+    goto_programt::targett t_d=dest.add_instruction(OTHER);
+    t_d->code=array_set;
+    t_d->source_location=location;
+  }
+
+  // multi-dimensional?
 
   if(rhs.operands().size()>=2)
   {
@@ -790,7 +833,7 @@ void goto_convertt::cpp_new_initializer(
       convert(to_code(initializer), dest);
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
 }
 
@@ -1353,7 +1396,7 @@ void goto_convertt::do_function_call_symbol(
   }
   else if(identifier=="__builtin_unreachable")
   {
-    // says something like assert(false);
+    // says something like UNREACHABLE;
   }
   else if(identifier==ID_gcc_builtin_va_arg)
   {
diff --git a/src/goto-programs/cfg.h b/src/goto-programs/cfg.h
index 2e1bd83598b..da7bec886b9 100644
--- a/src/goto-programs/cfg.h
+++ b/src/goto-programs/cfg.h
@@ -64,11 +64,30 @@ class cfg_baset:public grapht< cfg_base_nodet<T, I> >
 public:
   typedef std::size_t entryt;
 
-  struct entry_mapt:
-    public std::map<goto_programt::const_targett, entryt>
+  class entry_mapt final
   {
+    typedef std::map<goto_programt::const_targett, entryt> data_typet;
+    data_typet data;
+
+  public:
     grapht< cfg_base_nodet<T, I> > &container;
 
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::iterator iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::const_iterator const_iterator;
+
+    template <typename U>
+    const_iterator find(U &&u) const { return data.find(std::forward<U>(u)); }
+
+    iterator begin() { return data.begin(); }
+    const_iterator begin() const { return data.begin(); }
+    const_iterator cbegin() const { return data.cbegin(); }
+
+    iterator end() { return data.end(); }
+    const_iterator end() const { return data.end(); }
+    const_iterator cend() const { return data.cend(); }
+
     explicit entry_mapt(grapht< cfg_base_nodet<T, I> > &_container):
       container(_container)
     {
@@ -76,7 +95,7 @@ class cfg_baset:public grapht< cfg_base_nodet<T, I> >
 
     entryt &operator[](const goto_programt::const_targett &t)
     {
-      std::pair<iterator, bool> e=insert(std::make_pair(t, 0));
+      auto e=data.insert(std::make_pair(t, 0));
 
       if(e.second)
         e.first->second=container.add_node();
@@ -203,9 +222,7 @@ void cfg_baset<T, P, I>::compute_edges_goto(
      !instruction.guard.is_true())
     this->add_edge(entry, entry_map[next_PC]);
 
-  for(const auto &t : instruction.targets)
-    if(t!=goto_program.instructions.end())
-      this->add_edge(entry, entry_map[t]);
+  this->add_edge(entry, entry_map[instruction.get_target()]);
 }
 
 template<class T, typename P, typename I>
@@ -260,9 +277,7 @@ void concurrent_cfg_baset<T, P, I>::compute_edges_start_thread(
     next_PC,
     entry);
 
-  for(const auto &t : instruction.targets)
-    if(t!=goto_program.instructions.end())
-      this->add_edge(entry, this->entry_map[t]);
+  this->add_edge(entry, this->entry_map[instruction.get_target()]);
 }
 
 template<class T, typename P, typename I>
@@ -403,7 +418,7 @@ void cfg_baset<T, P, I>::compute_edges(
     break;
 
   case NO_INSTRUCTION_TYPE:
-    assert(false);
+    UNREACHABLE;
     break;
   }
 }
diff --git a/src/goto-programs/class_hierarchy.cpp b/src/goto-programs/class_hierarchy.cpp
index 0ef3ae5a21e..85dcb25680e 100644
--- a/src/goto-programs/class_hierarchy.cpp
+++ b/src/goto-programs/class_hierarchy.cpp
@@ -64,6 +64,11 @@ void class_hierarchyt::get_children_trans_rec(
     get_children_trans_rec(child, dest);
 }
 
+/// Get all the classes that inherit (directly or indirectly) from class c. The
+/// first element(s) will be the immediate parents of c, though after this
+/// the order is all the parents of the first immediate parent
+/// \param c: The class to consider
+/// \param [out] dest: A list of class ids that c eventually inherits from.
 void class_hierarchyt::get_parents_trans_rec(
   const irep_idt &c,
   idst &dest) const
diff --git a/src/goto-programs/convert_nondet.cpp b/src/goto-programs/convert_nondet.cpp
new file mode 100644
index 00000000000..d55afbe91a1
--- /dev/null
+++ b/src/goto-programs/convert_nondet.cpp
@@ -0,0 +1,170 @@
+/*******************************************************************\
+
+Module: Convert side_effect_expr_nondett expressions
+
+Author: Reuben Thomas, reuben.thomas@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Convert side_effect_expr_nondett expressions
+
+#include "convert_nondet.h"
+#include "goto_convert.h"
+#include "goto_model.h"
+#include "remove_skip.h"
+
+#include <java_bytecode/java_object_factory.h> // gen_nondet_init
+
+#include <util/irep_ids.h>
+
+#include <memory>
+
+/// Checks an instruction to see whether it contains an assignment from
+/// side_effect_expr_nondet.  If so, replaces the instruction with a range of
+/// instructions to properly nondet-initialize the lhs.
+/// \param goto_program: The goto program to modify.
+/// \param target: One of the steps in that goto program.
+/// \param symbol_table: The global symbol table.
+/// \param message_handler: Handles logging.
+/// \param max_nondet_array_length: Maximum size of new nondet arrays.
+/// \return The next instruction to process with this function.
+static goto_programt::targett insert_nondet_init_code(
+  goto_programt &goto_program,
+  const goto_programt::targett &target,
+  symbol_tablet &symbol_table,
+  message_handlert &message_handler,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth)
+{
+  // Return if the instruction isn't an assignment
+  const auto next_instr=std::next(target);
+  if(!target->is_assign())
+  {
+    return next_instr;
+  }
+
+  // Return if the rhs of the assignment isn't a side effect expression
+  const auto &assign=to_code_assign(target->code);
+  if(assign.rhs().id()!=ID_side_effect)
+  {
+    return next_instr;
+  }
+
+  // Return if the rhs isn't nondet
+  const auto &side_effect=to_side_effect_expr(assign.rhs());
+  if(side_effect.get_statement()!=ID_nondet)
+  {
+    return next_instr;
+  }
+
+  const auto lhs=assign.lhs();
+  // If the lhs type doesn't have a subtype then I guess it's primitive and
+  // we want to bail out now
+  if(!lhs.type().has_subtype())
+  {
+    return next_instr;
+  }
+
+  // Although, if the type is a ptr-to-void then we also want to bail
+  if(lhs.type().subtype().id()==ID_empty)
+  {
+    return next_instr;
+  }
+
+  // Check whether the nondet object may be null
+  const auto nullable=to_side_effect_expr_nondet(side_effect).get_nullable();
+  // Get the symbol to nondet-init
+  const auto source_loc=target->source_location;
+
+  // Erase the nondet assignment
+  target->make_skip();
+
+  // Generate nondet init code
+  code_blockt init_code;
+  gen_nondet_init(
+    lhs,
+    init_code,
+    symbol_table,
+    source_loc,
+    true,
+    allocation_typet::DYNAMIC,
+    nullable,
+    max_nondet_array_length,
+    max_nondet_tree_depth,
+    update_in_placet::NO_UPDATE_IN_PLACE);
+
+  // Convert this code into goto instructions
+  goto_programt new_instructions;
+  goto_convert(init_code, symbol_table, new_instructions, message_handler);
+
+  // Insert the new instructions into the instruction list
+  goto_program.destructive_insert(next_instr, new_instructions);
+  goto_program.update();
+
+  return next_instr;
+}
+
+/// For each instruction in the goto program, checks if it is an assignment from
+/// nondet and replaces it with the appropriate composite initialization code if
+/// so.
+/// \param goto_program: The goto program to modify.
+/// \param symbol_table: The global symbol table.
+/// \param message_handler: Handles logging.
+/// \param max_nondet_array_length: Maximum size of new nondet arrays.
+void convert_nondet(
+  goto_programt &goto_program,
+  symbol_tablet &symbol_table,
+  message_handlert &message_handler,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth)
+{
+  for(auto instruction_iterator=goto_program.instructions.begin(),
+        end=goto_program.instructions.end();
+      instruction_iterator!=end;)
+  {
+    instruction_iterator=insert_nondet_init_code(
+      goto_program,
+      instruction_iterator,
+      symbol_table,
+      message_handler,
+      max_nondet_array_length,
+      max_nondet_tree_depth);
+  }
+}
+
+void convert_nondet(
+  goto_functionst &goto_functions,
+  symbol_tablet &symbol_table,
+  message_handlert &message_handler,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth)
+{
+  for(auto &goto_program : goto_functions.function_map)
+  {
+    convert_nondet(
+      goto_program.second.body,
+      symbol_table,
+      message_handler,
+      max_nondet_array_length,
+      max_nondet_tree_depth);
+  }
+
+  goto_functions.compute_location_numbers();
+
+  remove_skip(goto_functions);
+}
+
+void convert_nondet(
+  goto_modelt &goto_model,
+  message_handlert &message_handler,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth)
+{
+  convert_nondet(
+    goto_model.goto_functions,
+    goto_model.symbol_table,
+    message_handler,
+    max_nondet_array_length,
+    max_nondet_tree_depth);
+}
diff --git a/src/goto-programs/convert_nondet.h b/src/goto-programs/convert_nondet.h
new file mode 100644
index 00000000000..32d8cd33f91
--- /dev/null
+++ b/src/goto-programs/convert_nondet.h
@@ -0,0 +1,43 @@
+/*******************************************************************\
+
+Module: Convert side_effect_expr_nondett expressions
+
+Author: Reuben Thomas, reuben.thomas@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Convert side_effect_expr_nondett expressions
+
+#ifndef CPROVER_GOTO_PROGRAMS_CONVERT_NONDET_H
+#define CPROVER_GOTO_PROGRAMS_CONVERT_NONDET_H
+
+#include <cstddef> // size_t
+
+class goto_functionst;
+class symbol_tablet;
+class goto_modelt;
+class message_handlert;
+
+/// Replace calls to nondet library functions with an internal nondet
+/// representation.
+/// \param goto_functions: The set of goto programs to modify.
+/// \param symbol_table: The symbol table to query/update.
+/// \param message_handler: For error logging.
+/// \param max_nondet_array_length: The maximum length of any new arrays.
+/// \param max_nondet_tree_depth: Maximum depth for object hierarchy on input
+///   parameterers.
+void convert_nondet(
+  goto_functionst &,
+  symbol_tablet &,
+  message_handlert &,
+  std::size_t max_nondet_array_length,
+  std::size_t max_nondet_tree_depth);
+
+void convert_nondet(
+  goto_modelt &,
+  message_handlert &,
+  std::size_t max_nondet_array_length,
+  std::size_t max_nondet_tree_depth);
+
+#endif
diff --git a/src/goto-programs/format_strings.h b/src/goto-programs/format_strings.h
index 8c233324ecf..502acfb311a 100644
--- a/src/goto-programs/format_strings.h
+++ b/src/goto-programs/format_strings.h
@@ -84,9 +84,7 @@ class format_tokent
   irep_idt value; // for text and pattern matching
 };
 
-class format_token_listt:public std::list<format_tokent>
-{
-};
+typedef std::list<format_tokent> format_token_listt;
 
 format_token_listt parse_format_string(const std::string &);
 
diff --git a/src/goto-programs/goto_convert.cpp b/src/goto-programs/goto_convert.cpp
index e2238e377d4..710c90595cd 100644
--- a/src/goto-programs/goto_convert.cpp
+++ b/src/goto-programs/goto_convert.cpp
@@ -58,31 +58,24 @@ static void finish_catch_push_targets(goto_programt &dest)
   // in the second pass set the targets
   Forall_goto_program_instructions(it, dest)
   {
-    if(it->is_catch())
+    if(it->is_catch() && it->code.get_statement()==ID_push_catch)
     {
-      bool handler_added=true;
-      irept exceptions=it->code.find(ID_exception_list);
+      // Populate `targets` with a GOTO instruction target per
+      // exception handler if it isn't already populated.
+      // (Java handlers, for example, need this finish step; C++
+      //  handlers will already be populated by now)
 
-      if(exceptions.is_nil() &&
-         it->code.has_operands())
-        exceptions=it->code.op0().find(ID_exception_list);
-
-      const irept::subt &exception_list=exceptions.get_sub();
-
-      if(!exception_list.empty())
+      if(it->targets.empty())
       {
-        // in this case we have a CATCH_PUSH
-        irept handlers=it->code.find(ID_label);
-        if(handlers.is_nil() &&
-           it->code.has_operands())
-          handlers=it->code.op0().find(ID_label);
-        const irept::subt &handler_list=handlers.get_sub();
-
-        // some handlers may not have been converted (if there was no
-        // exception to be caught); in such a situation we abort
+        bool handler_added=true;
+        const code_push_catcht::exception_listt &handler_list=
+          to_code_push_catch(it->code).exception_list();
+
         for(const auto &handler : handler_list)
         {
-          if(label_targets.find(handler.id())==label_targets.end())
+          // some handlers may not have been converted (if there was no
+          // exception to be caught); in such a situation we abort
+          if(label_targets.find(handler.get_label())==label_targets.end())
           {
             handler_added=false;
             break;
@@ -93,14 +86,7 @@ static void finish_catch_push_targets(goto_programt &dest)
           continue;
 
         for(const auto &handler : handler_list)
-        {
-          std::map<irep_idt,
-                   goto_programt::targett>::const_iterator handler_it=
-            label_targets.find(handler.id());
-          assert(handler_it!=label_targets.end());
-          // set the target
-          it->targets.push_back(handler_it->second);
-        }
+          it->targets.push_back(label_targets.at(handler.get_label()));
       }
     }
   }
@@ -558,6 +544,10 @@ void goto_convertt::convert(
     forall_operands(it, code)
       convert(to_code(*it), dest);
   }
+  else if(statement==ID_push_catch ||
+          statement==ID_pop_catch ||
+          statement==ID_exception_landingpad)
+    copy(code, CATCH, dest);
   else
     copy(code, OTHER, dest);
 
@@ -849,7 +839,7 @@ void goto_convertt::convert_cpp_delete(
   else if(code.get_statement()==ID_cpp_delete)
     delete_identifier="__delete";
   else
-    assert(false);
+    UNREACHABLE;
 
   if(destructor.is_not_nil())
   {
@@ -868,7 +858,7 @@ void goto_convertt::convert_cpp_delete(
       convert(tmp_code, dest);
     }
     else
-      assert(false);
+      UNREACHABLE;
   }
 
   // now do "free"
@@ -1264,6 +1254,19 @@ void goto_convertt::convert_switch(
 
   goto_programt tmp_cases;
 
+  // The case number represents which case this corresponds to in the sequence
+  // of case statements.
+  //
+  // switch (x)
+  // {
+  // case 2:  // case_number 1
+  //   ...;
+  // case 3:  // case_number 2
+  //   ...;
+  // case 10: // case_number 3
+  //   ...;
+  // }
+  size_t case_number=1;
   for(auto &case_pair : targets.cases)
   {
     const caset &case_ops=case_pair.second;
@@ -1272,10 +1275,15 @@ void goto_convertt::convert_switch(
 
     exprt guard_expr=case_guard(argument, case_ops);
 
+    source_locationt source_location=case_ops.front().find_source_location();
+    source_location.set_case_number(std::to_string(case_number));
+    case_number++;
+    guard_expr.add_source_location()=source_location;
+
     goto_programt::targett x=tmp_cases.add_instruction();
     x->make_goto(case_pair.first);
     x->guard.swap(guard_expr);
-    x->source_location=case_ops.front().find_source_location();
+    x->source_location=source_location;
   }
 
   {
@@ -1802,7 +1810,7 @@ void goto_convertt::generate_ifthenelse(
      true_case.instructions.back().labels.empty())
   {
     // The above conjunction deliberately excludes the instance
-    // if(some) { label: assert(0); }
+    // if(some) { label: assert(false); }
     true_case.instructions.back().guard=boolean_negate(guard);
     dest.destructive_append(true_case);
     true_case.instructions.clear();
@@ -1815,7 +1823,7 @@ void goto_convertt::generate_ifthenelse(
      false_case.instructions.back().labels.empty())
   {
     // The above conjunction deliberately excludes the instance
-    // if(some) ... else { label: assert(0); }
+    // if(some) ... else { label: assert(false); }
     false_case.instructions.back().guard=guard;
     dest.destructive_append(false_case);
     false_case.instructions.clear();
diff --git a/src/goto-programs/goto_convert_class.h b/src/goto-programs/goto_convert_class.h
index 6061e369d42..508fb4fda6d 100644
--- a/src/goto-programs/goto_convert_class.h
+++ b/src/goto-programs/goto_convert_class.h
@@ -97,9 +97,6 @@ class goto_convertt:public messaget
     side_effect_exprt &expr,
     goto_programt &dest,
     bool result_is_used);
-  void remove_push_catch(
-    side_effect_exprt &expr,
-    goto_programt &dest);
   void remove_assignment(
     side_effect_exprt &expr,
     goto_programt &dest,
@@ -243,7 +240,6 @@ class goto_convertt:public messaget
   void convert_msc_try_except(const codet &code, goto_programt &dest);
   void convert_msc_leave(const codet &code, goto_programt &dest);
   void convert_try_catch(const codet &code, goto_programt &dest);
-  void convert_java_try_catch(const codet &code, goto_programt &dest);
   void convert_CPROVER_try_catch(const codet &code, goto_programt &dest);
   void convert_CPROVER_try_finally(const codet &code, goto_programt &dest);
   void convert_CPROVER_throw(const codet &code, goto_programt &dest);
diff --git a/src/goto-programs/goto_convert_exceptions.cpp b/src/goto-programs/goto_convert_exceptions.cpp
index 581ae2bcecd..f34d4d2f3fa 100644
--- a/src/goto-programs/goto_convert_exceptions.cpp
+++ b/src/goto-programs/goto_convert_exceptions.cpp
@@ -93,61 +93,6 @@ void goto_convertt::convert_msc_leave(
   t->source_location=code.source_location();
 }
 
-void goto_convertt::convert_java_try_catch(
-  const codet &code,
-  goto_programt &dest)
-{
-  assert(!code.operands().empty());
-
-  // add the CATCH instruction to 'dest'
-  goto_programt::targett catch_instruction=dest.add_instruction();
-  catch_instruction->make_catch();
-  catch_instruction->code.set_statement(ID_catch);
-  catch_instruction->source_location=code.source_location();
-  catch_instruction->function=code.source_location().get_function();
-
-  // the CATCH instruction is annotated with a list of exception IDs
-  const irept exceptions=code.op0().find(ID_exception_list);
-  if(exceptions.is_not_nil())
-  {
-    irept::subt exceptions_sub=exceptions.get_sub();
-    irept::subt &exception_list=
-      catch_instruction->code.add(ID_exception_list).get_sub();
-    exception_list.resize(exceptions_sub.size());
-    for(size_t i=0; i<exceptions_sub.size(); ++i)
-      exception_list[i].id(exceptions_sub[i].id());
-  }
-
-  // the CATCH instruction is also annotated with a list of handle labels
-  const irept handlers=code.op0().find(ID_label);
-  if(handlers.is_not_nil())
-  {
-    irept::subt handlers_sub=handlers.get_sub();
-    irept::subt &handlers_list=
-      catch_instruction->code.add(ID_label).get_sub();
-    handlers_list.resize(handlers_sub.size());
-    for(size_t i=0; i<handlers_sub.size(); ++i)
-      handlers_list[i].id(handlers_sub[i].id());
-  }
-
-  // the CATCH instruction may also signal a handler
-  if(code.op0().has_operands())
-  {
-    catch_instruction->code.get_sub().resize(1);
-    catch_instruction->code.get_sub()[0]=code.op0().op0();
-  }
-
-  // add a SKIP target for the end of everything
-  goto_programt end;
-  goto_programt::targett end_target=end.add_instruction();
-  end_target->make_skip();
-  end_target->source_location=code.source_location();
-  end_target->function=code.source_location().get_function();
-
-  // add the end-target
-  dest.destructive_append(end);
-}
-
 void goto_convertt::convert_try_catch(
   const codet &code,
   goto_programt &dest)
@@ -157,13 +102,14 @@ void goto_convertt::convert_try_catch(
   // add the CATCH-push instruction to 'dest'
   goto_programt::targett catch_push_instruction=dest.add_instruction();
   catch_push_instruction->make_catch();
-  catch_push_instruction->code.set_statement(ID_catch);
   catch_push_instruction->source_location=code.source_location();
 
+  code_push_catcht push_catch_code;
+
   // the CATCH-push instruction is annotated with a list of IDs,
   // one per target
-  irept::subt &exception_list=
-    catch_push_instruction->code.add(ID_exception_list).get_sub();
+  code_push_catcht::exception_listt &exception_list=
+    push_catch_code.exception_list();
 
   // add a SKIP target for the end of everything
   goto_programt end;
@@ -176,7 +122,7 @@ void goto_convertt::convert_try_catch(
   // add the CATCH-pop to the end of the 'try' block
   goto_programt::targett catch_pop_instruction=dest.add_instruction();
   catch_pop_instruction->make_catch();
-  catch_pop_instruction->code.set_statement(ID_catch);
+  catch_pop_instruction->code=code_pop_catcht();
 
   // add a goto to the end of the 'try' block
   dest.add_instruction()->make_goto(end_target);
@@ -186,7 +132,8 @@ void goto_convertt::convert_try_catch(
     const codet &block=to_code(code.operands()[i]);
 
     // grab the ID and add to CATCH instruction
-    exception_list.push_back(irept(block.get(ID_exception_id)));
+    exception_list.push_back(
+      code_push_catcht::exception_list_entryt(block.get(ID_exception_id)));
 
     goto_programt tmp;
     convert(block, tmp);
@@ -197,6 +144,8 @@ void goto_convertt::convert_try_catch(
     dest.add_instruction()->make_goto(end_target);
   }
 
+  catch_push_instruction->code=push_catch_code;
+
   // add the end-target
   dest.destructive_append(end);
 }
diff --git a/src/goto-programs/goto_convert_side_effect.cpp b/src/goto-programs/goto_convert_side_effect.cpp
index 1d12ba8e9d7..ac12c64be41 100644
--- a/src/goto-programs/goto_convert_side_effect.cpp
+++ b/src/goto-programs/goto_convert_side_effect.cpp
@@ -123,7 +123,7 @@ void goto_convertt::remove_assignment(
     convert(assignment, dest);
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   // revert assignment in the expression to its LHS
   if(result_is_used)
@@ -636,17 +636,6 @@ void goto_convertt::remove_statement_expression(
   static_cast<exprt &>(expr)=tmp_symbol_expr;
 }
 
-void goto_convertt::remove_push_catch(
-  side_effect_exprt &expr,
-  goto_programt &dest)
-{
-  // we only get here for ID_push_catch, which is only used for Java
-  convert_java_try_catch(code_expressiont(expr), dest);
-
-  // the result can't be used, these are void
-  expr.make_nil();
-}
-
 void goto_convertt::remove_side_effect(
   side_effect_exprt &expr,
   goto_programt &dest,
@@ -707,8 +696,6 @@ void goto_convertt::remove_side_effect(
     // the result can't be used, these are void
     expr.make_nil();
   }
-  else if(statement==ID_push_catch)
-    remove_push_catch(expr, dest);
   else
   {
     error().source_location=expr.find_source_location();
diff --git a/src/goto-programs/goto_program.cpp b/src/goto-programs/goto_program.cpp
index e6055e98b3a..6cf8414899a 100644
--- a/src/goto-programs/goto_program.cpp
+++ b/src/goto-programs/goto_program.cpp
@@ -161,7 +161,17 @@ std::ostream &goto_programt::output_instruction(
     break;
 
   case CATCH:
-    if(!instruction.targets.empty())
+  {
+    if(instruction.code.get_statement()==ID_exception_landingpad)
+    {
+      const auto &landingpad=to_code_landingpad(instruction.code);
+      out << "EXCEPTION LANDING PAD ("
+          << from_type(ns, identifier, landingpad.catch_expr().type())
+          << ' '
+          << from_expr(ns, identifier, landingpad.catch_expr())
+          << ")";
+    }
+    else if(instruction.code.get_statement()==ID_push_catch)
     {
       out << "CATCH-PUSH ";
 
@@ -170,10 +180,9 @@ std::ostream &goto_programt::output_instruction(
         instruction.code.find(ID_exception_list).get_sub();
       assert(instruction.targets.size()==exception_list.size());
       for(instructiont::targetst::const_iterator
-          gt_it=instruction.targets.begin();
+            gt_it=instruction.targets.begin();
           gt_it!=instruction.targets.end();
-          gt_it++,
-          i++)
+          gt_it++, i++)
       {
         if(gt_it!=instruction.targets.begin())
           out << ", ";
@@ -181,11 +190,18 @@ std::ostream &goto_programt::output_instruction(
             << (*gt_it)->target_number;
       }
     }
-    else
+    else if(instruction.code.get_statement()==ID_pop_catch)
+    {
       out << "CATCH-POP";
+    }
+    else
+    {
+      UNREACHABLE;
+    }
 
     out << '\n';
     break;
+  }
 
   case ATOMIC_BEGIN:
     out << "ATOMIC_BEGIN" << '\n';
@@ -196,12 +212,9 @@ std::ostream &goto_programt::output_instruction(
     break;
 
   case START_THREAD:
-    out << "START THREAD ";
-
-    if(instruction.targets.size()==1)
-      out << instruction.targets.front()->target_number;
-
-    out << '\n';
+    out << "START THREAD "
+        << instruction.get_target()->target_number
+        << '\n';
     break;
 
   case END_THREAD:
diff --git a/src/goto-programs/goto_program.h b/src/goto-programs/goto_program.h
index 02b8b10f599..f6e0682ac9f 100644
--- a/src/goto-programs/goto_program.h
+++ b/src/goto-programs/goto_program.h
@@ -76,12 +76,19 @@ class goto_programt:public goto_program_templatet<codet, exprt>
       it!=(program).instructions.end(); it++)
 
 inline bool operator<(
-  const goto_programt::const_targett i1,
-  const goto_programt::const_targett i2)
+  const goto_programt::const_targett &i1,
+  const goto_programt::const_targett &i2)
 {
   return order_const_target<codet, exprt>(i1, i2);
 }
 
+inline bool operator<(
+  const goto_programt::targett &i1,
+  const goto_programt::targett &i2)
+{
+  return &(*i1)<&(*i2);
+}
+
 // NOLINTNEXTLINE(readability/identifiers)
 typedef struct const_target_hash_templatet<codet, exprt> const_target_hash;
 
diff --git a/src/goto-programs/goto_program_template.h b/src/goto-programs/goto_program_template.h
index 742875aa0ab..aa863a5dd0f 100644
--- a/src/goto-programs/goto_program_template.h
+++ b/src/goto-programs/goto_program_template.h
@@ -45,7 +45,7 @@ enum goto_program_instruction_typet
   DEAD=15,          // marks the end-of-live of a local variable
   FUNCTION_CALL=16, // call a function
   THROW=17,         // throw an exception
-  CATCH=18          // catch an exception
+  CATCH=18          // push, pop or enter an exception handler
 };
 
 std::ostream &operator<<(std::ostream &, goto_program_instruction_typet);
@@ -199,6 +199,11 @@ class goto_program_templatet
       targets.push_back(t);
     }
 
+    bool has_target() const
+    {
+      return !targets.empty();
+    }
+
     /// Goto target labels
     typedef std::list<irep_idt> labelst;
     labelst labels;
diff --git a/src/goto-programs/goto_trace.cpp b/src/goto-programs/goto_trace.cpp
index ddea10e38d2..15749d2012d 100644
--- a/src/goto-programs/goto_trace.cpp
+++ b/src/goto-programs/goto_trace.cpp
@@ -44,6 +44,7 @@ void goto_trace_stept::output(
   case goto_trace_stept::typet::ASSIGNMENT: out << "ASSIGNMENT"; break;
   case goto_trace_stept::typet::GOTO: out << "GOTO"; break;
   case goto_trace_stept::typet::DECL: out << "DECL"; break;
+  case goto_trace_stept::typet::DEAD: out << "DEAD"; break;
   case goto_trace_stept::typet::OUTPUT: out << "OUTPUT"; break;
   case goto_trace_stept::typet::INPUT: out << "INPUT"; break;
   case goto_trace_stept::typet::ATOMIC_BEGIN: out << "ATOMC_BEGIN"; break;
@@ -53,7 +54,9 @@ void goto_trace_stept::output(
   case goto_trace_stept::typet::FUNCTION_CALL: out << "FUNCTION CALL"; break;
   case goto_trace_stept::typet::FUNCTION_RETURN:
     out << "FUNCTION RETURN"; break;
-  default: assert(false);
+  default:
+    out << "unknown type: " << static_cast<int>(type) << std::endl;
+    UNREACHABLE;
   }
 
   if(type==typet::ASSERT || type==typet::ASSUME || type==typet::GOTO)
@@ -383,16 +386,16 @@ void show_goto_trace(
       break;
 
     case goto_trace_stept::typet::CONSTRAINT:
-      assert(false);
+      UNREACHABLE;
       break;
 
     case goto_trace_stept::typet::SHARED_READ:
     case goto_trace_stept::typet::SHARED_WRITE:
-      assert(false);
+      UNREACHABLE;
       break;
 
     default:
-      assert(false);
+      UNREACHABLE;
     }
   }
 }
diff --git a/src/goto-programs/goto_trace.h b/src/goto-programs/goto_trace.h
index 4c8a3accc8a..02f230e8943 100644
--- a/src/goto-programs/goto_trace.h
+++ b/src/goto-programs/goto_trace.h
@@ -83,6 +83,9 @@ class goto_trace_stept
   // we may choose to hide a step
   bool hidden;
 
+  // this is related to an internal expression
+  bool internal;
+
   // we categorize
   enum class assignment_typet { STATE, ACTUAL_PARAMETER };
   assignment_typet assignment_type;
@@ -127,6 +130,7 @@ class goto_trace_stept
     step_nr(0),
     type(typet::NONE),
     hidden(false),
+    internal(false),
     assignment_type(assignment_typet::STATE),
     thread_nr(0),
     cond_value(false),
@@ -174,6 +178,13 @@ class goto_tracet
     steps.push_back(step);
   }
 
+  // retrieves the final step in the trace for manipulation
+  // (used to fill a trace from code, hence non-const)
+  inline goto_trace_stept &get_last_step()
+  {
+    return steps.back();
+  }
+
   // delete all steps after (not including) s
   void trim_after(stepst::iterator s)
   {
diff --git a/src/goto-programs/initialize_goto_model.cpp b/src/goto-programs/initialize_goto_model.cpp
index e0efc4768e4..7b7024acdb0 100644
--- a/src/goto-programs/initialize_goto_model.cpp
+++ b/src/goto-programs/initialize_goto_model.cpp
@@ -134,9 +134,6 @@ bool initialize_goto_model(
         return true;
     }
 
-    if(!binaries.empty())
-      config.set_from_symbol_table(goto_model.symbol_table);
-
     msg.status() << "Generating GOTO Program" << messaget::eom;
 
     goto_convert(
diff --git a/src/goto-programs/interpreter.cpp b/src/goto-programs/interpreter.cpp
index 817d04c3a59..e6161934ae2 100644
--- a/src/goto-programs/interpreter.cpp
+++ b/src/goto-programs/interpreter.cpp
@@ -14,17 +14,53 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <cctype>
 #include <cstdio>
 #include <iostream>
+#include <fstream>
 #include <algorithm>
+#include <string.h>
 
+#include <util/invariant.h>
 #include <util/std_types.h>
 #include <util/symbol_table.h>
+#include <util/ieee_float.h>
+#include <util/fixedbv.h>
+#include <util/std_expr.h>
+#include <util/message.h>
+#include <json/json_parser.h>
 
 #include "interpreter_class.h"
+#include "remove_returns.h"
+
+const size_t interpretert::npos=std::numeric_limits<size_t>::max();
 
 void interpretert::operator()()
+{
+  status() << "0- Initialize:" << eom;
+  initialize(true);
+  try
+  {
+    status() << "Type h for help\n" << eom;
+
+    while(!done)
+      command();
+
+    status() << total_steps << "- Program End.\n" << eom;
+  }
+  catch (const char *e)
+  {
+    error() << e << "\n" << eom;
+  }
+
+  while(!done)
+    command();
+}
+
+/// Initializes the memory map of the interpreter and [optionally] runs up to
+/// the entry point (thus doing the cprover initialization)
+void interpretert::initialize(bool init)
 {
   build_memory_map();
 
+  total_steps=0;
   const goto_functionst::function_mapt::const_iterator
     main_it=goto_functions.function_map.find(goto_functionst::entry_point());
 
@@ -36,36 +72,54 @@ void interpretert::operator()()
   if(!goto_function.body_available())
     throw "main has no body";
 
-  PC=goto_function.body.instructions.begin();
+  pc=goto_function.body.instructions.begin();
   function=main_it;
 
   done=false;
-
-  while(!done)
+  if(init)
   {
+    stack_depth=call_stack.size()+1;
     show_state();
-    command();
-    if(!done)
+    step();
+    while(!done && (stack_depth<=call_stack.size()) && (stack_depth!=npos))
+    {
+      show_state();
       step();
+    }
+    while(!done && (call_stack.size()==0))
+    {
+      show_state();
+      step();
+    }
+    clear_input_flags();
+    input_vars.clear();
   }
 }
 
+/// displays the current position of the pc and corresponding code
 void interpretert::show_state()
 {
-  std::cout << "\n----------------------------------------------------\n";
+  if(!show)
+    return;
+  status() << "\n"
+           << total_steps+1
+           << " ----------------------------------------------------\n";
 
-  if(PC==function->second.body.instructions.end())
+  if(pc==function->second.body.instructions.end())
   {
-    std::cout << "End of function `"
-              << function->first << "'\n";
+    status() << "End of function `" << function->first << "'\n";
   }
   else
     function->second.body.output_instruction(
-      ns, function->first, std::cout, PC);
+      ns,
+      function->first,
+      status(),
+      pc);
 
-  std::cout << '\n';
+  status() << eom;
 }
 
+/// reads a user command and executes it.
 void interpretert::command()
 {
   #define BUFSIZE 100
@@ -77,42 +131,140 @@ void interpretert::command()
   }
 
   char ch=tolower(command[0]);
-
   if(ch=='q')
     done=true;
+  else if(ch=='h')
+  {
+    status()
+      << "Interpreter help\n"
+      << "h: display this menu\n"
+      << "j: output json trace\n"
+      << "m: output memory dump\n"
+      << "o: output goto trace\n"
+      << "q: quit\n"
+      << "r: run until completion\n"
+      << "s#: step a number of instructions\n"
+      << "sa: step across a function\n"
+      << "so: step out of a function\n"
+      << eom;
+  }
+  else if(ch=='j')
+  {
+    jsont json_steps;
+    convert(ns, steps, json_steps);
+    ch=tolower(command[1]);
+    if(ch==' ')
+    {
+      std::ofstream file;
+      file.open(command+2);
+      if(file.is_open())
+      {
+        json_steps.output(file);
+        file.close();
+        return;
+      }
+    }
+    json_steps.output(result());
+  }
+  else if(ch=='m')
+  {
+    ch=tolower(command[1]);
+    print_memory(ch=='i');
+  }
+  else if(ch=='o')
+  {
+    ch=tolower(command[1]);
+    if(ch==' ')
+    {
+      std::ofstream file;
+      file.open(command+2);
+      if(file.is_open())
+      {
+        steps.output(ns, file);
+        file.close();
+        return;
+      }
+    }
+    steps.output(ns, result());
+  }
+  else if(ch=='r')
+  {
+    ch=tolower(command[1]);
+    initialize(ch!='0');
+  }
+  else if((ch=='s') || (ch==0))
+  {
+    num_steps=1;
+    stack_depth=npos;
+    ch=tolower(command[1]);
+    if(ch=='e')
+      num_steps=npos;
+    else if(ch=='o')
+      stack_depth=call_stack.size();
+    else if(ch=='a')
+      stack_depth=call_stack.size()+1;
+    else
+    {
+      num_steps=atoi(command+1);
+      if(num_steps==0)
+        num_steps=1;
+    }
+    while(!done && ((num_steps==npos) || ((num_steps--)>0)))
+    {
+      step();
+      show_state();
+    }
+    while(!done && (stack_depth<=call_stack.size()) && (stack_depth!=npos))
+    {
+      step();
+      show_state();
+    }
+    return;
+  }
+  show_state();
 }
 
+/// executes a single step and updates the program counter
 void interpretert::step()
 {
-  if(PC==function->second.body.instructions.end())
+  total_steps++;
+  if(pc==function->second.body.instructions.end())
   {
     if(call_stack.empty())
       done=true;
     else
     {
-      PC=call_stack.top().return_PC;
+      pc=call_stack.top().return_pc;
       function=call_stack.top().return_function;
-      stack_pointer=call_stack.top().old_stack_pointer;
+      // TODO: this increases memory size quite quickly.
+      // Should check alternatives
       call_stack.pop();
     }
 
     return;
   }
 
-  next_PC=PC;
-  next_PC++;
+  next_pc=pc;
+  next_pc++;
 
-  switch(PC->type)
+  steps.add_step(goto_trace_stept());
+  goto_trace_stept &trace_step=steps.get_last_step();
+  trace_step.thread_nr=thread_id;
+  trace_step.pc=pc;
+  switch(pc->type)
   {
   case GOTO:
+    trace_step.type=goto_trace_stept::typet::GOTO;
     execute_goto();
     break;
 
   case ASSUME:
+    trace_step.type=goto_trace_stept::typet::ASSUME;
     execute_assume();
     break;
 
   case ASSERT:
+    trace_step.type=goto_trace_stept::typet::ASSERT;
     execute_assert();
     break;
 
@@ -121,38 +273,46 @@ void interpretert::step()
     break;
 
   case DECL:
+    trace_step.type=goto_trace_stept::typet::DECL;
     execute_decl();
     break;
 
   case SKIP:
   case LOCATION:
+    trace_step.type=goto_trace_stept::typet::LOCATION;
+    break;
   case END_FUNCTION:
+    trace_step.type=goto_trace_stept::typet::FUNCTION_RETURN;
     break;
 
   case RETURN:
+    trace_step.type=goto_trace_stept::typet::FUNCTION_RETURN;
     if(call_stack.empty())
       throw "RETURN without call"; // NOLINT(readability/throw)
 
-    if(PC->code.operands().size()==1 &&
+    if(pc->code.operands().size()==1 &&
        call_stack.top().return_value_address!=0)
     {
-      std::vector<mp_integer> rhs;
-      evaluate(PC->code.op0(), rhs);
+      mp_vectort rhs;
+      evaluate(pc->code.op0(), rhs);
       assign(call_stack.top().return_value_address, rhs);
     }
 
-    next_PC=function->second.body.instructions.end();
+    next_pc=function->second.body.instructions.end();
     break;
 
   case ASSIGN:
+    trace_step.type=goto_trace_stept::typet::ASSIGNMENT;
     execute_assign();
     break;
 
   case FUNCTION_CALL:
+    trace_step.type=goto_trace_stept::typet::FUNCTION_CALL;
     execute_function_call();
     break;
 
   case START_THREAD:
+    trace_step.type=goto_trace_stept::typet::SPAWN;
     throw "START_THREAD not yet implemented"; // NOLINT(readability/throw)
 
   case END_THREAD:
@@ -160,44 +320,91 @@ void interpretert::step()
     break;
 
   case ATOMIC_BEGIN:
+    trace_step.type=goto_trace_stept::typet::ATOMIC_BEGIN;
     throw "ATOMIC_BEGIN not yet implemented"; // NOLINT(readability/throw)
 
   case ATOMIC_END:
+    trace_step.type=goto_trace_stept::typet::ATOMIC_END;
     throw "ATOMIC_END not yet implemented"; // NOLINT(readability/throw)
 
   case DEAD:
-    throw "DEAD not yet implemented"; // NOLINT(readability/throw)
-
+    trace_step.type=goto_trace_stept::typet::DEAD;
+    break;
+  case THROW:
+    trace_step.type=goto_trace_stept::typet::GOTO;
+    while(!done && (pc->type!=CATCH))
+    {
+      if(pc==function->second.body.instructions.end())
+      {
+        if(call_stack.empty())
+          done=true;
+        else
+        {
+          pc=call_stack.top().return_pc;
+          function=call_stack.top().return_function;
+          call_stack.pop();
+        }
+      }
+      else
+      {
+        next_pc=pc;
+        next_pc++;
+      }
+    }
+    break;
+  case CATCH:
+    break;
   default:
     throw "encountered instruction with undefined instruction type";
   }
-
-  PC=next_PC;
+  pc=next_pc;
 }
 
+/// executes a goto instruction
 void interpretert::execute_goto()
 {
-  if(evaluate_boolean(PC->guard))
+  if(evaluate_boolean(pc->guard))
   {
-    if(PC->targets.empty())
+    if(pc->targets.empty())
       throw "taken goto without target";
 
-    if(PC->targets.size()>=2)
+    if(pc->targets.size()>=2)
       throw "non-deterministic goto encountered";
 
-    next_PC=PC->targets.front();
+    next_pc=pc->targets.front();
   }
 }
 
+/// executes side effects of 'other' instructions
 void interpretert::execute_other()
 {
-  const irep_idt &statement=PC->code.get_statement();
-
+  const irep_idt &statement=pc->code.get_statement();
   if(statement==ID_expression)
   {
-    assert(PC->code.operands().size()==1);
-    std::vector<mp_integer> rhs;
-    evaluate(PC->code.op0(), rhs);
+    DATA_INVARIANT(
+      pc->code.operands().size()==1,
+      "expression statement expected to have one operand");
+    mp_vectort rhs;
+    evaluate(pc->code.op0(), rhs);
+  }
+  else if(statement==ID_array_set)
+  {
+    mp_vectort tmp, rhs;
+    evaluate(pc->code.op1(), tmp);
+    mp_integer address=evaluate_address(pc->code.op0());
+    size_t size=get_size(pc->code.op0().type());
+    while(rhs.size()<size) rhs.insert(rhs.end(), tmp.begin(), tmp.end());
+    if(size!=rhs.size())
+      error() << "!! failed to obtain rhs (" << rhs.size() << " vs. "
+              << size << ")\n" << eom;
+    else
+    {
+      assign(address, rhs);
+    }
+  }
+  else if(statement==ID_output)
+  {
+    return;
   }
   else
     throw "unexpected OTHER statement: "+id2string(statement);
@@ -205,63 +412,328 @@ void interpretert::execute_other()
 
 void interpretert::execute_decl()
 {
-  assert(PC->code.get_statement()==ID_decl);
+  PRECONDITION(pc->code.get_statement()==ID_decl);
 }
 
+/// retrieves the member at offset
+/// \par parameters: an object and a memory offset
+irep_idt interpretert::get_component_id(
+  const irep_idt &object,
+  unsigned offset)
+{
+  const symbolt &symbol=ns.lookup(object);
+  const typet real_type=ns.follow(symbol.type);
+  if(real_type.id()!=ID_struct)
+    throw "request for member of non-struct";
+
+  const struct_typet &struct_type=to_struct_type(real_type);
+  const struct_typet::componentst &components=struct_type.components();
+  for(struct_typet::componentst::const_iterator it=components.begin();
+      it!=components.end(); it++)
+  {
+    if(offset<=0)
+      return it->id();
+    size_t size=get_size(it->type());
+    offset-=size;
+  }
+  return object;
+}
+
+/// returns the type object corresponding to id
+typet interpretert::get_type(const irep_idt &id) const
+{
+  dynamic_typest::const_iterator it=dynamic_types.find(id);
+  if(it==dynamic_types.end())
+    return symbol_table.lookup(id).type;
+  return it->second;
+}
+
+/// retrives the constant value at memory location offset as an object of type
+/// type
+exprt interpretert::get_value(
+  const typet &type,
+  std::size_t offset,
+  bool use_non_det)
+{
+  const typet real_type=ns.follow(type);
+  if(real_type.id()==ID_struct)
+  {
+    exprt result=struct_exprt(real_type);
+    const struct_typet &struct_type=to_struct_type(real_type);
+    const struct_typet::componentst &components=struct_type.components();
+
+    // Retrieve the values for the individual members
+    result.reserve_operands(components.size());
+    for(struct_typet::componentst::const_iterator it=components.begin();
+        it!=components.end(); it++)
+    {
+      size_t size=get_size(it->type());
+      const exprt operand=get_value(it->type(), offset);
+      offset+=size;
+      result.copy_to_operands(operand);
+    }
+    return result;
+  }
+  else if(real_type.id()==ID_array)
+  {
+    // Get size of array
+    exprt result=array_exprt(to_array_type(real_type));
+    const exprt &size_expr=static_cast<const exprt &>(type.find(ID_size));
+    size_t subtype_size=get_size(type.subtype());
+    std::size_t count;
+    if(size_expr.id()!=ID_constant)
+    {
+      count=base_address_to_actual_size(offset)/subtype_size;
+    }
+    else
+    {
+      mp_integer mp_count;
+      to_integer(size_expr, mp_count);
+      count=integer2size_t(mp_count);
+    }
+
+    // Retrieve the value for each member in the array
+    result.reserve_operands(count);
+    for(unsigned i=0; i<count; i++)
+    {
+      const exprt operand=get_value(
+        type.subtype(),
+        offset+i*subtype_size);
+      result.copy_to_operands(operand);
+    }
+    return result;
+  }
+  if(use_non_det && (memory[offset].initialized>=0))
+    return side_effect_expr_nondett(type);
+  mp_vectort rhs;
+  rhs.push_back(memory[offset].value);
+  return get_value(type, rhs);
+}
+
+/// returns the value at offset in the form of type given a memory buffer rhs
+/// which is typically a structured type
+exprt interpretert::get_value(
+  const typet &type,
+  mp_vectort &rhs,
+  std::size_t offset)
+{
+  const typet real_type=ns.follow(type);
+  PRECONDITION(!rhs.empty());
+
+  if(real_type.id()==ID_struct)
+  {
+    exprt result=struct_exprt(real_type);
+    const struct_typet &struct_type=to_struct_type(real_type);
+    const struct_typet::componentst &components=struct_type.components();
+
+    // Retrieve the values for the individual members
+    result.reserve_operands(components.size());
+    for(const struct_union_typet::componentt &expr : components)
+    {
+      size_t size=get_size(expr.type());
+      const exprt operand=get_value(expr.type(), rhs, offset);
+      offset+=size;
+      result.copy_to_operands(operand);
+    }
+    return result;
+  }
+  else if(real_type.id()==ID_array)
+  {
+    exprt result(ID_constant, type);
+    const exprt &size_expr=static_cast<const exprt &>(type.find(ID_size));
+
+    // Get size of array
+    size_t subtype_size=get_size(type.subtype());
+    unsigned count;
+    if(unbounded_size(type))
+    {
+      count=base_address_to_actual_size(offset)/subtype_size;
+    }
+    else
+    {
+      mp_integer mp_count;
+      to_integer(size_expr, mp_count);
+      count=integer2unsigned(mp_count);
+    }
+
+    // Retrieve the value for each member in the array
+    result.reserve_operands(count);
+    for(unsigned i=0; i<count; i++)
+    {
+      const exprt operand=get_value(type.subtype(), rhs,
+          offset+i*subtype_size);
+      result.copy_to_operands(operand);
+    }
+    return result;
+  }
+  else if(real_type.id()==ID_floatbv)
+  {
+    ieee_floatt f(to_floatbv_type(type));
+    f.unpack(rhs[offset]);
+    return f.to_expr();
+  }
+  else if(real_type.id()==ID_fixedbv)
+  {
+    fixedbvt f;
+    f.from_integer(rhs[offset]);
+    return f.to_expr();
+  }
+  else if(real_type.id()==ID_bool)
+  {
+    if(rhs[offset]!=0)
+      return true_exprt();
+    else
+      false_exprt();
+  }
+  else if(real_type.id()==ID_c_bool)
+  {
+    return from_integer(rhs[offset]!=0?1:0, type);
+  }
+  else if((real_type.id()==ID_pointer) || (real_type.id()==ID_address_of))
+  {
+    if(rhs[offset]==0)
+    {
+      // NULL pointer
+      constant_exprt result(type);
+      result.set_value(ID_NULL);
+      return result;
+    }
+    if(rhs[offset]<memory.size())
+    {
+      // We want the symbol pointed to
+      std::size_t address=integer2size_t(rhs[offset]);
+      irep_idt identifier=address_to_identifier(address);
+      size_t offset=address_to_offset(address);
+      const typet type=get_type(identifier);
+      exprt symbol_expr(ID_symbol, type);
+      symbol_expr.set(ID_identifier, identifier);
+
+      if(offset==0)
+        return address_of_exprt(symbol_expr);
+      if(ns.follow(type).id()==ID_struct)
+      {
+        irep_idt member_id=get_component_id(identifier, offset);
+        member_exprt member_expr(symbol_expr, member_id);
+        return address_of_exprt(member_expr);
+      }
+      index_exprt index_expr(
+        symbol_expr,
+        from_integer(offset, integer_typet()));
+      return index_expr;
+    }
+
+    error() << "interpreter: invalid pointer " << rhs[offset]
+            << " > object count " << memory.size() << eom;
+    throw "interpreter: reading from invalid pointer";
+  }
+  else if(real_type.id()==ID_string)
+  {
+    // Strings are currently encoded by their irep_idt ID.
+    return constant_exprt(
+      irep_idt::make_from_table_index(rhs[offset].to_long()),
+      type);
+  }
+  // Retrieve value of basic data type
+  return from_integer(rhs[offset], type);
+}
+
+/// executes the assign statement at the current pc value
 void interpretert::execute_assign()
 {
   const code_assignt &code_assign=
-    to_code_assign(PC->code);
+    to_code_assign(pc->code);
 
-  std::vector<mp_integer> rhs;
+  mp_vectort rhs;
   evaluate(code_assign.rhs(), rhs);
 
   if(!rhs.empty())
   {
     mp_integer address=evaluate_address(code_assign.lhs());
-    unsigned size=get_size(code_assign.lhs().type());
+    size_t size=get_size(code_assign.lhs().type());
 
     if(size!=rhs.size())
-      std::cout << "!! failed to obtain rhs ("
-                << rhs.size() << " vs. "
-                << size << ")\n";
+      error() << "!! failed to obtain rhs ("
+              << rhs.size() << " vs. "
+              << size << ")\n"
+              << eom;
     else
+    {
+      goto_trace_stept &trace_step=steps.get_last_step();
       assign(address, rhs);
+      trace_step.full_lhs=code_assign.lhs();
+
+      // TODO: need to look at other cases on ssa_exprt
+      // (dereference should be handled on ssa)
+      if(ssa_exprt::can_build_identifier(trace_step.full_lhs))
+      {
+        trace_step.lhs_object=ssa_exprt(trace_step.full_lhs);
+      }
+      trace_step.full_lhs_value=get_value(trace_step.full_lhs.type(), rhs);
+      trace_step.lhs_object_value=trace_step.full_lhs_value;
+    }
+  }
+  else if(code_assign.rhs().id()==ID_side_effect)
+  {
+    side_effect_exprt side_effect=to_side_effect_expr(code_assign.rhs());
+    if(side_effect.get_statement()==ID_nondet)
+    {
+      unsigned address=integer2unsigned(evaluate_address(code_assign.lhs()));
+      size_t size=get_size(code_assign.lhs().type());
+      for(size_t i=0; i<size; i++)
+      {
+        memory[address+i].initialized=-1;
+      }
+    }
   }
 }
 
+/// sets the memory at address with the given rhs value (up to sizeof(rhs))
 void interpretert::assign(
   mp_integer address,
-  const std::vector<mp_integer> &rhs)
+  const mp_vectort &rhs)
 {
-  for(unsigned i=0; i<rhs.size(); i++, ++address)
+  for(size_t i=0; i<rhs.size(); i++)
   {
-    if(address<memory.size())
+    if((address+i)<memory.size())
     {
-      memory_cellt &cell=memory[integer2unsigned(address)];
-      std::cout << "** assigning " << cell.identifier
-                << "[" << cell.offset << "]:=" << rhs[i] << '\n';
+      std::size_t address_val=integer2size_t(address+i);
+      memory_cellt &cell=memory[address_val];
+      if(show)
+      {
+        status() << total_steps << " ** assigning "
+                 << address_to_identifier(address_val) << "["
+                 << address_to_offset(address_val) << "]:=" << rhs[i]
+                 << "\n" << eom;
+      }
       cell.value=rhs[i];
+      if(cell.initialized==0)
+        cell.initialized=1;
     }
   }
 }
 
 void interpretert::execute_assume()
 {
-  if(!evaluate_boolean(PC->guard))
+  if(!evaluate_boolean(pc->guard))
     throw "assumption failed";
 }
 
 void interpretert::execute_assert()
 {
-  if(!evaluate_boolean(PC->guard))
-    throw "assertion failed";
+  if(!evaluate_boolean(pc->guard))
+  {
+    if((target_assert==pc) || stop_on_assertion)
+      throw "program assertion reached";
+    else if(show)
+      error() << "assertion failed at " << pc->location_number
+              << "\n" << eom;
+  }
 }
 
 void interpretert::execute_function_call()
 {
   const code_function_callt &function_call=
-    to_code_function_call(PC->code);
+    to_code_function_call(pc->code);
 
   // function to be called
   mp_integer a=evaluate_address(function_call.function());
@@ -271,8 +743,15 @@ void interpretert::execute_function_call()
   else if(a>=memory.size())
     throw "out-of-range function call";
 
-  const memory_cellt &cell=memory[integer2size_t(a)];
-  const irep_idt &identifier=cell.identifier;
+  // Retrieve the empty last trace step struct we pushed for this step
+  // of the interpreter run to fill it with the corresponding data
+  goto_trace_stept &trace_step=steps.get_last_step();
+  std::size_t address=integer2size_t(a);
+#if 0
+  const memory_cellt &cell=memory[address];
+#endif
+  const irep_idt &identifier=address_to_identifier(address);
+  trace_step.identifier=identifier;
 
   const goto_functionst::function_mapt::const_iterator f_it=
     goto_functions.function_map.find(identifier);
@@ -290,7 +769,7 @@ void interpretert::execute_function_call()
     return_value_address=0;
 
   // values of the arguments
-  std::vector<std::vector<mp_integer> > argument_values;
+  std::vector<mp_vectort> argument_values;
 
   argument_values.resize(function_call.arguments().size());
 
@@ -304,7 +783,7 @@ void interpretert::execute_function_call()
     call_stack.push(stack_framet());
     stack_framet &frame=call_stack.top();
 
-    frame.return_PC=next_PC;
+    frame.return_pc=next_pc;
     frame.return_function=function;
     frame.old_stack_pointer=stack_pointer;
     frame.return_value_address=return_value_address;
@@ -316,24 +795,7 @@ void interpretert::execute_function_call()
     for(const auto &id : locals)
     {
       const symbolt &symbol=ns.lookup(id);
-      unsigned size=get_size(symbol.type);
-
-      if(size!=0)
-      {
-        frame.local_map[id]=stack_pointer;
-
-        for(unsigned i=0; i<stack_pointer; i++)
-        {
-          unsigned address=stack_pointer+i;
-          if(address>=memory.size())
-            memory.resize(address+1);
-          memory[address].value=0;
-          memory[address].identifier=id;
-          memory[address].offset=i;
-        }
-
-        stack_pointer+=size;
-      }
+      frame.local_map[id]=integer2unsigned(build_memory_map(id, symbol.type));
     }
 
     // assign the arguments
@@ -343,29 +805,49 @@ void interpretert::execute_function_call()
     if(argument_values.size()<parameters.size())
       throw "not enough arguments";
 
-    for(unsigned i=0; i<parameters.size(); i++)
+    for(size_t i=0; i<parameters.size(); i++)
     {
       const code_typet::parametert &a=parameters[i];
       exprt symbol_expr(ID_symbol, a.type());
       symbol_expr.set(ID_identifier, a.get_identifier());
-      assert(i<argument_values.size());
       assign(evaluate_address(symbol_expr), argument_values[i]);
     }
 
-    // set up new PC
+    // set up new pc
     function=f_it;
-    next_PC=f_it->second.body.instructions.begin();
+    next_pc=f_it->second.body.instructions.begin();
   }
   else
-    throw "no body for "+id2string(identifier);
+  {
+    list_input_varst::iterator it=
+        function_input_vars.find(function_call.function().get(ID_identifier));
+    if(it!=function_input_vars.end())
+    {
+      mp_vectort value;
+      PRECONDITION(!it->second.empty());
+      PRECONDITION(!it->second.front().return_assignments.empty());
+      evaluate(it->second.front().return_assignments.back().value, value);
+      if(return_value_address>0)
+      {
+        assign(return_value_address, value);
+      }
+      it->second.pop_front();
+      return;
+    }
+    if(show)
+      error() << "no body for "+id2string(identifier) << eom;
+  }
 }
 
+/// Creates a memory map of all static symbols in the program
 void interpretert::build_memory_map()
 {
   // put in a dummy for NULL
   memory.resize(1);
-  memory[0].offset=0;
-  memory[0].identifier="NULL-OBJECT";
+  inverse_memory_map[0]="NULL-OBJECT";
+
+  num_dynamic_objects=0;
+  dynamic_types.clear();
 
   // now do regular static symbols
   for(const auto &s : symbol_table.symbols)
@@ -377,7 +859,7 @@ void interpretert::build_memory_map()
 
 void interpretert::build_memory_map(const symbolt &symbol)
 {
-  unsigned size=0;
+  size_t size=0;
 
   if(symbol.type.id()==ID_code)
   {
@@ -390,22 +872,101 @@ void interpretert::build_memory_map(const symbolt &symbol)
 
   if(size!=0)
   {
-    unsigned address=memory.size();
+    std::size_t address=memory.size();
     memory.resize(address+size);
     memory_map[symbol.name]=address;
+    inverse_memory_map[address]=symbol.name;
+  }
+}
 
-    for(unsigned i=0; i<size; i++)
+/// turns a variable length array type into a fixed array type
+typet interpretert::concretize_type(const typet &type)
+{
+  if(type.id()==ID_array)
+  {
+    const exprt &size_expr=static_cast<const exprt &>(type.find(ID_size));
+    mp_vectort computed_size;
+    evaluate(size_expr, computed_size);
+    if(computed_size.size()==1 &&
+       computed_size[0]>=0)
     {
-      memory_cellt &cell=memory[address+i];
-      cell.identifier=symbol.name;
-      cell.offset=i;
-      cell.value=0;
+      result() << "Concretized array with size " << computed_size[0]
+               << eom;
+      return
+        array_typet(
+          type.subtype(),
+          from_integer(computed_size[0], integer_typet()));
+    }
+    else
+    {
+      warning() << "Failed to concretize variable array" << eom;
     }
   }
+  return type;
 }
 
-unsigned interpretert::get_size(const typet &type) const
+/// Populates dynamic entries of the memory map
+/// \return Updates the memory map to include variable id if it does not exist
+mp_integer interpretert::build_memory_map(
+  const irep_idt &id,
+  const typet &type)
 {
+  typet alloc_type=concretize_type(type);
+  size_t size=get_size(alloc_type);
+  auto it=dynamic_types.find(id);
+
+  if(it!=dynamic_types.end())
+  {
+    std::size_t address=memory_map[id];
+    std::size_t current_size=base_address_to_alloc_size(address);
+    // current size <= size already recorded
+    if(size<=current_size)
+      return memory_map[id];
+  }
+
+  // The current size is bigger then the one previously recorded
+  // in the memory map
+
+  if(size==0)
+    size=1; // This is a hack to create existence
+
+  std::size_t address=memory.size();
+  memory.resize(address+size);
+  memory_map[id]=address;
+  inverse_memory_map[address]=id;
+  dynamic_types.insert(std::pair<const irep_idt, typet>(id, alloc_type));
+
+  return address;
+}
+
+bool interpretert::unbounded_size(const typet &type)
+{
+  if(type.id()==ID_array)
+  {
+    const exprt &size=to_array_type(type).size();
+    if(size.id()==ID_infinity)
+      return true;
+    return unbounded_size(type.subtype());
+  }
+  else if(type.id()==ID_struct)
+  {
+    const auto &st=to_struct_type(type);
+    if(st.components().empty())
+      return false;
+    return unbounded_size(st.components().back().type());
+  }
+  return false;
+}
+
+/// Retrieves the actual size of the provided structured type. Unbounded objects
+/// get allocated 2^32 address space each (of a 2^64 sized space).
+/// \param type: a structured type
+/// \return Size of the given type
+size_t interpretert::get_size(const typet &type)
+{
+  if(unbounded_size(type))
+    return 2ULL << 32ULL;
+
   if(type.id()==ID_struct)
   {
     const struct_typet::componentst &components=
@@ -428,7 +989,7 @@ unsigned interpretert::get_size(const typet &type) const
     const union_typet::componentst &components=
       to_union_type(type).components();
 
-    unsigned max_size=0;
+    size_t max_size=0;
 
     for(const auto &comp : components)
     {
@@ -444,26 +1005,74 @@ unsigned interpretert::get_size(const typet &type) const
   {
     const exprt &size_expr=static_cast<const exprt &>(type.find(ID_size));
 
-    unsigned subtype_size=get_size(type.subtype());
+    size_t subtype_size=get_size(type.subtype());
 
-    mp_integer i;
-    if(!to_integer(size_expr, i))
-      return subtype_size*integer2unsigned(i);
-    else
-      return subtype_size;
+    mp_vectort i;
+    evaluate(size_expr, i);
+    if(i.size()==1)
+    {
+      // Go via the binary representation to reproduce any
+      // overflow behaviour.
+      exprt size_const=from_integer(i[0], size_expr.type());
+      mp_integer size_mp;
+      bool ret=to_integer(size_const, size_mp);
+      CHECK_RETURN(!ret);
+      return subtype_size*integer2unsigned(size_mp);
+    }
+    return subtype_size;
   }
   else if(type.id()==ID_symbol)
   {
     return get_size(ns.follow(type));
   }
+  return 1;
+}
+
+exprt interpretert::get_value(const irep_idt &id)
+{
+  // The dynamic type and the static symbol type may differ for VLAs,
+  // where the symbol carries a size expression and the dynamic type
+  // registry contains its actual length.
+  auto findit=dynamic_types.find(id);
+  typet get_type;
+  if(findit!=dynamic_types.end())
+    get_type=findit->second;
   else
-    return 1;
+    get_type=symbol_table.lookup(id).type;
+
+  symbol_exprt symbol_expr(id, get_type);
+  mp_integer whole_lhs_object_address=evaluate_address(symbol_expr);
+
+  return get_value(get_type, integer2size_t(whole_lhs_object_address));
 }
 
 void interpreter(
   const symbol_tablet &symbol_table,
-  const goto_functionst &goto_functions)
+  const goto_functionst &goto_functions,
+  message_handlert &message_handler)
 {
-  interpretert interpreter(symbol_table, goto_functions);
+  interpretert interpreter(
+    symbol_table,
+    goto_functions,
+    message_handler);
   interpreter();
 }
+
+/// Prints the current state of the memory map Since messaget mdofifies class
+/// members, print functions are nonconst
+void interpretert::print_memory(bool input_flags)
+{
+  for(const auto &cell_address : memory)
+  {
+    std::size_t i=cell_address.first;
+    const memory_cellt &cell=cell_address.second;
+    const auto identifier=address_to_identifier(i);
+    const auto offset=address_to_offset(i);
+    debug() << identifier << "[" << offset << "]"
+            << "=" << cell.value << eom;
+    if(input_flags)
+      debug() << "(" << static_cast<int>(cell.initialized) << ")"
+              << eom;
+    debug() << eom;
+  }
+}
diff --git a/src/goto-programs/interpreter.h b/src/goto-programs/interpreter.h
index 20113a54fc6..8d598852b1a 100644
--- a/src/goto-programs/interpreter.h
+++ b/src/goto-programs/interpreter.h
@@ -12,10 +12,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_GOTO_PROGRAMS_INTERPRETER_H
 #define CPROVER_GOTO_PROGRAMS_INTERPRETER_H
 
+#include <util/message.h>
+
 #include "goto_functions.h"
 
 void interpreter(
   const symbol_tablet &symbol_table,
-  const goto_functionst &goto_functions);
+  const goto_functionst &goto_functions,
+  message_handlert &message_handler);
 
 #endif // CPROVER_GOTO_PROGRAMS_INTERPRETER_H
diff --git a/src/goto-programs/interpreter_class.h b/src/goto-programs/interpreter_class.h
index e1ac3ec14b7..43f562f36b0 100644
--- a/src/goto-programs/interpreter_class.h
+++ b/src/goto-programs/interpreter_class.h
@@ -15,49 +15,189 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <stack>
 
 #include <util/arith_tools.h>
+#include <util/invariant.h>
+#include <util/sparse_vector.h>
 
 #include "goto_functions.h"
+#include "goto_trace.h"
+#include "json_goto_trace.h"
+#include "util/message.h"
 
-class interpretert
+class interpretert:public messaget
 {
 public:
   interpretert(
     const symbol_tablet &_symbol_table,
-    const goto_functionst &_goto_functions):
+    const goto_functionst &_goto_functions,
+    message_handlert &_message_handler):
+    messaget(_message_handler),
     symbol_table(_symbol_table),
     ns(_symbol_table),
     goto_functions(_goto_functions),
     stack_pointer(0),
-    done(false)
+    done(false),
+    stop_on_assertion(false)
   {
+    show=true;
   }
 
   void operator()();
+  void print_memory(bool input_flags);
+
+  // An assertion that identifier 'id' carries value in some particular context.
+  // Used to record parameter (id) assignment (value) lists for function calls.
+  struct function_assignmentt
+  {
+    irep_idt id;
+    exprt value;
+  };
+
+  // A list of such assignments.
+  typedef std::vector<function_assignmentt> function_assignmentst;
+
+  typedef std::vector<mp_integer> mp_vectort;
+
+  // Maps an assignment id to the name of the parameter being assigned
+  typedef std::pair<irep_idt, irep_idt> assignment_idt;
+
+  // Identifies an expression before and after some change;
+  typedef std::pair<exprt, exprt> diff_pairt;
+
+  // Records a diff between an assignment pre and post conditions
+  typedef std::map<assignment_idt, diff_pairt> side_effects_differencet;
+
+  // A entry in the input_valuest map
+  typedef std::pair<irep_idt, exprt> input_entryt;
+
+  // List of the input variables with their corresponding initial values
+  typedef std::map<irep_idt, exprt> input_valuest;
+
+  // List of dynamically allocated symbols that are not in the symbol table
+  typedef std::map<irep_idt, typet> dynamic_typest;
+
+  typedef std::map<irep_idt, function_assignmentst> output_valuest;
+  output_valuest output_values;
+
+  // An assignment list annotated with the calling context.
+  struct function_assignments_contextt
+  {
+    irep_idt calling_function;
+    function_assignmentst return_assignments;
+    function_assignmentst param_assignments;
+  };
+
+  // list_input_varst maps function identifiers onto a vector of [name = value]
+  // assignments per call to that function.
+  typedef std::list<function_assignments_contextt>
+          function_assignments_contextst;
+  typedef std::map<irep_idt, std::list<function_assignments_contextt> >
+          list_input_varst;
+
+  const dynamic_typest &get_dynamic_types() { return dynamic_types; }
 
 protected:
   const symbol_tablet &symbol_table;
+
+  // This is a cache so that we don't have to create it when a call needs it
   const namespacet ns;
+
   const goto_functionst &goto_functions;
 
-  typedef std::unordered_map<irep_idt, unsigned, irep_id_hash> memory_mapt;
+  typedef std::unordered_map<irep_idt, std::size_t, irep_id_hash> memory_mapt;
+  typedef std::map<std::size_t, irep_idt> inverse_memory_mapt;
   memory_mapt memory_map;
+  inverse_memory_mapt inverse_memory_map;
+
+  const inverse_memory_mapt::value_type &address_to_object_record(
+    std::size_t address) const
+  {
+    auto lower_bound=inverse_memory_map.lower_bound(address);
+    if(lower_bound->first!=address)
+    {
+      CHECK_RETURN(lower_bound!=inverse_memory_map.begin());
+      --lower_bound;
+    }
+    return *lower_bound;
+  }
+
+  irep_idt address_to_identifier(std::size_t address) const
+  {
+    return address_to_object_record(address).second;
+  }
+
+  std::size_t address_to_offset(std::size_t address) const
+  {
+    return address-(address_to_object_record(address).first);
+  }
+
+  std::size_t base_address_to_alloc_size(std::size_t address) const
+  {
+    PRECONDITION(address_to_offset(address)==0);
+    auto upper_bound=inverse_memory_map.upper_bound(address);
+    std::size_t next_alloc_address=
+      upper_bound==inverse_memory_map.end() ?
+      memory.size() :
+      upper_bound->first;
+    return next_alloc_address-address;
+  }
+
+  std::size_t base_address_to_actual_size(std::size_t address) const
+  {
+    auto memory_iter=memory.find(address);
+    if(memory_iter==memory.end())
+      return 0;
+    std::size_t ret=0;
+    std::size_t alloc_size=base_address_to_alloc_size(address);
+    while(memory_iter!=memory.end() && memory_iter->first<(address+alloc_size))
+    {
+      ++ret;
+      ++memory_iter;
+    }
+    return ret;
+  }
 
   class memory_cellt
   {
   public:
-    irep_idt identifier;
-    unsigned offset;
+    memory_cellt() :
+    value(0),
+    initialized(0)
+    {}
     mp_integer value;
+    // Initialized is annotated even during reads
+    // Set to 1 when written-before-read, -1 when read-before-written
+    mutable char initialized;
   };
 
-  typedef std::vector<memory_cellt> memoryt;
-  memoryt memory;
+  typedef sparse_vectort<memory_cellt> memoryt;
+  typedef std::map<std::string, const irep_idt &> parameter_sett;
+  // mapping <structure, field> -> value
+  typedef std::pair<const irep_idt, const irep_idt> struct_member_idt;
+  typedef std::map<struct_member_idt, const exprt> struct_valuest;
+
+  //  The memory is being annotated/reshaped even during reads
+  //  (ie to find a read-before-write location) thus memory
+  //  properties need to be mutable to avoid making all calls nonconst
+  mutable memoryt memory;
 
   std::size_t stack_pointer;
 
   void build_memory_map();
   void build_memory_map(const symbolt &symbol);
-  unsigned get_size(const typet &type) const;
+  mp_integer build_memory_map(const irep_idt &id, const typet &type);
+  typet concretize_type(const typet &type);
+  bool unbounded_size(const typet &);
+  size_t get_size(const typet &type);
+
+  irep_idt get_component_id(const irep_idt &object, unsigned offset);
+  typet get_type(const irep_idt &id) const;
+  exprt get_value(
+    const typet &type,
+    std::size_t offset=0,
+    bool use_non_det=false);
+  exprt get_value(const typet &type, mp_vectort &rhs, std::size_t offset=0);
+  exprt get_value(const irep_idt &id);
+
   void step();
 
   void execute_assert();
@@ -67,21 +207,30 @@ class interpretert
   void execute_function_call();
   void execute_other();
   void execute_decl();
+  void clear_input_flags();
+
+  void allocate(
+    mp_integer address,
+    size_t size);
 
   void assign(
     mp_integer address,
-    const std::vector<mp_integer> &rhs);
+    const mp_vectort &rhs);
 
   void read(
     mp_integer address,
-    std::vector<mp_integer> &dest) const;
+    mp_vectort &dest) const;
+
+  void read_unbounded(
+    mp_integer address,
+    mp_vectort &dest) const;
 
-  void command();
+  virtual void command();
 
   class stack_framet
   {
   public:
-    goto_programt::const_targett return_PC;
+    goto_programt::const_targett return_pc;
     goto_functionst::function_mapt::const_iterator return_function;
     mp_integer return_value_address;
     memory_mapt local_map;
@@ -89,27 +238,56 @@ class interpretert
   };
 
   typedef std::stack<stack_framet> call_stackt;
+
   call_stackt call_stack;
+  input_valuest input_vars;
+  list_input_varst function_input_vars;
 
   goto_functionst::function_mapt::const_iterator function;
-  goto_programt::const_targett PC, next_PC;
+  goto_programt::const_targett pc, next_pc, target_assert;
+  goto_tracet steps;
   bool done;
+  bool show;
+  bool stop_on_assertion;
+  static const size_t npos;
+  size_t num_steps;
+  size_t total_steps;
+
+  dynamic_typest dynamic_types;
+  int num_dynamic_objects;
+  size_t stack_depth;
+  int thread_id;
 
-  bool evaluate_boolean(const exprt &expr) const
+  bool evaluate_boolean(const exprt &expr)
   {
-    std::vector<mp_integer> v;
+    mp_vectort v;
     evaluate(expr, v);
     if(v.size()!=1)
       throw "invalid boolean value";
     return v.front()!=0;
   }
 
+  bool count_type_leaves(
+    const typet &source_type,
+    mp_integer &result);
+
+  bool byte_offset_to_memory_offset(
+    const typet &source_type,
+    mp_integer byte_offset,
+    mp_integer &result);
+
+  bool memory_offset_to_byte_offset(
+    const typet &source_type,
+    mp_integer cell_offset,
+    mp_integer &result);
+
   void evaluate(
     const exprt &expr,
-    std::vector<mp_integer> &dest) const;
+    mp_vectort &dest);
 
-  mp_integer evaluate_address(const exprt &expr) const;
+  mp_integer evaluate_address(const exprt &expr, bool fail_quietly=false);
 
+  void initialize(bool init);
   void show_state();
 };
 
diff --git a/src/goto-programs/interpreter_evaluate.cpp b/src/goto-programs/interpreter_evaluate.cpp
index ac848315618..0efac402430 100644
--- a/src/goto-programs/interpreter_evaluate.cpp
+++ b/src/goto-programs/interpreter_evaluate.cpp
@@ -11,41 +11,342 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "interpreter_class.h"
 
-#include <cassert>
 #include <iostream>
+#include <sstream>
 
 #include <util/ieee_float.h>
+#include <util/invariant.h>
 #include <util/fixedbv.h>
 #include <util/std_expr.h>
+#include <util/pointer_offset_size.h>
+#include <string.h>
 
+/// reads a memory address and loads it into the dest variable marks cell as
+/// read before written if cell has never been written
 void interpretert::read(
   mp_integer address,
-  std::vector<mp_integer> &dest) const
+  mp_vectort &dest) const
 {
   // copy memory region
-  for(auto &d : dest)
+  for(size_t i=0; i<dest.size(); i++)
   {
     mp_integer value;
 
-    if(address<memory.size())
-      value=memory[integer2size_t(address)].value;
+    if((address+i)<memory.size())
+    {
+      const memory_cellt &cell=memory[integer2size_t(address+i)];
+      value=cell.value;
+      if(cell.initialized==0)
+        cell.initialized=-1;
+    }
     else
       value=0;
 
-    d=value;
+    dest[i]=value;
+  }
+}
+
+void interpretert::read_unbounded(
+  mp_integer address,
+  mp_vectort &dest) const
+{
+  // copy memory region
+  std::size_t address_val=integer2size_t(address);
+  const std::size_t offset=address_to_offset(address_val);
+  const std::size_t alloc_size=
+    base_address_to_actual_size(address_val-offset);
+  const std::size_t to_read=alloc_size-offset;
+  for(size_t i=0; i<to_read; i++)
+  {
+    mp_integer value;
+
+    if((address+i)<memory.size())
+    {
+      const memory_cellt &cell=memory[integer2size_t(address+i)];
+      value=cell.value;
+      if(cell.initialized==0)
+        cell.initialized=-1;
+    }
+    else
+      value=0;
+
+    dest.push_back(value);
+  }
+}
+
+/// reserves memory block of size at address
+void interpretert::allocate(
+  mp_integer address,
+  size_t size)
+{
+  // clear memory region
+  for(size_t i=0; i<size; i++)
+  {
+    if((address+i)<memory.size())
+    {
+      memory_cellt &cell=memory[integer2size_t(address+i)];
+      cell.value=0;
+      cell.initialized=0;
+    }
+  }
+}
+
+/// Clears memoy r/w flag initialization
+void interpretert::clear_input_flags()
+{
+  for(auto &cell : memory)
+  {
+    if(cell.second.initialized>0)
+      cell.second.initialized=0;
+  }
+}
+
+/// \return Number of leaf primitive types; returns true on error
+bool interpretert::count_type_leaves(const typet &ty, mp_integer &result)
+{
+  if(ty.id()==ID_struct)
+  {
+    result=0;
+    mp_integer subtype_count;
+    for(const auto &component : to_struct_type(ty).components())
+    {
+      if(count_type_leaves(component.type(), subtype_count))
+        return true;
+      result+=subtype_count;
+    }
+    return false;
+  }
+  else if(ty.id()==ID_array)
+  {
+    const auto &at=to_array_type(ty);
+    mp_vectort array_size_vec;
+    evaluate(at.size(), array_size_vec);
+    if(array_size_vec.size()!=1)
+      return true;
+    mp_integer subtype_count;
+    if(count_type_leaves(at.subtype(), subtype_count))
+      return true;
+    result=array_size_vec[0]*subtype_count;
+    return false;
+  }
+  else
+  {
+    result=1;
+    return false;
+  }
+}
+
+/// Supposing the caller has an mp_vector representing a value with type
+/// 'source_type', this yields the offset into that vector at which to find a
+/// value at *byte* address 'offset'. We need this because the interpreter's
+/// memory map uses unlabelled variable-width values -- for example, a C value {
+/// { 1, 2 }, 3, 4 } of type struct { int x[2]; char y; unsigned long z; } would
+/// be represented [1,2,3,4], with the source type needed alongside to figure
+/// out which member is targeted by a byte-extract operation.
+/// \par parameters: 'source_type', 'offset' (unit: bytes),
+/// \return Offset into a vector of interpreter values; returns true on error
+bool interpretert::byte_offset_to_memory_offset(
+  const typet &source_type,
+  mp_integer offset,
+  mp_integer &result)
+{
+  if(source_type.id()==ID_struct)
+  {
+    const auto &st=to_struct_type(source_type);
+    const struct_typet::componentst &components=st.components();
+    member_offset_iterator component_offsets(st, ns);
+    mp_integer previous_member_offsets=0;
+    for(; component_offsets->first<components.size() &&
+          component_offsets->second!=-1 &&
+          component_offsets->second<=offset;
+          ++component_offsets)
+    {
+      const auto &component_type=components[component_offsets->first].type();
+      mp_integer component_byte_size=pointer_offset_size(component_type, ns);
+      if(component_byte_size<0)
+        return true;
+      if((component_offsets->second+component_byte_size)>offset)
+      {
+        mp_integer subtype_result;
+        bool ret=byte_offset_to_memory_offset(
+          component_type,
+          offset-(component_offsets->second),
+          subtype_result);
+        result=previous_member_offsets+subtype_result;
+        return ret;
+      }
+      else
+      {
+        mp_integer component_count;
+        if(count_type_leaves(component_type, component_count))
+          return true;
+        previous_member_offsets+=component_count;
+      }
+    }
+    // Ran out of struct members, or struct contained a variable-length field.
+    return true;
+  }
+  else if(source_type.id()==ID_array)
+  {
+    const auto &at=to_array_type(source_type);
+    mp_vectort array_size_vec;
+    evaluate(at.size(), array_size_vec);
+    if(array_size_vec.size()!=1)
+      return true;
+    mp_integer array_size=array_size_vec[0];
+    mp_integer elem_size_bytes=pointer_offset_size(at.subtype(), ns);
+    if(elem_size_bytes<=0)
+      return true;
+    mp_integer elem_size_leaves;
+    if(count_type_leaves(at.subtype(), elem_size_leaves))
+      return true;
+    mp_integer this_idx=offset/elem_size_bytes;
+    if(this_idx>=array_size_vec[0])
+      return true;
+    mp_integer subtype_result;
+    bool ret=byte_offset_to_memory_offset(
+      at.subtype(),
+      offset%elem_size_bytes,
+      subtype_result);
+    result=subtype_result+(elem_size_leaves*this_idx);
+    return ret;
+  }
+  else
+  {
+    result=0;
+    // Can't currently subdivide a primitive.
+    return offset!=0;
+  }
+}
 
-    ++address;
+/// Similarly to the above, the interpreter's memory objects contain mp_integers
+/// that represent variable-sized struct members. This counts the size of type
+/// leaves to determine the byte offset corresponding to a memory offset.
+/// \par parameters: An interpreter memory offset and the type to interpret that
+///   memory
+/// \return The corresponding byte offset. Returns true on error
+bool interpretert::memory_offset_to_byte_offset(
+  const typet &source_type,
+  mp_integer cell_offset,
+  mp_integer &result)
+{
+  if(source_type.id()==ID_struct)
+  {
+    const auto &st=to_struct_type(source_type);
+    const struct_typet::componentst &components=st.components();
+    member_offset_iterator offsets(st, ns);
+    mp_integer previous_member_sizes;
+    for(; offsets->first<components.size() && offsets->second!=-1; ++offsets)
+    {
+      const auto &component_type=components[offsets->first].type();
+      mp_integer component_count;
+      if(count_type_leaves(component_type, component_count))
+        return true;
+      if(component_count>cell_offset)
+      {
+        mp_integer subtype_result;
+        bool ret=memory_offset_to_byte_offset(
+          component_type,
+          cell_offset,
+          subtype_result);
+        result=previous_member_sizes+subtype_result;
+        return ret;
+      }
+      else
+      {
+        cell_offset-=component_count;
+        mp_integer component_size=pointer_offset_size(component_type, ns);
+        if(component_size<0)
+          return true;
+        previous_member_sizes+=component_size;
+      }
+    }
+    // Ran out of members, or member of indefinite size
+    return true;
+  }
+  else if(source_type.id()==ID_array)
+  {
+    const auto &at=to_array_type(source_type);
+    mp_vectort array_size_vec;
+    evaluate(at.size(), array_size_vec);
+    if(array_size_vec.size()!=1)
+      return true;
+    mp_integer elem_size=pointer_offset_size(at.subtype(), ns);
+    if(elem_size==-1)
+      return true;
+    mp_integer elem_count;
+    if(count_type_leaves(at.subtype(), elem_count))
+      return true;
+    mp_integer this_idx=cell_offset/elem_count;
+    if(this_idx>=array_size_vec[0])
+      return true;
+    mp_integer subtype_result;
+    bool ret=
+      memory_offset_to_byte_offset(at.subtype(),
+        cell_offset%elem_count,
+        subtype_result);
+    result=subtype_result+(elem_size*this_idx);
+    return ret;
+  }
+  else
+  {
+    // Primitive type.
+    result=0;
+    return cell_offset!=0;
   }
 }
 
 void interpretert::evaluate(
   const exprt &expr,
-  std::vector<mp_integer> &dest) const
+  mp_vectort &dest)
 {
   if(expr.id()==ID_constant)
   {
     if(expr.type().id()==ID_struct)
     {
+      dest.reserve(get_size(expr.type()));
+      bool error=false;
+
+      forall_operands(it, expr)
+      {
+        if(it->type().id()==ID_code)
+          continue;
+
+        size_t sub_size=get_size(it->type());
+        if(sub_size==0)
+          continue;
+
+        mp_vectort tmp;
+        evaluate(*it, tmp);
+
+        if(tmp.size()==sub_size)
+        {
+          for(size_t i=0; i<sub_size; i++)
+            dest.push_back(tmp[i]);
+        }
+        else
+          error=true;
+      }
+
+      if(!error)
+        return;
+
+      dest.clear();
+    }
+    else if((expr.type().id()==ID_pointer)
+         || (expr.type().id()==ID_address_of))
+    {
+      mp_integer i=0;
+      if(expr.has_operands() && expr.op0().id()==ID_address_of)
+      {
+        evaluate(expr.op0(), dest);
+        return;
+      }
+      if(expr.has_operands() && !to_integer(expr.op0(), i))
+      {
+        dest.push_back(i);
+        return;
+      }
     }
     else if(expr.type().id()==ID_floatbv)
     {
@@ -61,11 +362,29 @@ void interpretert::evaluate(
       dest.push_back(f.get_value());
       return;
     }
+    else if(expr.type().id()==ID_c_bool)
+    {
+      const irep_idt &value=to_constant_expr(expr).get_value();
+      dest.push_back(binary2integer(id2string(value), false));
+      return;
+    }
     else if(expr.type().id()==ID_bool)
     {
       dest.push_back(expr.is_true());
       return;
     }
+    else if(expr.type().id()==ID_string)
+    {
+      irep_idt value=to_constant_expr(expr).get_value();
+      const char *str=value.c_str();
+      size_t length=strlen(str)+1;
+      if(show)
+        warning() << "string decoding not fully implemented "
+                  << length << eom;
+      mp_integer tmp=value.get_no();
+      dest.push_back(tmp);
+      return;
+    }
     else
     {
       mp_integer i;
@@ -78,7 +397,8 @@ void interpretert::evaluate(
   }
   else if(expr.id()==ID_struct)
   {
-    dest.reserve(get_size(expr.type()));
+    if(!unbounded_size(expr.type()))
+      dest.reserve(get_size(expr.type()));
     bool error=false;
 
     forall_operands(it, expr)
@@ -86,16 +406,16 @@ void interpretert::evaluate(
       if(it->type().id()==ID_code)
         continue;
 
-      unsigned sub_size=get_size(it->type());
+      size_t sub_size=get_size(it->type());
       if(sub_size==0)
         continue;
 
-      std::vector<mp_integer> tmp;
+      mp_vectort tmp;
       evaluate(*it, tmp);
 
-      if(tmp.size()==sub_size)
+      if(unbounded_size(it->type()) || tmp.size()==sub_size)
       {
-        for(unsigned i=0; i<sub_size; i++)
+        for(size_t i=0; i<tmp.size(); i++)
           dest.push_back(tmp[i]);
       }
       else
@@ -107,6 +427,183 @@ void interpretert::evaluate(
 
     dest.clear();
   }
+  else if(expr.id()==ID_side_effect)
+  {
+    side_effect_exprt side_effect=to_side_effect_expr(expr);
+    if(side_effect.get_statement()==ID_nondet)
+    {
+      if(show)
+        error() << "nondet not implemented" << eom;
+      return;
+    }
+    else if(side_effect.get_statement()==ID_malloc)
+    {
+      if(show)
+        error() << "malloc not fully implemented "
+                << expr.type().subtype().pretty()
+                << eom;
+      std::stringstream buffer;
+      num_dynamic_objects++;
+      buffer << "interpreter::malloc_object" << num_dynamic_objects;
+      irep_idt id(buffer.str().c_str());
+      mp_integer address=build_memory_map(id, expr.type().subtype());
+      // TODO: check array of type
+      dest.push_back(address);
+      return;
+    }
+    if(show)
+      error() << "side effect not implemented "
+              << side_effect.get_statement()
+              << eom;
+  }
+  else if(expr.id()==ID_bitor)
+  {
+    if(expr.operands().size()<2)
+      throw id2string(expr.id())+" expects at least two operands";
+
+    mp_integer final=0;
+    forall_operands(it, expr)
+    {
+      mp_vectort tmp;
+      evaluate(*it, tmp);
+      if(tmp.size()==1)
+        final=bitwise_or(final, tmp.front());
+    }
+    dest.push_back(final);
+    return;
+  }
+  else if(expr.id()==ID_bitand)
+  {
+    if(expr.operands().size()<2)
+      throw id2string(expr.id())+" expects at least two operands";
+
+    mp_integer final=-1;
+    forall_operands(it, expr)
+    {
+      mp_vectort tmp;
+      evaluate(*it, tmp);
+      if(tmp.size()==1)
+        final=bitwise_and(final, tmp.front());
+    }
+    dest.push_back(final);
+    return;
+  }
+  else if(expr.id()==ID_bitxor)
+  {
+    if(expr.operands().size()<2)
+      throw id2string(expr.id())+" expects at least two operands";
+
+    mp_integer final=0;
+    forall_operands(it, expr)
+    {
+      mp_vectort tmp;
+      evaluate(*it, tmp);
+      if(tmp.size()==1)
+        final=bitwise_xor(final, tmp.front());
+    }
+    dest.push_back(final);
+    return;
+  }
+  else if(expr.id()==ID_bitnot)
+  {
+    if(expr.operands().size()!=1)
+      throw id2string(expr.id())+" expects one operand";
+    mp_vectort tmp;
+    evaluate(expr.op0(), tmp);
+    if(tmp.size()==1)
+    {
+      dest.push_back(bitwise_neg(tmp.front()));
+      return;
+    }
+  }
+  else if(expr.id()==ID_shl)
+  {
+    if(expr.operands().size()!=2)
+      throw id2string(expr.id())+" expects two operands";
+
+    mp_vectort tmp0, tmp1;
+    evaluate(expr.op0(), tmp0);
+    evaluate(expr.op1(), tmp1);
+    if(tmp0.size()==1 && tmp1.size()==1)
+    {
+      mp_integer final=arith_left_shift(
+        tmp0.front(),
+        tmp1.front(),
+        to_bitvector_type(expr.op0().type()).get_width());
+      dest.push_back(final);
+      return;
+    }
+  }
+  else if((expr.id()==ID_shr) || (expr.id()==ID_lshr))
+  {
+    if(expr.operands().size()!=2)
+      throw id2string(expr.id())+" expects two operands";
+
+    mp_vectort tmp0, tmp1;
+    evaluate(expr.op0(), tmp0);
+    evaluate(expr.op1(), tmp1);
+    if(tmp0.size()==1 && tmp1.size()==1)
+    {
+      mp_integer final=logic_right_shift(
+        tmp0.front(),
+        tmp1.front(),
+        to_bitvector_type(expr.op0().type()).get_width());
+      dest.push_back(final);
+      return;
+    }
+  }
+  else if(expr.id()==ID_ashr)
+  {
+    if(expr.operands().size()!=2)
+      throw id2string(expr.id())+" expects two operands";
+
+    mp_vectort tmp0, tmp1;
+    evaluate(expr.op0(), tmp0);
+    evaluate(expr.op1(), tmp1);
+    if(tmp0.size()==1 && tmp1.size()==1)
+    {
+      mp_integer final=arith_right_shift(
+        tmp0.front(),
+        tmp1.front(),
+        to_bitvector_type(expr.op0().type()).get_width());
+      dest.push_back(final);
+      return;
+    }
+  }
+  else if(expr.id()==ID_ror)
+  {
+    if(expr.operands().size()!=2)
+      throw id2string(expr.id())+" expects two operands";
+
+    mp_vectort tmp0, tmp1;
+    evaluate(expr.op0(), tmp0);
+    evaluate(expr.op1(), tmp1);
+    if(tmp0.size()==1 && tmp1.size()==1)
+    {
+      mp_integer final=rotate_right(tmp0.front(),
+        tmp1.front(),
+        to_bitvector_type(expr.op0().type()).get_width());
+      dest.push_back(final);
+      return;
+    }
+  }
+  else if(expr.id()==ID_rol)
+  {
+    if(expr.operands().size()!=2)
+      throw id2string(expr.id())+" expects two operands";
+
+    mp_vectort tmp0, tmp1;
+    evaluate(expr.op0(), tmp0);
+    evaluate(expr.op1(), tmp1);
+    if(tmp0.size()==1 && tmp1.size()==1)
+    {
+      mp_integer final=rotate_left(tmp0.front(),
+        tmp1.front(),
+        to_bitvector_type(expr.op0().type()).get_width());
+      dest.push_back(final);
+      return;
+    }
+  }
   else if(expr.id()==ID_equal ||
           expr.id()==ID_notequal ||
           expr.id()==ID_le ||
@@ -117,7 +614,7 @@ void interpretert::evaluate(
     if(expr.operands().size()!=2)
       throw id2string(expr.id())+" expects two operands";
 
-    std::vector<mp_integer> tmp0, tmp1;
+    mp_vectort tmp0, tmp1;
     evaluate(expr.op0(), tmp0);
     evaluate(expr.op1(), tmp1);
 
@@ -151,7 +648,7 @@ void interpretert::evaluate(
 
     forall_operands(it, expr)
     {
-      std::vector<mp_integer> tmp;
+      mp_vectort tmp;
       evaluate(*it, tmp);
 
       if(tmp.size()==1 && tmp.front()!=0)
@@ -170,20 +667,20 @@ void interpretert::evaluate(
     if(expr.operands().size()!=3)
       throw "if expects three operands";
 
-    std::vector<mp_integer> tmp0, tmp1, tmp2;
+    mp_vectort tmp0, tmp1;
     evaluate(expr.op0(), tmp0);
-    evaluate(expr.op1(), tmp1);
-    evaluate(expr.op2(), tmp2);
 
-    if(tmp0.size()==1 && tmp1.size()==1 && tmp2.size()==1)
+    if(tmp0.size()==1)
     {
-      const mp_integer &op0=tmp0.front();
-      const mp_integer &op1=tmp1.front();
-      const mp_integer &op2=tmp2.front();
-
-      dest.push_back(op0!=0?op1:op2);
+      if(tmp0.front()!=0)
+        evaluate(expr.op1(), tmp1);
+      else
+        evaluate(expr.op2(), tmp1);
     }
 
+    if(tmp1.size()==1)
+      dest.push_back(tmp1.front());
+
     return;
   }
   else if(expr.id()==ID_and)
@@ -195,7 +692,7 @@ void interpretert::evaluate(
 
     forall_operands(it, expr)
     {
-      std::vector<mp_integer> tmp;
+      mp_vectort tmp;
       evaluate(*it, tmp);
 
       if(tmp.size()==1 && tmp.front()==0)
@@ -214,7 +711,7 @@ void interpretert::evaluate(
     if(expr.operands().size()!=1)
       throw id2string(expr.id())+" expects one operand";
 
-    std::vector<mp_integer> tmp;
+    mp_vectort tmp;
     evaluate(expr.op0(), tmp);
 
     if(tmp.size()==1)
@@ -228,7 +725,7 @@ void interpretert::evaluate(
 
     forall_operands(it, expr)
     {
-      std::vector<mp_integer> tmp;
+      mp_vectort tmp;
       evaluate(*it, tmp);
       if(tmp.size()==1)
         result+=tmp.front();
@@ -260,7 +757,7 @@ void interpretert::evaluate(
 
     forall_operands(it, expr)
     {
-      std::vector<mp_integer> tmp;
+      mp_vectort tmp;
       evaluate(*it, tmp);
       if(tmp.size()==1)
       {
@@ -296,7 +793,7 @@ void interpretert::evaluate(
     if(expr.operands().size()!=2)
       throw "- expects two operands";
 
-    std::vector<mp_integer> tmp0, tmp1;
+    mp_vectort tmp0, tmp1;
     evaluate(expr.op0(), tmp0);
     evaluate(expr.op1(), tmp1);
 
@@ -309,7 +806,7 @@ void interpretert::evaluate(
     if(expr.operands().size()!=2)
       throw "/ expects two operands";
 
-    std::vector<mp_integer> tmp0, tmp1;
+    mp_vectort tmp0, tmp1;
     evaluate(expr.op0(), tmp0);
     evaluate(expr.op1(), tmp1);
 
@@ -322,7 +819,7 @@ void interpretert::evaluate(
     if(expr.operands().size()!=1)
       throw "unary- expects one operand";
 
-    std::vector<mp_integer> tmp0;
+    mp_vectort tmp0;
     evaluate(expr.op0(), tmp0);
 
     if(tmp0.size()==1)
@@ -337,22 +834,139 @@ void interpretert::evaluate(
     dest.push_back(evaluate_address(expr.op0()));
     return;
   }
+  else if(expr.id()==ID_pointer_offset)
+  {
+    if(expr.operands().size()!=1)
+      throw "pointer_offset expects one operand";
+    if(expr.op0().type().id()!=ID_pointer)
+      throw "pointer_offset expects a pointer operand";
+    mp_vectort result;
+    evaluate(expr.op0(), result);
+    if(result.size()==1)
+    {
+      // Return the distance, in bytes, between the address returned
+      // and the beginning of the underlying object.
+      mp_integer address=result[0];
+      if(address>0 && address<memory.size())
+      {
+        std::size_t address_val=integer2size_t(address);
+        auto obj_type=get_type(address_to_identifier(address_val));
+
+        mp_integer offset=address_to_offset(address_val);
+        mp_integer byte_offset;
+        if(!memory_offset_to_byte_offset(obj_type, offset, byte_offset))
+          dest.push_back(byte_offset);
+      }
+    }
+    return;
+  }
+  else if(expr.id()==ID_byte_extract_little_endian ||
+          expr.id()==ID_byte_extract_big_endian)
+  {
+    if(expr.operands().size()!=2)
+      throw "byte_extract should have two operands";
+    mp_vectort extract_offset;
+    evaluate(expr.op1(), extract_offset);
+    mp_vectort extract_from;
+    evaluate(expr.op0(), extract_from);
+    if(extract_offset.size()==1 && extract_from.size()!=0)
+    {
+      const typet &target_type=expr.type();
+      mp_integer memory_offset;
+      // If memory offset is found (which should normally be the case)
+      // extract the corresponding data from the appropriate memory location
+      if(!byte_offset_to_memory_offset(
+           expr.op0().type(),
+           extract_offset[0],
+           memory_offset))
+      {
+        mp_integer target_type_leaves;
+        if(!count_type_leaves(target_type, target_type_leaves) &&
+           target_type_leaves>0)
+        {
+          dest.insert(dest.end(),
+            extract_from.begin()+memory_offset.to_long(),
+            extract_from.begin()+(memory_offset+target_type_leaves).to_long());
+          return;
+        }
+      }
+    }
+  }
   else if(expr.id()==ID_dereference ||
           expr.id()==ID_index ||
           expr.id()==ID_symbol ||
           expr.id()==ID_member)
   {
-    mp_integer a=evaluate_address(expr);
-    dest.resize(get_size(expr.type()));
-    read(a, dest);
-    return;
+    mp_integer address=evaluate_address(
+      expr,
+      true); // fail quietly
+    if(address.is_zero() && expr.id()==ID_index)
+    {
+      // Try reading from a constant array:
+      mp_vectort idx;
+      evaluate(expr.op1(), idx);
+      if(idx.size()==1)
+      {
+        mp_integer read_from_index=idx[0];
+        if(expr.op0().id()==ID_array)
+        {
+          const auto &ops=expr.op0().operands();
+          DATA_INVARIANT(read_from_index.is_long(), "index is too large");
+          if(read_from_index>=0 && read_from_index<ops.size())
+          {
+            evaluate(ops[read_from_index.to_long()], dest);
+            if(dest.size()!=0)
+              return;
+          }
+        }
+        else if(expr.op0().id()=="array-list")
+        {
+          // This sort of construct comes from boolbv_get, but doesn't seem
+          // to have an exprt yet. Its operands are a list of key-value pairs.
+          const auto &ops=expr.op0().operands();
+          DATA_INVARIANT(
+            ops.size()%2==0,
+            "array-list has odd number of operands");
+          for(size_t listidx=0; listidx!=ops.size(); listidx+=2)
+          {
+            mp_vectort elem_idx;
+            evaluate(ops[listidx], elem_idx);
+            CHECK_RETURN(elem_idx.size()==1);
+            if(elem_idx[0]==read_from_index)
+            {
+              evaluate(ops[listidx+1], dest);
+              if(dest.size()!=0)
+                return;
+              else
+                break;
+            }
+          }
+          // If we fall out the end of this loop then the constant array-list
+          // didn't define an element matching the index we're looking for.
+        }
+      }
+      evaluate_address(expr); // Evaluate again to print error message.
+    }
+    else if(!address.is_zero())
+    {
+      if(!unbounded_size(expr.type()))
+      {
+        dest.resize(get_size(expr.type()));
+        read(address, dest);
+      }
+      else
+      {
+        read_unbounded(address, dest);
+      }
+      return;
+    }
   }
   else if(expr.id()==ID_typecast)
   {
     if(expr.operands().size()!=1)
       throw "typecast expects one operand";
 
-    std::vector<mp_integer> tmp;
+    mp_vectort tmp;
     evaluate(expr.op0(), tmp);
 
     if(tmp.size()==1)
@@ -378,38 +992,90 @@ void interpretert::evaluate(
         dest.push_back(binary2integer(s, false));
         return;
       }
-      else if(expr.type().id()==ID_bool)
+      else if((expr.type().id()==ID_bool) || (expr.type().id()==ID_c_bool))
       {
         dest.push_back(value!=0);
         return;
       }
     }
   }
-  else if(expr.id()==ID_ashr)
+  else if(expr.id()==ID_array)
   {
-    if(expr.operands().size()!=2)
-      throw "ashr expects two operands";
-
-    std::vector<mp_integer> tmp0, tmp1;
-    evaluate(expr.op0(), tmp0);
-    evaluate(expr.op1(), tmp1);
-
-    if(tmp0.size()==1 && tmp1.size()==1)
-      dest.push_back(tmp0.front()/power(2, tmp1.front()));
-
+    forall_operands(it, expr)
+    {
+      evaluate(*it, dest);
+    }
     return;
   }
-
-  std::cout << "!! failed to evaluate expression: "
-            << from_expr(ns, function->first, expr)
-            << '\n';
+  else if(expr.id()==ID_array_of)
+  {
+    const auto &ty=to_array_type(expr.type());
+    std::vector<mp_integer> size;
+    if(ty.size().id()==ID_infinity)
+      size.push_back(0);
+    else
+      evaluate(ty.size(), size);
+    if(size.size()==1)
+    {
+      std::size_t size_int=integer2size_t(size[0]);
+      for(std::size_t i=0; i<size_int; ++i)
+        evaluate(expr.op0(), dest);
+      return;
+    }
+  }
+  else if(expr.id()==ID_with)
+  {
+    const auto &wexpr=to_with_expr(expr);
+    evaluate(wexpr.old(), dest);
+    std::vector<mp_integer> where;
+    std::vector<mp_integer> new_value;
+    evaluate(wexpr.where(), where);
+    evaluate(wexpr.new_value(), new_value);
+    const auto &subtype=expr.type().subtype();
+    if(!new_value.empty() && where.size()==1 && !unbounded_size(subtype))
+    {
+      // Ignore indices < 0, which the string solver sometimes produces
+      if(where[0]<0)
+        return;
+      std::size_t where_idx=integer2size_t(where[0]);
+      std::size_t subtype_size=get_size(subtype);
+      std::size_t need_size=(where_idx+1)*subtype_size;
+      if(dest.size()<need_size)
+        dest.resize(need_size, 0);
+      for(std::size_t i=0; i<new_value.size(); ++i)
+        dest[(where_idx*subtype_size)+i]=new_value[i];
+      return;
+    }
+  }
+  else if(expr.id()==ID_nil)
+  {
+    dest.push_back(0);
+    return;
+  }
+  else if(expr.id()==ID_infinity)
+  {
+    if(expr.type().id()==ID_signedbv)
+    {
+      warning() << "Infinite size arrays not supported" << eom;
+      return;
+    }
+  }
+  error() << "!! failed to evaluate expression: "
+          << from_expr(ns, function->first, expr) << "\n"
+          << expr.id() << "[" << expr.type().id() << "]"
+          << eom;
 }
 
-mp_integer interpretert::evaluate_address(const exprt &expr) const
+mp_integer interpretert::evaluate_address(
+  const exprt &expr,
+  bool fail_quietly)
 {
   if(expr.id()==ID_symbol)
   {
-    const irep_idt &identifier=expr.get(ID_identifier);
+    const irep_idt &identifier=
+      is_ssa_expr(expr) ?
+      to_ssa_expr(expr).get_original_name() :
+      expr.get(ID_identifier);
 
     interpretert::memory_mapt::const_iterator m_it1=
       memory_map.find(identifier);
@@ -425,13 +1091,16 @@ mp_integer interpretert::evaluate_address(const exprt &expr) const
       if(m_it2!=call_stack.top().local_map.end())
         return m_it2->second;
     }
+    mp_integer address=memory.size();
+    build_memory_map(to_symbol_expr(expr).get_identifier(), expr.type());
+    return address;
   }
   else if(expr.id()==ID_dereference)
   {
     if(expr.operands().size()!=1)
       throw "dereference expects one operand";
 
-    std::vector<mp_integer> tmp0;
+    mp_vectort tmp0;
     evaluate(expr.op0(), tmp0);
 
     if(tmp0.size()==1)
@@ -442,11 +1111,15 @@ mp_integer interpretert::evaluate_address(const exprt &expr) const
     if(expr.operands().size()!=2)
       throw "index expects two operands";
 
-    std::vector<mp_integer> tmp1;
+    mp_vectort tmp1;
     evaluate(expr.op1(), tmp1);
 
     if(tmp1.size()==1)
-      return evaluate_address(expr.op0())+tmp1.front();
+    {
+      auto base=evaluate_address(expr.op0(), fail_quietly);
+      if(!base.is_zero())
+        return base+tmp1.front();
+    }
   }
   else if(expr.id()==ID_member)
   {
@@ -469,12 +1142,53 @@ mp_integer interpretert::evaluate_address(const exprt &expr) const
       offset+=get_size(comp.type());
     }
 
-    return evaluate_address(expr.op0())+offset;
+    auto base=evaluate_address(expr.op0(), fail_quietly);
+    if(!base.is_zero())
+      return base+offset;
+  }
+  else if(expr.id()==ID_byte_extract_little_endian ||
+          expr.id()==ID_byte_extract_big_endian)
+  {
+    if(expr.operands().size()!=2)
+      throw "byte_extract should have two operands";
+    mp_vectort extract_offset;
+    evaluate(expr.op1(), extract_offset);
+    mp_vectort extract_from;
+    evaluate(expr.op0(), extract_from);
+    if(extract_offset.size()==1 && !extract_from.empty())
+    {
+      mp_integer memory_offset;
+      if(!byte_offset_to_memory_offset(expr.op0().type(),
+        extract_offset[0], memory_offset))
+        return evaluate_address(expr.op0(), fail_quietly)+memory_offset;
+    }
+  }
+  else if(expr.id()==ID_if)
+  {
+    mp_vectort result;
+    if_exprt address_cond(
+      expr.op0(),
+      address_of_exprt(expr.op1()),
+      address_of_exprt(expr.op2()));
+    evaluate(address_cond, result);
+    if(result.size()==1)
+      return result[0];
   }
+  else if(expr.id()==ID_typecast)
+  {
+    if(expr.operands().size()!=1)
+      throw "typecast expects one operand";
 
-  std::cout << "!! failed to evaluate address: "
+    PRECONDITION(expr.type().id()==ID_pointer);
+
+    return evaluate_address(expr.op0(), fail_quietly);
+  }
+  if(!fail_quietly)
+  {
+    error() << "!! failed to evaluate address: "
             << from_expr(ns, function->first, expr)
-            << '\n';
+            << eom;
+  }
 
   return 0;
 }
diff --git a/src/goto-programs/json_goto_trace.cpp b/src/goto-programs/json_goto_trace.cpp
index 744e26500db..4825fe5bea0 100644
--- a/src/goto-programs/json_goto_trace.cpp
+++ b/src/goto-programs/json_goto_trace.cpp
@@ -13,12 +13,95 @@ Author: Daniel Kroening
 
 #include "json_goto_trace.h"
 
-#include <cassert>
-
 #include <util/json_expr.h>
+#include <util/arith_tools.h>
+#include <util/config.h>
+#include <util/invariant.h>
+#include <util/simplify_expr.h>
 
 #include <langapi/language_util.h>
 
+/// Replaces in src, expressions of the form pointer_offset(constant) by that
+/// constant.
+/// \param src: an expression
+void remove_pointer_offsets(exprt &src)
+{
+  if(src.id()==ID_pointer_offset &&
+     src.op0().id()==ID_constant &&
+     src.op0().type().id()==ID_pointer)
+  {
+    std::string binary_str=id2string(to_constant_expr(src.op0()).get_value());
+    // The constant address consists of OBJECT-ID || OFFSET.
+    // Shift out the object-identifier bits, leaving only the offset:
+    mp_integer offset=binary2integer(
+      binary_str.substr(config.bv_encoding.object_bits), false);
+    src=from_integer(offset, src.type());
+  }
+  else
+    for(auto &op : src.operands())
+      remove_pointer_offsets(op);
+}
+
+/// Replaces in src, expressions of the form pointer_offset(array_symbol) by a
+/// constant value of 0. This is meant to simplify array expressions.
+/// \param src: an expression
+/// \param array_symbol: a symbol expression representing an array
+void remove_pointer_offsets(exprt &src, const symbol_exprt &array_symbol)
+{
+  if(src.id()==ID_pointer_offset &&
+     src.op0().id()==ID_constant &&
+     src.op0().op0().id()==ID_address_of &&
+     src.op0().op0().op0().id()==ID_index)
+  {
+    const index_exprt &idx=to_index_expr(src.op0().op0().op0());
+    const irep_idt &array_id=to_symbol_expr(idx.array()).get_identifier();
+    if(idx.array().id()==ID_symbol &&
+       array_id==array_symbol.get_identifier() &&
+       to_constant_expr(idx.index()).value_is_zero_string())
+      src=from_integer(0, src.type());
+  }
+  else
+    for(auto &op : src.operands())
+      remove_pointer_offsets(op, array_symbol);
+}
+
+/// Simplify an expression before putting it in the json format
+/// \param src: an expression potentialy containing array accesses (index_expr)
+/// \return an expression similar in meaning to src but where array accesses
+///   have been simplified
+exprt simplify_array_access(const exprt &src, const namespacet &ns)
+{
+  if(src.id()==ID_index && to_index_expr(src).array().id()==ID_symbol)
+  {
+    // Case where the array is a symbol.
+    const symbol_exprt &array_symbol=to_symbol_expr(to_index_expr(src).array());
+    exprt simplified_index=to_index_expr(src).index();
+    // We remove potential appearances of `pointer_offset(array_symbol)`
+    remove_pointer_offsets(simplified_index, array_symbol);
+    simplified_index=simplify_expr(simplified_index, ns);
+    return index_exprt(array_symbol, simplified_index);
+  }
+  else if(src.id()==ID_index && to_index_expr(src).array().id()==ID_array)
+  {
+    // Case where the array is given by an array of expressions
+    exprt index=to_index_expr(src).index();
+    remove_pointer_offsets(index);
+
+    // We look for an actual integer value for the index
+    index=simplify_expr(index, ns);
+    unsigned i;
+    if(index.id()==ID_constant &&
+       !to_unsigned_integer(to_constant_expr(index), i))
+      return to_index_expr(src).array().operands()[i];
+  }
+  return src;
+}
+
+/// Produce a json representation of a trace.
+/// \param ns: a namespace
+/// \param goto_trace: a trace in a goto program
+/// \param dest: referecence to a json object in which the goto trace will be
+///   added
 void convert(
   const namespacet &ns,
   const goto_tracet &goto_trace,
@@ -59,6 +142,7 @@ void convert(
 
         json_failure["stepType"]=json_stringt("failure");
         json_failure["hidden"]=jsont::json_boolean(step.hidden);
+        json_failure["internal"]=jsont::json_boolean(step.internal);
         json_failure["thread"]=json_numbert(std::to_string(step.thread_nr));
         json_failure["reason"]=json_stringt(id2string(step.comment));
         json_failure["property"]=json_stringt(id2string(property_id));
@@ -82,16 +166,11 @@ void convert(
         std::string value_string, binary_string, type_string, full_lhs_string;
         json_objectt full_lhs_value;
 
-        if(step.full_lhs.is_not_nil())
-          full_lhs_string=from_expr(ns, identifier, step.full_lhs);
-
-#if 0
-        if(it.full_lhs_value.is_not_nil())
-          full_lhs_value_string=from_expr(ns, identifier, it.full_lhs_value);
-#endif
-
-        if(step.full_lhs_value.is_not_nil())
-          full_lhs_value = json(step.full_lhs_value, ns);
+        DATA_INVARIANT(
+          step.full_lhs.is_not_nil(),
+          "full_lhs in assignment must not be nil");
+        exprt simplified=simplify_array_access(step.full_lhs, ns);
+        full_lhs_string=from_expr(ns, identifier, simplified);
 
         const symbolt *symbol;
         irep_idt base_name, display_name;
@@ -104,11 +183,22 @@ void convert(
             type_string=from_type(ns, identifier, symbol->type);
 
           json_assignment["mode"]=json_stringt(id2string(symbol->mode));
+          exprt simplified=simplify_array_access(step.full_lhs_value, ns);
+
+          full_lhs_value=json(simplified, ns, symbol->mode);
+        }
+        else
+        {
+          DATA_INVARIANT(
+            step.full_lhs_value.is_not_nil(),
+            "full_lhs_value in assignment must not be nil");
+          full_lhs_value=json(step.full_lhs_value, ns);
         }
 
         json_assignment["value"]=full_lhs_value;
         json_assignment["lhs"]=json_stringt(full_lhs_string);
         json_assignment["hidden"]=jsont::json_boolean(step.hidden);
+        json_assignment["internal"]=jsont::json_boolean(step.internal);
         json_assignment["thread"]=json_numbert(std::to_string(step.thread_nr));
 
         json_assignment["assignmentType"]=
@@ -126,9 +216,19 @@ void convert(
 
         json_output["stepType"]=json_stringt("output");
         json_output["hidden"]=jsont::json_boolean(step.hidden);
+        json_output["internal"]=jsont::json_boolean(step.internal);
         json_output["thread"]=json_numbert(std::to_string(step.thread_nr));
         json_output["outputID"]=json_stringt(id2string(step.io_id));
 
+        // Recovering the mode from the function
+        irep_idt mode;
+        const symbolt *function_name;
+        if(ns.lookup(source_location.get_function(), function_name))
+          // Failed to find symbol
+          mode=ID_unknown;
+        else
+          mode=function_name->mode;
+        json_output["mode"]=json_stringt(id2string(mode));
         json_arrayt &json_values=json_output["values"].make_array();
 
         for(const auto &arg : step.io_args)
@@ -136,7 +236,7 @@ void convert(
           if(arg.is_nil())
             json_values.push_back(json_stringt(""));
           else
-            json_values.push_back(json(arg, ns));
+            json_values.push_back(json(arg, ns, mode));
         }
 
         if(!json_location.is_null())
@@ -150,9 +250,19 @@ void convert(
 
         json_input["stepType"]=json_stringt("input");
         json_input["hidden"]=jsont::json_boolean(step.hidden);
+        json_input["internal"]=jsont::json_boolean(step.internal);
         json_input["thread"]=json_numbert(std::to_string(step.thread_nr));
         json_input["inputID"]=json_stringt(id2string(step.io_id));
 
+        // Recovering the mode from the function
+        irep_idt mode;
+        const symbolt *function_name;
+        if(ns.lookup(source_location.get_function(), function_name))
+          // Failed to find symbol
+          mode=ID_unknown;
+        else
+          mode=function_name->mode;
+        json_input["mode"]=json_stringt(id2string(mode));
         json_arrayt &json_values=json_input["values"].make_array();
 
         for(const auto &arg : step.io_args)
@@ -160,7 +270,7 @@ void convert(
           if(arg.is_nil())
             json_values.push_back(json_stringt(""));
           else
-            json_values.push_back(json(arg, ns));
+            json_values.push_back(json(arg, ns, mode));
         }
 
         if(!json_location.is_null())
@@ -178,6 +288,7 @@ void convert(
 
         json_call_return["stepType"]=json_stringt(tag);
         json_call_return["hidden"]=jsont::json_boolean(step.hidden);
+        json_call_return["internal"]=jsont::json_boolean(step.internal);
         json_call_return["thread"]=json_numbert(std::to_string(step.thread_nr));
 
         const symbolt &symbol=ns.lookup(step.identifier);
@@ -201,6 +312,7 @@ void convert(
           json_objectt &json_location_only=dest_array.push_back().make_object();
           json_location_only["stepType"]=json_stringt("location-only");
           json_location_only["hidden"]=jsont::json_boolean(step.hidden);
+          json_location_only["internal"]=jsont::json_boolean(step.internal);
           json_location_only["thread"]=
             json_numbert(std::to_string(step.thread_nr));
           json_location_only["sourceLocation"]=json_location;
diff --git a/src/goto-programs/link_goto_model.cpp b/src/goto-programs/link_goto_model.cpp
new file mode 100644
index 00000000000..2c8b49f74b7
--- /dev/null
+++ b/src/goto-programs/link_goto_model.cpp
@@ -0,0 +1,182 @@
+/*******************************************************************\
+
+Module: Link Goto Programs
+
+Author: Michael Tautschnig, Daniel Kroening
+
+\*******************************************************************/
+
+/// \file
+/// Link Goto Programs
+
+#include "link_goto_model.h"
+
+#include <unordered_set>
+
+#include <util/base_type.h>
+#include <util/symbol.h>
+#include <util/rename_symbol.h>
+
+#include <linking/linking_class.h>
+
+#include "goto_model.h"
+
+static void rename_symbols_in_function(
+  goto_functionst::goto_functiont &function,
+  const rename_symbolt &rename_symbol)
+{
+  goto_programt &program=function.body;
+  rename_symbol(function.type);
+
+  Forall_goto_program_instructions(iit, program)
+  {
+    rename_symbol(iit->code);
+    rename_symbol(iit->guard);
+  }
+}
+
+/// Link a set of goto functions, considering weak symbols
+/// and symbol renaming
+static bool link_functions(
+  symbol_tablet &dest_symbol_table,
+  goto_functionst &dest_functions,
+  const symbol_tablet &src_symbol_table,
+  goto_functionst &src_functions,
+  const rename_symbolt &rename_symbol,
+  const std::unordered_set<irep_idt, irep_id_hash> &weak_symbols,
+  const replace_symbolt &object_type_updates)
+{
+  namespacet ns(dest_symbol_table);
+  namespacet src_ns(src_symbol_table);
+
+  // merge functions
+  Forall_goto_functions(src_it, src_functions)
+  {
+    // the function might have been renamed
+    rename_symbolt::expr_mapt::const_iterator e_it=
+      rename_symbol.expr_map.find(src_it->first);
+
+    irep_idt final_id=src_it->first;
+
+    if(e_it!=rename_symbol.expr_map.end())
+      final_id=e_it->second;
+
+    // already there?
+    goto_functionst::function_mapt::iterator dest_f_it=
+      dest_functions.function_map.find(final_id);
+
+    if(dest_f_it==dest_functions.function_map.end()) // not there yet
+    {
+      rename_symbols_in_function(src_it->second, rename_symbol);
+
+      goto_functionst::goto_functiont &in_dest_symbol_table=
+        dest_functions.function_map[final_id];
+
+      in_dest_symbol_table.body.swap(src_it->second.body);
+      in_dest_symbol_table.type=src_it->second.type;
+    }
+    else // collision!
+    {
+      goto_functionst::goto_functiont &in_dest_symbol_table=
+        dest_functions.function_map[final_id];
+
+      goto_functionst::goto_functiont &src_func=src_it->second;
+
+      if(in_dest_symbol_table.body.instructions.empty() ||
+         weak_symbols.find(final_id)!=weak_symbols.end())
+      {
+        // the one with body wins!
+        rename_symbols_in_function(src_func, rename_symbol);
+
+        in_dest_symbol_table.body.swap(src_func.body);
+        in_dest_symbol_table.type=src_func.type;
+      }
+      else if(src_func.body.instructions.empty() ||
+              src_ns.lookup(src_it->first).is_weak)
+      {
+        // just keep the old one in dest
+      }
+      else if(in_dest_symbol_table.type.get_bool(ID_C_inlined))
+      {
+        // ok, we silently ignore
+      }
+      else
+      {
+        // the linking code will have ensured that types match
+        rename_symbol(src_func.type);
+        INVARIANT(base_type_eq(in_dest_symbol_table.type, src_func.type, ns),
+                  "linking ensures that types match");
+      }
+    }
+  }
+
+  // apply macros
+  rename_symbolt macro_application;
+
+  forall_symbols(it, dest_symbol_table.symbols)
+    if(it->second.is_macro && !it->second.is_type)
+    {
+      const symbolt &symbol=it->second;
+
+      INVARIANT(symbol.value.id()==ID_symbol, "must have symbol");
+      const irep_idt &id=to_symbol_expr(symbol.value).get_identifier();
+
+      #if 0
+      if(!base_type_eq(symbol.type, ns.lookup(id).type, ns))
+      {
+        std::cerr << symbol << '\n';
+        std::cerr << ns.lookup(id) << '\n';
+      }
+      INVARIANT(base_type_eq(symbol.type, ns.lookup(id).type, ns),
+                "type matches");
+      #endif
+
+      macro_application.insert_expr(symbol.name, id);
+    }
+
+  if(!macro_application.expr_map.empty())
+    Forall_goto_functions(dest_it, dest_functions)
+      rename_symbols_in_function(dest_it->second, macro_application);
+
+  if(!object_type_updates.expr_map.empty())
+  {
+    Forall_goto_functions(dest_it, dest_functions)
+      Forall_goto_program_instructions(iit, dest_it->second.body)
+      {
+        object_type_updates(iit->code);
+        object_type_updates(iit->guard);
+      }
+  }
+
+  return false;
+}
+
+void link_goto_model(
+  goto_modelt &dest,
+  goto_modelt &src,
+  message_handlert &message_handler)
+{
+  typedef std::unordered_set<irep_idt, irep_id_hash> id_sett;
+  id_sett weak_symbols;
+
+  forall_symbols(it, dest.symbol_table.symbols)
+    if(it->second.is_weak)
+      weak_symbols.insert(it->first);
+
+  linkingt linking(dest.symbol_table,
+                   src.symbol_table,
+                   message_handler);
+
+  if(linking.typecheck_main())
+    throw 0;
+
+  if(link_functions(
+      dest.symbol_table,
+      dest.goto_functions,
+      src.symbol_table,
+      src.goto_functions,
+      linking.rename_symbol,
+      weak_symbols,
+      linking.object_type_updates))
+    throw 0;
+}
diff --git a/src/goto-programs/link_goto_model.h b/src/goto-programs/link_goto_model.h
new file mode 100644
index 00000000000..e04b85727e9
--- /dev/null
+++ b/src/goto-programs/link_goto_model.h
@@ -0,0 +1,23 @@
+/*******************************************************************\
+
+Module: Read Goto Programs
+
+Author: Daniel Kroening, kroening@kroening.com
+
+\*******************************************************************/
+
+/// \file
+/// Read Goto Programs
+
+#ifndef CPROVER_GOTO_PROGRAMS_LINK_GOTO_MODEL_H
+#define CPROVER_GOTO_PROGRAMS_LINK_GOTO_MODEL_H
+
+class goto_modelt;
+class message_handlert;
+
+void link_goto_model(
+  goto_modelt &dest,
+  goto_modelt &src,
+  message_handlert &);
+
+#endif // CPROVER_GOTO_PROGRAMS_LINK_GOTO_MODEL_H
diff --git a/src/goto-programs/loop_ids.cpp b/src/goto-programs/loop_ids.cpp
index 5f4c560a0bd..86deb73eb43 100644
--- a/src/goto-programs/loop_ids.cpp
+++ b/src/goto-programs/loop_ids.cpp
@@ -67,7 +67,7 @@ void show_loop_ids(
       break;
     }
     case ui_message_handlert::uit::JSON_UI:
-      assert(false); // use function below
+      UNREACHABLE; // use function below
   }
 }
 
diff --git a/src/goto-programs/read_bin_goto_object.cpp b/src/goto-programs/read_bin_goto_object.cpp
index ebfaf6a75d1..466d6cef4ab 100644
--- a/src/goto-programs/read_bin_goto_object.cpp
+++ b/src/goto-programs/read_bin_goto_object.cpp
@@ -114,7 +114,7 @@ bool read_bin_goto_object_v3(
          rev_target_map.insert(
            rev_target_map.end(),
            std::make_pair(instruction.target_number, itarget))->second!=itarget)
-        assert(false);
+        UNREACHABLE;
 
       std::size_t t_count = irepconverter.read_gb_word(in); // # of targets
       for(std::size_t i=0; i<t_count; i++)
diff --git a/src/goto-programs/read_goto_binary.cpp b/src/goto-programs/read_goto_binary.cpp
index 1a4887cf0e9..2b4a3805401 100644
--- a/src/goto-programs/read_goto_binary.cpp
+++ b/src/goto-programs/read_goto_binary.cpp
@@ -28,12 +28,12 @@ Module: Read Goto Programs
 #include <util/tempfile.h>
 #include <util/rename_symbol.h>
 #include <util/base_type.h>
+#include <util/config.h>
 
 #include <langapi/language_ui.h>
 
-#include <linking/linking_class.h>
-
 #include "goto_model.h"
+#include "link_goto_model.h"
 #include "read_bin_goto_object.h"
 #include "elf_reader.h"
 #include "osx_fat_reader.h"
@@ -213,139 +213,12 @@ bool is_goto_binary(const std::string &filename)
   return false;
 }
 
-static void rename_symbols_in_function(
-  goto_functionst::goto_functiont &function,
-  const rename_symbolt &rename_symbol)
-{
-  goto_programt &program=function.body;
-  rename_symbol(function.type);
-
-  Forall_goto_program_instructions(iit, program)
-  {
-    rename_symbol(iit->code);
-    rename_symbol(iit->guard);
-  }
-}
-
-static bool link_functions(
-  symbol_tablet &dest_symbol_table,
-  goto_functionst &dest_functions,
-  const symbol_tablet &src_symbol_table,
-  goto_functionst &src_functions,
-  const rename_symbolt &rename_symbol,
-  const std::unordered_set<irep_idt, irep_id_hash> &weak_symbols,
-  const replace_symbolt &object_type_updates)
-{
-  namespacet ns(dest_symbol_table);
-  namespacet src_ns(src_symbol_table);
-
-  // merge functions
-  Forall_goto_functions(src_it, src_functions)
-  {
-    // the function might have been renamed
-    rename_symbolt::expr_mapt::const_iterator e_it=
-      rename_symbol.expr_map.find(src_it->first);
-
-    irep_idt final_id=src_it->first;
-
-    if(e_it!=rename_symbol.expr_map.end())
-      final_id=e_it->second;
-
-    // already there?
-    goto_functionst::function_mapt::iterator dest_f_it=
-      dest_functions.function_map.find(final_id);
-
-    if(dest_f_it==dest_functions.function_map.end()) // not there yet
-    {
-      rename_symbols_in_function(src_it->second, rename_symbol);
-
-      goto_functionst::goto_functiont &in_dest_symbol_table=
-        dest_functions.function_map[final_id];
-
-      in_dest_symbol_table.body.swap(src_it->second.body);
-      in_dest_symbol_table.type=src_it->second.type;
-    }
-    else // collision!
-    {
-      goto_functionst::goto_functiont &in_dest_symbol_table=
-        dest_functions.function_map[final_id];
-
-      goto_functionst::goto_functiont &src_func=src_it->second;
-
-      if(in_dest_symbol_table.body.instructions.empty() ||
-         weak_symbols.find(final_id)!=weak_symbols.end())
-      {
-        // the one with body wins!
-        rename_symbols_in_function(src_func, rename_symbol);
-
-        in_dest_symbol_table.body.swap(src_func.body);
-        in_dest_symbol_table.type=src_func.type;
-      }
-      else if(src_func.body.instructions.empty() ||
-              src_ns.lookup(src_it->first).is_weak)
-      {
-        // just keep the old one in dest
-      }
-      else if(in_dest_symbol_table.type.get_bool(ID_C_inlined))
-      {
-        // ok, we silently ignore
-      }
-      else
-      {
-        // the linking code will have ensured that types match
-        rename_symbol(src_func.type);
-        assert(base_type_eq(in_dest_symbol_table.type, src_func.type, ns));
-      }
-    }
-  }
-
-  // apply macros
-  rename_symbolt macro_application;
-
-  forall_symbols(it, dest_symbol_table.symbols)
-    if(it->second.is_macro && !it->second.is_type)
-    {
-      const symbolt &symbol=it->second;
-
-      assert(symbol.value.id()==ID_symbol);
-      const irep_idt &id=to_symbol_expr(symbol.value).get_identifier();
-
-      #if 0
-      if(!base_type_eq(symbol.type, ns.lookup(id).type, ns))
-      {
-        std::cerr << symbol << '\n';
-        std::cerr << ns.lookup(id) << '\n';
-      }
-      assert(base_type_eq(symbol.type, ns.lookup(id).type, ns));
-      #endif
-
-      macro_application.insert_expr(symbol.name, id);
-    }
-
-  if(!macro_application.expr_map.empty())
-    Forall_goto_functions(dest_it, dest_functions)
-      rename_symbols_in_function(dest_it->second, macro_application);
-
-  if(!object_type_updates.expr_map.empty())
-  {
-    Forall_goto_functions(dest_it, dest_functions)
-      Forall_goto_program_instructions(iit, dest_it->second.body)
-      {
-        object_type_updates(iit->code);
-        object_type_updates(iit->guard);
-      }
-  }
-
-  return false;
-}
-
 /// reads an object file
 /// \par parameters: a file_name
 /// \return true on error, false otherwise
 bool read_object_and_link(
   const std::string &file_name,
-  symbol_tablet &symbol_table,
-  goto_functionst &functions,
+  goto_modelt &dest,
   message_handlert &message_handler)
 {
   messaget(message_handler).statistics() << "Reading: "
@@ -360,28 +233,17 @@ bool read_object_and_link(
       message_handler))
     return true;
 
-  typedef std::unordered_set<irep_idt, irep_id_hash> id_sett;
-  id_sett weak_symbols;
-  forall_symbols(it, symbol_table.symbols)
-    if(it->second.is_weak)
-      weak_symbols.insert(it->first);
-
-  linkingt linking(symbol_table,
-                   temp_model.symbol_table,
-                   message_handler);
-
-  if(linking.typecheck_main())
+  try
+  {
+    link_goto_model(dest, temp_model, message_handler);
+  }
+  catch(...)
+  {
     return true;
+  }
 
-  if(link_functions(
-      symbol_table,
-      functions,
-      temp_model.symbol_table,
-      temp_model.goto_functions,
-      linking.rename_symbol,
-      weak_symbols,
-      linking.object_type_updates))
-    return true;
+  // reading successful, let's update config
+  config.set_from_symbol_table(dest.symbol_table);
 
   return false;
 }
@@ -391,12 +253,22 @@ bool read_object_and_link(
 /// \return true on error, false otherwise
 bool read_object_and_link(
   const std::string &file_name,
-  goto_modelt &goto_model,
+  symbol_tablet &dest_symbol_table,
+  goto_functionst &dest_functions,
   message_handlert &message_handler)
 {
-  return read_object_and_link(
+  goto_modelt goto_model;
+
+  goto_model.symbol_table.swap(dest_symbol_table);
+  goto_model.goto_functions.swap(dest_functions);
+
+  bool result=read_object_and_link(
     file_name,
-    goto_model.symbol_table,
-    goto_model.goto_functions,
+    goto_model,
     message_handler);
+
+  goto_model.symbol_table.swap(dest_symbol_table);
+  goto_model.goto_functions.swap(dest_functions);
+
+  return result;
 }
diff --git a/src/goto-programs/remove_complex.cpp b/src/goto-programs/remove_complex.cpp
index 13ff90f908b..78b655e4108 100644
--- a/src/goto-programs/remove_complex.cpp
+++ b/src/goto-programs/remove_complex.cpp
@@ -24,7 +24,7 @@ static exprt complex_member(const exprt &expr, irep_idt id)
     else if(id==ID_imag)
       return expr.op1();
     else
-      assert(false);
+      UNREACHABLE;
   }
   else
   {
diff --git a/src/goto-programs/remove_exceptions.cpp b/src/goto-programs/remove_exceptions.cpp
index 09fe45f2dec..712aaf4b1f3 100644
--- a/src/goto-programs/remove_exceptions.cpp
+++ b/src/goto-programs/remove_exceptions.cpp
@@ -1,6 +1,6 @@
 /*******************************************************************\
 
-Module: Remove exception handling 
+Module: Remove exception handling
 
 Author: Cristina David
 
@@ -22,8 +22,59 @@ Date:   December 2016
 
 #include <util/c_types.h>
 #include <util/std_expr.h>
+#include <util/std_code.h>
 #include <util/symbol_table.h>
 
+#include <analyses/uncaught_exceptions_analysis.h>
+
+/// Lowers high-level exception descriptions into low-level operations suitable
+/// for symex and other analyses that don't understand the THROW or CATCH GOTO
+/// instructions.
+///
+/// The instructions affected by the lowering are:
+///
+/// THROW, whose operand must be a code_expressiont wrapping a
+/// side_effect_expr_throwt. This starts propagating an exception, aborting
+/// functions until a suitable catch point is found.
+///
+/// CATCH with a code_push_catcht operand, which commences a region in which
+/// exceptions should be caught, commonly a try block.
+/// It specifies one or more exception tags to handle
+/// (in instruction->code.exception_list()) and a corresponding GOTO program
+/// target for each (in instruction->targets).
+/// Thrown instructions are currently always matched to tags using
+/// java_instanceof, so a language frontend wanting to use this class
+/// must use exceptions with a Java-compatible structure.
+///
+/// CATCH with a code_pop_catcht operand terminates a try-block begun by
+/// a code_push_catcht. At present the try block consists of the instructions
+/// between the push and the pop *in program order*, not according to dynamic
+/// control flow, so goto_convert_exceptions must ensure that control-flow
+/// within the try block does not leave this range.
+///
+/// CATCH with a code_landingpadt operand marks a point where exceptional
+/// control flow terminates and normal control flow resumes, typically the top
+/// of a catch or finally block, and the target of a code_push_catcht
+/// describing the correponding try block. It gives an lvalue expression that
+/// should be assigned the caught exception, typically a local variable.
+///
+/// FUNCTION_CALL instructions are also affected: if the callee may abort
+/// due to an escaping instruction, a dispatch sequence is inserted to check
+/// whether the callee aborted and propagate the exception further if so.
+///
+/// Exception propagation is implemented using a global variable per function
+/// (named function_name#exception_value) that carries a reference to an
+/// in-flight exception, or is null during normal control flow.
+/// THROW assigns it a reference to the thrown instance; CALL instructions
+/// copy between the exception_value for the callee and caller, catch_push
+/// and catch_pop instructions indicate how they should be checked to dispatch
+/// the right exception type to the right catch block, and landingpad
+/// instructions copy back to an ordinary local variable (or other expression)
+/// and set \#exception_value back to null, indicating the exception has been
+/// caught and normal control flow resumed.
+///
+/// Note that remove_exceptions introduces java_instanceof comparisons at
+/// present, so a remove_instanceof may be necessary after it completes.
 class remove_exceptionst
 {
   typedef std::vector<std::pair<
@@ -31,8 +82,11 @@ class remove_exceptionst
   typedef std::vector<catch_handlerst> stack_catcht;
 
 public:
-  explicit remove_exceptionst(symbol_tablet &_symbol_table):
-    symbol_table(_symbol_table)
+  explicit remove_exceptionst(
+    symbol_tablet &_symbol_table,
+    std::map<irep_idt, std::set<irep_idt>> &_exceptions_map):
+    symbol_table(_symbol_table),
+    exceptions_map(_exceptions_map)
   {
   }
 
@@ -41,25 +95,32 @@ class remove_exceptionst
 
 protected:
   symbol_tablet &symbol_table;
+  std::map<irep_idt, std::set<irep_idt>> &exceptions_map;
 
   void add_exceptional_returns(
     const goto_functionst::function_mapt::iterator &);
 
   void instrument_exception_handler(
     const goto_functionst::function_mapt::iterator &,
-    const goto_programt::instructionst::iterator &);
+    const goto_programt::targett &);
+
+  void add_exception_dispatch_sequence(
+    const goto_functionst::function_mapt::iterator &,
+    const goto_programt::targett &instr_it,
+    const stack_catcht &stack_catch,
+    const std::vector<exprt> &locals);
 
   void instrument_throw(
     const goto_functionst::function_mapt::iterator &,
-    const goto_programt::instructionst::iterator &,
+    const goto_programt::targett &,
     const stack_catcht &,
-    std::vector<exprt> &);
+    const std::vector<exprt> &);
 
   void instrument_function_call(
     const goto_functionst::function_mapt::iterator &,
-    const goto_programt::instructionst::iterator &,
+    const goto_programt::targett &,
     const stack_catcht &,
-    std::vector<exprt> &);
+    const std::vector<exprt> &);
 
   void instrument_exceptions(
     const goto_functionst::function_mapt::iterator &);
@@ -73,7 +134,9 @@ void remove_exceptionst::add_exceptional_returns(
   const irep_idt &function_id=func_it->first;
   goto_programt &goto_program=func_it->second.body;
 
-  assert(symbol_table.has_symbol(function_id));
+  INVARIANT(
+    symbol_table.has_symbol(function_id),
+    "functions should be recorded in the symbol table");
   const symbolt &function_symbol=symbol_table.lookup(function_id);
 
   // for now only add exceptional returns for Java
@@ -83,38 +146,14 @@ void remove_exceptionst::add_exceptional_returns(
   if(goto_program.empty())
     return;
 
-  // We generate an exceptional return value for any function that has
-  // a throw or a function call. This can be improved by only considering
-  // function calls that may escape exceptions. However, this will
-  // require multiple passes.
-  bool add_exceptional_var=false;
-  forall_goto_program_instructions(instr_it, goto_program)
-    if(instr_it->is_throw() || instr_it->is_function_call())
-    {
-      add_exceptional_var=true;
-      break;
-    }
-
-  if(add_exceptional_var)
+  // some methods (e.g. the entry method) have already been added to
+  // the symbol table; if you find it, initialise it
+  if(symbol_table.has_symbol(id2string(function_id)+EXC_SUFFIX))
   {
-    // look up the function symbol
-    symbol_tablet::symbolst::iterator s_it=
-      symbol_table.symbols.find(function_id);
-
-    assert(s_it!=symbol_table.symbols.end());
-
-    auxiliary_symbolt new_symbol;
-    new_symbol.is_static_lifetime=true;
-    new_symbol.module=function_symbol.module;
-    new_symbol.base_name=id2string(function_symbol.base_name)+EXC_SUFFIX;
-    new_symbol.name=id2string(function_symbol.name)+EXC_SUFFIX;
-    new_symbol.mode=function_symbol.mode;
-    new_symbol.type=pointer_type(empty_typet());
-    symbol_table.add(new_symbol);
-
-    // initialize the exceptional return with NULL
-    symbol_exprt lhs_expr_null=new_symbol.symbol_expr();
-    null_pointer_exprt rhs_expr_null(pointer_type(empty_typet()));
+    const symbolt &symbol=
+      symbol_table.lookup(id2string(function_id)+EXC_SUFFIX);
+    symbol_exprt lhs_expr_null=symbol.symbol_expr();
+    null_pointer_exprt rhs_expr_null((pointer_type(empty_typet())));
     goto_programt::targett t_null=
       goto_program.insert_before(goto_program.instructions.begin());
     t_null->make_assignment();
@@ -124,85 +163,158 @@ void remove_exceptionst::add_exceptional_returns(
       lhs_expr_null,
       rhs_expr_null);
     t_null->function=function_id;
+    return;
+  }
+
+  // We generate an exceptional return value for any function that
+  // contains a throw or a function call that may escape exceptions.
+  forall_goto_program_instructions(instr_it, goto_program)
+  {
+    bool has_uncaught_exceptions=false;
+    if(instr_it->is_function_call())
+    {
+      const exprt &function_expr=
+        to_code_function_call(instr_it->code).function();
+      DATA_INVARIANT(
+        function_expr.id()==ID_symbol,
+        "identifier expected to be a symbol");
+      const irep_idt &function_name=
+        to_symbol_expr(function_expr).get_identifier();
+      has_uncaught_exceptions=!exceptions_map[function_name].empty();
+    }
+
+    bool assertion_error=false;
+    if(instr_it->is_throw())
+    {
+      const exprt &exc =
+        uncaught_exceptions_domaint::get_exception_symbol(instr_it->code);
+      assertion_error =
+        id2string(uncaught_exceptions_domaint::get_exception_type(exc.type())).
+        find("java.lang.AssertionError")!=std::string::npos;
+    }
+
+    // if we find a throw different from AssertionError or a function call
+    // that may escape exceptions, then we add an exceptional return
+    // variable
+    if((instr_it->is_throw() && !assertion_error)
+       || has_uncaught_exceptions)
+    {
+      // look up the function symbol
+      symbol_tablet::symbolst::iterator s_it=
+        symbol_table.symbols.find(function_id);
+
+      INVARIANT(
+        s_it!=symbol_table.symbols.end(),
+        "functions should be recorded in the symbol table");
+
+      auxiliary_symbolt new_symbol;
+      new_symbol.is_static_lifetime=true;
+      new_symbol.module=function_symbol.module;
+      new_symbol.base_name=id2string(function_symbol.base_name)+EXC_SUFFIX;
+      new_symbol.name=id2string(function_symbol.name)+EXC_SUFFIX;
+      new_symbol.mode=function_symbol.mode;
+      new_symbol.type=typet(ID_pointer, empty_typet());
+      symbol_table.add(new_symbol);
+
+      // initialize the exceptional return with NULL
+      symbol_exprt lhs_expr_null=new_symbol.symbol_expr();
+      null_pointer_exprt rhs_expr_null(pointer_type(empty_typet()));
+      goto_programt::targett t_null=
+        goto_program.insert_before(goto_program.instructions.begin());
+      t_null->make_assignment();
+      t_null->source_location=
+        goto_program.instructions.begin()->source_location;
+      t_null->code=code_assignt(
+        lhs_expr_null,
+        rhs_expr_null);
+      t_null->function=function_id;
+
+      break;
+    }
   }
 }
 
-/// at the beginning of each handler in function f  adds exc=f#exception_value;
-/// f#exception_value=NULL;
+/// Translates an exception landing-pad into instructions that copy the
+/// in-flight exception pointer to a nominated expression, then clear the
+/// in-flight exception (i.e. null the pointer), hence marking it caught.
+/// \param func_it: iterator pointing to the function containing this
+///   landingpad instruction
+/// \param instr_it [in, out]: iterator pointing to the landingpad instruction.
+///   Will be overwritten.
 void remove_exceptionst::instrument_exception_handler(
   const goto_functionst::function_mapt::iterator &func_it,
-  const goto_programt::instructionst::iterator &instr_it)
+  const goto_programt::targett &instr_it)
 {
   const irep_idt &function_id=func_it->first;
   goto_programt &goto_program=func_it->second.body;
 
-  assert(instr_it->type==CATCH && instr_it->code.has_operands());
+  PRECONDITION(instr_it->type==CATCH);
 
   // retrieve the exception variable
-  const exprt &exception=instr_it->code.op0();
+  const exprt &thrown_exception_local=
+    to_code_landingpad(instr_it->code).catch_expr();
+  irep_idt thrown_exception_global=id2string(function_id)+EXC_SUFFIX;
 
-  if(symbol_table.has_symbol(id2string(function_id)+EXC_SUFFIX))
+  if(symbol_table.has_symbol(thrown_exception_global))
   {
-    const symbolt &function_symbol=
-      symbol_table.lookup(id2string(function_id)+EXC_SUFFIX);
+    const symbol_exprt thrown_global_symbol=
+      symbol_table.lookup(thrown_exception_global).symbol_expr();
     // next we reset the exceptional return to NULL
-    symbol_exprt lhs_expr_null=function_symbol.symbol_expr();
-    null_pointer_exprt rhs_expr_null(pointer_type(empty_typet()));
+    null_pointer_exprt null_voidptr((pointer_type(empty_typet())));
 
     // add the assignment
     goto_programt::targett t_null=goto_program.insert_after(instr_it);
     t_null->make_assignment();
     t_null->source_location=instr_it->source_location;
     t_null->code=code_assignt(
-      lhs_expr_null,
-      rhs_expr_null);
+      thrown_global_symbol,
+      null_voidptr);
     t_null->function=instr_it->function;
 
-    // add the assignment exc=f#exception_value
-    symbol_exprt rhs_expr_exc=function_symbol.symbol_expr();
-
+    // add the assignment exc=f#exception_value (before the null assignment)
     goto_programt::targett t_exc=goto_program.insert_after(instr_it);
     t_exc->make_assignment();
     t_exc->source_location=instr_it->source_location;
     t_exc->code=code_assignt(
-      typecast_exprt(exception, rhs_expr_exc.type()),
-      rhs_expr_exc);
+      thrown_exception_local,
+      typecast_exprt(thrown_global_symbol, thrown_exception_local.type()));
     t_exc->function=instr_it->function;
   }
   instr_it->make_skip();
 }
 
-/// instruments each throw with conditional GOTOS to the  corresponding
-/// exception handlers
-void remove_exceptionst::instrument_throw(
+/// Emit the code:
+/// if (exception instanceof ExnA) then goto handlerA
+/// else if (exception instanceof ExnB) then goto handlerB
+/// else goto universal_handler or (dead locals; function exit)
+/// \param func_it: iterator pointing to function instr_it belongs to
+/// \param instr_it: throw or call instruction that may be an
+///   exception source
+/// \param stack_catch: exception handlers currently registered
+/// \param locals: local variables to kill on a function-exit edge
+void remove_exceptionst::add_exception_dispatch_sequence(
   const goto_functionst::function_mapt::iterator &func_it,
-  const goto_programt::instructionst::iterator &instr_it,
+  const goto_programt::targett &instr_it,
   const remove_exceptionst::stack_catcht &stack_catch,
-  std::vector<exprt> &locals)
+  const std::vector<exprt> &locals)
 {
-  assert(instr_it->type==THROW);
-
-  goto_programt &goto_program=func_it->second.body;
   const irep_idt &function_id=func_it->first;
+  goto_programt &goto_program=func_it->second.body;
 
-  assert(instr_it->code.operands().size()==1);
-
-  // find the end of the function
-  goto_programt::targett end_function=goto_program.get_end_function();
-  if(end_function!=instr_it)
-  {
-    // jump to the end of the function
-    // this will appear after the GOTO-based dynamic dispatch below
-    goto_programt::targett t_end=goto_program.insert_after(instr_it);
-    t_end->make_goto(end_function);
-    t_end->source_location=instr_it->source_location;
-    t_end->function=instr_it->function;
-  }
+  // Unless we have a universal exception handler, jump to end of function
+  // if not caught:
+  goto_programt::targett default_target=goto_program.get_end_function();
 
+  // Jump to the universal handler or function end, as appropriate.
+  // This will appear after the GOTO-based dynamic dispatch below
+  goto_programt::targett default_dispatch=goto_program.insert_after(instr_it);
+  default_dispatch->make_goto();
+  default_dispatch->source_location=instr_it->source_location;
+  default_dispatch->function=instr_it->function;
 
   // find the symbol corresponding to the caught exceptions
   const symbolt &exc_symbol=
-        symbol_table.lookup(id2string(function_id)+EXC_SUFFIX);
+    symbol_table.lookup(id2string(function_id)+EXC_SUFFIX);
   symbol_exprt exc_thrown=exc_symbol.symbol_expr();
 
   // add GOTOs implementing the dynamic dispatch of the
@@ -213,22 +325,32 @@ void remove_exceptionst::instrument_throw(
     {
       goto_programt::targett new_state_pc=
         stack_catch[i][j].second;
+      if(stack_catch[i][j].first.empty())
+      {
+        // Universal handler. Highest on the stack takes
+        // precedence, so overwrite any we've already seen:
+        default_target=new_state_pc;
+      }
+      else
+      {
+        // Normal exception handler, make an instanceof check.
+        goto_programt::targett t_exc=goto_program.insert_after(instr_it);
+        t_exc->make_goto(new_state_pc);
+        t_exc->source_location=instr_it->source_location;
+        t_exc->function=instr_it->function;
 
-      // find handler
-      goto_programt::targett t_exc=goto_program.insert_after(instr_it);
-      t_exc->make_goto(new_state_pc);
-      t_exc->source_location=instr_it->source_location;
-      t_exc->function=instr_it->function;
-
-      // use instanceof to check that this is the correct handler
-      symbol_typet type(stack_catch[i][j].first);
-      type_exprt expr(type);
+        // use instanceof to check that this is the correct handler
+        symbol_typet type(stack_catch[i][j].first);
+        type_exprt expr(type);
 
-      binary_predicate_exprt check(exc_thrown, ID_java_instanceof, expr);
-      t_exc->guard=check;
+        binary_predicate_exprt check(exc_thrown, ID_java_instanceof, expr);
+        t_exc->guard=check;
+      }
     }
   }
 
+  default_dispatch->set_target(default_target);
+
   // add dead instructions
   for(const auto &local : locals)
   {
@@ -238,11 +360,37 @@ void remove_exceptionst::instrument_throw(
     t_dead->source_location=instr_it->source_location;
     t_dead->function=instr_it->function;
   }
+}
+
+/// instruments each throw with conditional GOTOS to the  corresponding
+/// exception handlers
+void remove_exceptionst::instrument_throw(
+  const goto_functionst::function_mapt::iterator &func_it,
+  const goto_programt::targett &instr_it,
+  const remove_exceptionst::stack_catcht &stack_catch,
+  const std::vector<exprt> &locals)
+{
+  PRECONDITION(instr_it->type==THROW);
+
+  const exprt &exc_expr=
+    uncaught_exceptions_domaint::get_exception_symbol(instr_it->code);
+  bool assertion_error=id2string(
+    uncaught_exceptions_domaint::get_exception_type(exc_expr.type())).
+    find("java.lang.AssertionError")!=std::string::npos;
+
+  // we don't count AssertionError (we couldn't catch it anyway
+  // and this may reduce the instrumentation considerably if the programmer
+  // used assertions)
+  if(assertion_error)
+    return;
 
-  // replace "throw x;" by "f#exception_value=x;"
-  exprt exc_expr=instr_it->code;
-  while(exc_expr.id()!=ID_symbol && exc_expr.has_operands())
-    exc_expr=exc_expr.op0();
+  add_exception_dispatch_sequence(
+    func_it, instr_it, stack_catch, locals);
+
+  // find the symbol where the thrown exception should be stored:
+  const symbolt &exc_symbol=
+        symbol_table.lookup(id2string(func_it->first)+EXC_SUFFIX);
+  symbol_exprt exc_thrown=exc_symbol.symbol_expr();
 
   // add the assignment with the appropriate cast
   code_assignt assignment(typecast_exprt(exc_thrown, exc_expr.type()),
@@ -256,77 +404,43 @@ void remove_exceptionst::instrument_throw(
 /// GOTOS to the corresponding exception handlers
 void remove_exceptionst::instrument_function_call(
   const goto_functionst::function_mapt::iterator &func_it,
-  const goto_programt::instructionst::iterator &instr_it,
+  const goto_programt::targett &instr_it,
   const stack_catcht &stack_catch,
-  std::vector<exprt> &locals)
+  const std::vector<exprt> &locals)
 {
-  assert(instr_it->type==FUNCTION_CALL);
+  PRECONDITION(instr_it->type==FUNCTION_CALL);
 
   goto_programt &goto_program=func_it->second.body;
   const irep_idt &function_id=func_it->first;
 
   // save the address of the next instruction
-  goto_programt::instructionst::iterator next_it=instr_it;
+  goto_programt::targett next_it=instr_it;
   next_it++;
 
   code_function_callt &function_call=to_code_function_call(instr_it->code);
-  assert(function_call.function().id()==ID_symbol);
+  DATA_INVARIANT(
+    function_call.function().id()==ID_symbol,
+    "identified expected to be a symbol");
   const irep_idt &callee_id=
     to_symbol_expr(function_call.function()).get_identifier();
 
-  if(symbol_table.has_symbol(id2string(callee_id)+EXC_SUFFIX))
-  {
-    // we may have an escaping exception
-    const symbolt &callee_exc_symbol=
-      symbol_table.lookup(id2string(callee_id)+EXC_SUFFIX);
-    symbol_exprt callee_exc=callee_exc_symbol.symbol_expr();
-
-    // find the end of the function
-    goto_programt::targett end_function=goto_program.get_end_function();
-    if(end_function!=instr_it)
-    {
-      // jump to the end of the function
-      // this will appear after the GOTO-based dynamic dispatch below
-      goto_programt::targett t_end=goto_program.insert_after(instr_it);
-      t_end->make_goto(end_function);
-      t_end->source_location=instr_it->source_location;
-      t_end->function=instr_it->function;
-    }
+  const irep_idt &callee_inflight_exception=id2string(callee_id)+EXC_SUFFIX;
+  const irep_idt &local_inflight_exception=id2string(function_id)+EXC_SUFFIX;
 
-    for(std::size_t i=stack_catch.size(); i-->0;)
-    {
-      for(std::size_t j=stack_catch[i].size(); j-->0;)
-      {
-        goto_programt::targett new_state_pc;
-        new_state_pc=stack_catch[i][j].second;
-        goto_programt::targett t_exc=goto_program.insert_after(instr_it);
-        t_exc->make_goto(new_state_pc);
-        t_exc->source_location=instr_it->source_location;
-        t_exc->function=instr_it->function;
-        // use instanceof to check that this is the correct handler
-        symbol_typet type(stack_catch[i][j].first);
-        type_exprt expr(type);
-        binary_predicate_exprt check_instanceof(
-          callee_exc,
-          ID_java_instanceof,
-          expr);
-        t_exc->guard=check_instanceof;
-      }
-    }
+  if(symbol_table.has_symbol(callee_inflight_exception) &&
+     symbol_table.has_symbol(local_inflight_exception))
+  {
+    add_exception_dispatch_sequence(
+      func_it, instr_it, stack_catch, locals);
 
-    // add dead instructions
-    for(const auto &local : locals)
-    {
-      goto_programt::targett t_dead=goto_program.insert_after(instr_it);
-      t_dead->make_dead();
-      t_dead->code=code_deadt(local);
-      t_dead->source_location=instr_it->source_location;
-      t_dead->function=instr_it->function;
-    }
+    const symbol_exprt callee_inflight_exception_expr=
+      symbol_table.lookup(callee_inflight_exception).symbol_expr();
+    const symbol_exprt local_inflight_exception_expr=
+      symbol_table.lookup(local_inflight_exception).symbol_expr();
 
     // add a null check (so that instanceof can be applied)
     equal_exprt eq_null(
-      callee_exc,
+      local_inflight_exception_expr,
       null_pointer_exprt(pointer_type(empty_typet())));
     goto_programt::targett t_null=goto_program.insert_after(instr_it);
     t_null->make_goto(next_it);
@@ -336,14 +450,12 @@ void remove_exceptionst::instrument_function_call(
 
     // after each function call g() in function f
     // adds f#exception_value=g#exception_value;
-    const symbolt &caller=
-      symbol_table.lookup(id2string(function_id)+EXC_SUFFIX);
-    const symbol_exprt &lhs_expr=caller.symbol_expr();
-
     goto_programt::targett t=goto_program.insert_after(instr_it);
     t->make_assignment();
     t->source_location=instr_it->source_location;
-    t->code=code_assignt(lhs_expr, callee_exc);
+    t->code=code_assignt(
+      local_inflight_exception_expr,
+      callee_inflight_exception_expr);
     t->function=instr_it->function;
   }
 }
@@ -368,10 +480,17 @@ void remove_exceptionst::instrument_exceptions(
       code_declt decl=to_code_decl(instr_it->code);
       locals.push_back(decl.symbol());
     }
-    // it's a CATCH but not a handler (as it has no operands)
-    else if(instr_it->type==CATCH && !instr_it->code.has_operands())
+    // Is it a handler push/pop or catch landing-pad?
+    else if(instr_it->type==CATCH)
     {
-      if(instr_it->targets.empty()) // pop
+      const irep_idt &statement=instr_it->code.get_statement();
+      // Is it an exception landing pad (start of a catch block)?
+      if(statement==ID_exception_landingpad)
+      {
+        instrument_exception_handler(func_it, instr_it);
+      }
+      // Is it a catch handler pop?
+      else if(statement==ID_pop_catch)
       {
         // pop the local vars stack
         if(!stack_locals.empty())
@@ -391,7 +510,8 @@ void remove_exceptionst::instrument_exceptions(
 #endif
         }
       }
-      else // push
+      // Is it a catch handler push?
+      else if(statement==ID_push_catch)
       {
         stack_locals.push_back(locals);
         locals.clear();
@@ -402,26 +522,34 @@ void remove_exceptionst::instrument_exceptions(
           stack_catch.back();
 
         // copy targets
-        const irept::subt &exception_list=
-          instr_it->code.find(ID_exception_list).get_sub();
-        assert(exception_list.size()==instr_it->targets.size());
+        const code_push_catcht::exception_listt &exception_list=
+          to_code_push_catch(instr_it->code).exception_list();
+
+        // The target list can be empty if `finish_catch_push_targets` found that
+        // the targets were unreachable (in which case no exception can truly
+        // be thrown at runtime)
+        INVARIANT(
+          instr_it->targets.empty() ||
+          exception_list.size()==instr_it->targets.size(),
+          "`exception_list` should contain current instruction's targets");
 
         // Fill the map with the catch type and the target
         unsigned i=0;
         for(auto target : instr_it->targets)
         {
           last_exception.push_back(
-            std::make_pair(exception_list[i].id(), target));
+            std::make_pair(exception_list[i].get_tag(), target));
           i++;
         }
       }
+      else
+      {
+        INVARIANT(
+          false,
+          "CATCH opcode should be one of push-catch, pop-catch, landingpad");
+      }
       instr_it->make_skip();
     }
-    // CATCH handler
-    else if(instr_it->type==CATCH && instr_it->code.has_operands())
-    {
-      instrument_exception_handler(func_it, instr_it);
-    }
     else if(instr_it->type==THROW)
     {
       instrument_throw(func_it, instr_it, stack_catch, locals);
@@ -446,13 +574,19 @@ void remove_exceptions(
   symbol_tablet &symbol_table,
   goto_functionst &goto_functions)
 {
-  remove_exceptionst remove_exceptions(symbol_table);
+  const namespacet ns(symbol_table);
+  std::map<irep_idt, std::set<irep_idt>> exceptions_map;
+  uncaught_exceptions(goto_functions, ns, exceptions_map);
+  remove_exceptionst remove_exceptions(symbol_table, exceptions_map);
   remove_exceptions(goto_functions);
 }
 
 /// removes throws/CATCH-POP/CATCH-PUSH
 void remove_exceptions(goto_modelt &goto_model)
 {
-  remove_exceptionst remove_exceptions(goto_model.symbol_table);
+  std::map<irep_idt, std::set<irep_idt>> exceptions_map;
+  remove_exceptionst remove_exceptions(
+    goto_model.symbol_table,
+    exceptions_map);
   remove_exceptions(goto_model.goto_functions);
 }
diff --git a/src/goto-programs/remove_instanceof.cpp b/src/goto-programs/remove_instanceof.cpp
index bc76c7e5991..c1f17ef6b39 100644
--- a/src/goto-programs/remove_instanceof.cpp
+++ b/src/goto-programs/remove_instanceof.cpp
@@ -124,6 +124,7 @@ void remove_instanceoft::lower_instanceof(
     newinst->make_assignment();
     newinst->code=code_assignt(newsym.symbol_expr(), object_clsid);
     newinst->source_location=this_inst->source_location;
+    newinst->function=this_inst->function;
 
     // Insert the check instruction after the existing one.
     // This will briefly be ill-formed (use before def of
diff --git a/src/goto-programs/remove_skip.cpp b/src/goto-programs/remove_skip.cpp
index 816960b1ea0..231ed117f31 100644
--- a/src/goto-programs/remove_skip.cpp
+++ b/src/goto-programs/remove_skip.cpp
@@ -10,6 +10,7 @@ Author: Daniel Kroening, kroening@kroening.com
 /// Program Transformation
 
 #include "remove_skip.h"
+#include "goto_model.h"
 
 static bool is_skip(goto_programt::instructionst::iterator it)
 {
@@ -27,16 +28,13 @@ static bool is_skip(goto_programt::instructionst::iterator it)
     if(it->guard.is_false())
       return true;
 
-    if(it->targets.size()!=1)
-      return false;
-
     goto_programt::instructionst::iterator next_it=it;
     next_it++;
 
     // A branch to the next instruction is a skip
     // We also require the guard to be 'true'
     return it->guard.is_true() &&
-           it->targets.front()==next_it;
+           it->get_target()==next_it;
   }
 
   if(it->is_other())
@@ -160,3 +158,9 @@ void remove_skip(goto_functionst &goto_functions)
   Forall_goto_functions(f_it, goto_functions)
     remove_skip(f_it->second.body);
 }
+
+void remove_skip(goto_modelt &goto_model)
+{
+  remove_skip(goto_model.goto_functions);
+}
+
diff --git a/src/goto-programs/remove_skip.h b/src/goto-programs/remove_skip.h
index e466251f9d6..593e34b89fd 100644
--- a/src/goto-programs/remove_skip.h
+++ b/src/goto-programs/remove_skip.h
@@ -14,7 +14,10 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "goto_functions.h"
 
-void remove_skip(goto_programt &goto_program);
-void remove_skip(goto_functionst &goto_functions);
+class goto_modelt;
+
+void remove_skip(goto_programt &);
+void remove_skip(goto_functionst &);
+void remove_skip(goto_modelt &);
 
 #endif // CPROVER_GOTO_PROGRAMS_REMOVE_SKIP_H
diff --git a/src/goto-programs/remove_static_init_loops.cpp b/src/goto-programs/remove_static_init_loops.cpp
index b30cc2a9cb7..e6493732b62 100644
--- a/src/goto-programs/remove_static_init_loops.cpp
+++ b/src/goto-programs/remove_static_init_loops.cpp
@@ -13,7 +13,6 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <algorithm>
 
-#include <util/message.h>
 #include <util/suffix.h>
 #include <util/string2int.h>
 
@@ -27,7 +26,8 @@ class remove_static_init_loopst
 
   void unwind_enum_static(
     const goto_functionst &goto_functions,
-    optionst &options);
+    optionst &options,
+    message_handlert &);
 protected:
   const symbol_tablet &symbol_table;
 };
@@ -38,9 +38,12 @@ class remove_static_init_loopst
 /// \return side effect is adding <clinit> loops to unwindset
 void remove_static_init_loopst::unwind_enum_static(
   const goto_functionst &goto_functions,
-  optionst &options)
+  optionst &options,
+  message_handlert &msg)
 {
   size_t unwind_max=0;
+  messaget message;
+  message.set_message_handler(msg);
   forall_goto_functions(f, goto_functions)
   {
     auto &p=f->second.body;
@@ -53,6 +56,13 @@ void remove_static_init_loopst::unwind_enum_static(
         const std::string java_clinit="<clinit>:()V";
         const std::string &fname=id2string(ins.function);
         size_t class_prefix_length=fname.find_last_of('.');
+        // is the function symbol in the symbol table?
+        if(!symbol_table.has_symbol(ins.function))
+        {
+          message.warning() << "function `" << id2string(ins.function)
+                            << "` is not in symbol table" << messaget::eom;
+          continue;
+        }
         // is Java function and static init?
         const symbolt &function_name=symbol_table.lookup(ins.function);
         if(!(function_name.mode==ID_java && has_suffix(fname, java_clinit)))
@@ -96,8 +106,9 @@ void remove_static_init_loopst::unwind_enum_static(
 void remove_static_init_loops(
   const symbol_tablet &symbol_table,
   const goto_functionst &goto_functions,
-  optionst &options)
+  optionst &options,
+  message_handlert &msg)
 {
   remove_static_init_loopst remove_loops(symbol_table);
-  remove_loops.unwind_enum_static(goto_functions, options);
+  remove_loops.unwind_enum_static(goto_functions, options, msg);
 }
diff --git a/src/goto-programs/remove_static_init_loops.h b/src/goto-programs/remove_static_init_loops.h
index eee270215a2..3f781f6a70b 100644
--- a/src/goto-programs/remove_static_init_loops.h
+++ b/src/goto-programs/remove_static_init_loops.h
@@ -11,6 +11,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <goto-programs/goto_functions.h>
 
+#include <util/message.h>
 #include <util/options.h>
 #include <util/symbol_table.h>
 
@@ -20,6 +21,7 @@ Author: Daniel Kroening, kroening@kroening.com
 void remove_static_init_loops(
   const symbol_tablet &,
   const goto_functionst &,
-  optionst &);
+  optionst &,
+  message_handlert &);
 
 #endif // CPROVER_GOTO_PROGRAMS_REMOVE_STATIC_INIT_LOOPS_H
diff --git a/src/goto-programs/remove_unused_functions.cpp b/src/goto-programs/remove_unused_functions.cpp
index fd2d8cca614..3092e114796 100644
--- a/src/goto-programs/remove_unused_functions.cpp
+++ b/src/goto-programs/remove_unused_functions.cpp
@@ -13,6 +13,13 @@ Author: CM Wintersteiger
 
 #include <util/message.h>
 
+void remove_unused_functions(
+  goto_modelt &goto_model,
+  message_handlert &message_handler)
+{
+  remove_unused_functions(goto_model.goto_functions, message_handler);
+}
+
 void remove_unused_functions(
   goto_functionst &functions,
   message_handlert &message_handler)
diff --git a/src/goto-programs/remove_unused_functions.h b/src/goto-programs/remove_unused_functions.h
index 550d657f299..8c8b1739a98 100644
--- a/src/goto-programs/remove_unused_functions.h
+++ b/src/goto-programs/remove_unused_functions.h
@@ -14,11 +14,15 @@ Author: CM Wintersteiger
 
 #include <util/message.h>
 
-#include <goto-programs/goto_functions.h>
+#include <goto-programs/goto_model.h>
 
 void remove_unused_functions(
-  goto_functionst &functions,
-  message_handlert &message_handler);
+  goto_functionst &,
+  message_handlert &);
+
+void remove_unused_functions(
+  goto_modelt &,
+  message_handlert &);
 
 void find_used_functions(
   const irep_idt &current,
diff --git a/src/goto-programs/remove_virtual_functions.cpp b/src/goto-programs/remove_virtual_functions.cpp
index 5ae06fceeb0..26671e18527 100644
--- a/src/goto-programs/remove_virtual_functions.cpp
+++ b/src/goto-programs/remove_virtual_functions.cpp
@@ -13,6 +13,8 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "class_hierarchy.h"
 #include "class_identifier.h"
 
+#include <goto-programs/resolve_concrete_function_call.h>
+
 #include <util/c_types.h>
 #include <util/prefix.h>
 #include <util/type_eq.h>
@@ -258,32 +260,26 @@ void remove_virtual_functionst::get_functions(
 {
   const irep_idt class_id=function.get(ID_C_class);
   const irep_idt component_name=function.get(ID_component_name);
-  assert(!class_id.empty());
+  INVARIANT(!class_id.empty(), "All virtual functions must have a class");
+
+  resolve_concrete_function_callt get_virtual_call_target(
+    symbol_table, class_hierarchy);
+  const resolve_concrete_function_callt::concrete_function_callt &
+    resolved_call=get_virtual_call_target(class_id, component_name);
   functiont root_function;
 
-  // Start from current class, go to parents until something
-  // is found.
-  irep_idt c=class_id;
-  while(!c.empty())
+  if(resolved_call.is_valid())
   {
-    exprt method=get_method(c, component_name);
-    if(method.is_not_nil())
-    {
-      root_function.class_id=c;
-      root_function.symbol_expr=to_symbol_expr(method);
-      root_function.symbol_expr.set(ID_C_class, c);
-      break; // abort
-    }
+    root_function.class_id=resolved_call.get_class_identifier();
 
-    const class_hierarchyt::idst &parents=
-      class_hierarchy.class_map[c].parents;
+    const symbolt &called_symbol=
+      symbol_table.lookup(resolved_call.get_virtual_method_name());
 
-    if(parents.empty())
-      break;
-    c=parents.front();
+    root_function.symbol_expr=called_symbol.symbol_expr();
+    root_function.symbol_expr.set(
+      ID_C_class, resolved_call.get_class_identifier());
   }
-
-  if(root_function.class_id.empty())
+  else
   {
     // No definition here; this is an abstract function.
     root_function.class_id=class_id;
@@ -306,8 +302,9 @@ exprt remove_virtual_functionst::get_method(
   const irep_idt &class_id,
   const irep_idt &component_name) const
 {
-  irep_idt id=id2string(class_id)+"."+
-              id2string(component_name);
+  const irep_idt &id=
+    resolve_concrete_function_callt::build_virtual_method_name(
+      class_id, component_name);
 
   const symbolt *symbol;
   if(ns.lookup(id, symbol))
diff --git a/src/goto-programs/replace_java_nondet.cpp b/src/goto-programs/replace_java_nondet.cpp
new file mode 100644
index 00000000000..8261bb087ea
--- /dev/null
+++ b/src/goto-programs/replace_java_nondet.cpp
@@ -0,0 +1,254 @@
+/*******************************************************************\
+
+Module: Replace Java Nondet expressions
+
+Author: Reuben Thomas, reuben.thomas@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Replace Java Nondet expressions
+
+#include "goto-programs/replace_java_nondet.h"
+#include "goto-programs/goto_convert.h"
+#include "goto-programs/goto_model.h"
+#include "goto-programs/remove_skip.h"
+
+#include "util/irep_ids.h"
+
+#include <algorithm>
+#include <regex>
+
+/// Holds information about any discovered nondet methods, with extreme type-
+/// safety.
+class nondet_instruction_infot final
+{
+public:
+  enum class is_nondett:bool { FALSE, TRUE };
+  enum class is_nullablet:bool { FALSE, TRUE };
+
+  nondet_instruction_infot():
+    is_nondet(is_nondett::FALSE),
+    is_nullable(is_nullablet::FALSE)
+  {
+  }
+
+  explicit nondet_instruction_infot(is_nullablet is_nullable):
+    is_nondet(is_nondett::TRUE),
+    is_nullable(is_nullable)
+  {
+  }
+
+  is_nondett get_instruction_type() const { return is_nondet; }
+  is_nullablet get_nullable_type() const { return is_nullable; }
+
+private:
+  is_nondett is_nondet;
+  is_nullablet is_nullable;
+};
+
+/// Checks whether the function call is one of our nondet library functions.
+/// \param function_call: The function call declaration to check.
+/// \return A structure detailing whether the function call appears to be one of
+///   our nondet library methods, and if so, whether or not it allows null
+///   results.
+static nondet_instruction_infot is_nondet_returning_object(
+  const code_function_callt &function_call)
+{
+  const auto &function_symbol=to_symbol_expr(function_call.function());
+  const auto function_name=id2string(function_symbol.get_identifier());
+  const std::regex reg(
+    R"(.*org\.cprover\.CProver\.nondet)"
+    R"((?:Boolean|Byte|Char|Short|Int|Long|Float|Double|With(out)?Null.*))");
+  std::smatch match_results;
+  if(!std::regex_match(function_name, match_results, reg))
+  {
+    return nondet_instruction_infot();
+  }
+
+  return nondet_instruction_infot(
+    nondet_instruction_infot::is_nullablet(!match_results[1].matched));
+}
+
+/// Check whether the instruction is a function call which matches one of the
+/// recognised nondet library methods, and return some information about it.
+/// \param instr: A goto-program instruction to check.
+/// \return A structure detailing the properties of the nondet method.
+static nondet_instruction_infot get_nondet_instruction_info(
+  const goto_programt::const_targett &instr)
+{
+  if(!(instr->is_function_call() && instr->code.id()==ID_code))
+  {
+    return nondet_instruction_infot();
+  }
+  const auto &code=to_code(instr->code);
+  if(code.get_statement()!=ID_function_call)
+  {
+    return nondet_instruction_infot();
+  }
+  const auto &function_call=to_code_function_call(code);
+  return is_nondet_returning_object(function_call);
+}
+
+/// Return whether the expression is a symbol with the specified identifier.
+/// \param expr: The expression which may be a symbol.
+/// \param identifier: Some identifier.
+/// \return True if the expression is a symbol with the specified identifier.
+static bool is_symbol_with_id(const exprt& expr, const irep_idt& identifier)
+{
+  return expr.id()==ID_symbol &&
+         to_symbol_expr(expr).get_identifier()==identifier;
+}
+
+/// Return whether the expression is a typecast with the specified identifier.
+/// \param expr: The expression which may be a typecast.
+/// \param identifier: Some identifier.
+/// \return True if the expression is a typecast with one operand, and the
+///   typecast's identifier matches the specified identifier.
+static bool is_typecast_with_id(const exprt& expr, const irep_idt& identifier)
+{
+  if(!(expr.id()==ID_typecast && expr.operands().size()==1))
+  {
+    return false;
+  }
+  const auto &typecast=to_typecast_expr(expr);
+  if(!(typecast.op().id()==ID_symbol && !typecast.op().has_operands()))
+  {
+    return false;
+  }
+  const auto &op_symbol=to_symbol_expr(typecast.op());
+  // Return whether the typecast has the expected operand
+  return op_symbol.get_identifier()==identifier;
+}
+
+/// Return whether the instruction is an assignment, and the rhs is a symbol or
+/// typecast expression with the specified identifier.
+/// \param instr: A goto program instruction.
+/// \param identifier: Some identifier.
+/// \return True if the expression is a typecast with one operand, and the
+///   typecast's identifier matches the specified identifier.
+static bool is_assignment_from(
+  const goto_programt::instructiont &instr,
+  const irep_idt &identifier)
+{
+  // If not an assignment, return false
+  if(!instr.is_assign())
+  {
+    return false;
+  }
+  const auto &rhs=to_code_assign(instr.code).rhs();
+  return is_symbol_with_id(rhs, identifier) ||
+         is_typecast_with_id(rhs, identifier);
+}
+
+/// Given an iterator into a list of instructions, modify the list to replace
+/// 'nondet' library functions with CBMC-native nondet expressions, and return
+/// an iterator to the next instruction to check.
+/// \param goto_program: The goto program to modify.
+/// \param target: A single step of the goto program which may be erased and
+///   replaced.
+/// \return The next instruction to process, probably with this function.
+static goto_programt::targett check_and_replace_target(
+  goto_programt &goto_program,
+  const goto_programt::targett &target)
+{
+  // Check whether this is a nondet library method, and return if not
+  const auto instr_info=get_nondet_instruction_info(target);
+  const auto next_instr=std::next(target);
+  if(instr_info.get_instruction_type()==
+     nondet_instruction_infot::is_nondett::FALSE)
+  {
+    return next_instr;
+  }
+
+  // Look at the next instruction, ensure that it is an assignment
+  assert(next_instr->is_assign());
+  // Get the name of the LHS of the assignment
+  const auto &next_instr_assign_lhs=to_code_assign(next_instr->code).lhs();
+  if(!(next_instr_assign_lhs.id()==ID_symbol &&
+       !next_instr_assign_lhs.has_operands()))
+  {
+    return next_instr;
+  }
+  const auto return_identifier=
+    to_symbol_expr(next_instr_assign_lhs).get_identifier();
+
+  auto &instructions=goto_program.instructions;
+  const auto end=instructions.end();
+
+  // Look for an instruction where this name is on the RHS of an assignment
+  const auto matching_assignment=std::find_if(
+    next_instr,
+    end,
+    [&return_identifier](const goto_programt::instructiont &instr)
+    {
+      return is_assignment_from(instr, return_identifier);
+    });
+
+  assert(matching_assignment!=end);
+
+  // Assume that the LHS of *this* assignment is the actual nondet variable
+  const auto &code_assign=to_code_assign(matching_assignment->code);
+  const auto nondet_var=code_assign.lhs();
+  const auto source_loc=target->source_location;
+
+  // Erase from the nondet function call to the assignment
+  const auto after_matching_assignment=std::next(matching_assignment);
+  assert(after_matching_assignment!=end);
+
+  std::for_each(
+    target,
+    after_matching_assignment,
+    [](goto_programt::instructiont &instr)
+    {
+      instr.make_skip();
+    });
+
+  const auto inserted=goto_program.insert_before(after_matching_assignment);
+  inserted->make_assignment();
+  side_effect_expr_nondett inserted_expr(nondet_var.type());
+  inserted_expr.set_nullable(
+    instr_info.get_nullable_type()==
+    nondet_instruction_infot::is_nullablet::TRUE);
+  inserted->code=code_assignt(nondet_var, inserted_expr);
+  inserted->code.add_source_location()=source_loc;
+  inserted->source_location=source_loc;
+
+  goto_program.update();
+
+  return after_matching_assignment;
+}
+
+/// Checks each instruction in the goto program to see whether it is a method
+/// returning nondet.  If it is, replaces the function call with an irep
+/// representing a nondet side effect with an appropriate type.
+/// \param goto_program: The goto program to modify.
+static void replace_java_nondet(goto_programt &goto_program)
+{
+  for(auto instruction_iterator=goto_program.instructions.begin(),
+        end=goto_program.instructions.end();
+      instruction_iterator!=end;)
+  {
+    instruction_iterator=check_and_replace_target(
+      goto_program,
+      instruction_iterator);
+  }
+}
+
+void replace_java_nondet(goto_functionst &goto_functions)
+{
+  for(auto &goto_program : goto_functions.function_map)
+  {
+    replace_java_nondet(goto_program.second.body);
+  }
+
+  goto_functions.compute_location_numbers();
+
+  remove_skip(goto_functions);
+}
+
+void replace_java_nondet(goto_modelt &goto_model)
+{
+  replace_java_nondet(goto_model.goto_functions);
+}
+
diff --git a/src/goto-programs/replace_java_nondet.h b/src/goto-programs/replace_java_nondet.h
new file mode 100644
index 00000000000..ac8f8cfb005
--- /dev/null
+++ b/src/goto-programs/replace_java_nondet.h
@@ -0,0 +1,25 @@
+/*******************************************************************\
+
+Module: Replace Java Nondet expressions
+
+Author: Reuben Thomas, reuben.thomas@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Replace Java Nondet expressions
+
+#ifndef CPROVER_GOTO_PROGRAMS_REPLACE_JAVA_NONDET_H
+#define CPROVER_GOTO_PROGRAMS_REPLACE_JAVA_NONDET_H
+
+class goto_modelt;
+class goto_functionst;
+
+/// Replace calls to nondet library functions with an internal nondet
+/// representation.
+/// \param goto_model: The goto program to modify.
+void replace_java_nondet(goto_modelt &);
+
+void replace_java_nondet(goto_functionst &);
+
+#endif
diff --git a/src/goto-programs/resolve_concrete_function_call.cpp b/src/goto-programs/resolve_concrete_function_call.cpp
new file mode 100644
index 00000000000..117ebfb5963
--- /dev/null
+++ b/src/goto-programs/resolve_concrete_function_call.cpp
@@ -0,0 +1,102 @@
+/*******************************************************************\
+
+ Module: GOTO Program Utilities
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <algorithm>
+
+#include "resolve_concrete_function_call.h"
+
+/// See the operator() method comment.
+/// \param symbol_table: The symbol table to resolve the function call in
+resolve_concrete_function_callt::resolve_concrete_function_callt(
+  const symbol_tablet &symbol_table):
+    symbol_table(symbol_table)
+{
+  class_hierarchy(symbol_table);
+}
+
+/// See the operator() method comment
+/// \param symbol_table: The symbol table to resolve the function call in
+/// \param class_hierarchy: A prebuilt class_hierachy based on the symbol_table
+///
+resolve_concrete_function_callt::resolve_concrete_function_callt(
+  const symbol_tablet &symbol_table, const class_hierarchyt &class_hierarchy):
+    class_hierarchy(class_hierarchy),
+    symbol_table(symbol_table)
+{
+  // We require the class_hierarchy to be already populated if we are being
+  // supplied it.
+  PRECONDITION(!class_hierarchy.class_map.empty());
+}
+
+/// Given a virtual function call, identify what concrete call this would be
+/// resolved to. For example, calling a method on a class will call its
+/// implementions if it exists, else will call the first parent that provides an
+/// implementation. If none are found, an empty string will be returned.
+/// \param class_id: The name of the class the function is being called on
+/// \param component_name: The base name of the function (e.g. without the
+///   class specifier
+/// \return The concrete call that has been resolved
+resolve_concrete_function_callt::concrete_function_callt
+  resolve_concrete_function_callt::operator()(
+    const irep_idt &class_id, const irep_idt &component_name)
+{
+  PRECONDITION(!class_id.empty());
+  PRECONDITION(!component_name.empty());
+
+  irep_idt current_class=class_id;
+  while(!current_class.empty())
+  {
+    const irep_idt &virtual_method_name=
+      build_virtual_method_name(current_class, component_name);
+
+    if(symbol_table.has_symbol(virtual_method_name))
+    {
+      return concrete_function_callt(current_class, component_name);
+    }
+
+    const class_hierarchyt::idst &parents=
+      class_hierarchy.class_map[current_class].parents;
+
+    if(parents.empty())
+      break;
+    current_class=parents.front();
+  }
+
+  return concrete_function_callt();
+}
+
+/// Build a method name as found in a GOTO symbol table equivalent to the name
+/// of a concrete call of method component_method_name on class class_name
+/// \param component_method_name: The name of the function
+/// \param class_name: The class the implementation would be found on.
+/// \return A name for looking up in the symbol table for classes `class_name`'s
+///   implementation of `component_name`
+irep_idt resolve_concrete_function_callt::build_virtual_method_name(
+  const irep_idt &class_name, const irep_idt &component_method_name)
+{
+  // Verify the parameters are called in the correct order.
+  PRECONDITION(id2string(class_name).find("::")!=std::string::npos);
+  PRECONDITION(id2string(component_method_name).find("(")!=std::string::npos);
+  return id2string(class_name)+'.'+id2string(component_method_name);
+}
+
+/// Get the full name of this function
+/// \return The symbol name for this function call
+irep_idt resolve_concrete_function_callt::concrete_function_callt::
+  get_virtual_method_name() const
+{
+  return resolve_concrete_function_callt::build_virtual_method_name(
+    class_identifier, function_identifier);
+}
+
+/// Use to check if this concrete_function_callt has been fully constructed.
+/// \return True if this represents a real concrete function call
+bool resolve_concrete_function_callt::concrete_function_callt::is_valid() const
+{
+  return !class_identifier.empty();
+}
diff --git a/src/goto-programs/resolve_concrete_function_call.h b/src/goto-programs/resolve_concrete_function_call.h
new file mode 100644
index 00000000000..c739e9b7393
--- /dev/null
+++ b/src/goto-programs/resolve_concrete_function_call.h
@@ -0,0 +1,75 @@
+/*******************************************************************\
+
+ Module: GOTO Program Utilities
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+/// \file
+/// Given a virtual function call on a specific class, find which implementation
+/// needs to be used.
+
+#ifndef CPROVER_GOTO_PROGRAMS_RESOLVE_CONCRETE_FUNCTION_CALL_H
+#define CPROVER_GOTO_PROGRAMS_RESOLVE_CONCRETE_FUNCTION_CALL_H
+
+#include <util/symbol_table.h>
+#include <util/std_expr.h>
+#include <util/std_code.h>
+#include <goto-programs/class_hierarchy.h>
+
+class resolve_concrete_function_callt
+{
+public:
+  explicit resolve_concrete_function_callt(const symbol_tablet &symbol_table);
+  resolve_concrete_function_callt(
+    const symbol_tablet &symbol_table, const class_hierarchyt &class_hierarchy);
+
+  class concrete_function_callt
+  {
+  public:
+    concrete_function_callt()
+    {}
+
+    concrete_function_callt(
+      const irep_idt &class_id, const irep_idt &method_id):
+        class_identifier(class_id),
+        function_identifier(method_id)
+    {}
+
+    irep_idt get_virtual_method_name() const;
+
+    irep_idt get_class_identifier() const
+    {
+      return class_identifier;
+    }
+
+    irep_idt get_function_identifier() const
+    {
+      return function_identifier;
+    }
+
+    bool is_valid() const;
+
+  private:
+    irep_idt class_identifier;
+    irep_idt function_identifier;
+  };
+
+  concrete_function_callt operator()(
+    const irep_idt &class_id, const irep_idt &component_name);
+
+  static irep_idt build_virtual_method_name(
+    const irep_idt &class_name, const irep_idt &component_method_name);
+
+private:
+  bool does_implementation_exist(
+    const irep_idt &class_name,
+    const irep_idt &component_method_name,
+    const irep_idt &calling_class_name);
+
+  class_hierarchyt class_hierarchy;
+  const symbol_tablet &symbol_table;
+};
+
+#endif // CPROVER_GOTO_PROGRAMS_RESOLVE_CONCRETE_FUNCTION_CALL_H
diff --git a/src/goto-programs/show_properties.cpp b/src/goto-programs/show_properties.cpp
index df88b4cb8b8..7f0be70cc64 100644
--- a/src/goto-programs/show_properties.cpp
+++ b/src/goto-programs/show_properties.cpp
@@ -64,7 +64,7 @@ void show_properties(
       break;
 
     case ui_message_handlert::uit::JSON_UI:
-      assert(false);
+      UNREACHABLE;
       break;
 
     case ui_message_handlert::uit::PLAIN:
@@ -79,7 +79,7 @@ void show_properties(
       break;
 
     default:
-      assert(false);
+      UNREACHABLE;
     }
   }
 }
@@ -110,6 +110,10 @@ void show_properties_json(
       json_properties.push_back(jsont()).make_object();
     json_property["name"]=json_stringt(id2string(property_id));
     json_property["class"]=json_stringt(id2string(property_class));
+    if(!source_location.get_basic_block_covered_lines().empty())
+      json_property["coveredLines"]=
+        json_stringt(
+          id2string(source_location.get_basic_block_covered_lines()));
     json_property["sourceLocation"]=json(source_location);
     json_property["description"]=json_stringt(id2string(description));
     json_property["expression"]=
diff --git a/src/goto-programs/show_symbol_table.cpp b/src/goto-programs/show_symbol_table.cpp
index 6a15759f11e..eebb63dcfcd 100644
--- a/src/goto-programs/show_symbol_table.cpp
+++ b/src/goto-programs/show_symbol_table.cpp
@@ -41,25 +41,27 @@ void show_symbol_table_plain(
   {
     const symbolt &symbol=ns.lookup(id);
 
-    languaget *ptr;
+    std::unique_ptr<languaget> ptr;
 
     if(symbol.mode=="")
+    {
       ptr=get_default_language();
+    }
     else
     {
       ptr=get_language_from_mode(symbol.mode);
-      if(ptr==nullptr)
-        throw "symbol "+id2string(symbol.name)+" has unknown mode";
     }
 
-    std::unique_ptr<languaget> p(ptr);
+    if(!ptr)
+      throw "symbol "+id2string(symbol.name)+" has unknown mode";
+
     std::string type_str, value_str;
 
     if(symbol.type.is_not_nil())
-      p->from_type(symbol.type, type_str, ns);
+      ptr->from_type(symbol.type, type_str, ns);
 
     if(symbol.value.is_not_nil())
-      p->from_expr(symbol.value, value_str, ns);
+      ptr->from_expr(symbol.value, value_str, ns);
 
     out << "Symbol......: " << symbol.name << '\n' << std::flush;
     out << "Pretty name.: " << symbol.pretty_name << '\n';
diff --git a/src/goto-programs/string_abstraction.cpp b/src/goto-programs/string_abstraction.cpp
index 299d27cceef..f7599e16578 100644
--- a/src/goto-programs/string_abstraction.cpp
+++ b/src/goto-programs/string_abstraction.cpp
@@ -82,6 +82,16 @@ void string_abstraction(
   string_abstraction(dest);
 }
 
+void string_abstraction(
+  goto_modelt &goto_model,
+  message_handlert &message_handler)
+{
+  string_abstraction(
+    goto_model.symbol_table,
+    message_handler,
+    goto_model.goto_functions);
+}
+
 string_abstractiont::string_abstractiont(
   symbol_tablet &_symbol_table,
   message_handlert &_message_handler):
@@ -471,7 +481,7 @@ goto_programt::targett string_abstractiont::abstract(
 
   case RETURN:
     // use remove_returns
-    assert(false);
+    UNREACHABLE;
     break;
 
   case END_FUNCTION:
@@ -488,7 +498,7 @@ goto_programt::targett string_abstractiont::abstract(
   case LOCATION:
     break;
   case NO_INSTRUCTION_TYPE:
-    assert(false);
+    UNREACHABLE;
     break;
   }
 
@@ -637,7 +647,7 @@ exprt string_abstractiont::build(
 
   exprt str_struct;
   if(build_wrap(pointer, str_struct, write))
-    assert(false);
+    UNREACHABLE;
 
   exprt result=member(str_struct, what);
 
diff --git a/src/goto-programs/string_abstraction.h b/src/goto-programs/string_abstraction.h
index 9443b09d68b..68949fc6db7 100644
--- a/src/goto-programs/string_abstraction.h
+++ b/src/goto-programs/string_abstraction.h
@@ -17,7 +17,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/config.h>
 #include <util/std_expr.h>
 
-#include "goto_functions.h"
+#include "goto_model.h"
 
 class string_abstractiont:public messaget
 {
@@ -171,13 +171,12 @@ class string_abstractiont:public messaget
 // keep track of length of strings
 
 void string_abstraction(
-  symbol_tablet &symbol_table,
-  message_handlert &message_handler,
-  goto_programt &dest);
+  goto_modelt &,
+  message_handlert &);
 
 void string_abstraction(
-  symbol_tablet &symbol_table,
-  message_handlert &message_handler,
-  goto_functionst &dest);
+  symbol_tablet &,
+  message_handlert &,
+  goto_functionst &);
 
 #endif // CPROVER_GOTO_PROGRAMS_STRING_ABSTRACTION_H
diff --git a/src/goto-programs/string_instrumentation.cpp b/src/goto-programs/string_instrumentation.cpp
index f4ce4129eed..71cf5959e35 100644
--- a/src/goto-programs/string_instrumentation.cpp
+++ b/src/goto-programs/string_instrumentation.cpp
@@ -13,15 +13,17 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <algorithm>
 
-#include <util/std_expr.h>
-#include <util/std_code.h>
-#include <util/message.h>
 #include <util/arith_tools.h>
+#include <util/c_types.h>
 #include <util/config.h>
+#include <util/message.h>
+#include <util/std_expr.h>
+#include <util/std_code.h>
 #include <util/symbol_table.h>
 
 #include <goto-programs/format_strings.h>
-#include <util/c_types.h>
+#include <goto-programs/goto_model.h>
+
 
 exprt is_zero_string(
   const exprt &what,
@@ -170,6 +172,16 @@ void string_instrumentation(
   string_instrumentation(dest);
 }
 
+void string_instrumentation(
+  goto_modelt &goto_model,
+  message_handlert &message_handler)
+{
+  string_instrumentation(
+    goto_model.symbol_table,
+    message_handler,
+    goto_model.goto_functions);
+}
+
 void string_instrumentationt::operator()(goto_functionst &dest)
 {
   for(goto_functionst::function_mapt::iterator
diff --git a/src/goto-programs/string_instrumentation.h b/src/goto-programs/string_instrumentation.h
index 9d8bda00370..0314fe87305 100644
--- a/src/goto-programs/string_instrumentation.h
+++ b/src/goto-programs/string_instrumentation.h
@@ -15,16 +15,21 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "goto_functions.h"
 
 class message_handlert;
+class goto_modelt;
 
 void string_instrumentation(
-  symbol_tablet &symbol_table,
-  message_handlert &message_handler,
-  goto_programt &dest);
+  symbol_tablet &,
+  message_handlert &,
+  goto_programt &);
 
 void string_instrumentation(
-  symbol_tablet &symbol_table,
-  message_handlert &message_handler,
-  goto_functionst &dest);
+  symbol_tablet &,
+  message_handlert &,
+  goto_functionst &);
+
+void string_instrumentation(
+  goto_modelt &,
+  message_handlert &);
 
 exprt is_zero_string(const exprt &what, bool write=false);
 exprt zero_string_length(const exprt &what, bool write=false);
diff --git a/src/goto-programs/system_library_symbols.cpp b/src/goto-programs/system_library_symbols.cpp
new file mode 100644
index 00000000000..045619f132e
--- /dev/null
+++ b/src/goto-programs/system_library_symbols.cpp
@@ -0,0 +1,356 @@
+/*******************************************************************\
+
+Module: Goto Programs
+
+Author: Thomas Kiley
+
+\*******************************************************************/
+
+/// \file
+/// Goto Programs
+
+#include "system_library_symbols.h"
+#include <util/cprover_prefix.h>
+#include <util/prefix.h>
+#include <util/suffix.h>
+#include <util/symbol.h>
+#include <util/type.h>
+#include <sstream>
+
+system_library_symbolst::system_library_symbolst():
+  use_all_headers(false)
+{
+  init_system_library_map();
+}
+
+/// To generate a map of header file names -> list of symbols The symbol names
+/// are reserved as the header and source files will be compiled in to the goto
+/// program.
+void system_library_symbolst::init_system_library_map()
+{
+  // ctype.h
+  std::list<irep_idt> ctype_syms=
+  {
+    "isalnum", "isalpha", "isblank", "iscntrl", "isdigit", "isgraph",
+    "islower", "isprint", "ispunct", "isspace", "isupper", "isxdigit",
+    "tolower", "toupper"
+  };
+  add_to_system_library("ctype.h", ctype_syms);
+
+  // fcntl.h
+  std::list<irep_idt> fcntl_syms=
+  {
+    "creat", "fcntl", "open"
+  };
+  add_to_system_library("fcntl.h", fcntl_syms);
+
+  // locale.h
+  std::list<irep_idt> locale_syms=
+  {
+    "setlocale"
+  };
+  add_to_system_library("locale.h", locale_syms);
+
+  // math.h
+  std::list<irep_idt> math_syms=
+  {
+    "acos", "acosh", "asin", "asinh", "atan", "atan2", "atanh",
+    "cbrt", "ceil", "copysign", "cos", "cosh", "erf", "erfc", "exp",
+    "exp2", "expm1", "fabs", "fdim", "floor", "fma", "fmax", "fmin",
+    "fmod", "fpclassify", "fpclassifyl", "fpclassifyf", "frexp",
+    "hypot", "ilogb", "isfinite", "isinf", "isnan", "isnormal",
+    "j0", "j1", "jn", "ldexp", "lgamma", "llrint", "llround", "log",
+    "log10", "log1p", "log2", "logb", "lrint", "lround", "modf", "nan",
+    "nearbyint", "nextafter", "pow", "remainder", "remquo", "rint",
+    "round", "scalbln", "scalbn", "signbit", "sin", "sinh", "sqrt",
+    "tan", "tanh", "tgamma", "trunc", "y0", "y1", "yn", "isinff",
+    "isinfl", "isnanf", "isnanl"
+  };
+  add_to_system_library("math.h", math_syms);
+
+  // for some reason the math functions can sometimes be prefixed with
+  // a double underscore
+  std::list<irep_idt> underscore_math_syms;
+  for(const irep_idt &math_sym : math_syms)
+  {
+    std::ostringstream underscore_id;
+    underscore_id << "__" << math_sym;
+    underscore_math_syms.push_back(irep_idt(underscore_id.str()));
+  }
+  add_to_system_library("math.h", underscore_math_syms);
+
+  // pthread.h
+  std::list<irep_idt> pthread_syms=
+  {
+    "pthread_cleanup_pop", "pthread_cleanup_push",
+    "pthread_cond_broadcast", "pthread_cond_destroy",
+    "pthread_cond_init", "pthread_cond_signal",
+    "pthread_cond_timedwait", "pthread_cond_wait", "pthread_create",
+    "pthread_detach", "pthread_equal", "pthread_exit",
+    "pthread_getspecific", "pthread_join", "pthread_key_delete",
+    "pthread_mutex_destroy", "pthread_mutex_init",
+    "pthread_mutex_lock", "pthread_mutex_trylock",
+    "pthread_mutex_unlock", "pthread_once", "pthread_rwlock_destroy",
+    "pthread_rwlock_init", "pthread_rwlock_rdlock",
+    "pthread_rwlock_unlock", "pthread_rwlock_wrlock",
+    "pthread_rwlockattr_destroy", "pthread_rwlockattr_getpshared",
+    "pthread_rwlockattr_init", "pthread_rwlockattr_setpshared",
+    "pthread_self", "pthread_setspecific",
+    /* non-public struct types */
+    "tag-__pthread_internal_list", "tag-__pthread_mutex_s",
+    "pthread_mutex_t"
+  };
+  add_to_system_library("pthread.h", pthread_syms);
+
+  // setjmp.h
+  std::list<irep_idt> setjmp_syms=
+  {
+    "_longjmp", "_setjmp", "longjmp", "longjmperror", "setjmp",
+    "siglongjmp", "sigsetjmp"
+  };
+  add_to_system_library("setjmp.h", setjmp_syms);
+
+  // stdio.h
+  std::list<irep_idt> stdio_syms=
+  {
+    "asprintf", "clearerr", "fclose", "fdopen", "feof", "ferror",
+    "fflush", "fgetc", "fgetln", "fgetpos", "fgets", "fgetwc",
+    "fgetws", "fileno", "fopen", "fprintf", "fpurge", "fputc",
+    "fputs", "fputwc", "fputws", "fread", "freopen", "fropen",
+    "fscanf", "fseek", "fsetpos", "ftell", "funopen", "fwide",
+    "fwopen", "fwprintf", "fwrite", "getc", "getchar", "getdelim",
+    "getline", "gets", "getw", "getwc", "getwchar", "mkdtemp",
+    "mkstemp", "mktemp", "perror", "printf", "putc", "putchar",
+    "puts", "putw", "putwc", "putwchar", "remove", "rewind", "scanf",
+    "setbuf", "setbuffer", "setlinebuf", "setvbuf", "snprintf",
+    "sprintf", "sscanf", "swprintf", "sys_errlist",
+    "sys_nerr", "tempnam", "tmpfile", "tmpnam", "ungetc", "ungetwc",
+    "vasprintf", "vfprintf", "vfscanf", "vfwprintf", "vprintf",
+    "vscanf", "vsnprintf", "vsprintf", "vsscanf", "vswprintf",
+    "vwprintf", "wprintf",
+    /* non-public struct types */
+    "tag-__sFILE", "tag-__sbuf", // OS X
+    "tag-_IO_FILE", "tag-_IO_marker", // Linux
+  };
+  add_to_system_library("stdio.h", stdio_syms);
+
+  // stdlib.h
+  std::list<irep_idt> stdlib_syms=
+  {
+    "abort", "abs", "atexit", "atof", "atoi", "atol", "atoll",
+    "bsearch", "calloc", "div", "exit", "free", "getenv", "labs",
+    "ldiv", "llabs", "lldiv", "malloc", "mblen", "mbstowcs", "mbtowc",
+    "qsort", "rand", "realloc", "srand", "strtod", "strtof", "strtol",
+    "strtold", "strtoll", "strtoul", "strtoull", "system", "wcstombs",
+    "wctomb"
+  };
+  add_to_system_library("stdlib.h", stdlib_syms);
+
+  // string.h
+  std::list<irep_idt> string_syms=
+  {
+    "strcat", "strncat", "strchr", "strrchr", "strcmp", "strncmp",
+    "strcpy", "strncpy", "strerror", "strlen", "strpbrk", "strspn",
+    "strcspn", "strstr", "strtok", "strcasecmp", "strncasecmp", "strdup",
+    "memset"
+  };
+  add_to_system_library("string.h", string_syms);
+
+  // time.h
+  std::list<irep_idt> time_syms=
+  {
+    "asctime", "asctime_r", "ctime", "ctime_r", "difftime", "gmtime",
+    "gmtime_r", "localtime", "localtime_r", "mktime", "strftime",
+    /* non-public struct types */
+    "tag-timespec", "tag-timeval", "tag-tm"
+  };
+  add_to_system_library("time.h", time_syms);
+
+  // unistd.h
+  std::list<irep_idt> unistd_syms=
+  {
+    "_exit", "access", "alarm", "chdir", "chown", "close", "dup",
+    "dup2", "execl", "execle", "execlp", "execv", "execve", "execvp",
+    "fork", "fpathconf", "getcwd", "getegid", "geteuid", "getgid",
+    "getgroups", "getlogin", "getpgrp", "getpid", "getppid", "getuid",
+    "isatty", "link", "lseek", "pathconf", "pause", "pipe", "read",
+    "rmdir", "setgid", "setpgid", "setsid", "setuid", "sleep",
+    "sysconf", "tcgetpgrp", "tcsetpgrp", "ttyname", "ttyname_r",
+    "unlink", "write"
+  };
+  add_to_system_library("unistd.h", unistd_syms);
+
+  // sys/select.h
+  std::list<irep_idt> sys_select_syms=
+  {
+    "select",
+    /* non-public struct types */
+    "fd_set"
+  };
+  add_to_system_library("sys/select.h", sys_select_syms);
+
+  // sys/socket.h
+  std::list<irep_idt> sys_socket_syms=
+  {
+    "accept", "bind", "connect",
+    /* non-public struct types */
+    "tag-sockaddr"
+  };
+  add_to_system_library("sys/socket.h", sys_socket_syms);
+
+  // sys/stat.h
+  std::list<irep_idt> sys_stat_syms=
+  {
+    "fstat", "lstat", "stat",
+    /* non-public struct types */
+    "tag-stat"
+  };
+  add_to_system_library("sys/stat.h", sys_stat_syms);
+
+  std::list<irep_idt> fenv_syms=
+  {
+    "fenv_t", "fexcept_t", "feclearexcept", "fegetexceptflag",
+    "feraiseexcept", "fesetexceptflag", "fetestexcept",
+    "fegetround", "fesetround", "fegetenv", "feholdexcept",
+    "fesetenv", "feupdateenv"
+  };
+  add_to_system_library("fenv.h", fenv_syms);
+
+  std::list<irep_idt> errno_syms=
+  {
+    "__error", "__errno_location", "__errno"
+  };
+  add_to_system_library("errno.c", errno_syms);
+
+  std::list<irep_idt> noop_syms=
+  {
+    "__noop"
+  };
+  add_to_system_library("noop.c", noop_syms);
+
+#if 0
+  // sys/types.h
+  std::list<irep_idt> sys_types_syms=
+  {
+  };
+  add_to_system_library("sys/types.h", sys_types_syms);
+#endif
+
+  // sys/wait.h
+  std::list<irep_idt> sys_wait_syms=
+  {
+    "wait", "waitpid"
+  };
+  add_to_system_library("sys/wait.h", sys_wait_syms);
+}
+
+/// To add the symbols from a specific header file to the system library map.
+/// The symbol is used as the key so that we can easily look up symbols.
+/// \param header_file: the name of the header file the symbol came from
+/// \param symbols: a list of the names of the symbols in the header file
+void system_library_symbolst::add_to_system_library(
+  irep_idt header_file,
+  std::list<irep_idt> symbols)
+{
+  for(const irep_idt &symbol : symbols)
+  {
+    system_library_map[symbol]=header_file;
+  }
+}
+
+/// Helper function to call `is_symbol_internal_symbol` on a nameless
+/// fake symbol with the given type, to determine whether the type alone
+/// is sufficient to classify a symbol of that type as internal.
+/// \param type: the type to check
+/// \return True if the type is an internal type. If specific system headers
+///   need to be included, the out_system_headers will contain the headers.
+bool system_library_symbolst::is_type_internal(
+  const typet &type,
+  std::set<std::string> &out_system_headers) const
+{
+  symbolt symbol;
+  symbol.type=type;
+  return is_symbol_internal_symbol(symbol, out_system_headers);
+}
+
+/// To find out if a symbol is an internal symbol.
+/// \param symbol: the symbol to check
+/// \return True if the symbol is an internal symbol. If specific system headers
+///   need to be included, the out_system_headers will contain the headers.
+bool system_library_symbolst::is_symbol_internal_symbol(
+  const symbolt &symbol,
+  std::set<std::string> &out_system_headers) const
+{
+  const std::string &name_str=id2string(symbol.name);
+
+  if(has_prefix(name_str, CPROVER_PREFIX) ||
+     name_str=="__func__" ||
+     name_str=="__FUNCTION__" ||
+     name_str=="__PRETTY_FUNCTION__" ||
+     name_str=="argc'" ||
+     name_str=="argv'" ||
+     name_str=="envp'" ||
+     name_str=="envp_size'")
+    return true;
+
+  if(has_suffix(name_str, "$object"))
+    return true;
+
+  // exclude nondet instructions
+  if(has_prefix(name_str, "nondet_"))
+  {
+    return true;
+  }
+
+  if(has_prefix(name_str, "__VERIFIER"))
+  {
+    return true;
+  }
+
+  const std::string &file_str=id2string(symbol.location.get_file());
+
+  // don't dump internal GCC builtins
+  if(has_prefix(file_str, "gcc_builtin_headers_") &&
+     has_prefix(name_str, "__builtin_"))
+    return true;
+
+  if(name_str=="__builtin_va_start" ||
+     name_str=="__builtin_va_end" ||
+     symbol.name==ID_gcc_builtin_va_arg)
+  {
+    out_system_headers.insert("stdarg.h");
+    return true;
+  }
+
+  // don't dump asserts
+  else if(name_str=="__assert_fail" ||
+          name_str=="_assert" ||
+          name_str=="__assert_c99" ||
+          name_str=="_wassert")
+  {
+    return true;
+  }
+
+  const auto &it=system_library_map.find(symbol.name);
+
+  if(it!=system_library_map.end())
+  {
+    out_system_headers.insert(id2string(it->second));
+    return true;
+  }
+
+  if(use_all_headers &&
+     has_prefix(file_str, "/usr/include/"))
+  {
+    if(file_str.find("/bits/")==std::string::npos)
+    {
+      // Do not include transitive includes of system headers!
+      std::string::size_type prefix_len=std::string("/usr/include/").size();
+      out_system_headers.insert(file_str.substr(prefix_len));
+    }
+
+    return true;
+  }
+
+  return false;
+}
diff --git a/src/goto-programs/system_library_symbols.h b/src/goto-programs/system_library_symbols.h
new file mode 100644
index 00000000000..82146991be1
--- /dev/null
+++ b/src/goto-programs/system_library_symbols.h
@@ -0,0 +1,53 @@
+/*******************************************************************\
+
+Module: Goto Programs
+
+Author: Thomas Kiley
+
+\*******************************************************************/
+
+/// \file
+/// Goto Programs
+
+#ifndef CPROVER_GOTO_PROGRAMS_SYSTEM_LIBRARY_SYMBOLS_H
+#define CPROVER_GOTO_PROGRAMS_SYSTEM_LIBRARY_SYMBOLS_H
+
+#include <list>
+#include <set>
+#include <string>
+#include <util/irep.h>
+#include <util/type.h>
+
+class symbolt;
+class typet;
+
+class system_library_symbolst
+{
+public:
+  system_library_symbolst();
+
+  bool is_symbol_internal_symbol(
+    const symbolt &symbol,
+    std::set<std::string> &out_system_headers) const;
+
+  bool is_type_internal(
+    const typet &type,
+    std::set<std::string> &out_system_headers) const;
+
+  void set_use_all_headers(bool use)
+  {
+    use_all_headers=use;
+  }
+
+private:
+  void init_system_library_map();
+
+  void add_to_system_library(
+    irep_idt header_file,
+    std::list<irep_idt> symbols);
+
+  std::map<irep_idt, irep_idt> system_library_map;
+  bool use_all_headers;
+};
+
+#endif // CPROVER_GOTO_PROGRAMS_SYSTEM_LIBRARY_SYMBOLS_H
diff --git a/src/goto-symex/build_goto_trace.cpp b/src/goto-symex/build_goto_trace.cpp
index ee03e7e0bd8..56f9f42763d 100644
--- a/src/goto-symex/build_goto_trace.cpp
+++ b/src/goto-symex/build_goto_trace.cpp
@@ -109,6 +109,67 @@ exprt adjust_lhs_object(
   return nil_exprt();
 }
 
+/// set internal field for variable assignment related to dynamic_object[0-9]
+/// and dynamic_[0-9]_array.
+void set_internal_dynamic_object(
+  const exprt &expr,
+  goto_trace_stept &goto_trace_step,
+  const namespacet &ns)
+{
+  if(expr.id()==ID_symbol)
+  {
+    const irep_idt &id=to_ssa_expr(expr).get_original_name();
+    const symbolt *symbol;
+    if(!ns.lookup(id, symbol))
+    {
+      bool result=symbol->type.get_bool("#dynamic");
+      if(result)
+        goto_trace_step.internal=true;
+    }
+  }
+  else
+  {
+    forall_operands(it, expr)
+      set_internal_dynamic_object(*it, goto_trace_step, ns);
+  }
+}
+
+/// set internal for variables assignments related to dynamic_object and CPROVER
+/// internal functions (e.g., __CPROVER_initialize)
+void update_internal_field(
+  const symex_target_equationt::SSA_stept &SSA_step,
+  goto_trace_stept &goto_trace_step,
+  const namespacet &ns)
+{
+  // set internal for dynamic_object in both lhs and rhs expressions
+  set_internal_dynamic_object(SSA_step.ssa_lhs, goto_trace_step, ns);
+  set_internal_dynamic_object(SSA_step.ssa_rhs, goto_trace_step, ns);
+
+  // set internal field to CPROVER functions (e.g., __CPROVER_initialize)
+  if(SSA_step.is_function_call())
+  {
+    if(SSA_step.source.pc->source_location.as_string().empty())
+      goto_trace_step.internal=true;
+  }
+
+  // set internal field to input and output steps
+  if(goto_trace_step.type==goto_trace_stept::typet::OUTPUT ||
+      goto_trace_step.type==goto_trace_stept::typet::INPUT)
+  {
+    goto_trace_step.internal=true;
+  }
+
+  // set internal field to _start function-return step
+  if(SSA_step.source.pc->function==goto_functionst::entry_point())
+  {
+    // "__CPROVER_*" function calls in __CPROVER_start are already marked as
+    // internal. Don't mark any other function calls (i.e. "main"), function
+    // arguments or any other parts of a code_function_callt as internal.
+    if(SSA_step.source.pc->code.get_statement()!=ID_function_call)
+      goto_trace_step.internal=true;
+  }
+}
+
 void build_goto_trace(
   const symex_target_equationt &target,
   symex_target_equationt::SSA_stepst::const_iterator end_step,
@@ -216,6 +277,9 @@ void build_goto_trace(
     goto_trace_step.formatted=SSA_step.formatted;
     goto_trace_step.identifier=SSA_step.identifier;
 
+    // update internal field for specific variables in the counterexample
+    update_internal_field(SSA_step, goto_trace_step, ns);
+
     goto_trace_step.assignment_type=
       (it->is_assignment()&&
        (SSA_step.assignment_type==
diff --git a/src/goto-symex/goto_symex_state.cpp b/src/goto-symex/goto_symex_state.cpp
index 6402923c4cf..9616a3daa20 100644
--- a/src/goto-symex/goto_symex_state.cpp
+++ b/src/goto-symex/goto_symex_state.cpp
@@ -32,6 +32,8 @@ goto_symex_statet::goto_symex_statet():
   new_frame();
 }
 
+goto_symex_statet::~goto_symex_statet()=default;
+
 void goto_symex_statet::initialize(const goto_functionst &goto_functions)
 {
   goto_functionst::function_mapt::const_iterator it=
@@ -302,7 +304,7 @@ static void assert_l1_renaming(const exprt &expr)
   if(check_renaming_l1(expr))
   {
     std::cerr << expr.pretty() << '\n';
-    assert(false);
+    UNREACHABLE;
   }
   #else
   (void)expr;
@@ -315,7 +317,7 @@ static void assert_l2_renaming(const exprt &expr)
   if(check_renaming(expr))
   {
     std::cerr << expr.pretty() << '\n';
-    assert(false);
+    UNREACHABLE;
   }
   #else
   (void)expr;
@@ -437,7 +439,7 @@ void goto_symex_statet::set_ssa_indices(
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
diff --git a/src/goto-symex/goto_symex_state.h b/src/goto-symex/goto_symex_state.h
index d62d4a66af9..3c2deecf994 100644
--- a/src/goto-symex/goto_symex_state.h
+++ b/src/goto-symex/goto_symex_state.h
@@ -13,11 +13,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #define CPROVER_GOTO_SYMEX_GOTO_SYMEX_STATE_H
 
 #include <cassert>
+#include <memory>
 #include <unordered_set>
 
 #include <util/guard.h>
 #include <util/std_expr.h>
 #include <util/ssa_expr.h>
+#include <util/make_unique.h>
 
 #include <pointer-analysis/value_set.h>
 #include <goto-programs/goto_functions.h>
@@ -27,10 +29,11 @@ Author: Daniel Kroening, kroening@kroening.com
 class dirtyt;
 
 // central data structure: state
-class goto_symex_statet
+class goto_symex_statet final
 {
 public:
   goto_symex_statet();
+  ~goto_symex_statet();
 
   // distance from entry
   unsigned depth;
@@ -341,7 +344,7 @@ class goto_symex_statet
 
   void switch_to_thread(unsigned t);
   bool record_events;
-  const dirtyt * dirty;
+  std::unique_ptr<const dirtyt> dirty;
 };
 
 #endif // CPROVER_GOTO_SYMEX_GOTO_SYMEX_STATE_H
diff --git a/src/goto-symex/partial_order_concurrency.cpp b/src/goto-symex/partial_order_concurrency.cpp
index e0f82ba6af2..e79c6f3d90d 100644
--- a/src/goto-symex/partial_order_concurrency.cpp
+++ b/src/goto-symex/partial_order_concurrency.cpp
@@ -133,7 +133,7 @@ irep_idt partial_order_concurrencyt::rw_clock_id(
   else if(event->is_shared_read())
     return id2string(id(event))+"$rclk$"+std::to_string(axiom);
   else
-    assert(false);
+    UNREACHABLE;
 
   return "";
 }
@@ -156,7 +156,7 @@ symbol_exprt partial_order_concurrencyt::clock(
       std::to_string(numbering[event])+"$spwnclk$"+std::to_string(axiom);
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   return symbol_exprt(identifier, clock_type);
 }
diff --git a/src/goto-symex/partial_order_concurrency.h b/src/goto-symex/partial_order_concurrency.h
index 5163451e210..adb82366cbd 100644
--- a/src/goto-symex/partial_order_concurrency.h
+++ b/src/goto-symex/partial_order_concurrency.h
@@ -116,7 +116,7 @@ class numbered_evtst
     const ordered_evtst::size_type offset=ordered_evts.size();
     ordered_evts.push_back(&evt);
     if(!ordered_evts_map.insert(std::make_pair(&evt, offset)).second)
-      assert(false);
+      UNREACHABLE;
     assert(ordered_evts.size()==ordered_evts_map.size());
 
     if(evt.direction==evtt::D_SYNC ||
diff --git a/src/goto-symex/slice.cpp b/src/goto-symex/slice.cpp
index 0a59b7befea..67795005c37 100644
--- a/src/goto-symex/slice.cpp
+++ b/src/goto-symex/slice.cpp
@@ -105,7 +105,7 @@ void symex_slicet::slice(symex_target_equationt::SSA_stept &SSA_step)
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -196,7 +196,7 @@ void symex_slicet::collect_open_variables(
       break;
 
     default:
-      assert(false);
+      UNREACHABLE;
     }
   }
 
diff --git a/src/goto-symex/symex_assign.cpp b/src/goto-symex/symex_assign.cpp
index a403ff3a129..518df75b954 100644
--- a/src/goto-symex/symex_assign.cpp
+++ b/src/goto-symex/symex_assign.cpp
@@ -60,7 +60,8 @@ void goto_symext::symex_assign(
       throw "symex_assign: unexpected function call: "+id2string(identifier);
     }
     else if(statement==ID_cpp_new ||
-            statement==ID_cpp_new_array)
+            statement==ID_cpp_new_array ||
+            statement==ID_java_new_array)
       symex_cpp_new(state, lhs, side_effect_expr);
     else if(statement==ID_malloc)
       symex_malloc(state, lhs, side_effect_expr);
@@ -471,7 +472,7 @@ void goto_symext::symex_assign_byte_extract(
   else if(lhs.id()==ID_byte_extract_big_endian)
     new_rhs.id(ID_byte_update_big_endian);
   else
-    assert(false);
+    UNREACHABLE;
 
   new_rhs.copy_to_operands(lhs.op(), lhs.offset(), rhs);
   new_rhs.type()=lhs.op().type();
diff --git a/src/goto-symex/symex_builtin_functions.cpp b/src/goto-symex/symex_builtin_functions.cpp
index d6e9fd416d8..8b317f3cdc3 100644
--- a/src/goto-symex/symex_builtin_functions.cpp
+++ b/src/goto-symex/symex_builtin_functions.cpp
@@ -23,7 +23,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/simplify_expr.h>
 #include <util/prefix.h>
 #include <util/string2int.h>
-
+#include <util/invariant_utils.h>
 #include <util/c_types.h>
 
 #include <linking/zero_initializer.h>
@@ -361,6 +361,11 @@ void goto_symext::symex_output(
   target.output(state.guard.as_expr(), state.source, output_id, args);
 }
 
+/// Handles side effects of type 'new' for C++ and 'new array'
+/// for C++ and Java language modes
+/// \param state: Symex state
+/// \param lhs: left-hand side of assignment
+/// \param code: right-hand side containing side effect
 void goto_symext::symex_cpp_new(
   statet &state,
   const exprt &lhs,
@@ -371,7 +376,8 @@ void goto_symext::symex_cpp_new(
   if(code.type().id()!=ID_pointer)
     throw "new expected to return pointer";
 
-  do_array=(code.get(ID_statement)==ID_cpp_new_array);
+  do_array=(code.get(ID_statement)==ID_cpp_new_array ||
+            code.get(ID_statement)==ID_java_new_array);
 
   dynamic_counter++;
 
@@ -384,7 +390,13 @@ void goto_symext::symex_cpp_new(
              "dynamic_"+count_string+"_value";
   symbol.name="symex_dynamic::"+id2string(symbol.base_name);
   symbol.is_lvalue=true;
-  symbol.mode=ID_cpp;
+  if(code.get(ID_statement)==ID_cpp_new_array ||
+     code.get(ID_statement)==ID_cpp_new)
+    symbol.mode=ID_cpp;
+  else if(code.get(ID_statement)==ID_java_new_array)
+    symbol.mode=ID_java;
+  else
+    INVARIANT_WITH_IREP(false, "Unexpected side effect expression", code);
 
   if(do_array)
   {
@@ -397,7 +409,6 @@ void goto_symext::symex_cpp_new(
   else
     symbol.type=code.type().subtype();
 
-  // symbol.type.set("#active", symbol_expr(active_symbol));
   symbol.type.set("#dynamic", true);
 
   new_symbol_table.add(symbol);
@@ -425,7 +436,10 @@ void goto_symext::symex_cpp_delete(
   statet &state,
   const codet &code)
 {
-  // bool do_array=code.get(ID_statement)==ID_cpp_delete_array;
+  // TODO
+  #if 0
+  bool do_array=code.get(ID_statement)==ID_cpp_delete_array;
+  #endif
 }
 
 void goto_symext::symex_trace(
diff --git a/src/goto-symex/symex_dereference.cpp b/src/goto-symex/symex_dereference.cpp
index f066ee1065f..1349233d45e 100644
--- a/src/goto-symex/symex_dereference.cpp
+++ b/src/goto-symex/symex_dereference.cpp
@@ -297,7 +297,7 @@ void goto_symext::dereference_rec(
           to_index_expr(expr).array().type().id()==ID_pointer)
   {
     // old stuff, will go away
-    assert(false);
+    UNREACHABLE;
   }
   else if(expr.id()==ID_address_of)
   {
diff --git a/src/goto-symex/symex_main.cpp b/src/goto-symex/symex_main.cpp
index 4fce789ad3a..d7a897e7f85 100644
--- a/src/goto-symex/symex_main.cpp
+++ b/src/goto-symex/symex_main.cpp
@@ -12,11 +12,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "goto_symex.h"
 
 #include <cassert>
+#include <memory>
 
 #include <util/std_expr.h>
 #include <util/rename.h>
 #include <util/symbol_table.h>
 #include <util/replace_symbol.h>
+#include <util/make_unique.h>
 
 #include <analyses/dirty.h>
 
@@ -136,7 +138,7 @@ void goto_symext::operator()(
   state.top().end_of_function=--goto_program.instructions.end();
   state.top().calling_location.pc=state.top().end_of_function;
   state.symex_target=&target;
-  state.dirty=new dirtyt(goto_functions);
+  state.dirty=util_make_unique<dirtyt>(goto_functions);
 
   symex_transition(state, state.source.pc);
 
@@ -157,7 +159,6 @@ void goto_symext::operator()(
     }
   }
 
-  delete state.dirty;
   state.dirty=nullptr;
 }
 
diff --git a/src/goto-symex/symex_other.cpp b/src/goto-symex/symex_other.cpp
index d5b30fa4b05..e98480e98a9 100644
--- a/src/goto-symex/symex_other.cpp
+++ b/src/goto-symex/symex_other.cpp
@@ -66,7 +66,7 @@ void goto_symext::symex_other(
   }
   else if(statement==ID_decl)
   {
-    assert(false); // see symex_decl.cpp
+    UNREACHABLE; // see symex_decl.cpp
   }
   else if(statement==ID_nondet)
   {
diff --git a/src/goto-symex/symex_start_thread.cpp b/src/goto-symex/symex_start_thread.cpp
index 8ebed5216c1..a7e3101d84d 100644
--- a/src/goto-symex/symex_start_thread.cpp
+++ b/src/goto-symex/symex_start_thread.cpp
@@ -32,7 +32,7 @@ void goto_symext::symex_start_thread(statet &state)
     throw "start_thread expects one target";
 
   goto_programt::const_targett thread_target=
-    instruction.targets.front();
+    instruction.get_target();
 
   // put into thread vector
   std::size_t t=state.threads.size();
@@ -71,7 +71,7 @@ void goto_symext::symex_start_thread(statet &state)
     if(!state.level1.current_names.insert(
         std::make_pair(lhs.get_l1_object_identifier(),
                        std::make_pair(lhs, 0))).second)
-      assert(false);
+      UNREACHABLE;
     state.rename(lhs, ns, goto_symex_statet::L1);
     const irep_idt l1_name=lhs.get_l1_object_identifier();
     // store it
diff --git a/src/goto-symex/symex_target_equation.cpp b/src/goto-symex/symex_target_equation.cpp
index 6627e198b71..76a6bae061a 100644
--- a/src/goto-symex/symex_target_equation.cpp
+++ b/src/goto-symex/symex_target_equation.cpp
@@ -511,7 +511,7 @@ void symex_target_equationt::convert_assertions(
         prop_conv.set_to_true(step.cond_expr);
     }
 
-    assert(false); // unreachable
+    UNREACHABLE; // unreachable
   }
 
   // We do (NOT a1) OR (NOT a2) ...
@@ -695,7 +695,7 @@ void symex_target_equationt::SSA_stept::output(
   case goto_trace_stept::typet::GOTO:
     out << "IF " << from_expr(ns, "", cond_expr) << " GOTO\n"; break;
 
-  default: assert(false);
+  default: UNREACHABLE;
   }
 
   if(is_assert() || is_assume() || is_assignment() || is_constraint())
diff --git a/src/java_bytecode/Makefile b/src/java_bytecode/Makefile
index 677987cfc9b..06a7d55757e 100644
--- a/src/java_bytecode/Makefile
+++ b/src/java_bytecode/Makefile
@@ -1,10 +1,12 @@
 SRC = bytecode_info.cpp \
       character_refine_preprocess.cpp \
       ci_lazy_methods.cpp \
+      ci_lazy_methods_needed.cpp \
       expr2java.cpp \
       jar_file.cpp \
       java_bytecode_convert_class.cpp \
       java_bytecode_convert_method.cpp \
+      java_bytecode_instrument.cpp \
       java_bytecode_internal_additions.cpp \
       java_bytecode_language.cpp \
       java_bytecode_parse_tree.cpp \
@@ -20,8 +22,11 @@ SRC = bytecode_info.cpp \
       java_object_factory.cpp \
       java_pointer_casts.cpp \
       java_root_class.cpp \
+      java_string_library_preprocess.cpp \
       java_types.cpp \
       java_utils.cpp \
+      mz_zip_archive.cpp \
+      select_pointer_type.cpp \
       # Empty last line
 
 INCLUDES= -I ..
diff --git a/src/java_bytecode/character_refine_preprocess.cpp b/src/java_bytecode/character_refine_preprocess.cpp
index b7c1e1b281e..81c6e53e23e 100644
--- a/src/java_bytecode/character_refine_preprocess.cpp
+++ b/src/java_bytecode/character_refine_preprocess.cpp
@@ -23,7 +23,7 @@ Date:   March 2017
 /// \param target: A position in a goto program
 codet character_refine_preprocesst::convert_char_function(
   exprt (*expr_function)(const exprt &chr, const typet &type),
-  conversion_input &target)
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==1);
@@ -79,7 +79,8 @@ exprt character_refine_preprocesst::expr_of_char_count(
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.charCount:(I)I
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_char_count(conversion_input &target)
+codet character_refine_preprocesst::convert_char_count(
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_char_count, target);
@@ -96,7 +97,8 @@ exprt character_refine_preprocesst::expr_of_char_value(
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.charValue:()C
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_char_value(conversion_input &target)
+codet character_refine_preprocesst::convert_char_value(
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_char_value, target);
@@ -105,7 +107,7 @@ codet character_refine_preprocesst::convert_char_value(conversion_input &target)
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.compare:(CC)I
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_compare(conversion_input &target)
+codet character_refine_preprocesst::convert_compare(conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==2);
@@ -125,14 +127,22 @@ codet character_refine_preprocesst::convert_compare(conversion_input &target)
 
 
 /// Converts function call to an assignment of an expression corresponding to
-/// the java method Character.digit:(CI)I
+/// the java method Character.digit:(CI)I. The function call has one character
+/// argument and an optional integer radix argument. If the radix is not given
+/// it is set to 36 by default.
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_digit_char(conversion_input &target)
+/// \return code assigning the result of the Character.digit function to the
+///         left-hand-side of the given target
+codet character_refine_preprocesst::convert_digit_char(
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
-  assert(function_call.arguments().size()==2);
+  const std::size_t nb_args=function_call.arguments().size();
+  PRECONDITION(nb_args==1 || nb_args==2);
   const exprt &arg=function_call.arguments()[0];
-  const exprt &radix=function_call.arguments()[1];
+  // If there is no radix argument we set it to 36 which is the maximum possible
+  const exprt &radix=
+    nb_args>1?function_call.arguments()[1]:from_integer(36, arg.type());
   const exprt &result=function_call.lhs();
   const typet &type=result.type();
 
@@ -200,28 +210,29 @@ codet character_refine_preprocesst::convert_digit_char(conversion_input &target)
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.digit:(II)I
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_digit_int(conversion_input &target)
+codet character_refine_preprocesst::convert_digit_int(conversion_inputt &target)
 {
   return convert_digit_char(target);
 }
 
 /// Converts function call to an assignment of an expression corresponding to
-/// the java method Character.forDigit:(II)I
+/// the java method Character.forDigit:(II)C
 ///
 ///    TODO: For now the radix argument is ignored
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_for_digit(conversion_input &target)
+codet character_refine_preprocesst::convert_for_digit(conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==2);
   const exprt &digit=function_call.arguments()[0];
   const exprt &result=function_call.lhs();
   const typet &type=result.type();
+  typecast_exprt casted_digit(digit, type);
 
   exprt d10=from_integer(10, type);
-  binary_relation_exprt small(digit, ID_le, d10);
-  plus_exprt value1(digit, from_integer('0', type));
-  minus_exprt value2(plus_exprt(digit, from_integer('a', digit.type())), d10);
+  binary_relation_exprt small(casted_digit, ID_le, d10);
+  plus_exprt value1(casted_digit, from_integer('0', type));
+  plus_exprt value2(minus_exprt(casted_digit, d10), from_integer('a', type));
   return code_assignt(result, if_exprt(small, value1, value2));
 }
 
@@ -229,7 +240,7 @@ codet character_refine_preprocesst::convert_for_digit(conversion_input &target)
 /// the java method Character.getDirectionality:(C)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_get_directionality_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   // TODO: This is unimplemented for now as it requires analyzing
   // the UnicodeData file to find characters directionality.
@@ -240,7 +251,7 @@ codet character_refine_preprocesst::convert_get_directionality_char(
 /// the java method Character.getDirectionality:(I)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_get_directionality_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_get_directionality_char(target);
 }
@@ -250,7 +261,7 @@ codet character_refine_preprocesst::convert_get_directionality_int(
 ///
 ///    TODO: For now this is only for ASCII characters
 codet character_refine_preprocesst::convert_get_numeric_value_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_digit_char(target);
 }
@@ -261,7 +272,7 @@ codet character_refine_preprocesst::convert_get_numeric_value_char(
 ///    TODO: For now this is only for ASCII characters
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_get_numeric_value_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_digit_int(target);
 }
@@ -270,7 +281,7 @@ codet character_refine_preprocesst::convert_get_numeric_value_int(
 /// the java method Character.getType:(C)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_get_type_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   // TODO: This is unimplemented for now as it requires analyzing
   // the UnicodeData file to categorize characters.
@@ -281,7 +292,7 @@ codet character_refine_preprocesst::convert_get_type_char(
 /// the java method Character.getType:(I)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_get_type_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_get_type_char(target);
 }
@@ -289,7 +300,7 @@ codet character_refine_preprocesst::convert_get_type_int(
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.hashCode:()I
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_hash_code(conversion_input &target)
+codet character_refine_preprocesst::convert_hash_code(conversion_inputt &target)
 {
   return convert_char_value(target);
 }
@@ -314,7 +325,7 @@ exprt character_refine_preprocesst::expr_of_high_surrogate(
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.highSurrogate:(C)Z
 codet character_refine_preprocesst::convert_high_surrogate(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_high_surrogate, target);
@@ -376,7 +387,7 @@ exprt character_refine_preprocesst::expr_of_is_alphabetic(
 /// the java method Character.isAlphabetic:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_alphabetic(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_alphabetic, target);
@@ -399,7 +410,7 @@ exprt character_refine_preprocesst::expr_of_is_bmp_code_point(
 /// the java method Character.isBmpCodePoint:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_bmp_code_point(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_bmp_code_point, target);
@@ -444,7 +455,7 @@ exprt character_refine_preprocesst::expr_of_is_defined(
 /// the java method Character.isDefined:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_defined_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_defined, target);
@@ -454,7 +465,7 @@ codet character_refine_preprocesst::convert_is_defined_char(
 /// the java method Character.isDefined:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_defined_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_defined_char(target);
 }
@@ -491,7 +502,7 @@ exprt character_refine_preprocesst::expr_of_is_digit(
 /// the java method Character.isDigit:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_digit_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_digit, target);
@@ -501,7 +512,7 @@ codet character_refine_preprocesst::convert_is_digit_char(
 /// the java method Character.digit:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_digit_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_digit_char(target);
 }
@@ -521,7 +532,7 @@ exprt character_refine_preprocesst::expr_of_is_high_surrogate(
 /// the java method Character.isHighSurrogate:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_high_surrogate(
-    conversion_input &target)
+    conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_high_surrogate, target);
@@ -552,7 +563,7 @@ exprt character_refine_preprocesst::expr_of_is_identifier_ignorable(
 ///    TODO: For now, we ignore the FORMAT general category value
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_identifier_ignorable_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_identifier_ignorable, target);
@@ -564,7 +575,7 @@ codet character_refine_preprocesst::convert_is_identifier_ignorable_char(
 ///    TODO: For now, we ignore the FORMAT general category value
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_identifier_ignorable_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_identifier_ignorable_char(target);
 }
@@ -573,7 +584,7 @@ codet character_refine_preprocesst::convert_is_identifier_ignorable_int(
 /// the java method Character.isIdeographic:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_ideographic(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==1);
@@ -587,7 +598,7 @@ codet character_refine_preprocesst::convert_is_ideographic(
 /// the java method Character.isISOControl:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_ISO_control_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==1);
@@ -602,7 +613,7 @@ codet character_refine_preprocesst::convert_is_ISO_control_char(
 /// the java method Character.isISOControl:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_ISO_control_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_ISO_control_char(target);
 }
@@ -614,7 +625,7 @@ codet character_refine_preprocesst::convert_is_ISO_control_int(
 ///          combining mark, non-spacing mark
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_java_identifier_part_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_unicode_identifier_part, target);
@@ -624,7 +635,7 @@ codet character_refine_preprocesst::convert_is_java_identifier_part_char(
 /// the java method isJavaIdentifierPart:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_java_identifier_part_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_unicode_identifier_part_char(target);
 }
@@ -637,7 +648,7 @@ codet character_refine_preprocesst::convert_is_java_identifier_part_int(
 ///          other characters.
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_java_identifier_start_char(
-    conversion_input &target)
+    conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_unicode_identifier_start, target);
@@ -647,7 +658,7 @@ codet character_refine_preprocesst::convert_is_java_identifier_start_char(
 /// the java method isJavaIdentifierStart:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_java_identifier_start_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_java_identifier_start_char(target);
 }
@@ -656,7 +667,7 @@ codet character_refine_preprocesst::convert_is_java_identifier_start_int(
 /// the java method Character.isJavaLetter:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_java_letter(
-    conversion_input &target)
+    conversion_inputt &target)
 {
   return convert_is_java_identifier_start_char(target);
 }
@@ -665,7 +676,7 @@ codet character_refine_preprocesst::convert_is_java_letter(
 /// the java method isJavaLetterOrDigit:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_java_letter_or_digit(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_java_identifier_part_char(target);
 }
@@ -674,7 +685,7 @@ codet character_refine_preprocesst::convert_is_java_letter_or_digit(
 /// the java method Character.isLetter:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_letter_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_letter, target);
@@ -684,7 +695,7 @@ codet character_refine_preprocesst::convert_is_letter_char(
 /// the java method Character.isLetter:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_letter_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_letter_char(target);
 }
@@ -703,7 +714,7 @@ exprt character_refine_preprocesst::expr_of_is_letter_or_digit(
 /// the java method Character.isLetterOrDigit:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_letter_or_digit_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_digit, target);
@@ -713,7 +724,7 @@ codet character_refine_preprocesst::convert_is_letter_or_digit_char(
 /// the java method Character.isLetterOrDigit:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_letter_or_digit_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_letter_or_digit_char(target);
 }
@@ -724,7 +735,7 @@ codet character_refine_preprocesst::convert_is_letter_or_digit_int(
 ///    TODO: For now we only consider ASCII characters
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_lower_case_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_ascii_lower_case, target);
@@ -736,7 +747,7 @@ codet character_refine_preprocesst::convert_is_lower_case_char(
 ///    TODO: For now we only consider ASCII characters
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_lower_case_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_lower_case_char(target);
 }
@@ -745,7 +756,7 @@ codet character_refine_preprocesst::convert_is_lower_case_int(
 /// the java method Character.isLowSurrogate:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_low_surrogate(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==1);
@@ -774,7 +785,7 @@ exprt character_refine_preprocesst::expr_of_is_mirrored(
 ///    TODO: For now only ASCII characters are considered
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_mirrored_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_mirrored, target);
@@ -786,7 +797,7 @@ codet character_refine_preprocesst::convert_is_mirrored_char(
 ///    TODO: For now only ASCII characters are considered
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_mirrored_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_mirrored_char(target);
 }
@@ -794,7 +805,7 @@ codet character_refine_preprocesst::convert_is_mirrored_int(
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.isSpace:(C)Z
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_is_space(conversion_input &target)
+codet character_refine_preprocesst::convert_is_space(conversion_inputt &target)
 {
   return convert_is_whitespace_char(target);
 }
@@ -818,7 +829,7 @@ exprt character_refine_preprocesst::expr_of_is_space_char(
 /// the java method Character.isSpaceChar:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_space_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_space_char, target);
@@ -828,7 +839,7 @@ codet character_refine_preprocesst::convert_is_space_char(
 /// the java method Character.isSpaceChar:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_space_char_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_space_char(target);
 }
@@ -848,7 +859,7 @@ exprt character_refine_preprocesst::expr_of_is_supplementary_code_point(
 /// the java method Character.isSupplementaryCodePoint:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_supplementary_code_point(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_supplementary_code_point, target);
@@ -868,7 +879,7 @@ exprt character_refine_preprocesst::expr_of_is_surrogate(
 /// the java method Character.isSurrogate:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_surrogate(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_surrogate, target);
@@ -878,7 +889,7 @@ codet character_refine_preprocesst::convert_is_surrogate(
 /// the java method Character.isSurrogatePair:(CC)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_surrogate_pair(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==2);
@@ -911,7 +922,7 @@ exprt character_refine_preprocesst::expr_of_is_title_case(
 /// the java method Character.isTitleCase:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_title_case_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_title_case, target);
@@ -921,7 +932,7 @@ codet character_refine_preprocesst::convert_is_title_case_char(
 /// the java method Character.isTitleCase:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_title_case_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_title_case_char(target);
 }
@@ -972,7 +983,7 @@ exprt character_refine_preprocesst::expr_of_is_unicode_identifier_part(
 /// the java method Character.isUnicodeIdentifierPart:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_unicode_identifier_part_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_unicode_identifier_part, target);
@@ -982,7 +993,7 @@ codet character_refine_preprocesst::convert_is_unicode_identifier_part_char(
 /// the java method Character.isUnicodeIdentifierPart:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_unicode_identifier_part_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_unicode_identifier_part_char(target);
 }
@@ -1003,7 +1014,7 @@ exprt character_refine_preprocesst::expr_of_is_unicode_identifier_start(
 /// the java method Character.isUnicodeIdentifierStart:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_unicode_identifier_start_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_unicode_identifier_start, target);
@@ -1013,7 +1024,7 @@ codet character_refine_preprocesst::convert_is_unicode_identifier_start_char(
 /// the java method Character.isUnicodeIdentifierStart:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_unicode_identifier_start_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_unicode_identifier_start_char(target);
 }
@@ -1024,7 +1035,7 @@ codet character_refine_preprocesst::convert_is_unicode_identifier_start_int(
 ///    TODO: For now we only consider ASCII characters
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_upper_case_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_ascii_upper_case, target);
@@ -1034,7 +1045,7 @@ codet character_refine_preprocesst::convert_is_upper_case_char(
 /// the java method Character.isUpperCase:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_upper_case_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_upper_case_char(target);
 }
@@ -1054,7 +1065,7 @@ exprt character_refine_preprocesst::expr_of_is_valid_code_point(
 /// the java method Character.isValidCodePoint:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_valid_code_point(
-    conversion_input &target)
+    conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_valid_code_point, target);
@@ -1086,7 +1097,7 @@ exprt character_refine_preprocesst::expr_of_is_whitespace(
 /// the java method Character.isWhitespace:(C)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_whitespace_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_is_whitespace, target);
@@ -1096,7 +1107,7 @@ codet character_refine_preprocesst::convert_is_whitespace_char(
 /// the java method Character.isWhitespace:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_is_whitespace_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_is_whitespace_char(target);
 }
@@ -1119,7 +1130,7 @@ exprt character_refine_preprocesst::expr_of_low_surrogate(
 /// the java method Character.lowSurrogate:(I)Z
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_low_surrogate(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_low_surrogate, target);
@@ -1142,7 +1153,7 @@ exprt character_refine_preprocesst::expr_of_reverse_bytes(
 /// the java method Character.reverseBytes:(C)C
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_reverse_bytes(
-    conversion_input &target)
+    conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_reverse_bytes, target);
@@ -1174,7 +1185,7 @@ exprt character_refine_preprocesst::expr_of_to_chars(
 /// Converts function call to an assignment of an expression corresponding to
 /// the java method Character.toChars:(I)[C
 /// \param target: a position in a goto program
-codet character_refine_preprocesst::convert_to_chars(conversion_input &target)
+codet character_refine_preprocesst::convert_to_chars(conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_to_chars, target);
@@ -1184,7 +1195,7 @@ codet character_refine_preprocesst::convert_to_chars(conversion_input &target)
 /// the java method Character.toCodePoint:(CC)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_code_point(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   const code_function_callt &function_call=target;
   assert(function_call.arguments().size()==2);
@@ -1230,7 +1241,7 @@ exprt character_refine_preprocesst::expr_of_to_lower_case(
 /// the java method Character.toLowerCase:(C)C
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_lower_case_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_to_lower_case, target);
@@ -1240,7 +1251,7 @@ codet character_refine_preprocesst::convert_to_lower_case_char(
 /// the java method Character.toLowerCase:(I)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_lower_case_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_to_lower_case_char(target);
 }
@@ -1286,7 +1297,7 @@ exprt character_refine_preprocesst::expr_of_to_title_case(
 /// the java method Character.toTitleCase:(C)C
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_title_case_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_to_title_case, target);
@@ -1296,7 +1307,7 @@ codet character_refine_preprocesst::convert_to_title_case_char(
 /// the java method Character.toTitleCase:(I)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_title_case_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_to_title_case_char(target);
 }
@@ -1323,7 +1334,7 @@ exprt character_refine_preprocesst::expr_of_to_upper_case(
 /// the java method Character.toUpperCase:(C)C
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_upper_case_char(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_char_function(
     &character_refine_preprocesst::expr_of_to_upper_case, target);
@@ -1333,7 +1344,7 @@ codet character_refine_preprocesst::convert_to_upper_case_char(
 /// the java method Character.toUpperCase:(I)I
 /// \param target: a position in a goto program
 codet character_refine_preprocesst::convert_to_upper_case_int(
-  conversion_input &target)
+  conversion_inputt &target)
 {
   return convert_to_upper_case_char(target);
 }
diff --git a/src/java_bytecode/character_refine_preprocess.h b/src/java_bytecode/character_refine_preprocess.h
index 3714aa6b9a9..a41d59b5226 100644
--- a/src/java_bytecode/character_refine_preprocess.h
+++ b/src/java_bytecode/character_refine_preprocess.h
@@ -31,122 +31,123 @@ class character_refine_preprocesst:public messaget
   codet replace_character_call(const code_function_callt &call) const;
 
 private:
-  typedef const code_function_callt &conversion_input;
-  typedef codet (*conversion_functiont)(conversion_input &target);
+  typedef const code_function_callt &conversion_inputt;
+  typedef codet (*conversion_functiont)(conversion_inputt &target);
   // A table tells us what method to call for each java method signature
   std::unordered_map<irep_idt, conversion_functiont, irep_id_hash>
     conversion_table;
 
   // Conversion functions
   static exprt expr_of_char_count(const exprt &chr, const typet &type);
-  static codet convert_char_count(conversion_input &target);
+  static codet convert_char_count(conversion_inputt &target);
   static exprt expr_of_char_value(const exprt &chr, const typet &type);
-  static codet convert_char_value(conversion_input &target);
-  static codet convert_compare(conversion_input &target);
-  static codet convert_digit_char(conversion_input &target);
-  static codet convert_digit_int(conversion_input &target);
-  static codet convert_for_digit(conversion_input &target);
-  static codet convert_get_directionality_char(conversion_input &target);
-  static codet convert_get_directionality_int(conversion_input &target);
-  static codet convert_get_numeric_value_char(conversion_input &target);
-  static codet convert_get_numeric_value_int(conversion_input &target);
-  static codet convert_get_type_char(conversion_input &target);
-  static codet convert_get_type_int(conversion_input &target);
-  static codet convert_hash_code(conversion_input &target);
+  static codet convert_char_value(conversion_inputt &target);
+  static codet convert_compare(conversion_inputt &target);
+  static codet convert_digit_char(conversion_inputt &target);
+  static codet convert_digit_int(conversion_inputt &target);
+  static codet convert_for_digit(conversion_inputt &target);
+  static codet convert_get_directionality_char(conversion_inputt &target);
+  static codet convert_get_directionality_int(conversion_inputt &target);
+  static codet convert_get_numeric_value_char(conversion_inputt &target);
+  static codet convert_get_numeric_value_int(conversion_inputt &target);
+  static codet convert_get_type_char(conversion_inputt &target);
+  static codet convert_get_type_int(conversion_inputt &target);
+  static codet convert_hash_code(conversion_inputt &target);
   static exprt expr_of_high_surrogate(const exprt &chr, const typet &type);
-  static codet convert_high_surrogate(conversion_input &target);
+  static codet convert_high_surrogate(conversion_inputt &target);
   static exprt expr_of_is_alphabetic(const exprt &chr, const typet &type);
-  static codet convert_is_alphabetic(conversion_input &target);
+  static codet convert_is_alphabetic(conversion_inputt &target);
   static exprt expr_of_is_bmp_code_point(const exprt &chr, const typet &type);
-  static codet convert_is_bmp_code_point(conversion_input &target);
+  static codet convert_is_bmp_code_point(conversion_inputt &target);
   static exprt expr_of_is_defined(const exprt &chr, const typet &type);
-  static codet convert_is_defined_char(conversion_input &target);
-  static codet convert_is_defined_int(conversion_input &target);
+  static codet convert_is_defined_char(conversion_inputt &target);
+  static codet convert_is_defined_int(conversion_inputt &target);
   static exprt expr_of_is_digit(const exprt &chr, const typet &type);
-  static codet convert_is_digit_char(conversion_input &target);
-  static codet convert_is_digit_int(conversion_input &target);
+  static codet convert_is_digit_char(conversion_inputt &target);
+  static codet convert_is_digit_int(conversion_inputt &target);
   static exprt expr_of_is_high_surrogate(const exprt &chr, const typet &type);
-  static codet convert_is_high_surrogate(conversion_input &target);
+  static codet convert_is_high_surrogate(conversion_inputt &target);
   static exprt expr_of_is_identifier_ignorable(
     const exprt &chr, const typet &type);
-  static codet convert_is_identifier_ignorable_char(conversion_input &target);
-  static codet convert_is_identifier_ignorable_int(conversion_input &target);
-  static codet convert_is_ideographic(conversion_input &target);
-  static codet convert_is_ISO_control_char(conversion_input &target);
-  static codet convert_is_ISO_control_int(conversion_input &target);
-  static codet convert_is_java_identifier_part_char(conversion_input &target);
-  static codet convert_is_java_identifier_part_int(conversion_input &target);
-  static codet convert_is_java_identifier_start_char(conversion_input &target);
-  static codet convert_is_java_identifier_start_int(conversion_input &target);
-  static codet convert_is_java_letter(conversion_input &target);
-  static codet convert_is_java_letter_or_digit(conversion_input &target);
+  static codet convert_is_identifier_ignorable_char(conversion_inputt &target);
+  static codet convert_is_identifier_ignorable_int(conversion_inputt &target);
+  static codet convert_is_ideographic(conversion_inputt &target);
+  static codet convert_is_ISO_control_char(conversion_inputt &target);
+  static codet convert_is_ISO_control_int(conversion_inputt &target);
+  static codet convert_is_java_identifier_part_char(conversion_inputt &target);
+  static codet convert_is_java_identifier_part_int(conversion_inputt &target);
+  static codet convert_is_java_identifier_start_char(conversion_inputt &target);
+  static codet convert_is_java_identifier_start_int(conversion_inputt &target);
+  static codet convert_is_java_letter(conversion_inputt &target);
+  static codet convert_is_java_letter_or_digit(conversion_inputt &target);
   static exprt expr_of_is_letter(const exprt &chr, const typet &type);
-  static codet convert_is_letter_char(conversion_input &target);
-  static codet convert_is_letter_int(conversion_input &target);
+  static codet convert_is_letter_char(conversion_inputt &target);
+  static codet convert_is_letter_int(conversion_inputt &target);
   static exprt expr_of_is_letter_or_digit(const exprt &chr, const typet &type);
-  static codet convert_is_letter_or_digit_char(conversion_input &target);
-  static codet convert_is_letter_or_digit_int(conversion_input &target);
+  static codet convert_is_letter_or_digit_char(conversion_inputt &target);
+  static codet convert_is_letter_or_digit_int(conversion_inputt &target);
   static exprt expr_of_is_ascii_lower_case(const exprt &chr, const typet &type);
-  static codet convert_is_lower_case_char(conversion_input &target);
-  static codet convert_is_lower_case_int(conversion_input &target);
-  static codet convert_is_low_surrogate(conversion_input &target);
+  static codet convert_is_lower_case_char(conversion_inputt &target);
+  static codet convert_is_lower_case_int(conversion_inputt &target);
+  static codet convert_is_low_surrogate(conversion_inputt &target);
   static exprt expr_of_is_mirrored(const exprt &chr, const typet &type);
-  static codet convert_is_mirrored_char(conversion_input &target);
-  static codet convert_is_mirrored_int(conversion_input &target);
-  static codet convert_is_space(conversion_input &target);
+  static codet convert_is_mirrored_char(conversion_inputt &target);
+  static codet convert_is_mirrored_int(conversion_inputt &target);
+  static codet convert_is_space(conversion_inputt &target);
   static exprt expr_of_is_space_char(const exprt &chr, const typet &type);
-  static codet convert_is_space_char(conversion_input &target);
-  static codet convert_is_space_char_int(conversion_input &target);
+  static codet convert_is_space_char(conversion_inputt &target);
+  static codet convert_is_space_char_int(conversion_inputt &target);
   static exprt expr_of_is_supplementary_code_point(
     const exprt &chr, const typet &type);
-  static codet convert_is_supplementary_code_point(conversion_input &target);
+  static codet convert_is_supplementary_code_point(conversion_inputt &target);
   static exprt expr_of_is_surrogate(const exprt &chr, const typet &type);
-  static codet convert_is_surrogate(conversion_input &target);
-  static codet convert_is_surrogate_pair(conversion_input &target);
+  static codet convert_is_surrogate(conversion_inputt &target);
+  static codet convert_is_surrogate_pair(conversion_inputt &target);
   static exprt expr_of_is_title_case(const exprt &chr, const typet &type);
-  static codet convert_is_title_case_char(conversion_input &target);
-  static codet convert_is_title_case_int(conversion_input &target);
+  static codet convert_is_title_case_char(conversion_inputt &target);
+  static codet convert_is_title_case_int(conversion_inputt &target);
   static exprt expr_of_is_letter_number(const exprt &chr, const typet &type);
   static exprt expr_of_is_unicode_identifier_part(
     const exprt &chr, const typet &type);
   static codet convert_is_unicode_identifier_part_char(
-    conversion_input &target);
-  static codet convert_is_unicode_identifier_part_int(conversion_input &target);
+    conversion_inputt &target);
+  static codet convert_is_unicode_identifier_part_int(
+    conversion_inputt &target);
   static exprt expr_of_is_unicode_identifier_start(
     const exprt &chr, const typet &type);
   static codet convert_is_unicode_identifier_start_char(
-    conversion_input &target);
+    conversion_inputt &target);
   static codet convert_is_unicode_identifier_start_int(
-    conversion_input &target);
+    conversion_inputt &target);
   static exprt expr_of_is_ascii_upper_case(const exprt &chr, const typet &type);
-  static codet convert_is_upper_case_char(conversion_input &target);
-  static codet convert_is_upper_case_int(conversion_input &target);
+  static codet convert_is_upper_case_char(conversion_inputt &target);
+  static codet convert_is_upper_case_int(conversion_inputt &target);
   static exprt expr_of_is_valid_code_point(const exprt &chr, const typet &type);
-  static codet convert_is_valid_code_point(conversion_input &target);
+  static codet convert_is_valid_code_point(conversion_inputt &target);
   static exprt expr_of_is_whitespace(const exprt &chr, const typet &type);
-  static codet convert_is_whitespace_char(conversion_input &target);
-  static codet convert_is_whitespace_int(conversion_input &target);
+  static codet convert_is_whitespace_char(conversion_inputt &target);
+  static codet convert_is_whitespace_int(conversion_inputt &target);
   static exprt expr_of_low_surrogate(const exprt &chr, const typet &type);
-  static codet convert_low_surrogate(conversion_input &target);
+  static codet convert_low_surrogate(conversion_inputt &target);
   static exprt expr_of_reverse_bytes(const exprt &chr, const typet &type);
-  static codet convert_reverse_bytes(conversion_input &target);
+  static codet convert_reverse_bytes(conversion_inputt &target);
   static exprt expr_of_to_chars(const exprt &chr, const typet &type);
-  static codet convert_to_chars(conversion_input &target);
-  static codet convert_to_code_point(conversion_input &target);
+  static codet convert_to_chars(conversion_inputt &target);
+  static codet convert_to_code_point(conversion_inputt &target);
   static exprt expr_of_to_lower_case(const exprt &chr, const typet &type);
-  static codet convert_to_lower_case_char(conversion_input &target);
-  static codet convert_to_lower_case_int(conversion_input &target);
+  static codet convert_to_lower_case_char(conversion_inputt &target);
+  static codet convert_to_lower_case_int(conversion_inputt &target);
   static exprt expr_of_to_title_case(const exprt &chr, const typet &type);
-  static codet convert_to_title_case_char(conversion_input &target);
-  static codet convert_to_title_case_int(conversion_input &target);
+  static codet convert_to_title_case_char(conversion_inputt &target);
+  static codet convert_to_title_case_int(conversion_inputt &target);
   static exprt expr_of_to_upper_case(const exprt &chr, const typet &type);
-  static codet convert_to_upper_case_char(conversion_input &target);
-  static codet convert_to_upper_case_int(conversion_input &target);
+  static codet convert_to_upper_case_char(conversion_inputt &target);
+  static codet convert_to_upper_case_int(conversion_inputt &target);
 
   // Helper functions
   static codet convert_char_function(
     exprt (*expr_function)(const exprt &chr, const typet &type),
-    conversion_input &target);
+    conversion_inputt &target);
   static exprt in_interval_expr(
     const exprt &chr,
     const mp_integer &lower_bound,
diff --git a/src/java_bytecode/ci_lazy_methods.cpp b/src/java_bytecode/ci_lazy_methods.cpp
index d7d95e85b91..41eab823e42 100644
--- a/src/java_bytecode/ci_lazy_methods.cpp
+++ b/src/java_bytecode/ci_lazy_methods.cpp
@@ -1,39 +1,508 @@
 /*******************************************************************\
 
-Module: Context-insensitive lazy methods container
+ Module: Java Bytecode
 
-Author: Chris Smowton, chris.smowton@diffblue.com
+ Author: DiffBlue Limited. All rights reserved.
 
 \*******************************************************************/
+#include "ci_lazy_methods.h"
 
-/// \file
-/// Context-insensitive lazy methods container
 
-#include "ci_lazy_methods.h"
+#include <java_bytecode/java_entry_point.h>
+#include <java_bytecode/java_class_loader.h>
+#include <java_bytecode/java_utils.h>
+#include <util/safe_pointer.h>
+#include <util/suffix.h>
+#include <java_bytecode/java_string_library_preprocess.h>
+
+#include <goto-programs/resolve_concrete_function_call.h>
+
+
+ci_lazy_methodst::ci_lazy_methodst(
+  const symbol_tablet &symbol_table,
+  const irep_idt &main_class,
+  const std::vector<irep_idt> &main_jar_classes,
+  const std::vector<irep_idt> &lazy_methods_extra_entry_points,
+  java_class_loadert &java_class_loader,
+  const select_pointer_typet &pointer_type_selector,
+  message_handlert &message_handler):
+    messaget(message_handler),
+    main_class(main_class),
+    main_jar_classes(main_jar_classes),
+    lazy_methods_extra_entry_points(lazy_methods_extra_entry_points),
+    java_class_loader(java_class_loader),
+    pointer_type_selector(pointer_type_selector)
+{
+  // build the class hierarclass_hierarchyy
+  class_hierarchy(symbol_table);
+}
+
+/// Uses a simple context-insensitive ('ci') analysis to determine which methods
+/// may be reachable from the main entry point. In brief, static methods are
+/// reachable if we find a callsite in another reachable site, while virtual
+/// methods are reachable if we find a virtual callsite targeting a compatible
+/// type *and* a constructor callsite indicating an object of that type may be
+/// instantiated (or evidence that an object of that type exists before the main
+/// function is entered, such as being passed as a parameter).
+/// Elaborates lazily-converted methods that may be reachable starting
+/// from the main entry point (usually provided with the --function command-
+/// line option
+/// \param symbol_table: global symbol table
+/// \param [out] lazy_methods: map from method names to relevant symbol and
+///   parsed-method objects.
+/// \param method_converter: Function for converting methods on demand.
+/// \return Returns false on success
+bool ci_lazy_methodst::operator()(
+  symbol_tablet &symbol_table,
+  lazy_methodst &lazy_methods,
+  method_convertert method_converter)
+{
+  std::vector<irep_idt> method_worklist1;
+  std::vector<irep_idt> method_worklist2;
+
+  auto main_function=
+    get_main_symbol(symbol_table, main_class, get_message_handler(), true);
+  if(main_function.stop_convert)
+  {
+    // Failed, mark all functions in the given main class(es)
+    // reaclass_hierarchyable.
+    std::vector<irep_idt> reaclass_hierarchyable_classes;
+    if(!main_class.empty())
+      reaclass_hierarchyable_classes.push_back(main_class);
+    else
+      reaclass_hierarchyable_classes=main_jar_classes;
+    for(const auto &classname : reaclass_hierarchyable_classes)
+    {
+      const auto &methods=
+        java_class_loader.class_map.at(classname).parsed_class.methods;
+      for(const auto &method : methods)
+      {
+        const irep_idt methodid="java::"+id2string(classname)+"."+
+          id2string(method.name)+":"+
+          id2string(method.signature);
+        method_worklist2.push_back(methodid);
+      }
+    }
+  }
+  else
+    method_worklist2.push_back(main_function.main_function.name);
+
+  // Add any extra entry points specified; we should elaborate these in the
+  // same way as the main function.
+  std::vector<irep_idt> extra_entry_points=lazy_methods_extra_entry_points;
+  resolve_method_names(extra_entry_points, symbol_table);
+  method_worklist2.insert(
+    method_worklist2.begin(),
+    extra_entry_points.begin(),
+    extra_entry_points.end());
+
+  std::set<irep_idt> needed_classes;
+
+  {
+    std::vector<irep_idt> needed_clinits;
+    ci_lazy_methods_neededt initial_lazy_methods(
+      needed_clinits,
+      needed_classes,
+      symbol_table);
+    initialize_needed_classes(
+      method_worklist2,
+      namespacet(symbol_table),
+      initial_lazy_methods);
+    method_worklist2.insert(
+      method_worklist2.end(),
+      needed_clinits.begin(),
+      needed_clinits.end());
+  }
+
+  std::set<irep_idt> methods_already_populated;
+  std::vector<const code_function_callt *> virtual_callsites;
+
+  bool any_new_methods=false;
+  do
+  {
+    any_new_methods=false;
+    while(!method_worklist2.empty())
+    {
+      std::swap(method_worklist1, method_worklist2);
+      for(const auto &mname : method_worklist1)
+      {
+        if(!methods_already_populated.insert(mname).second)
+          continue;
+        auto findit=lazy_methods.find(mname);
+        if(findit==lazy_methods.end())
+        {
+          debug() << "Skip " << mname << eom;
+          continue;
+        }
+        debug() << "CI lazy methods: elaborate " << mname << eom;
+        const auto &parsed_method=findit->second;
+        // Note this wraps *references* to method_worklist2, needed_classes:
+        ci_lazy_methods_neededt new_lazy_methods(
+          method_worklist2,
+          needed_classes,
+          symbol_table);
+        method_converter(
+          *parsed_method.first, *parsed_method.second, new_lazy_methods);
+        gather_virtual_callsites(
+          symbol_table.lookup(mname).value,
+          virtual_callsites);
+        any_new_methods=true;
+      }
+      method_worklist1.clear();
+    }
 
-#include <string>
+    // Given the object types we now know may be created, populate more
+    // possible virtual function call targets:
 
-/// Notes `method_symbol_name` is referenced from some reachable function, and
-/// should therefore be elaborated.
-/// \par parameters: `method_symbol_name`: method name; must exist in symbol
-///   table.
-void ci_lazy_methodst::add_needed_method(const irep_idt &method_symbol_name)
+    debug() << "CI lazy methods: add virtual method targets ("
+            << virtual_callsites.size()
+            << " callsites)"
+            << eom;
+
+    for(const auto &callsite : virtual_callsites)
+    {
+      // This will also create a stub if a virtual callsite has no targets.
+      get_virtual_method_targets(
+        *callsite,
+        needed_classes,
+        method_worklist2,
+        symbol_table);
+    }
+  }
+  while(any_new_methods);
+
+  // Remove symbols for methods that were declared but never used:
+  symbol_tablet keep_symbols;
+
+  for(const auto &sym : symbol_table.symbols)
+  {
+    if(sym.second.is_static_lifetime)
+      continue;
+    if(lazy_methods.count(sym.first) &&
+       !methods_already_populated.count(sym.first))
+    {
+      continue;
+    }
+    if(sym.second.type.id()==ID_code)
+      gather_needed_globals(sym.second.value, symbol_table, keep_symbols);
+    keep_symbols.add(sym.second);
+  }
+
+  debug() << "CI lazy methods: removed "
+          << symbol_table.symbols.size() - keep_symbols.symbols.size()
+          << " unreaclass_hierarchyable methods and globals"
+          << eom;
+
+  symbol_table.swap(keep_symbols);
+
+  return false;
+}
+
+/// Translates the given list of method names from human-readable to
+/// internal syntax.
+/// Expands any wildcards (entries ending in '.*') in the given method
+/// list to include all non-static methods defined on the given class.
+/// \param [in, out] methods: List of methods to expand. Any wildcard entries
+///   will be deleted and the expanded entries appended to the end.
+/// \param symbol_table: global symbol table
+void ci_lazy_methodst::resolve_method_names(
+  std::vector<irep_idt> &methods,
+  const symbol_tablet &symbol_table)
 {
-  needed_methods.push_back(method_symbol_name);
+  std::vector<irep_idt> new_methods;
+  for(const irep_idt &method : methods)
+  {
+    const std::string &method_str=id2string(method);
+    if(!has_suffix(method_str, ".*"))
+    {
+      std::string error_message;
+      irep_idt internal_name=
+        resolve_friendly_method_name(
+          method_str,
+          symbol_table,
+          error_message);
+      if(internal_name==irep_idt())
+        throw "entry point "+error_message;
+      new_methods.push_back(internal_name);
+    }
+    else
+    {
+      irep_idt classname="java::"+method_str.substr(0, method_str.length()-2);
+      if(!symbol_table.has_symbol(classname))
+        throw "wildcard entry point '"+method_str+"': unknown class";
+
+      for(const auto &name_symbol : symbol_table.symbols)
+      {
+        if(name_symbol.second.type.id()!=ID_code)
+          continue;
+        if(!to_code_type(name_symbol.second.type).has_this())
+          continue;
+        if(has_prefix(id2string(name_symbol.first), id2string(classname)))
+          new_methods.push_back(name_symbol.first);
+      }
+    }
+  }
+
+  methods=std::move(new_methods);
 }
 
-/// Notes class `class_symbol_name` will be instantiated, or a static field
-/// belonging to it will be accessed. Also notes that its static initializer is
-/// therefore reachable.
-/// \par parameters: `class_symbol_name`: class name; must exist in symbol
-///   table.
-/// \return Returns true if `class_symbol_name` is new (not seen before).
-bool ci_lazy_methodst::add_needed_class(const irep_idt &class_symbol_name)
+/// Build up a list of methods whose type may be passed around reachable
+/// from the entry point.
+/// \param entry_points: list of fully-qualified function names that
+///   we should assume are reachable
+/// \param ns: global namespace
+/// \param [out] lazy_methods: Populated with all Java reference types whose
+///   references may be passed, directly or indirectly, to any of the functions
+///   in `entry_points`.
+void ci_lazy_methodst::initialize_needed_classes(
+  const std::vector<irep_idt> &entry_points,
+  const namespacet &ns,
+  ci_lazy_methods_neededt &lazy_methods)
 {
-  if(!needed_classes.insert(class_symbol_name).second)
-    return false;
-  const irep_idt clinit_name(id2string(class_symbol_name)+".<clinit>:()V");
-  if(symbol_table.symbols.count(clinit_name))
-    add_needed_method(clinit_name);
-  return true;
+  for(const auto &mname : entry_points)
+  {
+    const auto &symbol=ns.lookup(mname);
+    const auto &mtype=to_code_type(symbol.type);
+    for(const auto &param : mtype.parameters())
+    {
+      if(param.type().id()==ID_pointer)
+      {
+        const pointer_typet &original_pointer=to_pointer_type(param.type());
+        initialize_all_needed_classes_from_pointer(
+          original_pointer, ns, lazy_methods);
+      }
+    }
+  }
+
+  // Also add classes whose instances are magically
+  // created by the JVM and so won't be spotted by
+  // looking for constructors and calls as usual:
+  lazy_methods.add_needed_class("java::java.lang.String");
+  lazy_methods.add_needed_class("java::java.lang.Class");
+  lazy_methods.add_needed_class("java::java.lang.Object");
 }
+
+/// Build up list of methods for types for a pointer and any types it
+/// might be subsituted for. See
+/// `initialize_needed_classes` for more details.
+/// \param pointer_type: The type to gather methods for.
+/// \param ns: global namespace
+/// \param [out] lazy_methods: Populated with all Java reference types whose
+///   references may be passed, directly or indirectly, to any of the functions
+///   in `entry_points
+void ci_lazy_methodst::initialize_all_needed_classes_from_pointer(
+  const pointer_typet &pointer_type,
+  const namespacet &ns,
+  ci_lazy_methods_neededt &lazy_methods)
+{
+  initialize_needed_classes_from_pointer(
+    pointer_type, ns, lazy_methods);
+
+  const pointer_typet &subbed_pointer_type=
+    pointer_type_selector.convert_pointer_type(pointer_type, ns);
+
+  if(subbed_pointer_type!=pointer_type)
+  {
+    initialize_needed_classes_from_pointer(
+      subbed_pointer_type, ns, lazy_methods);
+  }
+}
+
+/// Build up list of methods for types for a specific pointer type. See
+/// `initialize_needed_classes` for more details.
+/// \param pointer_type: The type to gather methods for.
+/// \param ns: global namespace
+/// \param [out] lazy_methods: Populated with all Java reference types whose
+///   references may be passed, directly or indirectly, to any of the functions
+///   in `entry_points
+void ci_lazy_methodst::initialize_needed_classes_from_pointer(
+  const pointer_typet &pointer_type,
+  const namespacet &ns,
+  ci_lazy_methods_neededt &lazy_methods)
+{
+  const symbol_typet &class_type=to_symbol_type(pointer_type.subtype());
+  const auto &param_classid=class_type.get_identifier();
+
+  if(lazy_methods.add_needed_class(param_classid))
+  {
+    gather_field_types(pointer_type.subtype(), ns, lazy_methods);
+  }
+}
+
+/// Get places where virtual functions are called.
+/// \param e: expression tree to search
+/// \param [out] result: filled with pointers to each function call within
+///   e that calls a virtual function.
+void ci_lazy_methodst::gather_virtual_callsites(
+  const exprt &e,
+  std::vector<const code_function_callt *> &result)
+{
+  if(e.id()!=ID_code)
+    return;
+  const codet &c=to_code(e);
+  if(c.get_statement()==ID_function_call &&
+     to_code_function_call(c).function().id()==ID_virtual_function)
+  {
+    result.push_back(&to_code_function_call(c));
+  }
+  else
+  {
+    for(const exprt &op : e.operands())
+      gather_virtual_callsites(op, result);
+  }
+}
+
+/// Find possible callees, excluding types that are not known to be
+/// instantiated.
+/// \param c: function call whose potential target functions should
+///   be determined.
+/// \param needed_classes: set of classes that can be instantiated. Any
+///   potential callee not in this set will be ignored.
+/// \param symbol_table: global symbol table
+/// \param [out] needed_methods: Populated with all possible `c` callees, taking
+///   `needed_classes` into account (virtual function overrides defined on
+///   classes that are not 'needed' are ignored)
+void ci_lazy_methodst::get_virtual_method_targets(
+  const code_function_callt &c,
+  const std::set<irep_idt> &needed_classes,
+  std::vector<irep_idt> &needed_methods,
+  symbol_tablet &symbol_table)
+{
+  const auto &called_function=c.function();
+  PRECONDITION(called_function.id()==ID_virtual_function);
+
+  const auto &call_class=called_function.get(ID_C_class);
+  INVARIANT(
+    !call_class.empty(), "All virtual calls should be aimed at a class");
+  const auto &call_basename=called_function.get(ID_component_name);
+  INVARIANT(
+    !call_basename.empty(),
+    "Virtual function must have a reasonable name after removing class");
+
+  auto old_size=needed_methods.size();
+
+  const irep_idt &self_method=
+    get_virtual_method_target(
+      needed_classes, call_basename, call_class, symbol_table);
+
+  if(!self_method.empty())
+  {
+    needed_methods.push_back(self_method);
+  }
+
+  const auto child_classes=class_hierarchy.get_children_trans(call_class);
+  for(const auto &child_class : child_classes)
+  {
+    const auto child_method=
+      get_virtual_method_target(
+        needed_classes,
+        call_basename,
+        child_class,
+        symbol_table);
+    if(!child_method.empty())
+      needed_methods.push_back(child_method);
+  }
+
+  if(needed_methods.size()==old_size)
+  {
+    // Didn't find any candidate callee. Generate a stub.
+    std::string stubname=id2string(call_class)+"."+id2string(call_basename);
+    symbolt symbol;
+    symbol.name=stubname;
+    symbol.base_name=call_basename;
+    symbol.type=c.function().type();
+    symbol.value.make_nil();
+    symbol.mode=ID_java;
+    symbol_table.add(symbol);
+  }
+}
+
+/// See output
+/// \param e: expression tree to search
+/// \param symbol_table: global symbol table
+/// \param [out] needed: Populated with global variable symbols referenced from
+/// `e` or its children.
+void ci_lazy_methodst::gather_needed_globals(
+  const exprt &e,
+  const symbol_tablet &symbol_table,
+  symbol_tablet &needed)
+{
+  if(e.id()==ID_symbol)
+  {
+    // If the symbol isn't in the symbol table at all, then it is defined
+    // on an opaque type (i.e. we don't have the class definition at this point)
+    // and will be created during the typecheck phase.
+    // We don't mark it as 'needed' as it doesn't exist yet to keep.
+    const auto findit=
+      symbol_table.symbols.find(to_symbol_expr(e).get_identifier());
+    if(findit!=symbol_table.symbols.end() &&
+       findit->second.is_static_lifetime)
+    {
+      needed.add(findit->second);
+    }
+  }
+  else
+    forall_operands(opit, e)
+      gather_needed_globals(*opit, symbol_table, needed);
+}
+
+/// See param lazy_methods
+/// \param class_type: root of class tree to search
+/// \param ns: global namespace
+/// \param [out] lazy_methods: Popualted with all Java reference types reachable
+///   starting at `class_type`. For example if `class_type` is
+///   `symbol_typet("java::A")` and A has a B field, then `B` (but not `A`) will
+///   noted as a needed class.
+void ci_lazy_methodst::gather_field_types(
+  const typet &class_type,
+  const namespacet &ns,
+  ci_lazy_methods_neededt &lazy_methods)
+{
+  const auto &underlying_type=to_struct_type(ns.follow(class_type));
+  for(const auto &field : underlying_type.components())
+  {
+    if(field.type().id()==ID_struct || field.type().id()==ID_symbol)
+      gather_field_types(field.type(), ns, lazy_methods);
+    else if(field.type().id()==ID_pointer)
+    {
+      // Skip array primitive pointers, for example:
+      if(field.type().subtype().id()!=ID_symbol)
+        continue;
+      initialize_all_needed_classes_from_pointer(
+        to_pointer_type(field.type()), ns, lazy_methods);
+    }
+  }
+}
+
+/// Find a virtual callee, if one is defined and the callee type is known to
+/// exist.
+/// \param needed_classes: set of classes that can be instantiated.
+///   Any potential callee not in this set will be ignored.
+/// \param call_basename: unqualified function name with type signature (e.g.
+///   "f:(I)")
+/// \param classname: class name that may define or override a function named
+///   `call_basename`.
+/// \param symbol_table: global symtab
+/// \return Returns the fully qualified name of `classname`'s definition of
+///   `call_basename` if found and `classname` is present in `needed_classes`,
+///   or irep_idt() otherwise.
+irep_idt ci_lazy_methodst::get_virtual_method_target(
+  const std::set<irep_idt> &needed_classes,
+  const irep_idt &call_basename,
+  const irep_idt &classname,
+  const symbol_tablet &symbol_table)
+{
+  // Program-wide, is this class ever instantiated?
+  if(!needed_classes.count(classname))
+    return irep_idt();
+
+  resolve_concrete_function_callt call_resolver(symbol_table, class_hierarchy);
+  const resolve_concrete_function_callt ::concrete_function_callt &
+    resolved_call=call_resolver(classname, call_basename);
+
+  if(resolved_call.is_valid())
+    return resolved_call.get_virtual_method_name();
+  else
+    return irep_idt();
+}
+
diff --git a/src/java_bytecode/ci_lazy_methods.h b/src/java_bytecode/ci_lazy_methods.h
index e64a3f2467c..f910abf2bb8 100644
--- a/src/java_bytecode/ci_lazy_methods.h
+++ b/src/java_bytecode/ci_lazy_methods.h
@@ -1,49 +1,117 @@
 /*******************************************************************\
 
-Module: Context-insensitive lazy methods container
+ Module: Java Bytecode
 
-Author: Chris Smowton, chris.smowton@diffblue.com
+ Author: DiffBlue Limited. All rights reserved.
 
 \*******************************************************************/
 
 /// \file
-/// Context-insensitive lazy methods container
+/// Collect methods needed to be loaded using the lazy method
 
-#ifndef CPROVER_JAVA_BYTECODE_CI_LAZY_METHODS_H
-#define CPROVER_JAVA_BYTECODE_CI_LAZY_METHODS_H
+#ifndef CPROVER_JAVA_BYTECODE_GATHER_METHODS_LAZILY_H
+#define CPROVER_JAVA_BYTECODE_GATHER_METHODS_LAZILY_H
 
-#include <vector>
-#include <set>
+#include <map>
+#include <functional>
+
+#include <util/irep.h>
 #include <util/symbol_table.h>
+#include <util/message.h>
+#include <goto-programs/class_hierarchy.h>
+#include <java_bytecode/java_bytecode_parse_tree.h>
+#include <java_bytecode/java_class_loader.h>
+#include <java_bytecode/ci_lazy_methods_needed.h>
+#include <java_bytecode/select_pointer_type.h>
+
+class java_string_library_preprocesst;
+
+typedef std::pair<
+          const symbolt *,
+          const java_bytecode_parse_treet::methodt *>
+  lazy_method_valuet;
+
+typedef std::map<irep_idt, lazy_method_valuet>
+  lazy_methodst;
 
-class ci_lazy_methodst
+typedef std::function<void(
+  const symbolt &,
+  const java_bytecode_parse_treet::methodt &,
+  ci_lazy_methods_neededt)> method_convertert;
+
+class ci_lazy_methodst:public messaget
 {
 public:
   ci_lazy_methodst(
-    std::vector<irep_idt> &_needed_methods,
-    std::set<irep_idt> &_needed_classes,
-    symbol_tablet &_symbol_table):
-  needed_methods(_needed_methods),
-  needed_classes(_needed_classes),
-  symbol_table(_symbol_table)
-  {}
-
-  void add_needed_method(const irep_idt &);
-  // Returns true if new
-  bool add_needed_class(const irep_idt &);
+    const symbol_tablet &symbol_table,
+    const irep_idt &main_class,
+    const std::vector<irep_idt> &main_jar_classes,
+    const std::vector<irep_idt> &lazy_methods_extra_entry_points,
+    java_class_loadert &java_class_loader,
+    const select_pointer_typet &pointer_type_selector,
+    message_handlert &message_handler);
+
+  // not const since messaget
+  bool operator()(
+    symbol_tablet &symbol_table,
+    lazy_methodst &lazy_methods,
+    method_convertert method_converter);
 
 private:
-  // needed_methods is a vector because it's used as a work-list
-  // which is periodically cleared. It can't be relied upon to
-  // contain all methods that have previously been elaborated.
-  // It should be changed to a set if we develop the need to use
-  // it that way.
-  std::vector<irep_idt> &needed_methods;
-  // needed_classes on the other hand is a true set of every class
-  // found so far, so we can use a membership test to avoid
-  // repeatedly exploring a class hierarchy.
-  std::set<irep_idt> &needed_classes;
-  symbol_tablet &symbol_table;
+  void resolve_method_names(
+    std::vector<irep_idt> &methods,
+    const symbol_tablet &symbol_table);
+
+  void initialize_needed_classes(
+    const std::vector<irep_idt> &entry_points,
+    const namespacet &ns,
+    ci_lazy_methods_neededt &lazy_methods);
+
+  void initialize_all_needed_classes_from_pointer(
+    const pointer_typet &pointer_type,
+    const namespacet &ns,
+    ci_lazy_methods_neededt &lazy_methods);
+
+  void initialize_needed_classes_from_pointer(
+    const pointer_typet &pointer_type,
+    const namespacet &ns,
+    ci_lazy_methods_neededt &lazy_methods);
+
+  void gather_virtual_callsites(
+    const exprt &e,
+    std::vector<const code_function_callt *> &result);
+
+  void get_virtual_method_targets(
+    const code_function_callt &c,
+    const std::set<irep_idt> &needed_classes,
+    std::vector<irep_idt> &needed_methods,
+    symbol_tablet &symbol_table);
+
+  void gather_needed_globals(
+    const exprt &e,
+    const symbol_tablet &symbol_table,
+    symbol_tablet &needed);
+
+  void gather_field_types(const typet &class_type,
+    const namespacet &ns,
+    ci_lazy_methods_neededt &lazy_methods);
+
+  irep_idt get_virtual_method_target(
+    const std::set<irep_idt> &needed_classes,
+    const irep_idt &call_basename,
+    const irep_idt &classname,
+    const symbol_tablet &symbol_table);
+
+  static irep_idt build_virtual_method_name(
+    const irep_idt &class_name,
+    const irep_idt &component_method_name);
+
+  class_hierarchyt class_hierarchy;
+  irep_idt main_class;
+  std::vector<irep_idt> main_jar_classes;
+  std::vector<irep_idt> lazy_methods_extra_entry_points;
+  java_class_loadert &java_class_loader;
+  const select_pointer_typet &pointer_type_selector;
 };
 
-#endif
+#endif // CPROVER_JAVA_BYTECODE_GATHER_METHODS_LAZILY_H
diff --git a/src/java_bytecode/ci_lazy_methods_needed.cpp b/src/java_bytecode/ci_lazy_methods_needed.cpp
new file mode 100644
index 00000000000..e7ee2cf8510
--- /dev/null
+++ b/src/java_bytecode/ci_lazy_methods_needed.cpp
@@ -0,0 +1,41 @@
+/*******************************************************************\
+
+Module: Context-insensitive lazy methods container
+
+Author: Chris Smowton, chris.smowton@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Context-insensitive lazy methods container
+
+#include "ci_lazy_methods.h"
+
+#include <string>
+
+/// Notes `method_symbol_name` is referenced from some reachable function, and
+/// should therefore be elaborated.
+/// \par parameters: `method_symbol_name`: method name; must exist in symbol
+///   table.
+void ci_lazy_methods_neededt::add_needed_method(
+  const irep_idt &method_symbol_name)
+{
+  needed_methods.push_back(method_symbol_name);
+}
+
+/// Notes class `class_symbol_name` will be instantiated, or a static field
+/// belonging to it will be accessed. Also notes that its static initializer is
+/// therefore reachable.
+/// \par parameters: `class_symbol_name`: class name; must exist in symbol
+///   table.
+/// \return Returns true if `class_symbol_name` is new (not seen before).
+bool ci_lazy_methods_neededt::add_needed_class(
+  const irep_idt &class_symbol_name)
+{
+  if(!needed_classes.insert(class_symbol_name).second)
+    return false;
+  const irep_idt clinit_name(id2string(class_symbol_name)+".<clinit>:()V");
+  if(symbol_table.symbols.count(clinit_name))
+    add_needed_method(clinit_name);
+  return true;
+}
diff --git a/src/java_bytecode/ci_lazy_methods_needed.h b/src/java_bytecode/ci_lazy_methods_needed.h
new file mode 100644
index 00000000000..acb48d5a115
--- /dev/null
+++ b/src/java_bytecode/ci_lazy_methods_needed.h
@@ -0,0 +1,49 @@
+/*******************************************************************\
+
+Module: Context-insensitive lazy methods container
+
+Author: Chris Smowton, chris.smowton@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Context-insensitive lazy methods container
+
+#ifndef CPROVER_JAVA_BYTECODE_CI_LAZY_METHODS_H
+#define CPROVER_JAVA_BYTECODE_CI_LAZY_METHODS_H
+
+#include <vector>
+#include <set>
+#include <util/symbol_table.h>
+
+class ci_lazy_methods_neededt
+{
+public:
+  ci_lazy_methods_neededt(
+    std::vector<irep_idt> &_needed_methods,
+    std::set<irep_idt> &_needed_classes,
+    symbol_tablet &_symbol_table):
+  needed_methods(_needed_methods),
+  needed_classes(_needed_classes),
+  symbol_table(_symbol_table)
+  {}
+
+  void add_needed_method(const irep_idt &);
+  // Returns true if new
+  bool add_needed_class(const irep_idt &);
+
+private:
+  // needed_methods is a vector because it's used as a work-list
+  // which is periodically cleared. It can't be relied upon to
+  // contain all methods that have previously been elaborated.
+  // It should be changed to a set if we develop the need to use
+  // it that way.
+  std::vector<irep_idt> &needed_methods;
+  // needed_classes on the other hand is a true set of every class
+  // found so far, so we can use a membership test to avoid
+  // repeatedly exploring a class hierarchy.
+  std::set<irep_idt> &needed_classes;
+  symbol_tablet &symbol_table;
+};
+
+#endif
diff --git a/src/java_bytecode/expr2java.cpp b/src/java_bytecode/expr2java.cpp
index 38a91d4d857..5e782b34d82 100644
--- a/src/java_bytecode/expr2java.cpp
+++ b/src/java_bytecode/expr2java.cpp
@@ -9,12 +9,14 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 #include "expr2java.h"
 
 #include <cassert>
+#include <sstream>
 
 #include <util/namespace.h>
 #include <util/std_types.h>
 #include <util/std_expr.h>
 #include <util/symbol.h>
 #include <util/arith_tools.h>
+#include <util/ieee_float.h>
 
 #include <ansi-c/c_qualifiers.h>
 #include <ansi-c/c_misc.h>
@@ -187,7 +189,7 @@ std::string expr2javat::convert_constant(
 
     mp_integer int_value;
     if(to_integer(src, int_value))
-      assert(false);
+      UNREACHABLE;
 
     dest+="(char)'";
 
@@ -210,7 +212,7 @@ std::string expr2javat::convert_constant(
     // No byte-literals in Java, so just cast:
     mp_integer int_value;
     if(to_integer(src, int_value))
-      assert(false);
+      UNREACHABLE;
     std::string dest="(byte)";
     dest+=integer2string(int_value);
     return dest;
@@ -220,7 +222,7 @@ std::string expr2javat::convert_constant(
     // No short-literals in Java, so just cast:
     mp_integer int_value;
     if(to_integer(src, int_value))
-      assert(false);
+      UNREACHABLE;
     std::string dest="(short)";
     dest+=integer2string(int_value);
     return dest;
@@ -230,11 +232,63 @@ std::string expr2javat::convert_constant(
     // long integer literals must have 'L' at the end
     mp_integer int_value;
     if(to_integer(src, int_value))
-      assert(false);
+      UNREACHABLE;
     std::string dest=integer2string(int_value);
     dest+='L';
     return dest;
   }
+  else if((src.type()==java_float_type()) ||
+          (src.type()==java_double_type()))
+  {
+    ieee_floatt ieee_repr(to_constant_expr(src));
+    std::string result;
+
+    bool is_java_float=(src.type()==java_float_type());
+    if(ieee_repr.is_zero())
+    {
+      if(ieee_repr.get_sign())
+        result+='-';
+      result+="0.0";
+      if(is_java_float)
+        result+='f';
+      return result;
+    }
+
+    if(ieee_repr.is_NaN())
+    {
+       if(is_java_float)
+         return "Float.NaN";
+       else
+         return "Double.NaN";
+    }
+
+    if(ieee_repr.is_infinity())
+    {
+      if(is_java_float)
+      {
+        if(ieee_repr.get_sign())
+          return "Float.NEGATIVE_INFINITY";
+        else
+          return "Float.POSITIVE_INFINITY";
+      }
+      else
+      {
+        if(ieee_repr.get_sign())
+          return "Double.NEGATIVE_INFINITY";
+        else
+          return "Double.POSITIVE_INFINITY";
+      }
+    }
+
+    std::stringstream buffer;
+    buffer << std::hexfloat;
+    if(is_java_float)
+      buffer << ieee_repr.to_float() << 'f';
+    else
+      buffer << ieee_repr.to_double();
+    return buffer.str();
+  }
+
 
   return expr2ct::convert_constant(src, precedence);
 }
@@ -392,6 +446,17 @@ std::string expr2javat::convert_with_precedence(
   else if(src.id()==ID_side_effect &&
           src.get(ID_statement)==ID_throw)
     return convert_function(src, "throw", precedence=16);
+  else if(src.id()==ID_code &&
+          to_code(src).get_statement()==ID_exception_landingpad)
+  {
+    const exprt &catch_expr=
+      to_code_landingpad(to_code(src)).catch_expr();
+    return "catch_landingpad("+
+      convert(catch_expr.type())+
+      ' '+
+      convert(catch_expr)+
+      ')';
+  }
   else if(src.id()==ID_unassigned)
     return "?";
   else if(src.id()=="pod_constructor")
diff --git a/src/java_bytecode/jar_file.cpp b/src/java_bytecode/jar_file.cpp
index 26bb1a9de50..ec690238996 100644
--- a/src/java_bytecode/jar_file.cpp
+++ b/src/java_bytecode/jar_file.cpp
@@ -1,131 +1,100 @@
 /*******************************************************************\
 
-Module:
+Module: Jar file reader
 
-Author: Daniel Kroening, kroening@kroening.com
+Author: Diffblue Ltd
 
 \*******************************************************************/
 
 #include "jar_file.h"
-
-#include <cstring>
-#include <cassert>
-#include <unordered_set>
-
-#include <json/json_parser.h>
+#include <cctype>
 #include <util/suffix.h>
+#include <util/invariant.h>
+#include "java_class_loader_limit.h"
 
-void jar_filet::open(
-  java_class_loader_limitt &class_loader_limit,
-  const std::string &filename)
+jar_filet::jar_filet(
+  java_class_loader_limitt &limit,
+  const std::string &filename):
+  m_zip_archive(filename)
 {
-  if(!mz_ok)
+  const size_t file_count=m_zip_archive.get_num_files();
+  for(size_t index=0; index<file_count; index++)
   {
-    memset(&zip, 0, sizeof(zip));
-    mz_bool mz_open=mz_zip_reader_init_file(&zip, filename.c_str(), 0);
-    mz_ok=mz_open==MZ_TRUE;
+    const auto filename=m_zip_archive.get_filename(index);
+    if(!has_suffix(filename, ".class") || limit.load_class_file(filename))
+      m_name_to_index.emplace(filename, index);
   }
+}
 
-  if(mz_ok)
-  {
-    std::size_t number_of_files=
-      mz_zip_reader_get_num_files(&zip);
+// VS: No default move constructors or assigns
 
-    for(std::size_t i=0; i<number_of_files; i++)
-    {
-      mz_uint filename_length=mz_zip_reader_get_filename(&zip, i, nullptr, 0);
-      char *filename_char=new char[filename_length+1];
-      mz_uint filename_len=
-        mz_zip_reader_get_filename(&zip, i, filename_char, filename_length);
-      assert(filename_length==filename_len);
-      std::string file_name(filename_char);
+jar_filet::jar_filet(jar_filet &&other):
+  m_zip_archive(std::move(other.m_zip_archive)),
+  m_name_to_index((other.m_name_to_index)) {}
 
-      // non-class files are loaded in any case
-      bool add_file=!has_suffix(file_name, ".class");
-      // load .class file only if they match regex / are in match set
-      add_file|=class_loader_limit.load_class_file(file_name);
-      if(add_file)
-      {
-        if(has_suffix(file_name, ".class"))
-          status() << "read class file " << file_name
-                   << " from " << filename << eom;
-        filtered_jar[file_name]=i;
-      }
-      delete[] filename_char;
-    }
-  }
+jar_filet &jar_filet::operator=(jar_filet &&other)
+{
+  m_zip_archive=std::move(other.m_zip_archive);
+  m_name_to_index=std::move(other.m_name_to_index);
+  return *this;
 }
 
-jar_filet::~jar_filet()
+std::string jar_filet::get_entry(const std::string &name)
 {
-  if(mz_ok)
+  const auto entry=m_name_to_index.find(name);
+  INVARIANT(entry!=m_name_to_index.end(), "File doesn't exist");
+  try
+  {
+    return m_zip_archive.extract(entry->second);
+  }
+  catch(const std::runtime_error &)
   {
-    mz_zip_reader_end(&zip);
-    mz_ok=false;
+    return "";
   }
 }
 
-std::string jar_filet::get_entry(const irep_idt &name)
+static bool is_space(const char ch)
 {
-  if(!mz_ok)
-    return std::string("");
-
-  std::string dest;
-
-  auto entry=filtered_jar.find(name);
-  assert(entry!=filtered_jar.end());
-
-  size_t real_index=entry->second;
-  mz_zip_archive_file_stat file_stat;
-  memset(&file_stat, 0, sizeof(file_stat));
-  mz_bool stat_ok=mz_zip_reader_file_stat(&zip, real_index, &file_stat);
-  if(stat_ok!=MZ_TRUE)
-    return std::string();
-  std::vector<char> buffer;
-  size_t bufsize=file_stat.m_uncomp_size;
-  buffer.resize(bufsize);
-  mz_bool read_ok=
-    mz_zip_reader_extract_to_mem(&zip, real_index, buffer.data(), bufsize, 0);
-  if(read_ok!=MZ_TRUE)
-    return std::string();
-
-  dest.insert(dest.end(), buffer.begin(), buffer.end());
-
-  return dest;
+  return std::isspace(ch);
 }
 
-jar_filet::manifestt jar_filet::get_manifest()
+/// Remove leading and trailing whitespace characters from string
+static std::string trim(
+  const std::string::const_iterator begin,
+  const std::string::const_iterator end)
 {
-  auto entry=filtered_jar.find("META-INF/MANIFEST.MF");
-  if(entry==filtered_jar.end())
-    return manifestt();
-
-  std::string dest=get_entry(entry->first);
-  std::istringstream in(dest);
-
-  manifestt manifest;
+  const auto out_begin=std::find_if_not(begin, end, is_space);
+  const auto out_end=std::find_if_not(
+    std::string::const_reverse_iterator(end),
+    std::string::const_reverse_iterator(out_begin),
+    is_space).base();
+  return { out_begin, out_end };
+}
 
-  std::string line;
-  while(std::getline(in, line))
+std::unordered_map<std::string, std::string> jar_filet::get_manifest()
+{
+  std::unordered_map<std::string, std::string> out;
+  const auto entry=m_name_to_index.find("META-INF/MANIFEST.MF");
+  if(entry!=m_name_to_index.end())
   {
-    std::size_t pos=line.find(':');
-    if(pos==std::string::npos)
-      continue;
-    std::string key=line.substr(0, pos);
-
-    // skip spaces
-    pos++;
-    while(pos<line.size() && line[pos]==' ') pos++;
-
-    std::string value=line.substr(pos, std::string::npos);
-
-    // trim off \r
-    if(!value.empty() && *value.rbegin()=='\r')
-      value.resize(value.size()-1);
-
-    // store
-    manifest[key]=value;
+    std::istringstream in(this->get_entry(entry->first));
+    std::string line;
+    while(std::getline(in, line))
+    {
+      const auto key_end=std::find(line.cbegin(), line.cend(), ':');
+      if(key_end!=line.cend())
+        out.emplace(
+          trim(line.cbegin(), key_end),
+          trim(std::next(key_end), line.cend()));
+    }
   }
+  return out;
+}
 
-  return manifest;
+std::vector<std::string> jar_filet::filenames() const
+{
+  std::vector<std::string> out;
+  for(const auto &pair : m_name_to_index)
+    out.emplace_back(pair.first);
+  return out;
 }
diff --git a/src/java_bytecode/jar_file.h b/src/java_bytecode/jar_file.h
index bb0b30b918e..e53e1610495 100644
--- a/src/java_bytecode/jar_file.h
+++ b/src/java_bytecode/jar_file.h
@@ -1,81 +1,48 @@
 /*******************************************************************\
 
-Module: JAR File Reading
+Module: Jar file reader
 
-Author: Daniel Kroening, kroening@kroening.com
+Author: Diffblue Ltd
 
 \*******************************************************************/
 
-/// \file
-/// JAR File Reading
-
 #ifndef CPROVER_JAVA_BYTECODE_JAR_FILE_H
 #define CPROVER_JAVA_BYTECODE_JAR_FILE_H
 
-#define _LARGEFILE64_SOURCE 1
-#include "miniz/miniz.h"
-
+#include <unordered_map>
+#include <memory>
 #include <string>
 #include <vector>
-#include <map>
-#include <regex>
-#include <util/message.h>
-
-#include "java_class_loader_limit.h"
-
-class jar_filet:public messaget
-{
-public:
-  jar_filet():
-    mz_ok(false)
-    // `zip` will be initialized by open()
-  {
-  }
-
-  ~jar_filet();
+#include "mz_zip_archive.h"
 
-  void open(java_class_loader_limitt &, const std::string &);
+class java_class_loader_limitt;
 
-  // Test for error; 'true' means we are good.
-  explicit operator bool() const { return mz_ok; }
-
-  // map internal index to real index in jar central directory
-  typedef std::map<irep_idt, size_t> filtered_jart;
-  filtered_jart filtered_jar;
-
-  std::string get_entry(const irep_idt &);
-
-  typedef std::map<std::string, std::string> manifestt;
-  manifestt get_manifest();
-
-protected:
-  mz_zip_archive zip;
-  bool mz_ok;
-};
-
-class jar_poolt:public messaget
+/// Class representing a .jar archive
+class jar_filet final
 {
 public:
-  jar_filet &operator()(
-    java_class_loader_limitt &class_loader_limit,
-    const std::string &file_name)
-  {
-    file_mapt::iterator it=file_map.find(file_name);
-    if(it==file_map.end())
-    {
-      jar_filet &jar_file=file_map[file_name];
-      jar_file.set_message_handler(get_message_handler());
-      jar_file.open(class_loader_limit, file_name);
-      return jar_file;
-    }
-    else
-      return file_map[file_name];
-  }
-
-protected:
-  typedef std::map<std::string, jar_filet> file_mapt;
-  file_mapt file_map;
-  std::string java_cp_include_files;
+  /// Open java file for reading
+  /// \param limit Object limiting number of loaded .class files
+  /// \param filename Name of the file
+  /// \throw Throws std::runtime_error if file cannot be opened
+  jar_filet(java_class_loader_limitt &limit, const std::string &filename);
+  jar_filet(const jar_filet &)=delete;
+  jar_filet &operator=(const jar_filet &)=delete;
+  jar_filet(jar_filet &&);
+  jar_filet &operator=(jar_filet &&);
+  ~jar_filet()=default;
+  /// Get contents of a file in the jar archive.
+  /// Terminates the program if file doesn't exist
+  /// \param filename Name of the file in the archive
+  std::string get_entry(const std::string &filename);
+  /// Get contents of the Manifest file in the jar archive
+  std::unordered_map<std::string, std::string> get_manifest();
+  /// Get list of filenames in the archive
+  std::vector<std::string> filenames() const;
+private:
+  mz_zip_archivet m_zip_archive;
+  /// Map of filename to the file index in the zip archive
+  std::unordered_map<std::string, size_t> m_name_to_index;
 };
 
 #endif // CPROVER_JAVA_BYTECODE_JAR_FILE_H
diff --git a/src/java_bytecode/java_bytecode_convert_class.cpp b/src/java_bytecode/java_bytecode_convert_class.cpp
index ab4c3d50ce9..71d742c247f 100644
--- a/src/java_bytecode/java_bytecode_convert_class.cpp
+++ b/src/java_bytecode/java_bytecode_convert_class.cpp
@@ -19,8 +19,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "java_types.h"
 #include "java_bytecode_convert_method.h"
 #include "java_bytecode_language.h"
+#include "java_utils.h"
 
-#include <util/c_types.h>
+#include <util/arith_tools.h>
 #include <util/namespace.h>
 #include <util/std_expr.h>
 
@@ -35,29 +36,33 @@ class java_bytecode_convert_classt:public messaget
     size_t _max_array_length,
     lazy_methodst& _lazy_methods,
     lazy_methods_modet _lazy_methods_mode,
-    bool _string_refinement_enabled,
-    const character_refine_preprocesst &_character_preprocess):
+    java_string_library_preprocesst &_string_preprocess):
     messaget(_message_handler),
     symbol_table(_symbol_table),
     max_array_length(_max_array_length),
     lazy_methods(_lazy_methods),
     lazy_methods_mode(_lazy_methods_mode),
-    string_refinement_enabled(_string_refinement_enabled),
-    character_preprocess(_character_preprocess)
+    string_preprocess(_string_preprocess)
   {
   }
 
   void operator()(const java_bytecode_parse_treet &parse_tree)
   {
-    add_array_types();
+    // add array types to the symbol table
+    add_array_types(symbol_table);
 
-    if(parse_tree.loading_successful)
+    bool loading_success=parse_tree.loading_successful;
+    if(loading_success)
       convert(parse_tree.parsed_class);
-    else if(string_refinement_enabled &&
-            parse_tree.parsed_class.name=="java.lang.String")
-      add_string_type();
-    else
-      generate_class_stub(parse_tree.parsed_class.name);
+
+    if(string_preprocess.is_known_string_type(parse_tree.parsed_class.name))
+      string_preprocess.add_string_type(
+        parse_tree.parsed_class.name, symbol_table);
+    else if(!loading_success)
+      generate_class_stub(
+        parse_tree.parsed_class.name,
+        symbol_table,
+        get_message_handler());
   }
 
   typedef java_bytecode_parse_treet::classt classt;
@@ -68,18 +73,24 @@ class java_bytecode_convert_classt:public messaget
   const size_t max_array_length;
   lazy_methodst &lazy_methods;
   lazy_methods_modet lazy_methods_mode;
-  bool string_refinement_enabled;
-  character_refine_preprocesst character_preprocess;
+  java_string_library_preprocesst &string_preprocess;
+
+  /// This field will be initialized to false, and set to true when
+  /// add_array_types() is executed. It serves as a sentinel to make sure that
+  /// the code using this class calls add_array_types() at least once.
+  static bool add_array_types_executed;
 
   // conversion
   void convert(const classt &c);
   void convert(symbolt &class_symbol, const fieldt &f);
 
-  void generate_class_stub(const irep_idt &class_name);
-  void add_array_types();
-  void add_string_type();
+  // see definition below for more info
+  static void add_array_types(symbol_tablet &symbol_table);
 };
 
+// initialization of static field
+bool java_bytecode_convert_classt::add_array_types_executed=false;
+
 void java_bytecode_convert_classt::convert(const classt &c)
 {
   std::string qualified_classname="java::"+id2string(c.name);
@@ -89,14 +100,27 @@ void java_bytecode_convert_classt::convert(const classt &c)
     return;
   }
 
-  class_typet class_type;
+  java_class_typet class_type;
 
   class_type.set_tag(c.name);
   class_type.set(ID_base_name, c.name);
+  class_type.set(ID_abstract, c.is_abstract);
   if(c.is_enum)
+  {
     class_type.set(
       ID_java_enum_static_unwind,
       std::to_string(c.enum_elements+1));
+    class_type.set(ID_enumeration, true);
+  }
+
+  if(c.is_public)
+    class_type.set_access(ID_public);
+  else if(c.is_protected)
+    class_type.set_access(ID_protected);
+  else if(c.is_private)
+    class_type.set_access(ID_private);
+  else
+    class_type.set_access(ID_default);
 
   if(!c.extends.empty())
   {
@@ -130,6 +154,7 @@ void java_bytecode_convert_classt::convert(const classt &c)
   symbolt *class_symbol;
 
   // add before we do members
+  debug() << "Adding symbol: class '" << c.name << "'" << eom;
   if(symbol_table.move(new_symbol, class_symbol))
   {
     error() << "failed to add class symbol " << new_symbol.name << eom;
@@ -138,7 +163,10 @@ void java_bytecode_convert_classt::convert(const classt &c)
 
   // now do fields
   for(const auto &field : c.fields)
+  {
+    debug() << "Adding symbol:  field '" << field.name << "'" << eom;
     convert(*class_symbol, field);
+  }
 
   // now do methods
   for(const auto &method : c.methods)
@@ -149,27 +177,13 @@ void java_bytecode_convert_classt::convert(const classt &c)
       ":"+method.signature;
     // Always run the lazy pre-stage, as it symbol-table
     // registers the function.
+    debug() << "Adding symbol:  method '" << method_identifier << "'" << eom;
     java_bytecode_convert_method_lazy(
       *class_symbol,
       method_identifier,
       method,
       symbol_table);
-    if(lazy_methods_mode==LAZY_METHODS_MODE_EAGER)
-    {
-      // Upgrade to a fully-realized symbol now:
-      java_bytecode_convert_method(
-        *class_symbol,
-        method,
-        symbol_table,
-        get_message_handler(),
-        max_array_length,
-        character_preprocess);
-    }
-    else
-    {
-      // Wait for our caller to decide what needs elaborating.
-      lazy_methods[method_identifier]=std::make_pair(class_symbol, &method);
-    }
+    lazy_methods[method_identifier]=std::make_pair(class_symbol, &method);
   }
 
   // is this a root class?
@@ -177,40 +191,6 @@ void java_bytecode_convert_classt::convert(const classt &c)
     java_root_class(*class_symbol);
 }
 
-void java_bytecode_convert_classt::generate_class_stub(
-  const irep_idt &class_name)
-{
-  class_typet class_type;
-
-  class_type.set_tag(class_name);
-  class_type.set(ID_base_name, class_name);
-
-  class_type.set(ID_incomplete_class, true);
-
-  // produce class symbol
-  symbolt new_symbol;
-  new_symbol.base_name=class_name;
-  new_symbol.pretty_name=class_name;
-  new_symbol.name="java::"+id2string(class_name);
-  class_type.set(ID_name, new_symbol.name);
-  new_symbol.type=class_type;
-  new_symbol.mode=ID_java;
-  new_symbol.is_type=true;
-
-  symbolt *class_symbol;
-
-  if(symbol_table.move(new_symbol, class_symbol))
-  {
-    warning() << "stub class symbol " << new_symbol.name
-              << " already exists" << eom;
-  }
-  else
-  {
-    // create the class identifier etc
-    java_root_class(*class_symbol);
-  }
-}
-
 void java_bytecode_convert_classt::convert(
   symbolt &class_symbol,
   const fieldt &f)
@@ -272,8 +252,16 @@ void java_bytecode_convert_classt::convert(
   }
 }
 
-void java_bytecode_convert_classt::add_array_types()
+/// Register in the \p symbol_table new symbols for the objects
+/// java::array[X] where X is byte, float, int, char...
+void java_bytecode_convert_classt::add_array_types(symbol_tablet &symbol_table)
 {
+  // this method only adds stuff to the symbol table, no need to execute it more
+  // than once
+  if(add_array_types_executed)
+    return;
+  add_array_types_executed=true;
+
   const std::string letters="ijsbcfdza";
 
   for(const char l : letters)
@@ -289,21 +277,148 @@ void java_bytecode_convert_classt::add_array_types()
     struct_type.components().reserve(3);
     struct_typet::componentt
       comp0("@java.lang.Object", symbol_typet("java::java.lang.Object"));
+    comp0.set_pretty_name("@java.lang.Object");
+    comp0.set_base_name("@java.lang.Object");
     struct_type.components().push_back(comp0);
 
     struct_typet::componentt comp1("length", java_int_type());
+    comp1.set_pretty_name("length");
+    comp1.set_base_name("length");
     struct_type.components().push_back(comp1);
 
     struct_typet::componentt
-      comp2("data", pointer_type(java_type_from_char(l)));
+      comp2("data", java_reference_type(java_type_from_char(l)));
+    comp2.set_pretty_name("data");
+    comp2.set_base_name("data");
     struct_type.components().push_back(comp2);
 
+    INVARIANT(
+      is_valid_java_array(struct_type),
+      "Constructed a new type representing a Java Array "
+      "object that doesn't match expectations");
+
     symbolt symbol;
     symbol.name=symbol_type.get_identifier();
     symbol.base_name=symbol_type.get(ID_C_base_name);
     symbol.is_type=true;
     symbol.type=struct_type;
     symbol_table.add(symbol);
+
+    // Also provide a clone method:
+    // ----------------------------
+
+    const irep_idt clone_name=
+      id2string(symbol_type.get_identifier())+".clone:()Ljava/lang/Object;";
+    code_typet clone_type;
+    clone_type.return_type()=
+      java_reference_type(symbol_typet("java::java.lang.Object"));
+    code_typet::parametert this_param;
+    this_param.set_identifier(id2string(clone_name)+"::this");
+    this_param.set_base_name("this");
+    this_param.set_this();
+    this_param.type()=java_reference_type(symbol_type);
+    clone_type.parameters().push_back(this_param);
+
+    parameter_symbolt this_symbol;
+    this_symbol.name=this_param.get_identifier();
+    this_symbol.base_name=this_param.get_base_name();
+    this_symbol.pretty_name=this_symbol.base_name;
+    this_symbol.type=this_param.type();
+    this_symbol.mode=ID_java;
+    symbol_table.add(this_symbol);
+
+    const irep_idt local_name=
+      id2string(clone_name)+"::cloned_array";
+    auxiliary_symbolt local_symbol;
+    local_symbol.name=local_name;
+    local_symbol.base_name="cloned_array";
+    local_symbol.pretty_name=local_symbol.base_name;
+    local_symbol.type=java_reference_type(symbol_type);
+    local_symbol.mode=ID_java;
+    symbol_table.add(local_symbol);
+    const auto &local_symexpr=local_symbol.symbol_expr();
+
+    code_blockt clone_body;
+
+    code_declt declare_cloned(local_symexpr);
+    clone_body.move_to_operands(declare_cloned);
+
+    side_effect_exprt java_new_array(
+      ID_java_new_array,
+      java_reference_type(symbol_type));
+    dereference_exprt old_array(this_symbol.symbol_expr(), symbol_type);
+    dereference_exprt new_array(local_symexpr, symbol_type);
+    member_exprt old_length(old_array, comp1.get_name(), comp1.type());
+    java_new_array.copy_to_operands(old_length);
+    code_assignt create_blank(local_symexpr, java_new_array);
+    clone_body.move_to_operands(create_blank);
+
+
+    member_exprt old_data(old_array, comp2.get_name(), comp2.type());
+    member_exprt new_data(new_array, comp2.get_name(), comp2.type());
+
+    /*
+      // TODO use this instead of a loop.
+    codet array_copy;
+    array_copy.set_statement(ID_array_copy);
+    array_copy.move_to_operands(new_data);
+    array_copy.move_to_operands(old_data);
+    clone_body.move_to_operands(array_copy);
+    */
+
+    // Begin for-loop to replace:
+
+    const irep_idt index_name=
+      id2string(clone_name)+"::index";
+    auxiliary_symbolt index_symbol;
+    index_symbol.name=index_name;
+    index_symbol.base_name="index";
+    index_symbol.pretty_name=index_symbol.base_name;
+    index_symbol.type=comp1.type();
+    index_symbol.mode=ID_java;
+    symbol_table.add(index_symbol);
+    const auto &index_symexpr=index_symbol.symbol_expr();
+
+    code_declt declare_index(index_symexpr);
+    clone_body.move_to_operands(declare_index);
+
+    code_fort copy_loop;
+
+    copy_loop.init()=
+      code_assignt(index_symexpr, from_integer(0, index_symexpr.type()));
+    copy_loop.cond()=
+      binary_relation_exprt(index_symexpr, ID_lt, old_length);
+
+    side_effect_exprt inc(ID_assign);
+    inc.operands().resize(2);
+    inc.op0()=index_symexpr;
+    inc.op1()=plus_exprt(index_symexpr, from_integer(1, index_symexpr.type()));
+    copy_loop.iter()=inc;
+
+    dereference_exprt old_cell(
+      plus_exprt(old_data, index_symexpr), old_data.type().subtype());
+    dereference_exprt new_cell(
+      plus_exprt(new_data, index_symexpr), new_data.type().subtype());
+    code_assignt copy_cell(new_cell, old_cell);
+    copy_loop.body()=copy_cell;
+
+    // End for-loop
+    clone_body.move_to_operands(copy_loop);
+
+    member_exprt new_base_class(new_array, comp0.get_name(), comp0.type());
+    address_of_exprt retval(new_base_class);
+    code_returnt return_inst(retval);
+    clone_body.move_to_operands(return_inst);
+
+    symbolt clone_symbol;
+    clone_symbol.name=clone_name;
+    clone_symbol.pretty_name=
+      id2string(symbol_type.get_identifier())+".clone:()";
+    clone_symbol.base_name="clone";
+    clone_symbol.type=clone_type;
+    clone_symbol.value=clone_body;
+    clone_symbol.mode=ID_java;
+    symbol_table.add(clone_symbol);
   }
 }
 
@@ -314,8 +429,7 @@ bool java_bytecode_convert_class(
   size_t max_array_length,
   lazy_methodst &lazy_methods,
   lazy_methods_modet lazy_methods_mode,
-  bool string_refinement_enabled,
-  const character_refine_preprocesst &character_preprocess)
+  java_string_library_preprocesst &string_preprocess)
 {
   java_bytecode_convert_classt java_bytecode_convert_class(
     symbol_table,
@@ -323,8 +437,7 @@ bool java_bytecode_convert_class(
     max_array_length,
     lazy_methods,
     lazy_methods_mode,
-    string_refinement_enabled,
-    character_preprocess);
+    string_preprocess);
 
   try
   {
@@ -348,57 +461,3 @@ bool java_bytecode_convert_class(
 
   return true;
 }
-
-/// Implements the java.lang.String type in the case that we provide an internal
-/// implementation.
-void java_bytecode_convert_classt::add_string_type()
-{
-  class_typet string_type;
-  string_type.set_tag("java.lang.String");
-  string_type.components().resize(3);
-  string_type.components()[0].set_name("@java.lang.Object");
-  string_type.components()[0].set_pretty_name("@java.lang.Object");
-  string_type.components()[0].type()=symbol_typet("java::java.lang.Object");
-  string_type.components()[1].set_name("length");
-  string_type.components()[1].set_pretty_name("length");
-  string_type.components()[1].type()=java_int_type();
-  string_type.components()[2].set_name("data");
-  string_type.components()[2].set_pretty_name("data");
-  // Use a pointer-to-unbounded-array instead of a pointer-to-char.
-  // Saves some casting in the string refinement algorithm but may
-  // be unnecessary.
-  string_type.components()[2].type()=pointer_type(
-    array_typet(java_char_type(), infinity_exprt(java_int_type())));
-  string_type.add_base(symbol_typet("java::java.lang.Object"));
-
-  symbolt string_symbol;
-  string_symbol.name="java::java.lang.String";
-  string_symbol.base_name="java.lang.String";
-  string_symbol.type=string_type;
-  string_symbol.is_type=true;
-
-  symbol_table.add(string_symbol);
-
-  // Also add a stub of `String.equals` so that remove-virtual-functions
-  // generates a check for Object.equals vs. String.equals.
-  // No need to fill it in, as pass_preprocess will replace the calls again.
-  symbolt string_equals_symbol;
-  string_equals_symbol.name=
-    "java::java.lang.String.equals:(Ljava/lang/Object;)Z";
-  string_equals_symbol.base_name="java.lang.String.equals";
-  string_equals_symbol.pretty_name="java.lang.String.equals";
-  string_equals_symbol.mode=ID_java;
-
-  code_typet string_equals_type;
-  string_equals_type.return_type()=java_boolean_type();
-  code_typet::parametert thisparam;
-  thisparam.set_this();
-  thisparam.type()=java_reference_type(symbol_typet(string_symbol.name));
-  code_typet::parametert otherparam;
-  otherparam.type()=java_reference_type(symbol_typet("java::java.lang.Object"));
-  string_equals_type.parameters().push_back(thisparam);
-  string_equals_type.parameters().push_back(otherparam);
-  string_equals_symbol.type=std::move(string_equals_type);
-
-  symbol_table.add(string_equals_symbol);
-}
diff --git a/src/java_bytecode/java_bytecode_convert_class.h b/src/java_bytecode/java_bytecode_convert_class.h
index 0c14a760eec..490372adf9d 100644
--- a/src/java_bytecode/java_bytecode_convert_class.h
+++ b/src/java_bytecode/java_bytecode_convert_class.h
@@ -17,8 +17,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "java_bytecode_parse_tree.h"
 #include "java_bytecode_language.h"
-#include "character_refine_preprocess.h"
 
+/// See class \ref java_bytecode_convert_classt
 bool java_bytecode_convert_class(
   const java_bytecode_parse_treet &parse_tree,
   symbol_tablet &symbol_table,
@@ -26,7 +26,6 @@ bool java_bytecode_convert_class(
   size_t max_array_length,
   lazy_methodst &,
   lazy_methods_modet,
-  bool string_refinement_enabled,
-  const character_refine_preprocesst &character_preprocess);
+  java_string_library_preprocesst &string_preprocess);
 
 #endif // CPROVER_JAVA_BYTECODE_JAVA_BYTECODE_CONVERT_CLASS_H
diff --git a/src/java_bytecode/java_bytecode_convert_method.cpp b/src/java_bytecode/java_bytecode_convert_method.cpp
index d97a769d59f..89c5afc82ac 100644
--- a/src/java_bytecode/java_bytecode_convert_method.cpp
+++ b/src/java_bytecode/java_bytecode_convert_method.cpp
@@ -16,7 +16,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "java_bytecode_convert_method.h"
 #include "java_bytecode_convert_method_class.h"
 #include "bytecode_info.h"
+#include "java_string_library_preprocess.h"
 #include "java_types.h"
+#include "java_utils.h"
 
 #include <util/arith_tools.h>
 #include <util/c_types.h>
@@ -31,12 +33,16 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <linking/zero_initializer.h>
 
 #include <goto-programs/cfg.h>
+#include <goto-programs/remove_exceptions.h>
+#include <goto-programs/class_hierarchy.h>
+#include <goto-programs/resolve_concrete_function_call.h>
 #include <analyses/cfg_dominators.h>
 
 #include <limits>
 #include <algorithm>
 #include <functional>
 #include <unordered_set>
+#include <regex>
 
 class patternt
 {
@@ -61,31 +67,62 @@ class patternt
   const char *p;
 };
 
-static bool operator==(const irep_idt &what, const patternt &pattern)
+/// Iterates through the parameters of the function type \p ftype, finds a new
+/// new name for each parameter and renames them in `ftype.parameters()` as
+/// well as in the \p symbol_table.
+/// \param[in,out] ftype:
+///   Function type whose parameters should be named.
+/// \param name_prefix:
+///   Prefix for parameter names, typically the parent function's name.
+/// \param[in,out] symbol_table:
+///   Global symbol table.
+/// \return Assigns parameter names (side-effects on `ftype`) to function stub
+///   parameters, which are initially nameless as method conversion hasn't
+///   happened. Also creates symbols in `symbol_table`.
+void assign_parameter_names(
+  code_typet &ftype,
+  const irep_idt &name_prefix,
+  symbol_tablet &symbol_table)
 {
-  return pattern==what;
-}
+  code_typet::parameterst &parameters=ftype.parameters();
 
-const size_t SLOTS_PER_INTEGER(1u);
-const size_t INTEGER_WIDTH(64u);
-static size_t count_slots(
-  const size_t value,
-  const code_typet::parametert &param)
-{
-  const std::size_t width(param.type().get_unsigned_int(ID_width));
-  return value+SLOTS_PER_INTEGER+width/INTEGER_WIDTH;
+  // Mostly borrowed from java_bytecode_convert.cpp; maybe factor this out.
+  // assign names to parameters
+  for(std::size_t i=0; i<parameters.size(); ++i)
+  {
+    irep_idt base_name, identifier;
+
+    if(i==0 && parameters[i].get_this())
+      base_name="this";
+    else
+      base_name="stub_ignored_arg"+std::to_string(i);
+
+    identifier=id2string(name_prefix)+"::"+id2string(base_name);
+    parameters[i].set_base_name(base_name);
+    parameters[i].set_identifier(identifier);
+
+    // add to symbol table
+    parameter_symbolt parameter_symbol;
+    parameter_symbol.base_name=base_name;
+    parameter_symbol.mode=ID_java;
+    parameter_symbol.name=identifier;
+    parameter_symbol.type=parameters[i].type();
+    symbol_table.add(parameter_symbol);
+  }
 }
 
-static size_t get_variable_slots(const code_typet::parametert &param)
+static bool operator==(const irep_idt &what, const patternt &pattern)
 {
-  return count_slots(0, param);
+  return pattern==what;
 }
 
 static irep_idt strip_java_namespace_prefix(const irep_idt to_strip)
 {
-  const auto to_strip_str=id2string(to_strip);
-  assert(has_prefix(to_strip_str, "java::"));
-  return to_strip_str.substr(6, std::string::npos);
+  const std::string to_strip_str=id2string(to_strip);
+  const std::string prefix="java::";
+
+  PRECONDITION(has_prefix(to_strip_str, prefix));
+  return to_strip_str.substr(prefix.size(), std::string::npos);
 }
 
 // name contains <init> or <clinit>
@@ -158,6 +195,21 @@ symbol_exprt java_bytecode_convert_methodt::tmp_variable(
   return result;
 }
 
+/// Returns a symbol_exprt indicating a local variable suitable to load/store
+/// from a bytecode at address `address` a value of type `type_char` stored in
+/// the JVM's slot `arg`.
+///
+/// \param arg
+///   The local variable slot
+/// \param type_char
+///   The type of the value stored in the slot pointed by `arg`.
+/// \param address
+///   Bytecode address used to find a variable that the LVT declares to be live
+///   and living in the slot pointed by `arg` for this bytecode.
+/// \param do_cast
+///   Indicates whether we should return the original symbol_exprt or a
+///   typecast_exprt if the type of the symbol_exprt does not equal that
+///   represented by `type_char`.
 const exprt java_bytecode_convert_methodt::variable(
   const exprt &arg,
   char type_char,
@@ -260,25 +312,44 @@ void java_bytecode_convert_methodt::convert(
   const symbolt &class_symbol,
   const methodt &m)
 {
+  // Construct the fully qualified method name
+  // (e.g. "my.package.ClassName.myMethodName:(II)I") and query the symbol table
+  // to retrieve the symbol (constructed by java_bytecode_convert_method_lazy)
+  // associated to the method
   const irep_idt method_identifier=
     id2string(class_symbol.name)+"."+id2string(m.name)+":"+m.signature;
   method_id=method_identifier;
 
   const auto &old_sym=symbol_table.lookup(method_identifier);
 
+  // Obtain a std::vector of code_typet::parametert objects from the
+  // (function) type of the symbol
   typet member_type=old_sym.type;
   code_typet &code_type=to_code_type(member_type);
   method_return_type=code_type.return_type();
   code_typet::parameterst &parameters=code_type.parameters();
 
+  // Determine the number of local variable slots used by the JVM to maintan the
+  // formal parameters
+  slots_for_parameters=java_method_parameter_slots(code_type);
+
+  debug() << "Generating codet: class "
+             << class_symbol.name << ", method "
+             << m.name << eom;
+
+  // We now set up the local variables for the method parameters
   variables.clear();
 
-  // find parameter names in the local variable table:
+  // Find parameter names in the local variable table:
   for(const auto &v : m.local_variable_table)
   {
-    if(v.start_pc!=0) // Local?
+    // Skip this variable if it is not a method parameter
+    if(!is_parameter(v))
       continue;
 
+    // Construct a fully qualified name for the parameter v,
+    // e.g. my.package.ClassName.myMethodName:(II)I::anIntParam, and then a
+    // symbol_exprt with the parameter and its type
     typet t=java_type_from_string(v.signature);
     std::ostringstream id_oss;
     id_oss << method_id << "::" << v.name;
@@ -286,6 +357,10 @@ void java_bytecode_convert_methodt::convert(
     symbol_exprt result(identifier, t);
     result.set(ID_C_base_name, v.name);
 
+    // Create a new variablet in the variables vector; in fact this entry will
+    // be rewritten below in the loop that iterates through the method
+    // parameters; the only field that seem to be useful to write here is the
+    // symbol_expr, others will be rewritten
     variables[v.index].push_back(variablet());
     auto &newv=variables[v.index].back();
     newv.symbol_expr=result;
@@ -293,46 +368,59 @@ void java_bytecode_convert_methodt::convert(
     newv.length=v.length;
   }
 
-  // set up variables array
+  // The variables is a expanding_vectort, and the loop above may have expanded
+  // the vector introducing gaps where the entries are empty vectors. We now
+  // make sure that the vector of each LV slot contains exactly one variablet,
+  // possibly default-initialized
   std::size_t param_index=0;
   for(const auto &param : parameters)
   {
     variables[param_index].resize(1);
-    param_index+=get_variable_slots(param);
+    param_index+=java_local_variable_slots(param.type());
   }
+  INVARIANT(
+    param_index==slots_for_parameters,
+    "java_parameter_count and local computation must agree");
 
-  // assign names to parameters
+  // Assign names to parameters
   param_index=0;
   for(auto &param : parameters)
   {
     irep_idt base_name, identifier;
 
+    // Construct a sensible base name (base_name) and a fully qualified name
+    // (identifier) for every parameter of the method under translation,
+    // regardless of whether we have an LVT or not; and assign it to the
+    // parameter object (which is stored in the type of the symbol, not in the
+    // symbol table)
     if(param_index==0 && param.get_this())
     {
+      // my.package.ClassName.myMethodName:(II)I::this
       base_name="this";
       identifier=id2string(method_identifier)+"::"+id2string(base_name);
-      param.set_base_name(base_name);
-      param.set_identifier(identifier);
     }
     else
     {
-      // in the variable table?
+      // if already present in the LVT ...
       base_name=variables[param_index][0].symbol_expr.get(ID_C_base_name);
       identifier=variables[param_index][0].symbol_expr.get(ID_identifier);
 
+      // ... then base_name will not be empty
       if(base_name.empty())
       {
+        // my.package.ClassName.myMethodName:(II)I::argNT, where N is the local
+        // variable slot where the parameter is stored and T is a character
+        // indicating the type
         const typet &type=param.type();
         char suffix=java_char_from_type(type);
         base_name="arg"+std::to_string(param_index)+suffix;
         identifier=id2string(method_identifier)+"::"+id2string(base_name);
       }
-
-      param.set_base_name(base_name);
-      param.set_identifier(identifier);
     }
+    param.set_base_name(base_name);
+    param.set_identifier(identifier);
 
-    // add to symbol table
+    // Build a new symbol for the parameter and add it to the symbol table
     parameter_symbolt parameter_symbol;
     parameter_symbol.base_name=base_name;
     parameter_symbol.mode=ID_java;
@@ -340,47 +428,45 @@ void java_bytecode_convert_methodt::convert(
     parameter_symbol.type=param.type();
     symbol_table.add(parameter_symbol);
 
-    // add as a JVM variable
-    std::size_t slots=get_variable_slots(param);
+    // Add as a JVM local variable
     variables[param_index][0].symbol_expr=parameter_symbol.symbol_expr();
     variables[param_index][0].is_parameter=true;
     variables[param_index][0].start_pc=0;
     variables[param_index][0].length=std::numeric_limits<size_t>::max();
-    variables[param_index][0].is_parameter=true;
-    param_index+=slots;
-    assert(param_index>0);
+    param_index+=java_local_variable_slots(param.type());
   }
 
+  // The parameter slots detected in this function should agree with what
+  // java_parameter_count() thinks about this method
+  INVARIANT(
+    param_index==slots_for_parameters,
+    "java_parameter_count and local computation must agree");
+
   const bool is_virtual=!m.is_static && !m.is_final;
 
-  #if 0
-  class_type.methods().push_back(class_typet::methodt());
-  class_typet::methodt &method=class_type.methods().back();
-  #else
+  // Construct a methodt, which lives within the class type; this object is
+  // never used for anything useful and could be removed
   class_typet::methodt method;
-  #endif
-
   method.set_base_name(m.base_name);
   method.set_name(method_identifier);
-
   method.set(ID_abstract, m.is_abstract);
   method.set(ID_is_virtual, is_virtual);
-
+  method.type()=member_type;
   if(is_constructor(method))
     method.set(ID_constructor, true);
 
-  method.type()=member_type;
-
   // we add the symbol for the method
-
   symbolt method_symbol;
-
   method_symbol.name=method.get_name();
   method_symbol.base_name=method.get_base_name();
   method_symbol.mode=ID_java;
   method_symbol.location=m.source_location;
   method_symbol.location.set_function(method_identifier);
 
+  // Set up the pretty name for the method entry in the symbol table.
+  // The pretty name of a constructor includes the base name of the class
+  // instead of the internal method name "<init>". For regular methods, it's
+  // just the base name of the method.
   if(method.get_base_name()=="<init>")
     method_symbol.pretty_name=id2string(class_symbol.pretty_name)+"."+
                               id2string(class_symbol.base_name)+"()";
@@ -391,18 +477,20 @@ void java_bytecode_convert_methodt::convert(
   method_symbol.type=member_type;
   if(is_constructor(method))
     method_symbol.type.set(ID_constructor, true);
+
   current_method=method_symbol.name;
   method_has_this=code_type.has_this();
-
-  tmp_vars.clear();
   if((!m.is_abstract) && (!m.is_native))
-    method_symbol.value=convert_instructions(m, code_type);
+    method_symbol.value=convert_instructions(m, code_type, method_symbol.name);
 
   // Replace the existing stub symbol with the real deal:
   const auto s_it=symbol_table.symbols.find(method.get_name());
-  assert(s_it!=symbol_table.symbols.end());
+  INVARIANT(
+    s_it!=symbol_table.symbols.end(),
+    "the symbol was there earlier on this function; it must be there now");
   symbol_table.symbols.erase(s_it);
 
+  // Insert the method symbol in the symbol table
   symbol_table.add(method_symbol);
 }
 
@@ -443,41 +531,14 @@ static member_exprt to_member(const exprt &pointer, const exprt &fieldref)
   exprt pointer2=
     typecast_exprt(pointer, java_reference_type(class_type));
 
-  const dereference_exprt obj_deref(pointer2, class_type);
+  dereference_exprt obj_deref=checked_dereference(pointer2, class_type);
 
-  return member_exprt(
+  const member_exprt member_expr(
     obj_deref,
     fieldref.get(ID_component_name),
     fieldref.type());
-}
 
-codet java_bytecode_convert_methodt::get_array_bounds_check(
-  const exprt &arraystruct,
-  const exprt &idx,
-  const source_locationt &original_sloc)
-{
-  constant_exprt intzero=from_integer(0, java_int_type());
-  binary_relation_exprt gezero(idx, ID_ge, intzero);
-  const member_exprt length_field(arraystruct, "length", java_int_type());
-  binary_relation_exprt ltlength(idx, ID_lt, length_field);
-  code_blockt bounds_checks;
-
-  bounds_checks.add(code_assertt(gezero));
-  bounds_checks.operands().back().add_source_location()=original_sloc;
-  bounds_checks.operands().back().add_source_location()
-    .set_comment("Array index < 0");
-  bounds_checks.operands().back().add_source_location()
-    .set_property_class("array-index-out-of-bounds-low");
-  bounds_checks.add(code_assertt(ltlength));
-
-  bounds_checks.operands().back().add_source_location()=original_sloc;
-  bounds_checks.operands().back().add_source_location()
-    .set_comment("Array index >= length");
-  bounds_checks.operands().back().add_source_location()
-    .set_property_class("array-index-out-of-bounds-high");
-
-  // TODO make this throw ArrayIndexOutOfBoundsException instead of asserting.
-  return bounds_checks;
+  return member_expr;
 }
 
 /// Find all goto statements in 'repl' that target 'old_label' and redirect them
@@ -648,7 +709,8 @@ code_blockt &java_bytecode_convert_methodt::get_or_create_block_for_pcrange(
     {
       if(p<(*findstart) || p>=findlim_block_start_address)
       {
-        debug() << "Warning: refusing to create lexical block spanning "
+        debug() << "Generating codet:  "
+                << "warning: refusing to create lexical block spanning "
                 << (*findstart) << "-" << findlim_block_start_address
                 << " due to incoming edge " << p << " -> "
                 << checkit->first << eom;
@@ -670,7 +732,8 @@ code_blockt &java_bytecode_convert_methodt::get_or_create_block_for_pcrange(
   code_blockt &newblock=to_code_block(newlabel.code());
   auto nblocks=std::distance(findstart, findlim);
   assert(nblocks>=2);
-  debug() << "Combining " << std::distance(findstart, findlim)
+  debug() << "Generating codet:  combining "
+          << std::distance(findstart, findlim)
           << " blocks for addresses " << (*findstart) << "-"
           << findlim_block_start_address << eom;
 
@@ -769,6 +832,174 @@ static void gather_symbol_live_ranges(
   }
 }
 
+/// See above
+/// \par parameters: `se`: Symbol expression referring to a static field
+/// `basename`: The static field's basename
+/// \return Creates a symbol table entry for the static field if one doesn't
+///   exist already.
+void java_bytecode_convert_methodt::check_static_field_stub(
+  const symbol_exprt &symbol_expr,
+  const irep_idt &basename)
+{
+  const auto &id=symbol_expr.get_identifier();
+  if(symbol_table.symbols.find(id)==symbol_table.symbols.end())
+  {
+    // Create a stub, to be overwritten if/when the real class is loaded.
+    symbolt new_symbol;
+    new_symbol.is_static_lifetime=true;
+    new_symbol.is_lvalue=true;
+    new_symbol.is_state_var=true;
+    new_symbol.name=id;
+    new_symbol.base_name=basename;
+    new_symbol.type=symbol_expr.type();
+    new_symbol.pretty_name=new_symbol.name;
+    new_symbol.mode=ID_java;
+    new_symbol.is_type=false;
+    new_symbol.value.make_nil();
+    symbol_table.add(new_symbol);
+  }
+}
+
+/// Determine whether a `new` or static access against `classname` should be
+/// prefixed with a static initialization check.
+/// \param classname: Class name
+/// \return Returns true if the given class or one of its parents has a static
+///   initializer
+bool java_bytecode_convert_methodt::class_needs_clinit(
+  const irep_idt &classname)
+{
+  auto findit_any=any_superclass_has_clinit_method.insert({classname, false});
+  if(!findit_any.second)
+    return findit_any.first->second;
+
+  auto findit_here=class_has_clinit_method.insert({classname, false});
+  if(findit_here.second)
+  {
+    const irep_idt &clinit_name=id2string(classname)+".<clinit>:()V";
+    findit_here.first->second=symbol_table.symbols.count(clinit_name);
+  }
+  if(findit_here.first->second)
+  {
+    findit_any.first->second=true;
+    return true;
+  }
+  auto findit_symbol=symbol_table.symbols.find(classname);
+  // Stub class?
+  if(findit_symbol==symbol_table.symbols.end())
+  {
+    warning() << "SKIPPED: " << classname << eom;
+    return false;
+  }
+  const symbolt &class_symbol=symbol_table.lookup(classname);
+  for(const auto &base : to_class_type(class_symbol.type).bases())
+  {
+    if(class_needs_clinit(to_symbol_type(base.type()).get_identifier()))
+    {
+      findit_any.first->second=true;
+      return true;
+    }
+  }
+  return false;
+}
+
+/// Create a ::clinit_wrapper the first time a static initializer might be
+/// called. The wrapper method checks whether static init has already taken
+/// place, calls the actual <clinit> method if not, and initializes super-
+/// classes and interfaces.
+/// \param classname: Class name
+/// \return Returns a symbol_exprt pointing to the given class' clinit wrapper
+///   if one is required, or nil otherwise.
+exprt java_bytecode_convert_methodt::get_or_create_clinit_wrapper(
+  const irep_idt &classname)
+{
+  if(!class_needs_clinit(classname))
+    return static_cast<const exprt &>(get_nil_irep());
+
+  const irep_idt &clinit_wrapper_name=
+    id2string(classname)+"::clinit_wrapper";
+  auto findit=symbol_table.symbols.find(clinit_wrapper_name);
+  if(findit!=symbol_table.symbols.end())
+    return findit->second.symbol_expr();
+
+  // Create the wrapper now:
+  const irep_idt &already_run_name=
+    id2string(classname)+"::clinit_already_run";
+  symbolt already_run_symbol;
+  already_run_symbol.name=already_run_name;
+  already_run_symbol.pretty_name=already_run_name;
+  already_run_symbol.base_name="clinit_already_run";
+  already_run_symbol.type=bool_typet();
+  already_run_symbol.value=false_exprt();
+  already_run_symbol.is_lvalue=true;
+  already_run_symbol.is_state_var=true;
+  already_run_symbol.is_static_lifetime=true;
+  already_run_symbol.mode=ID_java;
+  symbol_table.add(already_run_symbol);
+
+  equal_exprt check_already_run(
+    already_run_symbol.symbol_expr(),
+    false_exprt());
+
+  code_ifthenelset wrapper_body;
+  wrapper_body.cond()=check_already_run;
+  code_blockt init_body;
+  // Note already-run is set *before* calling clinit, in order to prevent
+  // recursion in clinit methods.
+  code_assignt set_already_run(already_run_symbol.symbol_expr(), true_exprt());
+  init_body.move_to_operands(set_already_run);
+  const irep_idt &real_clinit_name=id2string(classname)+".<clinit>:()V";
+  const symbolt &class_symbol=symbol_table.lookup(classname);
+
+  auto findsymit=symbol_table.symbols.find(real_clinit_name);
+  if(findsymit!=symbol_table.symbols.end())
+  {
+    code_function_callt call_real_init;
+    call_real_init.function()=findsymit->second.symbol_expr();
+    init_body.move_to_operands(call_real_init);
+  }
+
+  for(const auto &base : to_class_type(class_symbol.type).bases())
+  {
+    const auto base_name=to_symbol_type(base.type()).get_identifier();
+    exprt base_init_routine=get_or_create_clinit_wrapper(base_name);
+    if(base_init_routine.is_nil())
+      continue;
+    code_function_callt call_base;
+    call_base.function()=base_init_routine;
+    init_body.move_to_operands(call_base);
+  }
+
+  wrapper_body.then_case()=init_body;
+
+  symbolt wrapper_method_symbol;
+  code_typet wrapper_method_type;
+  wrapper_method_type.return_type()=void_typet();
+  wrapper_method_symbol.name=clinit_wrapper_name;
+  wrapper_method_symbol.pretty_name=clinit_wrapper_name;
+  wrapper_method_symbol.base_name="clinit_wrapper";
+  wrapper_method_symbol.type=wrapper_method_type;
+  wrapper_method_symbol.value=wrapper_body;
+  wrapper_method_symbol.mode=ID_java;
+  symbol_table.add(wrapper_method_symbol);
+  return wrapper_method_symbol.symbol_expr();
+}
+
+/// Each static access to classname should be prefixed with a check for
+/// necessary static init; this returns a call implementing that check.
+/// \param classname: Class name
+/// \return Returns a function call to the given class' static initializer
+///   wrapper if one is needed, or a skip instruction otherwise.
+codet java_bytecode_convert_methodt::get_clinit_call(
+  const irep_idt &classname)
+{
+  exprt callee=get_or_create_clinit_wrapper(classname);
+  if(callee.is_nil())
+    return code_skipt();
+  code_function_callt ret;
+  ret.function()=callee;
+  return ret;
+}
+
 static unsigned get_bytecode_type_width(const typet &ty)
 {
   if(ty.id()==ID_pointer)
@@ -778,7 +1009,8 @@ static unsigned get_bytecode_type_width(const typet &ty)
 
 codet java_bytecode_convert_methodt::convert_instructions(
   const methodt &method,
-  const code_typet &method_type)
+  const code_typet &method_type,
+  const irep_idt &method_name)
 {
   const instructionst &instructions=method.instructions;
 
@@ -822,6 +1054,17 @@ codet java_bytecode_convert_methodt::convert_instructions(
     }
 
     if(i_it->statement=="athrow" ||
+       i_it->statement=="putfield" ||
+       i_it->statement=="getfield" ||
+       i_it->statement=="checkcast" ||
+       i_it->statement=="newarray" ||
+       i_it->statement=="anewarray" ||
+       i_it->statement=="idiv" ||
+       i_it->statement=="ldiv" ||
+       i_it->statement=="irem" ||
+       i_it->statement=="lrem" ||
+       i_it->statement==patternt("?astore") ||
+       i_it->statement==patternt("?aload") ||
        i_it->statement=="invokestatic" ||
        i_it->statement=="invokevirtual" ||
        i_it->statement=="invokespecial" ||
@@ -915,6 +1158,12 @@ codet java_bytecode_convert_methodt::convert_instructions(
     }
   }
 
+  // Clean the list of temporary variables created by a call to `tmp_variable`.
+  // These are local variables in the goto function used to represent temporary
+  // values of the JVM operand stack, newly allocated objects before the
+  // constructor is called, ...
+  tmp_vars.clear();
+
   // Now that the control flow graph is built, set up our local variables
   // (these require the graph to determine live ranges)
   setup_local_variables(method, address_map);
@@ -968,46 +1217,45 @@ codet java_bytecode_convert_methodt::convert_instructions(
       statement=std::string(id2string(statement), 0, statement.size()-2);
     }
 
-    // we throw away the first statement in an exception handler
-    // as we don't know if a function call had a normal or exceptional return
+    typet catch_type;
+
+    // Find catch blocks that begin here. For now we assume if more than
+    // one catch targets the same bytecode then we must be indifferent to
+    // its type and just call it a Throwable.
     auto it=method.exception_table.begin();
     for(; it!=method.exception_table.end(); ++it)
     {
       if(cur_pc==it->handler_pc)
       {
-        exprt exc_var=variable(
-          arg0, statement[0],
-          i_it->address,
-          NO_CAST);
-
-        // throw away the operands
-        pop_residue(bytecode_info.pop);
-
-        // add a CATCH-PUSH signaling a handler
-        side_effect_expr_catcht catch_handler_expr;
-        // pack the exception variable so that it can be used
-        // later for instrumentation
-        catch_handler_expr.get_sub().resize(1);
-        catch_handler_expr.get_sub()[0]=exc_var;
-
-        code_expressiont catch_handler(catch_handler_expr);
-        code_labelt newlabel(label(std::to_string(cur_pc)),
-                             code_blockt());
-
-        code_blockt label_block=to_code_block(newlabel.code());
-        code_blockt handler_block;
-        handler_block.move_to_operands(c);
-        handler_block.move_to_operands(catch_handler);
-        handler_block.move_to_operands(label_block);
-        c=handler_block;
-        break;
+        if(catch_type!=typet() || it->catch_type==symbol_typet())
+        {
+          catch_type=symbol_typet("java::java.lang.Throwable");
+          break;
+        }
+        else
+          catch_type=it->catch_type;
       }
     }
 
-    if(it!=method.exception_table.end())
+    codet catch_instruction;
+
+    if(catch_type!=typet())
     {
-      // go straight to the next statement
-      continue;
+      // at the beginning of a handler, clear the stack and
+      // push the corresponding exceptional return variable
+      // We also create a catch exception instruction that
+      // precedes the catch block, and which remove_exceptionst
+      // will transform into something like:
+      // catch_var = GLOBAL_THROWN_EXCEPTION;
+      // GLOBAL_THROWN_EXCEPTION = null;
+      stack.clear();
+      symbol_exprt catch_var=
+        tmp_variable(
+          "caught_exception",
+          java_reference_type(catch_type));
+      stack.push_back(catch_var);
+      code_landingpadt catch_statement(catch_var);
+      catch_instruction=catch_statement;
     }
 
     exprt::operandst op=pop(bytecode_info.pop);
@@ -1022,40 +1270,26 @@ codet java_bytecode_convert_methodt::convert_instructions(
     else if(statement=="athrow")
     {
       assert(op.size()==1 && results.size()==1);
-      code_blockt block;
-      // TODO throw NullPointerException instead
-      const typecast_exprt lhs(op[0], java_reference_type(empty_typet()));
-      const exprt rhs(null_pointer_exprt(to_pointer_type(lhs.type())));
-      const exprt not_equal_null(
-        binary_relation_exprt(lhs, ID_notequal, rhs));
-      code_assertt check(not_equal_null);
-      check.add_source_location()
-        .set_comment("Throw null");
-      check.add_source_location()
-        .set_property_class("null-pointer-exception");
-      block.move_to_operands(check);
 
       side_effect_expr_throwt throw_expr;
       throw_expr.add_source_location()=i_it->source_location;
       throw_expr.copy_to_operands(op[0]);
       c=code_expressiont(throw_expr);
       results[0]=op[0];
-
-      block.move_to_operands(c);
-      c=block;
     }
     else if(statement=="checkcast")
     {
       // checkcast throws an exception in case a cast of object
       // on stack to given type fails.
       // The stack isn't modified.
-      // TODO: convert assertions to exceptions.
       assert(op.size()==1 && results.size()==1);
       binary_predicate_exprt check(op[0], ID_java_instanceof, arg0);
-      c=code_assertt(check);
-      c.add_source_location().set_comment("Dynamic cast check");
-      c.add_source_location().set_property_class("bad-dynamic-cast");
-
+      code_assertt assert_class(check);
+      assert_class.add_source_location().set_comment("Dynamic cast check");
+      assert_class.add_source_location().set_property_class("bad-dynamic-cast");
+      // we add this assert such that we can recognise it
+      // during the instrumentation phase
+      c=std::move(assert_class);
       results[0]=op[0];
     }
     else if(statement=="invokedynamic")
@@ -1079,6 +1313,25 @@ codet java_bytecode_convert_methodt::convert_instructions(
             get_message_handler());
       }
     }
+    // replace calls to CProver.assume
+    else if(statement=="invokestatic" &&
+            id2string(arg0.get(ID_identifier))==
+            "java::org.cprover.CProver.assume:(Z)V")
+    {
+      const code_typet &code_type=to_code_type(arg0.type());
+      // sanity check: function has the right number of args
+      assert(code_type.parameters().size()==1);
+
+      exprt operand = pop(1)[0];
+      // we may need to adjust the type of the argument
+      if(operand.type()!=bool_typet())
+        operand.make_typecast(bool_typet());
+
+      c=code_assumet(operand);
+      source_locationt loc=i_it->source_location;
+      loc.set_function(method_id);
+      c.add_source_location()=loc;
+    }
     else if(statement=="invokeinterface" ||
             statement=="invokespecial" ||
             statement=="invokevirtual" ||
@@ -1168,18 +1421,44 @@ codet java_bytecode_convert_methodt::convert_instructions(
 
       assert(arg0.id()==ID_virtual_function);
 
-      // does the function symbol exist?
+      // If we don't have a definition for the called symbol, and we won't
+      // inherit a definition from a super-class, we create a new symbol and
+      // insert it in the symbol table. The name and type of the method are
+      // derived from the information we have in the call.
+      // We fix the access attribute to ID_public, because of the following
+      // reasons:
+      // - We don't know the orignal access attribute and since the .class file
+      //   unavailable, we have no way to know.
+      // - Whatever it was, we assume that the bytecode we are translating
+      //   compiles correctly, so such a method has to be accessible from this
+      //   method.
+      // - We will never generate code that calls that method unless we
+      //   translate bytecode that calls that method. As a result we will never
+      //   generate code that may wrongly assume that such a method is
+      //   accessible if we assume that its access attribute is "more
+      //   accessible" than it actually is.
       irep_idt id=arg0.get(ID_identifier);
-
-      if(symbol_table.symbols.find(id)==symbol_table.symbols.end())
+      if(symbol_table.symbols.find(id)==symbol_table.symbols.end() &&
+         !(is_virtual && is_method_inherited(arg0.get(ID_C_class), arg0.get(ID_component_name))))
       {
-        // no, create stub
         symbolt symbol;
         symbol.name=id;
         symbol.base_name=arg0.get(ID_C_base_name);
+        symbol.pretty_name=
+          id2string(arg0.get(ID_C_class)).substr(6)+"."+
+          id2string(symbol.base_name)+"()";
         symbol.type=arg0.type();
+        symbol.type.set(ID_access, ID_public);
         symbol.value.make_nil();
         symbol.mode=ID_java;
+        assign_parameter_names(
+          to_code_type(symbol.type),
+          symbol.name,
+          symbol_table);
+
+        debug()
+          << "Generating codet:  new opaque symbol: method '"
+          << symbol.name << "'" << eom;
         symbol_table.add(symbol);
       }
 
@@ -1197,14 +1476,30 @@ codet java_bytecode_convert_methodt::convert_instructions(
         // static binding
         call.function()=symbol_exprt(arg0.get(ID_identifier), arg0.type());
         if(lazy_methods)
+        {
           lazy_methods->add_needed_method(arg0.get(ID_identifier));
+          // Calling a static method causes static initialization:
+          lazy_methods->add_needed_class(arg0.get(ID_C_class));
+        }
       }
 
       call.function().add_source_location()=loc;
 
       // Replacing call if it is a function of the Character library,
       // returning the same call otherwise
-      c=character_preprocess.replace_character_call(call);
+      c=string_preprocess.replace_character_call(call);
+
+      if(!use_this)
+      {
+        codet clinit_call=get_clinit_call(arg0.get(ID_C_class));
+        if(clinit_call.get_statement()!=ID_skip)
+        {
+          code_blockt ret_block;
+          ret_block.move_to_operands(clinit_call);
+          ret_block.move_to_operands(c);
+          c=std::move(ret_block);
+        }
+      }
     }
     else if(statement=="return")
     {
@@ -1230,7 +1525,8 @@ codet java_bytecode_convert_methodt::convert_instructions(
       exprt pointer=
         typecast_exprt(op[0], java_array_type(type_char));
 
-      const dereference_exprt deref(pointer, pointer.type().subtype());
+      dereference_exprt deref(pointer, pointer.type().subtype());
+      deref.set(ID_java_member_access, true);
 
       const member_exprt data_ptr(
         deref,
@@ -1238,6 +1534,8 @@ codet java_bytecode_convert_methodt::convert_instructions(
         pointer_type(java_type_from_char(type_char)));
 
       plus_exprt data_plus_offset(data_ptr, op[1], data_ptr.type());
+      // tag it so it's easy to identify during instrumentation
+      data_plus_offset.set(ID_java_array_access, true);
       typet element_type=data_ptr.type().subtype();
       const dereference_exprt element(data_plus_offset, element_type);
 
@@ -1251,10 +1549,6 @@ codet java_bytecode_convert_methodt::convert_instructions(
         bytecode_write_typet::ARRAY_REF,
         "");
 
-      codet bounds_check=
-        get_array_bounds_check(deref, op[1], i_it->source_location);
-      bounds_check.add_source_location()=i_it->source_location;
-      block.move_to_operands(bounds_check);
       code_assignt array_put(element, op[2]);
       array_put.add_source_location()=i_it->source_location;
       block.move_to_operands(array_put);
@@ -1295,7 +1589,8 @@ codet java_bytecode_convert_methodt::convert_instructions(
       exprt pointer=
         typecast_exprt(op[0], java_array_type(type_char));
 
-      const dereference_exprt deref(pointer, pointer.type().subtype());
+      dereference_exprt deref(pointer, pointer.type().subtype());
+      deref.set(ID_java_member_access, true);
 
       const member_exprt data_ptr(
         deref,
@@ -1303,11 +1598,10 @@ codet java_bytecode_convert_methodt::convert_instructions(
         pointer_type(java_type_from_char(type_char)));
 
       plus_exprt data_plus_offset(data_ptr, op[1], data_ptr.type());
+      // tag it so it's easy to identify during instrumentation
+      data_plus_offset.set(ID_java_array_access, true);
       typet element_type=data_ptr.type().subtype();
       dereference_exprt element(data_plus_offset, element_type);
-
-      c=get_array_bounds_check(deref, op[1], i_it->source_location);
-      c.add_source_location()=i_it->source_location;
       results[0]=java_bytecode_promotion(element);
     }
     else if(statement==patternt("?load"))
@@ -1379,7 +1673,7 @@ codet java_bytecode_convert_methodt::convert_instructions(
         from_integer(
           std::next(i_it)->address,
           unsignedbv_typet(64));
-      results[0].type()=pointer_typet(void_typet(), 64);
+      results[0].type()=pointer_type(void_typet());
     }
     else if(statement=="ret")
     {
@@ -1404,7 +1698,7 @@ codet java_bytecode_convert_methodt::convert_instructions(
             from_integer(
               jsr_ret_targets[idx],
               unsignedbv_typet(64));
-          address_ptr.type()=pointer_typet(void_typet(), 64);
+          address_ptr.type()=pointer_type(void_typet());
           branch.cond()=equal_exprt(retvar, address_ptr);
           branch.cond().add_source_location()=i_it->source_location;
           branch.then_case()=g;
@@ -1499,7 +1793,9 @@ codet java_bytecode_convert_methodt::convert_instructions(
         statement=="ifge"?ID_ge:
         statement=="ifgt"?ID_gt:
         statement=="ifle"?ID_le:
-        (assert(false), "");
+        irep_idt();
+
+      INVARIANT(!id.empty(), "unexpected bytecode-if");
 
       assert(op.size()==1 && results.empty());
       mp_integer number;
@@ -1800,17 +2096,44 @@ codet java_bytecode_convert_methodt::convert_instructions(
       assert(op.empty() && results.size()==1);
       symbol_exprt symbol_expr(arg0.type());
       const auto &field_name=arg0.get_string(ID_component_name);
+      const bool is_assertions_disabled_field=
+        field_name.find("$assertionsDisabled")!=std::string::npos;
       symbol_expr.set_identifier(arg0.get_string(ID_class)+"."+field_name);
-      if(lazy_methods && arg0.type().id()==ID_symbol)
+
+      // If external, create a symbol table entry for this static field:
+      check_static_field_stub(symbol_expr, field_name);
+
+      if(lazy_methods)
       {
-        lazy_methods->add_needed_class(
-          to_symbol_type(arg0.type()).get_identifier());
+        if(arg0.type().id()==ID_symbol)
+        {
+          lazy_methods->add_needed_class(
+            to_symbol_type(arg0.type()).get_identifier());
+        }
+        else if(arg0.type().id()==ID_pointer)
+        {
+          const auto &pointer_type=to_pointer_type(arg0.type());
+          if(pointer_type.subtype().id()==ID_symbol)
+          {
+            lazy_methods->add_needed_class(
+              to_symbol_type(pointer_type.subtype()).get_identifier());
+          }
+        }
+        else if(is_assertions_disabled_field)
+        {
+          lazy_methods->add_needed_class(arg0.get_string(ID_class));
+        }
       }
       results[0]=java_bytecode_promotion(symbol_expr);
 
-      // set $assertionDisabled to false
-      if(field_name.find("$assertionsDisabled")!=std::string::npos)
+      codet clinit_call=get_clinit_call(arg0.get_string(ID_class));
+      if(clinit_call.get_statement()!=ID_skip)
+        c=clinit_call;
+      else if(is_assertions_disabled_field)
+      {
+        // set $assertionDisabled to false
         c=code_assignt(symbol_expr, false_exprt());
+      }
     }
     else if(statement=="putfield")
     {
@@ -1831,14 +2154,23 @@ codet java_bytecode_convert_methodt::convert_instructions(
       symbol_exprt symbol_expr(arg0.type());
       const auto &field_name=arg0.get_string(ID_component_name);
       symbol_expr.set_identifier(arg0.get_string(ID_class)+"."+field_name);
+
+      // If external, create a symbol table entry for this static field:
+      check_static_field_stub(symbol_expr, field_name);
+
       if(lazy_methods && arg0.type().id()==ID_symbol)
       {
         lazy_methods->add_needed_class(
           to_symbol_type(arg0.type()).get_identifier());
       }
+
       code_blockt block;
       block.add_source_location()=i_it->source_location;
 
+      codet clinit_call=get_clinit_call(arg0.get_string(ID_class));
+      if(clinit_call.get_statement()!=ID_skip)
+        block.move_to_operands(clinit_call);
+
       save_stack_entries(
         "stack_static_field",
         symbol_expr.type(),
@@ -1869,6 +2201,15 @@ codet java_bytecode_convert_methodt::convert_instructions(
       const exprt tmp=tmp_variable("new", ref_type);
       c=code_assignt(tmp, java_new_expr);
       c.add_source_location()=i_it->source_location;
+      codet clinit_call=
+        get_clinit_call(to_symbol_type(arg0.type()).get_identifier());
+      if(clinit_call.get_statement()!=ID_skip)
+      {
+        code_blockt ret_block;
+        ret_block.move_to_operands(clinit_call);
+        ret_block.move_to_operands(c);
+        c=std::move(ret_block);
+      }
       results[0]=tmp;
     }
     else if(statement=="newarray" ||
@@ -1915,14 +2256,6 @@ codet java_bytecode_convert_methodt::convert_instructions(
         java_new_array.add_source_location()=i_it->source_location;
 
       c=code_blockt();
-      // TODO make this throw NegativeArrayIndexException instead.
-      constant_exprt intzero=from_integer(0, java_int_type());
-      binary_relation_exprt gezero(op[0], ID_ge, intzero);
-      code_assertt check(gezero);
-      check.add_source_location().set_comment("Array size < 0");
-      check.add_source_location()
-        .set_property_class("array-create-negative-size");
-      c.move_to_operands(check);
 
       if(max_array_length!=0)
       {
@@ -1957,15 +2290,7 @@ codet java_bytecode_convert_methodt::convert_instructions(
       if(!i_it->source_location.get_line().empty())
         java_new_array.add_source_location()=i_it->source_location;
 
-      code_blockt checkandcreate;
-      // TODO make this throw NegativeArrayIndexException instead.
-      constant_exprt intzero=from_integer(0, java_int_type());
-      binary_relation_exprt gezero(op[0], ID_ge, intzero);
-      code_assertt check(gezero);
-      check.add_source_location().set_comment("Array size < 0");
-      check.add_source_location()
-        .set_property_class("array-create-negative-size");
-      checkandcreate.move_to_operands(check);
+      code_blockt create;
 
       if(max_array_length!=0)
       {
@@ -1973,11 +2298,12 @@ codet java_bytecode_convert_methodt::convert_instructions(
           from_integer(max_array_length, java_int_type());
         binary_relation_exprt le_max_size(op[0], ID_le, size_limit);
         code_assumet assume_le_max_size(le_max_size);
-        checkandcreate.move_to_operands(assume_le_max_size);
+        create.move_to_operands(assume_le_max_size);
       }
 
       const exprt tmp=tmp_variable("newarray", ref_type);
-      c=code_assignt(tmp, java_new_array);
+      create.copy_to_operands(code_assignt(tmp, java_new_array));
+      c=std::move(create);
       results[0]=tmp;
     }
     else if(statement=="arraylength")
@@ -1987,8 +2313,9 @@ codet java_bytecode_convert_methodt::convert_instructions(
       exprt pointer=
         typecast_exprt(op[0], java_array_type(statement[0]));
 
-      const dereference_exprt array(pointer, pointer.type().subtype());
+      dereference_exprt array(pointer, pointer.type().subtype());
       assert(pointer.type().subtype().id()==ID_symbol);
+      array.set(ID_java_member_access, true);
 
       const member_exprt length(array, "length", java_int_type());
 
@@ -2090,6 +2417,12 @@ codet java_bytecode_convert_methodt::convert_instructions(
       call.add_source_location()=i_it->source_location;
       c=call;
     }
+    else if(statement=="swap")
+    {
+      assert(op.size()==2 && results.size()==2);
+      results[1]=op[0];
+      results[0]=op[1];
+    }
     else
     {
       c=codet(statement);
@@ -2137,23 +2470,21 @@ codet java_bytecode_convert_methodt::convert_instructions(
       // add the actual PUSH-CATCH instruction
       if(!exception_ids.empty())
       {
-        // add the exception ids
-        side_effect_expr_catcht catch_push_expr;
-        irept result(ID_exception_list);
-        result.get_sub().resize(exception_ids.size());
+        code_push_catcht catch_push;
+        INVARIANT(
+          exception_ids.size()==handler_labels.size(),
+          "Exception tags and handler labels should be 1-to-1");
+        code_push_catcht::exception_listt &exception_list=
+          catch_push.exception_list();
         for(size_t i=0; i<exception_ids.size(); ++i)
-          result.get_sub()[i].id(exception_ids[i]);
-        catch_push_expr.set(ID_exception_list, result);
-
-        // add the labels corresponding to the handlers
-        irept labels(ID_label);
-        labels.get_sub().resize(handler_labels.size());
-        for(size_t i=0; i<handler_labels.size(); ++i)
-          labels.get_sub()[i].id(handler_labels[i]);
-        catch_push_expr.set(ID_label, labels);
+        {
+          exception_list.push_back(
+            code_push_catcht::exception_list_entryt(
+              exception_ids[i],
+              handler_labels[i]));
+        }
 
         code_blockt try_block;
-        code_expressiont catch_push(catch_push_expr);
         try_block.move_to_operands(catch_push);
         try_block.move_to_operands(c);
         c=try_block;
@@ -2193,11 +2524,8 @@ codet java_bytecode_convert_methodt::convert_instructions(
           // another CATCH-POP for the same try-catch
           start_pc=exception_row.start_pc;
           // add CATCH_POP instruction
-          side_effect_expr_catcht catch_pop_expr;
+          code_pop_catcht catch_pop;
           code_blockt end_try_block;
-          code_expressiont catch_pop(catch_pop_expr);
-          catch_pop.set(ID_exception_list, get_nil_irep());
-          catch_pop.set(ID_label, get_nil_irep());
           end_try_block.move_to_operands(c);
           end_try_block.move_to_operands(catch_pop);
           c=end_try_block;
@@ -2205,8 +2533,17 @@ codet java_bytecode_convert_methodt::convert_instructions(
       }
     }
 
+    // Finally if this is the beginning of a catch block (already determined
+    // before the big bytecode switch), insert the exception 'landing pad'
+    // instruction before the actual instruction:
+    if(catch_instruction!=codet())
+    {
+      c.make_block();
+      c.operands().insert(c.operands().begin(), catch_instruction);
+    }
+
     if(!i_it->source_location.get_line().empty())
-      c.add_source_location()=i_it->source_location;
+      merge_source_location_rec(c, i_it->source_location);
 
     push(results);
 
@@ -2216,9 +2553,7 @@ codet java_bytecode_convert_methodt::convert_instructions(
       address_mapt::iterator a_it2=address_map.find(address);
       assert(a_it2!=address_map.end());
 
-      // we don't worry about exception handlers as we don't load the
-      // operands from the stack anyway -- we keep explicit global
-      // exception variables
+      // clear the stack if this is an exception handler
       for(const auto &exception_row : method.exception_table)
       {
         if(address==exception_row.handler_pc)
@@ -2287,7 +2622,6 @@ codet java_bytecode_convert_methodt::convert_instructions(
               c.copy_to_operands(*o_it);
         }
       }
-
       a_it2->second.stack=stack;
     }
   }
@@ -2438,19 +2772,100 @@ void java_bytecode_convert_method(
   symbol_tablet &symbol_table,
   message_handlert &message_handler,
   size_t max_array_length,
-  safe_pointer<ci_lazy_methodst> lazy_methods,
-  const character_refine_preprocesst &character_refine)
+  safe_pointer<ci_lazy_methods_neededt> lazy_methods,
+  java_string_library_preprocesst &string_preprocess)
 {
+  static const std::unordered_set<std::string> methods_to_ignore
+  {
+    "nondetBoolean",
+    "nondetByte",
+    "nondetChar",
+    "nondetShort",
+    "nondetInt",
+    "nondetLong",
+    "nondetFloat",
+    "nondetDouble",
+    "nondetWithNull",
+    "nondetWithoutNull",
+    "notModelled",
+  };
+
+  if(std::regex_match(
+       id2string(class_symbol.name),
+       std::regex(".*org\\.cprover\\.CProver.*")) &&
+     methods_to_ignore.find(id2string(method.name))!=methods_to_ignore.end())
+  {
+    // Ignore these methods, rely on default stubbing behaviour.
+    return;
+  }
+
   java_bytecode_convert_methodt java_bytecode_convert_method(
     symbol_table,
     message_handler,
     max_array_length,
     lazy_methods,
-    character_refine);
+    string_preprocess);
 
   java_bytecode_convert_method(class_symbol, method);
 }
 
+/// Returns true iff method \p methodid from class \p classname is
+/// a method inherited from a class (and not an interface!) from which
+/// \p classname inherits, either directly or indirectly.
+bool java_bytecode_convert_methodt::is_method_inherited(
+  const irep_idt &classname, const irep_idt &methodid) const
+{
+  resolve_concrete_function_callt call_resolver(symbol_table);
+  const resolve_concrete_function_callt ::concrete_function_callt &
+    resolved_call=call_resolver(classname, methodid);
+
+  // resolved_call is a pair (class-name, method-name) found by walking the
+  // chain of class inheritance (not interfaces!) and stopping on the first
+  // class that contains a method of equal name and type to `methodid`
+
+  if(resolved_call.is_valid())
+  {
+    const symbolt &function_symbol=
+      symbol_table.lookup(resolved_call.get_virtual_method_name());
+
+    INVARIANT(function_symbol.type.id()==ID_code, "Function must be code");
+
+    const auto &access=function_symbol.type.get(ID_access);
+    if(access==ID_public || access==ID_protected)
+    {
+      // since the method is public, it is a public method of `classname`, it is
+      // inherited
+      return true;
+    }
+
+    // methods with the default access modifier are only
+    // accessible within the same package.
+    if(access==ID_default)
+    {
+      const std::string &class_package=
+        java_class_to_package(id2string(classname));
+      const std::string &method_package=
+        java_class_to_package(id2string(resolved_call.get_class_identifier()));
+      return method_package==class_package;
+    }
+
+    if(access==ID_private)
+    {
+      // We return false because the method found by the call_resolver above
+      // proves that `methodid` cannot be inherited (assuming that the original
+      // Java code compiles). This is because, as we walk the inheritance chain
+      // for `classname` from Object to `classname`, a method can only become
+      // "more accessible". So, if the last occurrence is private, all others
+      // before must be private as well, and none is inherited in `classname`.
+      return false;
+    }
+
+    INVARIANT(false, "Unexpected access modifier.");
+  }
+
+  return false;
+}
+
 /// create temporary variables if a write instruction can have undesired side-
 /// effects
 void java_bytecode_convert_methodt::save_stack_entries(
diff --git a/src/java_bytecode/java_bytecode_convert_method.h b/src/java_bytecode/java_bytecode_convert_method.h
index abd30112031..6aa68810e60 100644
--- a/src/java_bytecode/java_bytecode_convert_method.h
+++ b/src/java_bytecode/java_bytecode_convert_method.h
@@ -15,10 +15,10 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/symbol_table.h>
 #include <util/message.h>
 #include <util/safe_pointer.h>
-#include "character_refine_preprocess.h"
+#include "java_string_library_preprocess.h"
 
 #include "java_bytecode_parse_tree.h"
-#include "ci_lazy_methods.h"
+#include <java_bytecode/ci_lazy_methods_needed.h>
 
 class class_hierarchyt;
 
@@ -28,8 +28,8 @@ void java_bytecode_convert_method(
   symbol_tablet &symbol_table,
   message_handlert &message_handler,
   size_t max_array_length,
-  safe_pointer<ci_lazy_methodst> lazy_methods,
-  const character_refine_preprocesst &character_refine);
+  safe_pointer<ci_lazy_methods_neededt> lazy_methods,
+  java_string_library_preprocesst &string_preprocess);
 
 inline void java_bytecode_convert_method(
   const symbolt &class_symbol,
@@ -37,7 +37,7 @@ inline void java_bytecode_convert_method(
   symbol_tablet &symbol_table,
   message_handlert &message_handler,
   size_t max_array_length,
-  const character_refine_preprocesst &character_preprocess)
+  java_string_library_preprocesst &string_preprocess)
 {
   java_bytecode_convert_method(
     class_symbol,
@@ -45,8 +45,8 @@ inline void java_bytecode_convert_method(
     symbol_table,
     message_handler,
     max_array_length,
-    safe_pointer<ci_lazy_methodst>::create_null(),
-    character_preprocess);
+    safe_pointer<ci_lazy_methods_neededt>::create_null(),
+    string_preprocess);
 }
 
 void java_bytecode_convert_method_lazy(
diff --git a/src/java_bytecode/java_bytecode_convert_method_class.h b/src/java_bytecode/java_bytecode_convert_method_class.h
index 89e9883d63f..dfd71f322d6 100644
--- a/src/java_bytecode/java_bytecode_convert_method_class.h
+++ b/src/java_bytecode/java_bytecode_convert_method_class.h
@@ -20,7 +20,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <analyses/cfg_dominators.h>
 #include "java_bytecode_parse_tree.h"
 #include "java_bytecode_convert_class.h"
-#include "ci_lazy_methods.h"
+#include <java_bytecode/ci_lazy_methods_needed.h>
 
 #include <vector>
 #include <list>
@@ -35,13 +35,14 @@ class java_bytecode_convert_methodt:public messaget
     symbol_tablet &_symbol_table,
     message_handlert &_message_handler,
     size_t _max_array_length,
-    safe_pointer<ci_lazy_methodst> _lazy_methods,
-    const character_refine_preprocesst &_character_preprocess):
+    safe_pointer<ci_lazy_methods_neededt> _lazy_methods,
+    java_string_library_preprocesst &_string_preprocess):
     messaget(_message_handler),
     symbol_table(_symbol_table),
     max_array_length(_max_array_length),
     lazy_methods(_lazy_methods),
-    character_preprocess(_character_preprocess),
+    string_preprocess(_string_preprocess),
+    slots_for_parameters(0),
     method_has_this(false)
   {
   }
@@ -60,12 +61,26 @@ class java_bytecode_convert_methodt:public messaget
 protected:
   symbol_tablet &symbol_table;
   const size_t max_array_length;
-  safe_pointer<ci_lazy_methodst> lazy_methods;
+  safe_pointer<ci_lazy_methods_neededt> lazy_methods;
 
+  /// Fully qualified name of the method under translation.
+  /// Initialized by `convert`.
+  /// Example: "my.package.ClassName.myMethodName:(II)I"
   irep_idt method_id;
+
+  /// A copy of `method_id` :/
   irep_idt current_method;
+
+  /// Return type of the method under conversion.
+  /// Initialized by `convert`.
   typet method_return_type;
-  character_refine_preprocesst character_preprocess;
+
+  java_string_library_preprocesst &string_preprocess;
+
+  /// Number of local variable slots used by the JVM to pass parameters upon
+  /// invocation of the method under translation.
+  /// Initialized in `convert`.
+  unsigned slots_for_parameters;
 
 public:
   struct holet
@@ -77,6 +92,7 @@ class java_bytecode_convert_methodt:public messaget
   struct local_variable_with_holest
   {
     local_variablet var;
+    bool is_parameter;
     std::vector<holet> holes;
   };
 
@@ -94,11 +110,13 @@ class java_bytecode_convert_methodt:public messaget
     variablet() : symbol_expr(), start_pc(0), length(0), is_parameter(false) {}
   };
 
- protected:
+protected:
   typedef std::vector<variablet> variablest;
   expanding_vectort<variablest> variables;
   std::set<symbol_exprt> used_local_names;
   bool method_has_this;
+  std::map<irep_idt, bool> class_has_clinit_method;
+  std::map<irep_idt, bool> any_superclass_has_clinit_method;
 
   enum instruction_sizet
   {
@@ -106,11 +124,6 @@ class java_bytecode_convert_methodt:public messaget
     INST_INDEX_CONST=3
   };
 
-  codet get_array_bounds_check(
-    const exprt &arraystruct,
-    const exprt &idx,
-    const source_locationt &original_sloc);
-
   // return corresponding reference of variable
   const variablet &find_variable_for_slot(
     size_t address,
@@ -146,8 +159,18 @@ class java_bytecode_convert_methodt:public messaget
   void pop_residue(std::size_t n);
   void push(const exprt::operandst &o);
 
+  /// Determines whether the `method` is a constructor or a static initializer,
+  /// by checking whether its name equals either <init> or <clinit>
   bool is_constructor(const class_typet::methodt &method);
 
+  /// Returns true iff the slot index of the local variable of a method (coming
+  /// from the LVT) is a parameter of that method. Assumes that
+  /// `slots_for_parameters` is initialized upon call.
+  bool is_parameter(const local_variablet &v)
+  {
+    return v.index<slots_for_parameters;
+  }
+
   struct converted_instructiont
   {
     converted_instructiont(
@@ -170,12 +193,12 @@ class java_bytecode_convert_methodt:public messaget
     java_cfg_dominatorst;
 
 protected:
-  void find_initialisers(
+  void find_initializers(
     local_variable_table_with_holest &vars,
     const address_mapt &amap,
     const java_cfg_dominatorst &doms);
 
-  void find_initialisers_for_slot(
+  void find_initializers_for_slot(
     local_variable_table_with_holest::iterator firstvar,
     local_variable_table_with_holest::iterator varlimit,
     const address_mapt &amap,
@@ -219,10 +242,23 @@ class java_bytecode_convert_methodt:public messaget
 
   codet convert_instructions(
     const methodt &,
-    const code_typet &);
+    const code_typet &,
+    const irep_idt &);
 
   const bytecode_infot &get_bytecode_info(const irep_idt &statement);
 
+  void check_static_field_stub(
+    const symbol_exprt &se,
+    const irep_idt &basename);
+
+  bool class_needs_clinit(const irep_idt &classname);
+  exprt get_or_create_clinit_wrapper(const irep_idt &classname);
+  codet get_clinit_call(const irep_idt &classname);
+
+  bool is_method_inherited(
+    const irep_idt &classname,
+    const irep_idt &methodid) const;
+
   enum class bytecode_write_typet { VARIABLE, ARRAY_REF, STATIC_FIELD, FIELD};
   void save_stack_entries(
     const std::string &,
diff --git a/src/java_bytecode/java_bytecode_instrument.cpp b/src/java_bytecode/java_bytecode_instrument.cpp
new file mode 100644
index 00000000000..ea00b1ac58a
--- /dev/null
+++ b/src/java_bytecode/java_bytecode_instrument.cpp
@@ -0,0 +1,621 @@
+/*******************************************************************\
+
+Module: Instrument codet with assertions/runtime exceptions
+
+Author: Cristina David
+
+Date:   June 2017
+
+\*******************************************************************/
+
+#include <util/arith_tools.h>
+#include <util/fresh_symbol.h>
+#include <util/std_code.h>
+#include <util/std_expr.h>
+#include <util/symbol_table.h>
+#include <util/c_types.h>
+
+#include <goto-programs/goto_functions.h>
+
+#include "java_bytecode_convert_class.h"
+#include "java_bytecode_instrument.h"
+#include "java_entry_point.h"
+#include "java_root_class.h"
+#include "java_types.h"
+#include "java_utils.h"
+
+class java_bytecode_instrumentt:public messaget
+{
+public:
+  java_bytecode_instrumentt(
+    symbol_tablet &_symbol_table,
+    const bool _throw_runtime_exceptions,
+    message_handlert &_message_handler):
+    messaget(_message_handler),
+    symbol_table(_symbol_table),
+    throw_runtime_exceptions(_throw_runtime_exceptions),
+    message_handler(_message_handler)
+    {
+    }
+
+  void operator()(exprt &expr);
+
+protected:
+  symbol_tablet &symbol_table;
+  const bool throw_runtime_exceptions;
+  message_handlert &message_handler;
+
+  codet throw_exception(
+    const exprt &cond,
+    const source_locationt &original_loc,
+    const irep_idt &exc_name);
+
+  codet check_array_access(
+    const exprt &array_struct,
+    const exprt &idx,
+    const source_locationt &original_loc);
+
+  codet check_arithmetic_exception(
+    const exprt &denominator,
+    const source_locationt &original_loc);
+
+  codet check_null_dereference(
+    const exprt &expr,
+    const source_locationt &original_loc);
+
+  codet check_class_cast(
+    const exprt &class1,
+    const exprt &class2,
+    const source_locationt &original_loc);
+
+  codet check_array_length(
+    const exprt &length,
+    const source_locationt &original_loc);
+
+  void instrument_code(exprt &expr);
+  void add_expr_instrumentation(code_blockt &block, const exprt &expr);
+  void prepend_instrumentation(codet &code, code_blockt &instrumentation);
+  codet instrument_expr(const exprt &expr);
+};
+
+
+/// Creates a class stub for exc_name and generates a
+///  conditional GOTO such that exc_name is thrown when
+///  cond is met.
+/// \par parameters: `cond`: condition to be met in order
+/// to throw an exception
+/// `original_loc`: source location in the original program
+/// `exc_name`: the name of the exception to be thrown
+/// \return Returns the code initialising the throwing the
+/// exception
+codet java_bytecode_instrumentt::throw_exception(
+  const exprt &cond,
+  const source_locationt &original_loc,
+  const irep_idt &exc_name)
+{
+  irep_idt exc_class_name("java::"+id2string(exc_name));
+
+  if(!symbol_table.has_symbol(exc_class_name))
+  {
+    generate_class_stub(
+      exc_name,
+      symbol_table,
+      get_message_handler());
+  }
+
+  pointer_typet exc_ptr_type;
+  exc_ptr_type.subtype()=symbol_typet(exc_class_name);
+
+  // Allocate and throw an instance of the exception class:
+
+  symbolt &new_symbol=
+    get_fresh_aux_symbol(
+      exc_ptr_type,
+      "new_exception",
+      "new_exception",
+      original_loc,
+      ID_java,
+      symbol_table);
+
+  side_effect_exprt new_instance(ID_java_new, exc_ptr_type);
+  code_assignt assign_new(new_symbol.symbol_expr(), new_instance);
+
+  side_effect_expr_throwt throw_expr;
+  throw_expr.copy_to_operands(new_symbol.symbol_expr());
+
+  code_blockt throw_code;
+  throw_code.move_to_operands(assign_new);
+  throw_code.copy_to_operands(code_expressiont(throw_expr));
+
+  code_ifthenelset if_code;
+  if_code.add_source_location()=original_loc;
+  if_code.cond()=cond;
+  if_code.then_case()=throw_code;
+
+  return if_code;
+}
+
+
+/// Checks whether there is a division by zero
+/// and throws ArithmeticException if necessary.
+/// Exceptions are thrown when the `throw_runtime_exceptions`
+/// flag is set.
+/// \return Based on the value of the flag `throw_runtime_exceptions`,
+/// it returns code that either throws an ArithmeticException
+/// or is a skip
+codet java_bytecode_instrumentt::check_arithmetic_exception(
+  const exprt &denominator,
+  const source_locationt &original_loc)
+{
+  const constant_exprt &zero=from_integer(0, denominator.type());
+  const binary_relation_exprt equal_zero(denominator, ID_equal, zero);
+
+  if(throw_runtime_exceptions)
+    return throw_exception(
+      equal_zero,
+      original_loc,
+      "java.lang.ArithmeticException");
+
+  return code_skipt();
+}
+
+/// Checks whether the array access array_struct[idx] is out-of-bounds,
+/// and throws ArrayIndexOutofBoundsException/generates an assertion
+/// if necessary; Exceptions are thrown when the `throw_runtime_exceptions`
+/// flag is set. Otherwise, assertions are emitted.
+/// \par parameters: `array_struct`: the array being accessed
+/// `idx`: index into the array
+/// `original_loc: source location in the original code
+/// \return Based on the value of the flag `throw_runtime_exceptions`,
+/// it returns code that either throws an ArrayIndexOutPfBoundsException
+/// or emits an assertion checking the array access
+codet java_bytecode_instrumentt::check_array_access(
+  const exprt &array_struct,
+  const exprt &idx,
+  const source_locationt &original_loc)
+{
+  const constant_exprt &zero=from_integer(0, java_int_type());
+  const binary_relation_exprt ge_zero(idx, ID_ge, zero);
+  const member_exprt length_field(array_struct, "length", java_int_type());
+  const binary_relation_exprt lt_length(idx, ID_lt, length_field);
+  const and_exprt cond(ge_zero, lt_length);
+
+  if(throw_runtime_exceptions)
+    return throw_exception(
+      not_exprt(cond),
+      original_loc,
+      "java.lang.ArrayIndexOutOfBoundsException");
+
+  code_blockt bounds_checks;
+  bounds_checks.add(code_assertt(ge_zero));
+  bounds_checks.operands().back().add_source_location()=original_loc;
+  bounds_checks.operands().back().add_source_location()
+    .set_comment("Array index should be >= 0");
+  bounds_checks.operands().back().add_source_location()
+    .set_property_class("array-index-out-of-bounds-low");
+
+  bounds_checks.add(code_assertt(lt_length));
+  bounds_checks.operands().back().add_source_location()=original_loc;
+  bounds_checks.operands().back().add_source_location()
+    .set_comment("Array index should be < length");
+  bounds_checks.operands().back().add_source_location()
+    .set_property_class("array-index-out-of-bounds-high");
+
+  return bounds_checks;
+}
+
+/// Checks whether `class1` is an instance of `class2` and throws
+/// ClassCastException/generates an assertion when necessary;
+/// Exceptions are thrown when the `throw_runtime_exceptions` flag is set.
+/// Otherwise, assertions are emitted.
+/// \par parameters: `class1`: the subclass
+/// `class2`: the super class
+/// `original_loc: source location in the original code
+/// \return Based on the value of the flag `throw_runtime_exceptions`,
+/// it returns code that either throws an ClassCastException or emits an
+/// assertion checking the subtype relation
+codet java_bytecode_instrumentt::check_class_cast(
+  const exprt &class1,
+  const exprt &class2,
+  const source_locationt &original_loc)
+{
+  binary_predicate_exprt class_cast_check(
+    class1, ID_java_instanceof, class2);
+
+  pointer_typet voidptr=pointer_type(empty_typet());
+  exprt null_check_op=class1;
+  if(null_check_op.type()!=voidptr)
+    null_check_op.make_typecast(voidptr);
+
+  codet check_code;
+  if(throw_runtime_exceptions)
+  {
+    check_code=
+      throw_exception(
+        not_exprt(class_cast_check),
+        original_loc,
+        "java.lang.ClassCastException");
+  }
+  else
+  {
+    code_assertt assert_class(class_cast_check);
+    assert_class.add_source_location().
+      set_comment("Dynamic cast check");
+    assert_class.add_source_location().
+      set_property_class("bad-dynamic-cast");
+    check_code=std::move(assert_class);
+  }
+
+  code_ifthenelset conditional_check;
+  notequal_exprt op_not_null(null_check_op, null_pointer_exprt(voidptr));
+  conditional_check.cond()=std::move(op_not_null);
+  conditional_check.then_case()=std::move(check_code);
+  return conditional_check;
+}
+
+/// Checks whether `expr` is null and throws NullPointerException/
+/// generates an assertion when necessary;
+/// Exceptions are thrown when the `throw_runtime_exceptions` flag is set.
+/// Otherwise, assertions are emitted.
+/// \par parameters: `expr`: the checked expression
+/// `original_loc: source location in the original code
+/// \return Based on the value of the flag `throw_runtime_exceptions`,
+/// it returns code that either throws an NullPointerException or emits an
+/// assertion checking the subtype relation
+codet java_bytecode_instrumentt::check_null_dereference(
+  const exprt &expr,
+  const source_locationt &original_loc)
+{
+  const equal_exprt equal_expr(
+    expr,
+    null_pointer_exprt(to_pointer_type(expr.type())));
+
+  if(throw_runtime_exceptions)
+    return throw_exception(
+      equal_expr,
+      original_loc, "java.lang.NullPointerException");
+
+  code_assertt check((not_exprt(equal_expr)));
+  check.add_source_location()
+    .set_comment("Throw null");
+  check.add_source_location()
+    .set_property_class("null-pointer-exception");
+  return check;
+}
+
+/// Checks whether `length`>=0 and throws NegativeArraySizeException/
+/// generates an assertion when necessary;
+/// Exceptions are thrown when the `throw_runtime_exceptions` flag is set.
+/// Otherwise, assertions are emitted.
+/// \par parameters: `length`: the checked length
+/// `original_loc: source location in the original code
+/// \return Based on the value of the flag `throw_runtime_exceptions`,
+/// it returns code that either throws an NegativeArraySizeException
+/// or emits an assertion checking the subtype relation
+codet java_bytecode_instrumentt::check_array_length(
+  const exprt &length,
+  const source_locationt &original_loc)
+{
+  const constant_exprt &zero=from_integer(0, java_int_type());
+  const binary_relation_exprt ge_zero(length, ID_ge, zero);
+
+  if(throw_runtime_exceptions)
+    return throw_exception(
+      not_exprt(ge_zero),
+      original_loc,
+      "java.lang.NegativeArraySizeException");
+
+  code_assertt check(ge_zero);
+  check.add_source_location().set_comment("Array size should be >= 0");
+  check.add_source_location()
+    .set_property_class("array-create-negative-size");
+  return check;
+}
+
+/// Checks whether `expr` requires instrumentation, and if so adds it
+/// to `block`.
+/// \param [out] block: block where instrumentation will be added
+/// \param expr: expression to instrument
+void java_bytecode_instrumentt::add_expr_instrumentation(
+  code_blockt &block,
+  const exprt &expr)
+{
+  codet expr_instrumentation=instrument_expr(expr);
+  if(expr_instrumentation!=code_skipt())
+  {
+    if(expr_instrumentation.get_statement()==ID_block)
+      block.append(to_code_block(expr_instrumentation));
+    else
+      block.move_to_operands(expr_instrumentation);
+  }
+}
+
+/// Appends `code` to `instrumentation` and overwrites reference `code`
+/// with the augmented block if `instrumentation` is non-empty.
+/// \param [in, out] code: code being instrumented
+/// \param instrumentation: instrumentation code block to prepend
+void java_bytecode_instrumentt::prepend_instrumentation(
+  codet &code,
+  code_blockt &instrumentation)
+{
+  if(instrumentation!=code_blockt())
+  {
+    if(code.get_statement()==ID_block)
+      instrumentation.append(to_code_block(code));
+    else
+      instrumentation.copy_to_operands(code);
+    code=instrumentation;
+  }
+}
+
+/// Augments `expr` with instrumentation in the form of either
+/// assertions or runtime exceptions
+/// \par parameters: `expr`: the expression to be instrumented
+void java_bytecode_instrumentt::instrument_code(exprt &expr)
+{
+  codet &code=to_code(expr);
+  source_locationt old_source_location=code.source_location();
+
+  const irep_idt &statement=code.get_statement();
+
+  if(statement==ID_assign)
+  {
+    code_assignt code_assign=to_code_assign(code);
+
+    code_blockt block;
+    add_expr_instrumentation(block, code_assign.lhs());
+    add_expr_instrumentation(block, code_assign.rhs());
+    prepend_instrumentation(code, block);
+  }
+  else if(statement==ID_expression)
+  {
+    code_expressiont code_expression=
+      to_code_expression(code);
+
+    code_blockt block;
+    add_expr_instrumentation(block, code_expression.expression());
+    prepend_instrumentation(code, block);
+  }
+  else if(statement==ID_assert)
+  {
+    const code_assertt &code_assert=to_code_assert(code);
+
+    // does this correspond to checkcast?
+    if(code_assert.assertion().id()==ID_java_instanceof)
+    {
+      code_blockt block;
+
+      INVARIANT(
+        code_assert.assertion().operands().size()==2,
+        "Instanceof should have 2 operands");
+
+      code=
+        check_class_cast(
+          code_assert.assertion().op0(),
+          code_assert.assertion().op1(),
+          code_assert.source_location());
+    }
+  }
+  else if(statement==ID_block)
+  {
+    Forall_operands(it, code)
+      instrument_code(to_code(*it));
+  }
+  else if(statement==ID_label)
+  {
+    code_labelt &code_label=to_code_label(code);
+    instrument_code(code_label.code());
+  }
+  else if(statement==ID_ifthenelse)
+  {
+    code_blockt block;
+    code_ifthenelset &code_ifthenelse=to_code_ifthenelse(code);
+    add_expr_instrumentation(block, code_ifthenelse.cond());
+    instrument_code(code_ifthenelse.then_case());
+    if(code_ifthenelse.else_case().is_not_nil())
+      instrument_code(code_ifthenelse.else_case());
+    prepend_instrumentation(code, block);
+  }
+  else if(statement==ID_switch)
+  {
+    code_blockt block;
+    code_switcht &code_switch=to_code_switch(code);
+    add_expr_instrumentation(block, code_switch.value());
+    add_expr_instrumentation(block, code_switch.body());
+    prepend_instrumentation(code, block);
+  }
+  else if(statement==ID_return)
+  {
+    if(code.operands().size()==1)
+    {
+      code_blockt block;
+      add_expr_instrumentation(block, code.op0());
+      prepend_instrumentation(code, block);
+    }
+  }
+  else if(statement==ID_function_call)
+  {
+    code_blockt block;
+    code_function_callt &code_function_call=to_code_function_call(code);
+    add_expr_instrumentation(block, code_function_call.lhs());
+    add_expr_instrumentation(block, code_function_call.function());
+
+    const code_typet &function_type=
+      to_code_type(code_function_call.function().type());
+
+    // Check for a null this-argument of a virtual call:
+    if(function_type.has_this())
+    {
+      block.copy_to_operands(
+        check_null_dereference(
+          code_function_call.arguments()[0],
+          code_function_call.source_location()));
+    }
+
+    for(const auto &arg : code_function_call.arguments())
+      add_expr_instrumentation(block, arg);
+
+    prepend_instrumentation(code, block);
+  }
+
+  // Ensure source location is retained:
+  if(!old_source_location.get_line().empty())
+    merge_source_location_rec(code, old_source_location);
+}
+
+/// Computes the instrumentation for `expr` in the form of
+/// either assertions or runtime exceptions.
+/// \par parameters: `expr`: the expression for which we compute
+/// instrumentation
+/// \return: The instrumentation required for `expr`
+codet java_bytecode_instrumentt::instrument_expr(
+  const exprt &expr)
+{
+  code_blockt result;
+  // First check our operands:
+  forall_operands(it, expr)
+  {
+    codet op_result=instrument_expr(*it);
+    if(op_result!=code_skipt())
+      result.move_to_operands(op_result);
+  }
+
+  // Add any check due at this node:
+  if(expr.id()==ID_plus &&
+     expr.get_bool(ID_java_array_access))
+  {
+    // this corresponds to ?aload and ?astore so
+    // we check that 0<=index<array.length
+    const plus_exprt &plus_expr=to_plus_expr(expr);
+    if(plus_expr.op0().id()==ID_member)
+    {
+      const member_exprt &member_expr=to_member_expr(plus_expr.op0());
+      if(member_expr.op0().id()==ID_dereference)
+      {
+        const dereference_exprt &dereference_expr=
+          to_dereference_expr(member_expr.op0());
+        codet bounds_check=
+          check_array_access(
+            dereference_expr,
+            plus_expr.op1(),
+            expr.source_location());
+        result.move_to_operands(bounds_check);
+      }
+    }
+  }
+  else if(expr.id()==ID_side_effect)
+  {
+    const side_effect_exprt &side_effect_expr=to_side_effect_expr(expr);
+    const irep_idt &statement=side_effect_expr.get_statement();
+    if(statement==ID_throw)
+    {
+      // this corresponds to athrow and so we check that
+      // we don't throw null
+      result.copy_to_operands(
+        check_null_dereference(
+          expr.op0(),
+          expr.source_location()));
+    }
+    else if(statement==ID_java_new_array)
+    {
+      // this correpond to new array so we check that
+      // length is >=0
+      result.copy_to_operands(
+        check_array_length(
+          expr.op0(),
+          expr.source_location()));
+    }
+  }
+  else if((expr.id()==ID_div || expr.id()==ID_mod) &&
+          expr.type().id()==ID_signedbv)
+  {
+    // check division by zero (for integer types only)
+    result.copy_to_operands(
+      check_arithmetic_exception(
+        expr.op1(),
+        expr.source_location()));
+  }
+  else if(expr.id()==ID_dereference &&
+          expr.get_bool(ID_java_member_access))
+  {
+    // Check pointer non-null before access:
+    const dereference_exprt dereference_expr=to_dereference_expr(expr);
+    codet null_dereference_check=
+      check_null_dereference(
+        dereference_expr.op0(),
+        dereference_expr.source_location());
+    result.move_to_operands(null_dereference_check);
+  }
+
+  if(result==code_blockt())
+    return code_skipt();
+  else
+    return result;
+}
+
+/// Instruments `expr`
+/// \par parameters: `expr`: the expression to be instrumented
+void java_bytecode_instrumentt::operator()(exprt &expr)
+{
+  instrument_code(expr);
+}
+
+/// Instruments the code attached to `symbol` with
+/// runtime exceptions or corresponding assertions.
+/// Exceptions are thrown when the `throw_runtime_exceptions` flag is set.
+/// Otherwise, assertions are emitted.
+/// \param symbol_table: global symbol table (may gain exception type stubs and
+///   similar)
+/// \param symbol: the symbol to instrument
+/// \param throw_runtime_exceptions: flag determining whether we instrument the
+///   code with runtime exceptions or with assertions. The former applies if
+///   this flag is set to true.
+/// \param message_handler: stream to report status and warnings
+void java_bytecode_instrument_symbol(
+  symbol_tablet &symbol_table,
+  symbolt &symbol,
+  const bool throw_runtime_exceptions,
+  message_handlert &message_handler)
+{
+  java_bytecode_instrumentt instrument(
+    symbol_table,
+    throw_runtime_exceptions,
+    message_handler);
+  INVARIANT(
+    symbol.value.id()==ID_code,
+    "java_bytecode_instrument expects a code-typed symbol");
+  instrument(symbol.value);
+}
+
+/// Instruments all the code in the symbol_table with
+/// runtime exceptions or corresponding assertions.
+/// Exceptions are thrown when the `throw_runtime_exceptions` flag is set.
+/// Otherwise, assertions are emitted.
+/// \param symbol_table: global symbol table, all of whose code members
+///   will be annotated (may gain exception type stubs and similar)
+/// \param throw_runtime_exceptions: flag determining whether we instrument the
+///   code with runtime exceptions or with assertions. The former applies if
+///   this flag is set to true.
+/// \param message_handler: stream to report status and warnings
+void java_bytecode_instrument(
+  symbol_tablet &symbol_table,
+  const bool throw_runtime_exceptions,
+  message_handlert &message_handler)
+{
+  java_bytecode_instrumentt instrument(
+    symbol_table,
+    throw_runtime_exceptions,
+    message_handler);
+
+  std::vector<irep_idt> symbols_to_instrument;
+  forall_symbols(s_it, symbol_table.symbols)
+  {
+    if(s_it->second.value.id()==ID_code)
+      symbols_to_instrument.push_back(s_it->first);
+  }
+
+  // instrument(...) can add symbols to the table, so it's
+  // not safe to hold a reference to a symbol across a call.
+  for(const auto &symbol : symbols_to_instrument)
+    instrument(symbol_table.lookup(symbol).value);
+}
diff --git a/src/java_bytecode/java_bytecode_instrument.h b/src/java_bytecode/java_bytecode_instrument.h
new file mode 100644
index 00000000000..d5168a418ea
--- /dev/null
+++ b/src/java_bytecode/java_bytecode_instrument.h
@@ -0,0 +1,25 @@
+/*******************************************************************\
+
+Module: Instrument codet with assertions/runtime exceptions
+
+Author: Cristina David
+
+Date:   June 2017
+
+\*******************************************************************/
+
+#ifndef CPROVER_JAVA_BYTECODE_JAVA_BYTECODE_INSTRUMENT_H
+#define CPROVER_JAVA_BYTECODE_JAVA_BYTECODE_INSTRUMENT_H
+
+void java_bytecode_instrument_symbol(
+  symbol_tablet &symbol_table,
+  symbolt &symbol,
+  const bool throw_runtime_exceptions,
+  message_handlert &_message_handler);
+
+void java_bytecode_instrument(
+  symbol_tablet &symbol_table,
+  const bool throw_runtime_exceptions,
+  message_handlert &_message_handler);
+
+#endif
diff --git a/src/java_bytecode/java_bytecode_language.cpp b/src/java_bytecode/java_bytecode_language.cpp
index 3103e6f463f..d5d1c890fc9 100644
--- a/src/java_bytecode/java_bytecode_language.cpp
+++ b/src/java_bytecode/java_bytecode_language.cpp
@@ -15,6 +15,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/config.h>
 #include <util/cmdline.h>
 #include <util/string2int.h>
+#include <util/invariant.h>
 #include <json/json_parser.h>
 
 #include <goto-programs/class_hierarchy.h>
@@ -22,10 +23,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "java_bytecode_convert_class.h"
 #include "java_bytecode_convert_method.h"
 #include "java_bytecode_internal_additions.h"
+#include "java_bytecode_instrument.h"
 #include "java_bytecode_typecheck.h"
 #include "java_entry_point.h"
 #include "java_bytecode_parser.h"
 #include "java_class_loader.h"
+#include "java_utils.h"
+#include <java_bytecode/ci_lazy_methods.h>
 
 #include "expr2java.h"
 
@@ -35,10 +39,14 @@ Author: Daniel Kroening, kroening@kroening.com
 void java_bytecode_languaget::get_language_options(const cmdlinet &cmd)
 {
   assume_inputs_non_null=cmd.isset("java-assume-inputs-non-null");
-  string_refinement_enabled=cmd.isset("string-refine");
+  string_refinement_enabled=cmd.isset("refine-strings");
+  throw_runtime_exceptions=cmd.isset("java-throw-runtime-exceptions");
   if(cmd.isset("java-max-input-array-length"))
     max_nondet_array_length=
       std::stoi(cmd.get_value("java-max-input-array-length"));
+  if(cmd.isset("java-max-input-tree-depth"))
+    max_nondet_tree_depth=
+      std::stoi(cmd.get_value("java-max-input-tree-depth"));
   if(cmd.isset("java-max-vla-length"))
     max_user_array_length=std::stoi(cmd.get_value("java-max-vla-length"));
   if(cmd.isset("lazy-methods-context-sensitive"))
@@ -48,6 +56,13 @@ void java_bytecode_languaget::get_language_options(const cmdlinet &cmd)
   else
     lazy_methods_mode=LAZY_METHODS_MODE_EAGER;
 
+  const std::list<std::string> &extra_entry_points=
+    cmd.get_values("lazy-methods-extra-entry-point");
+  lazy_methods_extra_entry_points.insert(
+    lazy_methods_extra_entry_points.end(),
+    extra_entry_points.begin(),
+    extra_entry_points.end());
+
   if(cmd.isset("java-cp-include-files"))
   {
     java_cp_include_files=cmd.get_value("java-cp-include-files");
@@ -77,6 +92,8 @@ void java_bytecode_languaget::get_language_options(const cmdlinet &cmd)
   }
   else
     java_cp_include_files=".*";
+
+  language_options_initialized=true;
 }
 
 std::set<std::string> java_bytecode_languaget::extensions() const
@@ -103,6 +120,7 @@ bool java_bytecode_languaget::parse(
   std::istream &instream,
   const std::string &path)
 {
+  PRECONDITION(language_options_initialized);
   java_class_loader.set_message_handler(get_message_handler());
   java_class_loader.set_java_cp_include_files(java_cp_include_files);
 
@@ -114,23 +132,24 @@ bool java_bytecode_languaget::parse(
   }
   else if(has_suffix(path, ".jar"))
   {
+    // build an object to potentially limit which classes are loaded
     java_class_loader_limitt class_loader_limit(
       get_message_handler(),
       java_cp_include_files);
     if(config.java.main_class.empty())
     {
-      // Does it have a main class set in the manifest?
-      jar_filet::manifestt manifest=
+      auto manifest=
         java_class_loader.jar_pool(class_loader_limit, path).get_manifest();
       std::string manifest_main_class=manifest["Main-Class"];
 
+      // if the manifest declares a Main-Class line, we got a main class
       if(manifest_main_class!="")
         main_class=manifest_main_class;
     }
     else
       main_class=config.java.main_class;
 
-    // Do we have one now?
+    // do we have one now?
     if(main_class.empty())
     {
       status() << "JAR file without entry point: loading class files" << eom;
@@ -142,7 +161,7 @@ bool java_bytecode_languaget::parse(
       java_class_loader.add_jar_file(path);
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   if(!main_class.empty())
   {
@@ -153,246 +172,15 @@ bool java_bytecode_languaget::parse(
   return false;
 }
 
-/// Find a virtual callee, if one is defined and the callee type is known to
-/// exist.
-/// \par parameters: `needed_classes`: set of classes that can be instantiated.
-///   Any potential callee not in this set will be ignored.
-/// `call_basename`: unqualified function name with type signature (e.g.
-///   "f:(I)")
-/// `classname`: class name that may define or override a function named
-///   `call_basename`.
-/// `symbol_table`: global symtab
-/// \return Returns the fully qualified name of `classname`'s definition of
-///   `call_basename` if found and `classname` is present in `needed_classes`,
-///   or irep_idt() otherwise.
-static irep_idt get_virtual_method_target(
-  const std::set<irep_idt> &needed_classes,
-  const irep_idt &call_basename,
-  const irep_idt &classname,
-  const symbol_tablet &symbol_table)
-{
-  // Program-wide, is this class ever instantiated?
-  if(!needed_classes.count(classname))
-    return irep_idt();
-  auto methodid=id2string(classname)+"."+id2string(call_basename);
-  if(symbol_table.has_symbol(methodid))
-    return methodid;
-  else
-    return irep_idt();
-}
-
-/// Find possible callees, excluding types that are not known to be
-/// instantiated.
-/// \par parameters: `c`: function call whose potential target functions should
-///   be determined.
-/// `needed_classes`: set of classes that can be instantiated. Any potential
-///   callee not in this set will be ignored.
-/// `symbol_table`: global symtab
-/// `class_hierarchy`: global class hierarchy
-/// \return Populates `needed_methods` with all possible `c` callees, taking
-///   `needed_classes` into account (virtual function overrides defined on
-///   classes that are not 'needed' are ignored)
-static void get_virtual_method_targets(
-  const code_function_callt &c,
-  const std::set<irep_idt> &needed_classes,
-  std::vector<irep_idt> &needed_methods,
-  symbol_tablet &symbol_table,
-  const class_hierarchyt &class_hierarchy)
-{
-  const auto &called_function=c.function();
-  assert(called_function.id()==ID_virtual_function);
-
-  const auto &call_class=called_function.get(ID_C_class);
-  assert(!call_class.empty());
-  const auto &call_basename=called_function.get(ID_component_name);
-  assert(!call_basename.empty());
-
-  auto old_size=needed_methods.size();
-
-  auto child_classes=class_hierarchy.get_children_trans(call_class);
-  for(const auto &child_class : child_classes)
-  {
-    auto child_method=
-      get_virtual_method_target(
-        needed_classes,
-        call_basename,
-        child_class,
-        symbol_table);
-    if(!child_method.empty())
-      needed_methods.push_back(child_method);
-  }
-
-  irep_idt parent_class_id=call_class;
-  while(1)
-  {
-    auto parent_method=
-      get_virtual_method_target(
-        needed_classes,
-        call_basename,
-        parent_class_id,
-        symbol_table);
-    if(!parent_method.empty())
-    {
-      needed_methods.push_back(parent_method);
-      break;
-    }
-    else
-    {
-      auto findit=class_hierarchy.class_map.find(parent_class_id);
-      if(findit==class_hierarchy.class_map.end())
-        break;
-      else
-      {
-        const auto &entry=findit->second;
-        if(entry.parents.empty())
-          break;
-        else
-          parent_class_id=entry.parents[0];
-      }
-    }
-  }
-
-  if(needed_methods.size()==old_size)
-  {
-    // Didn't find any candidate callee. Generate a stub.
-    std::string stubname=id2string(call_class)+"."+id2string(call_basename);
-    symbolt symbol;
-    symbol.name=stubname;
-    symbol.base_name=call_basename;
-    symbol.type=c.function().type();
-    symbol.value.make_nil();
-    symbol.mode=ID_java;
-    symbol_table.add(symbol);
-  }
-}
-
-/// See output
-/// \par parameters: `e`: expression tree to search
-/// \return Populates `result` with pointers to each function call within e that
-///   calls a virtual function.
-static void gather_virtual_callsites(
-  const exprt &e,
-  std::vector<const code_function_callt *> &result)
-{
-  if(e.id()!=ID_code)
-    return;
-  const codet &c=to_code(e);
-  if(c.get_statement()==ID_function_call &&
-     to_code_function_call(c).function().id()==ID_virtual_function)
-    result.push_back(&to_code_function_call(c));
-  else
-    forall_operands(it, e)
-      gather_virtual_callsites(*it, result);
-}
-
-/// See output
-/// \par parameters: `e`: expression tree to search
-/// `symbol_table`: global symtab
-/// \return Populates `needed` with global variable symbols referenced from `e`
-///   or its children.
-static void gather_needed_globals(
-  const exprt &e,
-  const symbol_tablet &symbol_table,
-  symbol_tablet &needed)
-{
-  if(e.id()==ID_symbol)
-  {
-    // If the symbol isn't in the symbol table at all, then it is defined
-    // on an opaque type (i.e. we don't have the class definition at this point)
-    // and will be created during the typecheck phase.
-    // We don't mark it as 'needed' as it doesn't exist yet to keep.
-    auto findit=symbol_table.symbols.find(to_symbol_expr(e).get_identifier());
-    if(findit!=symbol_table.symbols.end() &&
-       findit->second.is_static_lifetime)
-    {
-      needed.add(findit->second);
-    }
-  }
-  else
-    forall_operands(opit, e)
-      gather_needed_globals(*opit, symbol_table, needed);
-}
-
-/// See output
-/// \par parameters: `class_type`: root of class tree to search
-/// `ns`: global namespace
-/// \return Populates `lazy_methods` with all Java reference types reachable
-///   starting at `class_type`. For example if `class_type` is
-///   `symbol_typet("java::A")` and A has a B field, then `B` (but not `A`) will
-///   noted as a needed class.
-static void gather_field_types(
-  const typet &class_type,
-  const namespacet &ns,
-  ci_lazy_methodst &lazy_methods)
-{
-  const auto &underlying_type=to_struct_type(ns.follow(class_type));
-  for(const auto &field : underlying_type.components())
-  {
-    if(field.type().id()==ID_struct || field.type().id()==ID_symbol)
-      gather_field_types(field.type(), ns, lazy_methods);
-    else if(field.type().id()==ID_pointer)
-    {
-      // Skip array primitive pointers, for example:
-      if(field.type().subtype().id()!=ID_symbol)
-        continue;
-      const auto &field_classid=
-        to_symbol_type(field.type().subtype()).get_identifier();
-      if(lazy_methods.add_needed_class(field_classid))
-        gather_field_types(field.type().subtype(), ns, lazy_methods);
-    }
-  }
-}
-
-/// See output
-/// \par parameters: `entry_points`: list of fully-qualified function names that
-///   we should assume are reachable
-/// `ns`: global namespace
-/// `ch`: global class hierarchy
-/// \return Populates `lazy_methods` with all Java reference types whose
-///   references may be passed, directly or indirectly, to any of the functions
-///   in `entry_points`.
-static void initialize_needed_classes(
-  const std::vector<irep_idt> &entry_points,
-  const namespacet &ns,
-  const class_hierarchyt &ch,
-  ci_lazy_methodst &lazy_methods)
-{
-  for(const auto &mname : entry_points)
-  {
-    const auto &symbol=ns.lookup(mname);
-    const auto &mtype=to_code_type(symbol.type);
-    for(const auto &param : mtype.parameters())
-    {
-      if(param.type().id()==ID_pointer)
-      {
-        const auto &param_classid=
-          to_symbol_type(param.type().subtype()).get_identifier();
-        std::vector<irep_idt> class_and_parents=
-          ch.get_parents_trans(param_classid);
-        class_and_parents.push_back(param_classid);
-        for(const auto &classid : class_and_parents)
-          lazy_methods.add_needed_class(classid);
-        gather_field_types(param.type().subtype(), ns, lazy_methods);
-      }
-    }
-  }
-
-  // Also add classes whose instances are magically
-  // created by the JVM and so won't be spotted by
-  // looking for constructors and calls as usual:
-  lazy_methods.add_needed_class("java::java.lang.String");
-  lazy_methods.add_needed_class("java::java.lang.Class");
-  lazy_methods.add_needed_class("java::java.lang.Object");
-}
-
 bool java_bytecode_languaget::typecheck(
   symbol_tablet &symbol_table,
   const std::string &module)
 {
   if(string_refinement_enabled)
-    character_preprocess.initialize_conversion_table();
+    string_preprocess.initialize_conversion_table();
 
-  // first convert all
+  // first generate a new struct symbol for each class and a new function symbol
+  // for every method
   for(java_class_loadert::class_mapt::const_iterator
       c_it=java_class_loader.class_map.begin();
       c_it!=java_class_loader.class_map.end();
@@ -401,8 +189,6 @@ bool java_bytecode_languaget::typecheck(
     if(c_it->second.parsed_class.name.empty())
       continue;
 
-    debug() << "Converting class " << c_it->first << eom;
-
     if(java_bytecode_convert_class(
          c_it->second,
          symbol_table,
@@ -410,8 +196,7 @@ bool java_bytecode_languaget::typecheck(
          max_user_array_length,
          lazy_methods,
          lazy_methods_mode,
-         string_refinement_enabled,
-         character_preprocess))
+         string_preprocess))
       return true;
   }
 
@@ -423,6 +208,27 @@ bool java_bytecode_languaget::typecheck(
     if(do_ci_lazy_method_conversion(symbol_table, lazy_methods))
       return true;
   }
+  else if(lazy_methods_mode==LAZY_METHODS_MODE_EAGER)
+  {
+    // Simply elaborate all methods symbols now.
+    for(const auto &method_sig : lazy_methods)
+    {
+      java_bytecode_convert_method(
+        *method_sig.second.first,
+        *method_sig.second.second,
+        symbol_table,
+        get_message_handler(),
+        max_user_array_length,
+        string_preprocess);
+    }
+  }
+  // Otherwise our caller is in charge of elaborating methods on demand.
+
+  // now instrument runtime exceptions
+  java_bytecode_instrument(
+    symbol_table,
+    throw_runtime_exceptions,
+    get_message_handler());
 
   // now typecheck all
   if(java_bytecode_typecheck(
@@ -449,146 +255,38 @@ bool java_bytecode_languaget::do_ci_lazy_method_conversion(
   symbol_tablet &symbol_table,
   lazy_methodst &lazy_methods)
 {
-  class_hierarchyt ch;
-  ch(symbol_table);
-
-  std::vector<irep_idt> method_worklist1;
-  std::vector<irep_idt> method_worklist2;
-
-  auto main_function=
-    get_main_symbol(symbol_table, main_class, get_message_handler(), true);
-  if(main_function.stop_convert)
-  {
-    // Failed, mark all functions in the given main class(es) reachable.
-    std::vector<irep_idt> reachable_classes;
-    if(!main_class.empty())
-      reachable_classes.push_back(main_class);
-    else
-      reachable_classes=main_jar_classes;
-    for(const auto &classname : reachable_classes)
-    {
-      const auto &methods=
-        java_class_loader.class_map.at(classname).parsed_class.methods;
-      for(const auto &method : methods)
-      {
-        const irep_idt methodid="java::"+id2string(classname)+"."+
-          id2string(method.name)+":"+
-          id2string(method.signature);
-        method_worklist2.push_back(methodid);
-      }
-    }
-  }
-  else
-    method_worklist2.push_back(main_function.main_function.name);
-
-  std::set<irep_idt> needed_classes;
-
-  {
-    std::vector<irep_idt> needed_clinits;
-    ci_lazy_methodst initial_lazy_methods(
-      needed_clinits,
-      needed_classes,
-      symbol_table);
-    initialize_needed_classes(
-      method_worklist2,
-      namespacet(symbol_table),
-      ch,
-      initial_lazy_methods);
-    method_worklist2.insert(
-      method_worklist2.end(),
-      needed_clinits.begin(),
-      needed_clinits.end());
-  }
-
-  std::set<irep_idt> methods_already_populated;
-  std::vector<const code_function_callt *> virtual_callsites;
-
-  bool any_new_methods;
-  do
+  const auto method_converter=[&](
+    const symbolt &symbol,
+    const java_bytecode_parse_treet::methodt &method,
+    ci_lazy_methods_neededt new_lazy_methods)
   {
-    any_new_methods=false;
-    while(!method_worklist2.empty())
-    {
-      std::swap(method_worklist1, method_worklist2);
-      for(const auto &mname : method_worklist1)
-      {
-        if(!methods_already_populated.insert(mname).second)
-          continue;
-        auto findit=lazy_methods.find(mname);
-        if(findit==lazy_methods.end())
-        {
-          debug() << "Skip " << mname << eom;
-          continue;
-        }
-        debug() << "CI lazy methods: elaborate " << mname << eom;
-        const auto &parsed_method=findit->second;
-        // Note this wraps *references* to method_worklist2, needed_classes:
-        ci_lazy_methodst lazy_methods(
-          method_worklist2,
-          needed_classes,
-          symbol_table);
-        java_bytecode_convert_method(
-          *parsed_method.first,
-          *parsed_method.second,
-          symbol_table,
-          get_message_handler(),
-          max_user_array_length,
-          safe_pointer<ci_lazy_methodst>::create_non_null(&lazy_methods),
-          character_preprocess);
-        gather_virtual_callsites(
-          symbol_table.lookup(mname).value,
-          virtual_callsites);
-        any_new_methods=true;
-      }
-      method_worklist1.clear();
-    }
-
-    // Given the object types we now know may be created, populate more
-    // possible virtual function call targets:
-
-    debug() << "CI lazy methods: add virtual method targets ("
-            << virtual_callsites.size()
-            << " callsites)"
-            << eom;
-
-    for(const auto &callsite : virtual_callsites)
-    {
-      // This will also create a stub if a virtual callsite has no targets.
-      get_virtual_method_targets(
-        *callsite,
-        needed_classes,
-        method_worklist2,
-        symbol_table,
-        ch);
-    }
-  }
-  while(any_new_methods);
-
-  // Remove symbols for methods that were declared but never used:
-  symbol_tablet keep_symbols;
-
-  for(const auto &sym : symbol_table.symbols)
-  {
-    if(sym.second.is_static_lifetime)
-      continue;
-    if(lazy_methods.count(sym.first) &&
-       !methods_already_populated.count(sym.first))
-    {
-      continue;
-    }
-    if(sym.second.type.id()==ID_code)
-      gather_needed_globals(sym.second.value, symbol_table, keep_symbols);
-    keep_symbols.add(sym.second);
-  }
-
-  debug() << "CI lazy methods: removed "
-          << symbol_table.symbols.size() - keep_symbols.symbols.size()
-          << " unreachable methods and globals"
-          << eom;
-
-  symbol_table.swap(keep_symbols);
+    java_bytecode_convert_method(
+      symbol,
+      method,
+      symbol_table,
+      get_message_handler(),
+      max_user_array_length,
+      safe_pointer<ci_lazy_methods_neededt>::create_non_null(&new_lazy_methods),
+      string_preprocess);
+  };
+
+  ci_lazy_methodst method_gather(
+    symbol_table,
+    main_class,
+    main_jar_classes,
+    lazy_methods_extra_entry_points,
+    java_class_loader,
+    get_pointer_type_selector(),
+    get_message_handler());
+
+  return method_gather(symbol_table, lazy_methods, method_converter);
+}
 
-  return false;
+const select_pointer_typet &
+  java_bytecode_languaget::get_pointer_type_selector() const
+{
+  PRECONDITION(pointer_type_selector.get()!=nullptr);
+  return *pointer_type_selector;
 }
 
 /// Provide feedback to `language_filest` so that when asked for a lazy method,
@@ -623,18 +321,53 @@ void java_bytecode_languaget::convert_lazy_method(
     symtab,
     get_message_handler(),
     max_user_array_length,
-    character_preprocess);
+    string_preprocess);
+}
+
+/// Replace methods of the String library that are in the symbol table by code
+/// generated by string_preprocess.
+/// \param context: a symbol table
+void java_bytecode_languaget::replace_string_methods(
+  symbol_tablet &context)
+{
+  // Symbols that have code type are potentialy to be replaced
+  std::list<symbolt> code_symbols;
+  forall_symbols(symbol, context.symbols)
+  {
+    if(symbol->second.type.id()==ID_code)
+      code_symbols.push_back(symbol->second);
+  }
+
+  for(const auto &symbol : code_symbols)
+  {
+    const irep_idt &id=symbol.name;
+    exprt generated_code=string_preprocess.code_for_function(
+      id, to_code_type(symbol.type), symbol.location, context);
+    if(generated_code.is_not_nil())
+    {
+      // Replace body of the function by code generated by string preprocess
+      symbolt &symbol=context.lookup(id);
+      symbol.value=generated_code;
+      // Specifically instrument the new code, since this comes after the
+      // blanket instrumentation pass called before typechecking.
+      java_bytecode_instrument_symbol(
+        context,
+        symbol,
+        throw_runtime_exceptions,
+        get_message_handler());
+    }
+  }
 }
 
 bool java_bytecode_languaget::final(
   symbol_tablet &symbol_table,
   bool generate_start_function)
 {
-  /*
-  if(c_final(symbol_table, message_handler)) return true;
-  */
   java_internal_additions(symbol_table);
 
+  // replace code of String methods calls by code we generate
+  replace_string_methods(symbol_table);
+
   if(!generate_start_function)
     return false;
 
@@ -643,15 +376,16 @@ bool java_bytecode_languaget::final(
   if(res.stop_convert)
     return res.error_found;
 
-  symbolt entry=res.main_function;
-
-  return(
+  // generate the test harness in __CPROVER__start and a call the entry point
+  return
     java_entry_point(
       symbol_table,
       main_class,
       get_message_handler(),
       assume_inputs_non_null,
-      max_nondet_array_length));
+      max_nondet_array_length,
+      max_nondet_tree_depth,
+      get_pointer_type_selector());
 }
 
 void java_bytecode_languaget::show_parse(std::ostream &out)
@@ -659,9 +393,9 @@ void java_bytecode_languaget::show_parse(std::ostream &out)
   java_class_loader(main_class).output(out);
 }
 
-languaget *new_java_bytecode_language()
+std::unique_ptr<languaget> new_java_bytecode_language()
 {
-  return new java_bytecode_languaget;
+  return util_make_unique<java_bytecode_languaget>();
 }
 
 bool java_bytecode_languaget::from_expr(
diff --git a/src/java_bytecode/java_bytecode_language.h b/src/java_bytecode/java_bytecode_language.h
index c6242c3aac2..be0713e2d03 100644
--- a/src/java_bytecode/java_bytecode_language.h
+++ b/src/java_bytecode/java_bytecode_language.h
@@ -10,13 +10,45 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_JAVA_BYTECODE_JAVA_BYTECODE_LANGUAGE_H
 #define CPROVER_JAVA_BYTECODE_JAVA_BYTECODE_LANGUAGE_H
 
+#include <memory>
+
 #include <util/language.h>
 #include <util/cmdline.h>
+#include <util/make_unique.h>
 
 #include "java_class_loader.h"
-#include "character_refine_preprocess.h"
+#include "java_string_library_preprocess.h"
+
+#include <java_bytecode/select_pointer_type.h>
+
+#define JAVA_BYTECODE_LANGUAGE_OPTIONS /*NOLINT*/ \
+  "(java-assume-inputs-non-null)"                 \
+  "(java-throw-runtime-exceptions)"               \
+  "(java-max-input-array-length):"                \
+  "(java-max-input-tree-depth):"                  \
+  "(java-max-vla-length):"                        \
+  "(java-cp-include-files):"                      \
+  "(lazy-methods)"                                \
+  "(lazy-methods-extra-entry-point):"
+
+#define JAVA_BYTECODE_LANGUAGE_OPTIONS_HELP /*NOLINT*/                                          \
+  " --java-assume-inputs-non-null    never initialize reference-typed parameter to the\n"       \
+  "                                  entry point with null\n"                                   \
+  " --java-throw-runtime-exceptions  make implicit runtime exceptions explicit\n"               \
+  " --java-max-input-array-length N  limit input array size to <= N\n"                          \
+  " --java-max-input-tree-depth N    object references are (deterministically) set to null in\n"\
+  "                                  the object\n"                                              \
+  " --java-max-vla-length            limit the length of user-code-created arrays\n"            \
+  " --java-cp-include-files          regexp or JSON list of files to load (with '@' prefix)\n"  \
+  " --lazy-methods                   only translate methods that appear to be reachable from\n" \
+  "                                  the --function entry point or main class\n"                \
+  " --lazy-methods-extra-entry-point METHODNAME\n"                                              \
+  "                                  treat METHODNAME as a possible program entry point for\n"  \
+  "                                  the purpose of lazy method loading\n"                      \
+  "                                  A '.*' wildcard is allowed to specify all class members\n"
 
 #define MAX_NONDET_ARRAY_LENGTH_DEFAULT 5
+#define MAX_NONDET_TREE_DEPTH 5
 
 class symbolt;
 
@@ -52,20 +84,31 @@ class java_bytecode_languaget:public languaget
     symbol_tablet &context,
     const std::string &module) override;
 
-  bool final(
+  void replace_string_methods(symbol_tablet &context);
+
+  virtual bool final(
     symbol_tablet &context,
     bool generate_start_function) override;
 
   void show_parse(std::ostream &out) override;
 
   virtual ~java_bytecode_languaget();
+  java_bytecode_languaget(
+    std::unique_ptr<select_pointer_typet> pointer_type_selector):
+      assume_inputs_non_null(false),
+      max_nondet_array_length(MAX_NONDET_ARRAY_LENGTH_DEFAULT),
+      max_nondet_tree_depth(MAX_NONDET_TREE_DEPTH),
+      max_user_array_length(0),
+      lazy_methods_mode(lazy_methods_modet::LAZY_METHODS_MODE_EAGER),
+      string_refinement_enabled(false),
+      pointer_type_selector(std::move(pointer_type_selector))
+  {}
+
   java_bytecode_languaget():
-    assume_inputs_non_null(false),
-    max_nondet_array_length(MAX_NONDET_ARRAY_LENGTH_DEFAULT),
-    max_user_array_length(0),
-    lazy_methods_mode(lazy_methods_modet::LAZY_METHODS_MODE_EAGER),
-    string_refinement_enabled(false)
-    {}
+    java_bytecode_languaget(
+      std::unique_ptr<select_pointer_typet>(new select_pointer_typet()))
+  {}
+
 
   bool from_expr(
     const exprt &expr,
@@ -86,8 +129,8 @@ class java_bytecode_languaget:public languaget
     exprt &expr,
     const namespacet &ns) override;
 
-  languaget *new_language() override
-  { return new java_bytecode_languaget; }
+  std::unique_ptr<languaget> new_language() override
+  { return util_make_unique<java_bytecode_languaget>(); }
 
   std::string id() const override { return "java"; }
   std::string description() const override { return "Java Bytecode"; }
@@ -100,20 +143,27 @@ class java_bytecode_languaget:public languaget
 
 protected:
   bool do_ci_lazy_method_conversion(symbol_tablet &, lazy_methodst &);
+  const select_pointer_typet &get_pointer_type_selector() const;
 
   irep_idt main_class;
   std::vector<irep_idt> main_jar_classes;
   java_class_loadert java_class_loader;
   bool assume_inputs_non_null;      // assume inputs variables to be non-null
   size_t max_nondet_array_length;   // maximal length for non-det array creation
+  size_t max_nondet_tree_depth;     // maximal depth for object tree in non-det creation
   size_t max_user_array_length;     // max size for user code created arrays
   lazy_methodst lazy_methods;
   lazy_methods_modet lazy_methods_mode;
+  std::vector<irep_idt> lazy_methods_extra_entry_points;
   bool string_refinement_enabled;
-  character_refine_preprocesst character_preprocess;
+  bool throw_runtime_exceptions;
+  java_string_library_preprocesst string_preprocess;
   std::string java_cp_include_files;
+
+private:
+  const std::unique_ptr<const select_pointer_typet> pointer_type_selector;
 };
 
-languaget *new_java_bytecode_language();
+std::unique_ptr<languaget> new_java_bytecode_language();
 
 #endif // CPROVER_JAVA_BYTECODE_JAVA_BYTECODE_LANGUAGE_H
diff --git a/src/java_bytecode/java_bytecode_parse_tree.cpp b/src/java_bytecode/java_bytecode_parse_tree.cpp
index d7dda702683..f19de120195 100644
--- a/src/java_bytecode/java_bytecode_parse_tree.cpp
+++ b/src/java_bytecode/java_bytecode_parse_tree.cpp
@@ -25,6 +25,9 @@ void java_bytecode_parse_treet::classt::swap(
   std::swap(other.is_enum, is_enum);
   std::swap(other.enum_elements, enum_elements);
   std::swap(other.is_abstract, is_abstract);
+  std::swap(other.is_public, is_public);
+  std::swap(other.is_protected, is_protected);
+  std::swap(other.is_private, is_private);
   other.implements.swap(implements);
   other.fields.swap(fields);
   other.methods.swap(methods);
diff --git a/src/java_bytecode/java_bytecode_parse_tree.h b/src/java_bytecode/java_bytecode_parse_tree.h
index 06b2ca5632f..d982a62cd39 100644
--- a/src/java_bytecode/java_bytecode_parse_tree.h
+++ b/src/java_bytecode/java_bytecode_parse_tree.h
@@ -169,6 +169,7 @@ class java_bytecode_parse_treet
     irep_idt name, extends;
     bool is_abstract=false;
     bool is_enum=false;
+    bool is_public=false, is_protected=false, is_private=false;
     size_t enum_elements=0;
 
     typedef std::list<irep_idt> implementst;
diff --git a/src/java_bytecode/java_bytecode_parser.cpp b/src/java_bytecode/java_bytecode_parser.cpp
index cbf4ea92fb8..1b424291a5c 100644
--- a/src/java_bytecode/java_bytecode_parser.cpp
+++ b/src/java_bytecode/java_bytecode_parser.cpp
@@ -279,6 +279,9 @@ void java_bytecode_parsert::rClassFile()
 
   parsed_class.is_abstract=(access_flags&ACC_ABSTRACT)!=0;
   parsed_class.is_enum=(access_flags&ACC_ENUM)!=0;
+  parsed_class.is_public=(access_flags&ACC_PUBLIC)!=0;
+  parsed_class.is_protected=(access_flags&ACC_PROTECTED)!=0;
+  parsed_class.is_private=(access_flags&ACC_PRIVATE)!=0;
   parsed_class.name=
     constant(this_class).type().get(ID_C_base_name);
 
diff --git a/src/java_bytecode/java_bytecode_typecheck_code.cpp b/src/java_bytecode/java_bytecode_typecheck_code.cpp
index 431e39234f5..f1540a53191 100644
--- a/src/java_bytecode/java_bytecode_typecheck_code.cpp
+++ b/src/java_bytecode/java_bytecode_typecheck_code.cpp
@@ -67,4 +67,8 @@ void java_bytecode_typecheckt::typecheck_code(codet &code)
         a_it++)
       typecheck_expr(*a_it);
   }
+  else if(statement==ID_assert || statement==ID_assume)
+  {
+    typecheck_expr(code.op0());
+  }
 }
diff --git a/src/java_bytecode/java_bytecode_typecheck_expr.cpp b/src/java_bytecode/java_bytecode_typecheck_expr.cpp
index c83ad680784..f25e988e850 100644
--- a/src/java_bytecode/java_bytecode_typecheck_expr.cpp
+++ b/src/java_bytecode/java_bytecode_typecheck_expr.cpp
@@ -22,6 +22,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "java_pointer_casts.h"
 #include "java_types.h"
+#include "java_utils.h"
 
 void java_bytecode_typecheckt::typecheck_expr(exprt &expr)
 {
@@ -106,8 +107,7 @@ void java_bytecode_typecheckt::typecheck_expr_java_string_literal(exprt &expr)
   const irep_idt value=expr.get(ID_value);
   const symbol_typet string_type("java::java.lang.String");
 
-  std::string escaped_symbol_name=
-    "java::java.lang.String.Literal.";
+  std::string escaped_symbol_name=JAVA_STRING_LITERAL_PREFIX ".";
   escaped_symbol_name+=escape_non_alnum(id2string(value));
 
   auto findit=symbol_table.symbols.find(escaped_symbol_name);
diff --git a/src/java_bytecode/java_class_loader.cpp b/src/java_bytecode/java_class_loader.cpp
index 6b720f05fb6..e627c9e1f8b 100644
--- a/src/java_bytecode/java_class_loader.cpp
+++ b/src/java_bytecode/java_class_loader.cpp
@@ -31,6 +31,9 @@ java_bytecode_parse_treet &java_class_loadert::operator()(
   queue.push("java.lang.String");
   // add java.lang.Class
   queue.push("java.lang.Class");
+  // Require java.lang.Throwable as the catch-type used for
+  // universal exception handlers:
+  queue.push("java.lang.Throwable");
   queue.push(class_name);
 
   java_class_loader_limitt class_loader_limit(
@@ -65,7 +68,6 @@ void java_class_loadert::set_java_cp_include_files(
   std::string &_java_cp_include_files)
 {
   java_cp_include_files=_java_cp_include_files;
-  jar_pool.set_message_handler(get_message_handler());
 }
 
 java_bytecode_parse_treet &java_class_loadert::get_parse_tree(
@@ -185,25 +187,27 @@ void java_class_loadert::read_jar_file(
   if(jar_map.find(file)!=jar_map.end())
     return;
 
-  jar_filet &jar_file=jar_pool(class_loader_limit, id2string(file));
-
-  if(!jar_file)
+  std::vector<std::string> filenames;
+  try
+  {
+    filenames=this->jar_pool(class_loader_limit, id2string(file)).filenames();
+  }
+  catch(const std::runtime_error &)
   {
     error() << "failed to open JAR file `" << file << "'" << eom;
     return;
   }
-
   debug() << "adding JAR file `" << file << "'" << eom;
 
+  // create a new entry in the map and initialize using the list of file names
+  // that were retained in the jar_filet by the class_loader_limit filter
   auto &jm=jar_map[file];
-
-  for(auto &jar_entry : jar_file.filtered_jar)
+  for(auto &file_name : filenames)
   {
-    std::string file_name=id2string(jar_entry.first);
-
     // does it end on .class?
     if(has_suffix(file_name, ".class"))
     {
+      status() << "read class file " << file_name << " from " << file << eom;
       irep_idt class_name=file_to_class_name(file_name);
 
       // record
@@ -259,3 +263,18 @@ std::string java_class_loadert::class_name_to_file(const irep_idt &class_name)
 
   return result;
 }
+
+jar_filet &java_class_loadert::jar_pool(
+  java_class_loader_limitt &class_loader_limit,
+  const std::string &file_name)
+{
+  const auto it=m_archives.find(file_name);
+  if(it==m_archives.end())
+  {
+    // VS: Can't construct in place
+    auto file=jar_filet(class_loader_limit, file_name);
+    return m_archives.emplace(file_name, std::move(file)).first->second;
+  }
+  else
+    return it->second;
+}
diff --git a/src/java_bytecode/java_class_loader.h b/src/java_bytecode/java_class_loader.h
index f6996fb2efd..fe8f8e3dd77 100644
--- a/src/java_bytecode/java_class_loader.h
+++ b/src/java_bytecode/java_class_loader.h
@@ -27,10 +27,6 @@ class java_class_loadert:public messaget
 
   void set_java_cp_include_files(std::string &);
 
-  // maps class names to the parse trees
-  typedef std::map<irep_idt, java_bytecode_parse_treet> class_mapt;
-  class_mapt class_map;
-
   static std::string file_to_class_name(const std::string &);
   static std::string class_name_to_file(const irep_idt &);
 
@@ -41,8 +37,32 @@ class java_class_loadert:public messaget
 
   void load_entire_jar(java_class_loader_limitt &, const std::string &f);
 
-  jar_poolt jar_pool;
+  void read_jar_file(java_class_loader_limitt &, const irep_idt &);
+
+  /// Given a \p class_name (e.g. "java.lang.Thread") try to load the
+  /// corresponding .class file by first scanning all .jar files whose
+  /// pathname is stored in \ref jar_files, and if that doesn't work, then scan
+  /// the actual filesystem using `config.java.classpath` as class path. Uses
+  /// \p limit to limit the class files that it might (directly or indirectly)
+  /// load and returns a default-constructed parse tree when unable to find the
+  /// .class file.
+  java_bytecode_parse_treet &get_parse_tree(
+    java_class_loader_limitt &limit, const irep_idt &class_name);
 
+  /// Maps class names to the bytecode parse trees.
+  typedef std::map<irep_idt, java_bytecode_parse_treet> class_mapt;
+  class_mapt class_map;
+
+  /// Load jar archive(from cache if already loaded)
+  /// \param limit
+  /// \param filename name of the file
+  jar_filet &jar_pool(java_class_loader_limitt &limit,
+                      const std::string &filename);
+
+  /// An object of this class represents the information of _a single JAR file_
+  /// that is relevant for a class loader: a map associating logical class names
+  /// with with handles (struct entryt) that describe one .class file inside the
+  /// JAR. Currently the handle only contains the name of the .class file.
   class jar_map_entryt
   {
   public:
@@ -51,23 +71,29 @@ class java_class_loadert:public messaget
       std::string class_file_name;
     };
 
-    // class name to index map
+    /// Maps class names to jar file entries.
     typedef std::map<irep_idt, entryt> entriest;
     entriest entries;
   };
 
-  // maps jar files to maps of class names
+  /// Maps .jar filesystem paths to .class file descriptors (see
+  /// jar_map_entryt).
   typedef std::map<irep_idt, jar_map_entryt> jar_mapt;
   jar_mapt jar_map;
 
-  void read_jar_file(java_class_loader_limitt &, const irep_idt &);
-
-  // get a parse tree for given class
-  java_bytecode_parse_treet &get_parse_tree(
-    java_class_loader_limitt &, const irep_idt &);
-
+  /// List of filesystem paths to .jar files that will be used, in the given
+  /// order, to find and load a class, provided its name (see \ref
+  /// get_parse_tree).
   std::list<std::string> jar_files;
+
+  /// Either a regular expression matching files that will be allowed to be
+  /// loaded or a string of the form `@PATH` where PATH is the file path of a
+  /// json file storing an explicit list of files allowed to be loaded. See
+  /// java_class_loader_limitt::setup_class_load_limit() for further
+  /// information.
   std::string java_cp_include_files;
+private:
+  std::map<std::string, jar_filet> m_archives;
 };
 
 #endif // CPROVER_JAVA_BYTECODE_JAVA_CLASS_LOADER_H
diff --git a/src/java_bytecode/java_class_loader_limit.cpp b/src/java_bytecode/java_class_loader_limit.cpp
index 38b9f9f6c41..4c98e23c671 100644
--- a/src/java_bytecode/java_class_loader_limit.cpp
+++ b/src/java_bytecode/java_class_loader_limit.cpp
@@ -19,7 +19,7 @@ void java_class_loader_limitt::setup_class_load_limit(
   const std::string &java_cp_include_files)
 {
   if(java_cp_include_files.empty())
-    throw "class regexp cannot be empty";
+    throw "class regexp cannot be empty, `get_language_options` not called?";
 
   // '@' signals file reading with list of class files to load
   regex_match=java_cp_include_files[0]!='@';
diff --git a/src/java_bytecode/java_entry_point.cpp b/src/java_bytecode/java_entry_point.cpp
index 72414955785..c142f37ddf5 100644
--- a/src/java_bytecode/java_entry_point.cpp
+++ b/src/java_bytecode/java_entry_point.cpp
@@ -10,6 +10,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <algorithm>
 #include <set>
+#include <unordered_set>
 #include <iostream>
 
 #include <util/arith_tools.h>
@@ -31,6 +32,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "java_object_factory.h"
 #include "java_types.h"
+#include "java_utils.h"
 
 #define INITIALIZE CPROVER_PREFIX "initialize"
 
@@ -61,7 +63,6 @@ static void create_initialize(symbol_tablet &symbol_table)
     throw "failed to add "+std::string(INITIALIZE);
 }
 
-
 static bool should_init_symbol(const symbolt &sym)
 {
   if(sym.type.id()!=ID_code &&
@@ -71,14 +72,27 @@ static bool should_init_symbol(const symbolt &sym)
      sym.mode==ID_java)
     return true;
 
-  return has_prefix(id2string(sym.name), "java::java.lang.String.Literal");
+  return is_java_string_literal_id(sym.name);
+}
+
+static bool is_non_null_library_global(const irep_idt &symbolid)
+{
+  static const std::unordered_set<irep_idt, irep_id_hash> non_null_globals=
+  {
+    "java::java.lang.System.out",
+    "java::java.lang.System.err",
+    "java::java.lang.System.in"
+  };
+  return non_null_globals.count(symbolid);
 }
 
 void java_static_lifetime_init(
   symbol_tablet &symbol_table,
   const source_locationt &source_location,
   bool assume_init_pointers_not_null,
-  unsigned max_nondet_array_length)
+  unsigned max_nondet_array_length,
+  unsigned max_nondet_tree_depth,
+  const select_pointer_typet &pointer_type_selector)
 {
   symbolt &initialize_symbol=symbol_table.lookup(INITIALIZE);
   code_blockt &code_block=to_code_block(to_code(initialize_symbol.value));
@@ -101,14 +115,15 @@ void java_static_lifetime_init(
         bool allow_null=!assume_init_pointers_not_null;
         if(allow_null)
         {
-          std::string namestr=id2string(sym.symbol_expr().get_identifier());
+          irep_idt nameid=sym.symbol_expr().get_identifier();
+          std::string namestr=id2string(nameid);
           const std::string suffix="@class_model";
           // Static '.class' fields are always non-null.
           if(has_suffix(namestr, suffix))
             allow_null=false;
-          if(allow_null && has_prefix(
-               namestr,
-               "java::java.lang.String.Literal"))
+          if(allow_null && is_java_string_literal_id(nameid))
+            allow_null=false;
+          if(allow_null && is_non_null_library_global(nameid))
             allow_null=false;
         }
         auto newsym=object_factory(
@@ -118,7 +133,10 @@ void java_static_lifetime_init(
           allow_null,
           symbol_table,
           max_nondet_array_length,
-          source_location);
+          max_nondet_tree_depth,
+          allocation_typet::GLOBAL,
+          source_location,
+          pointer_type_selector);
         code_assignt assignment(sym.symbol_expr(), newsym);
         code_block.add(assignment);
       }
@@ -130,33 +148,25 @@ void java_static_lifetime_init(
       }
     }
   }
-
-  // we now need to run all the <clinit> methods
-
-  for(symbol_tablet::symbolst::const_iterator
-      it=symbol_table.symbols.begin();
-      it!=symbol_table.symbols.end();
-      it++)
-  {
-    if(it->second.base_name=="<clinit>" &&
-       it->second.type.id()==ID_code &&
-       it->second.mode==ID_java)
-    {
-      code_function_callt function_call;
-      function_call.lhs()=nil_exprt();
-      function_call.function()=it->second.symbol_expr();
-      function_call.add_source_location()=source_location;
-      code_block.add(function_call);
-    }
-  }
 }
 
+///  Extends \p init_code with code that allocates the objects used as test
+///  arguments for the function under test (\p function) and
+///  non-deterministically initializes them.
+///
+///  All the code generated by this function goes to __CPROVER__start, just
+///  before the call to the method under test.
+///
+///  \returns A std::vector of symbol_exprt, one per parameter of \p function,
+///  containing the objects that can be used as arguments for \p function.
 exprt::operandst java_build_arguments(
   const symbolt &function,
   code_blockt &init_code,
   symbol_tablet &symbol_table,
   bool assume_init_pointers_not_null,
-  unsigned max_nondet_array_length)
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  const select_pointer_typet &pointer_type_selector)
 {
   const code_typet::parameterst &parameters=
     to_code_type(function.type).parameters();
@@ -164,33 +174,46 @@ exprt::operandst java_build_arguments(
   exprt::operandst main_arguments;
   main_arguments.resize(parameters.size());
 
+  // certain method arguments cannot be allowed to be null, we set the following
+  // variable to true iff the method under test is the "main" method, which will
+  // be called (by the jvm) with arguments that are never null
+  bool is_default_entry_point(config.main.empty());
+  bool is_main=is_default_entry_point;
+
+  // if walks like a duck and quacks like a duck, it is a duck!
+  if(!is_main)
+  {
+    bool named_main=has_suffix(config.main, ".main");
+    const typet &string_array_type=
+      java_type_from_string("[Ljava.lang.String;");
+    bool has_correct_type=
+      to_code_type(function.type).return_type().id()==ID_empty &&
+      (!to_code_type(function.type).has_this()) &&
+      parameters.size()==1 &&
+      parameters[0].type().full_eq(string_array_type);
+    is_main=(named_main && has_correct_type);
+  }
+
+  // we iterate through all the parameters of the function under test, allocate
+  // an object for that parameter (recursively allocating other objects
+  // necessary to initialize it), and declare such object as an ID_input
   for(std::size_t param_number=0;
       param_number<parameters.size();
       param_number++)
   {
-    bool is_this=(param_number==0) &&
-                 parameters[param_number].get_this();
-    bool is_default_entry_point(config.main.empty());
-    bool is_main=is_default_entry_point;
-    if(!is_main)
-    {
-      bool named_main=has_suffix(config.main, ".main");
-      const typet &string_array_type=
-        java_type_from_string("[Ljava.lang.String;");
-      bool has_correct_type=
-        to_code_type(function.type).return_type().id()==ID_empty &&
-        (!to_code_type(function.type).has_this()) &&
-        parameters.size()==1 &&
-        parameters[0].type().full_eq(string_array_type);
-      is_main=(named_main && has_correct_type);
-    }
-
     const code_typet::parametert &p=parameters[param_number];
     const irep_idt base_name=p.get_base_name().empty()?
       ("argument#"+std::to_string(param_number)):p.get_base_name();
 
-    bool allow_null=(!is_main) && (!is_this) && !assume_init_pointers_not_null;
+    // true iff this parameter is the `this` pointer of the method, which cannot
+    // be null
+    bool is_this=(param_number==0) && parameters[param_number].get_this();
+
+    bool allow_null=
+      !assume_init_pointers_not_null && !is_main && !is_this;
 
+    // generate code to allocate and non-deterministicaly initialize the
+    // argument
     main_arguments[param_number]=
       object_factory(
         p.type(),
@@ -199,7 +222,10 @@ exprt::operandst java_build_arguments(
         allow_null,
         symbol_table,
         max_nondet_array_length,
-        function.location);
+        max_nondet_tree_depth,
+        allocation_typet::LOCAL,
+        function.location,
+        pointer_type_selector);
 
     // record as an input
     codet input(ID_input);
@@ -239,7 +265,8 @@ void java_record_outputs(
     codet output(ID_output);
     output.operands().resize(2);
 
-    const symbolt &return_symbol=symbol_table.lookup("return'");
+    const symbolt &return_symbol=
+      symbol_table.lookup(JAVA_ENTRY_POINT_RETURN_SYMBOL);
 
     output.op0()=
       address_of_exprt(
@@ -280,11 +307,9 @@ void java_record_outputs(
   codet output(ID_output);
   output.operands().resize(2);
 
-  assert(symbol_table.has_symbol(id2string(function.name)+EXC_SUFFIX));
-
   // retrieve the exception variable
   const symbolt exc_symbol=symbol_table.lookup(
-    id2string(function.name)+EXC_SUFFIX);
+    JAVA_ENTRY_POINT_EXCEPTION_SYMBOL);
 
   output.op0()=address_of_exprt(
     index_exprt(string_constantt(exc_symbol.base_name),
@@ -312,76 +337,28 @@ main_function_resultt get_main_symbol(
     // Add java:: prefix
     std::string main_identifier="java::"+config.main;
 
-    symbol_tablet::symbolst::const_iterator s_it;
+    std::string error_message;
+    irep_idt main_symbol_id=
+      resolve_friendly_method_name(config.main, symbol_table, error_message);
 
-    // Does it have a type signature? (':' suffix)
-    if(config.main.rfind(':')==std::string::npos)
+    if(main_symbol_id==irep_idt())
     {
-      std::string prefix=main_identifier+':';
-      std::set<irep_idt> matches;
-
-      for(const auto &s : symbol_table.symbols)
-        if(has_prefix(id2string(s.first), prefix) &&
-           s.second.type.id()==ID_code)
-          matches.insert(s.first);
-
-      if(matches.empty())
-      {
-        message.error() << "main symbol `" << config.main
-                        << "' not found" << messaget::eom;
-        res.main_function=symbol;
-        res.error_found=true;
-        res.stop_convert=true;
-        return res;
-      }
-      else if(matches.size()==1)
-      {
-        s_it=symbol_table.symbols.find(*matches.begin());
-        assert(s_it!=symbol_table.symbols.end());
-      }
-      else
-      {
-        message.error() << "main symbol `" << config.main
-                        << "' is ambiguous:\n";
-
-        for(const auto &s : matches)
-          message.error() << "  " << s << '\n';
-
-        message.error() << messaget::eom;
-        res.main_function=symbol;
-        res.error_found=true;
-        res.stop_convert=true;
-        return res;
-      }
-    }
-    else
-    {
-      // just look it up
-      s_it=symbol_table.symbols.find(main_identifier);
-
-      if(s_it==symbol_table.symbols.end())
-      {
-        message.error() << "main symbol `" << config.main
-                        << "' not found" << messaget::eom;
-        res.main_function=symbol;
-        res.error_found=true;
-        res.stop_convert=true;
-        return res;
-      }
-    }
-    // function symbol
-    symbol=s_it->second;
-
-    if(symbol.type.id()!=ID_code)
-    {
-      message.error() << "main symbol `" << config.main
-                      << "' not a function" << messaget::eom;
+      message.error() << "main symbol resolution failed: "
+                      << error_message << messaget::eom;
       res.main_function=symbol;
       res.error_found=true;
       res.stop_convert=true;
       return res;
     }
 
+    symbol_tablet::symbolst::const_iterator s_it=
+      symbol_table.symbols.find(main_symbol_id);
+    INVARIANT(
+      s_it!=symbol_table.symbols.end(),
+      "resolve_friendly_method_name should return a symbol-table identifier");
+
+    symbol=s_it->second;
+
     // check if it has a body
     if(symbol.value.is_nil() && !allow_no_body)
     {
@@ -465,20 +442,48 @@ main_function_resultt get_main_symbol(
   return res;  // give up with error
 }
 
-/// find entry point and create initialization code for function
-/// symbol_table
-/// main class
-/// message_handler
-/// \param assume_init_pointers_not_null: allow pointers in initialization code
-///   to be null
-/// max_nondet_array_length
-/// \return true if error occurred on entry point search
+/// Given the \p symbol_table and the \p main_class to test, this function
+/// generates a new function __CPROVER__start that calls the method under tests.
+///
+/// If __CPROVER__start is already in the `symbol_table`, it silently returns.
+/// Otherwise it finds the method under test using `get_main_symbol` and
+/// constructs a body for __CPROVER__start which does as follows:
+///
+/// 1. Allocates and initializes the parameters of the method under test.
+/// 2. Call it and save its return variable in the variable 'return'.
+/// 3. Declare variable 'return' as an output variable (codet with id
+///    ID_output), together with other objects possibly altered by the execution
+///    the method under test (in `java_record_outputs`)
+///
+/// When \p assume_init_pointers_not_null is false, the generated parameter
+/// initialization code will non-deterministically set input parameters to
+/// either null or a stack-allocated object. Observe that the null/non-null
+/// setting only applies to the parameter itself, and is not propagated to other
+/// pointers that it might be necessary to initialize in the object tree rooted
+/// at the parameter.
+/// Parameter \p max_nondet_array_length provides the maximum length for an
+/// array used as part of the input to the method under test, and
+/// \p max_nondet_tree_depth defines the maximum depth of the object tree
+/// created for such inputs. This maximum depth is used **in conjunction** with
+/// the so-called "recursive type set" (see field `recursive_set` in class
+/// java_object_factoryt) to bound the depth of the object tree for the
+/// parameter. Only when
+/// - the depth of the tree is >= max_nondet_tree_depth **AND**
+/// - the type of the object under initialization is already found in the
+///   recursive set
+/// then that object is not initalized and the reference pointing to it is
+/// (deterministically) set to null. This is a source of underapproximation in
+/// our approach to test generation, and should perhaps be fixed in the future.
+///
+/// \returns true if error occurred on entry point search
 bool java_entry_point(
   symbol_tablet &symbol_table,
   const irep_idt &main_class,
   message_handlert &message_handler,
   bool assume_init_pointers_not_null,
-  size_t max_nondet_array_length)
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  const select_pointer_typet &pointer_type_selector)
 {
   // check if the entry point is already there
   if(symbol_table.symbols.find(goto_functionst::entry_point())!=
@@ -501,7 +506,9 @@ bool java_entry_point(
     symbol_table,
     symbol.location,
     assume_init_pointers_not_null,
-    max_nondet_array_length);
+    max_nondet_array_length,
+    max_nondet_tree_depth,
+    pointer_type_selector);
 
   code_blockt init_code;
 
@@ -525,7 +532,10 @@ bool java_entry_point(
     init_code.move_to_operands(call_init);
   }
 
-  // build call to the main method
+  // build call to the main method, of the form
+  // return = main_method(arg1, arg2, ..., argn)
+  // where return is a new variable
+  // and arg1 ... argn are constructed below as well
 
   code_function_callt call_main;
 
@@ -533,16 +543,19 @@ bool java_entry_point(
   loc.set_function(symbol.name);
   source_locationt &dloc=loc;
 
+  // function to call
   call_main.add_source_location()=dloc;
   call_main.function()=symbol.symbol_expr();
   call_main.function().add_source_location()=dloc;
 
+  // if the method return type is not void, store return value in a new variable
+  // named 'return'
   if(to_code_type(symbol.type).return_type()!=empty_typet())
   {
     auxiliary_symbolt return_symbol;
-    return_symbol.mode=ID_C;
+    return_symbol.mode=ID_java;
     return_symbol.is_static_lifetime=false;
-    return_symbol.name="return'";
+    return_symbol.name=JAVA_ENTRY_POINT_RETURN_SYMBOL;
     return_symbol.base_name="return";
     return_symbol.type=to_code_type(symbol.type).return_type();
 
@@ -552,27 +565,73 @@ bool java_entry_point(
 
   // add the exceptional return value
   auxiliary_symbolt exc_symbol;
-  exc_symbol.mode=ID_C;
-  exc_symbol.is_static_lifetime=false;
-  exc_symbol.name=id2string(symbol.name)+EXC_SUFFIX;
-  exc_symbol.base_name=id2string(symbol.name)+EXC_SUFFIX;
+  exc_symbol.mode=ID_java;
+  exc_symbol.name=JAVA_ENTRY_POINT_EXCEPTION_SYMBOL;
+  exc_symbol.base_name=exc_symbol.name;
   exc_symbol.type=java_reference_type(empty_typet());
   symbol_table.add(exc_symbol);
 
+  // Zero-initialise the top-level exception catch variable:
+  init_code.copy_to_operands(
+    code_assignt(
+      exc_symbol.symbol_expr(),
+      null_pointer_exprt(to_pointer_type(exc_symbol.type))));
+
+  // create code that allocates the objects used as test arguments and
+  // non-deterministically initializes them
   exprt::operandst main_arguments=
     java_build_arguments(
       symbol,
       init_code,
       symbol_table,
       assume_init_pointers_not_null,
-      max_nondet_array_length);
+      max_nondet_array_length,
+      max_nondet_tree_depth,
+      pointer_type_selector);
   call_main.arguments()=main_arguments;
 
-  init_code.move_to_operands(call_main);
+  // Create target labels for the toplevel exception handler:
+  code_labelt toplevel_catch("toplevel_catch", code_skipt());
+  code_labelt after_catch("after_catch", code_skipt());
+
+  code_blockt call_block;
+
+  // Push a universal exception handler:
+  // Catch all exceptions:
+  // This is equivalent to catching Throwable, but also works if some of
+  // the class hierarchy is missing so that we can't determine that
+  // the thrown instance is an indirect child of Throwable
+  code_push_catcht push_universal_handler(
+    irep_idt(), toplevel_catch.get_label());
+  irept catch_type_list(ID_exception_list);
+  irept catch_target_list(ID_label);
+
+  call_block.move_to_operands(push_universal_handler);
+
+  // we insert the call to the method AFTER the argument initialization code
+  call_block.move_to_operands(call_main);
+
+  // Pop the handler:
+  code_pop_catcht pop_handler;
+  call_block.move_to_operands(pop_handler);
+  init_code.move_to_operands(call_block);
+
+  // Normal return: skip the exception handler:
+  init_code.copy_to_operands(code_gotot(after_catch.get_label()));
+
+  // Exceptional return: catch and assign to exc_symbol.
+  code_landingpadt landingpad(exc_symbol.symbol_expr());
+  init_code.copy_to_operands(toplevel_catch);
+  init_code.move_to_operands(landingpad);
+
+  // Converge normal and exceptional return:
+  init_code.move_to_operands(after_catch);
 
+  // declare certain (which?) variables as test outputs
   java_record_outputs(symbol, main_arguments, init_code, symbol_table);
 
-  // add "main"
+  // create a symbol for the __CPROVER__start function, associate the code that
+  // we just built and register it in the symbol table
   symbolt new_symbol;
 
   code_typet main_type;
diff --git a/src/java_bytecode/java_entry_point.h b/src/java_bytecode/java_entry_point.h
index e2d2fa3f41b..18e42aafc65 100644
--- a/src/java_bytecode/java_entry_point.h
+++ b/src/java_bytecode/java_entry_point.h
@@ -12,13 +12,19 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <util/irep.h>
 #include <util/symbol.h>
+#include <java_bytecode/select_pointer_type.h>
+
+#define JAVA_ENTRY_POINT_RETURN_SYMBOL "return'"
+#define JAVA_ENTRY_POINT_EXCEPTION_SYMBOL "uncaught_exception'"
 
 bool java_entry_point(
   class symbol_tablet &symbol_table,
   const irep_idt &main_class,
   class message_handlert &message_handler,
   bool assume_init_pointers_not_null,
-  size_t max_nondet_array_length);
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  const select_pointer_typet &pointer_type_selector);
 
 typedef struct
 {
@@ -27,6 +33,7 @@ typedef struct
   bool stop_convert;
 } main_function_resultt;
 
+/// Figures out the entry point of the code to verify
 main_function_resultt get_main_symbol(
   symbol_tablet &symbol_table,
   const irep_idt &main_class,
diff --git a/src/java_bytecode/java_local_variable_table.cpp b/src/java_bytecode/java_local_variable_table.cpp
index 70b2568476a..e50e96f41d3 100644
--- a/src/java_bytecode/java_local_variable_table.cpp
+++ b/src/java_bytecode/java_local_variable_table.cpp
@@ -12,6 +12,7 @@ Author: Chris Smowton, chris.smowton@diffblue.com
 #include "java_bytecode_convert_method_class.h"
 
 #include "java_types.h"
+#include "java_utils.h"
 
 #include <util/arith_tools.h>
 #include <util/invariant.h>
@@ -58,8 +59,9 @@ struct procedure_local_cfg_baset<
     for(const auto &table_entry : method.exception_table)
     {
       auto findit=amap.find(table_entry.start_pc);
-      assert(findit!=amap.end() &&
-             "Exception table entry doesn't point to an instruction?");
+      INVARIANT(
+        findit!=amap.end(),
+        "Exception table entry doesn't point to an instruction?");
       for(; findit->first<table_entry.end_pc; ++findit)
       {
         // For now just assume any non-branch
@@ -145,7 +147,7 @@ struct is_predecessor_oft
   }
 };
 
-// Helper routines for the find-initialisers code below:
+// Helper routines for the find-initializers code below:
 
 /// See above
 /// `start`: Variable to find the predecessors of `predecessor_map`: Map from
@@ -190,9 +192,13 @@ static bool is_store_to_slot(
   else
   {
     // Store shorthands, like "store_0", "store_1"
-    assert(prevstatement[6]=='_' && prevstatement.size()==8);
+    INVARIANT(
+      prevstatement[6]=='_' && prevstatement.size()==8,
+      "expected store instruction looks like store_0, store_1...");
     std::string storeslot(1, prevstatement[7]);
-    assert(isdigit(storeslot[0]));
+    INVARIANT(
+      isdigit(storeslot[0]),
+      "store_? instructions should end in a digit");
     storeslotidx=safe_string2unsigned(storeslot);
   }
   return storeslotidx==slotidx;
@@ -207,7 +213,7 @@ static void maybe_add_hole(
   unsigned from,
   unsigned to)
 {
-  assert(to>=from);
+  PRECONDITION(to>=from);
   if(to!=from)
     var.holes.push_back({from, to-from});
 }
@@ -234,26 +240,35 @@ static void populate_variable_address_map(
         idx!=idxlim;
         ++idx)
     {
-      assert((!live_variable_at_address[idx]) && "Local variable table clash?");
+      INVARIANT(!live_variable_at_address[idx], "Local variable table clash?");
       live_variable_at_address[idx]=&*it;
     }
   }
 }
 
-/// Usually a live variable range begins with a store instruction initialising
+/// Populates the `predecessor_map` with a graph from local variable table
+/// entries to their predecessors (table entries which may flow together and
+/// thus may be considered the same live range).
+///
+/// Usually a live variable range begins with a store instruction initializing
 /// the relevant local variable slot, but instead of or in addition to this,
 /// control flow edges may exist from bytecode addresses that fall under a table
-/// entry which differs, but which has the same variable name and type
-/// descriptor. This indicates a split live range, and will be recorded in the
-/// predecessor map.
-/// \par parameters: `firstvar`-`varlimit`: range of local variable table
-///   entries to consider
-/// `live_variable_at_address`: map from bytecode address to table entry (drawn
-///   from firstvar-varlimit) live at that address
-/// `amap`: map from bytecode address to instructions
-/// \return Populates `predecessor_map` with a graph from local variable table
-///   entries to their predecessors (table entries which may flow together and
-///   thus may be considered the same live range).
+/// entry which differs (or which fall under no table entry at all), but which
+/// has the same variable name and type descriptor. This indicates a split live
+/// range, and will be recorded in the predecessor map.
+///
+/// \param firstvar:
+///   range of local variable table entries to consider
+/// \param varlimit:
+///   range of local variable table entries to consider
+/// \param live_variable_at_address:
+///   map from bytecode address to table entry (drawn from firstvar-varlimit)
+//    live at that address
+/// \param amap:
+///   map from bytecode address to instructions, this is the CFG of the java
+///   method
+/// \param [out] predecessor_map:
+///   the output of the function, populated as described above
 static void populate_predecessor_map(
   local_variable_table_with_holest::iterator firstvar,
   local_variable_table_with_holest::iterator varlimit,
@@ -265,45 +280,78 @@ static void populate_predecessor_map(
   messaget msg(msg_handler);
   for(auto it=firstvar, itend=varlimit; it!=itend; ++it)
   {
-    // Parameters are irrelevant to us and shouldn't be changed:
-    if(it->var.start_pc==0)
+    // All entries of the "local_variable_table_with_holest" processed in this
+    // function concern the same Java Local Variable Table slot/register. This
+    // is because "find_initializers()" has already sorted them.
+    INVARIANT(
+      it->var.index==firstvar->var.index,
+      "all entries are for the same local variable slot");
+
+    // Parameters are irrelevant to us and shouldn't be changed. This is because
+    // they cannot have live predecessor ranges: they are initialized by the JVM
+    // and no other live variable range can flow into them.
+    if(it->is_parameter)
       continue;
 
+#ifdef DEBUG
+    msg.debug() << "jcm: ppm: processing var idx " << it->var.index
+                << " name '" << it->var.name << "' start-pc "
+                << it->var.start_pc << " len " << it->var.length
+                << "; holes " << it->holes.size() << messaget::eom;
+#endif
+
     // Find the last instruction within the live range:
     unsigned end_pc=it->var.start_pc+it->var.length;
     auto amapit=amap.find(end_pc);
-    assert(amapit!=amap.begin());
+    INVARIANT(
+      amapit!=amap.begin(),
+      "current bytecode shall not be the first");
     auto old_amapit=amapit;
     --amapit;
     if(old_amapit==amap.end())
     {
-      assert(
-        end_pc>amapit->first &&
+      INVARIANT(
+        end_pc>amapit->first,
         "Instruction live range doesn't align to instruction boundary?");
     }
 
-    // Find vartable entries that flow into this one:
+    // Find vartable entries that flow into this one. For unknown reasons this
+    // loop iterates backwards, walking back from the last bytecode in the live
+    // range of variable it to the first one. For each value of the iterator
+    // "amapit" we search for instructions that jump into amapit's address
+    // (predecessors)
     unsigned new_start_pc=it->var.start_pc;
     for(; amapit->first>=it->var.start_pc; --amapit)
     {
       for(auto pred : amapit->second.predecessors)
       {
+        // pred is the address (byecode offset) of a instruction that jumps into
+        // amapit. Compute now a pointer to the variable-with-holes whose index
+        // equals that of amapit and which was alive on instruction pred, or a
+        // null pointer if no such variable exists (e.g., because no live range
+        // covers that instruction)
         auto pred_var=
           (pred<live_variable_at_address.size() ?
            live_variable_at_address[pred] :
            nullptr);
+
+        // Three cases are now possible:
+        // 1. The predecessor instruction is in the same live range: nothing to
+        // do.
         if(pred_var==&*it)
         {
-          // Flow from within same live range?
           continue;
         }
+        // 2. The predecessor instruction is in no live range among those for
+        // variable slot it->var.index
         else if(!pred_var)
         {
-          // Flow from out of range?
-          // Check if this is an initialiser, and if so expand the live range
+          // Check if this is an initializer, and if so expand the live range
           // to include it, but don't check its predecessors:
           auto inst_before_this=amapit;
-          assert(inst_before_this!=amap.begin());
+          INVARIANT(
+            inst_before_this!=amap.begin(),
+            "we shall not be on the first bytecode of the method");
           --inst_before_this;
           if(amapit->first!=it->var.start_pc || inst_before_this->first!=pred)
           {
@@ -320,10 +368,17 @@ static void populate_predecessor_map(
                *(inst_before_this->second.source),
                it->var.index))
           {
-            throw "local variable table: didn't find initialising store";
+            msg.warning() << "Local variable table: didn't find initializing "
+                          << "store for predecessor of bytecode at address "
+                          << amapit->first << " ("
+                          << amapit->second.predecessors.size()
+                          << " predecessors)" << msg.eom;
+            throw "local variable table: unexpected live ranges";
           }
           new_start_pc=pred;
         }
+        // 3. Predecessor instruction is a different range associated to the
+        // same variable slot
         else
         {
           if(pred_var->var.name!=it->var.name ||
@@ -345,7 +400,7 @@ static void populate_predecessor_map(
       }
     }
 
-    // If a simple pre-block initialiser was found,
+    // If a simple pre-block initializer was found,
     // add it to the live range now:
     it->var.length+=(it->var.start_pc-new_start_pc);
     it->var.start_pc=new_start_pc;
@@ -356,7 +411,7 @@ static void populate_predecessor_map(
 /// variable live ranges.
 /// \par parameters: `merge_vars`: Set of variables we want the common dominator
 ///   for.
-/// `dominator_analysis`: Already-initialised dominator tree
+/// `dominator_analysis`: Already-initialized dominator tree
 /// \return Returns the bytecode address of the closest common dominator of all
 ///   given variable table entries. In the worst case the function entry point
 ///   should always satisfy this criterion.
@@ -364,7 +419,7 @@ static unsigned get_common_dominator(
   const std::set<local_variable_with_holest*> &merge_vars,
   const java_cfg_dominatorst &dominator_analysis)
 {
-  assert(!merge_vars.empty());
+  PRECONDITION(!merge_vars.empty());
 
   unsigned first_pc=UINT_MAX;
   for(auto v : merge_vars)
@@ -492,15 +547,15 @@ static void merge_variable_table_entries(
 /// Given a sequence of users of the same local variable slot, this figures out
 /// which ones are related by control flow, and combines them into a single
 /// entry with holes, such that after combination we can create a single
-/// declaration per variable table entry, placed at the live range's start
+/// GOTO variable per variable table entry, placed at the live range's start
 /// address, which may be moved back so that the declaration dominates all uses.
 /// \par parameters: `firstvar`-`varlimit`: sequence of variable table entries,
 ///   all of which should concern the same slot index.
 /// `amap`: Map from bytecode address to instruction
 /// \return Side-effect: merges variable table entries which flow into one
 ///   another (e.g. there are branches from one live range to another without
-///   re-initialising the local slot).
-void java_bytecode_convert_methodt::find_initialisers_for_slot(
+///   re-initializing the local slot).
+void java_bytecode_convert_methodt::find_initializers_for_slot(
   local_variable_table_with_holest::iterator firstvar,
   local_variable_table_with_holest::iterator varlimit,
   const address_mapt &amap,
@@ -513,7 +568,7 @@ void java_bytecode_convert_methodt::find_initialisers_for_slot(
   populate_variable_address_map(firstvar, varlimit, live_variable_at_address);
 
   // Now find variables that flow together by
-  // walking backwards to find initialisers
+  // walking backwards to find initializers
   // or branches from other live ranges:
   predecessor_mapt predecessor_map;
   populate_predecessor_map(
@@ -556,7 +611,7 @@ void java_bytecode_convert_methodt::find_initialisers_for_slot(
       continue;
 
     const auto &merge_vars=findit->second;
-    assert(merge_vars.size()>=2);
+    INVARIANT(merge_vars.size()>=2, "merging requires at least 2 variables");
 
     merge_variable_table_entries(
       *merge_into,
@@ -591,13 +646,13 @@ static void walk_to_next_index(
   it1=old_it2;
 }
 
-/// See `find_initialisers_for_slot` above for more detail.
+/// See `find_initializers_for_slot` above for more detail.
 /// \par parameters: `vars`: Local variable table
 /// `amap`: Map from bytecode index to instruction
 /// `dominator_analysis`: Already computed dominator tree for the Java function
 ///   described by `amap`
 /// \return Combines entries in `vars` which flow together
-void java_bytecode_convert_methodt::find_initialisers(
+void java_bytecode_convert_methodt::find_initializers(
   local_variable_table_with_holest &vars,
   const address_mapt &amap,
   const java_cfg_dominatorst &dominator_analysis)
@@ -612,7 +667,7 @@ void java_bytecode_convert_methodt::find_initialisers(
   auto itend=vars.end();
   walk_to_next_index(it1, it2, itend);
   for(; it1!=itend; walk_to_next_index(it1, it2, itend))
-    find_initialisers_for_slot(it1, it2, amap, dominator_analysis);
+    find_initializers_for_slot(it1, it2, amap, dominator_analysis);
 }
 
 /// See above
@@ -640,7 +695,7 @@ static void cleanup_var_table(
   vars_with_holes.resize(vars_with_holes.size()-toremove);
 }
 
-/// See `find_initialisers_for_slot` above for more detail.
+/// See `find_initializers_for_slot` above for more detail.
 /// \par parameters: `m`: Java method
 /// `amap`: Map from bytecode indices to instructions in `m`
 /// \return Populates `this->vars_with_holes` equal to
@@ -655,14 +710,40 @@ void java_bytecode_convert_methodt::setup_local_variables(
   method_with_amapt dominator_args(m, amap);
   dominator_analysis(dominator_args);
 
+#ifdef DEBUG
+  debug() << "jcm: setup-local-vars: m.is_static "
+          << m.is_static << " m.signature " << m.signature << eom;
+  debug() << "jcm: setup-local-vars: lv arg slots "
+          << slots_for_parameters << eom;
+  debug() << "jcm: setup-local-vars: lvt size "
+          << m.local_variable_table.size() << eom;
+#endif
+
   // Find out which local variable table entries should be merged:
-  // Wrap each entry so we have somewhere to record live ranges with holes:
+  // Wrap each entry so we have a data structure to work during function calls,
+  // where we record live ranges with holes:
   std::vector<local_variable_with_holest> vars_with_holes;
   for(const auto &v : m.local_variable_table)
-    vars_with_holes.push_back({v, {}});
-
-  // Merge variable records:
-  find_initialisers(vars_with_holes, amap, dominator_analysis);
+    vars_with_holes.push_back({v, is_parameter(v), {}});
+
+  // Merge variable records. See documentation of in
+  // `find_initializers_for_slot` for more details. If the strategy employed
+  // there fails with an exception, we just ignore the LVT for this method, no
+  // variable is generated in `this->variables[]` (because we return here and
+  // dont let the for loop below to execute), and as a result the method
+  // this->variable() will be forced to create new `anonlocal::` variables, as
+  // the only source of variable names for that method is `this->variables[]`.
+  try
+  {
+    find_initializers(vars_with_holes, amap, dominator_analysis);
+  }
+  catch(const char *message)
+  {
+    warning() << "Bytecode -> codet translation error: " << message << eom
+              << "This is probably due to an unexpected LVT, "
+              << "falling back to translation without LVT" << eom;
+    return;
+  }
 
   // Clean up removed records from the variable table:
   cleanup_var_table(vars_with_holes);
@@ -677,9 +758,14 @@ void java_bytecode_convert_methodt::setup_local_variables(
   // length values in the local variable table
   for(const auto &v : vars_with_holes)
   {
-    if(v.var.start_pc==0) // Parameter?
+    if(v.is_parameter)
       continue;
 
+#ifdef DEBUG
+    debug() << "jcm: setup-local-vars: merged variable: idx " << v.var.index
+            << " name " << v.var.name << " v.var.signature '"
+            << v.var.signature << "' holes " << v.holes.size() << eom;
+#endif
     typet t=java_type_from_string(v.var.signature);
     std::ostringstream id_oss;
     id_oss << method_id << "::" << v.var.start_pc << "::" << v.var.name;
@@ -687,6 +773,9 @@ void java_bytecode_convert_methodt::setup_local_variables(
     symbol_exprt result(identifier, t);
     result.set(ID_C_base_name, v.var.name);
 
+    // Create a new local variable in the variables[] array, the result of
+    // merging multiple local variables with equal name (parameters excluded)
+    // into a single local variable with holes
     variables[v.var.index].push_back(variablet());
     auto &newv=variables[v.var.index].back();
     newv.symbol_expr=result;
@@ -694,6 +783,7 @@ void java_bytecode_convert_methodt::setup_local_variables(
     newv.length=v.var.length;
     newv.holes=std::move(v.holes);
 
+    // Register the local variable in the symbol table
     symbolt new_symbol;
     new_symbol.name=identifier;
     new_symbol.type=t;
diff --git a/src/java_bytecode/java_object_factory.cpp b/src/java_bytecode/java_object_factory.cpp
index a903483aa4c..b9e3da19651 100644
--- a/src/java_bytecode/java_object_factory.cpp
+++ b/src/java_bytecode/java_object_factory.cpp
@@ -17,13 +17,18 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/std_code.h>
 #include <util/std_expr.h>
 #include <util/namespace.h>
+#include <util/nondet_bool.h>
+#include <util/nondet_ifthenelse.h>
 #include <util/pointer_offset_size.h>
 #include <util/prefix.h>
+#include <util/invariant.h>
 
 #include <linking/zero_initializer.h>
 
 #include <goto-programs/goto_functions.h>
 
+#include <java_bytecode/select_pointer_type.h>
+
 #include "java_types.h"
 #include "java_utils.h"
 
@@ -42,25 +47,44 @@ static symbolt &new_tmp_symbol(
     symbol_table);
 }
 
-/// \par parameters: Desired type (C_bool or plain bool)
-/// \return nondet expr of that type
-static exprt get_nondet_bool(const typet &type)
-{
-  // We force this to 0 and 1 and won't consider
-  // other values.
-  return typecast_exprt(side_effect_expr_nondett(bool_typet()), type);
-}
-
 class java_object_factoryt
 {
+  /// Every new variable initialized by the code emitted by the methods of this
+  /// class gets a symbol in the symbol table, and such symbols are also added
+  /// to this vector.
   std::vector<const symbolt *> &symbols_created;
+
+  /// The source location for new statements emitted during the operation of the
+  /// methods in this class.
   const source_locationt &loc;
+
+  /// Maximum value for the non-deterministically-chosen length of an array.
+  const size_t max_nondet_array_length;
+
+  /// Used to prevent the methods in this class to loop infinitely during the
+  /// generation of code that allocates/initializes data structures of recursive
+  /// data types or unbounded depth. We bound the maximum number of times we
+  /// dereference a pointer using a 'depth counter'. We set a pointer to null if
+  /// such depth becomes >= than this maximum value.
+  const size_t max_nondet_tree_depth;
+
+  /// This is employed in conjunction with the depth above. Every time the
+  /// non-det generator visits a type, the type is added to this set. We forbid
+  /// the non-det initialization when we see the type for the second time in
+  /// this set AND the tree depth becomes >= than the maximum value above.
   std::unordered_set<irep_idt, irep_id_hash> recursion_set;
-  bool assume_non_null;
-  size_t max_nondet_array_length;
+
+  /// The symbol table.
   symbol_tablet &symbol_table;
+
+  /// A namespace built from exclusively one symbol table - the one above.
   namespacet ns;
 
+  /// Resolves pointer types potentially using some heuristics, for example
+  /// to replace pointers to interface types with pointers to concrete
+  /// implementations.
+  const select_pointer_typet &pointer_type_selector;
+
   code_assignt get_null_assignment(
     const exprt &expr,
     const pointer_typet &ptr_type);
@@ -69,7 +93,9 @@ class java_object_factoryt
     code_blockt &assignments,
     const exprt &expr,
     const typet &target_type,
-    bool create_dynamic_objects);
+    allocation_typet alloc_type,
+    size_t depth,
+    update_in_placet update_in_place);
 
   void allocate_nondet_length_array(
     code_blockt &assignments,
@@ -81,130 +107,234 @@ class java_object_factoryt
   java_object_factoryt(
     std::vector<const symbolt *> &_symbols_created,
     const source_locationt &loc,
-    bool _assume_non_null,
     size_t _max_nondet_array_length,
-    symbol_tablet &_symbol_table):
+    size_t _max_nondet_tree_depth,
+    symbol_tablet &_symbol_table,
+    const select_pointer_typet &pointer_type_selector):
       symbols_created(_symbols_created),
       loc(loc),
-      assume_non_null(_assume_non_null),
       max_nondet_array_length(_max_nondet_array_length),
+      max_nondet_tree_depth(_max_nondet_tree_depth),
       symbol_table(_symbol_table),
-      ns(_symbol_table)
+      ns(_symbol_table),
+      pointer_type_selector(pointer_type_selector)
   {}
 
   exprt allocate_object(
     code_blockt &assignments,
     const exprt &,
     const typet &,
-    bool create_dynamic_objects);
+    allocation_typet alloc_type);
 
   void gen_nondet_array_init(
     code_blockt &assignments,
-    const exprt &expr);
+    const exprt &expr,
+    size_t depth,
+    update_in_placet);
 
   void gen_nondet_init(
     code_blockt &assignments,
     const exprt &expr,
     bool is_sub,
     irep_idt class_identifier,
-    bool create_dynamic_objects,
-    bool override=false,
-    const typet &override_type=empty_typet());
+    bool skip_classid,
+    allocation_typet alloc_type,
+    bool override_,
+    const typet &override_type,
+    bool allow_null,
+    size_t depth,
+    update_in_placet);
 
 private:
   void gen_nondet_pointer_init(
     code_blockt &assignments,
     const exprt &expr,
     const irep_idt &class_identifier,
-    bool create_dynamic_objects,
-    const pointer_typet &pointer_type);
+    allocation_typet alloc_type,
+    const pointer_typet &pointer_type,
+    bool allow_null,
+    size_t depth,
+    const update_in_placet &update_in_place);
 
   void gen_nondet_struct_init(
     code_blockt &assignments,
     const exprt &expr,
     bool is_sub,
     irep_idt class_identifier,
-    bool create_dynamic_objects,
-    const struct_typet &struct_type);
+    bool skip_classid,
+    allocation_typet alloc_type,
+    const struct_typet &struct_type,
+    size_t depth,
+    const update_in_placet &update_in_place);
+
+  symbol_exprt gen_nondet_subtype_pointer_init(
+    code_blockt &assignments,
+    allocation_typet alloc_type,
+    const pointer_typet &substitute_pointer_type,
+    size_t depth);
 };
 
-/// \param assignments: The code block to add code to
-/// \param target_expr: The expression which we are allocating a symbol for
-/// \param allocate_type:
-/// \param create_dynamic_objects: Whether to create a symbol with static
-///   lifetime or
-exprt java_object_factoryt::allocate_object(
-  code_blockt &assignments,
+/// Generates code for allocating a dynamic object. This is used in
+/// allocate_object() and also in the library preprocessing for allocating
+/// strings.
+/// \param target_expr: expression to which the necessary memory will be
+///   allocated, its type should be pointer to `allocate_type`
+/// \param allocate_type: type of the object allocated
+/// \param symbol_table: symbol table
+/// \param loc: location in the source
+/// \param output_code: code block to which the necessary code is added
+/// \param symbols_created: created symbols to be declared by the caller
+/// \param cast_needed: Boolean flags saying where we need to cast the malloc
+///   site
+/// \return Expression representing the malloc site allocated.
+exprt allocate_dynamic_object(
   const exprt &target_expr,
   const typet &allocate_type,
-  bool create_dynamic_objects)
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  code_blockt &output_code,
+  std::vector<const symbolt *> &symbols_created,
+  bool cast_needed)
 {
-  const typet &allocate_type_resolved=ns.follow(allocate_type);
-  const typet &target_type=ns.follow(target_expr.type().subtype());
-  bool cast_needed=allocate_type_resolved!=target_type;
-  if(!create_dynamic_objects)
-  {
-    symbolt &aux_symbol=new_tmp_symbol(symbol_table, loc, allocate_type);
-    symbols_created.push_back(&aux_symbol);
+  // build size expression
+  exprt object_size=size_of_expr(allocate_type, namespacet(symbol_table));
 
-    exprt object=aux_symbol.symbol_expr();
-    exprt aoe=address_of_exprt(object);
+  if(allocate_type.id()!=ID_empty)
+  {
+    INVARIANT(!object_size.is_nil(), "Size of Java objects should be known");
+    // malloc expression
+    exprt malloc_expr=side_effect_exprt(ID_malloc);
+    malloc_expr.copy_to_operands(object_size);
+    typet result_type=pointer_type(allocate_type);
+    malloc_expr.type()=result_type;
+    // create a symbol for the malloc expression so we can initialize
+    // without having to do it potentially through a double-deref, which
+    // breaks the to-SSA phase.
+    symbolt &malloc_sym=new_tmp_symbol(
+      symbol_table,
+      loc,
+      pointer_type(allocate_type),
+      "malloc_site");
+    symbols_created.push_back(&malloc_sym);
+    code_assignt assign=code_assignt(malloc_sym.symbol_expr(), malloc_expr);
+    assign.add_source_location()=loc;
+    output_code.copy_to_operands(assign);
+    malloc_expr=malloc_sym.symbol_expr();
     if(cast_needed)
-      aoe=typecast_exprt(aoe, target_expr.type());
-    code_assignt code(target_expr, aoe);
+      malloc_expr=typecast_exprt(malloc_expr, target_expr.type());
+    code_assignt code(target_expr, malloc_expr);
     code.add_source_location()=loc;
-    assignments.copy_to_operands(code);
-    return aoe;
+    output_code.copy_to_operands(code);
+    return malloc_sym.symbol_expr();
   }
   else
   {
-    // build size expression
-    exprt object_size=size_of_expr(allocate_type, namespacet(symbol_table));
+    // make null
+    null_pointer_exprt null_pointer_expr(to_pointer_type(target_expr.type()));
+    code_assignt code(target_expr, null_pointer_expr);
+    code.add_source_location()=loc;
+    output_code.copy_to_operands(code);
+    return exprt();
+  }
+}
+
+/// Generates code for allocating a dynamic object. This is a static version of
+/// allocate_dynamic_object that can be called from outside java_object_factory
+/// and which takes care of creating the associated declarations.
+/// \param target_expr: expression to which the necessary memory will be
+///   allocated
+/// \param symbol_table: symbol table
+/// \param loc: location in the source
+/// \param output_code: code block to which the necessary code is added
+void allocate_dynamic_object_with_decl(
+  const exprt &target_expr,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  code_blockt &output_code)
+{
+  std::vector<const symbolt *> symbols_created;
+  code_blockt tmp_block;
+  const typet &allocate_type=target_expr.type().subtype();
+  // We will not use the malloc site and can safely ignore it
+  (void) allocate_dynamic_object(
+    target_expr,
+    allocate_type,
+    symbol_table,
+    loc,
+    tmp_block,
+    symbols_created,
+    false);
+
+  // Add the following code to output_code for each symbol that's been created:
+  //   <type> <identifier>;
+  for(const symbolt * const symbol_ptr : symbols_created)
+  {
+    code_declt decl(symbol_ptr->symbol_expr());
+    decl.add_source_location()=loc;
+    output_code.add(decl);
+  }
+
+  for(const exprt &code : tmp_block.operands())
+    output_code.add(to_code(code));
+}
 
-    if(allocate_type.id()!=ID_empty)
+/// Installs a new symbol in the symbol table, pushing the corresponding symbolt
+/// object to the field `symbols_created` and emits to \p assignments a new
+/// assignment of the form `<target_expr> := address-of(new_object)`.  The
+/// \p allocate_type may differ from `target_expr.type()`, e.g. for target_expr
+/// having type int* and allocate_type being an int[10].
+///
+/// \param assignments: The code block to add code to.
+/// \param target_expr: The expression which we are allocating a symbol for.
+/// \param allocate_type:
+/// \param alloc_type: Allocation type (global, local or dynamic)
+/// \return An address_of_exprt of the newly allocated object.
+exprt java_object_factoryt::allocate_object(
+  code_blockt &assignments,
+  const exprt &target_expr,
+  const typet &allocate_type,
+  allocation_typet alloc_type)
+{
+  const typet &allocate_type_resolved=ns.follow(allocate_type);
+  const typet &target_type=ns.follow(target_expr.type().subtype());
+  bool cast_needed=allocate_type_resolved!=target_type;
+  switch(alloc_type)
+  {
+    case allocation_typet::LOCAL:
+    case allocation_typet::GLOBAL:
     {
-      assert(!object_size.is_nil() && "size of Java objects should be known");
-      // malloc expression
-      exprt malloc_expr=side_effect_exprt(ID_malloc);
-      malloc_expr.copy_to_operands(object_size);
-      typet result_type=pointer_type(allocate_type);
-      malloc_expr.type()=result_type;
-      // Create a symbol for the malloc expression so we can initialize
-      // without having to do it potentially through a double-deref, which
-      // breaks the to-SSA phase.
-      symbolt &malloc_sym=new_tmp_symbol(
-        symbol_table,
-        loc,
-        pointer_type(allocate_type),
-        "malloc_site");
-      symbols_created.push_back(&malloc_sym);
-      code_assignt assign=code_assignt(malloc_sym.symbol_expr(), malloc_expr);
-      code_assignt &malloc_assign=assign;
-      malloc_assign.add_source_location()=loc;
-      assignments.copy_to_operands(malloc_assign);
-      malloc_expr=malloc_sym.symbol_expr();
+      symbolt &aux_symbol=new_tmp_symbol(symbol_table, loc, allocate_type);
+      if(alloc_type==allocation_typet::GLOBAL)
+        aux_symbol.is_static_lifetime=true;
+      symbols_created.push_back(&aux_symbol);
+
+      exprt object=aux_symbol.symbol_expr();
+      exprt aoe=address_of_exprt(object);
       if(cast_needed)
-        malloc_expr=typecast_exprt(malloc_expr, target_expr.type());
-      code_assignt code(target_expr, malloc_expr);
+        aoe=typecast_exprt(aoe, target_expr.type());
+      code_assignt code(target_expr, aoe);
       code.add_source_location()=loc;
       assignments.copy_to_operands(code);
-      return malloc_sym.symbol_expr();
+      return aoe;
     }
-    else
+    case allocation_typet::DYNAMIC:
     {
-      // make null
-      null_pointer_exprt null_pointer_expr(to_pointer_type(target_expr.type()));
-      code_assignt code(target_expr, null_pointer_expr);
-      code.add_source_location()=loc;
-      assignments.copy_to_operands(code);
-      return exprt();
+      return allocate_dynamic_object(
+        target_expr,
+        allocate_type,
+        symbol_table,
+        loc,
+        assignments,
+        symbols_created,
+        cast_needed);
     }
-  }
+    default:
+      UNREACHABLE;
+      return exprt();
+  } // End switch
 }
 
-/// Adds an instruction to `init_code` null-initialising `expr`.
-/// \par parameters: `expr`: pointer-typed lvalue expression to initialise
-/// `ptr_type`: pointer type to write
+/// Returns a codet that assigns \p expr, of type \p ptr_type, a NULL value.
 code_assignt java_object_factoryt::get_null_assignment(
   const exprt &expr,
   const pointer_typet &ptr_type)
@@ -215,23 +345,56 @@ code_assignt java_object_factoryt::get_null_assignment(
   return code;
 }
 
-/// Initialises an object tree rooted at `expr`, allocating child objects as
-/// necessary and nondet-initialising their members, or if MUST_UPDATE_IN_PLACE
-/// is set, re-initialising already-allocated objects.
-/// \par parameters: `expr`: pointer-typed lvalue expression to initialise
-/// `target_type`: structure type to initialise, which may not match *expr (for
-///   example, expr might be void*)
-/// `create_dynamic_objects`: if true, use malloc to allocate objects; otherwise
-///   generate fresh static symbols.
-/// `update_in_place`: NO_UPDATE_IN_PLACE: initialise `expr` from scratch
-///   MUST_UPDATE_IN_PLACE: reinitialise an existing object MAY_UPDATE_IN_PLACE:
-///   invalid input
+/// Initializes the pointer-typed lvalue expression `expr` to point to an object
+/// of type `target_type`, recursively nondet-initializing the members of that
+/// object. Code emitted mainly depends on \p update_in_place:
+///
+/// When in NO_UPDATE_IN_PLACE mode, the code emitted looks like:
+///
+/// ```
+///   struct new_object obj; // depends on alloc_type
+///   <expr> := &obj
+///   // recursive initialization of obj in NO_UPDATE_IN_PLACE mode
+/// ```
+///
+/// When in MUST_UPDATE_IN_PLACE mode, all code is emitted by a recursive call
+/// to gen_nondet_init in MUST_UPDATE_IN_PLACE mode, and looks like:
+///
+/// ```
+///   (*<expr>).some_int := NONDET(int)
+///   (*<expr>).some_char := NONDET(char)
+/// ```
+/// It is illegal to call the function with MAY_UPDATE_IN_PLACE.
+///
+/// \param[out] assignments:
+///   A code_blockt where the initialization code will be emitted to.
+/// \param expr:
+///   Pointer-typed lvalue expression to initialize.
+///   The pointed type equals \p target_type.
+/// \param target_type:
+///   Structure type to initialize, which may not match `*expr` (for example,
+///   `expr` might be have type void*). It cannot be a pointer to a primitive
+///   type because Java does not allow so.
+/// \param alloc_type:
+///   Allocation type (global, local or dynamic)
+/// \param depth:
+///   Number of times that a pointer has been dereferenced from the root of the
+///   object tree that we are initializing.
+/// \param update_in_place:
+///   NO_UPDATE_IN_PLACE: initialize `expr` from scratch
+///   MUST_UPDATE_IN_PLACE: reinitialize an existing object
+///   MAY_UPDATE_IN_PLACE: invalid input
 void java_object_factoryt::gen_pointer_target_init(
   code_blockt &assignments,
   const exprt &expr,
   const typet &target_type,
-  bool create_dynamic_objects)
+  allocation_typet alloc_type,
+  size_t depth,
+  update_in_placet update_in_place)
 {
+  PRECONDITION(expr.type().id()==ID_pointer);
+  PRECONDITION(update_in_place!=update_in_placet::MAY_UPDATE_IN_PLACE);
+
   if(target_type.id()==ID_struct &&
      has_prefix(
        id2string(to_struct_type(target_type).get_tag()),
@@ -239,78 +402,275 @@ void java_object_factoryt::gen_pointer_target_init(
   {
     gen_nondet_array_init(
       assignments,
-      expr);
+      expr,
+      depth+1,
+      update_in_place);
   }
   else
   {
+    // obtain a target pointer to initialize; if in MUST_UPDATE_IN_PLACE mode we
+    // initialize the fields of the object pointed by `expr`; if in
+    // NO_UPDATE_IN_PLACE then we allocate a new object, get a pointer to it
+    // (return value of `allocate_object`), emit a statement of the form
+    // `<expr> := address-of(<new-object>)` and recursively initialize such new
+    // object.
     exprt target;
-    target=allocate_object(
-      assignments,
-      expr,
-      target_type,
-      create_dynamic_objects);
+    if(update_in_place==update_in_placet::NO_UPDATE_IN_PLACE)
+    {
+      target=allocate_object(
+        assignments,
+        expr,
+        target_type,
+        alloc_type);
+      INVARIANT(
+        target.type().id()==ID_pointer,
+        "Pointer-typed expression expected");
+    }
+    else
+    {
+      target=expr;
+    }
+
+    // we dereference the pointer and initialize the resulting object using a
+    // recursive call
     exprt init_expr;
     if(target.id()==ID_address_of)
       init_expr=target.op0();
     else
+    {
       init_expr=
         dereference_exprt(target, target.type().subtype());
+    }
     gen_nondet_init(
       assignments,
       init_expr,
-      false,
-      "",
-      create_dynamic_objects,
-      false,
-      typet());
+      false,   // is_sub
+      "",      // class_identifier
+      false,   // skip_classid
+      alloc_type,
+      false,   // override
+      typet(), // override type immaterial
+      true,    // allow_null always enabled in sub-objects
+      depth+1,
+      update_in_place);
   }
 }
 
-/// Initialises a primitive or object tree rooted at `expr`, of type pointer. It
-/// allocates child objects as necessary and nondet-initialising their members,
-/// \param assignments - the code block we are building with
-///   initilisation code
-/// \param expr: lvalue expression to initialise
-/// \param class_identifier - the name of the class so we can identify
-/// special cases where a null pointer is not applicable.
-/// \param create_dynamic_objects: if true, use malloc to allocate objects;
-///   otherwise generate fresh static symbols.
-/// \param pointer_type - The type of the pointer we are initalising
+/// Recursion-set entry owner class. If a recursion-set entry is added
+/// in a particular scope, ensures that it is erased on leaving
+/// that scope.
+class recursion_set_entryt
+{
+  /// Recursion set to modify
+  std::unordered_set<irep_idt, irep_id_hash> &recursion_set;
+  /// Entry to erase on destruction, if non-empty
+  irep_idt erase_entry;
+
+public:
+  /// Initialize a recursion-set entry owner operating on a given set.
+  /// Initially it does not own any set entry.
+  /// \param _recursion_set: set to operate on.
+  recursion_set_entryt(std::unordered_set<irep_idt, irep_id_hash> &_recursion_set):
+    recursion_set(_recursion_set)
+  { }
+
+  /// Removes erase_entry (if set) from the controlled set.
+  ~recursion_set_entryt()
+  {
+    if(erase_entry!=irep_idt())
+      recursion_set.erase(erase_entry);
+  }
+
+  recursion_set_entryt(const recursion_set_entryt &)=delete;
+  recursion_set_entryt &operator=(const recursion_set_entryt &)=delete;
+
+  /// Try to add an entry to the controlled set. If it is added, own that
+  /// entry and erase it on destruction; otherwise do nothing.
+  /// \param entry: entry to add
+  /// \return true if added to the set (and therefore owned by this object)
+  bool insert_entry(const irep_idt &entry)
+  {
+    INVARIANT(
+      erase_entry==irep_idt(),
+      "insert_entry should only be called once");
+    INVARIANT(entry!=irep_idt(), "entry should be a struct tag");
+    bool ret=recursion_set.insert(entry).second;
+    if(ret)
+    {
+      // We added something, so erase it when this is destroyed:
+      erase_entry=entry;
+    }
+    return ret;
+  }
+};
+
+/// Initializes a pointer \p expr of type \p pointer_type to a primitive-typed
+/// value or an object tree.  It allocates child objects as necessary and
+/// nondet-initializes their members, or if MUST_UPDATE_IN_PLACE is set,
+/// re-initializes already-allocated objects.
+///
+/// \param assignments:
+///   The code block we are building with initialization code.
+/// \param expr:
+///   Pointer-typed lvalue expression to initialize.
+/// \param class_identifier:
+///   Name of the parent class. Used to initialize the `@class_identifier` among
+///   others.
+/// \param alloc_type:
+///   Allocation type (global, local or dynamic)
+/// \param allow_null:
+///   true iff the the non-det initialization code is allowed to set null as a
+///   value to the pointer \p expr; note that the current value of allow_null is
+///   _not_ inherited by subsequent recursive calls; those will always be
+///   authorized to assign null to a pointer
+/// \param depth:
+///   Number of times that a pointer has been dereferenced from the root of the
+///   object tree that we are initializing.
+/// \param pointer_type:
+///   The type of the pointer we are initalizing
+/// \param update_in_place:
+///   * NO_UPDATE_IN_PLACE: initialize `expr` from scratch
+///   * MAY_UPDATE_IN_PLACE: generate a runtime nondet branch between the NO_
+///     and MUST_ cases.
+///   * MUST_UPDATE_IN_PLACE: reinitialize an existing object
 void java_object_factoryt::gen_nondet_pointer_init(
   code_blockt &assignments,
   const exprt &expr,
   const irep_idt &class_identifier,
-  bool create_dynamic_objects,
-  const pointer_typet &pointer_type)
+  allocation_typet alloc_type,
+  const pointer_typet &pointer_type,
+  bool allow_null,
+  size_t depth,
+  const update_in_placet &update_in_place)
 {
-  const typet &subtype=ns.follow(pointer_type.subtype());
+  PRECONDITION(expr.type().id()==ID_pointer);
+
+  const pointer_typet &replacement_pointer_type=
+    pointer_type_selector.convert_pointer_type(pointer_type, ns);
+
+  // If we are changing the pointer, we generate code for creating a pointer
+  // to the substituted type instead
+  if(replacement_pointer_type!=pointer_type)
+  {
+    const symbol_exprt real_pointer_symbol=gen_nondet_subtype_pointer_init(
+      assignments,
+      alloc_type,
+      replacement_pointer_type,
+      depth);
+
+    // Having created a pointer to object of type replacement_pointer_type
+    // we now assign it back to the original pointer with a cast
+    // from pointer_type to replacement_pointer_type
+    assignments.add(
+      code_assignt(expr, typecast_exprt(real_pointer_symbol, pointer_type)));
+    return;
+  }
 
+  // This deletes the recursion set entry on leaving this function scope,
+  // if one is set below.
+  recursion_set_entryt recursion_set_entry(recursion_set);
+
+  // If the pointed value is struct-typed, then we need to prevent the
+  // possibility of this code to loop infinitely when initializing a data
+  // structure with recursive types or unbounded depth.  We implement two
+  // mechanisms here. We keep a set of 'types seen', and detect when we perform
+  // a 2nd visit to the same type.  We also detect the depth in the chain of
+  // (recursive) calls to the methods of this class. The depth counter is
+  // incremented only when a pointer is deferenced, including pointers to
+  // arrays.
+  //
+  // When we visit for 2nd time a type AND the maximum depth is exceeded, we set
+  // the pointer to NULL instead of recursively initializing the struct to which
+  // it points.
+  const typet &subtype=ns.follow(pointer_type.subtype());
   if(subtype.id()==ID_struct)
   {
     const struct_typet &struct_type=to_struct_type(subtype);
-    const irep_idt struct_tag=struct_type.get_tag();
-    // set to null if found in recursion set and not a sub-type
-    if(recursion_set.find(struct_tag)!=recursion_set.end() &&
-       struct_tag==class_identifier)
+    const irep_idt &struct_tag=struct_type.get_tag();
+
+    // If this is a recursive type of some kind AND the depth is exceeded, set
+    // the pointer to null.
+    if(!recursion_set_entry.insert_entry(struct_tag) &&
+      depth>=max_nondet_tree_depth)
     {
-      assignments.copy_to_operands(
-        get_null_assignment(expr, pointer_type));
+      if(update_in_place==update_in_placet::NO_UPDATE_IN_PLACE)
+      {
+        assignments.copy_to_operands(
+          get_null_assignment(expr, pointer_type));
+      }
+      // Otherwise leave it as it is.
       return;
     }
   }
 
+  code_blockt new_object_assignments;
+  code_blockt update_in_place_assignments;
+
+  // if the initialization mode is MAY_UPDATE or MUST_UPDATE in place, then we
+  // emit to `update_in_place_assignments` code for in-place initialization of
+  // the object pointed by `expr`, assuming that such object is of type
+  // `subtype`
+  if(update_in_place!=update_in_placet::NO_UPDATE_IN_PLACE)
+  {
+    gen_pointer_target_init(
+      update_in_place_assignments,
+      expr,
+      subtype,
+      alloc_type,
+      depth,
+      update_in_placet::MUST_UPDATE_IN_PLACE);
+  }
+
+  // if we MUST_UPDATE_IN_PLACE, then the job is done, we copy the code emitted
+  // above to `assignments` and return
+  if(update_in_place==update_in_placet::MUST_UPDATE_IN_PLACE)
+  {
+    assignments.append(update_in_place_assignments);
+    return;
+  }
+
+  // if the mode is NO_UPDATE or MAY_UPDATE in place, then we need to emit a
+  // vector of assignments that create a new object (recursively initializes it)
+  // and asign to `expr` the address of such object
   code_blockt non_null_inst;
   gen_pointer_target_init(
     non_null_inst,
     expr,
     subtype,
-    create_dynamic_objects);
-
-  if(assume_non_null)
+    alloc_type,
+    depth,
+    update_in_placet::NO_UPDATE_IN_PLACE);
+
+  auto set_null_inst=get_null_assignment(expr, pointer_type);
+
+  // Determine whether the pointer can be null. In particular:
+  // - the 'data' of a String should not be null.
+  // - the pointers inside the java.lang.Class class shall not be null
+  bool not_null=
+    !allow_null ||
+    ((class_identifier=="java.lang.String" ||
+      class_identifier=="java.lang.StringBuilder" ||
+      class_identifier=="java.lang.StringBuffer" ||
+      class_identifier=="java.lang.CharSequence") &&
+     subtype.id()==ID_array) ||
+    class_identifier=="java.lang.Class";
+
+  // Alternatively, if this is a void* we *must* initialise with null:
+  // (This can currently happen for some cases of #exception_value)
+  bool must_be_null=
+    subtype==empty_typet();
+
+  if(must_be_null)
+  {
+    // Add the following code to assignments:
+    // <expr> = nullptr;
+    new_object_assignments.add(set_null_inst);
+  }
+  else if(not_null)
   {
     // Add the following code to assignments:
     // <expr> = <aoe>;
-    assignments.append(non_null_inst);
+    new_object_assignments.append(non_null_inst);
   }
   else
   {
@@ -323,49 +683,132 @@ void java_object_factoryt::gen_nondet_pointer_init(
     //    <code from recursive call to gen_nondet_init() with
     //             tmp$<temporary_counter>>
     // }
-    auto set_null_inst=get_null_assignment(expr, pointer_type);
-
     code_ifthenelset null_check;
     null_check.cond()=side_effect_expr_nondett(bool_typet());
     null_check.then_case()=set_null_inst;
     null_check.else_case()=non_null_inst;
 
-    assignments.add(null_check);
+    new_object_assignments.add(null_check);
+  }
+
+  // Similarly to above, maybe use a conditional if both the
+  // allocate-fresh and update-in-place cases are allowed:
+  if(update_in_place==update_in_placet::NO_UPDATE_IN_PLACE)
+  {
+    assignments.append(new_object_assignments);
+  }
+  else
+  {
+    INVARIANT(update_in_place==update_in_placet::MAY_UPDATE_IN_PLACE,
+      "No-update and must-update should have already been resolved");
+
+    code_ifthenelset update_check;
+    update_check.cond()=side_effect_expr_nondett(bool_typet());
+    update_check.then_case()=update_in_place_assignments;
+    update_check.else_case()=new_object_assignments;
+
+    assignments.add(update_check);
   }
 }
 
-/// Initialises an object tree rooted at `expr`, allocating child objects as
-/// necessary and nondet-initialising their members.
-/// \param assignments: The code block to append the new
-///   instructions to
-/// \param expr: pointer-typed lvalue expression to initialise
-/// \param is_sub: If true, `expr` is a substructure of a larger object, which
-///   in Java necessarily means a base class. not match *expr (for example, expr
-///   might be void*)
-/// \param class_identifier: clsid to initialise @java.lang.Object.
-///   @class_identifier
-/// \param create_dynamic_objects: if true, use malloc to allocate objects;
-///   otherwise generate fresh static symbols.
-/// \param struct_type - The type of the struct we are initalising
+/// Generate codet assignments to initalize the selected concrete type.
+/// Generated code looks as follows (here A = replacement_pointer.subtype()):
+///
+///   // allocate memory for a new object, depends on `alloc_type`
+///   A { ... } tmp_object;
+///
+///   // non-det init all the fields of A
+///   A.x = NONDET(...)
+///   A.y = NONDET(...)
+///
+///   // assign `expr` with a suitably casted pointer to new_object
+///   A * p = &tmp_object
+///
+/// \param assignments
+///   A block of code where we append the generated code.
+/// \param alloc_type: Allocation type (global, local or dynamic)
+/// \param replacement_pointer
+///   The type of the pointer we actually want to to create.
+/// \param depth:
+///   Number of times that a pointer has been dereferenced from the root of the
+///   object tree that we are initializing.
+/// \return
+///   A symbol expression of type \p replacement_pointer corresponding to a
+///   pointer to object `tmp_object` (see above).
+symbol_exprt java_object_factoryt::gen_nondet_subtype_pointer_init(
+  code_blockt &assignments,
+  allocation_typet alloc_type,
+  const pointer_typet &replacement_pointer,
+  size_t depth)
+{
+  symbolt new_symbol=new_tmp_symbol(symbol_table, loc, replacement_pointer);
+
+  // Generate a new object into this new symbol
+  gen_nondet_init(
+    assignments,
+    new_symbol.symbol_expr(),
+    false,   // is_sub
+    "",      // class_identifier
+    false,   // skip_classid
+    alloc_type,
+    false,   // override
+    typet(), // override_type
+    true,    // allow_null
+    depth,
+    update_in_placet::NO_UPDATE_IN_PLACE);
+
+  return new_symbol.symbol_expr();
+}
+
+/// Initializes an object tree rooted at `expr`, allocating child objects as
+/// necessary and nondet-initializes their members, or if MUST_UPDATE_IN_PLACE
+/// is set, re-initializes already-allocated objects.
+///
+/// \param assignments:
+///   The code block to append the new instructions to.
+/// \param expr
+///   Struct-typed lvalue expression to initialize.
+/// \param is_sub:
+///   If true, `expr` is a substructure of a larger object, which in Java
+///   necessarily means a base class.
+/// \param class_identifier:
+///   Name of the parent class. Used to initialize the `@class_identifier` among
+///   others.
+/// \param skip_classid:
+///   If true, skip initializing `@class_identifier`.
+/// \param alloc_type:
+///   Allocation type (global, local or dynamic)
+/// \param struct_type:
+///   The type of the struct we are initalizing.
+/// \param depth:
+///   Number of times that a pointer has been dereferenced from the root of the
+///   object tree that we are initializing.
+/// \param update_in_place:
+///   NO_UPDATE_IN_PLACE: initialize `expr` from scratch
+///   MUST_UPDATE_IN_PLACE: reinitialize an existing object
+///   MAY_UPDATE_IN_PLACE: invalid input
 void java_object_factoryt::gen_nondet_struct_init(
   code_blockt &assignments,
   const exprt &expr,
   bool is_sub,
   irep_idt class_identifier,
-  bool create_dynamic_objects,
-  const struct_typet &struct_type)
+  bool skip_classid,
+  allocation_typet alloc_type,
+  const struct_typet &struct_type,
+  size_t depth,
+  const update_in_placet &update_in_place)
 {
-  typedef struct_typet::componentst componentst;
+  PRECONDITION(ns.follow(expr.type()).id()==ID_struct);
+  PRECONDITION(struct_type.id()==ID_struct);
 
-  const irep_idt struct_tag=struct_type.get_tag();
+  typedef struct_typet::componentst componentst;
+  const irep_idt &struct_tag=struct_type.get_tag();
 
   const componentst &components=struct_type.components();
 
   if(!is_sub)
     class_identifier=struct_tag;
 
-  recursion_set.insert(struct_tag);
-
   for(const auto &component : components)
   {
     const typet &component_type=component.type();
@@ -375,6 +818,12 @@ void java_object_factoryt::gen_nondet_struct_init(
 
     if(name=="@class_identifier")
     {
+      if(update_in_place==update_in_placet::MUST_UPDATE_IN_PLACE)
+        continue;
+
+      if(skip_classid)
+        continue;
+
       irep_idt qualified_clsid="java::"+as_string(class_identifier);
       constant_exprt ci(qualified_clsid, string_typet());
       code_assignt code(me, ci);
@@ -383,6 +832,8 @@ void java_object_factoryt::gen_nondet_struct_init(
     }
     else if(name=="@lock")
     {
+      if(update_in_place==update_in_placet::MUST_UPDATE_IN_PLACE)
+        continue;
       code_assignt code(me, from_integer(0, me.type()));
       code.add_source_location()=loc;
       assignments.copy_to_operands(code);
@@ -393,39 +844,81 @@ void java_object_factoryt::gen_nondet_struct_init(
 
       bool _is_sub=name[0]=='@';
 
+      // MUST_UPDATE_IN_PLACE only applies to this object.
+      // If this is a pointer to another object, offer the chance
+      // to leave it alone by setting MAY_UPDATE_IN_PLACE instead.
+      update_in_placet substruct_in_place=
+        update_in_place==update_in_placet::MUST_UPDATE_IN_PLACE && !_is_sub ?
+        update_in_placet::MAY_UPDATE_IN_PLACE :
+        update_in_place;
       gen_nondet_init(
         assignments,
         me,
         _is_sub,
         class_identifier,
-        create_dynamic_objects);
+        false,   // skip_classid
+        alloc_type,
+        false,   // override
+        typet(), // override_type
+        true,    // allow_null always true for sub-objects
+        depth,
+        substruct_in_place);
     }
   }
-  recursion_set.erase(struct_tag);
 }
 
-/// Creates a nondet for expr, including calling itself recursively to make
-/// appropriate symbols to point to if expr is a pointer or struct
-/// \param expr: The expression which we are generating a non-determinate value
-///   for
+/// Initializes a primitive-typed or referece-typed object tree rooted at
+/// `expr`, allocating child objects as necessary and nondet-initializing their
+/// members, or if MUST_UPDATE_IN_PLACE is set, re-initializing
+/// already-allocated objects.
+///
+/// \param assignments:
+///   A code block where the initializing assignments will be appended to.
+/// \param expr:
+///   Lvalue expression to initialize.
 /// \param is_sub:
+///   If true, `expr` is a substructure of a larger object, which in Java
+///   necessarily means a base class.
 /// \param class_identifier:
-/// \param create_dynamic_objects: If true, allocate variables on the heap
-/// \param override: Ignore the LHS' real type. Used at the moment for reference
-///   arrays, which are implemented as void* arrays but should be init'd as
-///   their true type with appropriate casts.
-/// \param override_type: Type to use if ignoring the LHS' real type
+///   Name of the parent class. Used to initialize the `@class_identifier` among
+///   others.
+/// \param skip_classid:
+///   If true, skip initializing `@class_identifier`.
+/// \param alloc_type:
+///   Allocation type (global, local or dynamic)
+/// \param override_:
+///   If true, initialize with `override_type` instead of `expr.type()`. Used at
+///   the moment for reference arrays, which are implemented as void* arrays but
+///   should be init'd as their true type with appropriate casts.
+/// \param allow_null:
+///   True iff the the non-det initialization code is allowed to set null as a
+///   value to a pointer.
+/// \param depth:
+///   Number of times that a pointer has been dereferenced from the root of the
+///   object tree that we are initializing.
+/// \param override_type:
+///   Override type per above.
+/// \param update_in_place:
+///   NO_UPDATE_IN_PLACE: initialize `expr` from scratch
+///   MAY_UPDATE_IN_PLACE: generate a runtime nondet branch between the NO_
+///   and MUST_ cases.
+///   MUST_UPDATE_IN_PLACE: reinitialize an existing object
 void java_object_factoryt::gen_nondet_init(
   code_blockt &assignments,
   const exprt &expr,
   bool is_sub,
   irep_idt class_identifier,
-  bool create_dynamic_objects,
-  bool override,
-  const typet &override_type)
+  bool skip_classid,
+  allocation_typet alloc_type,
+  bool override_,
+  const typet &override_type,
+  bool allow_null,
+  size_t depth,
+  update_in_placet update_in_place)
 {
   const typet &type=
-    override ? ns.follow(override_type) : ns.follow(expr.type());
+    override_ ? ns.follow(override_type) : ns.follow(expr.type());
+
 
   if(type.id()==ID_pointer)
   {
@@ -435,22 +928,30 @@ void java_object_factoryt::gen_nondet_init(
       assignments,
       expr,
       class_identifier,
-      create_dynamic_objects,
-      pointer_type);
+      alloc_type,
+      pointer_type,
+      allow_null,
+      depth,
+      update_in_place);
   }
   else if(type.id()==ID_struct)
   {
-    const struct_typet &struct_type=to_struct_type(type);
+    const struct_typet struct_type=to_struct_type(type);
     gen_nondet_struct_init(
       assignments,
       expr,
       is_sub,
       class_identifier,
-      create_dynamic_objects,
-      struct_type);
+      skip_classid,
+      alloc_type,
+      struct_type,
+      depth,
+      update_in_place);
   }
   else
   {
+    // types different from pointer or structure:
+    // bool, int, float, byte, char, ...
     exprt rhs=type.id()==ID_c_bool?
       get_nondet_bool(type):
       side_effect_expr_nondett(type);
@@ -461,14 +962,18 @@ void java_object_factoryt::gen_nondet_init(
   }
 }
 
-/// Allocates a fresh array. Single-use at the moment, but useful to keep
-/// as a separate function for downstream branches.
-/// \par parameters: `lhs`, symbol to assign the new array structure
-/// `max_length_expr`, maximum length of the new array (minimum is fixed at zero
-///   for now)
-/// `element_type`, actual element type of the array (the array for all
-///   reference types will have void* type, but this will be annotated as the
-///   true member type)
+/// Allocates a fresh array and emits an assignment writing to \p lhs the
+/// address of the new array.  Single-use at the moment, but useful to keep as a
+/// separate function for downstream branches.
+/// \param[out] assignments:
+///   Code is emitted here.
+/// \param lhs:
+///   Symbol to assign the new array structure.
+/// \param max_length_expr:
+///   Maximum length of the new array (minimum is fixed at zero for now).
+/// \param element_type:
+///   Actual element type of the array (the array for all reference types will
+///   have void* type, but this will be annotated as the true member type).
 /// \return Appends instructions to `assignments`
 void java_object_factoryt::allocate_nondet_length_array(
   code_blockt &assignments,
@@ -485,7 +990,18 @@ void java_object_factoryt::allocate_nondet_length_array(
   const auto &length_sym_expr=length_sym.symbol_expr();
 
   // Initialize array with some undetermined length:
-  gen_nondet_init(assignments, length_sym_expr, false, irep_idt(), false);
+  gen_nondet_init(
+    assignments,
+    length_sym_expr,
+    false,   // is_sub
+    irep_idt(),
+    false,   // skip_classid
+    allocation_typet::LOCAL, // immaterial, type is primitive
+    false,   // override
+    typet(), // override type is immaterial
+    false,   // allow_null
+    0,       // depth is immaterial
+    update_in_placet::NO_UPDATE_IN_PLACE);
 
   // Insert assumptions to bound its length:
   binary_relation_exprt
@@ -506,26 +1022,46 @@ void java_object_factoryt::allocate_nondet_length_array(
   assignments.copy_to_operands(assign);
 }
 
-/// create code to initialize a Java array with size `max_nondet_array_length`,
-/// loop over elements and initialize them
+/// Create code to initialize a Java array whose size will be at most
+/// `max_nondet_array_length`. The code is emitted to \p assignments does as
+/// follows:
+/// 1. non-deterministically choose a length for the array
+/// 2. assume that such length is >=0 and <= max_length
+/// 3. loop through all elements of the array and initialize them
 void java_object_factoryt::gen_nondet_array_init(
   code_blockt &assignments,
-  const exprt &expr)
+  const exprt &expr,
+  size_t depth,
+  update_in_placet update_in_place)
 {
-  assert(expr.type().id()==ID_pointer);
+  PRECONDITION(expr.type().id()==ID_pointer);
+  PRECONDITION(expr.type().subtype().id()==ID_symbol);
+  PRECONDITION(update_in_place!=update_in_placet::MAY_UPDATE_IN_PLACE);
+
   const typet &type=ns.follow(expr.type().subtype());
   const struct_typet &struct_type=to_struct_type(type);
-  assert(expr.type().subtype().id()==ID_symbol);
   const typet &element_type=
     static_cast<const typet &>(expr.type().subtype().find(ID_C_element_type));
 
   auto max_length_expr=from_integer(max_nondet_array_length, java_int_type());
 
-  allocate_nondet_length_array(
-    assignments,
-    expr,
-    max_length_expr,
-    element_type);
+  // In NO_UPDATE_IN_PLACE mode we allocate a new array and recursively
+  // initialize its elements
+  if(update_in_place==update_in_placet::NO_UPDATE_IN_PLACE)
+  {
+    allocate_nondet_length_array(
+      assignments,
+      expr,
+      max_length_expr,
+      element_type);
+  }
+
+  // Otherwise we're updating the array in place, and use the
+  // existing array allocation and length.
+
+  INVARIANT(
+    is_valid_java_array(struct_type),
+    "Java struct array does not conform to expectations");
 
   dereference_exprt deref_expr(expr, expr.type().subtype());
   const auto &comps=struct_type.components();
@@ -578,26 +1114,41 @@ void java_object_factoryt::gen_nondet_array_init(
 
   assignments.move_to_operands(done_test);
 
-  // Add a redundant if(counter == max_length) break that is easier for the
-  // unwinder to understand.
-  code_ifthenelset max_test;
-  max_test.cond()=equal_exprt(counter_expr, max_length_expr);
-  max_test.then_case()=goto_done;
+  if(update_in_place!=update_in_placet::MUST_UPDATE_IN_PLACE)
+  {
+    // Add a redundant if(counter == max_length) break
+    // that is easier for the unwinder to understand.
+    code_ifthenelset max_test;
+    max_test.cond()=equal_exprt(counter_expr, max_length_expr);
+    max_test.then_case()=goto_done;
 
-  assignments.move_to_operands(max_test);
+    assignments.move_to_operands(max_test);
+  }
 
   exprt arraycellref=dereference_exprt(
     plus_exprt(array_init_symexpr, counter_expr, array_init_symexpr.type()),
     array_init_symexpr.type().subtype());
 
+  // MUST_UPDATE_IN_PLACE only applies to this object.
+  // If this is a pointer to another object, offer the chance
+  // to leave it alone by setting MAY_UPDATE_IN_PLACE instead.
+  update_in_placet child_update_in_place=
+    update_in_place==update_in_placet::MUST_UPDATE_IN_PLACE ?
+    update_in_placet::MAY_UPDATE_IN_PLACE :
+    update_in_place;
   gen_nondet_init(
     assignments,
     arraycellref,
-    false,
-    irep_idt(),
-    true,
-    true,
-    element_type);
+    false, // is_sub
+    irep_idt(), // class_identifier
+    false, // skip_classid
+    // These are variable in number, so use dynamic allocator:
+    allocation_typet::DYNAMIC,
+    true,  // override
+    element_type,
+    true,  // allow_null
+    depth,
+    child_update_in_place);
 
   exprt java_one=from_integer(1, java_int_type());
   code_assignt incr(counter_expr, plus_exprt(counter_expr, java_one));
@@ -607,6 +1158,40 @@ void java_object_factoryt::gen_nondet_array_init(
   assignments.move_to_operands(init_done_label);
 }
 
+/// Add code_declt instructions to `init_code` for every non-static symbol
+/// in `symbols_created`
+/// \param symbols_created: list of symbols
+/// \param loc: source location for new code_declt instances
+/// \param [out] init_code: gets code_declt for each symbol
+static void declare_created_symbols(
+  const std::vector<const symbolt *> &symbols_created,
+  const source_locationt &loc,
+  code_blockt &init_code)
+{
+  // Add the following code to init_code for each symbol that's been created:
+  //   <type> <identifier>;
+  for(const symbolt * const symbol_ptr : symbols_created)
+  {
+    if(!symbol_ptr->is_static_lifetime)
+    {
+      code_declt decl(symbol_ptr->symbol_expr());
+      decl.add_source_location()=loc;
+      init_code.add(decl);
+    }
+  }
+}
+
+/// Similar to `gen_nondet_init` below, but instead of allocating and
+/// non-deterministically initializing the the argument `expr` passed to that
+/// function, we create a static global object of type \p type and
+/// non-deterministically initialize it.
+///
+/// See gen_nondet_init for a description of the parameters.
+/// The only new one is \p type, which is the type of the object to create.
+///
+/// \return The object created, the \p symbol_table gains any new symbols
+/// created, and \p init_code gains any instructions requried to initialize
+/// either the returned value or its child objects
 exprt object_factory(
   const typet &type,
   const irep_idt base_name,
@@ -614,7 +1199,10 @@ exprt object_factory(
   bool allow_null,
   symbol_tablet &symbol_table,
   size_t max_nondet_array_length,
-  const source_locationt &loc)
+  size_t max_nondet_tree_depth,
+  allocation_typet alloc_type,
+  const source_locationt &loc,
+  const select_pointer_typet &pointer_type_selector)
 {
   irep_idt identifier=id2string(goto_functionst::entry_point())+
     "::"+id2string(base_name);
@@ -631,34 +1219,172 @@ exprt object_factory(
 
   symbolt *main_symbol_ptr;
   bool moving_symbol_failed=symbol_table.move(main_symbol, main_symbol_ptr);
-  assert(!moving_symbol_failed);
+  CHECK_RETURN(!moving_symbol_failed);
 
   std::vector<const symbolt *> symbols_created;
   symbols_created.push_back(main_symbol_ptr);
-
   java_object_factoryt state(
     symbols_created,
     loc,
-    !allow_null,
     max_nondet_array_length,
-    symbol_table);
+    max_nondet_tree_depth,
+    symbol_table,
+    pointer_type_selector);
   code_blockt assignments;
   state.gen_nondet_init(
     assignments,
     object,
-    false,
-    "",
-    false);
-
-  // Add the following code to init_code for each symbol that's been created:
-  //   <type> <identifier>;
-  for(const symbolt * const symbol_ptr : symbols_created)
-  {
-    code_declt decl(symbol_ptr->symbol_expr());
-    decl.add_source_location()=loc;
-    init_code.add(decl);
-  }
+    false,   // is_sub
+    "",      // class_identifier
+    false,   // skip_classid
+    alloc_type,
+    false,   // override
+    typet(), // override_type is immaterial
+    allow_null,
+    0,       // initial depth
+    update_in_placet::NO_UPDATE_IN_PLACE);
+
+  declare_created_symbols(symbols_created, loc, init_code);
 
   init_code.append(assignments);
   return object;
 }
+
+/// Initializes a primitive-typed or referece-typed object tree rooted at
+/// `expr`, allocating child objects as necessary and nondet-initializing their
+/// members, or if MAY_ or MUST_UPDATE_IN_PLACE is set, re-initializing
+/// already-allocated objects.
+///
+/// \param expr:
+///   Lvalue expression to initialize.
+/// \param[out] init_code:
+///   A code block where the initializing assignments will be appended to.
+///   It gets an instruction sequence to initialize or reinitialize `expr` and
+///   child objects it refers to.
+/// \param symbol_table:
+///   The symbol table, where new variables created as a result of emitting code
+///   to \p init_code will be inserted to.  This includes any necessary
+///   temporaries, and if `create_dyn_objs` is false, any allocated objects.
+/// \param loc:
+///   Source location to which all generated code will be associated to.
+/// \param skip_classid:
+///   If true, skip initializing field `@class_identifier`.
+/// \param alloc_type:
+///   Allocate new objects as global objects (GLOBAL) or as local variables
+///   (LOCAL) or using malloc (DYNAMIC).
+/// \param allow_null:
+///   When \p expr is a pointer, the non-det initializing code will
+///   unconditionally set \p expr to a non-null object iff \p allow_null is
+///   true. Note that other references down the object hierarchy *can* be null
+///   when \p allow_null is false (as this parameter is not inherited by
+///   subsequent recursive calls).  Has no effect when \p expr is not
+///   pointer-typed.
+/// \param max_nondet_array_length:
+///   Upper bound on size of initialized arrays.
+/// \param max_nondet_tree_depth:
+///   Maximum depth in the object hirearchy (counted as the number of times a
+///   pointer is deferenced) created by the initialization code that will be
+///   emitted here.
+/// \param pointer_type_selector:
+///   The pointer_selector to use to resolve pointer types where required.
+/// \param update_in_place:
+///   NO_UPDATE_IN_PLACE: initialize `expr` from scratch
+///   MAY_UPDATE_IN_PLACE: generate a runtime nondet branch between the NO_
+///   and MUST_ cases.
+///   MUST_UPDATE_IN_PLACE: reinitialize an existing object
+/// \return `init_code` gets an instruction sequence to initialize or
+///   reinitialize `expr` and child objects it refers to. `symbol_table` is
+///   modified with any new symbols created. This includes any necessary
+///   temporaries, and if `create_dyn_objs` is false, any allocated objects.
+void gen_nondet_init(
+  const exprt &expr,
+  code_blockt &init_code,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  bool skip_classid,
+  allocation_typet alloc_type,
+  bool allow_null,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  const select_pointer_typet &pointer_type_selector,
+  update_in_placet update_in_place)
+{
+  std::vector<const symbolt *> symbols_created;
+
+  java_object_factoryt state(
+    symbols_created,
+    loc,
+    max_nondet_array_length,
+    max_nondet_tree_depth,
+    symbol_table,
+    pointer_type_selector);
+  code_blockt assignments;
+  state.gen_nondet_init(
+    assignments,
+    expr,
+    false,   // is_sub
+    "",      // class_identifier
+    skip_classid,
+    alloc_type,
+    false,   // override
+    typet(), // override_type is immaterial
+    allow_null,
+    0,       // initial depth
+    update_in_place);
+
+  declare_created_symbols(symbols_created, loc, init_code);
+
+  init_code.append(assignments);
+}
+
+/// Call object_factory() above with a default (identity) pointer_type_selector
+exprt object_factory(const typet &type,
+  const irep_idt base_name,
+  code_blockt &init_code,
+  bool allow_null,
+  symbol_tablet &symbol_table,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  allocation_typet alloc_type,
+  const source_locationt &location)
+{
+  select_pointer_typet pointer_type_selector;
+  return object_factory(
+    type,
+    base_name,
+    init_code,
+    allow_null,
+    symbol_table,
+    max_nondet_array_length,
+    max_nondet_tree_depth,
+    alloc_type,
+    location,
+    pointer_type_selector);
+}
+
+/// Call gen_nondet_init() above with a default (identity) pointer_type_selector
+void gen_nondet_init(const exprt &expr,
+  code_blockt &init_code,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  bool skip_classid,
+  allocation_typet alloc_type,
+  bool allow_null,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  update_in_placet update_in_place)
+{
+  select_pointer_typet pointer_type_selector;
+  gen_nondet_init(
+    expr,
+    init_code,
+    symbol_table,
+    loc,
+    skip_classid,
+    alloc_type,
+    allow_null,
+    max_nondet_array_length,
+    max_nondet_tree_depth,
+    pointer_type_selector,
+    update_in_place);
+}
diff --git a/src/java_bytecode/java_object_factory.h b/src/java_bytecode/java_object_factory.h
index cefd152f10d..c08b6341877 100644
--- a/src/java_bytecode/java_object_factory.h
+++ b/src/java_bytecode/java_object_factory.h
@@ -6,6 +6,64 @@ Author: Daniel Kroening, kroening@kroening.com
 
 \*******************************************************************/
 
+/// \file
+/// This module is responsible for the synthesis of code (in the form of a
+/// sequence of codet statements) that can allocate and initialize
+/// non-deterministically both primitive Java types and objects. The
+/// non-deterministic initialization of one object triggers the
+/// non-deterministic initialization of all its fields, which in turn could be
+/// references to other objects. We thus speak about an object tree.
+///
+/// This is useful for, e.g., the creation of a verification harness (non-det
+/// initialization of the parameters of the method to verify), mocking methods
+/// that are called but for which we don't have a body (overapproximating the
+/// return value and possibly side effects).
+///
+/// The two main APIs are \ref gen_nondet_init() and \ref object_factory(), at
+/// the bottom of the file.  Their purpose is very similar. A call to
+///
+///   gen_nondet_init(expr, code, ..., update_in_place)
+///
+/// appends to `code` (a code_blockt) a sequence of statements that
+/// non-deterministically initialize the `expr` (which is expected to be an
+/// l-value exprt) with a primitive or reference value of type equal to or
+/// compatible with `expr.type()` -- see documentation for the argument
+/// `pointer_type_selector` for additional details.
+///
+/// The code generated mainly depends on the parameter `update_in_place`. Assume
+/// that `expr` is a reference to an object (in our IR, that means a pointer to
+/// a struct).
+///
+/// When update_in_place == NO_UPDATE_IN_PLACE, the following code is
+/// generated:
+///
+/// ```
+///     struct MyClass object;
+///     if (NONDET(bool))
+///       expr = NULL;
+///     else
+///       expr = &object;
+///       ... // non-det initialization of `object` in NO_UPDATE_IN_PLACE mode
+/// ```
+///
+/// When update_in_place == MUST_UPDATE_IN_PLACE, the following code is
+/// generated (assuming that MyClass has fields "int x" and "OtherClass y"):
+///
+/// ```
+///     expr->x = NONDET(int);
+///     expr->y = ... // non-det initialization in MUST_UPDATE_IN_PLACE mode
+/// ```
+///
+/// When update_in_place == MAY_UPDATE_IN_PLACE, the following code is
+/// generated:
+///
+/// ```
+///     if (NONDET(bool))
+///       ... // non-det initialization of `expr` in MUST_UPDATE_IN_PLACE
+///     else
+///       ... // non-det initialization of `expr` in NO_UPDATE_IN_PLACE
+/// ```
+///
 
 #ifndef CPROVER_JAVA_BYTECODE_JAVA_OBJECT_FACTORY_H
 #define CPROVER_JAVA_BYTECODE_JAVA_OBJECT_FACTORY_H
@@ -14,6 +72,19 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/std_code.h>
 #include <util/symbol_table.h>
 
+#include <java_bytecode/select_pointer_type.h>
+
+/// Selects the kind of allocation used by java_object_factory et al.
+enum class allocation_typet
+{
+  /// Allocate global objects
+  GLOBAL,
+  /// Allocate local stacked objects
+  LOCAL,
+  /// Allocate dynamic objects (using MALLOC)
+  DYNAMIC
+};
+
 exprt object_factory(
   const typet &type,
   const irep_idt base_name,
@@ -21,6 +92,67 @@ exprt object_factory(
   bool allow_null,
   symbol_tablet &symbol_table,
   size_t max_nondet_array_length,
-  const source_locationt &);
+  size_t max_nondet_tree_depth,
+  allocation_typet alloc_type,
+  const source_locationt &location,
+  const select_pointer_typet &pointer_type_selector);
+
+exprt object_factory(
+  const typet &type,
+  const irep_idt base_name,
+  code_blockt &init_code,
+  bool allow_null,
+  symbol_tablet &symbol_table,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  allocation_typet alloc_type,
+  const source_locationt &location);
+
+enum class update_in_placet
+{
+  NO_UPDATE_IN_PLACE,
+  MAY_UPDATE_IN_PLACE,
+  MUST_UPDATE_IN_PLACE
+};
+
+void gen_nondet_init(
+  const exprt &expr,
+  code_blockt &init_code,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  bool skip_classid,
+  allocation_typet alloc_type,
+  bool allow_null,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  const select_pointer_typet &pointer_type_selector,
+  update_in_placet update_in_place);
+
+void gen_nondet_init(
+  const exprt &expr,
+  code_blockt &init_code,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  bool skip_classid,
+  allocation_typet alloc_type,
+  bool allow_null,
+  size_t max_nondet_array_length,
+  size_t max_nondet_tree_depth,
+  update_in_placet update_in_place);
+
+exprt allocate_dynamic_object(
+  const exprt &target_expr,
+  const typet &allocate_type,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  code_blockt &output_code,
+  std::vector<const symbolt *> &symbols_created,
+  bool cast_needed=false);
+
+void allocate_dynamic_object_with_decl(
+  const exprt &target_expr,
+  symbol_tablet &symbol_table,
+  const source_locationt &loc,
+  code_blockt &output_code);
 
 #endif // CPROVER_JAVA_BYTECODE_JAVA_OBJECT_FACTORY_H
diff --git a/src/java_bytecode/java_string_library_preprocess.cpp b/src/java_bytecode/java_string_library_preprocess.cpp
new file mode 100644
index 00000000000..a0de9bfc3c1
--- /dev/null
+++ b/src/java_bytecode/java_string_library_preprocess.cpp
@@ -0,0 +1,2314 @@
+/*******************************************************************\
+
+Module: Java_string_libraries_preprocess, gives code for methods on
+        strings of the java standard library. In particular methods
+        from java.lang.String, java.lang.StringBuilder,
+        java.lang.StringBuffer.
+
+Author: Romain Brenguier
+
+Date:   April 2017
+
+\*******************************************************************/
+
+/// \file
+/// Java_string_libraries_preprocess, gives code for methods on strings of the
+///   java standard library. In particular methods from java.lang.String,
+///   java.lang.StringBuilder, java.lang.StringBuffer.
+
+#include <util/arith_tools.h>
+#include <util/std_expr.h>
+#include <util/std_code.h>
+#include <util/fresh_symbol.h>
+#include <util/refined_string_type.h>
+#include <util/string_expr.h>
+#include <util/c_types.h>
+
+#include "java_types.h"
+#include "java_object_factory.h"
+#include "java_utils.h"
+
+#include "java_string_library_preprocess.h"
+
+/// \param type: a type
+/// \param tag: a string
+/// \return Boolean telling whether the type is a struct with the given tag or a
+///   symbolic type with the tag prefixed by "java::"
+bool java_string_library_preprocesst::java_type_matches_tag(
+  const typet &type, const std::string &tag)
+{
+  if(type.id()==ID_symbol)
+  {
+    irep_idt tag_id=to_symbol_type(type).get_identifier();
+    return tag_id=="java::"+tag;
+  }
+  else if(type.id()==ID_struct)
+  {
+    irep_idt tag_id=to_struct_type(type).get_tag();
+    return tag_id==tag;
+  }
+  return false;
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java string pointer
+bool java_string_library_preprocesst::is_java_string_pointer_type(
+  const typet &type)
+{
+  if(type.id()==ID_pointer)
+  {
+    const pointer_typet &pt=to_pointer_type(type);
+    const typet &subtype=pt.subtype();
+    return is_java_string_type(subtype);
+  }
+  return false;
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java string
+bool java_string_library_preprocesst::is_java_string_type(
+  const typet &type)
+{
+  return java_type_matches_tag(type, "java.lang.String");
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java StringBuilder
+bool java_string_library_preprocesst::is_java_string_builder_type(
+  const typet &type)
+{
+  return java_type_matches_tag(type, "java.lang.StringBuilder");
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java StringBuilder
+///   pointers
+bool java_string_library_preprocesst::is_java_string_builder_pointer_type(
+  const typet &type)
+{
+  if(type.id()==ID_pointer)
+  {
+    const pointer_typet &pt=to_pointer_type(type);
+    const typet &subtype=pt.subtype();
+    return is_java_string_builder_type(subtype);
+  }
+  return false;
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java StringBuffer
+bool java_string_library_preprocesst::is_java_string_buffer_type(
+  const typet &type)
+{
+  return java_type_matches_tag(type, "java.lang.StringBuffer");
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java StringBuffer
+///   pointers
+bool java_string_library_preprocesst::is_java_string_buffer_pointer_type(
+  const typet &type)
+{
+  if(type.id()==ID_pointer)
+  {
+    const pointer_typet &pt=to_pointer_type(type);
+    const typet &subtype=pt.subtype();
+    return is_java_string_buffer_type(subtype);
+  }
+  return false;
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java char sequence
+bool java_string_library_preprocesst::is_java_char_sequence_type(
+  const typet &type)
+{
+  return java_type_matches_tag(type, "java.lang.CharSequence");
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of a pointer to a java char
+///   sequence
+bool java_string_library_preprocesst::is_java_char_sequence_pointer_type(
+  const typet &type)
+{
+  if(type.id()==ID_pointer)
+  {
+    const pointer_typet &pt=to_pointer_type(type);
+    const typet &subtype=pt.subtype();
+    return is_java_char_sequence_type(subtype);
+  }
+  return false;
+}
+
+/// \param type: a type
+/// \return Boolean telling whether the type is that of java char array
+bool java_string_library_preprocesst::is_java_char_array_type(
+  const typet &type)
+{
+  return java_type_matches_tag(type, "array[char]");
+}
+
+/// \par parameters: a type
+/// \return Boolean telling whether the type is that of a pointer to a java char
+///   array
+bool java_string_library_preprocesst::is_java_char_array_pointer_type(
+  const typet &type)
+{
+  if(type.id()==ID_pointer)
+  {
+    const pointer_typet &pt=to_pointer_type(type);
+    const typet &subtype=pt.subtype();
+    return is_java_char_array_type(subtype);
+  }
+  return false;
+}
+
+/// \param symbol_table: a symbol_table containing an entry for java Strings
+/// \return the type of data fields in java Strings.
+typet string_data_type(symbol_tablet symbol_table)
+{
+  symbolt sym=symbol_table.lookup("java::java.lang.String");
+  typet concrete_type=sym.type;
+  struct_typet struct_type=to_struct_type(concrete_type);
+  std::size_t index=struct_type.component_number("data");
+  typet data_type=struct_type.components()[index].type();
+  return data_type;
+}
+
+/// \return the type of the length field in java Strings.
+typet string_length_type()
+{
+  return java_int_type();
+}
+
+/// Add to the symbol table type declaration for a String-like Java class.
+/// \param class_name: a name for the class such as "java.lang.String"
+/// \param symbol_table: symbol table to which the class will be added
+void java_string_library_preprocesst::add_string_type(
+  const irep_idt &class_name, symbol_tablet &symbol_table)
+{
+  class_typet string_type;
+  string_type.set_tag(class_name);
+  string_type.components().resize(3);
+  string_type.components()[0].set_name("@java.lang.Object");
+  string_type.components()[0].set_pretty_name("@java.lang.Object");
+  string_type.components()[0].type()=symbol_typet("java::java.lang.Object");
+  string_type.components()[1].set_name("length");
+  string_type.components()[1].set_pretty_name("length");
+  string_type.components()[1].type()=string_length_type();
+  string_type.components()[2].set_name("data");
+  string_type.components()[2].set_pretty_name("data");
+  // Use a pointer-to-unbounded-array instead of a pointer-to-char.
+  // Saves some casting in the string refinement algorithm but may
+  // be unnecessary.
+  string_type.components()[2].type()=java_reference_type(
+    array_typet(java_char_type(), infinity_exprt(string_length_type())));
+  string_type.add_base(symbol_typet("java::java.lang.Object"));
+  if(class_name!="java.lang.CharSequence")
+  {
+    string_type.add_base(symbol_typet("java::java.io.Serializable"));
+    string_type.add_base(symbol_typet("java::java.lang.CharSequence"));
+  }
+  if(class_name=="java.lang.String")
+    string_type.add_base(symbol_typet("java::java.lang.Comparable"));
+
+  if(class_name=="java.lang.StringBuilder" ||
+     class_name=="java.lang.StringBuffer")
+    string_type.add_base(symbol_typet("java::java.lang.AbstractStringBuilder"));
+
+  symbolt tmp_string_symbol;
+  tmp_string_symbol.name="java::"+id2string(class_name);
+  symbolt *string_symbol=nullptr;
+  symbol_table.move(tmp_string_symbol, string_symbol);
+  string_symbol->base_name=id2string(class_name);
+  string_symbol->pretty_name=id2string(class_name);
+  string_symbol->type=string_type;
+  string_symbol->is_type=true;
+}
+
+/// add a symbol in the table with static lifetime and name containing
+/// `cprover_string_array` and given type
+/// \param type: an array type
+/// \param location: a location in the program
+/// \param symbol_table: symbol table
+symbol_exprt java_string_library_preprocesst::fresh_array(
+  const typet &type,
+  const source_locationt &location,
+  symbol_tablet &symbol_table)
+{
+  symbolt array_symbol=get_fresh_aux_symbol(
+    type,
+    "cprover_string_array",
+    "cprover_string_array",
+    location,
+    ID_java,
+    symbol_table);
+  array_symbol.is_static_lifetime=true;
+  return array_symbol.symbol_expr();
+}
+
+/// declare a function with the given name and type
+/// \param function_name: a name
+/// \param type: a type
+/// \param symbol_table: symbol table
+void java_string_library_preprocesst::declare_function(
+  irep_idt function_name, const typet &type, symbol_tablet &symbol_table)
+{
+  auxiliary_symbolt func_symbol;
+  func_symbol.base_name=function_name;
+  func_symbol.pretty_name=function_name;
+  func_symbol.is_static_lifetime=false;
+  func_symbol.mode=ID_java;
+  func_symbol.name=function_name;
+  func_symbol.type=type;
+  symbol_table.add(func_symbol);
+}
+
+/// calls string_refine_preprocesst::process_operands with a list of parameters.
+/// \param params: a list of function parameters
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \param init_code: code block, in which declaration of some arguments may be
+///   added
+/// \return a list of expressions
+exprt::operandst java_string_library_preprocesst::process_parameters(
+  const code_typet::parameterst &params,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &init_code)
+{
+  exprt::operandst ops;
+  for(const auto &p : params)
+  {
+    symbol_exprt sym(p.get_identifier(), p.type());
+    ops.push_back(sym);
+  }
+  return process_operands(ops, loc, symbol_table, init_code);
+}
+
+/// Creates a string_exprt from the input exprt and adds it to processed_ops
+/// \param processed_ops: the list of processed operands to populate
+/// \param op_to_process: a list of expressions
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \param init_code: code block, in which declaration of some arguments may be
+///   added
+void java_string_library_preprocesst::process_single_operand(
+  exprt::operandst &processed_ops,
+  const exprt &op_to_process,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &init_code)
+{
+  member_exprt length(
+    op_to_process, "length", string_length_type());
+  member_exprt data(op_to_process, "data", string_data_type(symbol_table));
+  dereference_exprt deref_data(data, data.type().subtype());
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, init_code);
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, init_code);
+  init_code.add(code_declt(string_expr_sym));
+  init_code.add(code_assignt(string_expr.length(), length));
+  init_code.add(
+    code_assignt(string_expr.content(), deref_data));
+  init_code.add(code_assignt(string_expr_sym, string_expr));
+  processed_ops.push_back(string_expr);
+}
+
+/// for each expression that is of a type implementing strings, we declare a new
+/// `cprover_string` whose contents is deduced from the expression and replace
+/// the expression by this cprover_string in the output list; in the other case
+/// the expression is kept as is for the output list. Also does the same thing
+/// for char array references.
+/// \param operands: a list of expressions
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \param init_code: code block, in which declaration of some arguments may be
+///   added
+/// \return a list of expressions
+exprt::operandst java_string_library_preprocesst::process_operands(
+  const exprt::operandst &operands,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &init_code)
+{
+  exprt::operandst ops;
+  for(const auto &p : operands)
+  {
+    if(implements_java_char_sequence(p.type()))
+    {
+      dereference_exprt deref=
+        checked_dereference(p, to_pointer_type(p.type()).subtype());
+      process_single_operand(ops, deref, loc, symbol_table, init_code);
+    }
+    else if(is_java_char_array_pointer_type(p.type()))
+    {
+      ops.push_back(replace_char_array(p, loc, symbol_table, init_code));
+    }
+    else
+    {
+      ops.push_back(p);
+    }
+  }
+  return ops;
+}
+
+/// Converts the operands of the equals function to string expressions and
+/// outputs these conversions. As a side effect of the conversions it adds some
+/// code to init_code.
+/// \param operands: a list of expressions
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \param init_code: code block, in which declaration of some arguments may be
+///   added
+/// \return a list of expressions
+exprt::operandst
+  java_string_library_preprocesst::process_equals_function_operands(
+  const exprt::operandst &operands,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &init_code)
+{
+  PRECONDITION(operands.size()==2);
+  exprt::operandst ops;
+  const exprt &op0=operands[0];
+  const exprt &op1=operands[1];
+  PRECONDITION(implements_java_char_sequence(op0.type()));
+
+  dereference_exprt deref0=
+    checked_dereference(op0, to_pointer_type(op0.type()).subtype());
+  process_single_operand(ops, deref0, loc, symbol_table, init_code);
+
+  // TODO: Manage the case where we have a non-String Object (this should
+  // probably be handled upstream. At any rate, the following code should be
+  // protected with assertions on the type of op1.
+  typecast_exprt tcast(op1, to_pointer_type(op0.type()));
+  dereference_exprt deref1=
+    checked_dereference(tcast, to_pointer_type(op0.type()).subtype());
+  process_single_operand(ops, deref1, loc, symbol_table, init_code);
+  return ops;
+}
+
+/// Finds the type of the data component
+/// \param type: a type containing a "data" component
+/// \param symbol_table: symbol table
+/// \return type of the "data" component
+typet java_string_library_preprocesst::get_data_type(
+  const typet &type, const symbol_tablet &symbol_table)
+{
+  PRECONDITION(type.id()==ID_struct || type.id()==ID_symbol);
+  if(type.id()==ID_symbol)
+  {
+    symbolt sym=symbol_table.lookup(to_symbol_type(type).get_identifier());
+    CHECK_RETURN(sym.type.id()!=ID_symbol);
+    return get_data_type(sym.type, symbol_table);
+  }
+  // else type id is ID_struct
+  const struct_typet &struct_type=to_struct_type(type);
+  return struct_type.component_type("data");
+}
+
+/// Finds the type of the length component
+/// \param type: a type containing a "length" component
+/// \param symbol_table: symbol table
+/// \return type of the "length" component
+typet java_string_library_preprocesst::get_length_type(
+  const typet &type, const symbol_tablet &symbol_table)
+{
+  PRECONDITION(type.id()==ID_struct || type.id()==ID_symbol);
+  if(type.id()==ID_symbol)
+  {
+    symbolt sym=symbol_table.lookup(to_symbol_type(type).get_identifier());
+    CHECK_RETURN(sym.type.id()!=ID_symbol);
+    return get_length_type(sym.type, symbol_table);
+  }
+  // else type id is ID_struct
+  const struct_typet &struct_type=to_struct_type(type);
+  return struct_type.component_type("length");
+}
+
+/// access length member
+/// \param expr: an expression of structured type with length component
+/// \param symbol_table: symbol table
+/// \return expression representing the "length" member
+exprt java_string_library_preprocesst::get_length(
+  const exprt &expr, const symbol_tablet &symbol_table)
+{
+  return member_exprt(
+    expr, "length", get_length_type(expr.type(), symbol_table));
+}
+
+/// access data member
+/// \param expr: an expression of structured type with length component
+/// \param symbol_table: symbol table
+/// \return expression representing the "data" member
+exprt java_string_library_preprocesst::get_data(
+  const exprt &expr, const symbol_tablet &symbol_table)
+{
+  return member_exprt(expr, "data", get_data_type(expr.type(), symbol_table));
+}
+
+/// we declare a new `cprover_string` whose contents is deduced from the char
+/// array.
+/// \param array_pointer: an expression of type char array pointer
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \param code: code block, in which some assignments will be added
+/// \return a string expression
+string_exprt java_string_library_preprocesst::replace_char_array(
+  const exprt &array_pointer,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &code)
+{
+  refined_string_typet ref_type=refined_string_type;
+  dereference_exprt array=
+    checked_dereference(array_pointer, array_pointer.type().subtype());
+  exprt array_data=get_data(array, symbol_table);
+  // `deref_array` is *(array_pointer->data)`
+  // No null-pointer-exception check here since all array structures
+  // have non-null data
+  const typet &content_type=ref_type.get_content_type();
+  dereference_exprt deref_array(array_data, array_data.type().subtype());
+
+  // lhs_deref <- convert_pointer_to_char_array(*(array_pointer->data))
+  symbolt sym_char_array=get_fresh_aux_symbol(
+    content_type, "char_array", "char_array", loc, ID_java, symbol_table);
+  symbol_exprt char_array=sym_char_array.symbol_expr();
+  code.add(code_assign_function_application(
+    char_array,
+    ID_cprover_string_array_of_char_pointer_func,
+    {deref_array},
+    symbol_table));
+
+  // string_expr is `{ rhs->length; string_array }`
+  string_exprt string_expr(
+    get_length(array, symbol_table), char_array, refined_string_type);
+  // string_expr_sym <- { rhs->length; string_array }
+  symbol_exprt string_expr_sym=
+    fresh_string(refined_string_type, loc, symbol_table);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  return string_expr;
+}
+
+/// add a symbol with static lifetime and name containing `cprover_string` and
+/// given type
+/// \param type: a type for refined strings
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \return a new symbol
+symbol_exprt java_string_library_preprocesst::fresh_string(
+  const typet &type, const source_locationt &loc, symbol_tablet &symbol_table)
+{
+  symbolt string_symbol=get_fresh_aux_symbol(
+    type, "cprover_string", "cprover_string", loc, ID_java, symbol_table);
+  string_symbol.is_static_lifetime=true;
+  return string_symbol.symbol_expr();
+}
+
+/// add symbols with prefix cprover_string_length and cprover_string_data and
+/// construct a string_expr from them.
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \param code: code block to which allocation instruction will be added
+/// \return a new string_expr
+string_exprt java_string_library_preprocesst::fresh_string_expr(
+  const source_locationt &loc, symbol_tablet &symbol_table, code_blockt &code)
+{
+  refined_string_typet type=refined_string_type;
+  symbolt sym_length=get_fresh_aux_symbol(
+    type.get_index_type(),
+    "cprover_string_length",
+    "cprover_string_length",
+    loc,
+    ID_java,
+    symbol_table);
+  symbol_exprt length_field=sym_length.symbol_expr();
+  symbol_exprt content_field=fresh_array(
+    type.get_content_type(), loc, symbol_table);
+  string_exprt str(length_field, content_field, type);
+  code.add(code_declt(length_field));
+  code.add(code_declt(content_field));
+  return str;
+}
+
+/// add symbols with prefix cprover_string_length and cprover_string_data and
+/// construct a string_expr from them.
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \param code: code block to which allocation instruction will be added
+/// \return a new expression of refined string type
+exprt java_string_library_preprocesst::fresh_string_expr_symbol(
+  const source_locationt &loc, symbol_tablet &symbol_table, code_blockt &code)
+{
+  symbolt sym=get_fresh_aux_symbol(
+    refined_string_type,
+    "cprover_string",
+    "cprover_string",
+    loc,
+    ID_java,
+    symbol_table);
+  code.add(code_declt(sym.symbol_expr()));
+  return sym.symbol_expr();
+}
+
+/// declare a new String and allocate it
+/// \param type: a type for string
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \param code: code block to which allocation instruction will be added
+/// \return a new string
+exprt java_string_library_preprocesst::allocate_fresh_string(
+  const typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &code)
+{
+  exprt str=fresh_string(type, loc, symbol_table);
+  code.add(code_declt(str));
+  allocate_dynamic_object_with_decl(str, symbol_table, loc, code);
+  return str;
+}
+
+/// declare a new character array and allocate it
+/// \param type: a type for string
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \param code: code block to which allocation instruction will be added
+/// \return a new array
+exprt java_string_library_preprocesst::allocate_fresh_array(
+  const typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &code)
+{
+  exprt array=fresh_array(type, loc, symbol_table);
+  code.add(code_declt(array));
+  allocate_dynamic_object_with_decl(array, symbol_table, loc, code);
+  return array;
+}
+
+/// \param function_name: the name of the function
+/// \param arguments: a list of arguments
+/// \param type: return type of the function
+/// \param symbol_table: a symbol table
+/// \return a function application representing: `function_name(arguments)`
+exprt java_string_library_preprocesst::make_function_application(
+  const irep_idt &function_name,
+  const exprt::operandst &arguments,
+  const typet &type,
+  symbol_tablet &symbol_table)
+{
+  // Names of function to call
+  std::string fun_name=id2string(function_name);
+
+  // Declaring the function
+  declare_function(fun_name, type, symbol_table);
+
+  // Function application
+  function_application_exprt call(symbol_exprt(fun_name), type);
+  call.arguments()=arguments;
+  return call;
+}
+
+/// assign the result of a function call
+/// \param lhs: an expression
+/// \param function_name: the name of the function
+/// \param arguments: a list of arguments
+/// \param symbol_table: a symbol table
+/// \return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// lhs = <function_name>(arguments)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::code_assign_function_application(
+  const exprt &lhs,
+  const irep_idt &function_name,
+  const exprt::operandst &arguments,
+  symbol_tablet &symbol_table)
+{
+  exprt fun_app=make_function_application(
+    function_name, arguments, lhs.type(), symbol_table);
+  return code_assignt(lhs, fun_app);
+}
+
+/// return the result of a function call
+/// \param function_name: the name of the function
+/// \param arguments: a list of arguments
+/// \param type: the return type
+/// \param symbol_table: a symbol table
+/// \return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// return <function_name>(arguments)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::code_return_function_application(
+  const irep_idt &function_name,
+  const exprt::operandst &arguments,
+  const typet &type,
+  symbol_tablet &symbol_table)
+{
+  exprt fun_app=make_function_application(
+    function_name, arguments, type, symbol_table);
+  return code_returnt(fun_app);
+}
+
+/// \param string_expr: a string expression
+/// \param function_name: the name of the function
+/// \param arguments: arguments of the function
+/// \param symbol_table: symbol table
+/// \return return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// str.length = <function_name>_length(arguments)
+/// str.data = <function_name>_data(arguments)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::code_assign_function_to_string_expr(
+  const string_exprt &string_expr,
+  const irep_idt &function_name,
+  const exprt::operandst &arguments,
+  symbol_tablet &symbol_table)
+{
+  // Names of function to call
+  std::string fun_name_length=id2string(function_name)+"_length";
+  std::string fun_name_data=id2string(function_name)+"_data";
+
+  // Assignments
+  codet assign_fun_length=code_assign_function_application(
+    string_expr.length(), fun_name_length, arguments, symbol_table);
+  codet assign_fun_data=code_assign_function_application(
+    string_expr.content(), fun_name_data, arguments, symbol_table);
+
+  return code_blockt({assign_fun_length, assign_fun_data});
+}
+
+/// \param function_name: the name of the function
+/// \param arguments: arguments of the function
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \param code: code block in which we add instructions
+/// \return return a string expr str and add the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// array = str.data
+/// str.length = <function_name>_length(arguments)
+/// str.data = <function_name>_data(arguments)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+string_exprt java_string_library_preprocesst::
+  string_expr_of_function_application(
+    const irep_idt &function_name,
+    const exprt::operandst &arguments,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code)
+{
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, code);
+  code.add(code_assign_function_to_string_expr(
+    string_expr, function_name, arguments, symbol_table));
+  return string_expr;
+}
+
+/// Produce code for an assignment of a string expr to a Java string.
+/// \param lhs: expression representing the java string to assign to
+/// \param rhs_array: pointer to the array to assign
+/// \param rhs_length: length of the array to assign
+/// \param symbol_table: symbol table
+/// \return return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// lhs = { {Object}, length=rhs_length, data=rhs_array }
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::code_assign_components_to_java_string(
+  const exprt &lhs,
+  const exprt &rhs_array,
+  const exprt &rhs_length,
+  symbol_tablet &symbol_table)
+{
+  PRECONDITION(implements_java_char_sequence(lhs.type()));
+  dereference_exprt deref=checked_dereference(lhs, lhs.type().subtype());
+
+  code_blockt code;
+
+  // A String has a field Object with @clsid = String and @lock = false:
+  const symbolt &jlo_symbol=symbol_table.lookup("java::java.lang.Object");
+  const struct_typet &jlo_struct=to_struct_type(jlo_symbol.type);
+  struct_exprt jlo_init(jlo_struct);
+  jlo_init.copy_to_operands(constant_exprt(
+    "java::java.lang.String", jlo_struct.components()[0].type()));
+  jlo_init.copy_to_operands(from_integer(0, jlo_struct.components()[1].type()));
+
+  struct_exprt struct_rhs(deref.type());
+  struct_rhs.copy_to_operands(jlo_init);
+  struct_rhs.copy_to_operands(rhs_length);
+  struct_rhs.copy_to_operands(rhs_array);
+  code.add(code_assignt(
+    checked_dereference(lhs, lhs.type().subtype()), struct_rhs));
+
+  return code;
+}
+
+/// Produce code for an assignemnt of a string expr to a Java string.
+/// \param lhs: an expression representing a java string
+/// \param rhs: a string expression
+/// \param symbol_table: symbol table
+/// \return return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// lhs = { {Object}, length=rhs.length, data=rhs.data }
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::code_assign_string_expr_to_java_string(
+  const exprt &lhs,
+  const string_exprt &rhs,
+  symbol_tablet &symbol_table)
+{
+  return code_assign_components_to_java_string(
+    lhs, address_of_exprt(rhs.content()), rhs.length(), symbol_table);
+}
+
+/// Produce code for an assignment of a string from a string expr.
+/// \param lhs: an expression representing a java string
+/// \param rhs: a string expression
+/// \param loc: a location in the program
+/// \param symbol_table: symbol table
+/// \return return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// data = new array[];
+/// *data = rhs.data;
+/// lhs = { {Object} , length=rhs.length, data=data}
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::
+  code_assign_string_expr_to_new_java_string(
+    const exprt &lhs,
+    const string_exprt &rhs,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table)
+{
+  PRECONDITION(implements_java_char_sequence(lhs.type()));
+  dereference_exprt deref=checked_dereference(lhs, lhs.type().subtype());
+
+  code_blockt code;
+  exprt new_array=allocate_fresh_array(
+    get_data_type(deref.type(), symbol_table), loc, symbol_table, code);
+  code.add(code_assignt(
+    dereference_exprt(new_array, new_array.type().subtype()), rhs.content()));
+
+  code.add(code_assign_components_to_java_string(
+    lhs, new_array, rhs.length(), symbol_table));
+
+  return code;
+}
+
+/// \param lhs: a string expression
+/// \param rhs: an expression representing a java string
+/// \param symbol_table: symbol table
+/// \return return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~
+/// lhs.length=rhs->length
+/// lhs.data=*(rhs->data)
+/// ~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::code_assign_java_string_to_string_expr(
+  const string_exprt &lhs, const exprt &rhs, symbol_tablet &symbol_table)
+{
+  PRECONDITION(implements_java_char_sequence(rhs.type()));
+
+  typet deref_type;
+  if(rhs.type().subtype().id()==ID_symbol)
+    deref_type=symbol_table.lookup(
+      to_symbol_type(rhs.type().subtype()).get_identifier()).type;
+  else
+    deref_type=rhs.type().subtype();
+
+  dereference_exprt deref=checked_dereference(rhs, deref_type);
+
+  // Fields of the string object
+  exprt rhs_length=get_length(deref, symbol_table);
+  exprt member_data=get_data(deref, symbol_table);
+  dereference_exprt rhs_data(member_data, member_data.type().subtype());
+
+  // Assignments
+  code_blockt code;
+  code.add(code_assignt(lhs.length(), rhs_length));
+
+  // We always assume data of a String is not null
+  not_exprt data_not_null(equal_exprt(
+    member_data, null_pointer_exprt(to_pointer_type(member_data.type()))));
+  code.add(code_assumet(data_not_null));
+  code.add(code_assignt(lhs.content(), rhs_data));
+  return code;
+}
+
+/// \param lhs: an expression representing a java string
+/// \param s: the literal to be assigned
+/// \param symbol_table: symbol table
+/// \return return the following code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// tmp_string = "<s>"
+/// lhs = (string_expr) tmp_string
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::
+  code_assign_string_literal_to_string_expr(
+    const string_exprt &lhs,
+    const std::string &s,
+    symbol_tablet &symbol_table)
+{
+  constant_exprt expr(s, string_typet());
+  return code_assign_function_to_string_expr(
+    lhs, ID_cprover_string_literal_func, {expr}, symbol_table);
+}
+
+/// Used to provide code for the Java String.equals(Object) function.
+/// \param type: type of the function call
+/// \param loc: location in the program_invocation_name
+/// \param symbol_table: symbol table
+/// \return Code corresponding to:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// string_expr1 = {this->length; *this->data}
+/// string_expr2 = {arg->length; *arg->data}
+/// return cprover_string_equal(string_expr1, string_expr2)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_equals_function_code(
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  // TODO: Code should return false if Object is not String.
+  code_blockt code;
+  exprt::operandst ops;
+  for(const auto &p : type.parameters())
+  {
+    symbol_exprt sym(p.get_identifier(), p.type());
+    ops.push_back(sym);
+  }
+  exprt::operandst args=process_equals_function_operands(
+    ops, loc, symbol_table, code);
+  code.add(code_return_function_application(
+    ID_cprover_string_equal_func, args, type.return_type(), symbol_table));
+  return code;
+}
+
+/// Provide code for the String.valueOf(F) function.
+/// \param type: type of the function call
+/// \param loc: location in the program_invocation_name
+/// \param symbol_table: symbol table
+/// \return Code corresponding to the Java conversion of floats to strings.
+codet java_string_library_preprocesst::make_float_to_string_code(
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  // Getting the argument
+  code_typet::parameterst params=type.parameters();
+  PRECONDITION(params.size()==1);
+  exprt arg=symbol_exprt(params[0].get_identifier(), params[0].type());
+
+  // Holder for output code
+  code_blockt code;
+
+  // Declaring and allocating String * str
+  exprt str=allocate_fresh_string(type.return_type(), loc, symbol_table, code);
+
+  // Expression representing 0.0
+  ieee_float_spect float_spec=ieee_float_spect::single_precision();
+  ieee_floatt zero_float(float_spec);
+  zero_float.from_float(0.0);
+  constant_exprt zero=zero_float.to_expr();
+
+  // For each possible case with have a condition and a string_exprt
+  std::vector<exprt> condition_list;
+  std::vector<string_exprt> string_expr_list;
+
+  // Case of computerized scientific notation
+  condition_list.push_back(binary_relation_exprt(arg, ID_ge, zero));
+  string_exprt sci_notation=fresh_string_expr(loc, symbol_table, code);
+  exprt sci_notation_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assign_function_to_string_expr(
+    sci_notation,
+    ID_cprover_string_of_float_scientific_notation_func,
+    {arg},
+    symbol_table));
+  // Assign string_expr_sym = { string_expr_length, string_expr_content }
+  code.add(code_assignt(sci_notation_sym, sci_notation));
+  string_expr_list.push_back(sci_notation);
+
+  // Subcase of negative scientific notation
+  condition_list.push_back(binary_relation_exprt(arg, ID_lt, zero));
+  string_exprt neg_sci_notation=fresh_string_expr(loc, symbol_table, code);
+  exprt neg_sci_notation_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  string_exprt minus_sign=fresh_string_expr(loc, symbol_table, code);
+  code.add(code_assign_string_literal_to_string_expr(
+    minus_sign, "-", symbol_table));
+  code.add(code_assign_function_to_string_expr(
+    neg_sci_notation,
+    ID_cprover_string_concat_func,
+    {minus_sign, sci_notation},
+    symbol_table));
+  code.add(code_assignt(neg_sci_notation_sym, neg_sci_notation));
+  string_expr_list.push_back(neg_sci_notation);
+
+  // Case of NaN
+  condition_list.push_back(isnan_exprt(arg));
+  string_exprt nan=fresh_string_expr(loc, symbol_table, code);
+  code.add(code_assign_string_literal_to_string_expr(
+    nan, "NaN", symbol_table));
+  string_expr_list.push_back(nan);
+
+  // Case of Infinity
+  extractbit_exprt is_neg(arg, float_spec.width()-1);
+  condition_list.push_back(and_exprt(isinf_exprt(arg), not_exprt(is_neg)));
+  string_exprt infinity=fresh_string_expr(loc, symbol_table, code);
+  code.add(code_assign_string_literal_to_string_expr(
+    infinity, "Infinity", symbol_table));
+  string_expr_list.push_back(infinity);
+
+  // Case -Infinity
+  string_exprt minus_infinity=fresh_string_expr(loc, symbol_table, code);
+  condition_list.push_back(and_exprt(isinf_exprt(arg), is_neg));
+  code.add(code_assign_string_literal_to_string_expr(
+    minus_infinity, "-Infinity", symbol_table));
+  string_expr_list.push_back(minus_infinity);
+
+  // Case of simple notation
+  ieee_floatt bound_inf_float(float_spec);
+  ieee_floatt bound_sup_float(float_spec);
+  bound_inf_float.from_float(1e-3);
+  bound_sup_float.from_float(1e7);
+  bound_inf_float.change_spec(float_spec);
+  bound_sup_float.change_spec(float_spec);
+  constant_exprt bound_inf=bound_inf_float.to_expr();
+  constant_exprt bound_sup=bound_sup_float.to_expr();
+
+  and_exprt is_simple_float(
+    binary_relation_exprt(arg, ID_ge, bound_inf),
+    binary_relation_exprt(arg, ID_lt, bound_sup));
+  condition_list.push_back(is_simple_float);
+
+  string_exprt simple_notation=fresh_string_expr(loc, symbol_table, code);
+  exprt simple_notation_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assign_function_to_string_expr(
+    simple_notation, ID_cprover_string_of_float_func, {arg}, symbol_table));
+  code.add(code_assignt(simple_notation_sym, simple_notation));
+  string_expr_list.push_back(simple_notation);
+
+  // Case of a negative number in simple notation
+  and_exprt is_neg_simple_float(
+    binary_relation_exprt(arg, ID_le, unary_minus_exprt(bound_inf)),
+    binary_relation_exprt(arg, ID_gt, unary_minus_exprt(bound_sup)));
+  condition_list.push_back(is_neg_simple_float);
+
+  string_exprt neg_simple_notation=fresh_string_expr(loc, symbol_table, code);
+  exprt neg_simple_notation_sym=
+    fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assign_function_to_string_expr(
+    neg_simple_notation,
+    ID_cprover_string_concat_func,
+    {minus_sign, simple_notation},
+    symbol_table));
+  code.add(code_assignt(neg_simple_notation_sym, simple_notation));
+  string_expr_list.push_back(neg_simple_notation);
+
+  // Combining all cases
+  INVARIANT(
+    string_expr_list.size()==condition_list.size(),
+    "number of created strings should correspond to number of conditions");
+
+  // We do not check the condition of the first element in the list as it
+  // will be reached only if all other conditions are not satisfied.
+  codet tmp_code=code_assign_string_expr_to_java_string(
+    str, string_expr_list[0], symbol_table);
+  for(std::size_t i=1; i<condition_list.size(); i++)
+  {
+    code_ifthenelset ife;
+    ife.cond()=condition_list[i];
+    ife.then_case()=code_assign_string_expr_to_new_java_string(
+      str, string_expr_list[i], loc, symbol_table);
+    ife.else_case()=tmp_code;
+    tmp_code=ife;
+  }
+  code.add(tmp_code);
+
+  // Return str
+  code.add(code_returnt(str));
+  return code;
+}
+
+/// Generate the goto code for string initialization.
+/// \param function_name: name of the function to be called
+/// \param type: the type of the function call
+/// \param loc: location in program
+/// \param symbol_table: the symbol table to populate
+/// \param ignore_first_arg: boolean flag telling that the first argument should
+///   not be part of the arguments of the call (but only used to be assigned the
+///   result)
+/// \return code for the String.<init>(args) function:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// cprover_string_length = fun(arg).length;
+/// cprover_string_array = fun(arg).data;
+/// this->length = cprover_string_length;
+/// this->data = cprover_string_array;
+/// cprover_string = {.=cprover_string_length, .=cprover_string_array};
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_init_function_from_call(
+  const irep_idt &function_name,
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  bool ignore_first_arg)
+{
+  code_typet::parameterst params=type.parameters();
+
+  // The first parameter is the object to be initialized
+  PRECONDITION(!params.empty());
+  exprt arg_this=symbol_exprt(params[0].get_identifier(), params[0].type());
+  if(ignore_first_arg)
+    params.erase(params.begin());
+
+  // Holder for output code
+  code_blockt code;
+
+  // Processing parameters
+  exprt::operandst args=process_parameters(params, loc, symbol_table, code);
+
+  // string_expr <- function(arg1)
+  string_exprt string_expr=string_expr_of_function_application(
+    function_name, args, loc, symbol_table, code);
+
+  // arg_this <- string_expr
+  code.add(code_assign_string_expr_to_new_java_string(
+    arg_this, string_expr, loc, symbol_table));
+
+  // string_expr_sym <- {string_expr.length, string_expr.content}
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  return code;
+}
+
+/// Call a cprover internal function, assign the result to object `this` and
+/// return it.
+/// \param function_name: name of the function to be called
+/// \param type: the type of the function call
+/// \param loc: location in program
+/// \param symbol_table: the symbol table to populate
+/// \return Code calling function with the given function name.
+codet java_string_library_preprocesst::
+  make_assign_and_return_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table)
+{
+  // This is similar to assign functions except we return a pointer to `this`
+  code_typet::parameterst params=type.parameters();
+  PRECONDITION(!params.empty());
+  code_blockt code;
+  code.add(make_assign_function_from_call(
+    function_name, type, loc, symbol_table));
+  exprt arg_this=symbol_exprt(params[0].get_identifier(), params[0].type());
+  code.add(code_returnt(arg_this));
+  return code;
+}
+
+/// Call a cprover internal function and assign the result to object `this`.
+/// \param function_name: name of the function to be called
+/// \param type: the type of the function call
+/// \param loc: location in program
+/// \param symbol_table: the symbol table to populate
+/// \return Code assigning result of a call to the function with given function
+///   name.
+codet java_string_library_preprocesst::make_assign_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table)
+{
+  // This is similar to initialization function except we do not ignore
+  // the first argument
+  codet code=make_init_function_from_call(
+    function_name, type, loc, symbol_table, false);
+  return code;
+}
+
+/// Used to provide our own implementation of the
+/// `java.lang.String.toCharArray:()[C` function.
+/// \param type: type of the function called
+/// \param loc: location in the source
+/// \param symbol_table: the symbol table
+/// \return Code corresponding to
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// lhs = new java::array[char]
+/// string_expr = {length=this->length, content=*(this->data)}
+/// data = new char[]
+/// *data = string_expr.content
+/// lhs->data = &data[0]
+/// lhs->length = string_expr.length
+/// return lhs
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_string_to_char_array_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table)
+{
+  code_blockt code;
+  PRECONDITION(!type.parameters().empty());
+  const code_typet::parametert &p=type.parameters()[0];
+  symbol_exprt string_argument(p.get_identifier(), p.type());
+  PRECONDITION(implements_java_char_sequence(string_argument.type()));
+
+  // lhs = new java::array[char]
+  exprt lhs=allocate_fresh_array(
+    type.return_type(), loc, symbol_table, code);
+
+  // string_expr = {this->length, this->data}
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, code);
+  code.add(code_assign_java_string_to_string_expr(
+    string_expr, string_argument, symbol_table));
+  exprt string_expr_sym=fresh_string_expr_symbol(
+    loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  // data = new char[]
+  exprt data=allocate_fresh_array(
+    java_reference_type(string_expr.content().type()), loc, symbol_table, code);
+
+  // *data = string_expr.content
+  dereference_exprt deref_data(data, data.type().subtype());
+  code.add(code_assignt(deref_data, string_expr.content()));
+
+  // lhs->data = &data[0]
+  dereference_exprt deref_lhs=checked_dereference(lhs, lhs.type().subtype());
+  exprt lhs_data=get_data(deref_lhs, symbol_table);
+  index_exprt first_elt(
+    deref_data, from_integer(0, java_int_type()), java_char_type());
+  code.add(code_assignt(lhs_data, address_of_exprt(first_elt)));
+
+  // lhs->length = string_expr.length
+  exprt lhs_length=get_length(deref_lhs, symbol_table);
+  code.add(code_assignt(lhs_length, string_expr.length()));
+
+  // return lhs
+  code.add(code_returnt(lhs));
+  return code;
+}
+
+/// Adds to the code an assignment of the form
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// type_name tmp_type_name
+/// tmp_type_name = ((Classname*)arg_i)->value
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// and returns `tmp_typename`.
+/// In case the class corresponding to `type_name` is not available in
+/// `symbol_table`, the variable is declared but not assigned.
+/// Used to access the values of the arguments of `String.format`.
+/// \param object: an expression representing a reference to an object
+/// \param type_name: name of the corresponding primitive type, this can be
+///        one of the following: ID_boolean, ID_char, ID_byte, ID_short, ID_int,
+///        ID_long, ID_float, ID_double, ID_void
+/// \param loc: a location in the source
+/// \param symbol_table: the symbol table
+/// \param code: code block to which we are adding some assignments
+/// \return An expression contaning a symbol `tmp_type_name` where `type_name`
+///         is the given argument (ie. boolean, char etc.). Which represents the
+///         primitive value contained in the given object.
+exprt java_string_library_preprocesst::get_primitive_value_of_object(
+  const exprt &object,
+  irep_idt type_name,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &code)
+{
+  symbol_typet object_type;
+  typet value_type;
+  if(type_name==ID_boolean)
+  {
+    value_type=java_boolean_type();
+    object_type=symbol_typet("java::java.lang.Boolean");
+  }
+  else if(type_name==ID_char)
+  {
+    value_type=java_char_type();
+    object_type=symbol_typet("java::java.lang.Character");
+  }
+  else if(type_name==ID_byte)
+  {
+    value_type=java_byte_type();
+    object_type=symbol_typet("java::java.lang.Byte");
+  }
+  else if(type_name==ID_short)
+  {
+    value_type=java_short_type();
+    object_type=symbol_typet("java::java.lang.Short");
+  }
+  else if(type_name==ID_int)
+  {
+    value_type=java_int_type();
+    object_type=symbol_typet("java::java.lang.Integer");
+  }
+  else if(type_name==ID_long)
+  {
+    value_type=java_long_type();
+    object_type=symbol_typet("java::java.lang.Long");
+  }
+  else if(type_name==ID_float)
+  {
+    value_type=java_float_type();
+    object_type=symbol_typet("java::java.lang.Float");
+  }
+  else if(type_name==ID_double)
+  {
+    value_type=java_double_type();
+    object_type=symbol_typet("java::java.lang.Double");
+  }
+  else if(type_name==ID_void)
+    return nil_exprt();
+  else
+    UNREACHABLE;
+
+  // declare tmp_type_name to hold the value
+  std::string aux_name="tmp_"+id2string(type_name);
+  symbolt symbol=get_fresh_aux_symbol(
+    value_type, aux_name, aux_name, loc, ID_java, symbol_table);
+  exprt value=symbol.symbol_expr();
+
+  // Check that the type of the object is in the symbol table,
+  // otherwise there is no safe way of finding its value.
+  if(symbol_table.has_symbol(object_type.get_identifier()))
+  {
+    struct_typet struct_type=to_struct_type(
+      symbol_table.lookup(object_type.get_identifier()).type);
+    // Check that the type has a value field
+    const struct_union_typet::componentt value_comp=
+      struct_type.get_component("value");
+    if(!value_comp.is_nil())
+    {
+      pointer_typet pointer_type=::pointer_type(struct_type);
+      dereference_exprt deref(
+        typecast_exprt(object, pointer_type), pointer_type.subtype());
+      member_exprt deref_value(deref, value_comp.get_name(), value_comp.type());
+      code.add(code_assignt(value, deref_value));
+      return value;
+    }
+  }
+
+  warning() << object_type.get_identifier()
+            << " not available to format function" << eom;
+  code.add(code_declt(value));
+  return value;
+}
+
+/// Helper for format function. Returns the expression:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// *((void**)(argv->data)+index )
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// which corresponds to the object at position `index` in  `argv`.
+/// \param argv: reference to an array of references
+/// \param index: index of the desired object
+/// \return An expression representing the object at position `index` of `argv`.
+exprt java_string_library_preprocesst::get_object_at_index(
+  const exprt &argv,
+  int index)
+{
+  dereference_exprt deref_objs(argv, argv.type().subtype());
+  pointer_typet empty_pointer=pointer_type(empty_typet());
+  pointer_typet pointer_of_pointer;
+  pointer_of_pointer.copy_to_subtypes(empty_pointer);
+  member_exprt data_member(deref_objs, "data", pointer_of_pointer);
+  plus_exprt data_pointer_plus_index(
+    data_member, from_integer(index, java_int_type()), data_member.type());
+  dereference_exprt data_at_index(
+    data_pointer_plus_index, data_pointer_plus_index.type().subtype());
+  return data_at_index;
+}
+
+/// Helper for format function. Adds code:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// string_expr arg_i_string_expr;
+/// int tmp_int;
+/// float tmp_float;
+/// char tmp_char;
+/// boolean tmp_boolean;
+/// Object* arg_i=get_object_at_index(argv, index)
+/// if(arg_i!=NULL)
+/// {
+///   if(arg_i.@class_identifier=="java::java.lang.String")
+///   {
+///     arg_i_string_expr = (string_expr)((String*)arg_i_as_string)
+///   }
+///   tmp_int=((Integer)arg_i)->value
+///   tmp_float=((Float)arg_i)->value
+///   tmp_char=((Char)arg_i)->value
+///   tmp_boolean=((Boolean)arg_i)->value
+/// }
+/// arg_i_struct = { string_expr=arg_i_string_expr;
+///   integer=tmp_int; float=tmp_float; char=tmp_char; boolean=tmp_boolean}
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// and returns `arg_i_struct`.
+///
+/// TODO: date_time and hash code are not implemented
+/// \param argv: reference to an array of references
+/// \param index: index of the desired argument
+/// \param structured_type: type for arguments of the internal format function
+/// \param loc: a location in the source
+/// \param symbol_table: the symbol table
+/// \param code: code block to which we are adding some assignments
+/// \return An expression of type `structured_type` representing the possible
+///         values of the argument at position `index` of `argv`.
+exprt java_string_library_preprocesst::make_argument_for_format(
+  const exprt &argv,
+  int index,
+  const struct_typet &structured_type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table,
+  code_blockt &code)
+{
+  // Declarations of the fields of arg_i_struct
+  // arg_i_struct is { arg_i_string_expr, tmp_int, tmp_char, ... }
+  struct_exprt arg_i_struct(structured_type);
+  std::list<exprt> field_exprs;
+  for(const auto & comp : structured_type.components())
+  {
+    const irep_idt &name=comp.get_name();
+    const typet &type=comp.type();
+    exprt field_expr;
+    if(name!="string_expr")
+    {
+      std::string tmp_name="tmp_"+id2string(name);
+      symbolt field_symbol=get_fresh_aux_symbol(
+        type, tmp_name, tmp_name, loc, ID_java, symbol_table);
+      field_expr=field_symbol.symbol_expr();
+      code.add(code_declt(field_expr));
+    }
+    else
+      field_expr=fresh_string_expr(loc, symbol_table, code);
+
+    field_exprs.push_back(field_expr);
+    arg_i_struct.copy_to_operands(field_expr);
+  }
+
+  // arg_i = argv[index]
+  exprt obj=get_object_at_index(argv, index);
+  symbolt object_symbol=get_fresh_aux_symbol(
+    obj.type(), "tmp_format_obj", "tmp_format_obj", loc, ID_java, symbol_table);
+  symbol_exprt arg_i=object_symbol.symbol_expr();
+  allocate_dynamic_object_with_decl(arg_i, symbol_table, loc, code);
+  code.add(code_assignt(arg_i, obj));
+  code.add(code_assumet(not_exprt(equal_exprt(
+    arg_i, null_pointer_exprt(to_pointer_type(arg_i.type()))))));
+
+  // if arg_i != null then [code_not_null]
+  code_ifthenelset code_avoid_null_arg;
+  code_avoid_null_arg.cond()=not_exprt(equal_exprt(
+    arg_i, null_pointer_exprt(to_pointer_type(arg_i.type()))));
+  code_blockt code_not_null;
+
+  // Assigning all the fields of arg_i_struct
+  for(const auto &comp : structured_type.components())
+  {
+    const irep_idt &name=comp.get_name();
+    exprt field_expr=field_exprs.front();
+    field_exprs.pop_front();
+
+    if(name=="string_expr")
+    {
+      pointer_typet string_pointer=
+        java_reference_type(symbol_typet("java::java.lang.String"));
+      typecast_exprt arg_i_as_string(arg_i, string_pointer);
+      code_not_null.add(code_assign_java_string_to_string_expr(
+        to_string_expr(field_expr), arg_i_as_string, symbol_table));
+      exprt arg_i_string_expr_sym=fresh_string_expr_symbol(
+        loc, symbol_table, code_not_null);
+      code_not_null.add(code_assignt(
+        arg_i_string_expr_sym, to_string_expr(field_expr)));
+    }
+    else if(name==ID_int || name==ID_float || name==ID_char || name==ID_boolean)
+    {
+      exprt value=get_primitive_value_of_object(
+        arg_i, name, loc, symbol_table, code_not_null);
+      code_not_null.add(code_assignt(field_expr, value));
+    }
+    else
+    {
+      // TODO: date_time and hash_code not implemented
+    }
+  }
+
+  code.add(code_not_null);
+  return arg_i_struct;
+}
+
+/// Used to provide code for the Java String.format function.
+///
+/// TODO: date_time and hash code are not implemented, and we set a limit of
+/// 10 arguments
+/// \param type: type of the function call
+/// \param loc: location in the program_invocation_name
+/// \param symbol_table: symbol table
+/// \return Code implementing the Java String.format function.
+///         Since the exact class of the arguments is not known, we give as
+///         argument to the internal format function a structure containing
+///         the different possible types.
+codet java_string_library_preprocesst::make_string_format_code(
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  PRECONDITION(type.parameters().size()==2);
+  code_blockt code;
+  exprt::operandst args=process_parameters(
+    type.parameters(), loc, symbol_table, code);
+  INVARIANT(args.size()==2, "String.format should have two arguments");
+
+  // The argument can be:
+  // a string, an integer, a floating point, a character, a boolean,
+  // an object of which we take the hash code, or a date/time
+  struct_typet structured_type;
+  structured_type.components().emplace_back("string_expr", refined_string_type);
+  structured_type.components().emplace_back(ID_int, java_int_type());
+  structured_type.components().emplace_back(ID_float, java_float_type());
+  structured_type.components().emplace_back(ID_char, java_char_type());
+  structured_type.components().emplace_back(ID_boolean, java_boolean_type());
+  // TODO: hash_code not implemented for now
+  structured_type.components().emplace_back("hashcode", java_int_type());
+  // TODO: date_time type not implemented for now
+  structured_type.components().emplace_back("date_time", java_int_type());
+
+  // We will process arguments so that each is converted to a `struct_exprt`
+  // containing each possible type used in format specifiers.
+  std::vector<exprt> processed_args;
+  processed_args.push_back(args[0]);
+  for(std::size_t i=0; i<MAX_FORMAT_ARGS; ++i)
+    processed_args.push_back(make_argument_for_format(
+      args[1], i, structured_type, loc, symbol_table, code));
+
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, code);
+  code.add(code_assign_function_to_string_expr(
+    string_expr, ID_cprover_string_format_func, processed_args, symbol_table));
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+  exprt java_string=allocate_fresh_string(
+    type.return_type(), loc, symbol_table, code);
+  code.add(code_assign_string_expr_to_new_java_string(
+    java_string, string_expr, loc, symbol_table));
+  code.add(code_returnt(java_string));
+  return code;
+}
+
+/// Used to provide our own implementation of the java.lang.Object.getClass()
+/// function.
+/// \param type: type of the function called
+/// \param loc: location in the source
+/// \param symbol_table: the symbol table
+/// \return Code corresponding to
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// Class class1;
+/// string_expr1 = substr(this->@class_identifier, 6)
+/// class1=Class.forName(string_expr1)
+/// return class1
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_object_get_class_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table)
+{
+  code_typet::parameterst params=type.parameters();
+  exprt this_obj=symbol_exprt(params[0].get_identifier(), params[0].type());
+
+  // Code to be returned
+  code_blockt code;
+
+  // > Class class1;
+  pointer_typet class_type=
+    java_reference_type(symbol_table.lookup("java::java.lang.Class").type);
+  symbolt class1_sym=get_fresh_aux_symbol(
+    class_type, "class_symbol", "class_symbol", loc, ID_java, symbol_table);
+  symbol_exprt class1=class1_sym.symbol_expr();
+  code.add(code_declt(class1));
+
+  // class_identifier is this->@class_identifier
+  member_exprt class_identifier(
+    checked_dereference(this_obj, this_obj.type().subtype()),
+    "@class_identifier",
+    string_typet());
+
+  // string_expr = cprover_string_literal(this->@class_identifier)
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, code);
+  code.add(
+    code_assign_function_to_string_expr(
+      string_expr,
+      ID_cprover_string_literal_func,
+      {class_identifier},
+      symbol_table));
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  // string_expr1 = substr(string_expr, 6)
+  // We do this to remove the "java::" prefix
+  string_exprt string_expr1=fresh_string_expr(loc, symbol_table, code);
+  code.add(
+    code_assign_function_to_string_expr(
+      string_expr1,
+      ID_cprover_string_substring_func,
+      {string_expr, from_integer(6, java_int_type())},
+      symbol_table));
+  exprt string_expr_sym1=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym1, string_expr1));
+
+  // string1 = (String*) string_expr
+  pointer_typet string_ptr_type=
+    java_reference_type(symbol_table.lookup("java::java.lang.String").type);
+  exprt string1=allocate_fresh_string(string_ptr_type, loc, symbol_table, code);
+  code.add(
+    code_assign_string_expr_to_new_java_string(
+      string1, string_expr1, loc, symbol_table));
+
+  // > class1 = Class.forName(string1)
+  code_function_callt fun_call;
+  fun_call.function()=symbol_exprt(
+    "java::java.lang.Class.forName:(Ljava/lang/String;)Ljava/lang/Class;");
+  fun_call.lhs()=class1;
+  fun_call.arguments().push_back(string1);
+  code_typet fun_type;
+  fun_type.return_type()=string1.type();
+  fun_call.function().type()=fun_type;
+  code.add(fun_call);
+
+  // > return class1;
+  code.add(code_returnt(class1));
+  return code;
+}
+
+/// Provide code for a function that calls a function from the solver and simply
+/// returns it.
+/// \param function_name: name of the function to be called
+/// \param type: type of the function
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \return Code corresponding to:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// return function_name(args)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_function_from_call(
+  const irep_idt &function_name,
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  code_blockt code;
+  exprt::operandst args=process_parameters(
+    type.parameters(), loc, symbol_table, code);
+  code.add(code_return_function_application(
+    function_name, args, type.return_type(), symbol_table));
+  return code;
+}
+
+/// Provide code for a function that calls a function from the solver and return
+/// the string_expr result as a Java string.
+/// \param function_name: name of the function to be called
+/// \param type: type of the function
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \return Code corresponding to:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// string_expr = function_name(args)
+/// string = new String
+/// string = string_expr_to_string(string)
+/// return string
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::
+  make_string_returning_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table)
+{
+  // Code for the output
+  code_blockt code;
+
+  // Calling the function
+  exprt::operandst arguments=process_parameters(
+    type.parameters(), loc, symbol_table, code);
+
+  // String expression that will hold the result
+  string_exprt string_expr=string_expr_of_function_application(
+    function_name, arguments, loc, symbol_table, code);
+
+  // Assign string_expr to symbol to keep track of it
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  // Assign to string
+  exprt str=allocate_fresh_string(type.return_type(), loc, symbol_table, code);
+  code.add(code_assign_string_expr_to_new_java_string(
+    str, string_expr, loc, symbol_table));
+
+  // Return value
+  code.add(code_returnt(str));
+  return code;
+}
+
+/// Generates code for a function which copies a string object to a new string
+/// object.
+/// \param type: type of the function
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \return Code corresponding to:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// string_expr = string_to_string_expr(arg0)
+/// string_expr_sym = { string_expr.length; string_expr.content }
+/// str = new String
+/// str = string_expr_to_string(string_expr)
+/// return str
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_copy_string_code(
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  // Code for the output
+  code_blockt code;
+
+  // String expression that will hold the result
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, code);
+
+  // Assign the argument to string_expr
+  code_typet::parametert op=type.parameters()[0];
+  symbol_exprt arg0(op.get_identifier(), op.type());
+  code.add(code_assign_java_string_to_string_expr(
+    string_expr, arg0, symbol_table));
+
+  // Assign string_expr to string_expr_sym
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  // Allocate and assign the string
+  exprt str=allocate_fresh_string(type.return_type(), loc, symbol_table, code);
+  code.add(code_assign_string_expr_to_new_java_string(
+    str, string_expr, loc, symbol_table));
+
+  // Return value
+  code.add(code_returnt(str));
+  return code;
+}
+
+/// Generates code for a constructor of a string object from another string
+/// object.
+/// \param type: type of the function
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \return Code corresponding to:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// string_expr = java_string_to_string_expr(arg1)
+/// string_expr_sym = { string_expr.length; string_expr.content }
+/// this = string_expr_to_java_string(string_expr)
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_copy_constructor_code(
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  // Code for the output
+  code_blockt code;
+
+  // String expression that will hold the result
+  string_exprt string_expr=fresh_string_expr(loc, symbol_table, code);
+
+  // Assign argument to a string_expr
+  code_typet::parameterst params=type.parameters();
+  symbol_exprt arg1(params[1].get_identifier(), params[1].type());
+  code.add(code_assign_java_string_to_string_expr(
+    string_expr, arg1, symbol_table));
+
+  // Assign string_expr to symbol to keep track of it
+  exprt string_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(string_expr_sym, string_expr));
+
+  // Assign string_expr to `this` object
+  symbol_exprt arg_this(params[0].get_identifier(), params[0].type());
+  code.add(code_assign_string_expr_to_new_java_string(
+    arg_this, string_expr, loc, symbol_table));
+
+  return code;
+}
+
+/// Generates code for the String.length method
+/// \param type: type of the function
+/// \param loc: location in the source
+/// \param symbol_table: symbol table
+/// \return Code corresponding to:
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/// str_expr = java_string_to_string_expr(this)
+/// str_expr_sym = str_expr
+/// return this->length
+/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+codet java_string_library_preprocesst::make_string_length_code(
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  // Code for the output
+  code_blockt code;
+
+  code_typet::parameterst params=type.parameters();
+  symbol_exprt arg_this(params[0].get_identifier(), params[0].type());
+  dereference_exprt deref=
+    checked_dereference(arg_this, arg_this.type().subtype());
+
+  // Create a new string_exprt to be picked up by the solver
+  string_exprt str_expr=fresh_string_expr(loc, symbol_table, code);
+
+  // Assign this to str_expr
+  code.add(
+    code_assign_java_string_to_string_expr(str_expr, arg_this, symbol_table));
+
+  // Assign str_expr to str_expr_sym for that expression to be present in the
+  // symbol table in order to be processed by the string solver
+  exprt str_expr_sym=fresh_string_expr_symbol(loc, symbol_table, code);
+  code.add(code_assignt(str_expr_sym, str_expr));
+  code.add(code_returnt(get_length(deref, symbol_table)));
+
+  return code;
+}
+
+/// Should be called to provide code for string functions that are used in the
+/// code but for which no implementation is provided.
+/// \param function_id: name of the function
+/// \param type: its type
+/// \param loc: location in the program
+/// \param symbol_table: a symbol table
+/// \return Code for the body of the String functions if they are part of the
+///   supported String functions, nil_exprt otherwise.
+exprt java_string_library_preprocesst::code_for_function(
+  const irep_idt &function_id,
+  const code_typet &type,
+  const source_locationt &loc,
+  symbol_tablet &symbol_table)
+{
+  auto it_id=cprover_equivalent_to_java_function.find(function_id);
+  if(it_id!=cprover_equivalent_to_java_function.end())
+    return make_function_from_call(it_id->second, type, loc, symbol_table);
+
+  it_id=cprover_equivalent_to_java_string_returning_function.find(function_id);
+  if(it_id!=cprover_equivalent_to_java_string_returning_function.end())
+    return make_string_returning_function_from_call(
+      it_id->second, type, loc, symbol_table);
+
+  it_id=cprover_equivalent_to_java_constructor.find(function_id);
+  if(it_id!=cprover_equivalent_to_java_constructor.end())
+    return make_init_function_from_call(
+      it_id->second, type, loc, symbol_table);
+
+  it_id=cprover_equivalent_to_java_assign_and_return_function.find(function_id);
+  if(it_id!=cprover_equivalent_to_java_assign_and_return_function.end())
+    return make_assign_and_return_function_from_call(
+      it_id->second, type, loc, symbol_table);
+
+  it_id=cprover_equivalent_to_java_assign_function.find(function_id);
+  if(it_id!=cprover_equivalent_to_java_assign_function.end())
+    return make_assign_function_from_call(
+      it_id->second, type, loc, symbol_table);
+
+  auto it=conversion_table.find(function_id);
+  if(it!=conversion_table.end())
+    return it->second(type, loc, symbol_table);
+
+  return nil_exprt();
+}
+
+/// Check whether a class name is known as a string type.
+/// \param class_name: name of the class
+/// \return True if the type is one that is known to our preprocessing, false
+///   otherwise
+bool java_string_library_preprocesst::is_known_string_type(
+  irep_idt class_name)
+{
+  return string_types.find(class_name)!=string_types.end();
+}
+
+/// fill maps with correspondence from java method names to conversion functions
+void java_string_library_preprocesst::initialize_conversion_table()
+{
+  character_preprocess.initialize_conversion_table();
+
+  string_types=
+    std::unordered_set<irep_idt, irep_id_hash>{"java.lang.String",
+                                               "java.lang.StringBuilder",
+                                               "java.lang.CharSequence",
+                                               "java.lang.StringBuffer"};
+
+  // The following list of function is organized by libraries, with
+  // constructors first and then methods in alphabetic order.
+  // Methods that are not supported here should ultimately have Java models
+  // provided for them in the class-path.
+
+  // String library
+  conversion_table
+    ["java::java.lang.String.<init>:(Ljava/lang/String;)V"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_constructor_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  conversion_table
+    ["java::java.lang.String.<init>:(Ljava/lang/StringBuilder;)V"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_constructor_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_constructor
+    ["java::java.lang.String.<init>:([C)V"]=
+      ID_cprover_string_copy_func;
+  cprover_equivalent_to_java_constructor
+    ["java::java.lang.String.<init>:([CII)V"]=
+      ID_cprover_string_copy_func;
+  cprover_equivalent_to_java_constructor
+    ["java::java.lang.String.<init>:()V"]=
+      ID_cprover_string_empty_string_func;
+
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.charAt:(I)C"]=
+      ID_cprover_string_char_at_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.codePointAt:(I)I"]=
+      ID_cprover_string_code_point_at_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.codePointBefore:(I)I"]=
+      ID_cprover_string_code_point_before_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.codePointCount:(II)I"]=
+      ID_cprover_string_code_point_count_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.compareTo:(Ljava/lang/String;)I"]=
+      ID_cprover_string_compare_to_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.concat:(Ljava/lang/String;)Ljava/lang/String;"]=
+      ID_cprover_string_concat_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.contains:(Ljava/lang/CharSequence;)Z"]=
+    ID_cprover_string_contains_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.copyValueOf:([CII)Ljava/lang/String;"]=
+    ID_cprover_string_copy_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.copyValueOf:([C)Ljava/lang/String;"]=
+    ID_cprover_string_copy_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.endsWith:(Ljava/lang/String;)Z"]=
+      ID_cprover_string_endswith_func;
+
+  conversion_table["java::java.lang.String.equals:(Ljava/lang/Object;)Z"]=
+    std::bind(
+      &java_string_library_preprocesst::make_equals_function_code,
+      this,
+      std::placeholders::_1,
+      std::placeholders::_2,
+      std::placeholders::_3);
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.equalsIgnoreCase:(Ljava/lang/String;)Z"]=
+      ID_cprover_string_equals_ignore_case_func;
+  conversion_table
+    ["java::java.lang.String.format:(Ljava/lang/String;[Ljava/lang/Object;)"
+      "Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_string_format_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.hashCode:()I"]=
+      ID_cprover_string_hash_code_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.indexOf:(I)I"]=
+      ID_cprover_string_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.indexOf:(II)I"]=
+      ID_cprover_string_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.indexOf:(Ljava/lang/String;)I"]=
+      ID_cprover_string_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.indexOf:(Ljava/lang/String;I)I"]=
+      ID_cprover_string_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.intern:()Ljava/lang/String;"]=
+      ID_cprover_string_intern_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.isEmpty:()Z"]=
+      ID_cprover_string_is_empty_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.lastIndexOf:(I)I"]=
+      ID_cprover_string_last_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.lastIndexOf:(II)I"]=
+      ID_cprover_string_last_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.lastIndexOf:(Ljava/lang/String;)I"]=
+      ID_cprover_string_last_index_of_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.lastIndexOf:(Ljava/lang/String;I)I"]=
+      ID_cprover_string_last_index_of_func;
+  conversion_table
+    ["java::java.lang.String.length:()I"]=
+      std::bind(
+        &java_string_library_preprocesst::make_string_length_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.offsetByCodePoints:(II)I"]=
+      ID_cprover_string_offset_by_code_point_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.replace:(CC)Ljava/lang/String;"]=
+      ID_cprover_string_replace_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.startsWith:(Ljava/lang/String;)Z"]=
+      ID_cprover_string_startswith_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.String.startsWith:(Ljava/lang/String;I)Z"]=
+      ID_cprover_string_startswith_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.subSequence:(II)Ljava/lang/CharSequence;"]=
+      ID_cprover_string_substring_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.substring:(II)Ljava/lang/String;"]=
+      ID_cprover_string_substring_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.substring:(I)Ljava/lang/String;"]=
+      ID_cprover_string_substring_func;
+  conversion_table
+    ["java::java.lang.String.toCharArray:()[C"]=
+      std::bind(
+        &java_string_library_preprocesst::make_string_to_char_array_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.toLowerCase:()Ljava/lang/String;"]=
+      ID_cprover_string_to_lower_case_func;
+  conversion_table
+    ["java::java.lang.String.toString:()Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.toUpperCase:()Ljava/lang/String;"]=
+      ID_cprover_string_to_upper_case_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.trim:()Ljava/lang/String;"]=
+      ID_cprover_string_trim_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.valueOf:(Z)Ljava/lang/String;"]=
+      ID_cprover_string_of_bool_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.valueOf:(C)Ljava/lang/String;"]=
+      ID_cprover_string_of_char_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.valueOf:([C)Ljava/lang/String;"]=
+      ID_cprover_string_copy_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.valueOf:([CII)Ljava/lang/String;"]=
+      ID_cprover_string_copy_func;
+  conversion_table
+    ["java::java.lang.String.valueOf:(D)Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_float_to_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  conversion_table
+    ["java::java.lang.String.valueOf:(F)Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_float_to_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.valueOf:(I)Ljava/lang/String;"]=
+      ID_cprover_string_of_int_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.String.valueOf:(J)Ljava/lang/String;"]=
+      ID_cprover_string_of_long_func;
+
+  // StringBuilder library
+  conversion_table
+    ["java::java.lang.StringBuilder.<init>:(Ljava/lang/String;)V"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_constructor_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_constructor
+    ["java::java.lang.StringBuilder.<init>:()V"]=
+      ID_cprover_string_empty_string_func;
+
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.append:(C)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_concat_char_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.append:([C)"
+      "Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_concat_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.append:(D)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_concat_double_func;
+  cprover_equivalent_to_java_assign_and_return_function
+      ["java::java.lang.StringBuilder.append:(Ljava/lang/CharSequence;II)"
+        "Ljava/lang/StringBuilder;"]=
+        ID_cprover_string_concat_func;
+    cprover_equivalent_to_java_assign_and_return_function
+      ["java::java.lang.StringBuilder.append:(Ljava/lang/CharSequence;)"
+        "Ljava/lang/StringBuilder;"]=
+        ID_cprover_string_concat_func;
+    cprover_equivalent_to_java_assign_and_return_function
+      ["java::java.lang.StringBuilder.append:(Ljava/lang/String;)"
+        "Ljava/lang/StringBuilder;"]=
+        ID_cprover_string_concat_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.append:(Z)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_concat_bool_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.appendCodePoint:(I)"
+     "Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_concat_code_point_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuilder.charAt:(I)C"]=
+      ID_cprover_string_char_at_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuilder.codePointAt:(I)I"]=
+      ID_cprover_string_code_point_at_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuilder.codePointBefore:(I)I"]=
+      ID_cprover_string_code_point_before_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuilder.codePointCount:(II)I"]=
+      ID_cprover_string_code_point_count_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.delete:(II)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_delete_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.deleteCharAt:(I)Ljava/lang/StringBuilder;"]=
+    ID_cprover_string_delete_char_at_func;
+  cprover_equivalent_to_java_assign_and_return_function
+      ["java::java.lang.StringBuilder.insert:(IC)Ljava/lang/StringBuilder;"]=
+        ID_cprover_string_insert_char_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.insert:(I[C)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_insert_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.insert:(I[CII)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_insert_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.insert:(IZ)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_insert_bool_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.insert:(II)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_insert_int_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.insert:(IJ)Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_insert_long_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuilder.insert:(ILjava/lang/String;)"
+     "Ljava/lang/StringBuilder;"]=
+      ID_cprover_string_insert_func;
+  conversion_table
+    ["java::java.lang.StringBuilder.length:()I"]=
+      std::bind(
+        &java_string_library_preprocesst::make_string_length_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_assign_function
+    ["java::java.lang.StringBuilder.setCharAt:(IC)V"]=
+      ID_cprover_string_char_set_func;
+  cprover_equivalent_to_java_assign_function
+    ["java::java.lang.StringBuilder.setLength:(I)V"]=
+      ID_cprover_string_set_length_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.StringBuilder.substring:(II)Ljava/lang/String;"]=
+      ID_cprover_string_substring_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.StringBuilder.substring:(I)Ljava/lang/String;"]=
+      ID_cprover_string_substring_func;
+  conversion_table
+    ["java::java.lang.StringBuilder.toString:()Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+
+  // StringBuffer library
+  conversion_table
+    ["java::java.lang.StringBuffer.<init>:(Ljava/lang/String;)V"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_constructor_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_constructor
+    ["java::java.lang.StringBuffer.<init>:()V"]=
+      ID_cprover_string_empty_string_func;
+
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(C)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_char_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:([C)"
+      "Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(D)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_double_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(F)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_float_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(I)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_int_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(J)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_long_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(Ljava/lang/String;)"
+      "Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.append:(Z)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_bool_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.appendCodePoint:(I)"
+     "Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_concat_code_point_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuffer.charAt:(I)C"]=
+      ID_cprover_string_char_at_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuffer.codePointAt:(I)I"]=
+      ID_cprover_string_code_point_at_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuffer.codePointBefore:(I)I"]=
+      ID_cprover_string_code_point_before_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.StringBuffer.codePointCount:(II)I"]=
+      ID_cprover_string_code_point_count_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.delete:(II)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_delete_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.deleteCharAt:(I)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_delete_char_at_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(IC)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_char_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(I[C)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(I[CII)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(II)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_int_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(IJ)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_long_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(ILjava/lang/String;)"
+     "Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_func;
+  cprover_equivalent_to_java_assign_and_return_function
+    ["java::java.lang.StringBuffer.insert:(IZ)Ljava/lang/StringBuffer;"]=
+      ID_cprover_string_insert_bool_func;
+  conversion_table
+    ["java::java.lang.StringBuffer.length:()I"]=
+      conversion_table["java::java.lang.String.length:()I"];
+  cprover_equivalent_to_java_assign_function
+    ["java::java.lang.StringBuffer.setCharAt:(IC)V"]=
+      ID_cprover_string_char_set_func;
+  cprover_equivalent_to_java_assign_function
+    ["java::java.lang.StringBuffer.setLength:(I)V"]=
+    ID_cprover_string_set_length_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.StringBuffer.substring:(I)Ljava/lang/String;"]=
+      ID_cprover_string_substring_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.StringBuffer.substring:(II)Ljava/lang/String;"]=
+      ID_cprover_string_substring_func;
+  conversion_table
+    ["java::java.lang.StringBuffer.toString:()Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+
+  // CharSequence library
+  cprover_equivalent_to_java_function
+    ["java::java.lang.CharSequence.charAt:(I)C"]=
+      ID_cprover_string_char_at_func;
+  conversion_table
+    ["java::java.lang.CharSequence.toString:()Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_copy_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  conversion_table
+    ["java::java.lang.CharSequence.length:()I"]=
+      conversion_table["java::java.lang.String.length:()I"];
+
+  // Other libraries
+  conversion_table
+    ["java::java.lang.Float.toString:(F)Ljava/lang/String;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_float_to_string_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+  cprover_equivalent_to_java_function
+    ["java::java.lang.Integer.parseInt:(Ljava/lang/String;)I"]=
+      ID_cprover_string_parse_int_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.Integer.parseInt:(Ljava/lang/String;I)I"]=
+      ID_cprover_string_parse_int_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.Long.parseLong:(Ljava/lang/String;)J"]=
+      ID_cprover_string_parse_int_func;
+  cprover_equivalent_to_java_function
+    ["java::java.lang.Long.parseLong:(Ljava/lang/String;I)J"]=
+      ID_cprover_string_parse_int_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.Integer.toHexString:(I)Ljava/lang/String;"]=
+      ID_cprover_string_of_int_hex_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.Integer.toString:(I)Ljava/lang/String;"]=
+      ID_cprover_string_of_int_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.Integer.toString:(II)Ljava/lang/String;"]=
+      ID_cprover_string_of_int_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.Long.toString:(J)Ljava/lang/String;"]=
+      ID_cprover_string_of_int_func;
+  cprover_equivalent_to_java_string_returning_function
+    ["java::java.lang.Long.toString:(JI)Ljava/lang/String;"]=
+      ID_cprover_string_of_int_func;
+  conversion_table
+    ["java::java.lang.Object.getClass:()Ljava/lang/Class;"]=
+      std::bind(
+        &java_string_library_preprocesst::make_object_get_class_code,
+        this,
+        std::placeholders::_1,
+        std::placeholders::_2,
+        std::placeholders::_3);
+}
diff --git a/src/java_bytecode/java_string_library_preprocess.h b/src/java_bytecode/java_string_library_preprocess.h
new file mode 100644
index 00000000000..cc8dd4cf469
--- /dev/null
+++ b/src/java_bytecode/java_string_library_preprocess.h
@@ -0,0 +1,345 @@
+/*******************************************************************\
+
+Module: Produce code for simple implementation of String Java libraries
+
+Author: Romain Brenguier
+
+Date:   March 2017
+
+\*******************************************************************/
+
+/// \file
+/// Produce code for simple implementation of String Java libraries
+
+#ifndef CPROVER_JAVA_BYTECODE_JAVA_STRING_LIBRARY_PREPROCESS_H
+#define CPROVER_JAVA_BYTECODE_JAVA_STRING_LIBRARY_PREPROCESS_H
+
+#include <util/ui_message.h>
+#include <util/std_code.h>
+#include <util/symbol_table.h>
+#include <util/refined_string_type.h>
+#include <util/string_expr.h>
+
+#include <util/ieee_float.h> // should get rid of this
+
+#include <unordered_set>
+#include <functional>
+#include "character_refine_preprocess.h"
+#include "java_types.h"
+
+// Arbitrary limit of 10 arguments for the number of arguments to String.format
+#define MAX_FORMAT_ARGS 10
+
+class java_string_library_preprocesst:public messaget
+{
+public:
+  java_string_library_preprocesst():
+    refined_string_type(java_int_type(), java_char_type()) {}
+
+  void initialize_conversion_table();
+  void initialize_refined_string_type();
+
+  exprt code_for_function(
+    const irep_idt &function_id,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet replace_character_call(code_function_callt call)
+  {
+    return character_preprocess.replace_character_call(call);
+  }
+  void add_string_type(const irep_idt &class_name, symbol_tablet &symbol_table);
+  bool is_known_string_type(irep_idt class_name);
+
+private:
+  // We forbid copies of the object
+  java_string_library_preprocesst(
+    const java_string_library_preprocesst &)=delete;
+
+  static bool java_type_matches_tag(const typet &type, const std::string &tag);
+  static bool is_java_string_pointer_type(const typet &type);
+  static bool is_java_string_type(const typet &type);
+  static bool is_java_string_builder_type(const typet &type);
+  static bool is_java_string_builder_pointer_type(const typet &type);
+  static bool is_java_string_buffer_type(const typet &type);
+  static bool is_java_string_buffer_pointer_type(const typet &type);
+  static bool is_java_char_sequence_type(const typet &type);
+  static bool is_java_char_sequence_pointer_type(const typet &type);
+  static bool is_java_char_array_type(const typet &type);
+  static bool is_java_char_array_pointer_type(const typet &type);
+  static bool implements_java_char_sequence(const typet &type)
+  {
+    return
+      is_java_char_sequence_pointer_type(type) ||
+      is_java_string_builder_pointer_type(type) ||
+      is_java_string_buffer_pointer_type(type) ||
+      is_java_string_pointer_type(type);
+  }
+
+  character_refine_preprocesst character_preprocess;
+
+  const refined_string_typet refined_string_type;
+
+  typedef
+    std::function<codet(
+      const code_typet &, const source_locationt &, symbol_tablet &)>
+    conversion_functiont;
+
+  typedef std::unordered_map<irep_idt, irep_idt, irep_id_hash> id_mapt;
+
+  // Table mapping each java method signature to the code generating function
+  std::unordered_map<irep_idt, conversion_functiont, irep_id_hash>
+    conversion_table;
+
+  // Some Java functions have an equivalent in the solver that we will
+  // call with the same argument and will return the same result
+  id_mapt cprover_equivalent_to_java_function;
+
+  // Some Java functions have an equivalent except that they should
+  // return Java Strings instead of string_exprt
+  id_mapt cprover_equivalent_to_java_string_returning_function;
+
+  // Some Java initialization function initialize strings with the
+  // same result as some function of the solver
+  id_mapt cprover_equivalent_to_java_constructor;
+
+  // Some Java functions have an equivalent in the solver except that
+  // in addition they assign the result to the object on which it is called
+  id_mapt cprover_equivalent_to_java_assign_and_return_function;
+
+  // Some Java functions have an equivalent in the solver except that
+  // they assign the result to the object on which it is called instead
+  // of returning it
+  id_mapt cprover_equivalent_to_java_assign_function;
+
+  // A set tells us what java types should be considered as string objects
+  std::unordered_set<irep_idt, irep_id_hash> string_types;
+
+  codet make_equals_function_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_float_to_string_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_string_to_char_array_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_string_format_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_copy_string_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_copy_constructor_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_string_length_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_object_get_class_code(
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  // Auxiliary functions
+  codet code_for_scientific_notation(
+    const exprt &arg,
+    const ieee_float_spect &float_spec,
+    const string_exprt &string_expr,
+    const exprt &tmp_string,
+    const refined_string_typet &refined_string_type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  // Helper functions
+  exprt::operandst process_parameters(
+    const code_typet::parameterst &params,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &init_code);
+
+  void process_single_operand(
+    exprt::operandst &processed_ops,
+    const exprt &deref,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &init_code);
+
+  exprt::operandst process_operands(
+    const exprt::operandst &operands,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &init_code);
+
+  exprt::operandst process_equals_function_operands(
+    const exprt::operandst &operands,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &init_code);
+
+  string_exprt replace_char_array(
+    const exprt &array_pointer,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  void declare_function(
+    irep_idt function_name, const typet &type, symbol_tablet &symbol_table);
+
+  typet get_data_type(
+    const typet &type, const symbol_tablet &symbol_table);
+  typet get_length_type(
+    const typet &type, const symbol_tablet &symbol_table);
+  exprt get_data(const exprt &expr, const symbol_tablet &symbol_table);
+  exprt get_length(const exprt &expr, const symbol_tablet &symbol_table);
+
+  symbol_exprt fresh_string(
+    const typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  symbol_exprt fresh_array(
+    const typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  string_exprt fresh_string_expr(
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  exprt fresh_string_expr_symbol(
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  exprt allocate_fresh_string(
+    const typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  exprt allocate_fresh_array(
+    const typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  exprt make_function_application(
+    const irep_idt &function_name,
+    const exprt::operandst &arguments,
+    const typet &type,
+    symbol_tablet &symbol_table);
+
+  codet code_assign_function_application(
+    const exprt &lhs,
+    const irep_idt &function_name,
+    const exprt::operandst &arguments,
+    symbol_tablet &symbol_table);
+
+  codet code_return_function_application(
+    const irep_idt &function_name,
+    const exprt::operandst &arguments,
+    const typet &type,
+    symbol_tablet &symbol_table);
+
+  codet code_assign_function_to_string_expr(
+    const string_exprt &string_expr,
+    const irep_idt &function_name,
+    const exprt::operandst &arguments,
+    symbol_tablet &symbol_table);
+
+  string_exprt string_expr_of_function_application(
+    const irep_idt &function_name,
+    const exprt::operandst &arguments,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  codet code_assign_components_to_java_string(
+    const exprt &lhs,
+    const exprt &rhs_array,
+    const exprt &rhs_length,
+    symbol_tablet &symbol_table);
+
+  codet code_assign_string_expr_to_java_string(
+    const exprt &lhs, const string_exprt &rhs, symbol_tablet &symbol_table);
+
+  codet code_assign_string_expr_to_new_java_string(
+    const exprt &lhs,
+    const string_exprt &rhs,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet code_assign_java_string_to_string_expr(
+    const string_exprt &lhs, const exprt &rhs, symbol_tablet &symbol_table);
+
+  codet code_assign_string_literal_to_string_expr(
+    const string_exprt &lhs,
+    const std::string &s,
+    symbol_tablet &symbol_table);
+
+  codet make_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_init_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    bool ignore_first_arg=true);
+
+  codet make_assign_and_return_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_assign_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  codet make_string_returning_function_from_call(
+    const irep_idt &function_name,
+    const code_typet &type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table);
+
+  exprt make_argument_for_format(const exprt &argv,
+    int index,
+    const struct_typet &structured_type,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  exprt get_primitive_value_of_object(
+    const exprt &object,
+    irep_idt type_name,
+    const source_locationt &loc,
+    symbol_tablet &symbol_table,
+    code_blockt &code);
+
+  exprt get_object_at_index(const exprt &argv, int index);
+};
+
+#endif // CPROVER_JAVA_BYTECODE_JAVA_STRING_LIBRARY_PREPROCESS_H
diff --git a/src/java_bytecode/java_types.cpp b/src/java_bytecode/java_types.cpp
index ae8d64d102f..22d59cf95e0 100644
--- a/src/java_bytecode/java_types.cpp
+++ b/src/java_bytecode/java_types.cpp
@@ -11,6 +11,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <cassert>
 #include <cctype>
 
+#include <util/prefix.h>
 #include <util/std_types.h>
 #include <util/c_types.h>
 #include <util/std_expr.h>
@@ -91,7 +92,7 @@ reference_typet java_array_type(const char subtype)
   case 'j': subtype_str="long"; break;
   case 'l': subtype_str="long"; break;
   case 'a': subtype_str="reference"; break;
-  default: assert(false);
+  default: UNREACHABLE;
   }
 
   irep_idt class_name="array["+subtype_str+"]";
@@ -103,6 +104,14 @@ reference_typet java_array_type(const char subtype)
   return java_reference_type(symbol_type);
 }
 
+/// See above
+/// \par parameters: Struct tag 'tag'
+/// \return True if the given struct is a Java array
+bool is_java_array_tag(const irep_idt& tag)
+{
+  return has_prefix(id2string(tag), "java::array[");
+}
+
 bool is_reference_type(const char t)
 {
   return 'a' == t;
@@ -122,7 +131,7 @@ typet java_type_from_char(char t)
   case 'd': return java_double_type();
   case 'z': return java_boolean_type();
   case 'a': return java_reference_type(void_typet());
-  default: assert(false); return nil_typet();
+  default: UNREACHABLE; return nil_typet();
   }
 }
 
@@ -305,3 +314,47 @@ symbol_typet java_classname(const std::string &id)
 
   return symbol_type;
 }
+
+/// Programmatic documentation of the structure of a Java array (of either
+/// primitives or references) type.
+/// A Java array is represented in GOTO in the following way:
+/// A struct component with a tag like java::array[type] where type is either
+/// a primitive like int, or reference.
+/// The struct has precisely three components:
+/// 1. \@java.lang.Object: of type struct {java.lang.Object} containing the base
+///   class data
+/// 2. length: of type Java integer - the length of the array
+/// 3. data: of type pointer to either pointer to a primitive type, or pointer
+///   to pointer to empty (i.e. a void**) pointing to the contents of the array
+/// \param type: A type that might represent a Java array
+/// \return True if it is a Java array type, false otherwise
+bool is_valid_java_array(const struct_typet &type)
+{
+  bool correct_num_components=type.components().size()==3;
+  if(!correct_num_components)
+    return false;
+
+  // First component, the base class (Object) data
+  const struct_union_typet::componentt base_class_component=
+    type.components()[0];
+
+  bool base_component_valid=true;
+  base_component_valid&=base_class_component.get_name()=="@java.lang.Object";
+
+  bool length_component_valid=true;
+  const struct_union_typet::componentt length_component=
+    type.components()[1];
+  length_component_valid&=length_component.get_name()=="length";
+  length_component_valid&=length_component.type()==java_int_type();
+
+  bool data_component_valid=true;
+  const struct_union_typet::componentt data_component=
+    type.components()[2];
+  data_component_valid&=data_component.get_name()=="data";
+  data_component_valid&=data_component.type().id()==ID_pointer;
+
+  return correct_num_components &&
+    base_component_valid &&
+    length_component_valid &&
+    data_component_valid;
+}
diff --git a/src/java_bytecode/java_types.h b/src/java_bytecode/java_types.h
index 43b24bb6934..27ec5becbb4 100644
--- a/src/java_bytecode/java_types.h
+++ b/src/java_bytecode/java_types.h
@@ -13,6 +13,32 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/type.h>
 #include <util/std_types.h>
 
+class java_class_typet:public class_typet
+{
+ public:
+  const irep_idt &get_access() const
+  {
+    return get(ID_access);
+  }
+
+  void set_access(const irep_idt &access)
+  {
+    return set(ID_access, access);
+  }
+};
+
+inline const java_class_typet &to_java_class_type(const typet &type)
+{
+  assert(type.id()==ID_struct);
+  return static_cast<const java_class_typet &>(type);
+}
+
+inline java_class_typet &to_java_class_type(typet &type)
+{
+  assert(type.id()==ID_struct);
+  return static_cast<java_class_typet &>(type);
+}
+
 typet java_int_type();
 typet java_long_type();
 typet java_short_type();
@@ -46,4 +72,8 @@ char java_char_from_type(const typet &type);
 typet java_bytecode_promotion(const typet &);
 exprt java_bytecode_promotion(const exprt &);
 
+bool is_java_array_tag(const irep_idt& tag);
+
+bool is_valid_java_array(const struct_typet &type);
+
 #endif // CPROVER_JAVA_BYTECODE_JAVA_TYPES_H
diff --git a/src/java_bytecode/java_utils.cpp b/src/java_bytecode/java_utils.cpp
index 6611b359f00..36b98dc0ccd 100644
--- a/src/java_bytecode/java_utils.cpp
+++ b/src/java_bytecode/java_utils.cpp
@@ -8,8 +8,14 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "java_utils.h"
 
+#include "java_root_class.h"
+#include "java_types.h"
+
+#include <util/invariant.h>
+#include <util/message.h>
 #include <util/prefix.h>
 #include <util/std_types.h>
+#include <util/string_utils.h>
 
 bool java_is_array_type(const typet &type)
 {
@@ -19,3 +25,158 @@ bool java_is_array_type(const typet &type)
     to_struct_type(type).get_tag()),
                     "java::array[");
 }
+
+unsigned java_local_variable_slots(const typet &t)
+{
+
+  // Even on a 64-bit platform, Java pointers occupy one slot:
+  if(t.id()==ID_pointer)
+    return 1;
+
+  unsigned bitwidth;
+
+  bitwidth=t.get_unsigned_int(ID_width);
+  INVARIANT(
+    bitwidth==8 ||
+    bitwidth==16 ||
+    bitwidth==32 ||
+    bitwidth==64,
+    "all types constructed in java_types.cpp encode JVM types "
+    "with these bit widths");
+
+  return bitwidth==64 ? 2 : 1;
+}
+
+unsigned java_method_parameter_slots(const code_typet &t)
+{
+  unsigned slots=0;
+
+  for(const auto &p : t.parameters())
+    slots+=java_local_variable_slots(p.type());
+
+  return slots;
+}
+
+const std::string java_class_to_package(const std::string &canonical_classname)
+{
+  return trim_from_last_delimiter(canonical_classname, '.');
+}
+
+void generate_class_stub(
+  const irep_idt &class_name,
+  symbol_tablet &symbol_table,
+  message_handlert &message_handler)
+{
+  class_typet class_type;
+
+  class_type.set_tag(class_name);
+  class_type.set(ID_base_name, class_name);
+
+  class_type.set(ID_incomplete_class, true);
+
+  // produce class symbol
+  symbolt new_symbol;
+  new_symbol.base_name=class_name;
+  new_symbol.pretty_name=class_name;
+  new_symbol.name="java::"+id2string(class_name);
+  class_type.set(ID_name, new_symbol.name);
+  new_symbol.type=class_type;
+  new_symbol.mode=ID_java;
+  new_symbol.is_type=true;
+
+  symbolt *class_symbol;
+
+  if(symbol_table.move(new_symbol, class_symbol))
+  {
+    messaget message(message_handler);
+    message.warning() <<
+      "stub class symbol " <<
+      new_symbol.name <<
+      " already exists" << messaget::eom;
+  }
+  else
+  {
+    // create the class identifier etc
+    java_root_class(*class_symbol);
+  }
+}
+
+void merge_source_location_rec(
+  exprt &expr,
+  const source_locationt &source_location)
+{
+  expr.add_source_location().merge(source_location);
+  for(exprt &op : expr.operands())
+    merge_source_location_rec(op, source_location);
+}
+
+bool is_java_string_literal_id(const irep_idt &id)
+{
+  return has_prefix(id2string(id), JAVA_STRING_LITERAL_PREFIX);
+}
+
+irep_idt resolve_friendly_method_name(
+  const std::string &friendly_name,
+  const symbol_tablet &symbol_table,
+  std::string &error)
+{
+  std::string qualified_name="java::"+friendly_name;
+  if(friendly_name.rfind(':')==std::string::npos)
+  {
+    std::string prefix=qualified_name+':';
+    std::set<irep_idt> matches;
+
+    for(const auto &s : symbol_table.symbols)
+      if(has_prefix(id2string(s.first), prefix) &&
+         s.second.type.id()==ID_code)
+        matches.insert(s.first);
+
+    if(matches.empty())
+    {
+      error="'"+friendly_name+"' not found";
+      return irep_idt();
+    }
+    else if(matches.size()>1)
+    {
+      std::ostringstream message;
+      message << "'"+friendly_name+"' is ambiguous between:";
+
+      // Trim java:: prefix so we can recommend an appropriate input:
+      for(const auto &s : matches)
+        message << "\n  " << id2string(s).substr(6);
+
+      error=message.str();
+      return irep_idt();
+    }
+    else
+    {
+      return *matches.begin();
+    }
+  }
+  else
+  {
+    auto findit=symbol_table.symbols.find(qualified_name);
+    if(findit==symbol_table.symbols.end())
+    {
+      error="'"+friendly_name+"' not found";
+      return irep_idt();
+    }
+    else if(findit->second.type.id()!=ID_code)
+    {
+      error="'"+friendly_name+"' not a function";
+      return irep_idt();
+    }
+    else
+    {
+      return findit->first;
+    }
+  }
+}
+
+dereference_exprt checked_dereference(const exprt &expr, const typet &type)
+{
+  dereference_exprt result(expr, type);
+  // tag it so it's easy to identify during instrumentation
+  result.set(ID_java_member_access, true);
+  return result;
+}
diff --git a/src/java_bytecode/java_utils.h b/src/java_bytecode/java_utils.h
index 4231c15a185..59405c9f9c6 100644
--- a/src/java_bytecode/java_utils.h
+++ b/src/java_bytecode/java_utils.h
@@ -6,6 +6,11 @@ Author: Daniel Kroening, kroening@kroening.com
 
 \*******************************************************************/
 
+#include <util/symbol_table.h>
+#include <util/message.h>
+#include <util/std_expr.h>
+
+#include "java_bytecode_parse_tree.h"
 #ifndef CPROVER_JAVA_BYTECODE_JAVA_UTILS_H
 #define CPROVER_JAVA_BYTECODE_JAVA_UTILS_H
 
@@ -13,4 +18,55 @@ Author: Daniel Kroening, kroening@kroening.com
 
 bool java_is_array_type(const typet &type);
 
+void generate_class_stub(
+  const irep_idt &class_name,
+  symbol_tablet &symbol_table,
+  message_handlert &message_handler);
+
+/// Returns the number of JVM local variables (slots) taken by a local variable
+/// that, when translated to goto, has type \p t.
+unsigned java_local_variable_slots(const typet &t);
+
+/// Returns the the number of JVM local variables (slots) used by the JVM to
+/// pass, upon call, the arguments of a Java method whose type is \p t.
+unsigned java_method_parameter_slots(const code_typet &t);
+
+const std::string java_class_to_package(const std::string &canonical_classname);
+
+/// Attaches a source location to an expression and all of its subexpressions.
+/// Usually only codet needs this, but there are a few known examples of
+/// expressions needing a location, such as
+/// `goto_convertt::do_function_call_symbol` (function() needs a location)
+/// and `goto_convertt::clean_expr` (any subexpression being split into a
+/// separate instruction needs a location), so for safety we give every
+/// mentioned expression a location.
+/// Any code or expressions with source location fields already set keep those
+/// fields using rules of source_locationt::merge.
+void merge_source_location_rec(
+  exprt &expr,
+  const source_locationt &source_location);
+
+#define JAVA_STRING_LITERAL_PREFIX "java::java.lang.String.Literal"
+
+/// \param id: any string
+/// \return Returns true if 'id' identifies a string literal symbol
+bool is_java_string_literal_id(const irep_idt &id);
+
+/// Resolves a user-friendly method name (like packagename.Class.method)
+/// into an internal name (like java::packagename.Class.method:()V)
+/// The input may also have a type descriptor suffix to resolve ambiguity.
+/// On error, returns irep_idt() and sets error.
+/// \param friendly_name: user-friendly method name
+/// \param symbol_table: global symbol table
+/// \param [out] error: gets error description on failure
+irep_idt resolve_friendly_method_name(
+  const std::string &friendly_name,
+  const symbol_tablet &symbol_table,
+  std::string &error);
+
+/// Dereference an expression and flag it for a null-pointer check
+/// \param expr: expression to dereference and check
+/// \param type: expected result type (typically expr.type().subtype())
+dereference_exprt checked_dereference(const exprt &expr, const typet &type);
+
 #endif // CPROVER_JAVA_BYTECODE_JAVA_UTILS_H
diff --git a/src/java_bytecode/library/Makefile b/src/java_bytecode/library/Makefile
new file mode 100644
index 00000000000..aa51ec1694a
--- /dev/null
+++ b/src/java_bytecode/library/Makefile
@@ -0,0 +1,26 @@
+all: org.cprover.jar
+
+SOURCE_DIR := src
+BINARY_DIR := classes
+
+FIND := find
+
+JAVAC := javac
+JFLAGS := -sourcepath $(SOURCE_DIR) -d $(BINARY_DIR)
+
+CLASSPATH := SOURCE_DIR
+
+all_javas := $(shell $(FIND) $(SOURCE_DIR) -name '*.java')
+
+$(BINARY_DIR):
+	mkdir -p $(BINARY_DIR)
+
+.PHONY: compile
+compile: $(BINARY_DIR)
+	$(JAVAC) $(JFLAGS) $(all_javas)
+
+JAR := jar
+JARFLAGS := -cf
+
+org.cprover.jar: compile
+	$(JAR) $(JARFLAGS) $@ -C $(BINARY_DIR) org
diff --git a/src/java_bytecode/library/src/org/cprover/CProver.java b/src/java_bytecode/library/src/org/cprover/CProver.java
new file mode 100644
index 00000000000..6aadd228e9e
--- /dev/null
+++ b/src/java_bytecode/library/src/org/cprover/CProver.java
@@ -0,0 +1,125 @@
+package org.cprover;
+
+public final class CProver
+{
+  public static boolean enableAssume=true;
+  public static boolean enableNondet=true;
+
+  public static boolean nondetBoolean()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetBoolean()");
+    }
+
+    return false;
+  }
+
+  public static byte nondetByte()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetByte()");
+    }
+
+    return 0;
+  }
+
+  public static char nondetChar()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetChar()");
+    }
+
+    return '\0';
+  }
+
+  public static short nondetShort()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetShort()");
+    }
+
+    return 0;
+  }
+
+  public static int nondetInt()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetInt()");
+    }
+
+    return 0;
+  }
+
+  public static long nondetLong()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetLong()");
+    }
+
+    return 0;
+  }
+
+  public static float nondetFloat()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetFloat()");
+    }
+
+    return 0;
+  }
+
+  public static double nondetDouble()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetDouble()");
+    }
+
+    return 0;
+  }
+
+  public static <T> T nondetWithNull()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetWithNull<T>(T)");
+    }
+
+    return null;
+  }
+
+  public static <T> T nondetWithoutNull()
+  {
+    if (enableNondet)
+    {
+      throw new RuntimeException(
+          "Cannot execute program with CProver.nondetWithoutNull<T>(T)");
+    }
+
+    return null;
+  }
+
+  public static void assume(boolean condition)
+  {
+    if(enableAssume && !condition)
+    {
+      throw new RuntimeException("CProver.assume() predicate is false");
+    }
+  }
+}
diff --git a/src/java_bytecode/mz_zip_archive.cpp b/src/java_bytecode/mz_zip_archive.cpp
new file mode 100644
index 00000000000..f467f4ed739
--- /dev/null
+++ b/src/java_bytecode/mz_zip_archive.cpp
@@ -0,0 +1,89 @@
+/*******************************************************************\
+
+Module: mz_zip library wrapper
+
+Author: Diffblue Ltd
+
+\*******************************************************************/
+
+#include "mz_zip_archive.h"
+#include <stdexcept>
+#include <string>
+#include <vector>
+#include <algorithm>
+#define _LARGEFILE64_SOURCE 1
+#include <miniz/miniz.h>
+
+// Original struct is an anonymous struct with a typedef, This is
+// required to remove internals from the header file
+class mz_zip_archive_statet final:public mz_zip_archive
+{
+public:
+  explicit mz_zip_archive_statet(const std::string &filename):
+    mz_zip_archive({ })
+  {
+    if(MZ_TRUE!=mz_zip_reader_init_file(this, filename.data(), 0))
+      throw std::runtime_error("MZT: Could not load a file: "+filename);
+  }
+  mz_zip_archive_statet(const mz_zip_archive_statet &)=delete;
+  mz_zip_archive_statet(mz_zip_archive_statet &&)=delete;
+  mz_zip_archive_statet &operator=(const mz_zip_archive_statet &)=delete;
+  mz_zip_archive_statet &operator=(mz_zip_archive_statet &&)=delete;
+  ~mz_zip_archive_statet()
+  {
+    mz_zip_reader_end(this);
+  }
+};
+
+static_assert(sizeof(mz_uint)<=sizeof(size_t),
+              "size_t cannot store mz_zip file ids, choose a larger type");
+
+mz_zip_archivet::mz_zip_archivet(const std::string &filename):
+  m_state(new mz_zip_archive_statet(filename)) { }
+
+// VS Compatibility
+mz_zip_archivet::mz_zip_archivet(mz_zip_archivet &&other):
+  m_state(std::move(other.m_state)) { }
+
+// Has to be defined here because header is incomplete
+mz_zip_archivet::~mz_zip_archivet()=default;
+
+// VS Compatibility
+mz_zip_archivet &mz_zip_archivet::operator=(mz_zip_archivet &&other)
+{
+  m_state=std::move(other.m_state);
+  return *this;
+}
+
+size_t mz_zip_archivet::get_num_files()
+{
+  return mz_zip_reader_get_num_files(m_state.get());
+}
+
+std::string mz_zip_archivet::get_filename(const size_t index)
+{
+  const auto id=static_cast<mz_uint>(index);
+  std::vector<char> buffer;
+  buffer.resize(mz_zip_reader_get_filename(m_state.get(), id, nullptr, 0));
+  mz_zip_reader_get_filename(m_state.get(), id, buffer.data(), buffer.size());
+  // Buffer may contain junk returned after \0
+  const auto null_char_it=std::find(buffer.cbegin(), buffer.cend(), '\0');
+  return { buffer.cbegin(), null_char_it };
+}
+
+std::string mz_zip_archivet::extract(const size_t index)
+{
+  const auto id=static_cast<mz_uint>(index);
+  mz_zip_archive_file_stat file_stat={ };
+  const mz_bool stat_ok=mz_zip_reader_file_stat(m_state.get(), id, &file_stat);
+  if(stat_ok==MZ_TRUE)
+  {
+    std::vector<char> buffer(file_stat.m_uncomp_size);
+    const mz_bool read_ok=mz_zip_reader_extract_to_mem(
+      m_state.get(), id, buffer.data(), buffer.size(), 0);
+    if(read_ok==MZ_TRUE)
+      return { buffer.cbegin(), buffer.cend() };
+  }
+  throw std::runtime_error("Could not extract the file");
+}
+
diff --git a/src/java_bytecode/mz_zip_archive.h b/src/java_bytecode/mz_zip_archive.h
new file mode 100644
index 00000000000..4e2bbf529d6
--- /dev/null
+++ b/src/java_bytecode/mz_zip_archive.h
@@ -0,0 +1,51 @@
+/*******************************************************************\
+
+Module: mz_zip library wrapper
+
+Author: Diffblue Ltd
+
+\*******************************************************************/
+
+#ifndef CPROVER_JAVA_BYTECODE_MZ_ZIP_ARCHIVE_H
+#define CPROVER_JAVA_BYTECODE_MZ_ZIP_ARCHIVE_H
+
+#include <string>
+#include <memory>
+
+/// State of the mz_zip_archive object
+class mz_zip_archive_statet;
+
+/// Thin object-oriented wrapper around the MZ Zip library
+/// Zip file reader and extractor. Not thread safe. Move only.
+class mz_zip_archivet final
+{
+public:
+  /// Open a zip archive
+  /// \param filename Path of the zip archive
+  /// \throw Throws std::runtime_error if file cannot be opened
+  explicit mz_zip_archivet(const std::string &filename);
+  mz_zip_archivet(const mz_zip_archivet &)=delete;
+  mz_zip_archivet &operator=(const mz_zip_archivet &)=delete;
+  /// Move constructor. Doesn't throw. Leaves other object invalidated.
+  mz_zip_archivet(mz_zip_archivet &&other);
+  /// Move assignment. Doesn't throw. Replaces this object's state
+  /// with other object's state. Invalidates other object.
+  mz_zip_archivet &operator=(mz_zip_archivet &&other);
+  ~mz_zip_archivet();
+
+  /// Get number of files in the archive
+  size_t get_num_files();
+  /// Get file name of nth file in the archive
+  /// \param index id of the file in the archive
+  /// \return Name of the file in the archive
+  std::string get_filename(size_t index);
+  /// Get contents of nth file in the archive
+  /// \param index id of the file in the archive
+  /// \throw Throws std::runtime_error if file cannot be extracted
+  /// \return Contents of the file in the archive
+  std::string extract(size_t index);
+private:
+  std::unique_ptr<mz_zip_archive_statet> m_state;
+};
+
+#endif // CPROVER_JAVA_BYTECODE_MZ_ZIP_ARCHIVE_H
diff --git a/src/java_bytecode/select_pointer_type.cpp b/src/java_bytecode/select_pointer_type.cpp
new file mode 100644
index 00000000000..4529b11e97b
--- /dev/null
+++ b/src/java_bytecode/select_pointer_type.cpp
@@ -0,0 +1,25 @@
+/*******************************************************************\
+
+ Module: Java Bytecode Language Conversion
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+/// \file
+/// Handle selection of correct pointer type (for example changing abstract
+/// classes to concrete versions).
+
+#include "select_pointer_type.h"
+#include <util/std_types.h>
+
+/// Select what type should be used for a given pointer type. For the base class
+/// we just use the supplied type. Derived classes can override this behaviour
+/// to provide more sophisticated type selection
+/// \param pointer_type: The pointer type replace
+/// \return A pointer type where the subtype may have been modified
+pointer_typet select_pointer_typet::convert_pointer_type(
+  const pointer_typet &pointer_type, const namespacet &ns) const
+{
+  return  pointer_type;
+}
diff --git a/src/java_bytecode/select_pointer_type.h b/src/java_bytecode/select_pointer_type.h
new file mode 100644
index 00000000000..78a74bd4883
--- /dev/null
+++ b/src/java_bytecode/select_pointer_type.h
@@ -0,0 +1,27 @@
+/*******************************************************************\
+
+ Module: Java Bytecode Language Conversion
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+#ifndef CPROVER_JAVA_BYTECODE_SELECT_POINTER_TYPE_H
+#define CPROVER_JAVA_BYTECODE_SELECT_POINTER_TYPE_H
+
+/// \file
+/// Handle selection of correct pointer type (for example changing abstract
+/// classes to concrete versions).
+
+#include <util/std_types.h>
+
+class namespacet;
+
+class select_pointer_typet
+{
+public:
+  virtual ~select_pointer_typet()=default;
+  virtual pointer_typet convert_pointer_type(
+    const pointer_typet &pointer_type, const namespacet &ns) const;
+};
+
+#endif // CPROVER_JAVA_BYTECODE_SELECT_POINTER_TYPE_H
diff --git a/src/jsil/jsil_language.cpp b/src/jsil/jsil_language.cpp
index 7bcd682a70d..447ae799911 100644
--- a/src/jsil/jsil_language.cpp
+++ b/src/jsil/jsil_language.cpp
@@ -107,9 +107,9 @@ void jsil_languaget::show_parse(std::ostream &out)
   parse_tree.output(out);
 }
 
-languaget *new_jsil_language()
+std::unique_ptr<languaget> new_jsil_language()
 {
-  return new jsil_languaget;
+  return util_make_unique<jsil_languaget>();
 }
 
 bool jsil_languaget::from_expr(
diff --git a/src/jsil/jsil_language.h b/src/jsil/jsil_language.h
index 1727aadb6c7..48214c013ac 100644
--- a/src/jsil/jsil_language.h
+++ b/src/jsil/jsil_language.h
@@ -12,7 +12,10 @@ Author: Michael Tautschnig, tautschn@amazon.com
 #ifndef CPROVER_JSIL_JSIL_LANGUAGE_H
 #define CPROVER_JSIL_JSIL_LANGUAGE_H
 
+#include <memory>
+
 #include <util/language.h>
+#include <util/make_unique.h>
 
 #include "jsil_parse_tree.h"
 
@@ -32,9 +35,7 @@ class jsil_languaget:public languaget
     symbol_tablet &context,
     const std::string &module);
 
-  virtual bool final(
-    symbol_tablet &context,
-    bool generate_start_function);
+  virtual bool final(symbol_tablet &context, bool generate_start_function);
 
   virtual void show_parse(std::ostream &out);
 
@@ -60,8 +61,8 @@ class jsil_languaget:public languaget
     exprt &expr,
     const namespacet &ns);
 
-  virtual languaget *new_language()
-  { return new jsil_languaget; }
+  virtual std::unique_ptr<languaget> new_language()
+  { return util_make_unique<jsil_languaget>(); }
 
   virtual std::string id() const { return "jsil"; }
   virtual std::string description() const
@@ -76,6 +77,6 @@ class jsil_languaget:public languaget
   std::string parse_path;
 };
 
-languaget *new_jsil_language();
+std::unique_ptr<languaget> new_jsil_language();
 
 #endif // CPROVER_JSIL_JSIL_LANGUAGE_H
diff --git a/src/langapi/language_ui.cpp b/src/langapi/language_ui.cpp
index dd6f7b63e26..9cd464b3c28 100644
--- a/src/langapi/language_ui.cpp
+++ b/src/langapi/language_ui.cpp
@@ -15,6 +15,7 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 #include <util/namespace.h>
 #include <util/language.h>
 #include <util/cmdline.h>
+#include <util/config.h>
 #include <util/unicode.h>
 
 #include "mode.h"
@@ -116,12 +117,18 @@ bool language_uit::final()
 {
   language_files.set_message_handler(*message_handler);
 
+  // Enable/disable stub generation for opaque methods
+  bool stubs_enabled=_cmdline.isset("generate-opaque-stubs");
+  language_files.set_should_generate_opaque_method_stubs(stubs_enabled);
+
   if(language_files.final(symbol_table, generate_start_function))
   {
     error() << "CONVERSION ERROR" << eom;
     return true;
   }
 
+  config.set_object_bits_from_symbol_table(symbol_table);
+
   return false;
 }
 
@@ -166,25 +173,27 @@ void language_uit::show_symbol_table_plain(
   {
     const symbolt &symbol=ns.lookup(id);
 
-    languaget *ptr;
+    std::unique_ptr<languaget> ptr;
 
     if(symbol.mode=="")
+    {
       ptr=get_default_language();
+    }
     else
     {
       ptr=get_language_from_mode(symbol.mode);
-      if(ptr==nullptr)
-        throw "symbol "+id2string(symbol.name)+" has unknown mode";
     }
 
-    std::unique_ptr<languaget> p(ptr);
+    if(!ptr)
+      throw "symbol "+id2string(symbol.name)+" has unknown mode";
+
     std::string type_str, value_str;
 
     if(symbol.type.is_not_nil())
-      p->from_type(symbol.type, type_str, ns);
+      ptr->from_type(symbol.type, type_str, ns);
 
     if(symbol.value.is_not_nil())
-      p->from_expr(symbol.value, value_str, ns);
+      ptr->from_expr(symbol.value, value_str, ns);
 
     if(brief)
     {
diff --git a/src/langapi/language_util.cpp b/src/langapi/language_util.cpp
index 9d7095ad07a..497cd42ca7a 100644
--- a/src/langapi/language_util.cpp
+++ b/src/langapi/language_util.cpp
@@ -13,7 +13,7 @@
 #include "pretty_printer.h"
 #include "mode.h"
 
-static languaget* get_language(
+static std::unique_ptr<languaget> get_language(
   const namespacet &ns,
   const irep_idt &identifier)
 {
@@ -24,7 +24,7 @@ static languaget* get_language(
      symbol->mode=="")
     return get_default_language();
 
-  languaget *ptr=get_language_from_mode(symbol->mode);
+  std::unique_ptr<languaget> ptr=get_language_from_mode(symbol->mode);
 
   if(ptr==nullptr)
     throw "symbol `"+id2string(symbol->name)+
diff --git a/src/langapi/mode.cpp b/src/langapi/mode.cpp
index 2c3a852b73a..8d1d9128010 100644
--- a/src/langapi/mode.cpp
+++ b/src/langapi/mode.cpp
@@ -37,7 +37,7 @@ void register_language(language_factoryt factory)
   languages.back().mode=l->id();
 }
 
-languaget *get_language_from_mode(const irep_idt &mode)
+std::unique_ptr<languaget> get_language_from_mode(const irep_idt &mode)
 {
   for(languagest::const_iterator it=languages.begin();
       it!=languages.end();
@@ -48,7 +48,8 @@ languaget *get_language_from_mode(const irep_idt &mode)
   return nullptr;
 }
 
-languaget *get_language_from_filename(const std::string &filename)
+std::unique_ptr<languaget> get_language_from_filename(
+  const std::string &filename)
 {
   std::size_t ext_pos=filename.rfind('.');
 
@@ -82,7 +83,7 @@ languaget *get_language_from_filename(const std::string &filename)
   return nullptr;
 }
 
-languaget *get_default_language()
+std::unique_ptr<languaget> get_default_language()
 {
   assert(!languages.empty());
   return languages.front().factory();
diff --git a/src/langapi/mode.h b/src/langapi/mode.h
index e8cf679d0e2..3edb7a30be8 100644
--- a/src/langapi/mode.h
+++ b/src/langapi/mode.h
@@ -12,13 +12,16 @@ Author: Daniel Kroening, kroening@cs.cmu.edu
 
 #include <util/irep.h>
 
+#include <memory> // unique_ptr
+
 class languaget;
 
-languaget *get_language_from_mode(const irep_idt &mode);
-languaget *get_language_from_filename(const std::string &filename);
-languaget *get_default_language();
+std::unique_ptr<languaget> get_language_from_mode(const irep_idt &mode);
+std::unique_ptr<languaget> get_language_from_filename(
+  const std::string &filename);
+std::unique_ptr<languaget> get_default_language();
 
-typedef languaget *(*language_factoryt)();
+typedef std::unique_ptr<languaget> (*language_factoryt)();
 void register_language(language_factoryt factory);
 
 #endif // CPROVER_LANGAPI_MODE_H
diff --git a/src/memory-models/Makefile b/src/memory-models/Makefile
index e13309deaae..3b8587611c8 100644
--- a/src/memory-models/Makefile
+++ b/src/memory-models/Makefile
@@ -9,6 +9,7 @@ SRC = mm2cpp.cpp \
 OBJ += ../big-int/big-int$(LIBEXT) \
       ../ansi-c/ansi-c$(LIBEXT) \
       ../linking/linking$(LIBEXT) \
+      ../langapi/langapi$(LIBEXT) \
       ../util/util$(LIBEXT)
 
 INCLUDES= -I ..
diff --git a/src/memory-models/mmcc_main.cpp b/src/memory-models/mmcc_main.cpp
index 962c5bbf527..4430059e556 100644
--- a/src/memory-models/mmcc_main.cpp
+++ b/src/memory-models/mmcc_main.cpp
@@ -16,7 +16,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
diff --git a/src/musketeer/fence_inserter.cpp b/src/musketeer/fence_inserter.cpp
index cd1aaa910f5..10de10049eb 100644
--- a/src/musketeer/fence_inserter.cpp
+++ b/src/musketeer/fence_inserter.cpp
@@ -40,7 +40,7 @@ unsigned fence_insertert::fence_cost(fence_typet f) const
     case Ctlfence:
       return 1;
   }
-  assert(false);
+  UNREACHABLE;
   return 0;
 }
 
@@ -769,7 +769,7 @@ void fence_insertert::solve()
       break;
     case GLP_UNDEF:
       instrumenter.message.result() << "Solution undefined" << messaget::eom;
-      assert(0);
+      UNREACHABLE;
     case GLP_FEAS:
       instrumenter.message.result() << "Solution feasible, "
                                     << "yet not proven optimal, "
@@ -779,7 +779,7 @@ void fence_insertert::solve()
     case GLP_NOFEAS:
       instrumenter.message.result()
         << "No feasible solution, the system is UNSAT" << messaget::eom;
-      assert(0);
+      UNREACHABLE;
   }
 
   event_grapht &egraph=instrumenter.egraph;
@@ -964,7 +964,7 @@ std::string fence_insertert::to_string(fence_typet f) const
     case Branching: return "branching";
     case Ctlfence: return "ctlfence";
   }
-  assert(0);
+  UNREACHABLE;
 }
 
 inline unsigned fence_insertert::col_to_var(unsigned u) const
@@ -983,7 +983,7 @@ inline fence_insertert::fence_typet fence_insertert::col_to_fence(unsigned u)
     case 3: return Branching;
     case 4: return Ctlfence;
   }
-  assert(0);
+  UNREACHABLE;
 }
 
 inline unsigned fence_insertert::var_fence_to_col(fence_typet f, unsigned var)
@@ -997,7 +997,7 @@ inline unsigned fence_insertert::var_fence_to_col(fence_typet f, unsigned var)
     case Branching: return (var-1)*fence_options+3;
     case Ctlfence: return (var-1)*fence_options+4;
   }
-  assert(0);
+  UNREACHABLE;
 }
 
 void fence_insertert::compute_fence_options()
@@ -1103,5 +1103,5 @@ typet fence_insertert::type_component(
     return type;
   }
 
-  assert(0);
+  UNREACHABLE;
 }
diff --git a/src/musketeer/ilp.h b/src/musketeer/ilp.h
index b8cbe4e9202..c7ce87537a5 100644
--- a/src/musketeer/ilp.h
+++ b/src/musketeer/ilp.h
@@ -22,26 +22,15 @@ Author: Vincent Nimal
 class ilpt
 {
 protected:
-  template <class T>
-  class my_vectort: public std::vector<T>
-  {
-  public:
-    T *to_array()
-    {
-      /* NOTE: not valid if T==bool */
-      return &(*this)[0];
-    }
-  };
-
   glp_iocp parm;
   unsigned matrix_size;
 
 public:
   glp_prob *lp;
 
-  my_vectort<int> imat;
-  my_vectort<int> jmat;
-  my_vectort<double> vmat;
+  std::vector<int> imat;
+  std::vector<int> jmat;
+  std::vector<double> vmat;
 
   ilpt()
   {
@@ -69,8 +58,8 @@ class ilpt
 
   void solve()
   {
-    glp_load_matrix(lp, matrix_size, imat.to_array(),
-      jmat.to_array(), vmat.to_array());
+    glp_load_matrix(lp, matrix_size, imat.data(),
+      jmat.data(), vmat.data());
     glp_intopt(lp, &parm);
   }
 };
diff --git a/src/musketeer/musketeer_parse_options.cpp b/src/musketeer/musketeer_parse_options.cpp
index ace73687432..fabb89a3add 100644
--- a/src/musketeer/musketeer_parse_options.cpp
+++ b/src/musketeer/musketeer_parse_options.cpp
@@ -139,8 +139,6 @@ void goto_fence_inserter_parse_optionst::get_goto_program(
   if(read_goto_binary(cmdline.args[0],
     symbol_table, goto_functions, get_message_handler()))
     throw 0;
-
-  config.set_from_symbol_table(symbol_table);
 }
 
 void goto_fence_inserter_parse_optionst::instrument_goto_program(
diff --git a/src/musketeer/propagate_const_function_pointers.cpp b/src/musketeer/propagate_const_function_pointers.cpp
index eca3648c285..e58efe92429 100644
--- a/src/musketeer/propagate_const_function_pointers.cpp
+++ b/src/musketeer/propagate_const_function_pointers.cpp
@@ -114,12 +114,25 @@ class const_function_pointer_propagationt
     unsigned stack_scope);
 
   /* to keep track of the constant function pointers passed as arguments */
-  class arg_stackt: public std::set<irep_idt>
+  class arg_stackt final
   {
-  protected:
+    typedef std::set<irep_idt> data_typet;
+    data_typet data;
     const_function_pointer_propagationt &cfpp;
 
   public:
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::iterator iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::const_iterator const_iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::value_type value_type;
+
+    std::pair<iterator, bool> insert(const value_type &t)
+    {
+      return data.insert(t);
+    }
+
     explicit arg_stackt(const_function_pointer_propagationt &_cfpp):
       cfpp(_cfpp)
     {}
@@ -415,7 +428,7 @@ void const_function_pointer_propagationt::arg_stackt::add_args(
 void const_function_pointer_propagationt::arg_stackt::remove_args()
 {
   /* remove the parameter names */
-  for(const_iterator arg_it=begin(); arg_it!=end(); ++arg_it)
+  for(const_iterator arg_it=data.begin(); arg_it!=data.end(); ++arg_it)
   {
     cfpp.remove(*arg_it);
     cfpp.message.debug() << "SET: remove " << *arg_it << messaget::eom;
diff --git a/src/path-symex/path_symex.cpp b/src/path-symex/path_symex.cpp
index 043ac0fb05c..0d8db5f979a 100644
--- a/src/path-symex/path_symex.cpp
+++ b/src/path-symex/path_symex.cpp
@@ -524,7 +524,7 @@ void path_symext::assign_rec(
     else if(ssa_lhs.id()==ID_byte_extract_big_endian)
       new_id=ID_byte_update_big_endian;
     else
-      assert(false);
+      UNREACHABLE;
 
     byte_update_exprt new_rhs(new_id);
 
diff --git a/src/pointer-analysis/value_set.cpp b/src/pointer-analysis/value_set.cpp
index 8fa18437afd..beb5d7fa147 100644
--- a/src/pointer-analysis/value_set.cpp
+++ b/src/pointer-analysis/value_set.cpp
@@ -31,7 +31,7 @@
 #include "add_failed_symbols.h"
 #include "dynamic_object_name.h"
 
-const value_sett::object_map_dt value_sett::object_map_dt::blank;
+const value_sett::object_map_dt value_sett::object_map_dt::blank{};
 object_numberingt value_sett::object_numbering;
 
 bool value_sett::field_sensitive(
@@ -72,7 +72,7 @@ bool value_sett::insert(
   unsigned n,
   const objectt &object) const
 {
-  object_map_dt::const_iterator entry=dest.read().find(n);
+  auto entry=dest.read().find(n);
 
   if(entry==dest.read().end())
   {
@@ -192,9 +192,9 @@ void value_sett::output(
   }
 }
 
-exprt value_sett::to_expr(object_map_dt::const_iterator it) const
+exprt value_sett::to_expr(const object_map_dt::value_type &it) const
 {
-  const exprt &object=object_numbering[it->first];
+  const exprt &object=object_numbering[it.first];
 
   if(object.id()==ID_invalid ||
      object.id()==ID_unknown)
@@ -204,8 +204,8 @@ exprt value_sett::to_expr(object_map_dt::const_iterator it) const
 
   od.object()=object;
 
-  if(it->second.offset_is_set)
-    od.offset()=from_integer(it->second.offset, index_type());
+  if(it.second.offset_is_set)
+    od.offset()=from_integer(it.second.offset, index_type());
 
   od.type()=od.object().type();
 
@@ -259,7 +259,7 @@ bool value_sett::make_union(object_mapt &dest, const object_mapt &src) const
       it!=src.read().end();
       it++)
   {
-    if(insert(dest, it))
+    if(insert(dest, *it))
       result=true;
   }
 
@@ -331,7 +331,7 @@ void value_sett::get_value_set(
       it=object_map.read().begin();
       it!=object_map.read().end();
       it++)
-    dest.push_back(to_expr(it));
+    dest.push_back(to_expr(*it));
 
   #if 0
   for(value_setst::valuest::const_iterator it=dest.begin();
@@ -924,7 +924,7 @@ void value_sett::get_reference_set(
       it=object_map.read().begin();
       it!=object_map.read().end();
       it++)
-    dest.push_back(to_expr(it));
+    dest.push_back(to_expr(*it));
 }
 
 /// Cleanly cast `e` to a given type if possible, avoiding the possibility of
@@ -1323,7 +1323,7 @@ void value_sett::do_free(
           dynamic_object.get_recency());
 
         if(to_mark.count(key_dynamic_object)==0)
-          set(new_object_map, o_it);
+          set(new_object_map, *o_it);
         else
         {
           // adjust
@@ -1335,7 +1335,7 @@ void value_sett::do_free(
         }
       }
       else
-        set(new_object_map, o_it);
+        set(new_object_map, *o_it);
     }
 
     if(changed)
@@ -1544,7 +1544,7 @@ void value_sett::apply_code(
   else if(statement==ID_function_call)
   {
     // shouldn't be here
-    assert(false);
+    UNREACHABLE;
   }
   else if(statement==ID_assign ||
           statement==ID_init)
diff --git a/src/pointer-analysis/value_set.h b/src/pointer-analysis/value_set.h
index edb98a71afd..528894dbaae 100644
--- a/src/pointer-analysis/value_set.h
+++ b/src/pointer-analysis/value_set.h
@@ -59,25 +59,58 @@ class value_sett
     { return offset_is_set && offset.is_zero(); }
   };
 
-  class object_map_dt:public std::map<unsigned, objectt>
+  class object_map_dt
   {
+    typedef std::map<unsigned, objectt> data_typet;
+    data_typet data;
+
   public:
-    object_map_dt() {}
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::iterator iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::const_iterator const_iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::value_type value_type;
+
+    iterator begin() { return data.begin(); }
+    const_iterator begin() const { return data.begin(); }
+    const_iterator cbegin() const { return data.cbegin(); }
+
+    iterator end() { return data.end(); }
+    const_iterator end() const { return data.end(); }
+    const_iterator cend() const { return data.cend(); }
+
+    size_t size() const { return data.size(); }
+    bool empty() const { return data.empty(); }
+
+    objectt &operator[](unsigned i) { return data[i]; }
+
+    template <typename It>
+    void insert(It b, It e) { data.insert(b, e); }
+
+    template <typename T>
+    const_iterator find(T &&t) const { return data.find(std::forward<T>(t)); }
+
     static const object_map_dt blank;
+
+    object_map_dt()=default;
+
+  protected:
+    ~object_map_dt()=default;
   };
 
-  exprt to_expr(object_map_dt::const_iterator it) const;
+  exprt to_expr(const object_map_dt::value_type &it) const;
 
   typedef reference_counting<object_map_dt> object_mapt;
 
-  void set(object_mapt &dest, object_map_dt::const_iterator it) const
+  void set(object_mapt &dest, const object_map_dt::value_type &it) const
   {
-    dest.write()[it->first]=it->second;
+    dest.write()[it.first]=it.second;
   }
 
-  bool insert(object_mapt &dest, object_map_dt::const_iterator it) const
+  bool insert(object_mapt &dest, const object_map_dt::value_type &it) const
   {
-    return insert(dest, it->first, it->second);
+    return insert(dest, it.first, it.second);
   }
 
   bool insert(object_mapt &dest, const exprt &src) const
diff --git a/src/pointer-analysis/value_set_fi.cpp b/src/pointer-analysis/value_set_fi.cpp
index 3dce128d557..a13ad54fd26 100644
--- a/src/pointer-analysis/value_set_fi.cpp
+++ b/src/pointer-analysis/value_set_fi.cpp
@@ -27,7 +27,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "dynamic_object_name.h"
 
-const value_set_fit::object_map_dt value_set_fit::object_map_dt::blank;
+const value_set_fit::object_map_dt value_set_fit::object_map_dt::blank{};
+
 object_numberingt value_set_fit::object_numbering;
 hash_numbering<irep_idt, irep_id_hash> value_set_fit::function_numbering;
 
@@ -208,11 +209,11 @@ void value_set_fit::flatten_rec(
         }
 
         forall_objects(oit, temp.read())
-          insert(dest, oit);
+          insert(dest, *oit);
       }
     }
     else
-      insert(dest, it);
+      insert(dest, *it);
   }
 
   if(generalize_index) // this means we had recursive symbols in there
@@ -224,9 +225,9 @@ void value_set_fit::flatten_rec(
   seen.erase(identifier + e.suffix);
 }
 
-exprt value_set_fit::to_expr(object_map_dt::const_iterator it) const
+exprt value_set_fit::to_expr(const object_map_dt::value_type &it) const
 {
-  const exprt &object=object_numbering[it->first];
+  const exprt &object=object_numbering[it.first];
 
   if(object.id()==ID_invalid ||
      object.id()==ID_unknown)
@@ -236,8 +237,8 @@ exprt value_set_fit::to_expr(object_map_dt::const_iterator it) const
 
   od.object()=object;
 
-  if(it->second.offset_is_set)
-    od.offset()=from_integer(it->second.offset, index_type());
+  if(it.second.offset_is_set)
+    od.offset()=from_integer(it.second.offset, index_type());
 
   od.type()=od.object().type();
 
@@ -246,7 +247,7 @@ exprt value_set_fit::to_expr(object_map_dt::const_iterator it) const
 
 bool value_set_fit::make_union(const value_set_fit::valuest &new_values)
 {
-  assert(0);
+  UNREACHABLE;
   bool result=false;
 
   for(valuest::const_iterator
@@ -289,7 +290,7 @@ bool value_set_fit::make_union(object_mapt &dest, const object_mapt &src) const
 
   forall_objects(it, src.read())
   {
-    if(insert(dest, it))
+    if(insert(dest, *it))
       result=true;
   }
 
@@ -342,7 +343,7 @@ void value_set_fit::get_value_set(
   }
 
   forall_objects(fit, flat_map.read())
-    value_set.push_back(to_expr(fit));
+    value_set.push_back(to_expr(*fit));
 
   #if 0
   // Sanity check!
@@ -742,11 +743,11 @@ void value_set_fit::get_reference_set(
         }
 
         forall_objects(it, omt.read())
-          dest.insert(to_expr(it));
+          dest.insert(to_expr(*it));
       }
     }
     else
-      dest.insert(to_expr(it));
+      dest.insert(to_expr(*it));
   }
 }
 
@@ -759,7 +760,7 @@ void value_set_fit::get_reference_set_sharing(
   get_reference_set_sharing(expr, object_map, ns);
 
   forall_objects(it, object_map.read())
-    dest.insert(to_expr(it));
+    dest.insert(to_expr(*it));
 }
 
 void value_set_fit::get_reference_set_sharing_rec(
@@ -831,13 +832,13 @@ void value_set_fit::get_reference_set_sharing_rec(
           }
 
           forall_objects(it2, t2.read())
-            insert(dest, it2);
+            insert(dest, *it2);
         }
         else
           insert(dest, exprt(ID_unknown, obj.type().subtype()));
       }
       else
-        insert(dest, it);
+        insert(dest, *it);
     }
 
     #if 0
@@ -1186,7 +1187,7 @@ void value_set_fit::do_free(
           dynamic_object.get_recency());
 
         if(to_mark.count(key_dynamic_object)==0)
-          set(new_object_map, o_it);
+          set(new_object_map, *o_it);
         else
         {
           // adjust
@@ -1198,7 +1199,7 @@ void value_set_fit::do_free(
         }
       }
       else
-        set(new_object_map, o_it);
+        set(new_object_map, *o_it);
     }
 
     if(changed)
@@ -1429,7 +1430,7 @@ void value_set_fit::apply_code(
   else if(statement==ID_function_call)
   {
     // shouldn't be here
-    assert(false);
+    UNREACHABLE;
   }
   else if(statement==ID_assign ||
           statement==ID_init)
diff --git a/src/pointer-analysis/value_set_fi.h b/src/pointer-analysis/value_set_fi.h
index 6298dce5dd5..bf5e1b63ab0 100644
--- a/src/pointer-analysis/value_set_fi.h
+++ b/src/pointer-analysis/value_set_fi.h
@@ -73,25 +73,55 @@ class value_set_fit
     { return offset_is_set && offset.is_zero(); }
   };
 
-  class object_map_dt:public std::map<unsigned, objectt>
+  class object_map_dt
   {
+    typedef std::map<unsigned, objectt> data_typet;
+    data_typet data;
+
   public:
-    object_map_dt() {}
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::iterator iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::const_iterator const_iterator;
+    // NOLINTNEXTLINE(readability/identifiers)
+    typedef data_typet::value_type value_type;
+
+    iterator begin() { return data.begin(); }
+    const_iterator begin() const { return data.begin(); }
+    const_iterator cbegin() const { return data.cbegin(); }
+
+    iterator end() { return data.end(); }
+    const_iterator end() const { return data.end(); }
+    const_iterator cend() const { return data.cend(); }
+
+    size_t size() const { return data.size(); }
+
+    objectt &operator[](unsigned i) { return data[i]; }
+
+    template <typename It>
+    void insert(It b, It e) { data.insert(b, e); }
+
+    template <typename T>
+    const_iterator find(T &&t) const { return data.find(std::forward<T>(t)); }
+
     static const object_map_dt blank;
+
+  protected:
+    ~object_map_dt()=default;
   };
 
-  exprt to_expr(object_map_dt::const_iterator it) const;
+  exprt to_expr(const object_map_dt::value_type &it) const;
 
   typedef reference_counting<object_map_dt> object_mapt;
 
-  void set(object_mapt &dest, object_map_dt::const_iterator it) const
+  void set(object_mapt &dest, const object_map_dt::value_type &it) const
   {
-    dest.write()[it->first]=it->second;
+    dest.write()[it.first]=it.second;
   }
 
-  bool insert(object_mapt &dest, object_map_dt::const_iterator it) const
+  bool insert(object_mapt &dest, const object_map_dt::value_type &it) const
   {
-    return insert(dest, it->first, it->second);
+    return insert(dest, it.first, it.second);
   }
 
   bool insert(object_mapt &dest, const exprt &src) const
diff --git a/src/pointer-analysis/value_set_fivr.cpp b/src/pointer-analysis/value_set_fivr.cpp
index 137ecbcbfe6..1a3304860d4 100644
--- a/src/pointer-analysis/value_set_fivr.cpp
+++ b/src/pointer-analysis/value_set_fivr.cpp
@@ -1587,7 +1587,7 @@ void value_set_fivrt::apply_code(
   else if(statement==ID_function_call)
   {
     // shouldn't be here
-    assert(false);
+    UNREACHABLE;
   }
   else if(statement==ID_assign ||
           statement==ID_init)
diff --git a/src/pointer-analysis/value_set_fivr.h b/src/pointer-analysis/value_set_fivr.h
index eb392928786..415f1a130f6 100644
--- a/src/pointer-analysis/value_set_fivr.h
+++ b/src/pointer-analysis/value_set_fivr.h
@@ -21,6 +21,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/mp_arith.h>
 #include <util/namespace.h>
 #include <util/reference_counting.h>
+#include <util/invariant.h>
 
 #include "object_numbering.h"
 
@@ -103,11 +104,11 @@ class value_set_fivrt
     // operator[] is the only way to insert something!
     std::pair<iterator, bool> insert(const std::pair<unsigned, objectt>&)
     {
-      assert(false);
+      UNREACHABLE;
     }
     iterator insert(iterator, const std::pair<unsigned, objectt>&)
     {
-      assert(false);
+      UNREACHABLE;
     }
 
     class validity_ranget
diff --git a/src/pointer-analysis/value_set_fivrns.cpp b/src/pointer-analysis/value_set_fivrns.cpp
index 9771581dd7d..81fa1fc19d2 100644
--- a/src/pointer-analysis/value_set_fivrns.cpp
+++ b/src/pointer-analysis/value_set_fivrns.cpp
@@ -1240,7 +1240,7 @@ void value_set_fivrnst::apply_code(
   else if(statement==ID_function_call)
   {
     // shouldn't be here
-    assert(false);
+    UNREACHABLE;
   }
   else if(statement==ID_assign ||
           statement==ID_init)
diff --git a/src/pointer-analysis/value_set_fivrns.h b/src/pointer-analysis/value_set_fivrns.h
index dc8264caa02..23c8b67489d 100644
--- a/src/pointer-analysis/value_set_fivrns.h
+++ b/src/pointer-analysis/value_set_fivrns.h
@@ -22,6 +22,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/mp_arith.h>
 #include <util/namespace.h>
 #include <util/reference_counting.h>
+#include <util/invariant.h>
 
 #include "object_numbering.h"
 
@@ -104,11 +105,11 @@ class value_set_fivrnst
     // operator[] is the only way to insert something!
     std::pair<iterator, bool> insert(const std::pair<unsigned, objectt>&)
     {
-      assert(false);
+      UNREACHABLE;
     }
     iterator insert(iterator, const std::pair<unsigned, objectt>&)
     {
-      assert(false);
+      UNREACHABLE;
     }
 
     class validity_ranget
diff --git a/src/solvers/Makefile b/src/solvers/Makefile
index 108718ccb75..b7b9c5b43d9 100644
--- a/src/solvers/Makefile
+++ b/src/solvers/Makefile
@@ -158,6 +158,20 @@ SRC = $(BOOLEFORCE_SRC) \
       refinement/bv_refinement_loop.cpp \
       refinement/refine_arithmetic.cpp \
       refinement/refine_arrays.cpp \
+      refinement/string_refinement.cpp \
+      refinement/string_constraint_generator_code_points.cpp \
+      refinement/string_constraint_generator_comparison.cpp \
+      refinement/string_constraint_generator_concat.cpp \
+      refinement/string_constraint_generator_constants.cpp \
+      refinement/string_constraint_generator_indexof.cpp \
+      refinement/string_constraint_generator_insert.cpp \
+      refinement/string_constraint_generator_float.cpp \
+      refinement/string_constraint_generator_format.cpp \
+      refinement/string_constraint_generator_main.cpp \
+      refinement/string_constraint_generator_testing.cpp \
+      refinement/string_constraint_generator_transformation.cpp \
+      refinement/string_constraint_generator_valueof.cpp \
+      refinement/string_constraint_instantiation.cpp \
       sat/cnf.cpp \
       sat/cnf_clause_list.cpp \
       sat/dimacs_cnf.cpp \
diff --git a/src/solvers/flattening/arrays.cpp b/src/solvers/flattening/arrays.cpp
index 82d82c0b3e9..854ca4156b1 100644
--- a/src/solvers/flattening/arrays.cpp
+++ b/src/solvers/flattening/arrays.cpp
@@ -8,9 +8,6 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "arrays.h"
 
-#include <cassert>
-#include <iostream>
-
 #include <langapi/language_util.h>
 
 #include <util/std_expr.h>
@@ -21,6 +18,10 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <solvers/prop/prop.h>
 
+#ifdef DEBUG
+#include <iostream>
+#endif
+
 arrayst::arrayst(
   const namespacet &_ns,
   propt &_prop):equalityt(_ns, _prop)
@@ -48,11 +49,15 @@ literalt arrayst::record_array_equality(
   // check types
   if(!base_type_eq(op0.type(), op1.type(), ns))
   {
-    std::cout << equality.pretty() << '\n';
-    throw "record_array_equality got equality without matching types";
+    prop.error() << equality.pretty() << messaget::eom;
+    DATA_INVARIANT(
+      false,
+      "record_array_equality got equality without matching types");
   }
 
-  assert(ns.follow(op0.type()).id()==ID_array);
+  DATA_INVARIANT(
+    ns.follow(op0.type()).id()==ID_array,
+    "record_array_equality parameter should be array-typed");
 
   array_equalities.push_back(array_equalityt());
 
@@ -113,8 +118,8 @@ void arrayst::collect_arrays(const exprt &a)
     // check types
     if(!base_type_eq(array_type, with_expr.old().type(), ns))
     {
-      std::cout << a.pretty() << '\n';
-      throw "collect_arrays got 'with' without matching types";
+      prop.error() << a.pretty() << messaget::eom;
+      DATA_INVARIANT(false, "collect_arrays got 'with' without matching types");
     }
 
     arrays.make_union(a, with_expr.old());
@@ -131,8 +136,10 @@ void arrayst::collect_arrays(const exprt &a)
     // check types
     if(!base_type_eq(array_type, update_expr.old().type(), ns))
     {
-      std::cout << a.pretty() << '\n';
-      throw "collect_arrays got 'update' without matching types";
+      prop.error() << a.pretty() << messaget::eom;
+      DATA_INVARIANT(
+        false,
+        "collect_arrays got 'update' without matching types");
     }
 
     arrays.make_union(a, update_expr.old());
@@ -151,15 +158,15 @@ void arrayst::collect_arrays(const exprt &a)
     // check types
     if(!base_type_eq(array_type, if_expr.true_case().type(), ns))
     {
-      std::cout << a.pretty() << '\n';
-      throw "collect_arrays got if without matching types";
+      prop.error() << a.pretty() << messaget::eom;
+      DATA_INVARIANT(false, "collect_arrays got if without matching types");
     }
 
     // check types
     if(!base_type_eq(array_type, if_expr.false_case().type(), ns))
     {
-      std::cout << a.pretty() << '\n';
-      throw "collect_arrays got if without matching types";
+      prop.error() << a.pretty() << messaget::eom;
+      DATA_INVARIANT(false, "collect_arrays got if without matching types");
     }
 
     arrays.make_union(a, if_expr.true_case());
@@ -175,9 +182,10 @@ void arrayst::collect_arrays(const exprt &a)
   }
   else if(a.id()==ID_member)
   {
-    if(to_member_expr(a).struct_op().id()!=ID_symbol)
-      throw
-        "unexpected array expression: member with `"+a.op0().id_string()+"'";
+    DATA_INVARIANT(
+      to_member_expr(a).struct_op().id()==ID_symbol,
+      ("unexpected array expression: member with `"+
+       a.op0().id_string()+"'").c_str());
   }
   else if(a.id()==ID_constant ||
           a.id()==ID_array ||
@@ -190,20 +198,24 @@ void arrayst::collect_arrays(const exprt &a)
   else if(a.id()==ID_byte_update_little_endian ||
           a.id()==ID_byte_update_big_endian)
   {
-    assert(0);
+    DATA_INVARIANT(
+      false,
+      "byte_update should be removed before collect_arrays");
   }
   else if(a.id()==ID_typecast)
   {
     // cast between array types?
-    assert(a.operands().size()==1);
+    DATA_INVARIANT(
+      a.operands().size()==1,
+      "typecast must have one operand");
 
-    if(a.op0().type().id()==ID_array)
-    {
-      arrays.make_union(a, a.op0());
-      collect_arrays(a.op0());
-    }
-    else
-      throw "unexpected array type cast from "+a.op0().type().id_string();
+    DATA_INVARIANT(
+      a.op0().type().id()==ID_array,
+      ("unexpected array type cast from "+
+       a.op0().type().id_string()).c_str());
+
+    arrays.make_union(a, a.op0());
+    collect_arrays(a.op0());
   }
   else if(a.id()==ID_index)
   {
@@ -212,7 +224,12 @@ void arrayst::collect_arrays(const exprt &a)
     collect_arrays(a.op0());
   }
   else
-    throw "unexpected array expression (collect_arrays): `"+a.id_string()+"'";
+  {
+    DATA_INVARIANT(
+      false,
+      ("unexpected array expression (collect_arrays): `"+
+       a.id_string()+"'").c_str());
+  }
 }
 
 /// adds array constraints (refine=true...lazily for the refinement loop)
@@ -280,7 +297,7 @@ void arrayst::add_array_Ackermann_constraints()
 {
   // this is quadratic!
 
-#if 0
+#ifdef DEBUG
   std::cout << "arrays.size(): " << arrays.size() << '\n';
 #endif
 
@@ -289,7 +306,7 @@ void arrayst::add_array_Ackermann_constraints()
   {
     const index_sett &index_set=index_map[arrays.find_number(i)];
 
-#if 0
+#ifdef DEBUG
     std::cout << "index_set.size(): " << index_set.size() << '\n';
 #endif
 
@@ -349,7 +366,7 @@ void arrayst::update_index_map(std::size_t i)
     return;
 
   std::size_t root_number=arrays.find_number(i);
-  assert(root_number!=i);
+  INVARIANT(root_number!=i, "is_root_number incorrect?");
 
   index_sett &root_index_set=index_map[root_number];
   index_sett &index_set=index_map[i];
@@ -407,7 +424,9 @@ void arrayst::add_array_constraints_equality(
     const typet &subtype2=ns.follow(array_equality.f2.type()).subtype();
     index_exprt index_expr2(array_equality.f2, index, subtype2);
 
-    assert(index_expr1.type()==index_expr2.type());
+    DATA_INVARIANT(
+      index_expr1.type()==index_expr2.type(),
+      "array elements should all have same type");
 
     array_equalityt equal;
     equal.f1 = index_expr1;
@@ -449,12 +468,14 @@ void arrayst::add_array_constraints(
   else if(expr.id()==ID_byte_update_little_endian ||
           expr.id()==ID_byte_update_big_endian)
   {
-    assert(0);
+    INVARIANT(false, "byte_update should be removed before arrayst");
   }
   else if(expr.id()==ID_typecast)
   {
     // we got a=(type[])b
-    assert(expr.operands().size()==1);
+    DATA_INVARIANT(
+      expr.operands().size()==1,
+      "typecast should have one operand");
 
     // add a[i]=b[i]
     for(const auto &index : index_set)
@@ -463,7 +484,9 @@ void arrayst::add_array_constraints(
       index_exprt index_expr1(expr, index, subtype);
       index_exprt index_expr2(expr.op0(), index, subtype);
 
-      assert(index_expr1.type()==index_expr2.type());
+      DATA_INVARIANT(
+        index_expr1.type()==index_expr2.type(),
+        "array elements should all have same type");
 
       // add constraint
       lazy_constraintt lazy(lazy_typet::ARRAY_TYPECAST,
@@ -475,9 +498,12 @@ void arrayst::add_array_constraints(
   {
   }
   else
-    throw
-      "unexpected array expression (add_array_constraints): `"+
-        expr.id_string()+"'";
+  {
+    DATA_INVARIANT(
+      false,
+      ("unexpected array expression (add_array_constraints): `"+
+       expr.id_string()+"'").c_str());
+  }
 }
 
 void arrayst::add_array_constraints_with(
@@ -495,8 +521,10 @@ void arrayst::add_array_constraints_with(
 
     if(index_expr.type()!=value.type())
     {
-      std::cout << expr.pretty() << '\n';
-      assert(false);
+      prop.error() << expr.pretty() << messaget::eom;
+      DATA_INVARIANT(
+        false,
+        "with-expression operand should match array element type");
     }
 
     lazy_constraintt lazy(
@@ -563,8 +591,10 @@ void arrayst::add_array_constraints_update(
 
     if(index_expr.type()!=value.type())
     {
-      std::cout << expr.pretty() << '\n';
-      assert(false);
+      prop.error() << expr.pretty() << messaget::eom;
+      DATA_INVARIANT(
+        false,
+        "update operand should match array element type");
     }
 
     set_to_true(equal_exprt(index_expr, value));
@@ -619,7 +649,9 @@ void arrayst::add_array_constraints_array_of(
     const typet &subtype=ns.follow(expr.type()).subtype();
     index_exprt index_expr(expr, index, subtype);
 
-    assert(base_type_eq(index_expr.type(), expr.op0().type(), ns));
+    DATA_INVARIANT(
+      base_type_eq(index_expr.type(), expr.op0().type(), ns),
+      "array_of operand type should match array element type");
 
     // add constraint
     lazy_constraintt lazy(
diff --git a/src/solvers/flattening/bv_pointers.cpp b/src/solvers/flattening/bv_pointers.cpp
index 9ecb81c9846..cf5ebfdb243 100644
--- a/src/solvers/flattening/bv_pointers.cpp
+++ b/src/solvers/flattening/bv_pointers.cpp
@@ -95,7 +95,7 @@ bv_pointerst::bv_pointerst(
   boolbvt(_ns, _prop),
   pointer_logic(_ns)
 {
-  object_bits=BV_ADDR_BITS;
+  object_bits=config.bv_encoding.object_bits;
   offset_bits=config.ansi_c.pointer_width-object_bits;
   bits=config.ansi_c.pointer_width;
 }
@@ -600,7 +600,7 @@ exprt bv_pointerst::bv_get_rec(
   result.set_value(value);
 
   pointer_logict::pointert pointer;
-  pointer.object=integer2unsigned(binary2integer(value_addr, false));
+  pointer.object=integer2size_t(binary2integer(value_addr, false));
   pointer.offset=binary2integer(value_offset, true);
 
   // we add the elaborated expression as operand
@@ -681,8 +681,12 @@ void bv_pointerst::add_addr(const exprt &expr, bvt &bv)
 {
   std::size_t a=pointer_logic.add_object(expr);
 
-  if(a==(std::size_t(1)<<object_bits))
-    throw "too many variables";
+  const std::size_t max_objects=std::size_t(1)<<object_bits;
+  if(a==max_objects)
+    throw
+      "too many addressed objects: maximum number of objects is set to 2^n="+
+      std::to_string(max_objects)+" (with n="+std::to_string(object_bits)+"); "+
+      "use the `--object-bits n` option to increase the maximum number";
 
   encode(a, bv);
 }
diff --git a/src/solvers/flattening/pointer_logic.h b/src/solvers/flattening/pointer_logic.h
index 07193819358..2ce6dee37aa 100644
--- a/src/solvers/flattening/pointer_logic.h
+++ b/src/solvers/flattening/pointer_logic.h
@@ -16,7 +16,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/expr.h>
 #include <util/numbering.h>
 
-#define BV_ADDR_BITS 8
+class namespacet;
 
 class namespacet;
 
diff --git a/src/solvers/prop/prop.h b/src/solvers/prop/prop.h
index e48674d5c57..fc43f6683ea 100644
--- a/src/solvers/prop/prop.h
+++ b/src/solvers/prop/prop.h
@@ -12,6 +12,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 // decision procedure wrapper for boolean propositional logics
 
+#include <stdint.h>
+
 #include <util/message.h>
 #include <util/threeval.h>
 
@@ -108,6 +110,12 @@ class propt:public messaget, public prop_assignmentt
   // an incremental solver may remove any variables that aren't frozen
   virtual void set_frozen(literalt a) { }
 
+  // Resource limits:
+  virtual void set_time_limit_seconds(uint32_t lim)
+  {
+    warning() << "CPU limit ignored (not implemented)" << eom;
+  }
+
 protected:
   // to avoid a temporary for lcnf(...)
   bvt lcnf_bv;
diff --git a/src/solvers/prop/prop_conv.h b/src/solvers/prop/prop_conv.h
index 9d59fb06cf5..816b7481a0e 100644
--- a/src/solvers/prop/prop_conv.h
+++ b/src/solvers/prop/prop_conv.h
@@ -55,6 +55,9 @@ class prop_convt:public decision_proceduret
   // returns true if an assumption is in the final conflict
   virtual bool is_in_conflict(literalt l) const;
   virtual bool has_is_in_conflict() const { return false; }
+
+  // Resource limits:
+  virtual void set_time_limit_seconds(uint32_t) {}
 };
 
 //
@@ -115,6 +118,11 @@ class prop_conv_solvert:public prop_convt
   const cachet &get_cache() const { return cache; }
   const symbolst &get_symbols() const { return symbols; }
 
+  void set_time_limit_seconds(uint32_t lim) override
+  {
+    prop.set_time_limit_seconds(lim);
+  }
+
 protected:
   virtual void post_process();
 
diff --git a/src/solvers/refinement/bv_refinement.h b/src/solvers/refinement/bv_refinement.h
index d1e72e227b3..6d4fb84db95 100644
--- a/src/solvers/refinement/bv_refinement.h
+++ b/src/solvers/refinement/bv_refinement.h
@@ -21,34 +21,44 @@ Author: Daniel Kroening, kroening@kroening.com
 class bv_refinementt:public bv_pointerst
 {
 public:
-  bv_refinementt(const namespacet &_ns, propt &_prop);
-  ~bv_refinementt();
+  struct infot
+  {
+    const namespacet *ns=nullptr;
+    propt *prop=nullptr;
+    language_uit::uit ui=language_uit::uit::PLAIN;
+    /// Max number of times we refine a formula node
+    unsigned max_node_refinement=5;
+    /// Enable array refinement
+    bool refine_arrays=true;
+    /// Enable arithmetic refinement
+    bool refine_arithmetic=true;
+  };
 
-  virtual decision_proceduret::resultt dec_solve();
+  explicit bv_refinementt(const infot &info);
 
-  virtual std::string decision_procedure_text() const
+  decision_proceduret::resultt dec_solve() override;
+
+  std::string decision_procedure_text() const override
   {
     return "refinement loop with "+prop.solver_text();
   }
 
-  // NOLINTNEXTLINE(readability/identifiers)
-  typedef bv_pointerst SUB;
-
-  // maximal number of times we refine a formula node
-  unsigned max_node_refinement;
-  // enable/disable refinements
-  bool do_array_refinement;
-  bool do_arithmetic_refinement;
+protected:
 
-  using bv_pointerst::is_in_conflict;
+  // Refine array
+  void post_process_arrays() override;
 
-  void set_ui(language_uit::uit _ui) { ui=_ui; }
+  // Refine arithmetic
+  bvt convert_mult(const exprt &expr) override;
+  bvt convert_div(const div_exprt &expr) override;
+  bvt convert_mod(const mod_exprt &expr) override;
+  bvt convert_floatbv_op(const exprt &expr) override;
 
-protected:
-  resultt prop_solve();
+  void set_assumptions(const bvt &_assumptions) override;
 
+private:
   // the list of operator approximations
-  struct approximationt
+  struct approximationt final
   {
   public:
     explicit approximationt(std::size_t _id_nr):
@@ -79,39 +89,30 @@ class bv_refinementt:public bv_pointerst
     std::size_t id_nr;
   };
 
-  typedef std::list<approximationt> approximationst;
-  approximationst approximations;
-
+  resultt prop_solve();
   approximationt &add_approximation(const exprt &expr, bvt &bv);
+  bool conflicts_with(approximationt &approximation);
   void check_SAT(approximationt &approximation);
   void check_UNSAT(approximationt &approximation);
   void initialize(approximationt &approximation);
   void get_values(approximationt &approximation);
-  bool is_in_conflict(approximationt &approximation);
-
-  virtual void check_SAT();
-  virtual void check_UNSAT();
-  bool progress;
-
-  // we refine the theory of arrays
-  virtual void post_process_arrays();
+  void check_SAT();
+  void check_UNSAT();
   void arrays_overapproximated();
   void freeze_lazy_constraints();
 
-  // we refine expensive arithmetic
-  virtual bvt convert_mult(const exprt &expr);
-  virtual bvt convert_div(const div_exprt &expr);
-  virtual bvt convert_mod(const mod_exprt &expr);
-  virtual bvt convert_floatbv_op(const exprt &expr);
-
-  // for collecting statistics
-  virtual void set_to(const exprt &expr, bool value);
-
-  // overloading
-  virtual void set_assumptions(const bvt &_assumptions);
+  // MEMBERS
 
+  // Maximum number of times we refine a formula node
+  const unsigned max_node_refinement;
+  // Refinement toggles
+  const bool do_array_refinement;
+  const bool do_arithmetic_refinement;
+  bool progress;
+  std::vector<approximationt> approximations;
   bvt parent_assumptions;
 
+protected:
   // use gui format
   language_uit::uit ui;
 };
diff --git a/src/solvers/refinement/bv_refinement_loop.cpp b/src/solvers/refinement/bv_refinement_loop.cpp
index 2429cf2138d..e3ac990b3a4 100644
--- a/src/solvers/refinement/bv_refinement_loop.cpp
+++ b/src/solvers/refinement/bv_refinement_loop.cpp
@@ -12,23 +12,18 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <util/xml.h>
 
-bv_refinementt::bv_refinementt(
-  const namespacet &_ns, propt &_prop):
-  bv_pointerst(_ns, _prop),
-  max_node_refinement(5),
-  do_array_refinement(true),
-  do_arithmetic_refinement(true),
+bv_refinementt::bv_refinementt(const infot &info):
+  bv_pointerst(*info.ns, *info.prop),
+  max_node_refinement(info.max_node_refinement),
+  do_array_refinement(info.refine_arrays),
+  do_arithmetic_refinement(info.refine_arithmetic),
   progress(false),
-  ui(ui_message_handlert::uit::PLAIN)
+  ui(info.ui)
 {
   // check features we need
-  assert(prop.has_set_assumptions());
-  assert(prop.has_set_to());
-  assert(prop.has_is_in_conflict());
-}
-
-bv_refinementt::~bv_refinementt()
-{
+  PRECONDITION(prop.has_set_assumptions());
+  PRECONDITION(prop.has_set_to());
+  PRECONDITION(prop.has_is_in_conflict());
 }
 
 decision_proceduret::resultt bv_refinementt::dec_solve()
@@ -96,17 +91,16 @@ decision_proceduret::resultt bv_refinementt::prop_solve()
   // this puts the underapproximations into effect
   bvt assumptions=parent_assumptions;
 
-  for(approximationst::const_iterator
-      a_it=approximations.begin();
-      a_it!=approximations.end();
-      a_it++)
+  for(const approximationt &approximation : approximations)
   {
     assumptions.insert(
       assumptions.end(),
-      a_it->over_assumptions.begin(), a_it->over_assumptions.end());
+      approximation.over_assumptions.begin(),
+      approximation.over_assumptions.end());
     assumptions.insert(
       assumptions.end(),
-      a_it->under_assumptions.begin(), a_it->under_assumptions.end());
+      approximation.under_assumptions.begin(),
+      approximation.under_assumptions.end());
   }
 
   prop.set_assumptions(assumptions);
@@ -127,40 +121,16 @@ void bv_refinementt::check_SAT()
 
   arrays_overapproximated();
 
-  for(approximationst::iterator
-      a_it=approximations.begin();
-      a_it!=approximations.end();
-      a_it++)
-    check_SAT(*a_it);
+  for(approximationt &approximation : this->approximations)
+    check_SAT(approximation);
 }
 
 void bv_refinementt::check_UNSAT()
 {
   progress=false;
 
-  for(approximationst::iterator
-      a_it=approximations.begin();
-      a_it!=approximations.end();
-      a_it++)
-    check_UNSAT(*a_it);
-}
-
-void bv_refinementt::set_to(const exprt &expr, bool value)
-{
-  #if 0
-  unsigned prev=prop.no_variables();
-  SUB::set_to(expr, value);
-  unsigned n=prop.no_variables()-prev;
-  std::cout << n << " EEE " << expr.id() << "@" << expr.type().id();
-  forall_operands(it, expr)
-    std::cout << " " << it->id() << "@" << it->type().id();
-  if(expr.id()=="=" && expr.operands().size()==2)
-    forall_operands(it, expr.op1())
-      std::cout << " " << it->id() << "@" << it->type().id();
-  std::cout << '\n';
-  #else
-  SUB::set_to(expr, value);
-  #endif
+  for(approximationt &approximation : this->approximations)
+    check_UNSAT(approximation);
 }
 
 void bv_refinementt::set_assumptions(const bvt &_assumptions)
diff --git a/src/solvers/refinement/refine_arithmetic.cpp b/src/solvers/refinement/refine_arithmetic.cpp
index f0be4a531bf..2a6627a34e3 100644
--- a/src/solvers/refinement/refine_arithmetic.cpp
+++ b/src/solvers/refinement/refine_arithmetic.cpp
@@ -15,6 +15,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <langapi/language_util.h>
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/floatbv/float_utils.h>
 
 // Parameters
@@ -61,7 +62,7 @@ bvt bv_refinementt::convert_mult(const exprt &expr)
 
   const typet &type=ns.follow(expr.type());
 
-  assert(operands.size()>=2);
+  PRECONDITION(operands.size()>=2);
 
   if(operands.size()>2)
     return convert_mult(make_binary(expr)); // make binary
@@ -105,7 +106,7 @@ bvt bv_refinementt::convert_div(const div_exprt &expr)
   // we catch any division
   // unless it's integer division by a constant
 
-  assert(expr.operands().size()==2);
+  PRECONDITION(expr.operands().size()==2);
 
   if(expr.op1().is_constant())
     return SUB::convert_div(expr);
@@ -123,7 +124,7 @@ bvt bv_refinementt::convert_mod(const mod_exprt &expr)
   // we catch any mod
   // unless it's integer + constant
 
-  assert(expr.operands().size()==2);
+  PRECONDITION(expr.operands().size()==2);
 
   if(expr.op1().is_constant())
     return SUB::convert_mod(expr);
@@ -151,7 +152,7 @@ void bv_refinementt::get_values(approximationt &a)
     a.op2_value=get_value(a.op2_bv);
   }
   else
-    assert(0);
+    UNREACHABLE;
 
   a.result_value=get_value(a.result_bv);
 }
@@ -169,8 +170,10 @@ void bv_refinementt::check_SAT(approximationt &a)
 
   if(type.id()==ID_floatbv)
   {
-    // these are all trinary
-    assert(a.expr.operands().size()==3);
+    // these are all ternary
+    INVARIANT(
+      a.expr.operands().size()==3,
+      string_refinement_invariantt("all floatbv typed exprs are ternary"));
 
     if(a.over_state==MAX_STATE)
       return;
@@ -202,7 +205,7 @@ void bv_refinementt::check_SAT(approximationt &a)
     else if(a.expr.id()==ID_floatbv_div)
       result/=o1;
     else
-      assert(false);
+      UNREACHABLE;
 
     if(result.pack()==a.result_value) // ok
       return;
@@ -270,9 +273,9 @@ void bv_refinementt::check_SAT(approximationt &a)
       else if(a.expr.id()==ID_floatbv_div)
         r=float_utils.div(op0, op1);
       else
-        assert(0);
+        UNREACHABLE;
 
-      assert(r.size()==res.size());
+      CHECK_RETURN(r.size()==res.size());
       bv_utils.set_equal(r, res);
     }
   }
@@ -280,7 +283,9 @@ void bv_refinementt::check_SAT(approximationt &a)
           type.id()==ID_unsignedbv)
   {
     // these are all binary
-    assert(a.expr.operands().size()==2);
+    INVARIANT(
+      a.expr.operands().size()==2,
+      string_refinement_invariantt("all (un)signedbv typed exprs are binary"));
 
     // already full interpretation?
     if(a.over_state>0)
@@ -304,7 +309,7 @@ void bv_refinementt::check_SAT(approximationt &a)
     else if(a.expr.id()==ID_mod)
       o0%=o1;
     else
-      assert(false);
+      UNREACHABLE;
 
     if(o0.pack()==a.result_value) // ok
       return;
@@ -338,21 +343,21 @@ void bv_refinementt::check_SAT(approximationt &a)
             bv_utilst::representationt::UNSIGNED);
       }
       else
-        assert(0);
+        UNREACHABLE;
 
       bv_utils.set_equal(r, a.result_bv);
     }
     else
-      assert(0);
+      UNREACHABLE;
   }
   else if(type.id()==ID_fixedbv)
   {
     // TODO: not implemented
-    assert(0);
+    TODO;
   }
   else
   {
-    assert(0);
+    UNREACHABLE;
   }
 
   status() << "Found spurious `" << a.as_string()
@@ -368,13 +373,13 @@ void bv_refinementt::check_SAT(approximationt &a)
 void bv_refinementt::check_UNSAT(approximationt &a)
 {
   // part of the conflict?
-  if(!is_in_conflict(a))
+  if(!this->conflicts_with(a))
     return;
 
   status() << "Found assumption for `" << a.as_string()
            << "' in proof (state " << a.under_state << ")" << eom;
 
-  assert(!a.under_assumptions.empty());
+  PRECONDITION(!a.under_assumptions.empty());
 
   a.under_assumptions.clear();
 
@@ -453,7 +458,7 @@ void bv_refinementt::check_UNSAT(approximationt &a)
 }
 
 /// check if an under-approximation is part of the conflict
-bool bv_refinementt::is_in_conflict(approximationt &a)
+bool bv_refinementt::conflicts_with(approximationt &a)
 {
   for(std::size_t i=0; i<a.under_assumptions.size(); i++)
     if(prop.is_in_conflict(a.under_assumptions[i]))
@@ -485,7 +490,7 @@ bv_refinementt::add_approximation(
   approximationt &a=approximations.back(); // stable!
 
   std::size_t width=boolbv_width(expr.type());
-  assert(width!=0);
+  PRECONDITION(width!=0);
 
   a.expr=expr;
   a.result_bv=prop.new_variables(width);
@@ -514,7 +519,7 @@ bv_refinementt::add_approximation(
     set_frozen(a.op2_bv);
   }
   else
-    assert(false);
+    UNREACHABLE;
 
   bv=a.result_bv;
 
diff --git a/src/solvers/refinement/refine_arrays.cpp b/src/solvers/refinement/refine_arrays.cpp
index 5aebddf2e18..77ddacd6584 100644
--- a/src/solvers/refinement/refine_arrays.cpp
+++ b/src/solvers/refinement/refine_arrays.cpp
@@ -16,6 +16,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/std_expr.h>
 #include <util/find_symbols.h>
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/sat/satcheck.h>
 
 /// generate array constraints
@@ -55,7 +56,9 @@ void bv_refinementt::arrays_overapproximated()
     if(current.id()==ID_implies)
     {
       implies_exprt imp=to_implies_expr(current);
-      assert(imp.operands().size()==2);
+      DATA_INVARIANT(
+        imp.operands().size()==2,
+        string_refinement_invariantt("implies must have two operands"));
       exprt implies_simplified=get(imp.op0());
       if(implies_simplified==false_exprt())
       {
@@ -67,7 +70,9 @@ void bv_refinementt::arrays_overapproximated()
     if(current.id()==ID_or)
     {
       or_exprt orexp=to_or_expr(current);
-      assert(orexp.operands().size()==2);
+      INVARIANT(
+        orexp.operands().size()==2,
+        string_refinement_invariantt("only treats the case of a binary or"));
       exprt o1=get(orexp.op0());
       exprt o2=get(orexp.op1());
       if(o1==true_exprt() || o2 == true_exprt())
@@ -91,7 +96,13 @@ void bv_refinementt::arrays_overapproximated()
       lazy_array_constraints.erase(it++);
       break;
     default:
-      assert(false);
+      error() << "error in array over approximation check" << eom;
+      INVARIANT(
+        false,
+        string_refinement_invariantt("error in array over approximation "
+          "check"));
+      // Placeholder to tell the compiler we bail
+      throw 0;
     }
   }
 
diff --git a/src/solvers/refinement/refined_string_type.cpp b/src/solvers/refinement/refined_string_type.cpp
deleted file mode 100644
index edd1c43e49a..00000000000
--- a/src/solvers/refinement/refined_string_type.cpp
+++ /dev/null
@@ -1,103 +0,0 @@
-/********************************************************************\
-
-Module: Type for string expressions used by the string solver.
-        These string expressions contain a field `length`, of type
-        `index_type`, a field `content` of type `content_type`.
-        This module also defines functions to recognise the C and java
-        string types.
-
-Author: Romain Brenguier, romain.brenguier@diffblue.com
-
-\*******************************************************************/
-
-/// \file
-/// Type for string expressions used by the string solver. These string
-///   expressions contain a field `length`, of type `index_type`, a field
-///   `content` of type `content_type`. This module also defines functions to
-///   recognise the C and java string types.
-
-#include "refined_string_type.h"
-
-#include <util/cprover_prefix.h>
-
-refined_string_typet::refined_string_typet(
-  const typet &index_type, const typet &char_type)
-{
-  infinity_exprt infinite_index(index_type);
-  array_typet char_array(char_type, infinite_index);
-  components().emplace_back("length", index_type);
-  components().emplace_back("content", char_array);
-}
-
-/// \par parameters: a type
-/// \return Boolean telling whether the type is that of C strings
-bool refined_string_typet::is_c_string_type(const typet &type)
-{
-  return
-    type.id()==ID_struct &&
-    to_struct_type(type).get_tag()==CPROVER_PREFIX"string";
-}
-
-/// \par parameters: a type
-/// \return Boolean telling whether the type is that of java string pointers
-bool refined_string_typet::is_java_string_pointer_type(const typet &type)
-{
-  if(type.id()==ID_pointer)
-  {
-    const pointer_typet &pt=to_pointer_type(type);
-    const typet &subtype=pt.subtype();
-    return is_java_string_type(subtype);
-  }
-  return false;
-}
-
-/// \par parameters: a type
-/// \return Boolean telling whether the type is that of java string
-bool refined_string_typet::is_java_string_type(const typet &type)
-{
-  if(type.id()==ID_symbol)
-  {
-    irep_idt tag=to_symbol_type(type).get_identifier();
-    return tag=="java::java.lang.String";
-  }
-  else if(type.id()==ID_struct)
-  {
-    irep_idt tag=to_struct_type(type).get_tag();
-    return tag=="java.lang.String";
-  }
-  return false;
-}
-
-/// \par parameters: a type
-/// \return Boolean telling whether the type is that of java string builder
-bool refined_string_typet::is_java_string_builder_type(const typet &type)
-{
-  if(type.id()==ID_pointer)
-  {
-    const pointer_typet &pt=to_pointer_type(type);
-    const typet &subtype=pt.subtype();
-    if(subtype.id()==ID_struct)
-    {
-      irep_idt tag=to_struct_type(subtype).get_tag();
-      return tag=="java.lang.StringBuilder";
-    }
-  }
-  return false;
-}
-
-/// \par parameters: a type
-/// \return Boolean telling whether the type is that of java char sequence
-bool refined_string_typet::is_java_char_sequence_type(const typet &type)
-{
-  if(type.id()==ID_pointer)
-  {
-    const pointer_typet &pt=to_pointer_type(type);
-    const typet &subtype=pt.subtype();
-    if(subtype.id()==ID_struct)
-    {
-      const irep_idt &tag=to_struct_type(subtype).get_tag();
-      return tag=="java.lang.CharSequence";
-    }
-  }
-  return false;
-}
diff --git a/src/solvers/refinement/string_constraint.h b/src/solvers/refinement/string_constraint.h
index 27a6a87a5a8..c553efb8c7e 100644
--- a/src/solvers/refinement/string_constraint.h
+++ b/src/solvers/refinement/string_constraint.h
@@ -22,7 +22,33 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 
 #include <langapi/language_ui.h>
 #include <solvers/refinement/bv_refinement.h>
-#include <solvers/refinement/refined_string_type.h>
+#include <solvers/refinement/string_refinement_invariant.h>
+#include <util/refined_string_type.h>
+#include <util/string_expr.h>
+#include <langapi/language_util.h>
+
+/*! \brief Universally quantified string constraint
+
+    This represents a universally quantified string constraint as laid out in
+    DOI: 10.1007/978-3-319-03077-7. The paper seems to specify a universal
+    constraint as follows.
+
+    A universal constraint is of the form \f$\forall n. L(n) \rightarrow
+    P(n, s_0,\ldots, s_k)\f$ where
+
+    1. \f$L(n)\f$ does not contain string indices [possibly not required, but
+       implied by examples]
+    2. \f$\forall n. L(n) \rightarrow P'\left(s_0[f_0(n)],\ldots, s_k[f_k(n)]
+       \right)\f$, i.e. when focusing on one specific string, all indices are
+       the same [stated in a roundabout manner]
+    3. Each \f$f\f$ is linear and therefore has an inverse [explicitly stated]
+    4. \f$L(n)\f$ and \f$P(n, s_0,\ldots, s_k)\f$ may contain other (free)
+       variables, but in \f$P\f$, \f$n\f$ can only occur as an argument to an
+       \f$f\f$ [explicitly stated, implied]
+
+    We extend this slightly by restricting n to be in a specific range, but this
+    is another implication which can be pushed in to \f$L(n)\f$.
+*/
 
 class string_constraintt: public exprt
 {
@@ -55,7 +81,6 @@ class string_constraintt: public exprt
     return operands()[4];
   }
 
-
  private:
   string_constraintt();
 
@@ -104,16 +129,33 @@ class string_constraintt: public exprt
 
 extern inline const string_constraintt &to_string_constraint(const exprt &expr)
 {
-  assert(expr.id()==ID_string_constraint && expr.operands().size()==5);
+  PRECONDITION(expr.id()==ID_string_constraint && expr.operands().size()==5);
   return static_cast<const string_constraintt &>(expr);
 }
 
 extern inline string_constraintt &to_string_constraint(exprt &expr)
 {
-  assert(expr.id()==ID_string_constraint && expr.operands().size()==5);
+  PRECONDITION(expr.id()==ID_string_constraint && expr.operands().size()==5);
   return static_cast<string_constraintt &>(expr);
 }
 
+/// Used for debug printing.
+/// \param [in] ns: namespace for `from_expr`
+/// \param [in] identifier: identifier for `from_expr`
+/// \param [in] expr: constraint to render
+/// \return rendered string
+inline std::string from_expr(
+  const namespacet &ns,
+  const irep_idt &identifier,
+  const string_constraintt &expr)
+{
+  return "forall "+from_expr(ns, identifier, expr.univ_var())+" in ["+
+    from_expr(ns, identifier, expr.lower_bound())+", "+
+    from_expr(ns, identifier, expr.upper_bound())+"). "+
+    from_expr(ns, identifier, expr.premise())+" => "+
+    from_expr(ns, identifier, expr.body());
+}
+
 class string_not_contains_constraintt: public exprt
 {
 public:
@@ -171,19 +213,45 @@ class string_not_contains_constraintt: public exprt
   }
 };
 
+/// Used for debug printing.
+/// \param [in] ns: namespace for `from_expr`
+/// \param [in] identifier: identifier for `from_expr`
+/// \param [in] expr: constraint to render
+/// \return rendered string
+inline std::string from_expr(
+  const namespacet &ns,
+  const irep_idt &identifier,
+  const string_not_contains_constraintt &expr)
+{
+  return "forall x in ["+
+    from_expr(ns, identifier, expr.univ_lower_bound())+", "+
+    from_expr(ns, identifier, expr.univ_upper_bound())+"). "+
+    from_expr(ns, identifier, expr.premise())+" => ("+
+    "exists y in ["+from_expr(ns, identifier, expr.exists_lower_bound())+", "+
+    from_expr(ns, identifier, expr.exists_upper_bound())+"). "+
+    from_expr(ns, identifier, expr.s0())+"[x+y] != "+
+    from_expr(ns, identifier, expr.s1())+"[y])";
+}
+
 inline const string_not_contains_constraintt
 &to_string_not_contains_constraint(const exprt &expr)
 {
-  assert(expr.id()==ID_string_not_contains_constraint);
-  assert(expr.operands().size()==7);
+  PRECONDITION(expr.id()==ID_string_not_contains_constraint);
+  DATA_INVARIANT(
+    expr.operands().size()==7,
+    string_refinement_invariantt("string_not_contains_constraintt must have 7 "
+      "operands"));
   return static_cast<const string_not_contains_constraintt &>(expr);
 }
 
 inline string_not_contains_constraintt
 &to_string_not_contains_constraint(exprt &expr)
 {
-  assert(expr.id()==ID_string_not_contains_constraint);
-  assert(expr.operands().size()==7);
+  PRECONDITION(expr.id()==ID_string_not_contains_constraint);
+  DATA_INVARIANT(
+    expr.operands().size()==7,
+    string_refinement_invariantt("string_not_contains_constraintt must have 7 "
+      "operands"));
   return static_cast<string_not_contains_constraintt &>(expr);
 }
 
diff --git a/src/solvers/refinement/string_constraint_generator.h b/src/solvers/refinement/string_constraint_generator.h
index 84732931d70..7a0667fb397 100644
--- a/src/solvers/refinement/string_constraint_generator.h
+++ b/src/solvers/refinement/string_constraint_generator.h
@@ -20,42 +20,47 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 #ifndef CPROVER_SOLVERS_REFINEMENT_STRING_CONSTRAINT_GENERATOR_H
 #define CPROVER_SOLVERS_REFINEMENT_STRING_CONSTRAINT_GENERATOR_H
 
+#include <limits>
 #include <util/string_expr.h>
-#include <solvers/refinement/refined_string_type.h>
+#include <util/replace_expr.h>
+#include <util/refined_string_type.h>
+#include <util/constexpr.def>
 #include <solvers/refinement/string_constraint.h>
 
-class string_constraint_generatort
+class string_constraint_generatort final
 {
 public:
   // This module keeps a list of axioms. It has methods which generate
-  // string constraints for different string funcitons and add them
+  // string constraints for different string functions and add them
   // to the axiom list.
 
-  string_constraint_generatort():
-    mode(ID_unknown)
-  { }
+  // Used by format function
+  class format_specifiert;
 
-  void set_mode(irep_idt _mode)
+  /// Arguments pack for the string_constraint_generator constructor
+  struct infot
   {
-    // only C and java modes supported
-    assert((_mode==ID_java) || (_mode==ID_C));
-    mode=_mode;
-  }
+    const namespacet *ns=nullptr;
+    /// Max length of non-deterministic strings
+    size_t string_max_length=std::numeric_limits<size_t>::max();
+    /// Prefer printable characters in non-deterministic strings
+    bool string_printable=false;
+  };
 
-  irep_idt &get_mode() { return mode; }
+  explicit string_constraint_generatort(const infot& info);
 
-  // Axioms are of three kinds: universally quantified string constraint,
-  // not contains string constraints and simple formulas.
-  std::list<exprt> axioms;
+  /// Axioms are of three kinds: universally quantified string constraint,
+  /// not contains string constraints and simple formulas.
+  const std::vector<exprt> &get_axioms() const;
 
-  // Boolean symbols for the results of some string functions
-  std::list<symbol_exprt> boolean_symbols;
+  /// Boolean symbols for the results of some string functions
+  const std::vector<symbol_exprt> &get_boolean_symbols() const;
 
-  // Symbols used in existential quantifications
-  std::list<symbol_exprt> index_symbols;
+  /// Symbols used in existential quantifications
+  const std::vector<symbol_exprt> &get_index_symbols() const;
 
-  // Used to store information about witnesses for not_contains constraints
-  std::map<string_not_contains_constraintt, symbol_exprt> witness;
+  /// Set of strings that have been created by the generator
+  const std::set<string_exprt> &get_created_strings() const;
 
   exprt get_witness_of(
     const string_not_contains_constraintt &c,
@@ -64,47 +69,33 @@ class string_constraint_generatort
     return index_exprt(witness.at(c), univ_val);
   }
 
-  static unsigned next_symbol_id;
-
-  static symbol_exprt fresh_symbol(
+  symbol_exprt fresh_symbol(
     const irep_idt &prefix, const typet &type=bool_typet());
-  symbol_exprt fresh_exist_index(const irep_idt &prefix, const typet &type);
   symbol_exprt fresh_univ_index(const irep_idt &prefix, const typet &type);
-  symbol_exprt fresh_boolean(const irep_idt &prefix);
-  string_exprt fresh_string(const refined_string_typet &type);
 
-  // We maintain a map from symbols to strings.
-  std::map<irep_idt, string_exprt> symbol_to_string;
-
-  string_exprt find_or_add_string_of_symbol(const symbol_exprt &sym);
-
-  void assign_to_symbol(
-    const symbol_exprt &sym, const string_exprt &expr)
-  {
-    symbol_to_string[sym.get_identifier()]=expr;
-  }
-
-  string_exprt add_axioms_for_string_expr(const exprt &expr);
-  void set_string_symbol_equal_to_expr(
-    const symbol_exprt &sym, const exprt &str);
+  /// Maps unresolved symbols to the string_exprt that was created for them
+  string_exprt add_axioms_for_refined_string(const exprt &expr);
 
   exprt add_axioms_for_function_application(
     const function_application_exprt &expr);
 
-  static constant_exprt constant_char(int i, const typet &char_type);
+  symbol_exprt fresh_exist_index(const irep_idt &prefix, const typet &type);
 
 private:
-  // The integer with the longest string is Integer.MIN_VALUE which is -2^31,
-  // that is -2147483648 so takes 11 characters to write.
-  // The long with the longest string is Long.MIN_VALUE which is -2^63,
-  // approximately -9.223372037*10^18 so takes 20 characters to write.
-  const std::size_t MAX_INTEGER_LENGTH=11;
-  const std::size_t MAX_LONG_LENGTH=20;
-  const std::size_t MAX_FLOAT_LENGTH=15;
-  const std::size_t MAX_DOUBLE_LENGTH=30;
+  symbol_exprt fresh_boolean(const irep_idt &prefix);
+  string_exprt fresh_string(const refined_string_typet &type);
+  string_exprt get_string_expr(const exprt &expr);
+  plus_exprt plus_exprt_with_overflow_check(const exprt &op1, const exprt &op2);
+
+  string_exprt find_or_add_string_of_symbol(
+    const symbol_exprt &sym,
+    const refined_string_typet &ref_type);
+
+  static constant_exprt constant_char(int i, const typet &char_type);
 
   static irep_idt extract_java_string(const symbol_exprt &s);
 
+  void add_default_axioms(const string_exprt &s);
   exprt axiom_for_is_positive_index(const exprt &x);
 
   // The following functions add axioms for the returned value
@@ -138,11 +129,18 @@ class string_constraint_generatort
   string_exprt add_axioms_for_copy(const function_application_exprt &f);
   string_exprt add_axioms_for_concat(
     const string_exprt &s1, const string_exprt &s2);
+  string_exprt add_axioms_for_concat_substr(
+    const string_exprt &s1,
+    const string_exprt &s2,
+    const exprt &start_index,
+    const exprt &end_index);
   string_exprt add_axioms_for_concat(const function_application_exprt &f);
   string_exprt add_axioms_for_concat_int(const function_application_exprt &f);
   string_exprt add_axioms_for_concat_long(const function_application_exprt &f);
   string_exprt add_axioms_for_concat_bool(const function_application_exprt &f);
   string_exprt add_axioms_for_concat_char(const function_application_exprt &f);
+  string_exprt add_axioms_for_concat_char(
+    const string_exprt &string_expr, const exprt &char_expr);
   string_exprt add_axioms_for_concat_double(
     const function_application_exprt &f);
   string_exprt add_axioms_for_concat_float(const function_application_exprt &f);
@@ -155,6 +153,21 @@ class string_constraint_generatort
   string_exprt add_axioms_for_delete(const function_application_exprt &expr);
   string_exprt add_axioms_for_delete_char_at(
     const function_application_exprt &expr);
+  string_exprt add_axioms_for_format(const function_application_exprt &f);
+  string_exprt add_axioms_for_format(
+    const std::string &s,
+    const exprt::operandst &args,
+    const refined_string_typet &ref_type);
+  exprt add_axioms_for_format_specifier_is_correct(
+    const function_application_exprt &expr);
+  bool add_axioms_for_format_specifier_is_correct(
+    const std::string &s);
+
+  string_exprt add_axioms_for_format_specifier(
+    const format_specifiert &fs,
+    const struct_exprt &arg,
+    const refined_string_typet &ref_type);
+
   string_exprt add_axioms_for_insert(
     const string_exprt &s1, const string_exprt &s2, const exprt &offset);
   string_exprt add_axioms_for_insert(const function_application_exprt &f);
@@ -165,12 +178,17 @@ class string_constraint_generatort
   string_exprt add_axioms_for_insert_double(
     const function_application_exprt &f);
   string_exprt add_axioms_for_insert_float(const function_application_exprt &f);
-  string_exprt add_axioms_for_insert_char_array(
-    const function_application_exprt &f);
   string_exprt add_axioms_from_literal(const function_application_exprt &f);
   string_exprt add_axioms_from_int(const function_application_exprt &f);
   string_exprt add_axioms_from_int(
-    const exprt &i, size_t max_size, const refined_string_typet &ref_type);
+    const exprt &input_int,
+    const refined_string_typet &ref_type,
+    size_t max_size=0);
+  string_exprt add_axioms_from_int_with_radix(
+    const exprt &input_int,
+    const exprt &radix,
+    const refined_string_typet &ref_type,
+    size_t max_size=0);
   string_exprt add_axioms_from_int_hex(
     const exprt &i, const refined_string_typet &ref_type);
   string_exprt add_axioms_from_int_hex(const function_application_exprt &f);
@@ -182,36 +200,24 @@ class string_constraint_generatort
   string_exprt add_axioms_from_char(const function_application_exprt &f);
   string_exprt add_axioms_from_char(
     const exprt &i, const refined_string_typet &ref_type);
-  string_exprt add_axioms_from_char_array(const function_application_exprt &f);
-  string_exprt add_axioms_from_char_array(
-    const exprt &length,
-    const exprt &data,
-    const exprt &offset,
-    const exprt &count);
   exprt add_axioms_for_index_of(
     const string_exprt &str,
     const exprt &c,
     const exprt &from_index);
 
   // Add axioms corresponding to the String.indexOf:(String;I) java function
-  // TODO: the specifications are only partial:
-  // we add axioms stating that the returned value is either -1 or greater than
-  // from_index and the string beggining there has prefix substring
   exprt add_axioms_for_index_of_string(
-    const string_exprt &str,
-    const string_exprt &substring,
+    const string_exprt &haystack,
+    const string_exprt &needle,
     const exprt &from_index);
 
   // Add axioms corresponding to the String.indexOf java functions
-  // TODO: the specifications are only partial for the ones that look for
-  // strings
   exprt add_axioms_for_index_of(const function_application_exprt &f);
 
   // Add axioms corresponding to the String.lastIndexOf:(String;I) java function
-  // TODO: the specifications are only partial
   exprt add_axioms_for_last_index_of_string(
-    const string_exprt &str,
-    const string_exprt &substring,
+    const string_exprt &haystack,
+    const string_exprt &needle,
     const exprt &from_index);
 
   // Add axioms corresponding to the String.lastIndexOf:(CI) java function
@@ -221,7 +227,6 @@ class string_constraint_generatort
     const exprt &from_index);
 
   // Add axioms corresponding to the String.lastIndexOf java functions
-  // TODO: the specifications is only partial
   exprt add_axioms_for_last_index_of(const function_application_exprt &f);
 
   // TODO: the specifications of these functions is only partial
@@ -229,9 +234,17 @@ class string_constraint_generatort
   // and minus infinity the string are "Infinity" and "-Infinity respectively
   // otherwise the string contains only characters in [0123456789.] and '-' at
   // the start for negative number
-  string_exprt add_axioms_from_float(const function_application_exprt &f);
-  string_exprt add_axioms_from_float(
-    const exprt &f, bool double_precision=false);
+  string_exprt add_axioms_for_string_of_float(
+    const function_application_exprt &f);
+  string_exprt add_axioms_for_string_of_float(
+    const exprt &f, const refined_string_typet &ref_type);
+
+  string_exprt add_axioms_for_fractional_part(
+    const exprt &i, size_t max_size, const refined_string_typet &ref_type);
+  string_exprt add_axioms_from_float_scientific_notation(
+    const exprt &f, const refined_string_typet &ref_type);
+  string_exprt add_axioms_from_float_scientific_notation(
+    const function_application_exprt &f);
 
   // Add axioms corresponding to the String.valueOf(D) java function
   // TODO: the specifications is only partial
@@ -251,15 +264,13 @@ class string_constraint_generatort
     const function_application_exprt &expr);
   string_exprt add_axioms_for_to_upper_case(
     const function_application_exprt &expr);
+  string_exprt add_axioms_for_to_upper_case(
+    const string_exprt &expr);
   string_exprt add_axioms_for_trim(const function_application_exprt &expr);
 
-  // Add axioms corresponding to the String.valueOf([CII) function
-  // TODO: not working correctly at the moment
-  string_exprt add_axioms_for_value_of(const function_application_exprt &f);
-
   string_exprt add_axioms_for_code_point(
     const exprt &code_point, const refined_string_typet &ref_type);
-  string_exprt add_axioms_for_java_char_array(const exprt &char_array);
+  exprt add_axioms_for_char_pointer(const function_application_exprt &fun);
   string_exprt add_axioms_for_if(const if_exprt &expr);
   exprt add_axioms_for_char_literal(const function_application_exprt &f);
 
@@ -276,6 +287,21 @@ class string_constraint_generatort
   exprt add_axioms_for_offset_by_code_point(
     const function_application_exprt &f);
 
+  void add_axioms_for_characters_in_integer_string(
+    const exprt &input_int,
+    const typet &type,
+    const bool strict_formatting,
+    const string_exprt &str,
+    const std::size_t max_string_length,
+    const exprt &radix,
+    const unsigned long radix_ul);
+  void add_axioms_for_correct_number_format(
+    const exprt &input_int,
+    const string_exprt &str,
+    const exprt &radix_as_char,
+    const unsigned long radix_ul,
+    const std::size_t max_size,
+    const bool strict_formatting);
   exprt add_axioms_for_parse_int(const function_application_exprt &f);
   exprt add_axioms_for_to_char_array(const function_application_exprt &f);
   exprt add_axioms_for_compare_to(const function_application_exprt &f);
@@ -285,29 +311,74 @@ class string_constraint_generatort
   // string pointers
   symbol_exprt add_axioms_for_intern(const function_application_exprt &f);
 
-  // Tells which language is used. C and Java are supported
-  irep_idt mode;
-
   // assert that the number of argument is equal to nb and extract them
   static const function_application_exprt::argumentst &args(
     const function_application_exprt &expr, size_t nb)
   {
     const function_application_exprt::argumentst &args=expr.arguments();
-    assert(args.size()==nb);
+    PRECONDITION(args.size()==nb);
     return args;
   }
 
-  exprt int_of_hex_char(const exprt &chr) const;
-  exprt is_high_surrogate(const exprt &chr) const;
-  exprt is_low_surrogate(const exprt &chr) const;
+  // Helper functions
+  static exprt int_of_hex_char(const exprt &chr);
+  static exprt is_high_surrogate(const exprt &chr);
+  static exprt is_low_surrogate(const exprt &chr);
   static exprt character_equals_ignore_case(
     exprt char1, exprt char2, exprt char_a, exprt char_A, exprt char_Z);
+  static bool is_constant_string(const string_exprt &expr);
+  static string_exprt empty_string(const refined_string_typet &ref_type);
+  unsigned long to_integer_or_default(const exprt &expr, unsigned long def);
 
-  // Pool used for the intern method
-  std::map<string_exprt, symbol_exprt> pool;
+  // MEMBERS
+public:
+  const size_t max_string_length;
+  // Used to store information about witnesses for not_contains constraints
+  std::map<string_not_contains_constraintt, symbol_exprt> witness;
+private:
+  // The integer with the longest string is Integer.MIN_VALUE which is -2^31,
+  // that is -2147483648 so takes 11 characters to write.
+  // The long with the longest string is Long.MIN_VALUE which is -2^63,
+  // approximately -9.223372037*10^18 so takes 20 characters to write.
+  CBMC_CONSTEXPR static const std::size_t MAX_INTEGER_LENGTH=11;
+  CBMC_CONSTEXPR static const std::size_t MAX_LONG_LENGTH=20;
+  CBMC_CONSTEXPR static const std::size_t MAX_FLOAT_LENGTH=15;
+  CBMC_CONSTEXPR static const std::size_t MAX_DOUBLE_LENGTH=30;
+  std::set<string_exprt> m_created_strings;
+  unsigned m_symbol_count=0;
+  const messaget m_message;
+  const bool m_force_printable_characters;
+
+  std::vector<exprt> m_axioms;
+  std::map<irep_idt, string_exprt> m_unresolved_symbols;
+  std::vector<symbol_exprt> m_boolean_symbols;
+  std::vector<symbol_exprt> m_index_symbols;
+  std::map<function_application_exprt, exprt> m_function_application_cache;
+  const namespacet m_ns;
+  // To each string on which hash_code was called we associate a symbol
+  // representing the return value of the hash_code function.
+  std::map<string_exprt, exprt> m_hash_code_of_string;
 
-  // Used to determine whether hashcode should be equal
-  std::map<string_exprt, symbol_exprt> hash;
+  // Pool used for the intern method
+  std::map<string_exprt, symbol_exprt> m_intern_of_string;
 };
 
+exprt is_digit_with_radix(
+  const exprt &chr,
+  const bool strict_formatting,
+  const exprt &radix_as_char,
+  const unsigned long radix_ul);
+
+exprt get_numeric_value_from_character(
+  const exprt &chr,
+  const typet &char_type,
+  const typet &type,
+  const bool strict_formatting,
+  unsigned long radix_ul);
+
+size_t max_printed_string_length(const typet &type, unsigned long ul_radix);
+
+std::string utf16_constant_array_to_java(
+  const array_exprt &arr, unsigned length);
+
 #endif
diff --git a/src/solvers/refinement/string_constraint_generator_code_points.cpp b/src/solvers/refinement/string_constraint_generator_code_points.cpp
index 6bf8e035ad5..55b914d1aa7 100644
--- a/src/solvers/refinement/string_constraint_generator_code_points.cpp
+++ b/src/solvers/refinement/string_constraint_generator_code_points.cpp
@@ -30,7 +30,7 @@ string_exprt string_constraint_generatort::add_axioms_for_code_point(
 {
   string_exprt res=fresh_string(ref_type);
   const typet &type=code_point.type();
-  assert(type.id()==ID_signedbv);
+  PRECONDITION(type.id()==ID_signedbv);
 
   // We add axioms:
   // a1 : code_point<0x010000 => |res|=1
@@ -48,27 +48,27 @@ string_exprt string_constraint_generatort::add_axioms_for_code_point(
 
   binary_relation_exprt small(code_point, ID_lt, hex010000);
   implies_exprt a1(small, res.axiom_for_has_length(1));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   implies_exprt a2(not_exprt(small), res.axiom_for_has_length(2));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   typecast_exprt code_point_as_char(code_point, ref_type.get_char_type());
   implies_exprt a3(small, equal_exprt(res[0], code_point_as_char));
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
 
   plus_exprt first_char(
     hexD800, div_exprt(minus_exprt(code_point, hex010000), hex0400));
   implies_exprt a4(
     not_exprt(small),
     equal_exprt(res[0], typecast_exprt(first_char, ref_type.get_char_type())));
-  axioms.push_back(a4);
+  m_axioms.push_back(a4);
 
   plus_exprt second_char(hexDC00, mod_exprt(code_point, hex0400));
   implies_exprt a5(
     not_exprt(small),
     equal_exprt(res[1], typecast_exprt(second_char, ref_type.get_char_type())));
-  axioms.push_back(a5);
+  m_axioms.push_back(a5);
 
   return res;
 }
@@ -79,7 +79,7 @@ string_exprt string_constraint_generatort::add_axioms_for_code_point(
 /// 0xD800..0xDBFF
 /// \par parameters: a character expression
 /// \return a Boolean expression
-exprt string_constraint_generatort::is_high_surrogate(const exprt &chr) const
+exprt string_constraint_generatort::is_high_surrogate(const exprt &chr)
 {
   return and_exprt(
     binary_relation_exprt(chr, ID_ge, constant_char(0xD800, chr.type())),
@@ -92,7 +92,7 @@ exprt string_constraint_generatort::is_high_surrogate(const exprt &chr) const
 /// 0xDC00..0xDFFF
 /// \par parameters: a character expression
 /// \return a Boolean expression
-exprt string_constraint_generatort::is_low_surrogate(const exprt &chr) const
+exprt string_constraint_generatort::is_low_surrogate(const exprt &chr)
 {
   return and_exprt(
     binary_relation_exprt(chr, ID_ge, constant_char(0xDC00, chr.type())),
@@ -126,22 +126,23 @@ exprt string_constraint_generatort::add_axioms_for_code_point_at(
   const function_application_exprt &f)
 {
   typet return_type=f.type();
-  assert(return_type.id()==ID_signedbv);
-  string_exprt str=add_axioms_for_string_expr(args(f, 2)[0]);
+  PRECONDITION(return_type.id()==ID_signedbv);
+  string_exprt str=get_string_expr(args(f, 2)[0]);
   const exprt &pos=args(f, 2)[1];
 
   symbol_exprt result=fresh_symbol("char", return_type);
   exprt index1=from_integer(1, str.length().type());
   const exprt &char1=str[pos];
-  const exprt &char2=str[plus_exprt(pos, index1)];
+  const exprt &char2=str[plus_exprt_with_overflow_check(pos, index1)];
   exprt char1_as_int=typecast_exprt(char1, return_type);
   exprt char2_as_int=typecast_exprt(char2, return_type);
   exprt pair=pair_value(char1_as_int, char2_as_int, return_type);
-  exprt is_low=is_low_surrogate(str[plus_exprt(pos, index1)]);
+  exprt is_low=is_low_surrogate(
+    str[plus_exprt_with_overflow_check(pos, index1)]);
   exprt return_pair=and_exprt(is_high_surrogate(str[pos]), is_low);
 
-  axioms.push_back(implies_exprt(return_pair, equal_exprt(result, pair)));
-  axioms.push_back(
+  m_axioms.push_back(implies_exprt(return_pair, equal_exprt(result, pair)));
+  m_axioms.push_back(
     implies_exprt(not_exprt(return_pair), equal_exprt(result, char1_as_int)));
   return result;
 }
@@ -154,11 +155,11 @@ exprt string_constraint_generatort::add_axioms_for_code_point_before(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(args.size()==2);
+  PRECONDITION(args.size()==2);
   typet return_type=f.type();
-  assert(return_type.id()==ID_signedbv);
+  PRECONDITION(return_type.id()==ID_signedbv);
   symbol_exprt result=fresh_symbol("char", return_type);
-  string_exprt str=add_axioms_for_string_expr(args[0]);
+  string_exprt str=get_string_expr(args[0]);
 
   const exprt &char1=
     str[minus_exprt(args[1], from_integer(2, str.length().type()))];
@@ -171,8 +172,8 @@ exprt string_constraint_generatort::add_axioms_for_code_point_before(
   exprt return_pair=and_exprt(
     is_high_surrogate(char1), is_low_surrogate(char2));
 
-  axioms.push_back(implies_exprt(return_pair, equal_exprt(result, pair)));
-  axioms.push_back(
+  m_axioms.push_back(implies_exprt(return_pair, equal_exprt(result, pair)));
+  m_axioms.push_back(
     implies_exprt(not_exprt(return_pair), equal_exprt(result, char2_as_int)));
   return result;
 }
@@ -185,15 +186,15 @@ exprt string_constraint_generatort::add_axioms_for_code_point_before(
 exprt string_constraint_generatort::add_axioms_for_code_point_count(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt str=get_string_expr(args(f, 3)[0]);
   const exprt &begin=args(f, 3)[1];
   const exprt &end=args(f, 3)[2];
   const typet &return_type=f.type();
   symbol_exprt result=fresh_symbol("code_point_count", return_type);
   minus_exprt length(end, begin);
   div_exprt minimum(length, from_integer(2, length.type()));
-  axioms.push_back(binary_relation_exprt(result, ID_le, length));
-  axioms.push_back(binary_relation_exprt(result, ID_ge, minimum));
+  m_axioms.push_back(binary_relation_exprt(result, ID_le, length));
+  m_axioms.push_back(binary_relation_exprt(result, ID_ge, minimum));
 
   return result;
 }
@@ -207,16 +208,17 @@ exprt string_constraint_generatort::add_axioms_for_code_point_count(
 exprt string_constraint_generatort::add_axioms_for_offset_by_code_point(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt str=get_string_expr(args(f, 3)[0]);
   const exprt &index=args(f, 3)[1];
   const exprt &offset=args(f, 3)[2];
   const typet &return_type=f.type();
   symbol_exprt result=fresh_symbol("offset_by_code_point", return_type);
 
-  exprt minimum=plus_exprt(index, offset);
-  exprt maximum=plus_exprt(index, plus_exprt(offset, offset));
-  axioms.push_back(binary_relation_exprt(result, ID_le, maximum));
-  axioms.push_back(binary_relation_exprt(result, ID_ge, minimum));
+  exprt minimum=plus_exprt_with_overflow_check(index, offset);
+  exprt maximum=plus_exprt_with_overflow_check(
+    index, plus_exprt_with_overflow_check(offset, offset));
+  m_axioms.push_back(binary_relation_exprt(result, ID_le, maximum));
+  m_axioms.push_back(binary_relation_exprt(result, ID_ge, minimum));
 
   return result;
 }
diff --git a/src/solvers/refinement/string_constraint_generator_comparison.cpp b/src/solvers/refinement/string_constraint_generator_comparison.cpp
index fbb64c55d68..7bc276cd24a 100644
--- a/src/solvers/refinement/string_constraint_generator_comparison.cpp
+++ b/src/solvers/refinement/string_constraint_generator_comparison.cpp
@@ -14,18 +14,20 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 #include <solvers/refinement/string_constraint_generator.h>
 
 /// add axioms stating that the result is true exactly when the strings
-/// represented by the arguments are equal
+/// represented by the arguments are equal. the variable ending in
+/// `witness_unequal` is -1 if the length differs or an index at which the
+/// strings are different
 /// \par parameters: function application with two string arguments
 /// \return a expression of Boolean type
 exprt string_constraint_generatort::add_axioms_for_equals(
   const function_application_exprt &f)
 {
-  assert(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  PRECONDITION(f.type()==bool_typet() || f.type().id()==ID_c_bool);
   symbol_exprt eq=fresh_boolean("equal");
   typecast_exprt tc_eq(eq, f.type());
 
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_for_string_expr(args(f, 2)[1]);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  string_exprt s2=get_string_expr(args(f, 2)[1]);
   typet index_type=s1.length().type();
 
   // We want to write:
@@ -37,11 +39,11 @@ exprt string_constraint_generatort::add_axioms_for_equals(
   //       || (witness<s1.length &&s1[witness]!=s2[witness])
 
   implies_exprt a1(eq, s1.axiom_for_has_same_length_as(s2));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   symbol_exprt qvar=fresh_univ_index("QA_equal", index_type);
   string_constraintt a2(qvar, s1.length(), eq, equal_exprt(s1[qvar], s2[qvar]));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   symbol_exprt witness=fresh_exist_index("witness_unequal", index_type);
   exprt zero=from_integer(0, index_type);
@@ -49,10 +51,11 @@ exprt string_constraint_generatort::add_axioms_for_equals(
     binary_relation_exprt(witness, ID_lt, s1.length()),
     binary_relation_exprt(witness, ID_ge, zero));
   and_exprt witnessing(bound_witness, notequal_exprt(s1[witness], s2[witness]));
-  implies_exprt a3(
-    not_exprt(eq),
-    or_exprt(notequal_exprt(s1.length(), s2.length()), witnessing));
-  axioms.push_back(a3);
+  and_exprt diff_length(
+    notequal_exprt(s1.length(), s2.length()),
+    equal_exprt(witness, from_integer(-1, index_type)));
+  implies_exprt a3(not_exprt(eq), or_exprt(diff_length, witnessing));
+  m_axioms.push_back(a3);
 
   return tc_eq;
 }
@@ -79,8 +82,13 @@ exprt string_constraint_generatort::character_equals_ignore_case(
   // p3 : (is_up2&&'a'-'A'+char2=char1)
   equal_exprt p1(char1, char2);
   minus_exprt diff=minus_exprt(char_a, char_A);
-  and_exprt p2(is_upper_case_1, equal_exprt(plus_exprt(diff, char1), char2));
-  and_exprt p3(is_upper_case_2, equal_exprt(plus_exprt(diff, char2), char1));
+
+  // Overflow is not a problem here because is_upper_case conditions
+  // ensure that we are within a safe range.
+  and_exprt p2(is_upper_case_1,
+               equal_exprt(plus_exprt(diff, char1), char2));
+  and_exprt p3(is_upper_case_2,
+               equal_exprt(plus_exprt(diff, char2), char1));
   return or_exprt(or_exprt(p1, p2), p3);
 }
 
@@ -90,12 +98,12 @@ exprt string_constraint_generatort::character_equals_ignore_case(
 exprt string_constraint_generatort::add_axioms_for_equals_ignore_case(
   const function_application_exprt &f)
 {
-  assert(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  PRECONDITION(f.type()==bool_typet() || f.type().id()==ID_c_bool);
 
   symbol_exprt eq=fresh_boolean("equal_ignore_case");
   typecast_exprt tc_eq(eq, f.type());
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_for_string_expr(args(f, 2)[1]);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  string_exprt s2=get_string_expr(args(f, 2)[1]);
   typet char_type=to_refined_string_type(s1.type()).get_char_type();
   exprt char_a=constant_char('a', char_type);
   exprt char_A=constant_char('A', char_type);
@@ -109,13 +117,13 @@ exprt string_constraint_generatort::add_axioms_for_equals_ignore_case(
   // a3 : !eq => |s1|!=s2 || (0 <=witness<|s1| &&!char_equal_ignore_case)
 
   implies_exprt a1(eq, s1.axiom_for_has_same_length_as(s2));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   symbol_exprt qvar=fresh_univ_index("QA_equal_ignore_case", index_type);
   exprt constr2=character_equals_ignore_case(
     s1[qvar], s2[qvar], char_a, char_A, char_Z);
   string_constraintt a2(qvar, s1.length(), eq, constr2);
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   symbol_exprt witness=fresh_exist_index(
     "witness_unequal_ignore_case", index_type);
@@ -131,7 +139,7 @@ exprt string_constraint_generatort::add_axioms_for_equals_ignore_case(
     or_exprt(
       notequal_exprt(s1.length(), s2.length()),
       and_exprt(bound_witness, witness_diff)));
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
 
   return tc_eq;
 }
@@ -143,37 +151,35 @@ exprt string_constraint_generatort::add_axioms_for_equals_ignore_case(
 exprt string_constraint_generatort::add_axioms_for_hash_code(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 1)[0]);
+  string_exprt str=get_string_expr(args(f, 1)[0]);
   typet return_type=f.type();
   typet index_type=str.length().type();
 
-  // initialisation of the missing pool variable
-  std::map<irep_idt, string_exprt>::iterator it;
-  for(it=symbol_to_string.begin(); it!=symbol_to_string.end(); it++)
-    if(hash.find(it->second)==hash.end())
-      hash[it->second]=fresh_symbol("hash", return_type);
+  auto pair=m_hash_code_of_string.insert(
+    std::make_pair(str, fresh_symbol("hash", return_type)));
+  exprt hash=pair.first->second;
 
   // for each string s. either:
   //   c1: hash(str)=hash(s)
   //   c2: |str|!=|s|
-  //   c3: (|str|==|s| &&exists i<|s|. s[i]!=str[i])
+  //   c3: (|str|==|s| && exists i<|s|. s[i]!=str[i])
 
   // WARNING: the specification may be incomplete
-  for(it=symbol_to_string.begin(); it!=symbol_to_string.end(); it++)
+  for(auto it : m_hash_code_of_string)
   {
     symbol_exprt i=fresh_exist_index("index_hash", index_type);
-    equal_exprt c1(hash[it->second], hash[str]);
-    not_exprt c2(equal_exprt(it->second.length(), str.length()));
+    equal_exprt c1(it.second, hash);
+    not_exprt c2(equal_exprt(it.first.length(), str.length()));
     and_exprt c3(
-      equal_exprt(it->second.length(), str.length()),
+      equal_exprt(it.first.length(), str.length()),
       and_exprt(
-        not_exprt(equal_exprt(str[i], it->second[i])),
+        not_exprt(equal_exprt(str[i], it.first[i])),
         and_exprt(
-          str.axiom_for_is_strictly_longer_than(i),
+          str.axiom_for_length_gt(i),
           axiom_for_is_positive_index(i))));
-    axioms.push_back(or_exprt(c1, or_exprt(c2, c3)));
+    m_axioms.push_back(or_exprt(c1, or_exprt(c2, c3)));
   }
-  return hash[str];
+  return hash;
 }
 
 /// add axioms corresponding to the String.compareTo java function
@@ -182,8 +188,8 @@ exprt string_constraint_generatort::add_axioms_for_hash_code(
 exprt string_constraint_generatort::add_axioms_for_compare_to(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_for_string_expr(args(f, 2)[1]);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  string_exprt s2=get_string_expr(args(f, 2)[1]);
   const typet &return_type=f.type();
   symbol_exprt res=fresh_symbol("compare_to", return_type);
   typet index_type=s1.length().type();
@@ -194,22 +200,22 @@ exprt string_constraint_generatort::add_axioms_for_compare_to(
   // a1 : res==0 => |s1|=|s2|
   // a2 : forall i<|s1|. s1[i]==s2[i]
   // a3 : exists x.
-  // res!=0 ==> x> 0 &&
-  //   ((|s1| <= |s2| &&x<|s1|) || (|s1| >= |s2| &&x<|s2|)
-  //   &&res=s1[x]-s2[x] )
-  // || cond2:
-  //   (|s1|<|s2| &&x=|s1|) || (|s1| > |s2| &&x=|s2|) &&res=|s1|-|s2|)
-  // a4 : forall i<x. res!=0 => s1[i]=s2[i]
+  //        res!=0 ==> x > 0
+  //        && ((|s1| <= |s2| && x<|s1|) || (|s1| >= |s2| &&x<|s2|)
+  //        && res=s1[x]-s2[x] )
+  //     || cond2:
+  //       (|s1|<|s2| &&x=|s1|) || (|s1| > |s2| &&x=|s2|) &&res=|s1|-|s2|)
+  // a4 : forall i'<x. res!=0 => s1[i]=s2[i]
 
-  assert(return_type.id()==ID_signedbv);
+  PRECONDITION(return_type.id()==ID_signedbv);
 
   equal_exprt res_null=equal_exprt(res, from_integer(0, return_type));
   implies_exprt a1(res_null, s1.axiom_for_has_same_length_as(s2));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   symbol_exprt i=fresh_univ_index("QA_compare_to", index_type);
   string_constraintt a2(i, s1.length(), res_null, equal_exprt(s1[i], s2[i]));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   symbol_exprt x=fresh_exist_index("index_compare_to", index_type);
   equal_exprt ret_char_diff(
@@ -223,16 +229,12 @@ exprt string_constraint_generatort::add_axioms_for_compare_to(
       typecast_exprt(s1.length(), return_type),
       typecast_exprt(s2.length(), return_type)));
   or_exprt guard1(
-    and_exprt(s1.axiom_for_is_shorter_than(s2),
-              s1.axiom_for_is_strictly_longer_than(x)),
-    and_exprt(s1.axiom_for_is_longer_than(s2),
-              s2.axiom_for_is_strictly_longer_than(x)));
+    and_exprt(s1.axiom_for_length_le(s2), s1.axiom_for_length_gt(x)),
+    and_exprt(s1.axiom_for_length_ge(s2), s2.axiom_for_length_gt(x)));
   and_exprt cond1(ret_char_diff, guard1);
   or_exprt guard2(
-    and_exprt(s2.axiom_for_is_strictly_longer_than(s1),
-              s1.axiom_for_has_length(x)),
-    and_exprt(s1.axiom_for_is_strictly_longer_than(s2),
-              s2.axiom_for_has_length(x)));
+    and_exprt(s2.axiom_for_length_gt(s1), s1.axiom_for_has_length(x)),
+    and_exprt(s1.axiom_for_length_gt(s2), s2.axiom_for_has_length(x)));
   and_exprt cond2(ret_length_diff, guard2);
 
   implies_exprt a3(
@@ -240,10 +242,12 @@ exprt string_constraint_generatort::add_axioms_for_compare_to(
     and_exprt(
       binary_relation_exprt(x, ID_ge, from_integer(0, return_type)),
       or_exprt(cond1, cond2)));
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
 
-  string_constraintt a4(i, x, not_exprt(res_null), equal_exprt(s1[i], s2[i]));
-  axioms.push_back(a4);
+  symbol_exprt i2=fresh_univ_index("QA_compare_to", index_type);
+  string_constraintt a4(
+    i2, x, not_exprt(res_null), equal_exprt(s1[i2], s2[i2]));
+  m_axioms.push_back(a4);
 
   return res;
 }
@@ -255,15 +259,15 @@ exprt string_constraint_generatort::add_axioms_for_compare_to(
 symbol_exprt string_constraint_generatort::add_axioms_for_intern(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 1)[0]);
+  string_exprt str=get_string_expr(args(f, 1)[0]);
+  // For now we only enforce content equality and not pointer equality
   const typet &return_type=f.type();
+
   typet index_type=str.length().type();
 
-  // initialisation of the missing pool variable
-  std::map<irep_idt, string_exprt>::iterator it;
-  for(it=symbol_to_string.begin(); it!=symbol_to_string.end(); it++)
-    if(pool.find(it->second)==pool.end())
-      pool[it->second]=fresh_symbol("pool", return_type);
+  auto pair=m_intern_of_string.insert(
+    std::make_pair(str, fresh_symbol("pool", return_type)));
+  symbol_exprt intern=pair.first->second;
 
   // intern(str)=s_0 || s_1 || ...
   // for each string s.
@@ -271,30 +275,30 @@ symbol_exprt string_constraint_generatort::add_axioms_for_intern(
   //    || (|str|==|s| &&exists i<|s|. s[i]!=str[i])
 
   exprt disj=false_exprt();
-  for(it=symbol_to_string.begin(); it!=symbol_to_string.end(); it++)
+  for(auto it : m_intern_of_string)
     disj=or_exprt(
-      disj, equal_exprt(pool[str], symbol_exprt(it->first, return_type)));
+      disj, equal_exprt(intern, it.second));
 
-  axioms.push_back(disj);
+  m_axioms.push_back(disj);
 
 
   // WARNING: the specification may be incomplete or incorrect
-  for(it=symbol_to_string.begin(); it!=symbol_to_string.end(); it++)
-    if(it->second!=str)
+  for(auto it : m_intern_of_string)
+    if(it.second!=str)
     {
       symbol_exprt i=fresh_exist_index("index_intern", index_type);
-      axioms.push_back(
+      m_axioms.push_back(
         or_exprt(
-          equal_exprt(pool[it->second], pool[str]),
+          equal_exprt(it.second, intern),
           or_exprt(
-            not_exprt(str.axiom_for_has_same_length_as(it->second)),
+            not_exprt(str.axiom_for_has_same_length_as(it.first)),
             and_exprt(
-              str.axiom_for_has_same_length_as(it->second),
+              str.axiom_for_has_same_length_as(it.first),
               and_exprt(
-                not_exprt(equal_exprt(str[i], it->second[i])),
-                and_exprt(str.axiom_for_is_strictly_longer_than(i),
+                not_exprt(equal_exprt(str[i], it.first[i])),
+                and_exprt(str.axiom_for_length_gt(i),
                           axiom_for_is_positive_index(i)))))));
     }
 
-  return pool[str];
+  return intern;
 }
diff --git a/src/solvers/refinement/string_constraint_generator_concat.cpp b/src/solvers/refinement/string_constraint_generator_concat.cpp
index 4d0a5b47151..3f4f607addd 100644
--- a/src/solvers/refinement/string_constraint_generator_concat.cpp
+++ b/src/solvers/refinement/string_constraint_generator_concat.cpp
@@ -13,142 +13,190 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 
 #include <solvers/refinement/string_constraint_generator.h>
 
-/// add axioms to say that the returned string expression is equal to the
-/// concatenation of the two string expressions given as input
-/// \par parameters: two string expressions
+/// Add axioms enforcing that the returned string expression is equal to the
+/// concatenation of s1 with the substring of s2 starting at index start_index
+/// and ending at index end_index.
+///
+/// If start_index >= end_index, the value returned is s1.
+/// If end_index > |s2| and/or start_index < 0, the appended string will be of
+/// length end_index - start_index and padded with non-deterministic values.
+///
+/// \param s1: string expression
+/// \param s2: string expression
+/// \param start_index: expression representing an integer
+/// \param end_index: expression representing an integer
 /// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_for_concat(
-  const string_exprt &s1, const string_exprt &s2)
+string_exprt string_constraint_generatort::add_axioms_for_concat_substr(
+  const string_exprt &s1,
+  const string_exprt &s2,
+  const exprt &start_index,
+  const exprt &end_index)
 {
   const refined_string_typet &ref_type=to_refined_string_type(s1.type());
   string_exprt res=fresh_string(ref_type);
 
   // We add axioms:
-  // a1 : |res|=|s1|+|s2|
-  // a2 : |s1| <= |res| (to avoid overflow with very long strings)
-  // a3 : |s2| <= |res| (to avoid overflow with very long strings)
-  // a4 : forall i<|s1|. res[i]=s1[i]
-  // a5 : forall i<|s2|. res[i+|s1|]=s2[i]
-
-  exprt a1=res.axiom_for_has_length(
-    plus_exprt(s1.length(), s2.length()));
-  axioms.push_back(a1);
-  axioms.push_back(s1.axiom_for_is_shorter_than(res));
-  axioms.push_back(s2.axiom_for_is_shorter_than(res));
+  // a1 : end_index > start_index => |res|=|s1|+ end_index - start_index
+  // a2 : end_index <= start_index => res = s1
+  // a3 : forall i<|s1|. res[i]=s1[i]
+  // a4 : forall i< end_index - start_index. res[i+|s1|]=s2[start_index+i]
+
+  binary_relation_exprt prem(end_index, ID_gt, start_index);
+
+  exprt res_length=plus_exprt_with_overflow_check(
+    s1.length(), minus_exprt(end_index, start_index));
+  implies_exprt a1(prem, equal_exprt(res.length(), res_length));
+  m_axioms.push_back(a1);
+
+  implies_exprt a2(not_exprt(prem), equal_exprt(res.length(), s1.length()));
+  m_axioms.push_back(a2);
 
   symbol_exprt idx=fresh_univ_index("QA_index_concat", res.length().type());
-  string_constraintt a4(idx, s1.length(), equal_exprt(s1[idx], res[idx]));
-  axioms.push_back(a4);
+  string_constraintt a3(idx, s1.length(), equal_exprt(s1[idx], res[idx]));
+  m_axioms.push_back(a3);
 
   symbol_exprt idx2=fresh_univ_index("QA_index_concat2", res.length().type());
-  equal_exprt res_eq(s2[idx2], res[plus_exprt(idx2, s1.length())]);
-  string_constraintt a5(idx2, s2.length(), res_eq);
-  axioms.push_back(a5);
+  equal_exprt res_eq(
+    res[plus_exprt(idx2, s1.length())], s2[plus_exprt(start_index, idx2)]);
+  string_constraintt a4(idx2, minus_exprt(end_index, start_index), res_eq);
+  m_axioms.push_back(a4);
 
   return res;
 }
 
-/// add axioms to say that the returned string expression is equal to the
-/// concatenation of the two string arguments of the function application
-/// \par parameters: function application with two arguments which are strings
+/// Add axioms to say that the returned string expression is equal to the
+/// concatenation of the two string expressions given as input.
+///
+/// \param s1: the string expression to append to
+/// \param s2: the string expression to append to the first one
+/// \return a new string expression
+string_exprt string_constraint_generatort::add_axioms_for_concat(
+  const string_exprt &s1, const string_exprt &s2)
+{
+  exprt index_zero=from_integer(0, s2.length().type());
+  return add_axioms_for_concat_substr(s1, s2, index_zero, s2.length());
+}
+
+/// Add axioms enforcing that the returned string expression is equal to the
+/// concatenation of the two string arguments of the function application.
+///
+/// In case 4 arguments instead of 2 are given the last two arguments are
+/// intepreted as a start index and last index from which we extract a substring
+/// of the second argument: this is similar to the Java
+/// StringBuilder.append(CharSequence s, int start, int end) method.
+///
+/// \param f: function application with two string arguments
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(args.size()==2);
-
-  string_exprt s1=add_axioms_for_string_expr(args[0]);
-  string_exprt s2=add_axioms_for_string_expr(args[1]);
-
+  PRECONDITION(args.size()>=2);
+  string_exprt s1=get_string_expr(args[0]);
+  string_exprt s2=get_string_expr(args[1]);
+  if(args.size()!=2)
+  {
+    PRECONDITION(args.size()==4);
+    return add_axioms_for_concat_substr(s1, s2, args[2], args[3]);
+  }
   return add_axioms_for_concat(s1, s2);
 }
 
-/// add axioms corresponding to the StringBuilder.append(I) java function
-/// \par parameters: function application with two arguments: a string and an
-///   integer
+/// Add axioms corresponding to the StringBuilder.append(I) java function
+/// \param f: function application with two arguments: a string and an
+///           integer
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_int(
   const function_application_exprt &f)
 {
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_from_int(
-    args(f, 2)[1], MAX_INTEGER_LENGTH, ref_type);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  string_exprt s2=add_axioms_from_int(args(f, 2)[1], ref_type);
   return add_axioms_for_concat(s1, s2);
 }
 
 /// Add axioms corresponding to the StringBuilder.append(J) java function
-/// \par parameters: function application with two arguments: a string and a
-/// integer of type long
+/// \param f: function application with two arguments: a string and an
+///           integer of type long
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_long(
   const function_application_exprt &f)
 {
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_from_int(args(f, 2)[1], MAX_LONG_LENGTH, ref_type);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  string_exprt s2=add_axioms_from_int(args(f, 2)[1], ref_type);
   return add_axioms_for_concat(s1, s2);
 }
 
-/// add axioms corresponding to the StringBuilder.append(Z) java function
-/// \par parameters: function application two arguments: a string and a bool
+/// Add axioms corresponding to the StringBuilder.append(Z) java function
+/// \param f: function application two arguments: a string and a bool
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_bool(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(s1.type());
   string_exprt s2=add_axioms_from_bool(args(f, 2)[1], ref_type);
   return add_axioms_for_concat(s1, s2);
 }
 
-/// add axioms corresponding to the StringBuilder.append(C) java function
-/// \par parameters: function application with two arguments: a string and a
-///   char
+/// Add axioms corresponding to the StringBuilder.append(C) java function
+/// \param f: function application with two arguments: a string and a char
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_char(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  const refined_string_typet &ref_type=to_refined_string_type(s1.type());
-  string_exprt s2=add_axioms_from_char(args(f, 2)[1], ref_type);
-  return add_axioms_for_concat(s1, s2);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  return add_axioms_for_concat_char(s1, args(f, 2)[1]);
+}
+
+/// Add axioms corresponding to adding the character char at the end of
+/// string_expr.
+/// \param string_expr: a string expression
+/// \param char' a character expression
+/// \return a new string expression
+string_exprt string_constraint_generatort::add_axioms_for_concat_char(
+  const string_exprt &string_expr, const exprt &char_expr)
+{
+  const refined_string_typet &ref_type=
+    to_refined_string_type(string_expr.type());
+  string_exprt s2=add_axioms_from_char(char_expr, ref_type);
+  return add_axioms_for_concat(string_expr, s2);
 }
 
-/// add axioms corresponding to the StringBuilder.append(D) java function
-/// \par parameters: function application with two arguments: a string and a
-///   double
+/// Add axioms corresponding to the StringBuilder.append(D) java function
+/// \param f: function application with two arguments: a string and a double
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_double(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_from_float(
-    args(f, 2)[1], MAX_DOUBLE_LENGTH);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  PRECONDITION(is_refined_string_type(f.type()));
+  refined_string_typet ref_type=to_refined_string_type(f.type());
+  string_exprt s2=add_axioms_for_string_of_float(args(f, 2)[1], ref_type);
   return add_axioms_for_concat(s1, s2);
 }
 
-/// add axioms corresponding to the StringBuilder.append(F) java function
-/// \par parameters: function application with two arguments: a string and a
-///   float
+/// Add axioms corresponding to the StringBuilder.append(F) java function
+/// \param f: function application with two arguments: a string and a float
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_float(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s2=add_axioms_from_float(args(f, 2)[1], MAX_FLOAT_LENGTH);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
+  PRECONDITION(is_refined_string_type(f.type()));
+  refined_string_typet ref_type=to_refined_string_type(f.type());
+  string_exprt s2=add_axioms_for_string_of_float(args(f, 2)[1], ref_type);
   return add_axioms_for_concat(s1, s2);
 }
 
 /// Add axioms corresponding to the StringBuilder.appendCodePoint(I) function
-/// \par parameters: function application with two arguments: a string and a
-///   code point
+/// \param f: function application with two arguments: a string and a code point
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_concat_code_point(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(s1.type());
   string_exprt s2=add_axioms_for_code_point(args(f, 2)[1], ref_type);
   return add_axioms_for_concat(s1, s2);
diff --git a/src/solvers/refinement/string_constraint_generator_constants.cpp b/src/solvers/refinement/string_constraint_generator_constants.cpp
index fe85c70dc46..d701d27a583 100644
--- a/src/solvers/refinement/string_constraint_generator_constants.cpp
+++ b/src/solvers/refinement/string_constraint_generator_constants.cpp
@@ -15,20 +15,6 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 #include <util/prefix.h>
 #include <util/unicode.h>
 
-/// extract java string from symbol expression when they are encoded inside the
-/// symbol name
-/// \par parameters: a symbol expression representing a java literal
-/// \return a string constant
-irep_idt string_constraint_generatort::extract_java_string(
-  const symbol_exprt &s)
-{
-  std::string tmp=id2string(s.get_identifier());
-  std::string prefix("java::java.lang.String.Literal.");
-  assert(has_prefix(tmp, prefix));
-  std::string value=tmp.substr(prefix.length());
-  return irep_idt(value);
-}
-
 /// add axioms saying the returned string expression should be equal to the
 /// string constant
 /// \par parameters: a string constant
@@ -54,12 +40,12 @@ string_exprt string_constraint_generatort::add_axioms_for_constant(
     exprt idx=from_integer(i, ref_type.get_index_type());
     exprt c=from_integer(str[i], ref_type.get_char_type());
     equal_exprt lemma(res[idx], c);
-    axioms.push_back(lemma);
+    m_axioms.push_back(lemma);
   }
 
   exprt s_length=from_integer(str.size(), ref_type.get_index_type());
 
-  axioms.push_back(res.axiom_for_has_length(s_length));
+  m_axioms.push_back(res.axiom_for_has_length(s_length));
   return res;
 }
 
@@ -69,46 +55,39 @@ string_exprt string_constraint_generatort::add_axioms_for_constant(
 string_exprt string_constraint_generatort::add_axioms_for_empty_string(
   const function_application_exprt &f)
 {
-  assert(f.arguments().empty());
+  PRECONDITION(f.arguments().empty());
+  PRECONDITION(is_refined_string_type(f.type()));
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  string_exprt res=fresh_string(ref_type);
-  axioms.push_back(res.axiom_for_has_length(0));
+  return empty_string(ref_type);
+}
+
+/// Generate a string expression representing the empty string
+/// \param ref_type: a refined string type
+/// \return a string expression
+string_exprt string_constraint_generatort::empty_string(
+  const refined_string_typet &ref_type)
+{
+  exprt size=from_integer(0, ref_type.get_index_type());
+  const array_typet &content_type=ref_type.get_content_type();
+  array_of_exprt empty_array(
+    from_integer(0, ref_type.get_content_type().subtype()), content_type);
+  string_exprt res(size, empty_array, ref_type);
   return res;
 }
 
 /// add axioms to say that the returned string expression is equal to the string
 /// literal
-/// \par parameters: function application with an argument which is a string
-///   literal
+/// \param f: function application with an argument which is a string literal
+/// that is a constant with a string value.
 /// \return string expression
 string_exprt string_constraint_generatort::add_axioms_from_literal(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(args.size()==1); // Bad args to string literal?
+  PRECONDITION(args.size()==1); // Bad args to string literal?
 
   const exprt &arg=args[0];
-  irep_idt sval;
-
-  assert(arg.operands().size()==1);
-  if(arg.op0().operands().size()==2 &&
-     arg.op0().op0().id()==ID_string_constant)
-  {
-    // C string constant
-    const exprt &s=arg.op0().op0();
-    sval=to_string_constant(s).get_value();
-  }
-  else
-  {
-    // Java string constant
-    assert(refined_string_typet::is_unrefined_string_type(arg.type()));
-    const exprt &s=arg.op0();
-
-    // It seems the value of the string is lost,
-    // we need to recover it from the identifier
-    sval=extract_java_string(to_symbol_expr(s));
-  }
-
+  irep_idt sval=to_constant_expr(arg).get_value();
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
   return add_axioms_for_constant(sval, ref_type);
 }
diff --git a/src/solvers/refinement/string_constraint_generator_float.cpp b/src/solvers/refinement/string_constraint_generator_float.cpp
new file mode 100644
index 00000000000..da085756115
--- /dev/null
+++ b/src/solvers/refinement/string_constraint_generator_float.cpp
@@ -0,0 +1,457 @@
+/*******************************************************************\
+
+Module: Generates string constraints for functions generating strings
+        from other types, in particular int, long, float, double, char, bool
+
+Author: Romain Brenguier, romain.brenguier@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Generates string constraints for functions generating strings from other
+/// types, in particular int, long, float, double, char, bool
+
+#include <solvers/floatbv/float_bv.h>
+
+#include "string_constraint_generator.h"
+
+
+/// Gets the unbiased exponent in a floating-point bit-vector
+///
+/// TODO: factorize with float_bv.cpp float_utils.h
+/// \param src: a floating point expression
+/// \param spec: specification for floating points
+/// \return A new 32 bit integer expression representing the exponent.
+///   Note that 32 bits are sufficient for the exponent even
+///   in octuple precision.
+exprt get_exponent(
+  const exprt &src, const ieee_float_spect &spec)
+{
+  exprt exp_bits=extractbits_exprt(
+    src, spec.f+spec.e-1, spec.f, unsignedbv_typet(spec.e));
+
+  // Exponent is in biased form (numbers from -128 to 127 are encoded with
+  // integer from 0 to 255) we have to remove the bias.
+  return minus_exprt(
+    typecast_exprt(exp_bits, signedbv_typet(32)),
+    from_integer(spec.bias(), signedbv_typet(32)));
+}
+
+/// Gets the fraction without hidden bit
+/// \param src: a floating point expression
+/// \param spec: specification for floating points
+/// \return An unsigned value representing the fractional part.
+exprt get_fraction(const exprt &src, const ieee_float_spect &spec)
+{
+  return extractbits_exprt(src, spec.f-1, 0, unsignedbv_typet(spec.f));
+}
+
+/// Gets the significand as a java integer, looking for the hidden bit.
+/// Since the most significant bit is 1 for normalized number, it is not part
+/// of the encoding of the significand and is 0 only if all the bits of the
+/// exponent are 0, that is why it is called the hidden bit.
+/// \param src: a floating point expression
+/// \param spec: specification for floating points
+/// \param type: type of the output, should be unsigned with width greater than
+///   the width of the significand in the given spec
+/// \return An integer expression of the given type representing the
+///   significand.
+exprt get_significand(
+  const exprt &src, const ieee_float_spect &spec, const typet &type)
+{
+  PRECONDITION(type.id()==ID_unsignedbv);
+  PRECONDITION(to_unsignedbv_type(type).get_width()>spec.f);
+  typecast_exprt fraction(get_fraction(src, spec), type);
+  exprt exponent=get_exponent(src, spec);
+  equal_exprt all_zeros(exponent, from_integer(0, exponent.type()));
+  exprt hidden_bit=from_integer((1 << spec.f), type);
+  bitor_exprt with_hidden_bit(fraction, hidden_bit);
+  return if_exprt(all_zeros, fraction, with_hidden_bit);
+}
+
+/// Create an expression to represent a float or double value.
+/// \param f: a floating point value in double precision
+/// \return an expression representing this floating point
+exprt constant_float(const double f, const ieee_float_spect &float_spec)
+{
+  ieee_floatt fl(float_spec);
+  if(float_spec==ieee_float_spect::single_precision())
+    fl.from_float(f);
+  else if(float_spec==ieee_float_spect::double_precision())
+    fl.from_double(f);
+  else
+    UNREACHABLE;
+  return fl.to_expr();
+}
+
+/// Round a float expression to an integer closer to 0
+/// \param f: expression representing a float
+/// \return expression representing a 32 bit integer
+exprt round_expr_to_zero(const exprt &f)
+{
+  exprt rounding=from_integer(ieee_floatt::ROUND_TO_ZERO, unsignedbv_typet(32));
+  return floatbv_typecast_exprt(f, rounding, signedbv_typet(32));
+}
+
+/// Multiplication of expressions representing floating points.
+/// Note that the rounding mode is set to ROUND_TO_EVEN.
+/// \param f: a floating point expression
+/// \param g: a floating point expression
+/// \param rounding: rounding mode
+/// \return An expression representing floating point multiplication.
+exprt floatbv_mult(const exprt &f, const exprt &g)
+{
+  PRECONDITION(f.type()==g.type());
+  ieee_floatt::rounding_modet rounding=ieee_floatt::ROUND_TO_EVEN;
+  exprt mult(ID_floatbv_mult, f.type());
+  mult.copy_to_operands(f);
+  mult.copy_to_operands(g);
+  mult.copy_to_operands(from_integer(rounding, unsignedbv_typet(32)));
+  return mult;
+}
+
+/// Convert integers to floating point to be used in operations with
+/// other values that are in floating point representation.
+/// \param i: an expression representing an integer
+/// \param spec: specification for floating point numbers
+/// \return An expression representing the value of the input
+///   integer as a float.
+exprt floatbv_of_int_expr(const exprt &i, const ieee_float_spect &spec)
+{
+  exprt rounding=from_integer(ieee_floatt::ROUND_TO_ZERO, unsignedbv_typet(32));
+  return floatbv_typecast_exprt(i, rounding, spec.to_type());
+}
+
+/// Estimate the decimal exponent that should be used to represent a given
+/// floating point value in decimal.
+/// We are looking for d such that n * 10^d = m * 2^e, so:
+/// d = log_10(m) + log_10(2) * e - log_10(n)
+/// m -- the fraction -- should be between 1 and 2 so log_10(m)
+/// in [0,log_10(2)].
+/// n -- the fraction in base 10 -- should be between 1 and 10 so
+/// log_10(n) in [0, 1].
+/// So the estimate is given by:
+/// d ~=~  floor(log_10(2) * e)
+/// \param f: a floating point expression
+/// \param spec: specification for floating point
+exprt estimate_decimal_exponent(const exprt &f, const ieee_float_spect &spec)
+{
+  exprt log_10_of_2=constant_float(0.30102999566398119521373889472449302, spec);
+  exprt bin_exp=get_exponent(f, spec);
+  exprt float_bin_exp=floatbv_of_int_expr(bin_exp, spec);
+  exprt dec_exp=floatbv_mult(float_bin_exp, log_10_of_2);
+  binary_relation_exprt negative_exp(dec_exp, ID_lt, constant_float(0.0, spec));
+  // Rounding to zero is not correct for negative numbers, so we substract 1.
+  minus_exprt dec_minus_one(dec_exp, constant_float(1.0, spec));
+  if_exprt adjust_for_neg(negative_exp, dec_minus_one, dec_exp);
+  return round_expr_to_zero(adjust_for_neg);
+}
+
+/// Add axioms corresponding to the String.valueOf(F) java function
+/// \param f: function application with one float argument
+/// \return a new string expression
+string_exprt string_constraint_generatort::add_axioms_for_string_of_float(
+  const function_application_exprt &f)
+{
+  return add_axioms_for_string_of_float(
+    args(f, 1)[0], to_refined_string_type(f.type()));
+}
+
+/// Add axioms corresponding to the String.valueOf(D) java function
+/// \param f: function application with one double argument
+/// \return a new string expression
+string_exprt string_constraint_generatort::add_axioms_from_double(
+  const function_application_exprt &f)
+{
+  return add_axioms_for_string_of_float(
+    args(f, 1)[0], to_refined_string_type(f.type()));
+}
+
+/// Add axioms corresponding to the integer part of m, in decimal form with no
+/// leading zeroes, followed by '.' ('\u002E'), followed by one or more decimal
+/// digits representing the fractional part of m. This specification is correct
+/// for inputs that do not exceed 100000 and the function is unspecified for
+/// other values.
+///
+/// TODO: this specification is not correct for negative numbers and
+/// double precision
+/// \param f: expression representing a float
+/// \param ref_type: refined type for strings
+/// \return a new string expression
+string_exprt string_constraint_generatort::add_axioms_for_string_of_float(
+  const exprt &f, const refined_string_typet &ref_type)
+{
+  const floatbv_typet &type=to_floatbv_type(f.type());
+  ieee_float_spect float_spec(type);
+
+  // We will look at the first 5 digits of the fractional part.
+  // shifted is floor(f * 1e5)
+  exprt shifting=constant_float(1e5, float_spec);
+  exprt shifted=round_expr_to_zero(floatbv_mult(f, shifting));
+  // Numbers with greater or equal value to the following, should use
+  // the exponent notation.
+  exprt max_non_exponent_notation=from_integer(100000, shifted.type());
+  // fractional_part is floor(f * 100000) % 100000
+  mod_exprt fractional_part(shifted, max_non_exponent_notation);
+  string_exprt fractional_part_str=
+    add_axioms_for_fractional_part(fractional_part, 6, ref_type);
+
+  // The axiom added to convert to integer should always be satisfiable even
+  // when the preconditions are not satisfied.
+  mod_exprt integer_part(round_expr_to_zero(f), max_non_exponent_notation);
+  // We should not need more than 8 characters to represent the integer
+  // part of the float.
+  string_exprt integer_part_str=add_axioms_from_int(integer_part, ref_type, 8);
+
+  return add_axioms_for_concat(integer_part_str, fractional_part_str);
+}
+
+/// Add axioms for representing the fractional part of a floating point starting
+/// with a dot
+/// \param int_expr: an integer expression
+/// \param max_size: a maximal size for the string, this includes the
+///   potential minus sign and therefore should be greater than 2
+/// \param ref_type: a type for refined strings
+/// \return a string expression
+string_exprt string_constraint_generatort::add_axioms_for_fractional_part(
+  const exprt &int_expr, size_t max_size, const refined_string_typet &ref_type)
+{
+  PRECONDITION(int_expr.type().id()==ID_signedbv);
+  PRECONDITION(max_size>=2);
+  const typet &type=int_expr.type();
+  string_exprt res=fresh_string(ref_type);
+  exprt ten=from_integer(10, type);
+  const typet &char_type=ref_type.get_char_type();
+  const typet &index_type=ref_type.get_index_type();
+  exprt zero_char=constant_char('0', char_type);
+  exprt nine_char=constant_char('9', char_type);
+  exprt max=from_integer(max_size, index_type);
+
+  // We add axioms:
+  // a1 : 2 <= |res| <= max_size
+  // a2 : starts_with_dot && no_trailing_zero && is_number
+  // starts_with_dot: res[0] = '.'
+  // is_number: forall i:[1, max_size[. '0' < res[i] < '9'
+  // no_trailing_zero: forall j:[2, max_size[. !(|res| = j+1 && res[j] = '0')
+  // a3 : int_expr = sum_j 10^j (j < |res| ? res[j] - '0' : 0)
+
+  and_exprt a1(res.axiom_for_length_gt(1),
+               res.axiom_for_length_le(max));
+  m_axioms.push_back(a1);
+
+  equal_exprt starts_with_dot(res[0], from_integer('.', char_type));
+
+  exprt::operandst digit_constraints;
+  digit_constraints.push_back(starts_with_dot);
+  exprt sum=from_integer(0, type);
+
+  for(size_t j=1; j<max_size; j++)
+  {
+    // after_end is |res| <= j
+    binary_relation_exprt after_end(
+      res.length(), ID_le, from_integer(j, res.length().type()));
+    mult_exprt ten_sum(sum, ten);
+
+    // sum = 10 * sum + after_end ? 0 : (res[j]-'0')
+    if_exprt to_add(
+      after_end,
+      from_integer(0, type),
+      typecast_exprt(minus_exprt(res[j], zero_char), type));
+    sum=plus_exprt(ten_sum, to_add);
+
+    and_exprt is_number(
+      binary_relation_exprt(res[j], ID_ge, zero_char),
+      binary_relation_exprt(res[j], ID_le, nine_char));
+    digit_constraints.push_back(is_number);
+
+    // There are no trailing zeros except for ".0" (i.e j=2)
+    if(j>1)
+    {
+      not_exprt no_trailing_zero(and_exprt(
+        equal_exprt(res.length(), from_integer(j+1, res.length().type())),
+      equal_exprt(res[j], zero_char)));
+      digit_constraints.push_back(no_trailing_zero);
+    }
+  }
+
+  exprt a2=conjunction(digit_constraints);
+  m_axioms.push_back(a2);
+
+  equal_exprt a3(int_expr, sum);
+  m_axioms.push_back(a3);
+
+  return res;
+}
+
+/// Add axioms to write the float in scientific notation.
+///
+/// A float is represented as $f = m * 2^e$ where $0 <= m < 2$ is the
+/// significand and $-126 <= e <= 127$ is the exponent.
+/// We want an alternate representation by finding $n$ and
+/// $d$ such that $f=n*10^d$. We can estimate $d$ the following way:
+/// $d ~= log_10(f/n) ~= log_10(m) + log_10(2) * e - log_10(n)$
+/// $d = floor(log_10(2) * e)$
+/// Then $n$ can be expressed by the equation:
+/// $log_10(n) = log_10(m) + log_10(2) * e - d$
+/// $n = f / 10^d = m * 2^e / 10^d = m * 2^e / 10^(floor(log_10(2) * e))$
+/// TODO: For now we only consider single precision.
+/// \param f: a float expression, which is positive
+/// \param max_size: a maximal size for the string
+/// \param ref_type: a type for refined strings
+/// \return a string expression representing the float in scientific notation
+string_exprt string_constraint_generatort::
+  add_axioms_from_float_scientific_notation(
+    const exprt &f, const refined_string_typet &ref_type)
+{
+  ieee_float_spect float_spec=ieee_float_spect::single_precision();
+  typet float_type=float_spec.to_type();
+  signedbv_typet int_type(32);
+
+  // This is used for rounding float to integers.
+  exprt round_to_zero_expr=from_integer(ieee_floatt::ROUND_TO_ZERO, int_type);
+
+  // `bin_exponent` is $e$ in the formulas
+  exprt bin_exponent=get_exponent(f, float_spec);
+
+  // $m$ from the formula is a value between 0.0 and 2.0 represented
+  // with values in the range 0x000000 0xFFFFFF so 1 corresponds to 0x800000.
+  // `bin_significand_int` represents $m * 0x800000$
+  exprt bin_significand_int=
+    get_significand(f, float_spec, unsignedbv_typet(32));
+  // `bin_significand` represents $m$ and is obtained
+  // by multiplying `binary_significand_as_int` by
+  // 1/0x800000 = 2^-23 = 1.1920928955078125 * 10^-7
+  exprt bin_significand=floatbv_mult(
+    floatbv_typecast_exprt(bin_significand_int, round_to_zero_expr, float_type),
+    constant_float(1.1920928955078125e-7, float_spec));
+
+  // This is a first approximation of the exponent that will adjust
+  // if the fraction we get is greater than 10
+  exprt dec_exponent_estimate=estimate_decimal_exponent(f, float_spec);
+
+  // Table for values of $2^x / 10^(floor(log_10(2)*x))$ where x=Range[0,128]
+  std::vector<double> two_power_e_over_ten_power_d_table(
+    { 1, 2, 4, 8, 1.6, 3.2, 6.4, 1.28, 2.56,
+      5.12, 1.024, 2.048, 4.096, 8.192, 1.6384, 3.2768, 6.5536,
+      1.31072, 2.62144, 5.24288, 1.04858, 2.09715, 4.19430, 8.38861, 1.67772,
+      3.35544, 6.71089, 1.34218, 2.68435, 5.36871, 1.07374, 2.14748, 4.29497,
+      8.58993, 1.71799, 3.43597, 6.87195, 1.37439, 2.74878, 5.49756, 1.09951,
+      2.19902, 4.39805, 8.79609, 1.75922, 3.51844, 7.03687, 1.40737, 2.81475,
+      5.62950, 1.12590, 2.25180, 4.50360, 9.00720, 1.80144, 3.60288, 7.20576,
+      1.44115, 2.88230, 5.76461, 1.15292, 2.30584, 4.61169, 9.22337, 1.84467,
+      3.68935, 7.37870, 1.47574, 2.95148, 5.90296, 1.18059, 2.36118, 4.72237,
+      9.44473, 1.88895, 3.77789, 7.55579, 1.51116, 3.02231, 6.04463, 1.20893,
+      2.41785, 4.83570, 9.67141, 1.93428, 3.86856, 7.73713, 1.54743, 3.09485,
+      6.18970, 1.23794, 2.47588, 4.95176, 9.90352, 1.98070, 3.96141, 7.92282,
+      1.58456, 3.16913, 6.33825, 1.26765, 2.53530, 5.07060, 1.01412, 2.02824,
+      4.05648, 8.11296, 1.62259, 3.24519, 6.49037, 1.29807, 2.59615, 5.1923,
+      1.03846, 2.07692, 4.15384, 8.30767, 1.66153, 3.32307, 6.64614, 1.32923,
+      2.65846, 5.31691, 1.06338, 2.12676, 4.25353, 8.50706, 1.70141});
+
+  // Table for values of $2^x / 10^(floor(log_10(2)*x))$ where x=Range[-128,-1]
+  std::vector<double> two_power_e_over_ten_power_d_table_negatives(
+    { 2.93874, 5.87747, 1.17549, 2.35099, 4.70198, 9.40395, 1.88079, 3.76158,
+      7.52316, 1.50463, 3.00927, 6.01853, 1.20371, 2.40741, 4.81482, 9.62965,
+      1.92593, 3.85186, 7.70372, 1.54074, 3.08149, 6.16298, 1.23260, 2.46519,
+      4.93038, 9.86076, 1.97215, 3.94430, 7.88861, 1.57772, 3.15544, 6.31089,
+      1.26218, 2.52435, 5.04871, 1.00974, 2.01948, 4.03897, 8.07794, 1.61559,
+      3.23117, 6.46235, 1.29247, 2.58494, 5.16988, 1.03398, 2.06795, 4.13590,
+      8.27181, 1.65436, 3.30872, 6.61744, 1.32349, 2.64698, 5.29396, 1.05879,
+      2.11758, 4.23516, 8.47033, 1.69407, 3.38813, 6.77626, 1.35525, 2.71051,
+      5.42101, 1.08420, 2.16840, 4.33681, 8.67362, 1.73472, 3.46945, 6.93889,
+      1.38778, 2.77556, 5.55112, 1.11022, 2.22045, 4.44089, 8.88178, 1.77636,
+      3.55271, 7.10543, 1.42109, 2.84217, 5.68434, 1.13687, 2.27374, 4.54747,
+      9.09495, 1.81899, 3.63798, 7.27596, 1.45519, 2.91038, 5.82077, 1.16415,
+      2.32831, 4.65661, 9.31323, 1.86265, 3.72529, 7.45058, 1.49012, 2.98023,
+      5.96046, 1.19209, 2.38419, 4.76837, 9.53674, 1.90735, 3.81470, 7.62939,
+      1.52588, 3.05176, 6.10352, 1.22070, 2.44141, 4.88281, 9.76563, 1.95313,
+      3.90625, 7.81250, 1.56250, 3.12500, 6.25000, 1.25000, 2.50000, 5});
+
+  // bias_table used to find the bias factor
+  exprt conversion_factor_table_size=from_integer(
+    two_power_e_over_ten_power_d_table_negatives.size()+
+      two_power_e_over_ten_power_d_table.size(),
+    int_type);
+  array_exprt conversion_factor_table(
+    array_typet(float_type, conversion_factor_table_size));
+  for(const auto &f : two_power_e_over_ten_power_d_table_negatives)
+    conversion_factor_table.copy_to_operands(constant_float(f, float_spec));
+  for(const auto &f : two_power_e_over_ten_power_d_table)
+    conversion_factor_table.copy_to_operands(constant_float(f, float_spec));
+
+  // The index in the table, corresponding to exponent e is e+128
+  plus_exprt shifted_index(bin_exponent, from_integer(128, int_type));
+
+  // bias_factor is $2^e / 10^(floor(log_10(2)*e))$ that is $2^e/10^d$
+  index_exprt conversion_factor(
+    conversion_factor_table, shifted_index, float_type);
+
+  // `dec_significand` is $n = m * bias_factor$
+  exprt dec_significand=floatbv_mult(conversion_factor, bin_significand);
+  exprt dec_significand_int=round_expr_to_zero(dec_significand);
+
+  // `dec_exponent` is $d$ in the formulas
+  // it is obtained from the approximation, checking whether it is not too small
+  binary_relation_exprt estimate_too_small(
+    dec_significand_int, ID_ge, from_integer(10, int_type));
+  if_exprt decimal_exponent(
+    estimate_too_small,
+    plus_exprt(dec_exponent_estimate, from_integer(1, int_type)),
+    dec_exponent_estimate);
+
+  // `dec_significand` is divided by 10 if it exceeds 10
+  dec_significand=if_exprt(
+    estimate_too_small,
+    floatbv_mult(dec_significand, constant_float(0.1, float_spec)),
+    dec_significand);
+  dec_significand_int=round_expr_to_zero(dec_significand);
+
+  string_exprt string_expr_integer_part=
+    add_axioms_from_int(dec_significand_int, ref_type, 3);
+  minus_exprt fractional_part(
+    dec_significand, floatbv_of_int_expr(dec_significand_int, float_spec));
+
+  // shifted_float is floor(f * 1e5)
+  exprt shifting=constant_float(1e5, float_spec);
+  exprt shifted_float=
+    round_expr_to_zero(floatbv_mult(fractional_part, shifting));
+
+  // Numbers with greater or equal value to the following, should use
+  // the exponent notation.
+  exprt max_non_exponent_notation=from_integer(100000, shifted_float.type());
+
+  // fractional_part_shifted is floor(f * 100000) % 100000
+  mod_exprt fractional_part_shifted(shifted_float, max_non_exponent_notation);
+
+  string_exprt string_fractional_part=add_axioms_for_fractional_part(
+    fractional_part_shifted, 6, ref_type);
+
+  // string_expr_with_fractional_part =
+  //   concat(string_with_do, string_fractional_part)
+  string_exprt string_expr_with_fractional_part=add_axioms_for_concat(
+    string_expr_integer_part, string_fractional_part);
+
+  // string_expr_with_E = concat(string_fraction, string_lit_E)
+  string_exprt string_expr_with_E=add_axioms_for_concat_char(
+    string_expr_with_fractional_part,
+    from_integer('E', ref_type.get_char_type()));
+
+  // exponent_string = string_of_int(decimal_exponent)
+  string_exprt exponent_string=
+    add_axioms_from_int(decimal_exponent, ref_type, 3);
+
+  // string_expr = concat(string_expr_with_E, exponent_string)
+  return add_axioms_for_concat(string_expr_with_E, exponent_string);
+}
+
+/// Add axioms corresponding to the scientific representation of floating point
+/// values
+/// \param f: a function application expression
+/// \return a new string expression
+string_exprt string_constraint_generatort::
+  add_axioms_from_float_scientific_notation(
+    const function_application_exprt &f)
+{
+  const refined_string_typet &ref_type=to_refined_string_type(f.type());
+  return add_axioms_from_float_scientific_notation(args(f, 1)[0], ref_type);
+}
diff --git a/src/solvers/refinement/string_constraint_generator_format.cpp b/src/solvers/refinement/string_constraint_generator_format.cpp
new file mode 100644
index 00000000000..ae672e6a01c
--- /dev/null
+++ b/src/solvers/refinement/string_constraint_generator_format.cpp
@@ -0,0 +1,442 @@
+/*******************************************************************\
+
+Module: Generates string constraints for the Java format function
+
+Author: Romain Brenguier
+
+Date:   May 2017
+
+\*******************************************************************/
+
+/// \file
+/// Generates string constraints for the Java format function
+
+#include <iomanip>
+#include <string>
+#include <regex>
+#include <vector>
+
+#include <util/std_expr.h>
+#include <util/unicode.h>
+
+#include "string_constraint_generator.h"
+
+// Format specifier describes how a value should be printed.
+class string_constraint_generatort::format_specifiert
+{
+public:
+  // Constants describing the meaning of characters in format specifiers.
+  static const char DECIMAL_INTEGER          ='d';
+  static const char OCTAL_INTEGER            ='o';
+  static const char HEXADECIMAL_INTEGER      ='x';
+  static const char HEXADECIMAL_INTEGER_UPPER='X';
+  static const char SCIENTIFIC               ='e';
+  static const char SCIENTIFIC_UPPER         ='E';
+  static const char GENERAL                  ='g';
+  static const char GENERAL_UPPER            ='G';
+  static const char DECIMAL_FLOAT            ='f';
+  static const char HEXADECIMAL_FLOAT        ='a';
+  static const char HEXADECIMAL_FLOAT_UPPER  ='A';
+  static const char CHARACTER                ='c';
+  static const char CHARACTER_UPPER          ='C';
+  static const char DATE_TIME                ='t';
+  static const char DATE_TIME_UPPER          ='T';
+  static const char BOOLEAN                  ='b';
+  static const char BOOLEAN_UPPER            ='B';
+  static const char STRING                   ='s';
+  static const char STRING_UPPER             ='S';
+  static const char HASHCODE                 ='h';
+  static const char HASHCODE_UPPER           ='H';
+  static const char LINE_SEPARATOR           ='n';
+  static const char PERCENT_SIGN             ='%';
+
+  int index=-1;
+  std::string flag;
+  int width;
+  int precision;
+  bool dt=false;
+  char conversion;
+
+  format_specifiert(
+    int _index,
+    std::string _flag,
+    int _width,
+    int _precision,
+    bool _dt,
+    char c):
+      index(_index),
+      flag(_flag),
+      width(_width),
+      precision(_precision),
+      dt(_dt),
+      conversion(c)
+  { }
+};
+
+// Format text represent a constant part of a format string.
+class format_textt
+{
+public:
+  explicit format_textt(std::string _content): content(_content) { }
+
+  format_textt(const format_textt &fs): content(fs.content) { }
+
+  std::string get_content() const
+  {
+    return content;
+  }
+
+private:
+  std::string content;
+};
+
+// A format element is either a specifier or text.
+class format_elementt
+{
+public:
+  typedef enum {SPECIFIER, TEXT} format_typet;
+
+  explicit format_elementt(format_typet _type): type(_type), fstring("")
+  {
+  }
+
+  explicit format_elementt(std::string s): type(TEXT), fstring(s)
+  {
+  }
+
+  explicit format_elementt(string_constraint_generatort::format_specifiert fs):
+    type(SPECIFIER),
+    fstring("")
+  {
+    fspec.push_back(fs);
+  }
+
+  bool is_format_specifier() const
+  {
+    return type==SPECIFIER;
+  }
+
+  bool is_format_text() const
+  {
+    return type==TEXT;
+  }
+
+  string_constraint_generatort::format_specifiert get_format_specifier() const
+  {
+    PRECONDITION(is_format_specifier());
+    return fspec.back();
+  }
+
+  format_textt &get_format_text()
+  {
+    PRECONDITION(is_format_text());
+    return fstring;
+  }
+
+  const format_textt &get_format_text() const
+  {
+    PRECONDITION(is_format_text());
+    return fstring;
+  }
+
+private:
+  format_typet type;
+  format_textt fstring;
+  std::vector<string_constraint_generatort::format_specifiert> fspec;
+};
+
+#if 0
+// This code is deactivated as it is not used for now, but ultimalety this
+// should be used to throw an exception when the format string is not correct
+/// Used to check first argument of `String.format` is correct.
+/// \param s: a string
+/// \return True if the argument is a correct format string. Any '%' found
+///   between format specifier means the string is invalid.
+static bool check_format_string(std::string s)
+{
+  std::string format_specifier=
+      "%(\\d+\\$)?([-#+ 0,(\\<]*)?(\\d+)?(\\.\\d+)?([tT])?([a-zA-Z%])";
+  std::regex regex(format_specifier);
+  std::smatch match;
+
+  while(std::regex_search(s, match, regex))
+  {
+    if(match.position()!= 0)
+      for(const auto &c : match.str())
+        if(c=='%')
+          return false;
+    s=match.suffix();
+  }
+
+  for(const auto &c : s)
+    if(c=='%')
+      return false;
+
+  return true;
+}
+#endif
+
+/// Helper function for parsing format strings.
+/// This follows the implementation in openJDK of the java.util.Formatter class:
+/// http://hg.openjdk.java.net/jdk7/jdk7/jdk/file/9b8c96f96a0f/src/share/classes/java/util/Formatter.java#l2660
+/// \param m: a match in a regular expression
+/// \return Format specifier represented by the matched string. The groups in
+///   the match should represent: index, flag, width, precision, date and
+///   conversion type.
+static string_constraint_generatort::format_specifiert
+  format_specifier_of_match(std::smatch &m)
+{
+  int index=m[1].str().empty()?-1:std::stoi(m[1].str());
+  std::string flag=m[2].str().empty()?"":m[2].str();
+  int width=m[3].str().empty()?-1:std::stoi(m[3].str());
+  int precision=m[4].str().empty()?-1:std::stoi(m[4].str());
+  std::string tT=m[5].str();
+
+  bool dt=(tT!="");
+  if(tT=="T")
+    flag.push_back(
+      string_constraint_generatort::format_specifiert::DATE_TIME_UPPER);
+
+  INVARIANT(
+    m[6].str().length()==1, "format conversion should be one character");
+  char conversion=m[6].str()[0];
+
+  return string_constraint_generatort::format_specifiert(
+    index, flag, width, precision, dt, conversion);
+}
+
+/// Parse the given string into format specifiers and text.
+/// This follows the implementation in openJDK of the java.util.Formatter class:
+/// http://hg.openjdk.java.net/jdk7/jdk7/jdk/file/9b8c96f96a0f/src/share/classes/java/util/Formatter.java#l2513
+/// \param s: a string
+/// \return A vector of format_elementt.
+static std::vector<format_elementt> parse_format_string(std::string s)
+{
+  std::string format_specifier=
+    "%(\\d+\\$)?([-#+ 0,(\\<]*)?(\\d+)?(\\.\\d+)?([tT])?([a-zA-Z%])";
+  std::regex regex(format_specifier);
+  std::vector<format_elementt> al;
+  std::smatch match;
+
+  while(std::regex_search(s, match, regex))
+  {
+    if(match.position()!=0)
+    {
+      std::string pre_match=s.substr(0, match.position());
+      al.emplace_back(pre_match);
+    }
+
+    al.emplace_back(format_specifier_of_match(match));
+    s=match.suffix();
+  }
+
+  al.emplace_back(s);
+  return al;
+}
+
+/// Helper for add_axioms_for_format_specifier
+/// \param expr: a structured expression
+/// \param component_name: name of the desired component
+/// \return Expression in the component of `expr` named `component_name`.
+static exprt get_component_in_struct(
+  const struct_exprt &expr, irep_idt component_name)
+{
+  const struct_typet &type=to_struct_type(expr.type());
+  std::size_t number=type.component_number(component_name);
+  return expr.operands()[number];
+}
+
+/// Parse `s` and add axioms ensuring the output corresponds to the output of
+/// String.format. Assumes the argument is a structured expression which
+/// contains the fields: string expr, int, float, char, boolean, hashcode,
+/// date_time. The correct component will be fetched depending on the format
+/// specifier.
+/// \param fs: a format specifier
+/// \param arg: a struct containing the possible value of the argument to format
+/// \param ref_type: a type  for refined string type
+/// \return String expression representing the output of String.format.
+string_exprt string_constraint_generatort::add_axioms_for_format_specifier(
+  const format_specifiert &fs,
+  const struct_exprt &arg,
+  const refined_string_typet &ref_type)
+{
+  switch(fs.conversion)
+  {
+  case format_specifiert::DECIMAL_INTEGER:
+    return add_axioms_from_int(get_component_in_struct(arg, ID_int), ref_type);
+  case format_specifiert::HEXADECIMAL_INTEGER:
+    return add_axioms_from_int_hex(
+      get_component_in_struct(arg, ID_int), ref_type);
+  case format_specifiert::SCIENTIFIC:
+    return add_axioms_from_float_scientific_notation(
+      get_component_in_struct(arg, ID_float), ref_type);
+  case format_specifiert::DECIMAL_FLOAT:
+    return add_axioms_for_string_of_float(
+      get_component_in_struct(arg, ID_float), ref_type);
+  case format_specifiert::CHARACTER:
+    return add_axioms_from_char(
+      get_component_in_struct(arg, ID_char), ref_type);
+  case format_specifiert::BOOLEAN:
+    return add_axioms_from_bool(
+      get_component_in_struct(arg, ID_boolean), ref_type);
+  case format_specifiert::STRING:
+    return get_string_expr(get_component_in_struct(arg, "string_expr"));
+  case format_specifiert::HASHCODE:
+    return add_axioms_from_int(
+      get_component_in_struct(arg, "hashcode"), ref_type);
+  case format_specifiert::LINE_SEPARATOR:
+    // TODO: the constant should depend on the system: System.lineSeparator()
+    return add_axioms_for_constant("\n", ref_type);
+  case format_specifiert::PERCENT_SIGN:
+    return add_axioms_for_constant("%", ref_type);
+  case format_specifiert::SCIENTIFIC_UPPER:
+  case format_specifiert::GENERAL_UPPER:
+  case format_specifiert::HEXADECIMAL_FLOAT_UPPER:
+  case format_specifiert::CHARACTER_UPPER:
+  case format_specifiert::DATE_TIME_UPPER:
+  case format_specifiert::BOOLEAN_UPPER:
+  case format_specifiert::STRING_UPPER:
+  case format_specifiert::HASHCODE_UPPER:
+  {
+    string_constraint_generatort::format_specifiert fs_lower=fs;
+    fs_lower.conversion=tolower(fs.conversion);
+    string_exprt lower_case=add_axioms_for_format_specifier(
+      fs_lower, arg, ref_type);
+    return add_axioms_for_to_upper_case(lower_case);
+  }
+  case format_specifiert::OCTAL_INTEGER:
+    // TODO: conversion of octal not implemented
+  case format_specifiert::GENERAL:
+    // TODO: general not implemented
+  case format_specifiert::HEXADECIMAL_FLOAT:
+    // TODO: hexadecimal float not implemented
+  case format_specifiert::DATE_TIME:
+    // TODO: DateTime not implemented
+    // For all these unimplemented cases we return a non-deterministic string
+    m_message.warning() << "unimplemented format specifier: " << fs.conversion
+                        << m_message.eom;
+    return fresh_string(ref_type);
+  default:
+    m_message.error() << "invalid format specifier: " << fs.conversion
+                      << m_message.eom;
+    INVARIANT(
+      false, "format specifier must belong to [bBhHsScCdoxXeEfgGaAtT%n]");
+    throw 0;
+  }
+}
+
+/// Parse `s` and add axioms ensuring the output corresponds to the output of
+/// String.format.
+/// \param s: a format string
+/// \param args: a vector of arguments
+/// \param ref_type: a type  for refined string type
+/// \return String expression representing the output of String.format.
+string_exprt string_constraint_generatort::add_axioms_for_format(
+  const std::string &s,
+  const exprt::operandst &args,
+  const refined_string_typet &ref_type)
+{
+  const std::vector<format_elementt> format_strings=parse_format_string(s);
+  std::vector<string_exprt> intermediary_strings;
+  std::size_t arg_count=0;
+
+  for(const format_elementt &fe : format_strings)
+    if(fe.is_format_specifier())
+    {
+      const format_specifiert &fs=fe.get_format_specifier();
+      struct_exprt arg;
+      if(fs.conversion!=format_specifiert::PERCENT_SIGN &&
+         fs.conversion!=format_specifiert::LINE_SEPARATOR)
+      {
+        if(fs.index==-1)
+        {
+          INVARIANT(
+            arg_count<args.size(), "number of format must match specifiers");
+          arg=to_struct_expr(args[arg_count++]);
+        }
+        else
+        {
+          INVARIANT(fs.index>=0, "index in format should be positive");
+          INVARIANT(
+            static_cast<std::size_t>(fs.index)<=args.size(),
+            "number of format must match specifiers");
+
+          // first argument `args[0]` corresponds to index 1
+          arg=to_struct_expr(args[fs.index-1]);
+        }
+      }
+      intermediary_strings.push_back(
+        add_axioms_for_format_specifier(fs, arg, ref_type));
+    }
+    else
+      intermediary_strings.push_back(
+        add_axioms_for_constant(
+          fe.get_format_text().get_content(), ref_type));
+
+  if(intermediary_strings.empty())
+    return empty_string(ref_type);
+
+  auto it=intermediary_strings.begin();
+  string_exprt str=*(it++);
+  for(; it!=intermediary_strings.end(); ++it)
+    str=add_axioms_for_concat(str, *it);
+  return str;
+}
+
+/// Construct a string from a constant array.
+/// \param arr: an array expression containing only constants
+/// \param length: an unsigned value representing the length of the array
+/// \return String of length `length` represented by the array assuming each
+///   field in `arr` represents a character.
+std::string utf16_constant_array_to_java(
+  const array_exprt &arr, unsigned int length)
+{
+  std::wstring out(length, '?');
+  unsigned int c;
+  for(std::size_t i=0; i<arr.operands().size() && i<length; i++)
+  {
+    PRECONDITION(arr.operands()[i].id()==ID_constant);
+    bool conversion_failed=to_unsigned_integer(
+      to_constant_expr(arr.operands()[i]), c);
+    INVARIANT(!conversion_failed, "constant should be convertible to unsigned");
+    out[i]=c;
+  }
+  return utf16_little_endian_to_java(out);
+}
+
+/// Add axioms to specify the Java String.format function.
+///
+/// TODO: This is correct only if the first argument (ie the format string) is
+/// constant or does not contain format specifiers.
+/// \param f: a function application
+/// \return A string expression representing the return value of the
+///   String.format function on the given arguments, assuming the first argument
+///   in the function application is a constant. Otherwise the first argument is
+///   returned.
+string_exprt string_constraint_generatort::add_axioms_for_format(
+  const function_application_exprt &f)
+{
+  PRECONDITION(!f.arguments().empty());
+  string_exprt s1=get_string_expr(f.arguments()[0]);
+  const refined_string_typet &ref_type=to_refined_string_type(f.type());
+  unsigned int length;
+
+  if(s1.length().id()==ID_constant &&
+     s1.content().id()==ID_array &&
+     !to_unsigned_integer(to_constant_expr(s1.length()), length))
+  {
+    std::string s=utf16_constant_array_to_java(
+      to_array_expr(s1.content()), length);
+    // List of arguments after s
+    std::vector<exprt> args(
+      std::next(f.arguments().begin()), f.arguments().end());
+    return add_axioms_for_format(s, args, ref_type);
+  }
+  else
+  {
+    m_message.warning()
+      << "ignoring format function with non constant first argument"
+      << m_message.eom;
+    return fresh_string(ref_type);
+  }
+}
diff --git a/src/solvers/refinement/string_constraint_generator_indexof.cpp b/src/solvers/refinement/string_constraint_generator_indexof.cpp
index d32be2e3570..977b9832dbf 100644
--- a/src/solvers/refinement/string_constraint_generator_indexof.cpp
+++ b/src/solvers/refinement/string_constraint_generator_indexof.cpp
@@ -11,12 +11,15 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 /// Generates string constraints for the family of indexOf and lastIndexOf java
 ///   functions
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/refinement/string_constraint_generator.h>
 
-/// add axioms that the returned value is either -1 or greater than from_index
-/// and the character at that position equals to c
-/// \par parameters: a string expression, a character expression and an integer
-///   expression
+/// Add axioms stating that the returned value is the index within str of the
+/// first occurrence of c starting the search at from_index, or -1 if no such
+/// character occurs at or after position from_index.
+/// \param str: a string expression
+/// \param c: an expression representing a character
+/// \param from_index: an expression representing an index in the string
 /// \return a integer expression
 exprt string_constraint_generatort::add_axioms_for_index_of(
   const string_exprt &str, const exprt &c, const exprt &from_index)
@@ -26,32 +29,32 @@ exprt string_constraint_generatort::add_axioms_for_index_of(
   symbol_exprt contains=fresh_boolean("contains_in_index_of");
 
   // We add axioms:
-  // a1 : -1 <= index<|str|
+  // a1 : -1 <= index < |str|
   // a2 : !contains <=> index=-1
-  // a3 : contains => from_index<=index&&str[index]=c
-  // a4 : forall n, from_index<=n<index. contains => str[n]!=c
-  // a5 : forall m, from_index<=n<|str|. !contains => str[m]!=c
+  // a3 : contains ==> from_index <= index && str[index] = c
+  // a4 : forall n, n:[from_index,index[. contains ==> str[n] != c
+  // a5 : forall m, n:[from_index,|str|[. !contains ==> str[m] != c
 
   exprt minus1=from_integer(-1, index_type);
   and_exprt a1(
     binary_relation_exprt(index, ID_ge, minus1),
     binary_relation_exprt(index, ID_lt, str.length()));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   equal_exprt a2(not_exprt(contains), equal_exprt(index, minus1));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   implies_exprt a3(
     contains,
     and_exprt(
       binary_relation_exprt(from_index, ID_le, index),
       equal_exprt(str[index], c)));
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
 
   symbol_exprt n=fresh_univ_index("QA_index_of", index_type);
   string_constraintt a4(
     n, from_index, index, contains, not_exprt(equal_exprt(str[n], c)));
-  axioms.push_back(a4);
+  m_axioms.push_back(a4);
 
   symbol_exprt m=fresh_univ_index("QA_index_of", index_type);
   string_constraintt a5(
@@ -60,84 +63,162 @@ exprt string_constraint_generatort::add_axioms_for_index_of(
     str.length(),
     not_exprt(contains),
     not_exprt(equal_exprt(str[m], c)));
-  axioms.push_back(a5);
+  m_axioms.push_back(a5);
 
   return index;
 }
 
-/// add axioms stating that the returned value is either -1 or greater than
-/// from_index and the string beggining there has prefix substring
-/// \par parameters: two string expressions and an integer expression
-/// \return a integer expression
+/// Add axioms stating that the returned value is the index within haystack of
+/// the first occurrence of needle starting the search at from_index, or -1 if
+/// needle does not occur at or after position from_index.
+/// \param haystack: a string expression
+/// \param needle: a string expression
+/// \param from_index: an expression representing an index in strings
+/// \return an integer expression representing the first index of needle in
+///   haystack after from_index, or -1 if there is none
 exprt string_constraint_generatort::add_axioms_for_index_of_string(
-  const string_exprt &str,
-  const string_exprt &substring,
+  const string_exprt &haystack,
+  const string_exprt &needle,
   const exprt &from_index)
 {
-  const typet &index_type=str.length().type();
+  const typet &index_type=haystack.length().type();
   symbol_exprt offset=fresh_exist_index("index_of", index_type);
   symbol_exprt contains=fresh_boolean("contains_substring");
 
   // We add axioms:
-  // a1 : contains => |substring|>=offset>=from_index
-  // a2 : !contains => offset=-1
-  // a3 : forall 0 <= witness<substring.length.
-  //   contains => str[witness+offset]=substring[witness]
+  // a1 : contains ==> from_index <= offset <= |haystack|-|needle|
+  // a2 : !contains <=> offset=-1
+  // a3 : forall n:[0,|needle|[.
+  //        contains ==> haystack[n+offset]=needle[n]
+  // a4 : forall n:[from_index,offset[.
+  //        contains ==> (exists m:[0,|needle|[. haystack[m+n] != needle[m]])
+  // a5:  forall n:[from_index,|haystack|-|needle|].
+  //        !contains ==> (exists m:[0,|needle|[. haystack[m+n] != needle[m])
 
   implies_exprt a1(
     contains,
     and_exprt(
-      str.axiom_for_is_longer_than(plus_exprt(substring.length(), offset)),
-      binary_relation_exprt(offset, ID_ge, from_index)));
-  axioms.push_back(a1);
+      binary_relation_exprt(from_index, ID_le, offset),
+      binary_relation_exprt(
+        offset, ID_le, minus_exprt(haystack.length(), needle.length()))));
+  m_axioms.push_back(a1);
 
-  implies_exprt a2(
+  equal_exprt a2(
     not_exprt(contains),
     equal_exprt(offset, from_integer(-1, index_type)));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   symbol_exprt qvar=fresh_univ_index("QA_index_of_string", index_type);
   string_constraintt a3(
     qvar,
-    substring.length(),
+    needle.length(),
+    contains,
+    equal_exprt(haystack[plus_exprt(qvar, offset)], needle[qvar]));
+  m_axioms.push_back(a3);
+
+  // string_not contains_constraintt are formulas of the form:
+  // forall x in [lb,ub[. p(x) => exists y in [lb,ub[. s1[x+y] != s2[y]
+  string_not_contains_constraintt a4(
+    from_index,
+    offset,
     contains,
-    equal_exprt(str[plus_exprt(qvar, offset)], substring[qvar]));
-  axioms.push_back(a3);
+    from_integer(0, index_type),
+    needle.length(),
+    haystack,
+    needle);
+  m_axioms.push_back(a4);
+
+  string_not_contains_constraintt a5(
+    from_index,
+    plus_exprt( // Add 1 for inclusive upper bound.
+      minus_exprt(haystack.length(), needle.length()),
+      from_integer(1, index_type)),
+    not_exprt(contains),
+    from_integer(0, index_type),
+    needle.length(),
+    haystack,
+    needle);
+  m_axioms.push_back(a5);
 
   return offset;
 }
 
+/// Add axioms stating that the returned value is the index within haystack of
+/// the last occurrence of needle starting the search backward at from_index (ie
+/// the index is smaller or equal to from_index), or -1 if needle does not occur
+/// before from_index.
+/// \param haystack: a string expression
+/// \param needle: a string expression
+/// \param from_index: an expression representing an index in strings
+/// \return an integer expression representing the last index of needle in
+///   haystack before or at from_index, or -1 if there is none
 exprt string_constraint_generatort::add_axioms_for_last_index_of_string(
-  const string_exprt &str,
-  const string_exprt &substring,
+  const string_exprt &haystack,
+  const string_exprt &needle,
   const exprt &from_index)
 {
-  const typet &index_type=str.length().type();
+  const typet &index_type=haystack.length().type();
   symbol_exprt offset=fresh_exist_index("index_of", index_type);
   symbol_exprt contains=fresh_boolean("contains_substring");
 
   // We add axioms:
-  // a1 : contains => |substring| >= length &&offset <= from_index
-  // a2 : !contains => offset=-1
-  // a3 : forall 0 <= witness<substring.length,
-  //        contains => str[witness+offset]=substring[witness]
+  // a1 : contains ==> -1 <= offset && offset <= from_index
+  //                   && offset <= |haystack| - |needle|
+  // a2 : !contains <=> offset = -1
+  // a3 : forall n:[0, |needle|[,
+  //        contains ==> haystack[n+offset] = needle[n]
+  // a4 : forall n:[offset+1, min(from_index, |haystack| - |needle|)].
+  //        contains ==>
+  //          (exists m:[0,|needle|[. haystack[m+n] != needle[m]])
+  // a5:  forall n:[0, min(from_index, |haystack| - |needle|)].
+  //        !contains ==>
+  //          (exists m:[0,|needle|[. haystack[m+n] != needle[m])
 
   implies_exprt a1(
     contains,
     and_exprt(
-      str.axiom_for_is_longer_than(plus_exprt(substring.length(), offset)),
+      binary_relation_exprt(from_integer(-1, index_type), ID_le, offset),
+      binary_relation_exprt(
+        offset, ID_le, minus_exprt(haystack.length(), needle.length())),
       binary_relation_exprt(offset, ID_le, from_index)));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
-  implies_exprt a2(
+  equal_exprt a2(
     not_exprt(contains),
     equal_exprt(offset, from_integer(-1, index_type)));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   symbol_exprt qvar=fresh_univ_index("QA_index_of_string", index_type);
-  equal_exprt constr3(str[plus_exprt(qvar, offset)], substring[qvar]);
-  string_constraintt a3(qvar, substring.length(), contains, constr3);
-  axioms.push_back(a3);
+  equal_exprt constr3(haystack[plus_exprt(qvar, offset)], needle[qvar]);
+  string_constraintt a3(qvar, needle.length(), contains, constr3);
+  m_axioms.push_back(a3);
+
+  // end_index is min(from_index, |str| - |substring|)
+  minus_exprt length_diff(haystack.length(), needle.length());
+  if_exprt end_index(
+    binary_relation_exprt(from_index, ID_le, length_diff),
+    from_index,
+    length_diff);
+
+  string_not_contains_constraintt a4(
+    plus_exprt(offset, from_integer(1, index_type)),
+    plus_exprt(end_index, from_integer(1, index_type)),
+    contains,
+    from_integer(0, index_type),
+    needle.length(),
+    haystack,
+    needle);
+  m_axioms.push_back(a4);
+
+  string_not_contains_constraintt a5(
+    from_integer(0, index_type),
+    plus_exprt(end_index, from_integer(1, index_type)),
+    not_exprt(contains),
+    from_integer(0, index_type),
+    needle.length(),
+    haystack,
+    needle);
+  m_axioms.push_back(a5);
 
   return offset;
 }
@@ -150,10 +231,10 @@ exprt string_constraint_generatort::add_axioms_for_index_of(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  string_exprt str=add_axioms_for_string_expr(args[0]);
+  string_exprt str=get_string_expr(args[0]);
   const exprt &c=args[1];
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
-  assert(f.type()==ref_type.get_index_type());
+  PRECONDITION(f.type()==ref_type.get_index_type());
   exprt from_index;
 
   if(args.size()==2)
@@ -161,18 +242,32 @@ exprt string_constraint_generatort::add_axioms_for_index_of(
   else if(args.size()==3)
     from_index=args[2];
   else
-    assert(false);
+    UNREACHABLE;
 
-  if(refined_string_typet::is_java_string_pointer_type(c.type()))
+  if(c.type().id()==ID_unsignedbv || c.type().id()==ID_signedbv)
   {
-    string_exprt sub=add_axioms_for_string_expr(c);
-    return add_axioms_for_index_of_string(str, sub, from_index);
-  }
-  else
     return add_axioms_for_index_of(
       str, typecast_exprt(c, ref_type.get_char_type()), from_index);
+  }
+  else
+  {
+    INVARIANT(
+      is_refined_string_type(c.type()),
+      string_refinement_invariantt("c can only be a (un)signedbv or a refined "
+        "string and the (un)signedbv case is already handled"));
+    string_exprt sub=get_string_expr(c);
+    return add_axioms_for_index_of_string(str, sub, from_index);
+  }
 }
 
+/// Add axioms stating that the returned value is the index within str of the
+/// last occurrence of c starting the search backward at from_index, or -1 if no
+/// such character occurs at or before position from_index.
+/// \param str: a string expression
+/// \param c: an expression representing a character
+/// \param from_index: an expression representing an index in the string
+/// \return an integer expression representing the last index of c in str before
+///   or at from_index, or -1 if there is none
 exprt string_constraint_generatort::add_axioms_for_last_index_of(
   const string_exprt &str, const exprt &c, const exprt &from_index)
 {
@@ -183,45 +278,45 @@ exprt string_constraint_generatort::add_axioms_for_last_index_of(
 
   // We add axioms:
   // a1 : -1 <= i <= from_index
-  // a2 : (i=-1 <=> !contains)
-  // a3 : (contains => i <= from_index &&s[i]=c)
-  // a4 : forall n. i+1 <= n < from_index +1 &&contains => s[n]!=c
-  // a5 : forall m. 0 <= m < from_index +1 &&!contains => s[m]!=c
+  // a2 : i = -1 <=> !contains
+  // a3 : contains ==> (i <= from_index && s[i] = c)
+  // a4 : forall n:[i+1, from_index+1[ && contains ==> s[n] != c
+  // a5 : forall m:[0, from_index+1[ && !contains ==> s[m] != c
 
   exprt index1=from_integer(1, index_type);
   exprt minus1=from_integer(-1, index_type);
-  exprt from_index_plus_one=plus_exprt(from_index, index1);
+  exprt from_index_plus_one=plus_exprt_with_overflow_check(from_index, index1);
   and_exprt a1(
     binary_relation_exprt(index, ID_ge, minus1),
     binary_relation_exprt(index, ID_lt, from_index_plus_one));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   equal_exprt a2(not_exprt(contains), equal_exprt(index, minus1));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   implies_exprt a3(
     contains,
     and_exprt(
       binary_relation_exprt(from_index, ID_ge, index),
       equal_exprt(str[index], c)));
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
 
-  symbol_exprt n=fresh_univ_index("QA_last_index_of", index_type);
+  symbol_exprt n=fresh_univ_index("QA_last_index_of1", index_type);
   string_constraintt a4(
     n,
     plus_exprt(index, index1),
     from_index_plus_one,
     contains,
     not_exprt(equal_exprt(str[n], c)));
-  axioms.push_back(a4);
+  m_axioms.push_back(a4);
 
-  symbol_exprt m=fresh_univ_index("QA_last_index_of", index_type);
+  symbol_exprt m=fresh_univ_index("QA_last_index_of2", index_type);
   string_constraintt a5(
     m,
     from_index_plus_one,
     not_exprt(contains),
     not_exprt(equal_exprt(str[m], c)));
-  axioms.push_back(a5);
+  m_axioms.push_back(a5);
 
   return index;
 }
@@ -235,25 +330,27 @@ exprt string_constraint_generatort::add_axioms_for_last_index_of(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  string_exprt str=add_axioms_for_string_expr(args[0]);
+  string_exprt str=get_string_expr(args[0]);
   exprt c=args[1];
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   exprt from_index;
-  assert(f.type()==ref_type.get_index_type());
+  PRECONDITION(f.type()==ref_type.get_index_type());
 
   if(args.size()==2)
     from_index=minus_exprt(str.length(), from_integer(1, str.length().type()));
   else if(args.size()==3)
     from_index=args[2];
   else
-    assert(false);
+    UNREACHABLE;
 
-  if(refined_string_typet::is_java_string_pointer_type(c.type()))
+  if(c.type().id()==ID_unsignedbv || c.type().id()==ID_signedbv)
   {
-    string_exprt sub=add_axioms_for_string_expr(c);
-    return add_axioms_for_last_index_of_string(str, sub, from_index);
-  }
-  else
     return add_axioms_for_last_index_of(
       str, typecast_exprt(c, ref_type.get_char_type()), from_index);
+  }
+  else
+  {
+    string_exprt sub=get_string_expr(c);
+    return add_axioms_for_last_index_of_string(str, sub, from_index);
+  }
 }
diff --git a/src/solvers/refinement/string_constraint_generator_insert.cpp b/src/solvers/refinement/string_constraint_generator_insert.cpp
index f757317121e..85ba2837c80 100644
--- a/src/solvers/refinement/string_constraint_generator_insert.cpp
+++ b/src/solvers/refinement/string_constraint_generator_insert.cpp
@@ -9,6 +9,7 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 /// \file
 /// Generates string constraints for the family of insert Java functions
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/refinement/string_constraint_generator.h>
 
 /// add axioms stating that the result correspond to the first string where we
@@ -18,7 +19,7 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 string_exprt string_constraint_generatort::add_axioms_for_insert(
   const string_exprt &s1, const string_exprt &s2, const exprt &offset)
 {
-  assert(offset.type()==s1.length().type());
+  PRECONDITION(offset.type()==s1.length().type());
   string_exprt pref=add_axioms_for_substring(
     s1, from_integer(0, offset.type()), offset);
   string_exprt suf=add_axioms_for_substring(s1, offset, s1.length());
@@ -26,16 +27,33 @@ string_exprt string_constraint_generatort::add_axioms_for_insert(
   return add_axioms_for_concat(concat1, suf);
 }
 
-/// add axioms corresponding to the StringBuilder.insert(String) java function
+/// add axioms corresponding to the StringBuilder.insert(int, CharSequence) and
+/// StringBuilder.insert(int, CharSequence, int, int) java functions
 /// \par parameters: function application with three arguments: two strings and
 ///   an index
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_insert(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
-  string_exprt s2=add_axioms_for_string_expr(args(f, 3)[2]);
-  return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
+  PRECONDITION(f.arguments().size()>=3);
+  string_exprt s1=get_string_expr(f.arguments()[0]);
+  string_exprt s2=get_string_expr(f.arguments()[2]);
+  const exprt &offset=f.arguments()[1];
+  if(f.arguments().size()==5)
+  {
+    const exprt &start=f.arguments()[3];
+    const exprt &end=f.arguments()[4];
+    string_exprt substring=add_axioms_for_substring(s2, start, end);
+    return add_axioms_for_insert(s1, substring, offset);
+  }
+  else
+  {
+    INVARIANT(
+      f.arguments().size()==3,
+      string_refinement_invariantt("f must have 2 or 5 arguments and the case "
+        "of 5 arguments is already handled"));
+    return add_axioms_for_insert(s1, s2, offset);
+  }
 }
 
 /// add axioms corresponding to the StringBuilder.insert(I) java function
@@ -47,9 +65,8 @@ string_exprt string_constraint_generatort::add_axioms_for_insert_int(
   const function_application_exprt &f)
 {
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
-  string_exprt s2=add_axioms_from_int(
-    args(f, 3)[2], MAX_INTEGER_LENGTH, ref_type);
+  string_exprt s1=get_string_expr(args(f, 3)[0]);
+  string_exprt s2=add_axioms_from_int(args(f, 3)[2], ref_type);
   return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
 }
 
@@ -62,8 +79,8 @@ string_exprt string_constraint_generatort::add_axioms_for_insert_long(
   const function_application_exprt &f)
 {
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
-  string_exprt s2=add_axioms_from_int(args(f, 3)[2], MAX_LONG_LENGTH, ref_type);
+  string_exprt s1=get_string_expr(args(f, 3)[0]);
+  string_exprt s2=add_axioms_from_int(args(f, 3)[2], ref_type);
   return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
 }
 
@@ -76,7 +93,7 @@ string_exprt string_constraint_generatort::add_axioms_for_insert_bool(
   const function_application_exprt &f)
 {
   const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt s1=get_string_expr(args(f, 3)[0]);
   string_exprt s2=add_axioms_from_bool(args(f, 3)[2], ref_type);
   return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
 }
@@ -89,7 +106,7 @@ string_exprt string_constraint_generatort::add_axioms_for_insert_bool(
 string_exprt string_constraint_generatort::add_axioms_for_insert_char(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt s1=get_string_expr(args(f, 3)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(s1.type());
   string_exprt s2=add_axioms_from_char(args(f, 3)[2], ref_type);
   return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
@@ -103,8 +120,9 @@ string_exprt string_constraint_generatort::add_axioms_for_insert_char(
 string_exprt string_constraint_generatort::add_axioms_for_insert_double(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
-  string_exprt s2=add_axioms_from_float(args(f, 3)[2]);
+  string_exprt s1=get_string_expr(args(f, 3)[0]);
+  const refined_string_typet &ref_type=to_refined_string_type(s1.type());
+  string_exprt s2=add_axioms_for_string_of_float(args(f, 3)[2], ref_type);
   return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
 }
 
@@ -116,39 +134,8 @@ string_exprt string_constraint_generatort::add_axioms_for_insert_double(
 string_exprt string_constraint_generatort::add_axioms_for_insert_float(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 3)[0]);
-  string_exprt s2=add_axioms_from_float(args(f, 3)[2]);
+  string_exprt s1=get_string_expr(args(f, 3)[0]);
+  const refined_string_typet &ref_type=to_refined_string_type(s1.type());
+  string_exprt s2=add_axioms_for_string_of_float(args(f, 3)[2], ref_type);
   return add_axioms_for_insert(s1, s2, args(f, 3)[1]);
 }
-
-/// add axioms corresponding to the StringBuilder.insert:(I[CII) and
-/// StringBuilder.insert:(I[C) java functions
-/// \par parameters: function application with 4 arguments plus two optional
-///   arguments:
-/// a string, an offset index, a length, data array, an offset and a
-/// count
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_for_insert_char_array(
-  const function_application_exprt &f)
-{
-  exprt offset;
-  exprt count;
-  if(f.arguments().size()==6)
-  {
-    offset=f.arguments()[4];
-    count=f.arguments()[5];
-  }
-  else
-  {
-    assert(f.arguments().size()==4);
-    count=f.arguments()[2];
-    offset=from_integer(0, count.type());
-  }
-
-  string_exprt str=add_axioms_for_string_expr(f.arguments()[0]);
-  const exprt &length=f.arguments()[2];
-  const exprt &data=f.arguments()[3];
-  string_exprt arr=add_axioms_from_char_array(
-    length, data, offset, count);
-  return add_axioms_for_insert(str, arr, f.arguments()[1]);
-}
diff --git a/src/solvers/refinement/string_constraint_generator_main.cpp b/src/solvers/refinement/string_constraint_generator_main.cpp
index 308846338ef..f149ef3ecf1 100644
--- a/src/solvers/refinement/string_constraint_generator_main.cpp
+++ b/src/solvers/refinement/string_constraint_generator_main.cpp
@@ -19,13 +19,42 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 
 #include <solvers/refinement/string_constraint_generator.h>
 
+#include <limits>
 #include <ansi-c/string_constant.h>
 #include <java_bytecode/java_types.h>
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <util/arith_tools.h>
 #include <util/pointer_predicates.h>
 #include <util/ssa_expr.h>
 
-unsigned string_constraint_generatort::next_symbol_id=1;
+string_constraint_generatort::string_constraint_generatort(
+  const string_constraint_generatort::infot& info):
+  max_string_length(info.string_max_length),
+  m_force_printable_characters(info.string_printable),
+  m_ns(*info.ns) { }
+
+const std::vector<exprt> &string_constraint_generatort::get_axioms() const
+{
+  return m_axioms;
+}
+
+const std::vector<symbol_exprt> &
+string_constraint_generatort::get_index_symbols() const
+{
+  return m_index_symbols;
+}
+
+const std::vector<symbol_exprt> &
+string_constraint_generatort::get_boolean_symbols() const
+{
+  return m_boolean_symbols;
+}
+
+const std::set<string_exprt> &
+string_constraint_generatort::get_created_strings() const
+{
+  return m_created_strings;
+}
 
 /// generate constant character expression with character type.
 /// \par parameters: integer representing a character, and a type for
@@ -47,7 +76,7 @@ symbol_exprt string_constraint_generatort::fresh_symbol(
   const irep_idt &prefix, const typet &type)
 {
   std::ostringstream buf;
-  buf << "string_refinement#" << prefix << "#" << (next_symbol_id++);
+  buf << "string_refinement#" << prefix << "#" << ++m_symbol_count;
   irep_idt name(buf.str());
   return symbol_exprt(name, type);
 }
@@ -68,7 +97,7 @@ symbol_exprt string_constraint_generatort::fresh_exist_index(
   const irep_idt &prefix, const typet &type)
 {
   symbol_exprt s=fresh_symbol(prefix, type);
-  index_symbols.push_back(s);
+  m_index_symbols.push_back(s);
   return s;
 }
 
@@ -79,68 +108,164 @@ symbol_exprt string_constraint_generatort::fresh_boolean(
   const irep_idt &prefix)
 {
   symbol_exprt b=fresh_symbol(prefix, bool_typet());
-  boolean_symbols.push_back(b);
+  m_boolean_symbols.push_back(b);
   return b;
 }
 
+/// Create a plus expression while adding extra constraints to axioms in order
+/// to prevent overflows.
+/// \param op1: First term of the sum
+/// \param op2: Second term of the sum
+/// \return A plus expression representing the sum of the arguments
+plus_exprt string_constraint_generatort::plus_exprt_with_overflow_check(
+  const exprt &op1, const exprt &op2)
+{
+  plus_exprt sum(plus_exprt(op1, op2));
+
+  exprt zero=from_integer(0, op1.type());
+
+  binary_relation_exprt neg1(op1, ID_lt, zero);
+  binary_relation_exprt neg2(op2, ID_lt, zero);
+  binary_relation_exprt neg_sum(sum, ID_lt, zero);
+
+  // We prevent overflows by adding the following constraint:
+  // If the signs of the two operands are the same, then the sign of the sum
+  // should also be the same.
+  implies_exprt no_overflow(equal_exprt(neg1, neg2),
+                            equal_exprt(neg1, neg_sum));
+
+  m_axioms.push_back(no_overflow);
+
+  return sum;
+}
+
 /// construct a string expression whose length and content are new variables
 /// \par parameters: a type for string
 /// \return a string expression
 string_exprt string_constraint_generatort::fresh_string(
   const refined_string_typet &type)
 {
-  symbol_exprt length=
-    fresh_symbol("string_length", type.get_index_type());
+  symbol_exprt length=fresh_symbol("string_length", type.get_index_type());
   symbol_exprt content=fresh_symbol("string_content", type.get_content_type());
-  return string_exprt(length, content, type);
+  string_exprt str(length, content, type);
+  m_created_strings.insert(str);
+  add_default_axioms(str);
+  return str;
+}
+
+/// casts an expression to a string expression, or fetches the actual
+/// string_exprt in the case of a symbol.
+/// \par parameters: an expression of refined string type
+/// \return a string expression
+string_exprt string_constraint_generatort::get_string_expr(const exprt &expr)
+{
+  PRECONDITION(is_refined_string_type(expr.type()));
+
+  if(expr.id()==ID_symbol)
+  {
+    return find_or_add_string_of_symbol(
+      to_symbol_expr(expr),
+      to_refined_string_type(expr.type()));
+  }
+  else
+  {
+    return to_string_expr(expr);
+  }
+}
+
+/// adds standard axioms about the length of the string and its content: * its
+/// length should be positive * it should not exceed max_string_length * if
+/// force_printable_characters is true then all characters should belong to the
+/// range of ASCII characters between ' ' and '~'
+/// \param s: a string expression
+/// \return a string expression that is linked to the argument through axioms
+///   that are added to the list
+void string_constraint_generatort::add_default_axioms(
+  const string_exprt &s)
+{
+  m_axioms.push_back(
+    s.axiom_for_length_ge(from_integer(0, s.length().type())));
+  if(max_string_length!=std::numeric_limits<size_t>::max())
+    m_axioms.push_back(s.axiom_for_length_le(max_string_length));
+
+  if(m_force_printable_characters)
+  {
+    symbol_exprt qvar=fresh_univ_index("printable", s.length().type());
+    exprt chr=s[qvar];
+    and_exprt printable(
+      binary_relation_exprt(chr, ID_ge, from_integer(' ', chr.type())),
+      binary_relation_exprt(chr, ID_le, from_integer('~', chr.type())));
+    string_constraintt sc(qvar, s.length(), printable);
+    m_axioms.push_back(sc);
+  }
 }
 
-/// obtain a refined string expression corresponding to string variable of
-/// string function call
-/// \par parameters: an expression of type string
+/// obtain a refined string expression corresponding to a expression of type
+/// string
+/// \par parameters: an expression of refined string type
 /// \return a string expression that is linked to the argument through axioms
 ///   that are added to the list
-string_exprt string_constraint_generatort::add_axioms_for_string_expr(
-  const exprt &unrefined_string)
+string_exprt string_constraint_generatort::add_axioms_for_refined_string(
+  const exprt &string)
 {
-  string_exprt s;
+  PRECONDITION(is_refined_string_type(string.type()));
+  refined_string_typet type=to_refined_string_type(string.type());
 
-  if(unrefined_string.id()==ID_function_application)
+  // Function applications should have been removed before
+  PRECONDITION(string.id()!=ID_function_application);
+
+  if(string.id()==ID_symbol)
   {
-    exprt res=add_axioms_for_function_application(
-      to_function_application_expr(unrefined_string));
-    s=to_string_expr(res);
+    const symbol_exprt &sym=to_symbol_expr(string);
+    string_exprt s=find_or_add_string_of_symbol(sym, type);
+    add_default_axioms(s);
+    return s;
   }
-  else if(unrefined_string.id()==ID_symbol)
-    s=find_or_add_string_of_symbol(to_symbol_expr(unrefined_string));
-  else if(unrefined_string.id()==ID_address_of)
+  else if(string.id()==ID_nondet_symbol)
   {
-    assert(unrefined_string.op0().id()==ID_symbol);
-    s=find_or_add_string_of_symbol(to_symbol_expr(unrefined_string.op0()));
+    string_exprt s=fresh_string(type);
+    add_default_axioms(s);
+    return s;
   }
-  else if(unrefined_string.id()==ID_if)
-    s=add_axioms_for_if(to_if_expr(unrefined_string));
-  else if(unrefined_string.id()==ID_nondet_symbol ||
-          unrefined_string.id()==ID_struct)
+  else if(string.id()==ID_if)
   {
-    // TODO: for now we ignore non deterministic symbols and struct
+    return add_axioms_for_if(to_if_expr(string));
   }
-  else if(unrefined_string.id()==ID_typecast)
+  else if(string.id()==ID_struct)
   {
-    exprt arg=to_typecast_expr(unrefined_string).op();
-    exprt res=add_axioms_for_string_expr(arg);
-    s=to_string_expr(res);
+    const string_exprt &s=to_string_expr(string);
+    INVARIANT(
+      s.length().id()==ID_symbol || s.length().id()==ID_constant,
+      "string length should be a symbol or a constant");
+    irep_idt content_id=s.content().id();
+    INVARIANT(
+      content_id==ID_symbol || content_id==ID_array || content_id==ID_if,
+      "string content should be a symbol, a constant array, or an if");
+    if(content_id==ID_if)
+    {
+      // If the string content is an if expression, we add axioms ensuring
+      // the content is the same as the content in the 'true' branch when the
+      // condition holds and the 'false' branch otherwise.
+      if_exprt if_expr=to_if_expr(s.content());
+      string_exprt str_true=add_axioms_for_refined_string(
+        string_exprt(s.length(), if_expr.true_case(), type));
+      string_exprt str_false=add_axioms_for_refined_string(
+        string_exprt(s.length(), if_expr.false_case(), type));
+      return add_axioms_for_if(if_exprt(if_expr.cond(), str_true, str_false));
+    }
+    add_default_axioms(s);
+    return s;
   }
   else
   {
-    throw "add_axioms_for_string_expr:\n"+unrefined_string.pretty()+
-      "\nwhich is not a function application, "+
-      "a symbol or an if expression";
+    INVARIANT(
+      false,
+      string_refinement_invariantt("add_axioms_for_refined_string:\n"+
+        string.pretty()+"\nwhich is not a function application, a symbol, a "+
+        "struct or an if expression"));
+    // For the compiler
+    throw 0;
   }
-
-  axioms.push_back(
-    s.axiom_for_is_longer_than(from_integer(0, s.length().type())));
-  return s;
 }
 
 /// add axioms for an if expression which should return a string
@@ -149,43 +274,41 @@ string_exprt string_constraint_generatort::add_axioms_for_string_expr(
 string_exprt string_constraint_generatort::add_axioms_for_if(
   const if_exprt &expr)
 {
-  assert(
-    refined_string_typet::is_unrefined_string_type(expr.true_case().type()));
-  string_exprt t=add_axioms_for_string_expr(expr.true_case());
-  assert(
-    refined_string_typet::is_unrefined_string_type(expr.false_case().type()));
-  string_exprt f=add_axioms_for_string_expr(expr.false_case());
+  PRECONDITION(is_refined_string_type(expr.true_case().type()));
+  string_exprt t=get_string_expr(expr.true_case());
+  PRECONDITION(is_refined_string_type(expr.false_case().type()));
+  string_exprt f=get_string_expr(expr.false_case());
   const refined_string_typet &ref_type=to_refined_string_type(t.type());
   const typet &index_type=ref_type.get_index_type();
   string_exprt res=fresh_string(ref_type);
 
-  axioms.push_back(
+  m_axioms.push_back(
     implies_exprt(expr.cond(), res.axiom_for_has_same_length_as(t)));
   symbol_exprt qvar=fresh_univ_index("QA_string_if_true", index_type);
   equal_exprt qequal(res[qvar], t[qvar]);
-  axioms.push_back(string_constraintt(qvar, t.length(), expr.cond(), qequal));
-  axioms.push_back(
+  string_constraintt sc1(qvar, t.length(), implies_exprt(expr.cond(), qequal));
+  m_axioms.push_back(sc1);
+  m_axioms.push_back(
     implies_exprt(not_exprt(expr.cond()), res.axiom_for_has_same_length_as(f)));
   symbol_exprt qvar2=fresh_univ_index("QA_string_if_false", index_type);
   equal_exprt qequal2(res[qvar2], f[qvar2]);
-  string_constraintt sc2(qvar2, f.length(), not_exprt(expr.cond()), qequal2);
-  axioms.push_back(sc2);
+  string_constraintt sc2(qvar2, f.length(), or_exprt(expr.cond(), qequal2));
+  m_axioms.push_back(sc2);
   return res;
 }
 
-/// if a symbol represent a string is present in the symbol_to_string table,
+/// if a symbol representing a string is present in the symbol_to_string table,
 /// returns the corresponding string, if the symbol is not yet present, creates
 /// a new string with the correct type depending on whether the mode is java or
 /// c, adds it to the table and returns it.
 /// \par parameters: a symbol expression
 /// \return a string expression
 string_exprt string_constraint_generatort::find_or_add_string_of_symbol(
-  const symbol_exprt &sym)
+  const symbol_exprt &sym, const refined_string_typet &ref_type)
 {
   irep_idt id=sym.get_identifier();
-  const refined_string_typet &ref_type=to_refined_string_type(sym.type());
   string_exprt str=fresh_string(ref_type);
-  auto entry=symbol_to_string.insert(std::make_pair(id, str));
+  auto entry=m_unresolved_symbols.insert(std::make_pair(id, str));
   return entry.first->second;
 }
 
@@ -198,177 +321,237 @@ exprt string_constraint_generatort::add_axioms_for_function_application(
   const function_application_exprt &expr)
 {
   const exprt &name=expr.function();
-  assert(name.id()==ID_symbol);
+  PRECONDITION(name.id()==ID_symbol);
 
   const irep_idt &id=is_ssa_expr(name)?to_ssa_expr(name).get_object_name():
     to_symbol_expr(name).get_identifier();
 
+  std::string str_id(id.c_str());
+
+  size_t pos=str_id.find("func_length");
+  if(pos!=std::string::npos)
+  {
+    function_application_exprt new_expr(expr);
+    // TODO: This part needs some improvement.
+    // Stripping the symbol name is not a very robust process.
+    new_expr.function()=symbol_exprt(str_id.substr(0, pos+4));
+    new_expr.type()=refined_string_typet(java_int_type(), java_char_type());
+
+    auto res_it=m_function_application_cache.insert(std::make_pair(new_expr,
+                                                                 nil_exprt()));
+    if(res_it.second)
+    {
+      string_exprt res=to_string_expr(
+        add_axioms_for_function_application(new_expr));
+      res_it.first->second=res;
+      return res.length();
+    }
+    else
+      return to_string_expr(res_it.first->second).length();
+  }
+
+  pos = str_id.find("func_data");
+  if(pos!=std::string::npos)
+  {
+    function_application_exprt new_expr(expr);
+    new_expr.function()=symbol_exprt(str_id.substr(0, pos+4));
+    new_expr.type()=refined_string_typet(java_int_type(), java_char_type());
+
+    auto res_it=m_function_application_cache.insert(std::make_pair(new_expr,
+                                                                 nil_exprt()));
+    if(res_it.second)
+    {
+      string_exprt res=to_string_expr(
+        add_axioms_for_function_application(new_expr));
+      res_it.first->second=res;
+      return res.content();
+    }
+    else
+      return to_string_expr(res_it.first->second).content();
+  }
+
   // TODO: improve efficiency of this test by either ordering test by frequency
   // or using a map
 
+  auto res_it=m_function_application_cache.find(expr);
+  if(res_it!=m_function_application_cache.end() && res_it->second!=nil_exprt())
+    return res_it->second;
+
+  exprt res;
+
   if(id==ID_cprover_char_literal_func)
-    return add_axioms_for_char_literal(expr);
+    res=add_axioms_for_char_literal(expr);
   else if(id==ID_cprover_string_length_func)
-    return add_axioms_for_length(expr);
+    res=add_axioms_for_length(expr);
   else if(id==ID_cprover_string_equal_func)
-    return add_axioms_for_equals(expr);
+    res=add_axioms_for_equals(expr);
   else if(id==ID_cprover_string_equals_ignore_case_func)
-    return add_axioms_for_equals_ignore_case(expr);
+    res=add_axioms_for_equals_ignore_case(expr);
   else if(id==ID_cprover_string_is_empty_func)
-    return add_axioms_for_is_empty(expr);
+    res=add_axioms_for_is_empty(expr);
   else if(id==ID_cprover_string_char_at_func)
-    return add_axioms_for_char_at(expr);
+    res=add_axioms_for_char_at(expr);
   else if(id==ID_cprover_string_is_prefix_func)
-    return add_axioms_for_is_prefix(expr);
+    res=add_axioms_for_is_prefix(expr);
   else if(id==ID_cprover_string_is_suffix_func)
-    return add_axioms_for_is_suffix(expr);
+    res=add_axioms_for_is_suffix(expr);
   else if(id==ID_cprover_string_startswith_func)
-    return add_axioms_for_is_prefix(expr, true);
+    res=add_axioms_for_is_prefix(expr, true);
   else if(id==ID_cprover_string_endswith_func)
-    return add_axioms_for_is_suffix(expr, true);
+    res=add_axioms_for_is_suffix(expr, true);
   else if(id==ID_cprover_string_contains_func)
-    return add_axioms_for_contains(expr);
+    res=add_axioms_for_contains(expr);
   else if(id==ID_cprover_string_hash_code_func)
-    return add_axioms_for_hash_code(expr);
+    res=add_axioms_for_hash_code(expr);
   else if(id==ID_cprover_string_index_of_func)
-    return add_axioms_for_index_of(expr);
+    res=add_axioms_for_index_of(expr);
   else if(id==ID_cprover_string_last_index_of_func)
-    return add_axioms_for_last_index_of(expr);
+    res=add_axioms_for_last_index_of(expr);
   else if(id==ID_cprover_string_parse_int_func)
-    return add_axioms_for_parse_int(expr);
+    res=add_axioms_for_parse_int(expr);
   else if(id==ID_cprover_string_to_char_array_func)
-    return add_axioms_for_to_char_array(expr);
+    res=add_axioms_for_to_char_array(expr);
   else if(id==ID_cprover_string_code_point_at_func)
-    return add_axioms_for_code_point_at(expr);
+    res=add_axioms_for_code_point_at(expr);
   else if(id==ID_cprover_string_code_point_before_func)
-    return add_axioms_for_code_point_before(expr);
+    res=add_axioms_for_code_point_before(expr);
   else if(id==ID_cprover_string_code_point_count_func)
-    return add_axioms_for_code_point_count(expr);
+    res=add_axioms_for_code_point_count(expr);
   else if(id==ID_cprover_string_offset_by_code_point_func)
-    return add_axioms_for_offset_by_code_point(expr);
+    res=add_axioms_for_offset_by_code_point(expr);
   else if(id==ID_cprover_string_compare_to_func)
-    return add_axioms_for_compare_to(expr);
+    res=add_axioms_for_compare_to(expr);
   else if(id==ID_cprover_string_literal_func)
-    return add_axioms_from_literal(expr);
+    res=add_axioms_from_literal(expr);
   else if(id==ID_cprover_string_concat_func)
-    return add_axioms_for_concat(expr);
+    res=add_axioms_for_concat(expr);
   else if(id==ID_cprover_string_concat_int_func)
-    return add_axioms_for_concat_int(expr);
+    res=add_axioms_for_concat_int(expr);
   else if(id==ID_cprover_string_concat_long_func)
-    return add_axioms_for_concat_long(expr);
+    res=add_axioms_for_concat_long(expr);
   else if(id==ID_cprover_string_concat_bool_func)
-      return add_axioms_for_concat_bool(expr);
+      res=add_axioms_for_concat_bool(expr);
   else if(id==ID_cprover_string_concat_char_func)
-    return add_axioms_for_concat_char(expr);
+    res=add_axioms_for_concat_char(expr);
   else if(id==ID_cprover_string_concat_double_func)
-    return add_axioms_for_concat_double(expr);
+    res=add_axioms_for_concat_double(expr);
   else if(id==ID_cprover_string_concat_float_func)
-    return add_axioms_for_concat_float(expr);
+    res=add_axioms_for_concat_float(expr);
   else if(id==ID_cprover_string_concat_code_point_func)
-    return add_axioms_for_concat_code_point(expr);
+    res=add_axioms_for_concat_code_point(expr);
   else if(id==ID_cprover_string_insert_func)
-    return add_axioms_for_insert(expr);
+    res=add_axioms_for_insert(expr);
   else if(id==ID_cprover_string_insert_int_func)
-    return add_axioms_for_insert_int(expr);
+    res=add_axioms_for_insert_int(expr);
   else if(id==ID_cprover_string_insert_long_func)
-    return add_axioms_for_insert_long(expr);
+    res=add_axioms_for_insert_long(expr);
   else if(id==ID_cprover_string_insert_bool_func)
-    return add_axioms_for_insert_bool(expr);
+    res=add_axioms_for_insert_bool(expr);
   else if(id==ID_cprover_string_insert_char_func)
-    return add_axioms_for_insert_char(expr);
+    res=add_axioms_for_insert_char(expr);
   else if(id==ID_cprover_string_insert_double_func)
-    return add_axioms_for_insert_double(expr);
+    res=add_axioms_for_insert_double(expr);
   else if(id==ID_cprover_string_insert_float_func)
-    return add_axioms_for_insert_float(expr);
-  else if(id==ID_cprover_string_insert_char_array_func)
-    return add_axioms_for_insert_char_array(expr);
+    res=add_axioms_for_insert_float(expr);
   else if(id==ID_cprover_string_substring_func)
-    return add_axioms_for_substring(expr);
+    res=add_axioms_for_substring(expr);
   else if(id==ID_cprover_string_trim_func)
-    return add_axioms_for_trim(expr);
+    res=add_axioms_for_trim(expr);
   else if(id==ID_cprover_string_to_lower_case_func)
-    return add_axioms_for_to_lower_case(expr);
+    res=add_axioms_for_to_lower_case(expr);
   else if(id==ID_cprover_string_to_upper_case_func)
-    return add_axioms_for_to_upper_case(expr);
+    res=add_axioms_for_to_upper_case(expr);
   else if(id==ID_cprover_string_char_set_func)
-    return add_axioms_for_char_set(expr);
-  else if(id==ID_cprover_string_value_of_func)
-    return add_axioms_for_value_of(expr);
+    res=add_axioms_for_char_set(expr);
   else if(id==ID_cprover_string_empty_string_func)
-    return add_axioms_for_empty_string(expr);
+    res=add_axioms_for_empty_string(expr);
   else if(id==ID_cprover_string_copy_func)
-    return add_axioms_for_copy(expr);
+    res=add_axioms_for_copy(expr);
   else if(id==ID_cprover_string_of_int_func)
-    return add_axioms_from_int(expr);
+    res=add_axioms_from_int(expr);
   else if(id==ID_cprover_string_of_int_hex_func)
-    return add_axioms_from_int_hex(expr);
+    res=add_axioms_from_int_hex(expr);
   else if(id==ID_cprover_string_of_float_func)
-    return add_axioms_from_float(expr);
+    res=add_axioms_for_string_of_float(expr);
+  else if(id==ID_cprover_string_of_float_scientific_notation_func)
+    res=add_axioms_from_float_scientific_notation(expr);
   else if(id==ID_cprover_string_of_double_func)
-    return add_axioms_from_double(expr);
+    res=add_axioms_from_double(expr);
   else if(id==ID_cprover_string_of_long_func)
-    return add_axioms_from_long(expr);
+    res=add_axioms_from_long(expr);
   else if(id==ID_cprover_string_of_bool_func)
-    return add_axioms_from_bool(expr);
+    res=add_axioms_from_bool(expr);
   else if(id==ID_cprover_string_of_char_func)
-    return add_axioms_from_char(expr);
-  else if(id==ID_cprover_string_of_char_array_func)
-    return add_axioms_from_char_array(expr);
+    res=add_axioms_from_char(expr);
   else if(id==ID_cprover_string_set_length_func)
-    return add_axioms_for_set_length(expr);
+    res=add_axioms_for_set_length(expr);
   else if(id==ID_cprover_string_delete_func)
-    return add_axioms_for_delete(expr);
+    res=add_axioms_for_delete(expr);
   else if(id==ID_cprover_string_delete_char_at_func)
-    return add_axioms_for_delete_char_at(expr);
+    res=add_axioms_for_delete_char_at(expr);
   else if(id==ID_cprover_string_replace_func)
-    return add_axioms_for_replace(expr);
+    res=add_axioms_for_replace(expr);
+  else if(id==ID_cprover_string_intern_func)
+    res=add_axioms_for_intern(expr);
+  else if(id==ID_cprover_string_array_of_char_pointer_func)
+    res=add_axioms_for_char_pointer(expr);
+  else if(id==ID_cprover_string_format_func)
+    res=add_axioms_for_format(expr);
   else
   {
     std::string msg(
       "string_constraint_generator::function_application: unknown symbol :");
     msg+=id2string(id);
-    throw msg;
+    DATA_INVARIANT(false, string_refinement_invariantt(msg));
   }
+  m_function_application_cache[expr]=res;
+  return res;
 }
 
 /// add axioms to say that the returned string expression is equal to the
 /// argument of the function application
-/// \par parameters: function application with one argument, which is a string
+/// \par parameters: function application with one argument, which is a string,
+/// or three arguments: string, integer offset and count
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_copy(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 1)[0]);
-  const refined_string_typet &ref_type=to_refined_string_type(s1.type());
-  string_exprt res=fresh_string(ref_type);
-
-  // We add axioms:
-  // a1 : |res|=|s1|
-  // a2 : forall i<|s1|. s1[i]=res[i]
-
-  axioms.push_back(res.axiom_for_has_same_length_as(s1));
-
-  symbol_exprt idx=fresh_univ_index("QA_index_copy", ref_type.get_index_type());
-  string_constraintt a2(idx, s1.length(), equal_exprt(s1[idx], res[idx]));
-  axioms.push_back(a2);
-  return res;
+  const auto &args=f.arguments();
+  if(args.size()==1)
+  {
+    string_exprt s1=get_string_expr(args[0]);
+    return s1;
+  }
+  else
+  {
+    INVARIANT(
+      args.size()==3,
+      string_refinement_invariantt("f must have 1 or 3 arguments and the case "
+        "of 3 arguments is already handled"));
+    string_exprt s1=get_string_expr(args[0]);
+    exprt offset=args[1];
+    exprt count=args[2];
+    return add_axioms_for_substring(s1, offset, plus_exprt(offset, count));
+  }
 }
 
-/// add axioms corresponding to the String.valueOf([C) java function
-/// \par parameters: an expression corresponding to a java object of type char
-///   array
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_for_java_char_array(
-  const exprt &char_array)
+/// for an expression of the form `array[0]` returns `array`
+/// \par parameters: an expression of type char
+/// \return an array expression
+exprt string_constraint_generatort::add_axioms_for_char_pointer(
+  const function_application_exprt &fun)
 {
-  string_exprt res=fresh_string(
-    refined_string_typet(java_int_type(), java_char_type()));
-  exprt arr=to_address_of_expr(char_array).object();
-  exprt len=member_exprt(arr, "length", res.length().type());
-  exprt cont=member_exprt(arr, "data", res.content().type());
-  res.length()=len;
-  res.content()=cont;
-  return res;
+  exprt char_pointer=args(fun, 1)[0];
+  if(char_pointer.id()==ID_index)
+    return typecast_exprt(char_pointer.op0(), fun.type());
+  // TODO: It seems reasonable that the result of the function application
+  //       should match the return type of the function. However it is not
+  //       clear whether this typecast is properly handled in the string
+  //       refinement. We need regression tests that use that function.
+
+  // TODO: we do not know what to do in the other cases
+  TODO;
+  return exprt();
 }
 
 /// add axioms corresponding to the String.length java function
@@ -377,70 +560,10 @@ string_exprt string_constraint_generatort::add_axioms_for_java_char_array(
 exprt string_constraint_generatort::add_axioms_for_length(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 1)[0]);
+  string_exprt str=get_string_expr(args(f, 1)[0]);
   return str.length();
 }
 
-/// add axioms stating that the content of the returned string equals to the
-/// content of the array argument, starting at offset and with `count`
-/// characters
-/// \par parameters: a length expression, an array expression, a offset index,
-///   and a
-/// count index
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_from_char_array(
-  const exprt &length,
-  const exprt &data,
-  const exprt &offset,
-  const exprt &count)
-{
-  const typet &char_type=to_array_type(data.type()).subtype();
-  const typet &index_type=length.type();
-  refined_string_typet ref_type(index_type, char_type);
-  string_exprt str=fresh_string(ref_type);
-
-  // We add axioms:
-  // a1 : forall q < count. str[q] = data[q+offset]
-  // a2 : |str| = count
-
-  symbol_exprt qvar=fresh_univ_index("QA_string_of_char_array", index_type);
-  exprt char_in_tab=data;
-  assert(char_in_tab.id()==ID_index);
-  char_in_tab.op1()=plus_exprt(qvar, offset);
-
-  string_constraintt a1(qvar, count, equal_exprt(str[qvar], char_in_tab));
-  axioms.push_back(a1);
-  axioms.push_back(equal_exprt(str.length(), count));
-
-  return str;
-}
-
-/// add axioms corresponding to the String.<init>:(I[CII) and
-/// String.<init>:(I[C) java functions
-/// function application with 2 arguments and 2 additional optional
-/// \param arguments: length, char array, offset and count
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_from_char_array(
-  const function_application_exprt &f)
-{
-  exprt offset;
-  exprt count;
-  if(f.arguments().size()==4)
-  {
-    offset=f.arguments()[2];
-    count=f.arguments()[3];
-  }
-  else
-  {
-    assert(f.arguments().size()==2);
-    count=f.arguments()[0];
-    offset=from_integer(0, count.type());
-  }
-  const exprt &tab_length=f.arguments()[0];
-  const exprt &data=f.arguments()[1];
-  return add_axioms_from_char_array(tab_length, data, offset, count);
-}
-
 /// expression true exactly when the index is positive
 /// \par parameters: an index expression
 /// \return a Boolean expression
@@ -457,7 +580,7 @@ exprt string_constraint_generatort::add_axioms_for_char_literal(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(args.size()==1); // there should be exactly 1 argument to char literal
+  PRECONDITION(args.size()==1); // there should be exactly 1 arg to char literal
 
   const exprt &arg=args[0];
   // for C programs argument to char literal should be one string constant
@@ -469,12 +592,15 @@ exprt string_constraint_generatort::add_axioms_for_char_literal(
   {
     const string_constantt s=to_string_constant(arg.op0().op0().op0());
     irep_idt sval=s.get_value();
-    assert(sval.size()==1);
+    CHECK_RETURN(sval.size()==1);
     return from_integer(unsigned(sval[0]), arg.type());
   }
   else
   {
-    throw "convert_char_literal unimplemented";
+    // convert_char_literal unimplemented
+    UNIMPLEMENTED;
+    // For the compiler
+    throw 0;
   }
 }
 
@@ -486,10 +612,10 @@ exprt string_constraint_generatort::add_axioms_for_char_literal(
 exprt string_constraint_generatort::add_axioms_for_char_at(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 2)[0]);
+  string_exprt str=get_string_expr(args(f, 2)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   symbol_exprt char_sym=fresh_symbol("char", ref_type.get_char_type());
-  axioms.push_back(equal_exprt(char_sym, str[args(f, 2)[1]]));
+  m_axioms.push_back(equal_exprt(char_sym, str[args(f, 2)[1]]));
   return char_sym;
 }
 
@@ -499,18 +625,6 @@ exprt string_constraint_generatort::add_axioms_for_char_at(
 exprt string_constraint_generatort::add_axioms_for_to_char_array(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 1)[0]);
+  string_exprt str=get_string_expr(args(f, 1)[0]);
   return str.content();
 }
-
-/// add a correspondence to make sure the symbol points to the same string as
-/// the second argument
-/// \par parameters: a symbol and a string
-void string_constraint_generatort::set_string_symbol_equal_to_expr(
-  const symbol_exprt &sym, const exprt &str)
-{
-  if(str.id()==ID_symbol)
-    assign_to_symbol(sym, find_or_add_string_of_symbol(to_symbol_expr(str)));
-  else
-    assign_to_symbol(sym, add_axioms_for_string_expr(str));
-}
diff --git a/src/solvers/refinement/string_constraint_generator_testing.cpp b/src/solvers/refinement/string_constraint_generator_testing.cpp
index dc28a5198e9..c11b8ef4263 100644
--- a/src/solvers/refinement/string_constraint_generator_testing.cpp
+++ b/src/solvers/refinement/string_constraint_generator_testing.cpp
@@ -10,6 +10,7 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 /// \file
 /// Generates string constraints for string functions that return Boolean values
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/refinement/string_constraint_generator.h>
 
 /// add axioms stating that the returned expression is true exactly when the
@@ -24,41 +25,41 @@ exprt string_constraint_generatort::add_axioms_for_is_prefix(
 
   // We add axioms:
   // a1 : isprefix => |str| >= |prefix|+offset
-  // a2 : forall 0<=qvar<prefix.length. isprefix =>
-  //   s0[witness+offset]=s2[witness]
-  // a3 : !isprefix => |str| < |prefix|+offset
-  //   || (|str| >= |prefix|+offset &&0<=witness<|prefix|
-  //     &&str[witness+ofsset]!=prefix[witness])
+  // a2 : forall 0<=qvar<|prefix|. isprefix => s0[witness+offset]=s2[witness]
+  // a3 : !isprefix =>
+  //        |str|<|prefix|+offset ||
+  //        (0<=witness<|prefix| && str[witness+offset]!=prefix[witness])
 
   implies_exprt a1(
     isprefix,
-    str.axiom_for_is_longer_than(plus_exprt(prefix.length(), offset)));
-  axioms.push_back(a1);
+    str.axiom_for_length_ge(plus_exprt_with_overflow_check(
+      prefix.length(), offset)));
+  m_axioms.push_back(a1);
 
   symbol_exprt qvar=fresh_univ_index("QA_isprefix", index_type);
   string_constraintt a2(
     qvar,
     prefix.length(),
     isprefix,
-    equal_exprt(str[plus_exprt(qvar, offset)], prefix[qvar]));
-  axioms.push_back(a2);
+    equal_exprt(str[plus_exprt_with_overflow_check(qvar, offset)],
+                prefix[qvar]));
+  m_axioms.push_back(a2);
 
   symbol_exprt witness=fresh_exist_index("witness_not_isprefix", index_type);
   and_exprt witness_diff(
     axiom_for_is_positive_index(witness),
     and_exprt(
-      prefix.axiom_for_is_strictly_longer_than(witness),
-      notequal_exprt(str[plus_exprt(witness, offset)], prefix[witness])));
+      prefix.axiom_for_length_gt(witness),
+      notequal_exprt(str[plus_exprt_with_overflow_check(witness, offset)],
+                     prefix[witness])));
   or_exprt s0_notpref_s1(
     not_exprt(
-      str.axiom_for_is_longer_than(plus_exprt(prefix.length(), offset))),
-    and_exprt(
-      witness_diff,
-      str.axiom_for_is_longer_than(
-        plus_exprt(prefix.length(), offset))));
+      str.axiom_for_length_ge(
+        plus_exprt_with_overflow_check(prefix.length(), offset))),
+    witness_diff);
 
   implies_exprt a3(not_exprt(isprefix), s0_notpref_s1);
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
   return isprefix;
 }
 
@@ -72,9 +73,9 @@ exprt string_constraint_generatort::add_axioms_for_is_prefix(
   const function_application_exprt &f, bool swap_arguments)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(f.type()==bool_typet() || f.type().id()==ID_c_bool);
-  string_exprt s0=add_axioms_for_string_expr(args[swap_arguments?1:0]);
-  string_exprt s1=add_axioms_for_string_expr(args[swap_arguments?0:1]);
+  PRECONDITION(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  string_exprt s0=get_string_expr(args[swap_arguments?1:0]);
+  string_exprt s1=get_string_expr(args[swap_arguments?0:1]);
   exprt offset;
   if(args.size()==2)
     offset=from_integer(0, s0.length().type());
@@ -90,16 +91,16 @@ exprt string_constraint_generatort::add_axioms_for_is_prefix(
 exprt string_constraint_generatort::add_axioms_for_is_empty(
   const function_application_exprt &f)
 {
-  assert(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  PRECONDITION(f.type()==bool_typet() || f.type().id()==ID_c_bool);
 
   // We add axioms:
   // a1 : is_empty => |s0| = 0
   // a2 : s0 => is_empty
 
   symbol_exprt is_empty=fresh_boolean("is_empty");
-  string_exprt s0=add_axioms_for_string_expr(args(f, 1)[0]);
-  axioms.push_back(implies_exprt(is_empty, s0.axiom_for_has_length(0)));
-  axioms.push_back(implies_exprt(s0.axiom_for_has_length(0), is_empty));
+  string_exprt s0=get_string_expr(args(f, 1)[0]);
+  m_axioms.push_back(implies_exprt(is_empty, s0.axiom_for_has_length(0)));
+  m_axioms.push_back(implies_exprt(s0.axiom_for_has_length(0), is_empty));
   return typecast_exprt(is_empty, f.type());
 }
 
@@ -113,13 +114,13 @@ exprt string_constraint_generatort::add_axioms_for_is_suffix(
   const function_application_exprt &f, bool swap_arguments)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(args.size()==2); // bad args to string issuffix?
-  assert(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  PRECONDITION(args.size()==2); // bad args to string issuffix?
+  PRECONDITION(f.type()==bool_typet() || f.type().id()==ID_c_bool);
 
   symbol_exprt issuffix=fresh_boolean("issuffix");
   typecast_exprt tc_issuffix(issuffix, f.type());
-  string_exprt s0=add_axioms_for_string_expr(args[swap_arguments?1:0]);
-  string_exprt s1=add_axioms_for_string_expr(args[swap_arguments?0:1]);
+  string_exprt s0=get_string_expr(args[swap_arguments?1:0]);
+  string_exprt s1=get_string_expr(args[swap_arguments?0:1]);
   const typet &index_type=s0.length().type();
 
   // We add axioms:
@@ -127,82 +128,113 @@ exprt string_constraint_generatort::add_axioms_for_is_suffix(
   // a2 : forall witness<s1.length.
   //     issufix => s1[witness]=s0[witness + s0.length-s1.length]
   // a3 : !issuffix =>
-  //   s1.length > s0.length
+  //   (s1.length > s0.length && witness=-1)
   //     || (s1.length > witness>=0
   //       &&s1[witness]!=s0[witness + s0.length-s1.length]
 
-  implies_exprt a1(issuffix, s1.axiom_for_is_longer_than(s0));
-  axioms.push_back(a1);
+  implies_exprt a1(issuffix, s1.axiom_for_length_ge(s0));
+  m_axioms.push_back(a1);
 
   symbol_exprt qvar=fresh_univ_index("QA_suffix", index_type);
   exprt qvar_shifted=plus_exprt(
     qvar, minus_exprt(s1.length(), s0.length()));
   string_constraintt a2(
     qvar, s0.length(), issuffix, equal_exprt(s0[qvar], s1[qvar_shifted]));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   symbol_exprt witness=fresh_exist_index("witness_not_suffix", index_type);
   exprt shifted=plus_exprt(
     witness, minus_exprt(s1.length(), s0.length()));
   or_exprt constr3(
-    s0.axiom_for_is_strictly_longer_than(s1),
+    and_exprt(s0.axiom_for_length_gt(s1),
+              equal_exprt(witness, from_integer(-1, index_type))),
     and_exprt(
       notequal_exprt(s0[witness], s1[shifted]),
       and_exprt(
-        s0.axiom_for_is_strictly_longer_than(witness),
+        s0.axiom_for_length_gt(witness),
         axiom_for_is_positive_index(witness))));
   implies_exprt a3(not_exprt(issuffix), constr3);
 
-  axioms.push_back(a3);
+  m_axioms.push_back(a3);
   return tc_issuffix;
 }
 
+/// tells whether the given string is a constant
+/// \param expr: a string expression
+/// \return a Boolean
+bool string_constraint_generatort::is_constant_string(
+  const string_exprt &expr)
+{
+  if(expr.id()!=ID_struct ||
+     expr.operands().size()!=2 ||
+     expr.length().id()!=ID_constant ||
+     expr.content().id()!=ID_array)
+    return false;
+  for(const auto &element : expr.content().operands())
+  {
+    if(element.id()!=ID_constant)
+      return false;
+  }
+  return true;
+}
+
 /// add axioms corresponding to the String.contains java function
 /// \par parameters: function application with two string arguments
 /// \return a Boolean expression
 exprt string_constraint_generatort::add_axioms_for_contains(
   const function_application_exprt &f)
 {
-  assert(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  PRECONDITION(f.type()==bool_typet() || f.type().id()==ID_c_bool);
+  string_exprt s0=get_string_expr(args(f, 2)[0]);
+  string_exprt s1=get_string_expr(args(f, 2)[1]);
+
   symbol_exprt contains=fresh_boolean("contains");
-  typecast_exprt tc_contains(contains, f.type());
-  string_exprt s0=add_axioms_for_string_expr(args(f, 2)[0]);
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[1]);
-  const typet &index_type=s0.type();
+  const refined_string_typet ref_type=to_refined_string_type(s0.type());
+  const typet &index_type=ref_type.get_index_type();
 
   // We add axioms:
-  // a1 : contains => s0.length >= s1.length
-  // a2 : 0 <= startpos <= s0.length-s1.length
-  // a3 : forall qvar<s1.length. contains => s1[qvar]=s0[startpos + qvar]
-  // a4 : !contains => s1.length > s0.length
-  //       || (forall startpos <= s0.length-s1.length.
-  //             exists witness<s1.length &&s1[witness]!=s0[witness + startpos]
+  // a1 : contains ==> |s0| >= |s1|
+  // a2 : contains ==> 0 <= startpos <= |s0|-|s1|
+  // a3 : !contains ==> startpos = -1
+  // a4 : forall qvar < |s1|. contains ==> s1[qvar] = s0[startpos + qvar]
+  // a5 : !contains ==> |s1| > |s0| ||
+  //      (forall startpos <= |s0| - |s1|.
+  //         exists witness < |s1|. s1[witness] != s0[witness + startpos])
 
-  implies_exprt a1(contains, s0.axiom_for_is_longer_than(s1));
-  axioms.push_back(a1);
+  implies_exprt a1(contains, s0.axiom_for_length_ge(s1));
+  m_axioms.push_back(a1);
 
   symbol_exprt startpos=fresh_exist_index("startpos_contains", index_type);
   minus_exprt length_diff(s0.length(), s1.length());
-  and_exprt a2(
+  and_exprt bounds(
     axiom_for_is_positive_index(startpos),
     binary_relation_exprt(startpos, ID_le, length_diff));
-  axioms.push_back(a2);
+  implies_exprt a2(contains, bounds);
+  m_axioms.push_back(a2);
+
+  implies_exprt a3(
+    not_exprt(contains),
+    equal_exprt(startpos, from_integer(-1, index_type)));
+  m_axioms.push_back(a3);
 
   symbol_exprt qvar=fresh_univ_index("QA_contains", index_type);
   exprt qvar_shifted=plus_exprt(qvar, startpos);
-  string_constraintt a3(
+  string_constraintt a4(
     qvar, s1.length(), contains, equal_exprt(s1[qvar], s0[qvar_shifted]));
-  axioms.push_back(a3);
+  m_axioms.push_back(a4);
 
-  // We rewrite the axiom for !contains as:
-  // forall startpos <= |s0|-|s1|.  (!contains &&|s0| >= |s1| )
-  //      ==> exists witness<|s1|. s1[witness]!=s0[startpos+witness]
-  string_not_contains_constraintt a4(
+  // We rewrite axiom a4 as:
+  // forall startpos <= |s0|-|s1|.  (!contains && |s0| >= |s1|)
+  //     ==> exists witness < |s1|. s1[witness] != s0[startpos+witness]
+  string_not_contains_constraintt a5(
     from_integer(0, index_type),
     plus_exprt(from_integer(1, index_type), length_diff),
-    and_exprt(not_exprt(contains), s0.axiom_for_is_longer_than(s1)),
-    from_integer(0, index_type), s1.length(), s0, s1);
-  axioms.push_back(a4);
+    and_exprt(not_exprt(contains), s0.axiom_for_length_ge(s1)),
+    from_integer(0, index_type),
+    s1.length(),
+    s0,
+    s1);
+  m_axioms.push_back(a5);
 
-  return tc_contains;
+  return typecast_exprt(contains, f.type());
 }
diff --git a/src/solvers/refinement/string_constraint_generator_transformation.cpp b/src/solvers/refinement/string_constraint_generator_transformation.cpp
index 01395b25cc1..5bbbba82c6c 100644
--- a/src/solvers/refinement/string_constraint_generator_transformation.cpp
+++ b/src/solvers/refinement/string_constraint_generator_transformation.cpp
@@ -11,41 +11,49 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 /// Generates string constraints for string transformations, that is, functions
 ///   taking one string and returning another
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/refinement/string_constraint_generator.h>
 
-/// add axioms to say that the returned string expression has length given by
-/// the second argument and whose characters are equal to those of the first
-/// argument for the positions which are defined in both strings
-/// \par parameters: function application with two arguments, the first of which
-///   is
-/// a string and the second an integer which should have same type has
-/// return by get_index_type()
-/// \return a new string expression
+/// add axioms to say that the returned string expression `res` has length `k`
+/// and characters at position `i` in `res` are equal to the character at
+/// position `i` in `s1` if `i` is smaller that the length of `s1`, otherwise
+/// it is the null character `\u0000`.
+/// \param f: function application with two arguments, the first of which
+///        is a string `s1` and the second an integer `k` which should have
+///        same type as the string length
+/// \return a new string expression `res`
 string_exprt string_constraint_generatort::add_axioms_for_set_length(
   const function_application_exprt &f)
 {
-  string_exprt s1=add_axioms_for_string_expr(args(f, 2)[0]);
+  string_exprt s1=get_string_expr(args(f, 2)[0]);
   exprt k=args(f, 2)[1];
   const refined_string_typet &ref_type=to_refined_string_type(s1.type());
   string_exprt res=fresh_string(ref_type);
 
   // We add axioms:
   // a1 : |res|=k
-  // a2 : forall i<k. (i<k ==> s[i]=s1[i]) &&(i >= k ==> s[i]=0)
+  // a2 : forall i<|res|. i < |s1|  ==> res[i] = s1[i]
+  // a3 : forall i<|res|. i >= |s1| ==> res[i] = 0
 
-  axioms.push_back(res.axiom_for_has_length(k));
+  m_axioms.push_back(res.axiom_for_has_length(k));
 
   symbol_exprt idx=fresh_univ_index(
     "QA_index_set_length", ref_type.get_index_type());
   string_constraintt a2(
-    idx, k, and_exprt(
-      implies_exprt(
-        s1.axiom_for_is_strictly_longer_than(idx),
-        equal_exprt(s1[idx], res[idx])),
-      implies_exprt(
-        s1.axiom_for_is_shorter_than(idx),
-        equal_exprt(s1[idx], constant_char(0, ref_type.get_char_type())))));
-  axioms.push_back(a2);
+    idx,
+    res.length(),
+    s1.axiom_for_length_gt(idx),
+    equal_exprt(s1[idx], res[idx]));
+  m_axioms.push_back(a2);
+
+  symbol_exprt idx2=fresh_univ_index(
+    "QA_index_set_length2", ref_type.get_index_type());
+  string_constraintt a3(
+    idx2,
+    res.length(),
+    s1.axiom_for_length_le(idx2),
+    equal_exprt(res[idx2], constant_char(0, ref_type.get_char_type())));
+  m_axioms.push_back(a3);
 
   return res;
 }
@@ -62,8 +70,8 @@ string_exprt string_constraint_generatort::add_axioms_for_substring(
   const function_application_exprt &f)
 {
   const function_application_exprt::argumentst &args=f.arguments();
-  assert(args.size()>=2);
-  string_exprt str=add_axioms_for_string_expr(args[0]);
+  PRECONDITION(args.size()>=2);
+  string_exprt str=get_string_expr(args[0]);
   exprt i(args[1]);
   exprt j;
   if(args.size()==3)
@@ -72,7 +80,10 @@ string_exprt string_constraint_generatort::add_axioms_for_substring(
   }
   else
   {
-    assert(args.size()==2);
+    INVARIANT(
+      args.size()==2,
+      string_refinement_invariantt("f must have 2 or 3 arguments and the case "
+        "of 3 arguments is already handled"));
     j=str.length();
   }
   return add_axioms_for_substring(str, i, j);
@@ -89,9 +100,8 @@ string_exprt string_constraint_generatort::add_axioms_for_substring(
 {
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   const typet &index_type=ref_type.get_index_type();
-  symbol_exprt idx=fresh_exist_index("index_substring", index_type);
-  assert(start.type()==index_type);
-  assert(end.type()==index_type);
+  PRECONDITION(start.type()==index_type);
+  PRECONDITION(end.type()==index_type);
   string_exprt res=fresh_string(ref_type);
 
   // We add axioms:
@@ -103,18 +113,21 @@ string_exprt string_constraint_generatort::add_axioms_for_substring(
   implies_exprt a1(
     binary_relation_exprt(start, ID_lt, end),
     res.axiom_for_has_length(minus_exprt(end, start)));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   exprt is_empty=res.axiom_for_has_length(from_integer(0, index_type));
   implies_exprt a2(binary_relation_exprt(start, ID_ge, end), is_empty);
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
   // Warning: check what to do if the string is not long enough
-  axioms.push_back(str.axiom_for_is_longer_than(end));
-
-  string_constraintt a4(
-    idx, res.length(), equal_exprt(res[idx], str[plus_exprt(start, idx)]));
-  axioms.push_back(a4);
+  m_axioms.push_back(str.axiom_for_length_ge(end));
+
+  symbol_exprt idx=fresh_univ_index("QA_index_substring", index_type);
+  string_constraintt a4(idx,
+                        res.length(),
+                        equal_exprt(res[idx],
+                        str[plus_exprt(start, idx)]));
+  m_axioms.push_back(a4);
   return res;
 }
 
@@ -124,7 +137,7 @@ string_exprt string_constraint_generatort::add_axioms_for_substring(
 string_exprt string_constraint_generatort::add_axioms_for_trim(
   const function_application_exprt &expr)
 {
-  string_exprt str=add_axioms_for_string_expr(args(expr, 1)[0]);
+  string_exprt str=get_string_expr(args(expr, 1)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   const typet &index_type=ref_type.get_index_type();
   string_exprt res=fresh_string(ref_type);
@@ -143,51 +156,54 @@ string_exprt string_constraint_generatort::add_axioms_for_trim(
   // a8 : forall n<|s1|, s[idx+n]=s1[n]
   // a9 : (s[m]>' ' &&s[m+|s1|-1]>' ') || m=|s|
 
-  exprt a1=str.axiom_for_is_longer_than(plus_exprt(idx, res.length()));
-  axioms.push_back(a1);
+  exprt a1=str.axiom_for_length_ge(
+    plus_exprt_with_overflow_check(idx, res.length()));
+  m_axioms.push_back(a1);
 
   binary_relation_exprt a2(idx, ID_ge, from_integer(0, index_type));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
 
-  exprt a3=str.axiom_for_is_longer_than(idx);
-  axioms.push_back(a3);
+  exprt a3=str.axiom_for_length_ge(idx);
+  m_axioms.push_back(a3);
 
-  exprt a4=res.axiom_for_is_longer_than(
+  exprt a4=res.axiom_for_length_ge(
     from_integer(0, index_type));
-  axioms.push_back(a4);
+  m_axioms.push_back(a4);
 
-  exprt a5=res.axiom_for_is_shorter_than(str);
-  axioms.push_back(a5);
+  exprt a5=res.axiom_for_length_le(str);
+  m_axioms.push_back(a5);
 
   symbol_exprt n=fresh_univ_index("QA_index_trim", index_type);
   binary_relation_exprt non_print(str[n], ID_le, space_char);
   string_constraintt a6(n, idx, non_print);
-  axioms.push_back(a6);
+  m_axioms.push_back(a6);
 
   symbol_exprt n2=fresh_univ_index("QA_index_trim2", index_type);
-  minus_exprt bound(str.length(), plus_exprt(idx, res.length()));
+  minus_exprt bound(str.length(), plus_exprt_with_overflow_check(idx,
+                                                                 res.length()));
   binary_relation_exprt eqn2(
     str[plus_exprt(idx, plus_exprt(res.length(), n2))],
     ID_le,
     space_char);
 
   string_constraintt a7(n2, bound, eqn2);
-  axioms.push_back(a7);
+  m_axioms.push_back(a7);
 
   symbol_exprt n3=fresh_univ_index("QA_index_trim3", index_type);
   equal_exprt eqn3(res[n3], str[plus_exprt(n3, idx)]);
   string_constraintt a8(n3, res.length(), eqn3);
-  axioms.push_back(a8);
+  m_axioms.push_back(a8);
 
   minus_exprt index_before(
-    plus_exprt(idx, res.length()), from_integer(1, index_type));
+    plus_exprt_with_overflow_check(idx, res.length()),
+      from_integer(1, index_type));
   binary_relation_exprt no_space_before(str[index_before], ID_gt, space_char);
   or_exprt a9(
     equal_exprt(idx, str.length()),
     and_exprt(
       binary_relation_exprt(str[idx], ID_gt, space_char),
       no_space_before));
-  axioms.push_back(a9);
+  m_axioms.push_back(a9);
   return res;
 }
 
@@ -197,41 +213,63 @@ string_exprt string_constraint_generatort::add_axioms_for_trim(
 string_exprt string_constraint_generatort::add_axioms_for_to_lower_case(
   const function_application_exprt &expr)
 {
-  string_exprt str=add_axioms_for_string_expr(args(expr, 1)[0]);
+  string_exprt str=get_string_expr(args(expr, 1)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   const typet &char_type=ref_type.get_char_type();
   const typet &index_type=ref_type.get_index_type();
   string_exprt res=fresh_string(ref_type);
-  exprt char_a=constant_char('a', char_type);
-  exprt char_A=constant_char('A', char_type);
-  exprt char_z=constant_char('z', char_type);
-  exprt char_Z=constant_char('Z', char_type);
+  const exprt char_A=constant_char('A', char_type);
+  const exprt char_Z=constant_char('Z', char_type);
 
-  // TODO: add support for locales using case mapping information
-  // from the UnicodeData file.
+
+  // TODO: for now, only characters in Basic Latin and Latin-1 supplement
+  // are supported (up to 0x100), we should add others using case mapping
+  // information from the UnicodeData file.
 
   // We add axioms:
   // a1 : |res| = |str|
-  // a2 : forall idx<str.length, 'A'<=str[idx]<='Z' => res[idx]=str[idx]+'a'-'A'
-  // a3 : forall idx<str.length, !('a'<=str[idx]<='z') => res[idx]=str[idx]
-  // forall idx<str.length,
-  // this[idx]='A'<=str[idx]<='Z' ? str[idx]+'a'-'A' : str[idx]
+  // a2 : forall idx<str.length,
+  //   is_upper_case(str[idx])?
+  //      res[idx]=str[idx]+diff : res[idx]=str[idx]<0x100
+  // where diff is the difference between lower case and upper case characters:
+  // diff = 'a'-'A' = 0x20
 
   exprt a1=res.axiom_for_has_same_length_as(str);
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
   symbol_exprt idx=fresh_univ_index("QA_lower_case", index_type);
-  exprt is_upper_case=and_exprt(
+  exprt::operandst upper_case;
+  // Characters between 'A' and 'Z' are upper-case
+  upper_case.push_back(and_exprt(
     binary_relation_exprt(char_A, ID_le, str[idx]),
-    binary_relation_exprt(str[idx], ID_le, char_Z));
-  minus_exprt diff(char_a, char_A);
-  equal_exprt convert(res[idx], plus_exprt(str[idx], diff));
-  string_constraintt a2(idx, res.length(), is_upper_case, convert);
-  axioms.push_back(a2);
-
-  equal_exprt eq(res[idx], str[idx]);
-  string_constraintt a3(idx, res.length(), not_exprt(is_upper_case), eq);
-  axioms.push_back(a3);
+    binary_relation_exprt(str[idx], ID_le, char_Z)));
+
+  // Characters between 0xc0 (latin capital A with grave)
+  // and 0xd6 (latin capital O with diaeresis) are upper-case
+  upper_case.push_back(and_exprt(
+    binary_relation_exprt(from_integer(0xc0, char_type), ID_le, str[idx]),
+    binary_relation_exprt(str[idx], ID_le, from_integer(0xd6, char_type))));
+
+  // Characters between 0xd8 (latin capital O with stroke)
+  // and 0xde (latin capital thorn) are upper-case
+  upper_case.push_back(and_exprt(
+    binary_relation_exprt(from_integer(0xd8, char_type), ID_le, str[idx]),
+    binary_relation_exprt(str[idx], ID_le, from_integer(0xde, char_type))));
+
+  exprt is_upper_case=disjunction(upper_case);
+
+  // The difference between upper-case and lower-case for the basic latin and
+  // latin-1 supplement is 0x20.
+  exprt diff=from_integer(0x20, char_type);
+  equal_exprt converted(res[idx], plus_exprt(str[idx], diff));
+  and_exprt non_converted(
+    equal_exprt(res[idx], str[idx]),
+    binary_relation_exprt(str[idx], ID_lt, from_integer(0x100, char_type)));
+  if_exprt conditional_convert(is_upper_case, converted, non_converted);
+
+  string_constraintt a2(idx, res.length(), conditional_convert);
+  m_axioms.push_back(a2);
+
   return res;
 }
 
@@ -239,9 +277,8 @@ string_exprt string_constraint_generatort::add_axioms_for_to_lower_case(
 /// \par parameters: function application with one string argument
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_for_to_upper_case(
-  const function_application_exprt &expr)
+  const string_exprt &str)
 {
-  string_exprt str=add_axioms_for_string_expr(args(expr, 1)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   const typet &char_type=ref_type.get_char_type();
   const typet &index_type=ref_type.get_index_type();
@@ -249,34 +286,51 @@ string_exprt string_constraint_generatort::add_axioms_for_to_upper_case(
   exprt char_a=constant_char('a', char_type);
   exprt char_A=constant_char('A', char_type);
   exprt char_z=constant_char('z', char_type);
-  exprt char_Z=constant_char('Z', char_type);
 
   // TODO: add support for locales using case mapping information
   // from the UnicodeData file.
 
   // We add axioms:
   // a1 : |res| = |str|
-  // a2 : forall idx<str.length, 'a'<=str[idx]<='z' => res[idx]=str[idx]+'A'-'a'
-  // a3 : forall idx<str.length, !('a'<=str[idx]<='z') => res[idx]=str[idx]
+  // a2 : forall idx1<str.length, 'a'<=str[idx1]<='z' =>
+  //                                res[idx1]=str[idx1]+'A'-'a'
+  // a3 : forall idx2<str.length, !('a'<=str[idx2]<='z') => res[idx2]=str[idx2]
+  // Note that index expressions are only allowed in the body of universal
+  // axioms, so we use a trivial premise and push our premise into the body.
 
   exprt a1=res.axiom_for_has_same_length_as(str);
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
 
-  symbol_exprt idx=fresh_univ_index("QA_upper_case", index_type);
+  symbol_exprt idx1=fresh_univ_index("QA_upper_case1", index_type);
   exprt is_lower_case=and_exprt(
-    binary_relation_exprt(char_a, ID_le, str[idx]),
-    binary_relation_exprt(str[idx], ID_le, char_z));
+    binary_relation_exprt(char_a, ID_le, str[idx1]),
+    binary_relation_exprt(str[idx1], ID_le, char_z));
   minus_exprt diff(char_A, char_a);
-  equal_exprt convert(res[idx], plus_exprt(str[idx], diff));
-  string_constraintt a2(idx, res.length(), is_lower_case, convert);
-  axioms.push_back(a2);
-
-  equal_exprt eq(res[idx], str[idx]);
-  string_constraintt a3(idx, res.length(), not_exprt(is_lower_case), eq);
-  axioms.push_back(a3);
+  equal_exprt convert(res[idx1], plus_exprt(str[idx1], diff));
+  implies_exprt body1(is_lower_case, convert);
+  string_constraintt a2(idx1, res.length(), body1);
+  m_axioms.push_back(a2);
+
+  symbol_exprt idx2=fresh_univ_index("QA_upper_case2", index_type);
+  exprt is_not_lower_case=not_exprt(and_exprt(
+    binary_relation_exprt(char_a, ID_le, str[idx2]),
+    binary_relation_exprt(str[idx2], ID_le, char_z)));
+  equal_exprt eq(res[idx2], str[idx2]);
+  implies_exprt body2(is_not_lower_case, eq);
+  string_constraintt a3(idx2, res.length(), body2);
+  m_axioms.push_back(a3);
   return res;
 }
 
+/// add axioms corresponding to the String.toUpperCase java function
+/// \param expr: function application with one string argument
+/// \return a new string expression
+string_exprt string_constraint_generatort::add_axioms_for_to_upper_case(
+  const function_application_exprt &expr)
+{
+  string_exprt str=get_string_expr(args(expr, 1)[0]);
+  return add_axioms_for_to_upper_case(str);
+}
 
 /// add axioms corresponding stating that the result is similar to that of the
 /// StringBuilder.setCharAt java function Warning: this may be underspecified in
@@ -288,7 +342,7 @@ string_exprt string_constraint_generatort::add_axioms_for_to_upper_case(
 string_exprt string_constraint_generatort::add_axioms_for_char_set(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt str=get_string_expr(args(f, 3)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   string_exprt res=fresh_string(ref_type);
   with_exprt sarrnew(str.content(), args(f, 3)[1], args(f, 3)[2]);
@@ -301,7 +355,7 @@ string_exprt string_constraint_generatort::add_axioms_for_char_set(
     and_exprt(
       equal_exprt(res.content(), sarrnew),
       res.axiom_for_has_same_length_as(str)));
-  axioms.push_back(a1);
+  m_axioms.push_back(a1);
   return res;
 }
 
@@ -313,7 +367,7 @@ string_exprt string_constraint_generatort::add_axioms_for_char_set(
 string_exprt string_constraint_generatort::add_axioms_for_replace(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt str=get_string_expr(args(f, 3)[0]);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   const exprt &old_char=args(f, 3)[1];
   const exprt &new_char=args(f, 3)[2];
@@ -325,7 +379,7 @@ string_exprt string_constraint_generatort::add_axioms_for_replace(
   //    str[qvar]=oldChar => res[qvar]=newChar
   //    !str[qvar]=oldChar => res[qvar]=str[qvar]
 
-  axioms.push_back(res.axiom_for_has_same_length_as(str));
+  m_axioms.push_back(res.axiom_for_has_same_length_as(str));
 
   symbol_exprt qvar=fresh_univ_index("QA_replace", ref_type.get_index_type());
   implies_exprt case1(
@@ -335,7 +389,7 @@ string_exprt string_constraint_generatort::add_axioms_for_replace(
     not_exprt(equal_exprt(str[qvar], old_char)),
     equal_exprt(res[qvar], str[qvar]));
   string_constraintt a2(qvar, res.length(), and_exprt(case1, case2));
-  axioms.push_back(a2);
+  m_axioms.push_back(a2);
   return res;
 }
 
@@ -347,10 +401,12 @@ string_exprt string_constraint_generatort::add_axioms_for_replace(
 string_exprt string_constraint_generatort::add_axioms_for_delete_char_at(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 2)[0]);
+  string_exprt str=get_string_expr(args(f, 2)[0]);
   exprt index_one=from_integer(1, str.length().type());
   return add_axioms_for_delete(
-    str, args(f, 2)[1], plus_exprt(args(f, 2)[1], index_one));
+    str,
+    args(f, 2)[1],
+    plus_exprt_with_overflow_check(args(f, 2)[1], index_one));
 }
 
 /// add axioms stating that the returned string corresponds to the input one
@@ -361,8 +417,8 @@ string_exprt string_constraint_generatort::add_axioms_for_delete_char_at(
 string_exprt string_constraint_generatort::add_axioms_for_delete(
   const string_exprt &str, const exprt &start, const exprt &end)
 {
-  assert(start.type()==str.length().type());
-  assert(end.type()==str.length().type());
+  PRECONDITION(start.type()==str.length().type());
+  PRECONDITION(end.type()==str.length().type());
   string_exprt str1=add_axioms_for_substring(
     str, from_integer(0, str.length().type()), start);
   string_exprt str2=add_axioms_for_substring(str, end, str.length());
@@ -376,6 +432,6 @@ string_exprt string_constraint_generatort::add_axioms_for_delete(
 string_exprt string_constraint_generatort::add_axioms_for_delete(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 3)[0]);
+  string_exprt str=get_string_expr(args(f, 3)[0]);
   return add_axioms_for_delete(str, args(f, 3)[1], args(f, 3)[2]);
 }
diff --git a/src/solvers/refinement/string_constraint_generator_valueof.cpp b/src/solvers/refinement/string_constraint_generator_valueof.cpp
index 66364bcdc2f..f54a821f623 100644
--- a/src/solvers/refinement/string_constraint_generator_valueof.cpp
+++ b/src/solvers/refinement/string_constraint_generator_valueof.cpp
@@ -11,148 +11,58 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 /// Generates string constraints for functions generating strings from other
 ///   types, in particular int, long, float, double, char, bool
 
+#include <solvers/refinement/string_refinement_invariant.h>
 #include <solvers/refinement/string_constraint_generator.h>
+#include <util/simplify_expr.h>
 
+#include <cmath>
 #include <solvers/floatbv/float_bv.h>
 
-/// add axioms corresponding to the String.valueOf(I) java function
-/// \par parameters: function application with one integer argument
+
+/// Add axioms corresponding to the String.valueOf(I) java function.
+/// \param expr: function application with one integer argument
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_int(
   const function_application_exprt &expr)
 {
   const refined_string_typet &ref_type=to_refined_string_type(expr.type());
-  return add_axioms_from_int(args(expr, 1)[0], MAX_INTEGER_LENGTH, ref_type);
+  PRECONDITION(expr.arguments().size()>=1);
+  if(expr.arguments().size()==1)
+  {
+    return add_axioms_from_int(expr.arguments()[0], ref_type);
+  }
+  else
+  {
+    return add_axioms_from_int_with_radix(
+      expr.arguments()[0],
+      expr.arguments()[1],
+      ref_type);
+  }
 }
 
-/// add axioms corresponding to the String.valueOf(J) java function
-/// \par parameters: function application with one long argument
+/// Add axioms corresponding to the String.valueOf(J) java function.
+/// \param expr: function application with one long argument
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_long(
   const function_application_exprt &expr)
 {
   const refined_string_typet &ref_type=to_refined_string_type(expr.type());
-  return add_axioms_from_int(args(expr, 1)[0], MAX_LONG_LENGTH, ref_type);
-}
-
-/// add axioms corresponding to the String.valueOf(F) java function
-/// \par parameters: function application with one float argument
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_from_float(
-  const function_application_exprt &f)
-{
-  return add_axioms_from_float(args(f, 1)[0], false);
-}
-
-/// add axioms corresponding to the String.valueOf(D) java function
-/// \par parameters: function application with one double argument
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_from_double(
-  const function_application_exprt &f)
-{
-  return add_axioms_from_float(args(f, 1)[0], true);
-}
-
-/// add axioms corresponding to the String.valueOf(F) java function Warning: we
-/// currently only have partial specification
-/// \par parameters: float expression and Boolean signaling that the argument
-///   has
-/// double precision
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_from_float(
-  const exprt &f, bool double_precision)
-{
-  const refined_string_typet &ref_type=to_refined_string_type(f.type());
-  const typet &index_type=ref_type.get_index_type();
-  const typet &char_type=ref_type.get_char_type();
-  string_exprt res=fresh_string(ref_type);
-  const exprt &index24=from_integer(24, ref_type.get_index_type());
-  axioms.push_back(res.axiom_for_is_shorter_than(index24));
-
-  string_exprt magnitude=fresh_string(ref_type);
-  string_exprt sign_string=fresh_string(ref_type);
-  string_exprt nan_string=add_axioms_for_constant("NaN", ref_type);
-
-  // We add the axioms:
-  // a1 : If the argument is NaN, the result length is that of "NaN".
-  // a2 : If the argument is NaN, the result content is the string "NaN".
-  // a3 : f<0 => |sign_string|=1
-  // a4 : f>=0 => |sign_string|=0
-  // a5 : f<0 => sign_string[0]='-'
-  // a6 : f infinite => |magnitude|=|"Infinity"|
-  // a7 : forall i<|"Infinity"|, f infinite => magnitude[i]="Infinity"[i]
-  // a8 : f=0 => |magnitude|=|"0.0"|
-  // a9 : forall i<|"0.0"|, f=0 => f[i]="0.0"[i]
-
-  ieee_float_spect fspec=
-    double_precision?ieee_float_spect::double_precision()
-    :ieee_float_spect::single_precision();
-
-  exprt isnan=float_bvt().isnan(f, fspec);
-  implies_exprt a1(isnan, magnitude.axiom_for_has_same_length_as(nan_string));
-  axioms.push_back(a1);
-
-  symbol_exprt qvar=fresh_univ_index("QA_equal_nan", index_type);
-  string_constraintt a2(
-    qvar,
-    nan_string.length(),
-    isnan,
-    equal_exprt(magnitude[qvar], nan_string[qvar]));
-  axioms.push_back(a2);
-
-  // If the argument is not NaN, the result is a string that represents
-  // the sign and magnitude (absolute value) of the argument.
-  // If the sign is negative, the first character of the result is '-';
-  // if the sign is positive, no sign character appears in the result.
-
-  bitvector_typet bv_type=to_bitvector_type(f.type());
-  unsigned width=bv_type.get_width();
-  exprt isneg=extractbit_exprt(f, width-1);
-
-  implies_exprt a3(isneg, sign_string.axiom_for_has_length(1));
-  axioms.push_back(a3);
-
-  implies_exprt a4(not_exprt(isneg), sign_string.axiom_for_has_length(0));
-  axioms.push_back(a4);
-
-  implies_exprt a5(
-    isneg, equal_exprt(sign_string[0], constant_char('-', char_type)));
-  axioms.push_back(a5);
-
-  // If m is infinity, it is represented by the characters "Infinity";
-  // thus, positive infinity produces the result "Infinity" and negative
-  // infinity produces the result "-Infinity".
-
-  string_exprt infinity_string=add_axioms_for_constant("Infinity", ref_type);
-  exprt isinf=float_bvt().isinf(f, fspec);
-  implies_exprt a6(
-    isinf, magnitude.axiom_for_has_same_length_as(infinity_string));
-  axioms.push_back(a6);
-
-  symbol_exprt qvar_inf=fresh_univ_index("QA_equal_infinity", index_type);
-  equal_exprt meq(magnitude[qvar_inf], infinity_string[qvar_inf]);
-  string_constraintt a7(qvar_inf, infinity_string.length(), isinf, meq);
-  axioms.push_back(a7);
-
-  // If m is zero, it is represented by the characters "0.0"; thus, negative
-  // zero produces the result "-0.0" and positive zero produces "0.0".
-
-  string_exprt zero_string=add_axioms_for_constant("0.0", ref_type);
-  exprt iszero=float_bvt().is_zero(f, fspec);
-  implies_exprt a8(iszero, magnitude.axiom_for_has_same_length_as(zero_string));
-  axioms.push_back(a8);
-
-  symbol_exprt qvar_zero=fresh_univ_index("QA_equal_zero", index_type);
-  equal_exprt eq_zero(magnitude[qvar_zero], zero_string[qvar_zero]);
-  string_constraintt a9(qvar_zero, zero_string.length(), iszero, eq_zero);
-  axioms.push_back(a9);
-
-  return add_axioms_for_concat(sign_string, magnitude);
+  PRECONDITION(expr.arguments().size()>=1);
+  if(expr.arguments().size()==1)
+  {
+    return add_axioms_from_int(expr.arguments()[0], ref_type);
+  }
+  else
+  {
+    return add_axioms_from_int_with_radix(
+      expr.arguments()[0],
+      expr.arguments()[1],
+      ref_type);
+  }
 }
 
-
-/// add axioms corresponding to the String.valueOf(Z) java function
-/// \par parameters: function application with on Boolean argument
+/// Add axioms corresponding to the String.valueOf(Z) java function.
+/// \param f: function application with a Boolean argument
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_bool(
   const function_application_exprt &f)
@@ -161,175 +71,125 @@ string_exprt string_constraint_generatort::add_axioms_from_bool(
   return add_axioms_from_bool(args(f, 1)[0], ref_type);
 }
 
-
-/// add axioms stating that the returned string equals "true" when the Boolean
-/// expression is true and "false" when it is false
-/// \par parameters: Boolean expression
+/// Add axioms stating that the returned string equals "true" when the Boolean
+/// expression is true and "false" when it is false.
+/// \param b: Boolean expression
+/// \param ref_type: type of refined string expressions
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_bool(
   const exprt &b, const refined_string_typet &ref_type)
 {
   string_exprt res=fresh_string(ref_type);
-  const typet &index_type=ref_type.get_index_type();
+  const typet &char_type=ref_type.get_char_type();
 
-  assert(b.type()==bool_typet() || b.type().id()==ID_c_bool);
+  PRECONDITION(b.type()==bool_typet() || b.type().id()==ID_c_bool);
 
   typecast_exprt eq(b, bool_typet());
 
-  string_exprt true_string=add_axioms_for_constant("true", ref_type);
-  string_exprt false_string=add_axioms_for_constant("false", ref_type);
-
   // We add axioms:
   // a1 : eq => res = |"true"|
   // a2 : forall i < |"true"|. eq => res[i]="true"[i]
   // a3 : !eq => res = |"false"|
   // a4 : forall i < |"false"|. !eq => res[i]="false"[i]
 
-  implies_exprt a1(eq, res.axiom_for_has_same_length_as(true_string));
-  axioms.push_back(a1);
-  symbol_exprt qvar=fresh_univ_index("QA_equal_true", index_type);
-  string_constraintt a2(
-    qvar,
-    true_string.length(),
-    eq,
-    equal_exprt(res[qvar], true_string[qvar]));
-  axioms.push_back(a2);
-
-  implies_exprt a3(
-    not_exprt(eq), res.axiom_for_has_same_length_as(false_string));
-  axioms.push_back(a3);
-
-  symbol_exprt qvar1=fresh_univ_index("QA_equal_false", index_type);
-  string_constraintt a4(
-    qvar,
-    false_string.length(),
-    not_exprt(eq),
-    equal_exprt(res[qvar1], false_string[qvar1]));
-  axioms.push_back(a4);
+  std::string str_true="true";
+  implies_exprt a1(eq, res.axiom_for_has_length(str_true.length()));
+  m_axioms.push_back(a1);
+
+  for(std::size_t i=0; i<str_true.length(); i++)
+  {
+    exprt chr=from_integer(str_true[i], char_type);
+    implies_exprt a2(eq, equal_exprt(res[i], chr));
+    m_axioms.push_back(a2);
+  }
+
+  std::string str_false="false";
+  implies_exprt a3(not_exprt(eq), res.axiom_for_has_length(str_false.length()));
+  m_axioms.push_back(a3);
+
+  for(std::size_t i=0; i<str_false.length(); i++)
+  {
+    exprt chr=from_integer(str_false[i], char_type);
+    implies_exprt a4(not_exprt(eq), equal_exprt(res[i], chr));
+    m_axioms.push_back(a4);
+  }
 
   return res;
 }
 
-/// gives the smallest integer with the specified number of digits
-/// \par parameters: number of digit
-/// \return an integer with the right number of digit
-static mp_integer smallest_by_digit(int nb)
+/// Add axioms enforcing that the string corresponds to the result
+/// of String.valueOf(I) or String.valueOf(J) Java functions applied
+/// on the integer expression.
+/// \param x: a signed integer expression
+/// \param ref_type: type for refined strings
+/// \param max_size: a maximal size for the string representation (default 0,
+///   which is interpreted to mean "as large as is needed for this type")
+/// \return a string expression
+string_exprt string_constraint_generatort::add_axioms_from_int(
+  const exprt &input_int,
+  const refined_string_typet &ref_type,
+  size_t max_size)
 {
-  return power(10, nb-1);
+  const constant_exprt radix=from_integer(10, input_int.type());
+  return add_axioms_from_int_with_radix(input_int, radix, ref_type, max_size);
 }
 
-/// add axioms to say the string corresponds to the result of String.valueOf(I)
-/// or String.valueOf(J) java functions applied on the integer expression
-/// \par parameters: a signed integer expression, and a maximal size for the
-///   string
-/// representation
+/// Add axioms enforcing that the string corresponds to the result
+/// of String.valueOf(II) or String.valueOf(JI) Java functions applied
+/// on the integer expression.
+/// \param input_int: a signed integer expression
+/// \param radix: the radix to use
+/// \param ref_type: type for refined strings
+/// \param max_size: a maximal size for the string representation (default 0,
+///   which is interpreted to mean "as large as is needed for this type")
 /// \return a string expression
-string_exprt string_constraint_generatort::add_axioms_from_int(
-  const exprt &i, size_t max_size, const refined_string_typet &ref_type)
+string_exprt string_constraint_generatort::add_axioms_from_int_with_radix(
+  const exprt &input_int,
+  const exprt &radix,
+  const refined_string_typet &ref_type,
+  size_t max_size)
 {
-  string_exprt res=fresh_string(ref_type);
-  const typet &type=i.type();
-  assert(type.id()==ID_signedbv);
-  exprt ten=from_integer(10, type);
-  const typet &char_type=ref_type.get_char_type();
-  const typet &index_type=ref_type.get_index_type();
-  exprt zero_char=constant_char('0', char_type);
-  exprt nine_char=constant_char('9', char_type);
-  exprt minus_char=constant_char('-', char_type);
-  exprt zero=from_integer(0, index_type);
-  exprt max=from_integer(max_size, index_type);
-
-  // We add axioms:
-  // a1 : 0 <|res|<=max_size
-  // a2 : (res[0]='-')||('0'<=res[0]<='9')
-
-  and_exprt a1(res.axiom_for_is_strictly_longer_than(zero),
-               res.axiom_for_is_shorter_than(max));
-  axioms.push_back(a1);
+  PRECONDITION(max_size==0 || max_size<std::numeric_limits<size_t>::max());
+  const typet &type=input_int.type();
+  PRECONDITION(type.id()==ID_signedbv);
 
-  exprt chr=res[0];
-  exprt starts_with_minus=equal_exprt(chr, minus_char);
-  exprt starts_with_digit=and_exprt(
-    binary_relation_exprt(chr, ID_ge, zero_char),
-    binary_relation_exprt(chr, ID_le, nine_char));
-  or_exprt a2(starts_with_digit, starts_with_minus);
-  axioms.push_back(a2);
+  /// Most of the time we can evaluate radix as an integer. The value 0 is used
+  /// to indicate when we can't tell what the radix is.
+  const unsigned long radix_ul=to_integer_or_default(radix, 0);
+  CHECK_RETURN((radix_ul>=2 && radix_ul<=36) || radix_ul==0);
 
-  for(size_t size=1; size<=max_size; size++)
+  if(max_size==0)
   {
-    // For each possible size, we add axioms:
-    // all_numbers: forall 1<=i<=size. '0'<=res[i]<='9'
-    // a3 : |res|=size&&'0'<=res[0]<='9' =>
-    //      i=sum+str[0]-'0' &&all_numbers
-    // a4 : |res|=size&&res[0]='-' => i=-sum
-    // a5 : size>1 => |res|=size&&'0'<=res[0]<='9' => res[0]!='0'
-    // a6 : size>1 => |res|=size&&res[0]'-' => res[1]!='0'
-    // a7 : size==max_size => i>1000000000
-    exprt sum=from_integer(0, type);
-    exprt all_numbers=true_exprt();
-    chr=res[0];
-    exprt first_value=typecast_exprt(minus_exprt(chr, zero_char), type);
-
-    for(size_t j=1; j<size; j++)
-    {
-      chr=res[j];
-      sum=plus_exprt(
-        mult_exprt(sum, ten),
-        typecast_exprt(minus_exprt(chr, zero_char), type));
-      first_value=mult_exprt(first_value, ten);
-      and_exprt is_number(
-        binary_relation_exprt(chr, ID_ge, zero_char),
-        binary_relation_exprt(chr, ID_le, nine_char));
-      all_numbers=and_exprt(all_numbers, is_number);
-    }
-
-    axioms.push_back(all_numbers);
-
-    equal_exprt premise=res.axiom_for_has_length(size);
-    equal_exprt constr3(i, plus_exprt(sum, first_value));
-    implies_exprt a3(and_exprt(premise, starts_with_digit), constr3);
-    axioms.push_back(a3);
-
-    implies_exprt a4(
-      and_exprt(premise, starts_with_minus),
-      equal_exprt(i, unary_minus_exprt(sum)));
-    axioms.push_back(a4);
-
-    // disallow 0s at the beginning
-    if(size>1)
-    {
-      equal_exprt r0_zero(res[zero], zero_char);
-      implies_exprt a5(
-        and_exprt(premise, starts_with_digit),
-        not_exprt(r0_zero));
-      axioms.push_back(a5);
-
-      exprt one=from_integer(1, index_type);
-      equal_exprt r1_zero(res[one], zero_char);
-      implies_exprt a6(
-        and_exprt(premise, starts_with_minus),
-        not_exprt(r1_zero));
-      axioms.push_back(a6);
-    }
-
-    // we have to be careful when exceeding the maximal size of integers
-    if(size==max_size)
-    {
-      exprt smallest_with_10_digits=from_integer(
-        smallest_by_digit(max_size), type);
-      binary_relation_exprt big(i, ID_ge, smallest_with_10_digits);
-      implies_exprt a7(premise, big);
-      axioms.push_back(a7);
-    }
+    max_size=max_printed_string_length(type, radix_ul);
+    CHECK_RETURN(max_size<std::numeric_limits<size_t>::max());
   }
-  return res;
+
+  string_exprt str=fresh_string(ref_type);
+  const typet &char_type=ref_type.get_char_type();
+  exprt radix_as_char=typecast_exprt(radix, char_type);
+  exprt radix_input_type=typecast_exprt(radix, type);
+  const bool strict_formatting=true;
+
+  add_axioms_for_correct_number_format(
+    input_int, str, radix_as_char, radix_ul, max_size, strict_formatting);
+
+  add_axioms_for_characters_in_integer_string(
+    input_int,
+    type,
+    strict_formatting,
+    str,
+    max_size,
+    radix_input_type,
+    radix_ul);
+
+  return str;
 }
 
-/// returns the value represented by the character
-/// \par parameters: a character expression in the following set:
+/// Returns the integer value represented by the character.
+/// \param chr: a character expression in the following set:
 ///   0123456789abcdef
 /// \return an integer expression
-exprt string_constraint_generatort::int_of_hex_char(const exprt &chr) const
+exprt string_constraint_generatort::int_of_hex_char(const exprt &chr)
 {
   exprt zero_char=constant_char('0', chr.type());
   exprt nine_char=constant_char('9', chr.type());
@@ -340,16 +200,17 @@ exprt string_constraint_generatort::int_of_hex_char(const exprt &chr) const
     minus_exprt(chr, zero_char));
 }
 
-/// add axioms stating that the returned string corresponds to the integer
-/// argument written in hexadecimal
-/// \par parameters: one integer argument
+/// Add axioms stating that the returned string corresponds to the integer
+/// argument written in hexadecimal.
+/// \param i: an integer argument
+/// \param ref_type: type of refined string expressions
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_int_hex(
   const exprt &i, const refined_string_typet &ref_type)
 {
   string_exprt res=fresh_string(ref_type);
   const typet &type=i.type();
-  assert(type.id()==ID_signedbv);
+  PRECONDITION(type.id()==ID_signedbv);
   const typet &index_type=ref_type.get_index_type();
   const typet &char_type=ref_type.get_char_type();
   exprt sixteen=from_integer(16, index_type);
@@ -360,9 +221,9 @@ string_exprt string_constraint_generatort::add_axioms_from_int_hex(
   exprt f_char=constant_char('f', char_type);
 
   size_t max_size=8;
-  axioms.push_back(
-    and_exprt(res.axiom_for_is_strictly_longer_than(0),
-              res.axiom_for_is_shorter_than(max_size)));
+  m_axioms.push_back(
+    and_exprt(res.axiom_for_length_gt(0),
+              res.axiom_for_length_le(max_size)));
 
   for(size_t size=1; size<=max_size; size++)
   {
@@ -386,19 +247,19 @@ string_exprt string_constraint_generatort::add_axioms_from_int_hex(
     }
 
     equal_exprt premise(res.axiom_for_has_length(size));
-    axioms.push_back(
+    m_axioms.push_back(
       implies_exprt(premise, and_exprt(equal_exprt(i, sum), all_numbers)));
 
-    // disallow 0s at the beggining
+    // disallow 0s at the beginning
     if(size>1)
-      axioms.push_back(
+      m_axioms.push_back(
         implies_exprt(premise, not_exprt(equal_exprt(res[0], zero_char))));
   }
   return res;
 }
 
 /// add axioms corresponding to the Integer.toHexString(I) java function
-/// \par parameters: function application with integer argument
+/// \param f: function application with an integer argument
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_int_hex(
   const function_application_exprt &f)
@@ -407,8 +268,8 @@ string_exprt string_constraint_generatort::add_axioms_from_int_hex(
   return add_axioms_from_int_hex(args(f, 1)[0], ref_type);
 }
 
-/// add axioms corresponding to the String.valueOf(C) java function
-/// \par parameters: function application one char argument
+/// Add axioms corresponding to the String.valueOf(C) java function.
+/// \param f: function application one char argument
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_char(
   const function_application_exprt &f)
@@ -417,109 +278,443 @@ string_exprt string_constraint_generatort::add_axioms_from_char(
   return add_axioms_from_char(args(f, 1)[0], ref_type);
 }
 
-/// add axioms stating that the returned string has length 1 and the character
-/// it contains correspond to the input expression
-/// \par parameters: one expression of type char
+/// Add axioms stating that the returned string has length 1 and the character
+/// it contains corresponds to the input expression.
+/// \param c: one expression of type char
+/// \param ref_type: type of refined string expressions
 /// \return a new string expression
 string_exprt string_constraint_generatort::add_axioms_from_char(
   const exprt &c, const refined_string_typet &ref_type)
 {
   string_exprt res=fresh_string(ref_type);
   and_exprt lemma(equal_exprt(res[0], c), res.axiom_for_has_length(1));
-  axioms.push_back(lemma);
+  m_axioms.push_back(lemma);
   return res;
 }
 
-/// add axioms corresponding to the String.valueOf([C) and String.valueOf([CII)
-/// functions
-/// \par parameters: function application with one or three arguments
-/// \return a new string expression
-string_exprt string_constraint_generatort::add_axioms_for_value_of(
-  const function_application_exprt &f)
+/// Add axioms making the return value true if the given string is a correct
+/// number in the given radix
+/// \param input_int: the number being represented as a string
+/// \param str: string expression
+/// \param radix_as_char: the radix as an expression of the same type as the
+///   characters in str
+/// \param radix_ul: the radix, which should be between 2 and 36, or 0, in
+///   which case the return value will work for any radix
+/// \param max_size: maximum number of characters
+/// \param strict_formatting: if true, don't allow a leading plus, redundant
+///   zeros or upper case letters
+void string_constraint_generatort::add_axioms_for_correct_number_format(
+  const exprt &input_int,
+  const string_exprt &str,
+  const exprt &radix_as_char,
+  const unsigned long radix_ul,
+  const std::size_t max_size,
+  const bool strict_formatting)
 {
-  const function_application_exprt::argumentst &args=f.arguments();
-  if(args.size()==3)
+  const refined_string_typet &ref_type=to_refined_string_type(str.type());
+  const typet &char_type=ref_type.get_char_type();
+  const typet &index_type=ref_type.get_index_type();
+
+  const exprt &chr=str[0];
+  const equal_exprt starts_with_minus(chr, constant_char('-', char_type));
+  const equal_exprt starts_with_plus(chr, constant_char('+', char_type));
+  const exprt starts_with_digit=
+    is_digit_with_radix(chr, strict_formatting, radix_as_char, radix_ul);
+
+  // |str| > 0
+  const exprt non_empty=str.axiom_for_length_ge(from_integer(1, index_type));
+  m_axioms.push_back(non_empty);
+
+  if(strict_formatting)
   {
-    const refined_string_typet &ref_type=to_refined_string_type(f.type());
-    string_exprt res=fresh_string(ref_type);
-    exprt char_array=args[0];
-    exprt offset=args[1];
-    exprt count=args[2];
-
-    // We add axioms:
-    // a1 : |res| = count
-    // a2 : forall idx<count, str[idx+offset]=res[idx]
-
-    string_exprt str=add_axioms_for_java_char_array(char_array);
-    axioms.push_back(res.axiom_for_has_length(count));
-
-    symbol_exprt idx=fresh_univ_index(
-      "QA_index_value_of", ref_type.get_index_type());
-    equal_exprt eq(str[plus_exprt(idx, offset)], res[idx]);
-    string_constraintt a2(idx, count, eq);
-    axioms.push_back(a2);
-    return res;
+    // str[0] = '-' || is_digit_with_radix(str[0], radix)
+    const or_exprt correct_first(starts_with_minus, starts_with_digit);
+    m_axioms.push_back(correct_first);
   }
   else
   {
-    assert(args.size()==1);
-    return add_axioms_for_java_char_array(args[0]);
+    // str[0] = '-' || str[0] = '+' || is_digit_with_radix(str[0], radix)
+    const or_exprt correct_first(
+      starts_with_minus, starts_with_digit, starts_with_plus);
+    m_axioms.push_back(correct_first);
+  }
+
+  // str[0]='+' or '-' ==> |str| > 1
+  const implies_exprt contains_digit(
+    or_exprt(starts_with_minus, starts_with_plus),
+    str.axiom_for_length_ge(from_integer(2, index_type)));
+  m_axioms.push_back(contains_digit);
+
+  // |str| <= max_size
+  m_axioms.push_back(str.axiom_for_length_le(max_size));
+
+  // forall 1 <= i < |str| . is_digit_with_radix(str[i], radix)
+  // We unfold the above because we know that it will be used for all i up to
+  // str.length(), and str.length() <= max_size
+  for(std::size_t index=1; index<max_size; ++index)
+  {
+    /// index < length => is_digit_with_radix(str[index], radix)
+    const implies_exprt character_at_index_is_digit(
+      str.axiom_for_length_ge(from_integer(index+1, index_type)),
+      is_digit_with_radix(
+        str[index], strict_formatting, radix_as_char, radix_ul));
+    m_axioms.push_back(character_at_index_is_digit);
+  }
+
+  if(strict_formatting)
+  {
+    const exprt zero_char=constant_char('0', char_type);
+
+    // no_leading_zero : str[0] = '0' => |str| = 1
+    const implies_exprt no_leading_zero(
+      equal_exprt(chr, zero_char),
+      str.axiom_for_has_length(from_integer(1, index_type)));
+    m_axioms.push_back(no_leading_zero);
+
+    // no_leading_zero_after_minus : str[0]='-' => str[1]!='0'
+    implies_exprt no_leading_zero_after_minus(
+      starts_with_minus, not_exprt(equal_exprt(str[1], zero_char)));
+    m_axioms.push_back(no_leading_zero_after_minus);
+  }
+}
+
+/// Add axioms connecting the characters in the input string to the value of the
+/// output integer. It is constructive because it gives a formula for input_int
+/// in terms of the characters in str.
+/// \param input_int: the integer represented by str
+/// \param type: the type for input_int
+/// \param str: input string
+/// \param max_string_length: the maximum length str can have
+/// \param radix: the radix, with the same type as input_int
+/// \param radix_ul: the radix as an unsigned long, or 0 if that can't be
+///   determined
+/// \param strict_formatting: if true, don't allow a leading plus, redundant
+///   zeros or upper case letters
+void string_constraint_generatort::add_axioms_for_characters_in_integer_string(
+  const exprt &input_int,
+  const typet &type,
+  const bool strict_formatting,
+  const string_exprt &str,
+  const std::size_t max_string_length,
+  const exprt &radix,
+  const unsigned long radix_ul)
+{
+  const refined_string_typet &ref_type=to_refined_string_type(str.type());
+  const typet &char_type=ref_type.get_char_type();
+
+  const equal_exprt starts_with_minus(str[0], constant_char('-', char_type));
+  const constant_exprt zero_expr=from_integer(0, type);
+  exprt::operandst digit_constraints;
+
+  exprt sum=get_numeric_value_from_character(
+    str[0], char_type, type, strict_formatting, radix_ul);
+
+  /// Deal with size==1 case separately. There are axioms from
+  /// add_axioms_for_correct_number_format which say that the string must
+  /// contain at least one digit, so we don't have to worry about "+" or "-".
+  m_axioms.push_back(
+    implies_exprt(str.axiom_for_has_length(1), equal_exprt(input_int, sum)));
+
+  for(size_t size=2; size<=max_string_length; size++)
+  {
+    // sum_0 := numeric value of res[0] (which is 0 if res[0] is '-')
+    // For each 1<=j<max_string_length, we have:
+    // sum_j := radix * sum_{j-1} + numeric value of res[j]
+    // no_overflow_j := sum_{j-1} == (radix * sum_{j-1} / radix)
+    //                  && sum_j >= sum_{j - 1}
+    //   (the first part avoid overflows in the multiplication and the second
+    //     one in the addition of the definition of sum_j)
+    // For all 1<=size<=max_string_length we add axioms:
+    // a5 : |res| == size =>
+    //        forall max_string_length-2 <= j < size. no_overflow_j
+    // a6 : |res| == size && res[0] is a digit for radix =>
+    //        input_int == sum_{size-1}
+    // a7 : |res| == size && res[0] == '-' => input_int == -sum_{size-1}
+
+    const mult_exprt radix_sum(sum, radix);
+    // new_sum = radix * sum + (numeric value of res[j])
+    const exprt new_sum=plus_exprt(
+      radix_sum,
+      get_numeric_value_from_character(
+        str[size-1], char_type, type, strict_formatting, radix_ul));
+
+    // An overflow can happen when reaching the last index which can contain
+    // a digit, which is `max_string_length - 2` because of the space left for
+    // a minus sign. That assumes that we were able to identify the radix. If we
+    // weren't then we check for overflow on every index.
+    if(size-1>=max_string_length-2 || radix_ul==0)
+    {
+      const and_exprt no_overflow(
+        equal_exprt(sum, div_exprt(radix_sum, radix)),
+        binary_relation_exprt(new_sum, ID_ge, radix_sum));
+      digit_constraints.push_back(no_overflow);
+    }
+    sum=new_sum;
+
+    const equal_exprt premise=str.axiom_for_has_length(size);
+
+    if(!digit_constraints.empty())
+    {
+      const implies_exprt a5(premise, conjunction(digit_constraints));
+      m_axioms.push_back(a5);
+    }
+
+    const implies_exprt a6(
+      and_exprt(premise, not_exprt(starts_with_minus)),
+      equal_exprt(input_int, sum));
+    m_axioms.push_back(a6);
+
+    const implies_exprt a7(
+      and_exprt(premise, starts_with_minus),
+      equal_exprt(input_int, unary_minus_exprt(sum)));
+    m_axioms.push_back(a7);
   }
 }
 
 /// add axioms corresponding to the Integer.parseInt java function
-/// \par parameters: function application with one string expression
+/// \param f: a function application with either one string expression or one
+///   string expression and an integer expression for the radix
 /// \return an integer expression
 exprt string_constraint_generatort::add_axioms_for_parse_int(
   const function_application_exprt &f)
 {
-  string_exprt str=add_axioms_for_string_expr(args(f, 1)[0]);
+  PRECONDITION(f.arguments().size()==1 || f.arguments().size()==2);
+  const string_exprt str=get_string_expr(f.arguments()[0]);
   const typet &type=f.type();
-  symbol_exprt i=fresh_symbol("parsed_int", type);
+  PRECONDITION(type.id()==ID_signedbv);
+  const exprt radix=f.arguments().size()==1?
+    static_cast<exprt>(from_integer(10, type)):
+    static_cast<exprt>(typecast_exprt(f.arguments()[1], type));
+  /// Most of the time we can evaluate radix as an integer. The value 0 is used
+  /// to indicate when we can't tell what the radix is.
+  const unsigned long radix_ul=to_integer_or_default(radix, 0);
+  PRECONDITION((radix_ul>=2 && radix_ul<=36) || radix_ul==0);
+
+  const symbol_exprt input_int=fresh_symbol("parsed_int", type);
   const refined_string_typet &ref_type=to_refined_string_type(str.type());
   const typet &char_type=ref_type.get_char_type();
-  exprt zero_char=constant_char('0', char_type);
-  exprt minus_char=constant_char('-', char_type);
-  exprt plus_char=constant_char('+', char_type);
-  assert(type.id()==ID_signedbv);
-  exprt ten=from_integer(10, type);
+  const typecast_exprt radix_as_char(radix, char_type);
+  const bool strict_formatting=false;
+
+  const std::size_t max_string_length=max_printed_string_length(type, radix_ul);
+
+  /// TODO: we should throw an exception when this does not hold:
+  /// Note that the only thing stopping us from taking longer strings with many
+  /// leading zeros is the axioms for correct number format
+  add_axioms_for_correct_number_format(
+    input_int,
+    str,
+    radix_as_char,
+    radix_ul,
+    max_string_length,
+    strict_formatting);
+
+  add_axioms_for_characters_in_integer_string(
+    input_int,
+    type,
+    strict_formatting,
+    str,
+    max_string_length,
+    radix,
+    radix_ul);
+
+  return input_int;
+}
+
+/// If the expression is a constant expression then we get the value of it as
+/// an unsigned long. If not we return a default value.
+/// \param expr: input expression
+/// \param def: default value to return if we cannot evaluate expr
+/// \return the output as an unsigned long
+unsigned long string_constraint_generatort::to_integer_or_default(
+  const exprt &expr, unsigned long def)
+{
+  mp_integer mp_radix;
+  bool to_integer_failed=to_integer(simplify_expr(expr, m_ns), mp_radix);
+  return to_integer_failed?def:integer2ulong(mp_radix);
+}
 
-  exprt chr=str[0];
-  exprt starts_with_minus=equal_exprt(chr, minus_char);
-  exprt starts_with_plus=equal_exprt(chr, plus_char);
-  exprt starts_with_digit=binary_relation_exprt(chr, ID_ge, zero_char);
+/// Check if a character is a digit with respect to the given radix, e.g. if the
+/// radix is 10 then check if the character is in the range 0-9.
+/// \param chr: the character
+/// \param strict_formatting: if true, don't allow upper case characters
+/// \param radix_as_char:  the radix as an expression of the same type as chr
+/// \param radix_ul: the radix, which should be between 2 and 36, or 0, in
+///   which case the return value will work for any radix
+/// \return an expression for the condition
+exprt is_digit_with_radix(
+  const exprt &chr,
+  const bool strict_formatting,
+  const exprt &radix_as_char,
+  const unsigned long radix_ul)
+{
+  PRECONDITION((radix_ul>=2 && radix_ul<=36) || radix_ul==0);
+  const typet &char_type=chr.type();
+  const exprt zero_char=from_integer('0', char_type);
+
+  const and_exprt is_digit_when_radix_le_10(
+    binary_relation_exprt(chr, ID_ge, zero_char),
+    binary_relation_exprt(
+      chr, ID_lt, plus_exprt(zero_char, radix_as_char)));
 
-  for(unsigned size=1; size<=10; size++)
+  if(radix_ul<=10 && radix_ul!=0)
   {
-    exprt sum=from_integer(0, type);
-    exprt first_value=typecast_exprt(minus_exprt(chr, zero_char), type);
+    return is_digit_when_radix_le_10;
+  }
+  else
+  {
+    const exprt nine_char=from_integer('9', char_type);
+    const exprt a_char=from_integer('a', char_type);
+    const constant_exprt ten_char_type=from_integer(10, char_type);
+
+    const minus_exprt radix_minus_ten(radix_as_char, ten_char_type);
+
+    or_exprt is_digit_when_radix_gt_10(
+      and_exprt(
+        binary_relation_exprt(chr, ID_ge, zero_char),
+        binary_relation_exprt(chr, ID_le, nine_char)),
+      and_exprt(
+        binary_relation_exprt(chr, ID_ge, a_char),
+        binary_relation_exprt(
+          chr, ID_lt, plus_exprt(a_char, radix_minus_ten))));
+
+    if(!strict_formatting)
+    {
+      exprt A_char=from_integer('A', char_type);
+      is_digit_when_radix_gt_10.copy_to_operands(
+        and_exprt(
+          binary_relation_exprt(chr, ID_ge, A_char),
+          binary_relation_exprt(
+            chr, ID_lt, plus_exprt(A_char, radix_minus_ten))));
+    }
 
-    for(unsigned j=1; j<size; j++)
+    if(radix_ul==0)
     {
-      sum=plus_exprt(
-        mult_exprt(sum, ten),
-        typecast_exprt(minus_exprt(str[j], zero_char), type));
-      first_value=mult_exprt(first_value, ten);
+      return if_exprt(
+        binary_relation_exprt(radix_as_char, ID_le, ten_char_type),
+        is_digit_when_radix_le_10,
+        is_digit_when_radix_gt_10);
     }
+    else
+    {
+      return is_digit_when_radix_gt_10;
+    }
+  }
+}
 
-    // If the length is `size`, we add axioms:
-    // a1 : starts_with_digit => i=sum+first_value
-    // a2 : starts_with_plus => i=sum
-    // a3 : starts_with_minus => i=-sum
+/// Get the numeric value of a character, assuming that the radix is large
+/// enough. '+' and '-' yield 0.
+/// \param chr: the character to get the numeric value of
+/// \param char_type: the type to use for characters
+/// \param type: the type to use for the return value
+/// \param strict_formatting: if true, don't allow upper case characters
+/// \param radix_ul: the radix, which should be between 2 and 36, or 0, in
+///   which case the return value will work for any radix
+/// \return an integer expression of the given type with the numeric value of
+///   the char
+exprt get_numeric_value_from_character(
+  const exprt &chr,
+  const typet &char_type,
+  const typet &type,
+  const bool strict_formatting,
+  const unsigned long radix_ul)
+{
+  const constant_exprt zero_char=from_integer('0', char_type);
 
-    equal_exprt premise=str.axiom_for_has_length(size);
-    implies_exprt a1(
-      and_exprt(premise, starts_with_digit),
-      equal_exprt(i, plus_exprt(sum, first_value)));
-    axioms.push_back(a1);
+  /// There are four cases, which occur in ASCII in the following order:
+  /// '+' and '-', digits, upper case letters, lower case letters
+  const binary_relation_exprt upper_case_lower_case_or_digit(
+    chr, ID_ge, zero_char);
 
-    implies_exprt a2(and_exprt(premise, starts_with_plus), equal_exprt(i, sum));
-    axioms.push_back(a2);
+  if(radix_ul<=10 && radix_ul!=0)
+  {
+    /// return char >= '0' ? (char - '0') : 0
+    return typecast_exprt(
+      if_exprt(
+        upper_case_lower_case_or_digit,
+        minus_exprt(chr, zero_char),
+        from_integer(0, char_type)),
+      type);
+  }
+  else
+  {
+    const constant_exprt a_char=from_integer('a', char_type);
+    const binary_relation_exprt lower_case(chr, ID_ge, a_char);
+    const constant_exprt A_char=from_integer('A', char_type);
+    const binary_relation_exprt upper_case_or_lower_case(chr, ID_ge, A_char);
+    const constant_exprt ten_int=from_integer(10, char_type);
 
-    implies_exprt a3(
-      and_exprt(premise, starts_with_minus),
-      equal_exprt(i, unary_minus_exprt(sum)));
-    axioms.push_back(a3);
+    if(strict_formatting)
+    {
+      /// return char >= 'a' ? (char - 'a' + 10) :
+      ///   char >= '0' ? (char - '0') : 0
+      return typecast_exprt(
+        if_exprt(
+          lower_case,
+          plus_exprt(minus_exprt(chr, a_char), ten_int),
+          if_exprt(
+            upper_case_lower_case_or_digit,
+            minus_exprt(chr, zero_char),
+            from_integer(0, char_type))),
+        type);
+    }
+    else
+    {
+      /// return char >= 'a' ? (char - 'a' + 10) :
+      ///   char >= 'A' ? (char - 'A' + 10) :
+      ///     char >= '0' ? (char - '0') : 0
+      return typecast_exprt(
+        if_exprt(
+          lower_case,
+          plus_exprt(minus_exprt(chr, a_char), ten_int),
+          if_exprt(
+            upper_case_or_lower_case,
+            plus_exprt(minus_exprt(chr, A_char), ten_int),
+            if_exprt(
+              upper_case_lower_case_or_digit,
+              minus_exprt(chr, zero_char),
+              from_integer(0, char_type)))),
+        type);
+    }
+  }
+}
+
+/// Calculate the string length needed to represent any value of the given type
+/// using the given radix. Due to floating point rounding errors we sometimes
+/// return a value 1 larger than needed, which is fine for our purposes.
+/// \param type: the type that we are considering values of
+/// \param radix_ul: the radix we are using, or 0, in which case the return
+///   value will work for any radix
+/// \return the maximum string length
+size_t max_printed_string_length(const typet &type, unsigned long radix_ul)
+{
+  if(radix_ul==0)
+  {
+    radix_ul=2;
   }
-  return i;
+  double n_bits=static_cast<double>(to_bitvector_type(type).get_width());
+  double radix=static_cast<double>(radix_ul);
+  bool signed_type=type.id()==ID_signedbv;
+  /// We want to calculate max, the maximum number of characters needed to
+  /// represent any value of the given type.
+  ///
+  /// For signed types, the longest string will be for -2^(n_bits-1), so
+  /// max = 1 + min{k: 2^(n_bits-1) < radix^k} (the 1 is for the minus sign)
+  ///     = 1 + min{k: n_bits-1 < k log_2(radix)}
+  ///     = 1 + min{k: k > (n_bits-1) / log_2(radix)}
+  ///     = 1 + min{k: k > floor((n_bits-1) / log_2(radix))}
+  ///     = 1 + (1 + floor((n_bits-1) / log_2(radix)))
+  ///     = 2 + floor((n_bits-1) / log_2(radix))
+  ///
+  /// For unsigned types, the longest string will be for (2^n_bits)-1, so
+  /// max = min{k: (2^n_bits)-1 < radix^k}
+  ///     = min{k: 2^n_bits <= radix^k}
+  ///     = min{k: n_bits <= k log_2(radix)}
+  ///     = min{k: k >= n_bits / log_2(radix)}
+  ///     = min{k: k >= ceil(n_bits / log_2(radix))}
+  ///     = ceil(n_bits / log_2(radix))
+  double max=signed_type?
+    floor(static_cast<double>(n_bits-1)/log2(radix))+2.0:
+    ceil(static_cast<double>(n_bits)/log2(radix));
+  return static_cast<size_t>(max);
 }
diff --git a/src/solvers/refinement/string_constraint_instantiation.cpp b/src/solvers/refinement/string_constraint_instantiation.cpp
new file mode 100644
index 00000000000..ca3a63861a2
--- /dev/null
+++ b/src/solvers/refinement/string_constraint_instantiation.cpp
@@ -0,0 +1,71 @@
+/*******************************************************************\
+
+Module: Defines functions related to string constraints.
+
+Author: Jesse Sigal, jesse.sigal@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Defines related function for string constraints.
+
+#include <solvers/refinement/string_constraint_instantiation.h>
+
+#include <solvers/refinement/string_constraint.h>
+#include <solvers/refinement/string_constraint_generator.h>
+#include <solvers/refinement/string_refinement.h>
+
+/// Instantiates a quantified formula representing `not_contains` by
+/// substituting the quantifiers and generating axioms.
+/// \related string_refinementt
+/// \param [in] axiom: the axiom to instantiate
+/// \param [in] index_set0: the index set for `axiom.s0()`
+/// \param [in] index_set1: the index set for `axiom.s1()`
+/// \param [in] generator: generator to be used to get `axiom`'s witness
+/// \return the lemmas produced through instantiation
+std::vector<exprt> instantiate_not_contains(
+  const string_not_contains_constraintt &axiom,
+  const std::set<exprt> &index_set0,
+  const std::set<exprt> &index_set1,
+  const string_constraint_generatort &generator)
+{
+  std::vector<exprt> lemmas;
+
+  const string_exprt s0=to_string_expr(axiom.s0());
+  const string_exprt s1=to_string_expr(axiom.s1());
+
+  for(const auto &i0 : index_set0)
+    for(const auto &i1 : index_set1)
+    {
+      const minus_exprt val(i0, i1);
+      const exprt witness=generator.get_witness_of(axiom, val);
+      const and_exprt prem_and_is_witness(
+        axiom.premise(),
+        equal_exprt(witness, i1));
+
+      const not_exprt differ(equal_exprt(s0[i0], s1[i1]));
+      const implies_exprt lemma(prem_and_is_witness, differ);
+      lemmas.push_back(lemma);
+
+      // we put bounds on the witnesses:
+      // 0 <= v <= |s0| - |s1| ==> 0 <= v+w[v] < |s0| && 0 <= w[v] < |s1|
+      const exprt zero=from_integer(0, val.type());
+      const binary_relation_exprt c1(zero, ID_le, plus_exprt(val, witness));
+      const binary_relation_exprt c2(
+        s0.length(), ID_gt, plus_exprt(val, witness));
+      const binary_relation_exprt c3(s1.length(), ID_gt, witness);
+      const binary_relation_exprt c4(zero, ID_le, witness);
+
+      const minus_exprt diff(s0.length(), s1.length());
+
+      const and_exprt premise(
+        binary_relation_exprt(zero, ID_le, val),
+        binary_relation_exprt(diff, ID_ge, val));
+      const implies_exprt witness_bounds(
+        premise,
+        and_exprt(and_exprt(c1, c2), and_exprt(c3, c4)));
+      lemmas.push_back(witness_bounds);
+    }
+
+  return lemmas;
+}
diff --git a/src/solvers/refinement/string_constraint_instantiation.h b/src/solvers/refinement/string_constraint_instantiation.h
new file mode 100644
index 00000000000..f4918e7e8d9
--- /dev/null
+++ b/src/solvers/refinement/string_constraint_instantiation.h
@@ -0,0 +1,24 @@
+/*******************************************************************\
+
+Module: Defines related function for string constraints.
+
+Author: Jesse Sigal, jesse.sigal@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Defines related function for string constraints.
+
+#ifndef CPROVER_SOLVERS_REFINEMENT_STRING_CONSTRAINT_INSTANTIATION_H
+#define CPROVER_SOLVERS_REFINEMENT_STRING_CONSTRAINT_INSTANTIATION_H
+
+#include <solvers/refinement/string_constraint.h>
+#include <solvers/refinement/string_constraint_generator.h>
+
+std::vector<exprt> instantiate_not_contains(
+  const string_not_contains_constraintt &axiom,
+  const std::set<exprt> &index_set0,
+  const std::set<exprt> &index_set1,
+  const string_constraint_generatort &generator);
+
+#endif // CPROVER_SOLVERS_REFINEMENT_STRING_CONSTRAINT_INSTANTIATION_H
diff --git a/src/solvers/refinement/string_refinement.cpp b/src/solvers/refinement/string_refinement.cpp
index 34e3217e27a..608b70212aa 100644
--- a/src/solvers/refinement/string_refinement.cpp
+++ b/src/solvers/refinement/string_refinement.cpp
@@ -20,41 +20,85 @@ Author: Alberto Griggio, alberto.griggio@gmail.com
 #include <solvers/refinement/string_refinement.h>
 
 #include <sstream>
+#include <iomanip>
+#include <stack>
 #include <ansi-c/string_constant.h>
 #include <util/cprover_prefix.h>
+#include <util/expr_iterator.h>
 #include <util/replace_expr.h>
+#include <util/refined_string_type.h>
+#include <util/simplify_expr.h>
 #include <solvers/sat/satcheck.h>
+#include <solvers/refinement/string_refinement_invariant.h>
+#include <solvers/refinement/string_constraint_instantiation.h>
 #include <langapi/language_util.h>
+#include <java_bytecode/java_types.h>
 
-string_refinementt::string_refinementt(
-  const namespacet &_ns, propt &_prop, unsigned refinement_bound):
-  supert(_ns, _prop),
-  use_counter_example(false),
-  initial_loop_bound(refinement_bound)
-{ }
+static bool validate(const string_refinementt::infot &info)
+{
+  PRECONDITION(info.ns);
+  PRECONDITION(info.prop);
+  return true;
+}
+
+static bv_refinementt::infot bv_refinement_info(
+  const string_refinementt::infot &in)
+{
+  bv_refinementt::infot out;
+  out.ns=in.ns;
+  out.prop=in.prop;
+  out.ui=in.ui;
+  out.max_node_refinement=in.max_node_refinement;
+  out.refine_arrays=in.refine_arrays;
+  out.refine_arithmetic=in.refine_arithmetic;
+  return out;
+}
 
-/// determine which language should be used
-void string_refinementt::set_mode()
+static string_constraint_generatort::infot
+generator_info(const string_refinementt::infot &in)
 {
-  debug() << "initializing mode" << eom;
-  symbolt init=ns.lookup(irep_idt(CPROVER_PREFIX"initialize"));
-  irep_idt mode=init.mode;
-  debug() << "mode detected as " << mode << eom;
-  generator.set_mode(mode);
+  string_constraint_generatort::infot out;
+  out.ns=in.ns;
+  out.string_max_length=in.string_max_length;
+  out.string_printable=in.string_printable;
+  return out;
 }
 
+string_refinementt::string_refinementt(const infot &info, bool):
+  supert(bv_refinement_info(info)),
+  use_counter_example(false),
+  do_concretizing(info.trace),
+  initial_loop_bound(info.refinement_bound),
+  generator(generator_info(info)),
+  non_empty_string(info.string_non_empty) { }
+
+string_refinementt::string_refinementt(const infot &info):
+  string_refinementt(info, validate(info)) { }
+
 /// display the current index set, for debugging
 void string_refinementt::display_index_set()
 {
+  std::size_t count=0;
+  std::size_t count_current=0;
   for(const auto &i : index_set)
   {
     const exprt &s=i.first;
-    debug() << "IS(" << from_expr(s) << ")=={";
+    debug() << "IS(" << from_expr(ns, "", s) << ")=={" << eom;
 
     for(auto j : i.second)
-      debug() << from_expr(j) << "; ";
+    {
+      if(current_index_set[i.first].find(j)!=current_index_set[i.first].end())
+      {
+        count_current++;
+        debug() << "**";
+      }
+      debug() << "  " << from_expr(ns, "", j) << ";" << eom;
+      count++;
+    }
     debug() << "}"  << eom;
   }
+  debug() << count << " elements in index set (" << count_current
+          << " newly added)" << eom;
 }
 
 /// compute the index set for all formulas, instantiate the formulas with the
@@ -66,136 +110,381 @@ void string_refinementt::add_instantiations()
   for(const auto &i : current_index_set)
   {
     const exprt &s=i.first;
-    debug() << "IS(" << from_expr(s) << ")=={";
+    debug() << "IS(" << from_expr(ns, "", s) << ")=={";
 
     for(const auto &j : i.second)
-      debug() << from_expr(j) << "; ";
+      debug() << from_expr(ns, "", j) << "; ";
     debug() << "}"  << eom;
 
-    for(const auto &j : i.second)
+    for(const auto &ua : universal_axioms)
     {
-      const exprt &val=j;
-
-      for(const auto &ua : universal_axioms)
+      for(const auto &j : i.second)
       {
-        exprt lemma=instantiate(ua, s, val);
+        exprt lemma=instantiate(ua, s, j);
         add_lemma(lemma);
       }
     }
   }
 }
 
-/// if the expression is a function application, we convert it using our own
-/// convert_function_application method
-/// \par parameters: an expression
-/// \return a literal
-literalt string_refinementt::convert_rest(const exprt &expr)
+/// List the simple expressions on which the expression depends in the
+/// `symbol_resolve` map. A simple expression is either a symbol or a
+/// constant array
+/// \param expr: an expression
+static void depends_in_symbol_map(const exprt &expr, std::vector<exprt> &accu)
 {
-  if(expr.id()==ID_function_application)
+  if(expr.id()==ID_if)
+  {
+    if_exprt if_expr=to_if_expr(expr);
+    depends_in_symbol_map(if_expr.true_case(), accu);
+    depends_in_symbol_map(if_expr.false_case(), accu);
+  }
+  else if(expr.id()==ID_struct)
   {
-    // can occur in __CPROVER_assume
-    bvt bv=convert_function_application(to_function_application_expr(expr));
-    assert(bv.size()==1);
-    return bv[0];
+    string_exprt str=to_string_expr(expr);
+    depends_in_symbol_map(str.content(), accu);
   }
   else
   {
-    return supert::convert_rest(expr);
+    INVARIANT(
+      expr.id()==ID_symbol || expr.id()==ID_array || expr.id()==ID_array_of,
+      "leaf in symbol resolve should be a symbol or a constant array");
+    accu.push_back(expr);
   }
 }
 
-/// if the expression as string type, look up for the string in the list of
-/// string symbols that we maintain, and convert it; otherwise use the method of
-/// the parent class
-/// \par parameters: an expression
-/// \return a bitvector
-bvt string_refinementt::convert_symbol(const exprt &expr)
+/// keeps a map of symbols to expressions, such as none of the mapped values
+/// exist as a key
+/// \param lhs: a symbol expression
+/// \param rhs: an expression to map it to, which should be either a symbol
+///             a string_exprt, an array_exprt, an array_of_exprt or an
+///             if_exprt with branches of the previous kind
+void string_refinementt::add_symbol_to_symbol_map(
+  const exprt &lhs, const exprt &rhs)
 {
-  const typet &type=expr.type();
-  const irep_idt &identifier=expr.get(ID_identifier);
-  assert(!identifier.empty());
-
-  if(refined_string_typet::is_unrefined_string_type(type))
+  PRECONDITION(lhs.id()==ID_symbol);
+  PRECONDITION(rhs.id()==ID_symbol ||
+               rhs.id()==ID_array ||
+               rhs.id()==ID_array_of ||
+               rhs.id()==ID_if ||
+               (rhs.id()==ID_struct &&
+                is_refined_string_type(rhs.type())));
+
+  // We insert the mapped value of the rhs, if it exists.
+  auto it=symbol_resolve.find(rhs);
+  const exprt &new_rhs=it!=symbol_resolve.end()?it->second:rhs;
+  symbol_resolve[lhs]=new_rhs;
+
+  // List the leaves of new_rhs
+  std::vector<exprt> leaves;
+  depends_in_symbol_map(new_rhs, leaves);
+
+  const auto &symbols_to_update_with_new_rhs=reverse_symbol_resolve[lhs];
+
+  // We need to update all the symbols which depend on lhs
+  for(const exprt &item : symbols_to_update_with_new_rhs)
+    replace_expr(symbol_resolve, symbol_resolve[item]);
+
+  // Every time a symbol at the leaves is updated we need to update lhs
+  // and the symbols that depend on it
+  for(const auto &leaf : leaves)
   {
-    string_exprt str=
-      generator.find_or_add_string_of_symbol(to_symbol_expr(expr));
-    bvt bv=convert_bv(str);
-    return bv;
+    reverse_symbol_resolve[leaf].push_back(lhs);
+    for(const exprt &item : symbols_to_update_with_new_rhs)
+      reverse_symbol_resolve[leaf].push_back(item);
   }
-  else
-    return supert::convert_symbol(expr);
 }
 
-/// generate an expression, add lemmas stating that this expression corresponds
-/// to the result of the given function call, and convert this expression
-/// \par parameters: a function_application
-/// \return a bitvector
-bvt string_refinementt::convert_function_application
-(const function_application_exprt &expr)
+/// add axioms if the rhs is a character array
+/// \par parameters: the rhs and lhs of an equality over character arrays
+void string_refinementt::set_char_array_equality(
+  const exprt &lhs, const exprt &rhs)
 {
-  debug() << "string_refinementt::convert_function_application "
-          << from_expr(expr) << eom;
-  exprt f=generator.add_axioms_for_function_application(expr);
-  return convert_bv(f);
+  PRECONDITION(lhs.id()==ID_symbol);
+
+  if(rhs.id()==ID_array && rhs.type().id()==ID_array)
+  {
+    const typet &index_type=to_array_type(rhs.type()).size().type();
+    for(size_t i=0, ilim=rhs.operands().size(); i!=ilim; ++i)
+    {
+      // Introduce axioms to map symbolic rhs to its char array.
+      index_exprt arraycell(rhs, from_integer(i, index_type));
+      equal_exprt arrayeq(arraycell, rhs.operands()[i]);
+      add_lemma(arrayeq, false);
+    }
+  }
+  // At least for Java (as it is currently pre-processed), we need not consider
+  // other cases, because all character arrays find themselves on the rhs of an
+  // equality. Note that this might not be the case for other languages.
 }
 
-/// add lemmas to the solver corresponding to the given equation
-/// \par parameters: an equality expression
-/// \return a Boolean flag to signal a proble
-bool string_refinementt::boolbv_set_equality_to_true(const equal_exprt &expr)
+/// remove functions applications and create the necessary axioms
+/// \par parameters: an expression containing function applications
+/// \return an expression containing no function application
+exprt string_refinementt::substitute_function_applications(exprt expr)
 {
-  if(!equality_propagation)
-    return true;
+  for(size_t i=0; i<expr.operands().size(); ++i)
+  {
+    // TODO: only copy when necessary
+    exprt op(expr.operands()[i]);
+    expr.operands()[i]=substitute_function_applications(op);
+  }
+
+  if(expr.id()==ID_function_application)
+  {
+    function_application_exprt f=to_function_application_expr(expr);
+    return generator.add_axioms_for_function_application(f);
+  }
+
+  return expr;
+}
 
-  // We should not do that everytime, but I cannot find
-  // another good entry point
-  if(generator.get_mode()==ID_unknown)
-    set_mode();
+/// distinguish char array from other types
+///
+/// TODO: this is only for java char array and does not work for other languages
+/// \param type: a type
+/// \return true if the given type is an array of java characters
+bool string_refinementt::is_char_array(const typet &type) const
+{
+  if(type.id()==ID_symbol)
+    return is_char_array(ns.follow(type));
 
-  typet type=ns.follow(expr.lhs().type());
+  return (type.id()==ID_array && type.subtype()==java_char_type());
+}
 
-  if(expr.lhs().id()==ID_symbol &&
-     // We can have affectation of string from StringBuilder or CharSequence
-     // type==ns.follow(expr.rhs().type()) &&
-     type.id()!=ID_bool)
+/// add lemmas to the solver corresponding to the given equation
+/// \param lhs: left hand side of an equality expression
+/// \param rhs: right and side of the equality
+/// \return true if the assignemnt needs to be handled by the parent class
+///         via `set_to`
+bool string_refinementt::add_axioms_for_string_assigns(
+  const exprt &lhs, const exprt &rhs)
+{
+  if(is_char_array(rhs.type()))
   {
-    debug() << "string_refinementt " << from_expr(expr.lhs()) << " <- "
-            << from_expr(expr.rhs()) << eom;
+    set_char_array_equality(lhs, rhs);
+    if(rhs.id() == ID_symbol || rhs.id() == ID_array)
+    {
+      add_symbol_to_symbol_map(lhs, rhs);
+      return false;
+    }
+    else if(rhs.id()==ID_nondet_symbol)
+    {
+      add_symbol_to_symbol_map(
+        lhs, generator.fresh_symbol("nondet_array", lhs.type()));
+      return false;
+    }
+    else if(rhs.id()==ID_if)
+    {
+      add_symbol_to_symbol_map(lhs, rhs);
+      return true;
+    }
+    else
+    {
+      warning() << "ignoring char array " << from_expr(ns, "", rhs) << eom;
+      return true;
+    }
+  }
+  if(is_refined_string_type(rhs.type()))
+  {
+    exprt refined_rhs=generator.add_axioms_for_refined_string(rhs);
+    add_symbol_to_symbol_map(lhs, refined_rhs);
+    return false;
+  }
+  // Other cases are to be handled by supert::set_to.
+  return true;
+}
+
+/// Convert exprt to a specific type. Throw bad_cast if conversion
+/// cannot be performed
+/// Generic case doesn't exist, specialize for different types accordingly
+/// TODO: this should go to util
+template<typename T>
+T expr_cast(const exprt&);
 
+template<>
+std::size_t expr_cast<std::size_t>(const exprt& val_expr)
+{
+  mp_integer val_mb;
+  if(to_integer(val_expr, val_mb))
+    throw std::bad_cast();
+  if(!val_mb.is_long())
+    throw std::bad_cast();
+  if(val_mb<0)
+    throw std::bad_cast();
+  return val_mb.to_long();
+}
 
-    if(expr.rhs().id()==ID_typecast)
+/// If the expression is of type string, then adds constants to the index set to
+/// force the solver to pick concrete values for each character, and fill the
+/// maps `found_length` and `found_content`.
+///
+/// The way this is done is by looking for the length of the string,
+/// then for each `i` in the index set, look at the value found by
+/// the solver and put it in the `result` table.
+/// For indexes that are not present in the index set, we put the
+/// same value as the next index that is present in the index set.
+/// We do so by traversing the array backward, remembering the
+/// last value that has been initialized.
+void string_refinementt::concretize_string(const exprt &expr)
+{
+  if(is_refined_string_type(expr.type()))
+  {
+    const string_exprt str=to_string_expr(expr);
+    const exprt length=get(str.length());
+    exprt content=str.content();
+    replace_expr(symbol_resolve, content);
+    found_length[content]=length;
+    const auto string_length=expr_cast<std::size_t>(length);
+    INVARIANT(
+      string_length<=generator.max_string_length,
+      string_refinement_invariantt("string length must be less than the max "
+        "length"));
+    if(index_set[str.content()].empty())
+      return;
+
+    std::map<std::size_t, exprt> map;
+
+    for(const auto &i : index_set[str.content()])
     {
-      exprt uncast=to_typecast_expr(expr.rhs()).op();
-      if(refined_string_typet::is_unrefined_string_type(uncast.type()))
+      const exprt simple_i=simplify_expr(get(i), ns);
+      mp_integer mpi_index;
+      bool conversion_failure=to_integer(simple_i, mpi_index);
+      if(!conversion_failure && mpi_index>=0 && mpi_index<string_length)
       {
-        debug() << "(sr) detected casted string" << eom;
-        symbol_exprt sym=to_symbol_expr(expr.lhs());
-        generator.set_string_symbol_equal_to_expr(sym, uncast);
-        return false;
+        const exprt str_i=simplify_expr(str[simple_i], ns);
+        const exprt value=simplify_expr(get(str_i), ns);
+        std::size_t index=mpi_index.to_long();
+        map.emplace(index, value);
+      }
+      else
+      {
+        debug() << "concretize_string: ignoring out of bound index: "
+                << from_expr(ns, "", simple_i) << eom;
       }
     }
+    array_exprt arr(to_array_type(content.type()));
+    arr.operands()=fill_in_map_as_vector(map);
+    debug() << "Concretized " << from_expr(ns, "", str.content())
+            << " = " << from_expr(ns, "", arr) << eom;
+    found_content[content]=arr;
+  }
+}
+
+/// For each string whose length has been solved, add constants to the index set
+/// to force the solver to pick concrete values for each character, and fill the
+/// map `found_length`
+void string_refinementt::concretize_results()
+{
+  for(const auto &it : symbol_resolve)
+    concretize_string(it.second);
+  for(const auto &it : generator.get_created_strings())
+    concretize_string(it);
+  add_instantiations();
+}
 
-    if(refined_string_typet::is_unrefined_string_type(type))
+/// For each string whose length has been solved, add constants to the map
+/// `found_length`
+void string_refinementt::concretize_lengths()
+{
+  for(const auto &it : symbol_resolve)
+  {
+    if(is_refined_string_type(it.second.type()))
     {
-      symbol_exprt sym=to_symbol_expr(expr.lhs());
-      generator.set_string_symbol_equal_to_expr(sym, expr.rhs());
-      return false;
+      string_exprt str=to_string_expr(it.second);
+      exprt length=get(str.length());
+      exprt content=str.content();
+      replace_expr(symbol_resolve, content);
+      found_length[content]=length;
+     }
+  }
+  for(const auto &it : generator.get_created_strings())
+  {
+    if(is_refined_string_type(it.type()))
+    {
+      string_exprt str=to_string_expr(it);
+      exprt length=get(str.length());
+      exprt content=str.content();
+      replace_expr(symbol_resolve, content);
+      found_length[content]=length;
+     }
+  }
+}
+
+/// add lemmas representing the setting of an expression to a given value
+/// \par parameters: an expression and the value to set it to
+void string_refinementt::set_to(const exprt &expr, bool value)
+{
+  PRECONDITION(expr.type().id()==ID_bool);
+  PRECONDITION(equality_propagation);
+
+  if(expr.id()==ID_equal)
+  {
+    equal_exprt eq_expr=to_equal_expr(expr);
+    const exprt &lhs=eq_expr.lhs();
+    const exprt &rhs=eq_expr.rhs();
+
+    // The assignment of a string equality to false is not supported.
+    PRECONDITION(value || !is_char_array(rhs.type()));
+    PRECONDITION(value || !is_refined_string_type(rhs.type()));
+
+    PRECONDITION(lhs.id()==ID_symbol || !is_char_array(rhs.type()));
+    PRECONDITION(lhs.id()==ID_symbol || !is_refined_string_type(rhs.type()));
+
+    // If lhs is not a symbol, let supert::set_to() handle it.
+    if(lhs.id()!=ID_symbol)
+    {
+      non_string_axioms.push_back(std::make_pair(expr, value));
+      return;
     }
-    else if(type==ns.follow(expr.rhs().type()))
+
+    if(lhs.type()!=rhs.type())
     {
-      if(is_unbounded_array(type))
-        return true;
-      bvt bv1=convert_bv(expr.rhs());
-      const irep_idt &identifier=
-        to_symbol_expr(expr.lhs()).get_identifier();
-      map.set_literals(identifier, type, bv1);
-      if(freeze_all)
-        set_frozen(bv1);
-      return false;
+      warning() << "ignoring " << from_expr(ns, "", expr)
+                << " [inconsistent types]" << eom;
+      debug() << "lhs has type: " << lhs.type().pretty(12) << eom;
+      debug() << "rhs has type: " << rhs.type().pretty(12) << eom;
+      return;
     }
-  }
 
-  return true;
+    // Preprocessing to remove function applications.
+    debug() << "(sr::set_to) " << from_expr(ns, "", lhs)
+            << " = " << from_expr(ns, "", rhs) << eom;
+
+    const exprt subst_rhs=substitute_function_applications(rhs);
+    if(lhs.type()!=subst_rhs.type())
+    {
+      if(lhs.type().id()!=ID_array ||
+         subst_rhs.type().id()!=ID_array ||
+         lhs.type().subtype()!=subst_rhs.type().subtype())
+      {
+        warning() << "ignoring " << from_expr(ns, "", expr)
+                  << " [inconsistent types after substitution]" << eom;
+        return;
+      }
+      else
+      {
+        debug() << "(sr::set_to) accepting arrays with "
+                << "same subtype but different sizes" << eom;
+      }
+    }
+
+    if(value && !add_axioms_for_string_assigns(lhs, subst_rhs))
+      return;
+
+    // Push the substituted equality to the list of axioms to be given to
+    // supert::set_to.
+    non_string_axioms.push_back(
+      std::make_pair(equal_exprt(lhs, subst_rhs), value));
+  }
+  // Push the unmodified equality to the list of axioms to be given to
+  // supert::set_to.
+  else
+  {
+    // TODO: Verify that the expression contains no string.
+    // This will be easy once exprt iterators will have been implemented.
+    non_string_axioms.push_back(std::make_pair(expr, value));
+  }
 }
 
 /// use a refinement loop to instantiate universal axioms, call the sat solver,
@@ -203,10 +492,25 @@ bool string_refinementt::boolbv_set_equality_to_true(const equal_exprt &expr)
 /// \return result of the decision procedure
 decision_proceduret::resultt string_refinementt::dec_solve()
 {
-  for(const exprt &axiom : generator.axioms)
+  // Substitute all symbols to char arrays in the axioms to give to
+  // supert::set_to().
+  for(std::pair<exprt, bool> &pair : non_string_axioms)
+  {
+    replace_expr(symbol_resolve, pair.first);
+    debug() << "super::set_to " << from_expr(ns, "", pair.first) << eom;
+    supert::set_to(pair.first, pair.second);
+  }
+
+  for(exprt axiom : generator.get_axioms())
+  {
+    replace_expr(symbol_resolve, axiom);
     if(axiom.id()==ID_string_constraint)
     {
       string_constraintt c=to_string_constraint(axiom);
+      DATA_INVARIANT(
+        is_valid_string_constraint(c),
+        string_refinement_invariantt(
+          "string constraints satisfy their invariant"));
       universal_axioms.push_back(c);
     }
     else if(axiom.id()==ID_string_not_contains_constraint)
@@ -224,6 +528,26 @@ decision_proceduret::resultt string_refinementt::dec_solve()
     {
       add_lemma(axiom);
     }
+  }
+
+  found_length.clear();
+  found_content.clear();
+
+  // Initial try without index set
+  decision_proceduret::resultt res=supert::dec_solve();
+  if(res==resultt::D_SATISFIABLE)
+  {
+    if(!check_axioms())
+    {
+      debug() << "check_SAT: got SAT but the model is not correct" << eom;
+    }
+    else
+    {
+      debug() << "check_SAT: the model is correct" << eom;
+      concretize_lengths();
+      return resultt::D_SATISFIABLE;
+    }
+  }
 
   initial_index_set(universal_axioms);
   update_index_set(cur);
@@ -236,7 +560,7 @@ decision_proceduret::resultt string_refinementt::dec_solve()
 
     switch(res)
     {
-    case D_SATISFIABLE:
+    case resultt::D_SATISFIABLE:
       if(!check_axioms())
       {
         debug() << "check_SAT: got SAT but the model is not correct" << eom;
@@ -244,7 +568,8 @@ decision_proceduret::resultt string_refinementt::dec_solve()
       else
       {
         debug() << "check_SAT: the model is correct" << eom;
-        return D_SATISFIABLE;
+        concretize_lengths();
+        return resultt::D_SATISFIABLE;
       }
 
       debug() <<  "refining..." << eom;
@@ -260,7 +585,17 @@ decision_proceduret::resultt string_refinementt::dec_solve()
       if(current_index_set.empty())
       {
         debug() << "current index set is empty" << eom;
-        return D_SATISFIABLE;
+        if(do_concretizing)
+        {
+          concretize_results();
+          return resultt::D_SATISFIABLE;
+        }
+        else
+        {
+          debug() << "check_SAT: the model is correct and "
+                  << "does not need concretizing" << eom;
+          return resultt::D_SATISFIABLE;
+        }
       }
 
       display_index_set();
@@ -268,19 +603,20 @@ decision_proceduret::resultt string_refinementt::dec_solve()
       for(unsigned i=0; i<not_contains_axioms.size(); i++)
       {
         debug()<< "constraint " << i << eom;
-        std::list<exprt> lemmas;
-        instantiate_not_contains(not_contains_axioms[i], lemmas);
+        const std::vector<exprt> lemmas=
+          instantiate_not_contains(not_contains_axioms[i]);
         for(const exprt &lemma : lemmas)
           add_lemma(lemma);
       }
       break;
     default:
+      debug() << "check_SAT: default return " << static_cast<int>(res) << eom;
       return res;
     }
   }
   debug() << "string_refinementt::dec_solve reached the maximum number"
            << "of steps allowed" << eom;
-  return D_ERROR;
+  return resultt::D_ERROR;
 }
 
 /// fills as many 0 as necessary in the bit vectors to have the right width
@@ -296,205 +632,611 @@ bvt string_refinementt::convert_bool_bv(const exprt &boole, const exprt &orig)
 }
 
 /// add the given lemma to the solver
-/// \par parameters: a lemma
-void string_refinementt::add_lemma(const exprt &lemma, bool add_to_index_set)
+/// \par parameters: a lemma and Boolean value stating whether the lemma should
+/// be added to the index set.
+void string_refinementt::add_lemma(
+  const exprt &lemma, bool _simplify, bool add_to_index_set)
 {
   if(!seen_instances.insert(lemma).second)
     return;
 
-  if(lemma.is_true())
+  if(add_to_index_set)
+    cur.push_back(lemma);
+
+  exprt simple_lemma=lemma;
+  if(_simplify)
+    simplify(simple_lemma, ns);
+
+  if(simple_lemma.is_true())
   {
+#if 0
     debug() << "string_refinementt::add_lemma : tautology" << eom;
+#endif
     return;
   }
 
-  debug() << "adding lemma " << from_expr(lemma) << eom;
+  debug() << "adding lemma " << from_expr(ns, "", simple_lemma) << eom;
 
-  prop.l_set_to_true(convert(lemma));
-  if(add_to_index_set)
-    cur.push_back(lemma);
+  prop.l_set_to_true(convert(simple_lemma));
 }
 
-/// convert the content of a string to a more readable representation. This
-/// should only be used for debbuging.
-/// \par parameters: a constant array expression and a integer expression
-/// \return a string
-std::string string_refinementt::string_of_array(
-  const exprt &arr, const exprt &size) const
+/// get a model of an array and put it in a certain form. If the size cannot be
+/// obtained or if it is too big, return an empty array.
+/// \par parameters: an expression representing an array and an expression
+/// representing an integer
+/// \return an array expression or an array_of_exprt
+exprt string_refinementt::get_array(const exprt &arr, const exprt &size) const
 {
-  if(size.id()!=ID_constant)
-    return "string of unknown size";
+  exprt arr_val=simplify_expr(get_array(arr), ns);
+  exprt size_val=supert::get(size);
+  size_val=simplify_expr(size_val, ns);
+  typet char_type=arr.type().subtype();
+  typet index_type=size.type();
+  array_typet empty_ret_type(char_type, from_integer(0, index_type));
+  array_of_exprt empty_ret(from_integer(0, char_type), empty_ret_type);
+
+  if(size_val.id()!=ID_constant)
+  {
+#if 0
+    debug() << "(sr::get_array) string of unknown size: "
+            << from_expr(ns, "", size_val) << eom;
+#endif
+    return empty_ret;
+  }
+
   unsigned n;
-  if(to_unsigned_integer(to_constant_expr(size), n))
-    n=0;
+  if(to_unsigned_integer(to_constant_expr(size_val), n))
+  {
+#if 0
+    debug() << "(sr::get_array) size is not valid" << eom;
+#endif
+    return empty_ret;
+  }
 
-  if(n>MAX_CONCRETE_STRING_SIZE)
-    return "very long string";
-  if(n==0)
-    return "\"\"";
+  array_typet ret_type(char_type, from_integer(n, index_type));
+  array_exprt ret(ret_type);
 
-  std::ostringstream buf;
-  buf << "\"";
-  exprt val=get(arr);
+  if(n>generator.max_string_length)
+  {
+#if 0
+    debug() << "(sr::get_array) long string (size=" << n << ")" << eom;
+#endif
+    return empty_ret;
+  }
+
+  if(n==0)
+  {
+#if 0
+    debug() << "(sr::get_array) empty string" << eom;
+#endif
+    return empty_ret;
+  }
 
-  if(val.id()=="array-list")
+  if(arr_val.id()=="array-list")
   {
-    for(size_t i=0; i<val.operands().size()/2; i++)
+    DATA_INVARIANT(
+      arr_val.operands().size()%2==0,
+      string_refinement_invariantt("and index expression must be on a symbol, "
+                                   "with, array_of, if, or array, and all "
+                                   "cases besides array are handled above"));
+    std::map<std::size_t, exprt> initial_map;
+    for(size_t i=0; i<arr_val.operands().size()/2; i++)
     {
-      exprt index=val.operands()[i*2];
+      exprt index=arr_val.operands()[i*2];
       unsigned idx;
-      if(!to_unsigned_integer(to_constant_expr(index), idx))
-      {
-        if(idx<n)
-        {
-          exprt value=val.operands()[i*2+1];
-          unsigned c;
-          if(!to_unsigned_integer(to_constant_expr(value), c))
-            buf << static_cast<char>(c);
-        }
-      }
+      if(!to_unsigned_integer(to_constant_expr(index), idx) && idx<n)
+        initial_map[idx]=arr_val.operands()[i*2+1];
     }
+
+    // Pad the concretized values to the left to assign the uninitialized
+    // values of result.
+    ret.operands()=fill_in_map_as_vector(initial_map);
+    return ret;
   }
-  else
+  else if(arr_val.id()==ID_array)
   {
-    return "unable to get array-list";
+    // copy the `n` first elements of `arr_val`
+    for(size_t i=0; i<arr_val.operands().size() && i<n; i++)
+      ret.move_to_operands(arr_val.operands()[i]);
+    return ret;
   }
+  // default return value is an array of `0`s
+  return array_of_exprt(from_integer(0, char_type), ret_type);
+}
 
-  buf << "\"";
-  return buf.str();
+/// get a model of an array of unknown size and infer the size if possible
+/// \par parameters: an expression representing an array
+/// \return an expression
+exprt string_refinementt::get_array(const exprt &arr) const
+{
+  exprt arr_model=supert::get(arr);
+  if(arr_model.id()==ID_array)
+  {
+    array_typet &arr_type=to_array_type(arr_model.type());
+    arr_type.size()=from_integer(
+      arr_model.operands().size(), arr_type.size().type());
+  }
+  return arr_model;
 }
 
-/// gets a model of an array and put it in a certain form
-/// \par parameters: an array expression and a integer expression
-/// \return a string expression
-exprt string_refinementt::get_array(const exprt &arr, const exprt &size)
+/// convert the content of a string to a more readable representation. This
+/// should only be used for debugging.
+/// \par parameters: a constant array expression and a integer expression
+/// \return a string
+std::string string_refinementt::string_of_array(const array_exprt &arr)
 {
-  exprt val=get(arr);
-  typet char_type=arr.type().subtype();
-  typet index_type=size.type();
+  unsigned n;
+  if(arr.type().id()!=ID_array)
+      return std::string("");
+
+  exprt size_expr=to_array_type(arr.type()).size();
+  PRECONDITION(size_expr.id()==ID_constant);
+  to_unsigned_integer(to_constant_expr(size_expr), n);
+  return utf16_constant_array_to_java(arr, n);
+}
 
-  if(val.id()=="array-list")
+/// Display part of the current model by mapping the variables created by the
+/// solver to constant expressions given by the current model
+void string_refinementt::debug_model()
+{
+  const std::string indent("  ");
+  for(auto it : symbol_resolve)
   {
-    array_typet ret_type(char_type, infinity_exprt(index_type));
-    exprt ret=array_of_exprt(from_integer(0, char_type), ret_type);
+    if(is_refined_string_type(it.second.type()))
+    {
+      debug() << "- " << from_expr(ns, "", to_symbol_expr(it.first)) << ":\n";
+      string_exprt refined=to_string_expr(it.second);
+      debug() << indent << indent << "in_map: "
+              << from_expr(ns, "", refined) << eom;
+      debug() << indent << indent << "resolved: "
+              << from_expr(ns, "", refined) << eom;
+      const exprt &econtent=refined.content();
+      const exprt &elength=refined.length();
+
+      exprt len=supert::get(elength);
+      len=simplify_expr(len, ns);
+      exprt arr=get_array(econtent, len);
+      if(arr.id()==ID_array)
+        debug() << indent << indent << "as_string: \""
+                << string_of_array(to_array_expr(arr)) << "\"\n";
+      else
+        debug() << indent << indent << "as_char_array: "
+                << from_expr(ns, "", arr) << "\n";
 
-    for(size_t i=0; i<val.operands().size()/2; i++)
+      debug() << indent << indent << "size: " << from_expr(ns, "", len) << eom;
+    }
+    else
     {
-      exprt index=val.operands()[i*2];
-      assert(index.type()==index_type);
-      exprt value=val.operands()[i*2+1];
-      assert(value.type()==char_type);
-      ret=with_exprt(ret, index, value);
+      INVARIANT(
+        is_char_array(it.second.type()),
+        string_refinement_invariantt("symbol_resolve should only map to "
+          "refined_strings or to char_arrays, and refined_strings are already "
+          "handled"));
+      exprt arr=it.second;
+      replace_expr(symbol_resolve, arr);
+      debug() << "- " << from_expr(ns, "", to_symbol_expr(it.first)) << ":\n";
+      debug() << indent << indent << "resolved: "
+              << from_expr(ns, "", arr) << "\n";
+      exprt arr_model=get_array(arr);
+      debug() << indent << indent << "char_array: "
+              << from_expr(ns, "", arr_model) << eom;
     }
-    return ret;
+  }
+
+  for(const auto it : generator.get_boolean_symbols())
+  {
+      debug() << " - " << it.get_identifier() << ": "
+              << from_expr(ns, "", supert::get(it)) << eom;
+  }
+
+  for(const auto it : generator.get_index_symbols())
+  {
+     debug() << " - " << it.get_identifier() << ": "
+             << from_expr(ns, "", supert::get(it)) << eom;
+  }
+}
+
+/// Create a new expression where 'with' expressions on arrays are replaced by
+/// 'if' expressions. e.g. for an array access arr[x], where: `arr :=
+/// array_of(12) with {0:=24} with {2:=42}` the constructed expression will be:
+/// `index==0 ? 24 : index==2 ? 42 : 12`
+/// \param expr: A (possibly nested) 'with' expression on an `array_of`
+///   expression
+/// \param index: An index with which to build the equality condition
+/// \return An expression containing no 'with' expression
+exprt string_refinementt::substitute_array_with_expr(
+  const exprt &expr, const exprt &index) const
+{
+  if(expr.id()==ID_with)
+  {
+    const with_exprt &with_expr=to_with_expr(expr);
+    const exprt &then_expr=with_expr.new_value();
+    exprt else_expr=substitute_array_with_expr(with_expr.old(), index);
+    const typet &type=then_expr.type();
+    CHECK_RETURN(else_expr.type()==type);
+    CHECK_RETURN(index.type()==with_expr.where().type());
+    return if_exprt(
+      equal_exprt(index, with_expr.where()), then_expr, else_expr, type);
   }
   else
   {
-    debug() << "unable to get array-list value of "
-            << from_expr(val) << eom;
-    return arr;
+    // Only handle 'with' expressions and 'array_of' expressions.
+    INVARIANT(
+      expr.id()==ID_array_of,
+      string_refinement_invariantt("only handles 'with' and 'array_of' "
+        "expressions, and expr is 'with' is handled above"));
+    return to_array_of_expr(expr).what();
   }
 }
 
-/// return true if the current model satisfies all the axioms
-/// \return a Boolean
-bool string_refinementt::check_axioms()
+/// Fill an array represented by a list of with_expr by propagating values to
+/// the left. For instance `ARRAY_OF(12) WITH[2:=24] WITH[4:=42]` will give
+/// `{ 24, 24, 24, 42, 42 }`
+/// \param expr: an array expression in the form
+///   `ARRAY_OF(x) WITH [i0:=v0] ... WITH [iN:=vN]`
+/// \param string_max_length: bound on the length of strings
+/// \return an array expression with filled in values, or expr if it is simply
+///   an `ARRAY_OF(x)` expression
+exprt fill_in_array_with_expr(const exprt &expr, std::size_t string_max_length)
+{
+  PRECONDITION(expr.type().id()==ID_array);
+  PRECONDITION(expr.id()==ID_with || expr.id()==ID_array_of);
+
+  // Nothing to do for empty array
+  if(expr.id()==ID_array_of)
+    return expr;
+
+  // Map of the parts of the array that are initialized
+  std::map<std::size_t, exprt> initial_map;
+
+  for(exprt it=expr; it.id()==ID_with; it=to_with_expr(it).old())
+  {
+    // Add to `initial_map` all the pairs (index,value) contained in `WITH`
+    // statements
+    const with_exprt with_expr=to_with_expr(it);
+    const exprt &then_expr=with_expr.new_value();
+    const auto index=expr_cast<std::size_t>(with_expr.where());
+    if(index<string_max_length)
+      initial_map.emplace(index, then_expr);
+  }
+
+  array_exprt result(to_array_type(expr.type()));
+  result.operands()=fill_in_map_as_vector(initial_map);
+  return result;
+}
+
+/// create an equivalent expression where array accesses and 'with' expressions
+/// are replaced by 'if' expressions, in particular:
+///  * for an array access `arr[x]`, where:
+///    `arr := {12, 24, 48}` the constructed expression will be:
+///    `index==0 ? 12 : index==1 ? 24 : 48`
+///  * for an array access `arr[x]`, where:
+///    `arr := array_of(12) with {0:=24} with {2:=42}` the constructed
+///    expression will be: `index==0 ? 24 : index==2 ? 42 : 12`
+///  * for an array access `(g1?arr1:arr2)[x]` where `arr1 := {12}` and
+///    `arr2 := {34}`, the constructed expression will be: `g1 ? 12 : 34`
+/// \param expr: an expression containing array accesses
+/// \return an expression containing no array access
+void string_refinementt::substitute_array_access(exprt &expr) const
 {
-  debug() << "string_refinementt::check_axioms: ==============="
-          << "===========================================" << eom;
-  debug() << "string_refinementt::check_axioms: build the"
-          << " interpretation from the model of the prop_solver" << eom;
-  replace_mapt fmodel;
+  for(auto &op : expr.operands())
+    substitute_array_access(op);
 
-  for(auto it : generator.symbol_to_string)
+  if(expr.id()==ID_index)
   {
-    string_exprt refined=it.second;
-    const exprt &econtent=refined.content();
-    const exprt &elength=refined.length();
+    index_exprt &index_expr=to_index_expr(expr);
+
+    if(index_expr.array().id()==ID_symbol)
+    {
+      expr=index_expr;
+      return;
+    }
+
+    if(index_expr.array().id()==ID_with)
+    {
+      expr=substitute_array_with_expr(index_expr.array(), index_expr.index());
+      return;
+    }
+
+    if(index_expr.array().id()==ID_array_of)
+    {
+      expr=to_array_of_expr(index_expr.array()).op();
+      return;
+    }
+
+    if(index_expr.array().id()==ID_if)
+    {
+      // Substitute recursively in branches of conditional expressions
+      if_exprt if_expr=to_if_expr(index_expr.array());
+      exprt true_case=index_exprt(if_expr.true_case(), index_expr.index());
+      substitute_array_access(true_case);
+      exprt false_case=index_exprt(if_expr.false_case(), index_expr.index());
+      substitute_array_access(false_case);
+      expr=if_exprt(if_expr.cond(), true_case, false_case);
+      return;
+    }
+
+    DATA_INVARIANT(
+      index_expr.array().id()==ID_array,
+      string_refinement_invariantt("and index expression must be on a symbol, "
+        "with, array_of, if, or array, and all cases besides array are handled "
+        "above"));
+    array_exprt &array_expr=to_array_expr(index_expr.array());
+
+    // Empty arrays do not need to be substituted.
+    if(array_expr.operands().empty())
+      return;
+
+    size_t last_index=array_expr.operands().size()-1;
+
+    const typet &char_type=index_expr.array().type().subtype();
+    exprt ite=array_expr.operands().back();
+
+    if(ite.type()!=char_type)
+    {
+      // We have to manually set the type for unknown values
+      INVARIANT(
+        ite.id()==ID_unknown,
+        string_refinement_invariantt("the last element can only have type char "
+          "or unknown, and it is not char type"));
+      ite.type()=char_type;
+    }
 
-    exprt len=get(elength);
-    exprt arr=get_array(econtent, len);
+    auto op_it=++array_expr.operands().rbegin();
 
-    fmodel[elength]=len;
-    fmodel[econtent]=arr;
-    debug() << it.first << "=" << from_expr(it.second)
-            << " of length " << from_expr(len) <<" := " << eom
-            << from_expr(get(econtent)) << eom
-            << string_of_array(econtent, len) << eom;
+    for(size_t i=last_index-1;
+        op_it!=array_expr.operands().rend(); ++op_it, --i)
+    {
+      equal_exprt equals(index_expr.index(), from_integer(i, java_int_type()));
+      if(op_it->type()!=char_type)
+      {
+        INVARIANT(
+          op_it->id()==ID_unknown,
+          string_refinement_invariantt("elements can only have type char or "
+            "unknown, and it is not char type"));
+        op_it->type()=char_type;
+      }
+      ite=if_exprt(equals, *op_it, ite);
+    }
+    expr=ite;
   }
+}
 
-  for(auto it : generator.boolean_symbols)
+/// Negates the constraint to be fed to a solver. The intended usage is to find
+/// an assignment of the universal variable that would violate the axiom. To
+/// avoid false positives, the symbols other than the universal variable should
+/// have been replaced by their valuation in the current model.
+/// \pre Symbols other than the universal variable should have been replaced by
+///   their valuation in the current model.
+/// \param axiom: the not_contains constraint to add the negation of
+/// \param univ_var: the universal variable for the negation of the axiom
+/// \return: the negation of the axiom under the current evaluation
+static exprt negation_of_not_contains_constraint(
+  const string_not_contains_constraintt &axiom,
+  const symbol_exprt &univ_var)
+{
+  // If the for all is vacuously true, the negation is false.
+  exprt lbu=axiom.univ_lower_bound();
+  exprt ubu=axiom.univ_upper_bound();
+  if(lbu.id()==ID_constant && ubu.id()==ID_constant)
   {
-    debug() << "" << it.get_identifier() << " := "
-            << from_expr(get(it)) << eom;
-    fmodel[it]=get(it);
+    mp_integer lb_int, ub_int;
+    to_integer(to_constant_expr(lbu), lb_int);
+    to_integer(to_constant_expr(ubu), ub_int);
+    if(ub_int<=lb_int)
+      return false_exprt();
   }
 
-  for(auto it : generator.index_symbols)
+  exprt lbe=axiom.exists_lower_bound();
+  exprt ube=axiom.exists_upper_bound();
+
+  mp_integer lbe_int, ube_int;
+  to_integer(to_constant_expr(lbe), lbe_int);
+  to_integer(to_constant_expr(ube), ube_int);
+
+  // If the premise is false, the implication is trivially true, so the
+  // negation is false.
+  if(axiom.premise()==false_exprt())
+    return false_exprt();
+
+  and_exprt univ_bounds(
+    binary_relation_exprt(lbu, ID_le, univ_var),
+    binary_relation_exprt(ubu, ID_gt, univ_var));
+
+  // The negated existential becomes an universal, and this is the unrolling of
+  // that universal quantifier.
+  std::vector<exprt> conjuncts;
+  for(mp_integer i=lbe_int; i<ube_int; ++i)
   {
-    debug() << "" << it.get_identifier() << " := "
-            << from_expr(get(it)) << eom;
-    fmodel[it]=get(it);
+    const constant_exprt i_exprt=from_integer(i, univ_var.type());
+    const equal_exprt equal_chars(
+      axiom.s0()[plus_exprt(univ_var, i_exprt)],
+      axiom.s1()[i_exprt]);
+    conjuncts.push_back(equal_chars);
   }
+  exprt equal_strings=conjunction(conjuncts);
+  and_exprt negaxiom(univ_bounds, axiom.premise(), equal_strings);
 
-  // Maps from indexes of violated universal axiom to a witness of violation
-  std::map<size_t, exprt> violated;
+  return negaxiom;
+}
 
-  debug() << "there are " << universal_axioms.size()
-          << " universal axioms" << eom;
-  for(size_t i=0; i<universal_axioms.size(); i++)
+/// Negates the constraint to be fed to a solver. The intended usage is to find
+/// an assignment of the universal variable that would violate the axiom. To
+/// avoid false positives, the symbols other than the universal variable should
+/// have been replaced by their valuation in the current model.
+/// \pre Symbols other than the universal variable should have been replaced by
+///   their valuation in the current model.
+/// \param axiom: the not_contains constraint to add the negation of
+/// \return: the negation of the axiom under the current evaluation
+static exprt negation_of_constraint(const string_constraintt &axiom)
+{
+  // If the for all is vacuously true, the negation is false.
+  exprt lb=axiom.lower_bound();
+  exprt ub=axiom.upper_bound();
+  if(lb.id()==ID_constant && ub.id()==ID_constant)
   {
-    const string_constraintt &axiom=universal_axioms[i];
+    mp_integer lb_int, ub_int;
+    to_integer(to_constant_expr(lb), lb_int);
+    to_integer(to_constant_expr(ub), ub_int);
+    if(ub_int<=lb_int)
+      return false_exprt();
+  }
 
-    exprt negaxiom=and_exprt(axiom.premise(), not_exprt(axiom.body()));
-    replace_expr(fmodel, negaxiom);
+  // If the premise is false, the implication is trivially true, so the
+  // negation is false.
+  if(axiom.premise()==false_exprt())
+    return false_exprt();
 
-    debug() << "negaxiom: " << from_expr(negaxiom) << eom;
+  and_exprt premise(axiom.premise(), axiom.univ_within_bounds());
+  and_exprt negaxiom(premise, not_exprt(axiom.body()));
 
-    satcheck_no_simplifiert sat_check;
-    supert solver(ns, sat_check);
-    solver << negaxiom;
+  return negaxiom;
+}
 
-    switch(solver())
+/// Result of the solver `supert` should not be interpreted literally for char
+/// arrays as not all indices are present in the index set.
+/// In the given expression, we populate arrays at the indices for which the
+/// solver has no constraint by copying values to the left.
+/// For example an expression `ARRAY_OF(0) WITH [1:=2] WITH [4:=3]` would
+/// be interpreted as `{ 2, 2, 3, 3, 3}`.
+/// \param expr: expression to interpret
+/// \param string_max_length: maximum size of arrays to consider
+/// \return the interpreted expression
+exprt concretize_arrays_in_expression(exprt expr, std::size_t string_max_length)
+{
+  auto it=expr.depth_begin();
+  const auto end=expr.depth_end();
+  while(it!=end)
+  {
+    if(it->id()==ID_with && it->type().id()==ID_array)
     {
-    case decision_proceduret::D_SATISFIABLE:
-      {
-        exprt val=solver.get(axiom.univ_var());
-        violated[i]=val;
-      }
-      break;
-    case decision_proceduret::D_UNSATISFIABLE:
-      break;
-    default:
-      throw "failure in checking axiom";
+      it.mutate()=fill_in_array_with_expr(*it, string_max_length);
+      it.next_sibling_or_parent();
+    }
+    else
+      ++it;
+  }
+  return expr;
+}
+
+/// return true if the current model satisfies all the axioms
+/// \return a Boolean
+bool string_refinementt::check_axioms()
+{
+  debug() << "string_refinementt::check_axioms:" << eom;
+  debug_model();
+
+  // Maps from indexes of violated universal axiom to a witness of violation
+  std::map<size_t, exprt> violated;
+
+  debug() << "string_refinement::check_axioms: " << universal_axioms.size()
+          << " universal axioms:" << eom;
+  for(size_t i=0; i<universal_axioms.size(); i++)
+  {
+    const string_constraintt &axiom=universal_axioms[i];
+    const symbol_exprt univ_var=axiom.univ_var();
+    const exprt bound_inf=axiom.lower_bound();
+    const exprt bound_sup=axiom.upper_bound();
+    const exprt prem=axiom.premise();
+    const exprt body=axiom.body();
+
+    const string_constraintt axiom_in_model(
+      univ_var, get(bound_inf), get(bound_sup), get(prem), get(body));
+
+    exprt negaxiom=negation_of_constraint(axiom_in_model);
+
+    debug() << "  "<< i << ".\n"
+            << "    - axiom:\n"
+            << "       " << from_expr(ns, "", axiom) << eom;
+    debug() << "    - axiom_in_model:\n"
+            << "       " << from_expr(ns, "", axiom_in_model) << eom;
+    debug() << "    - negated_axiom:\n"
+            << "       " << from_expr(ns, "", negaxiom) << eom;
+
+    exprt with_concretized_arrays=concretize_arrays_in_expression(
+      negaxiom, generator.max_string_length);
+    debug() << "    - negated_axiom_with_concretized_array_access:\n"
+            << "       " << from_expr(ns, "", with_concretized_arrays) << eom;
+
+    substitute_array_access(with_concretized_arrays);
+    debug() << "    - negated_axiom_without_array_access:\n"
+            << "       " << from_expr(ns, "", with_concretized_arrays) << eom;
+    exprt witness;
+
+    bool is_sat=is_axiom_sat(with_concretized_arrays, univ_var, witness);
+
+    if(is_sat)
+    {
+      debug() << "  - violated_for: "
+              << univ_var.get_identifier()
+              << " = " << from_expr(ns, "", witness) << eom;
+      violated[i]=witness;
     }
+    else
+      debug() << "  - correct" << eom;
   }
 
-  // tells whether one of the not_contains constraint can be violated
-  bool violated_not_contains=false;
+  // Maps from indexes of violated not_contains axiom to a witness of violation
+  std::map<std::size_t, exprt> violated_not_contains;
+
   debug() << "there are " << not_contains_axioms.size()
           << " not_contains axioms" << eom;
-
-  for(auto nc_axiom : not_contains_axioms)
+  for(size_t i=0; i<not_contains_axioms.size(); i++)
   {
-    typet index_type=nc_axiom.s0().length().type();
-    exprt zero=from_integer(0, index_type);
-    exprt witness=generator.get_witness_of(nc_axiom, zero);
-    exprt val=get(witness);
-    violated_not_contains=true;
+    const string_not_contains_constraintt &nc_axiom=not_contains_axioms[i];
+    const exprt univ_bound_inf=nc_axiom.univ_lower_bound();
+    const exprt univ_bound_sup=nc_axiom.univ_upper_bound();
+    const exprt prem=nc_axiom.premise();
+    const exprt exists_bound_inf=nc_axiom.exists_lower_bound();
+    const exprt exists_bound_sup=nc_axiom.exists_upper_bound();
+    const string_exprt s0=nc_axiom.s0();
+    const string_exprt s1=nc_axiom.s1();
+
+    symbol_exprt univ_var=generator.fresh_univ_index(
+      "not_contains_univ_var", nc_axiom.s0().length().type());
+    const string_not_contains_constraintt nc_axiom_in_model(
+      get(univ_bound_inf),
+      get(univ_bound_sup),
+      get(prem),
+      get(exists_bound_inf),
+      get(exists_bound_sup),
+      to_string_expr(get(s0)),
+      to_string_expr(get(s1)));
+
+    exprt negaxiom=negation_of_not_contains_constraint(
+      nc_axiom_in_model, univ_var);
+    debug() << "(string_refinementt::check_axioms) Adding negated constraint: "
+            << from_expr(ns, "", negaxiom) << eom;
+    substitute_array_access(negaxiom);
+    exprt witness;
+
+    bool is_sat=is_axiom_sat(negaxiom, univ_var, witness);
+
+    if(is_sat)
+    {
+      debug() << "string constraint can be violated for "
+              << univ_var.get_identifier()
+              << " = " << from_expr(ns, "", witness) << eom;
+      violated_not_contains[i]=witness;
+    }
   }
 
-  if(violated.empty() && !violated_not_contains)
+  if(violated.empty() && violated_not_contains.empty())
   {
     debug() << "no violated property" << eom;
     return true;
   }
   else
   {
-    debug() << violated.size() << " string axioms can be violated" << eom;
+    debug() << violated.size()
+            << " universal string axioms can be violated" << eom;
+    debug() << violated_not_contains.size()
+            << " not_contains string axioms can be violated" << eom;
 
     if(use_counter_example)
     {
+      // TODO: add counter examples for not_contains?
+
       // Checking if the current solution satisfies the constraints
       for(const auto &v : violated)
       {
@@ -504,11 +1246,11 @@ bool string_refinementt::check_axioms()
         exprt premise(axiom.premise());
         exprt body(axiom.body());
         implies_exprt instance(premise, body);
+        replace_expr(symbol_resolve, instance);
         replace_expr(axiom.univ_var(), val, instance);
-        if(seen_instances.insert(instance).second)
-          add_lemma(instance);
-        else
-          debug() << "instance already seen" << eom;
+        debug() << "adding counter example " << from_expr(ns, "", instance)
+                << eom;
+        add_lemma(instance);
       }
     }
 
@@ -516,7 +1258,7 @@ bool string_refinementt::check_axioms()
   }
 }
 
-/// \par parameters: an expression with only addition and substraction
+/// \par parameters: an expression with only addition and subtraction
 /// \return a map where each leaf of the input is mapped to the number of times
 ///   it is added. For instance, expression $x + x - y$ would give the map x ->
 ///   2, y -> -1.
@@ -536,8 +1278,8 @@ std::map<exprt, int> string_refinementt::map_representation_of_sum(
     to_process.pop_back();
     if(cur.id()==ID_plus)
     {
-      to_process.push_back(std::make_pair(cur.op1(), positive));
-      to_process.push_back(std::make_pair(cur.op0(), positive));
+      for(const auto &op : cur.operands())
+        to_process.push_back(std::make_pair(op, positive));
     }
     else if(cur.id()==ID_minus)
     {
@@ -564,13 +1306,13 @@ std::map<exprt, int> string_refinementt::map_representation_of_sum(
 ///   times given by the corresponding integer in the map. For a map x -> 2, y
 ///   -> -1 would give an expression $x + x - y$.
 exprt string_refinementt::sum_over_map(
-  std::map<exprt, int> &m, bool negated) const
+  std::map<exprt, int> &m, const typet &type, bool negated) const
 {
   exprt sum=nil_exprt();
   mp_integer constants=0;
   typet index_type;
   if(m.empty())
-    return nil_exprt();
+    return from_integer(0, type);
   else
     index_type=m.begin()->first.type();
 
@@ -605,12 +1347,20 @@ exprt string_refinementt::sum_over_map(
       default:
         if(second>1)
         {
-          for(int i=0; i<second; i++)
+          if(sum.is_nil())
+            sum=t;
+          else
+            plus_exprt(sum, t);
+          for(int i=1; i<second; i++)
             sum=plus_exprt(sum, t);
         }
-        else
+        else if(second<-1)
         {
-          for(int i=0; i>second; i--)
+          if(sum.is_nil())
+            sum=unary_minus_exprt(t);
+          else
+            sum=minus_exprt(sum, t);
+          for(int i=-1; i>second; i--)
             sum=minus_exprt(sum, t);
         }
       }
@@ -625,11 +1375,11 @@ exprt string_refinementt::sum_over_map(
 }
 
 /// \par parameters: an expression with only plus and minus expr
-/// \return an equivalent expression in a cannonical form
+/// \return an equivalent expression in a canonical form
 exprt string_refinementt::simplify_sum(const exprt &f) const
 {
   std::map<exprt, int> map=map_representation_of_sum(f);
-  return sum_over_map(map);
+  return sum_over_map(map, f.type());
 }
 
 /// \par parameters: a symbol qvar, an expression val, an expression f
@@ -645,7 +1395,7 @@ exprt string_refinementt::compute_inverse_function(
   exprt positive, negative;
   // number of time the element should be added (can be negative)
   // qvar has to be equal to val - f(0) if it appears positively in f
-  // (ie if f(qvar)=f(0) + qvar) and f(0) - val if it appears negatively
+  // (i.e. if f(qvar)=f(0) + qvar) and f(0) - val if it appears negatively
   // in f. So we start by computing val - f(0).
   std::map<exprt, int> elems=map_representation_of_sum(minus_exprt(val, f));
 
@@ -653,20 +1403,26 @@ exprt string_refinementt::compute_inverse_function(
   bool neg=false;
 
   auto it=elems.find(qvar);
-  assert(it!=elems.end());
+  INVARIANT(
+    it!=elems.end(),
+    string_refinement_invariantt("a function must have an occurrence of qvar"));
   if(it->second==1 || it->second==-1)
   {
     neg=(it->second==1);
   }
   else
   {
-    assert(it->second==0);
+    INVARIANT(
+      it->second==0,
+      string_refinement_invariantt("a proper function must have exactly one "
+        "occurrences after reduction, or it canceled out, and it does not have "
+        " one"));
     debug() << "in string_refinementt::compute_inverse_function:"
             << " warning: occurrences of qvar canceled out " << eom;
   }
 
   elems.erase(it);
-  return sum_over_map(elems, neg);
+  return sum_over_map(elems, f.type(), neg);
 }
 
 
@@ -681,14 +1437,14 @@ class find_qvar_visitort: public const_expr_visitort
 
   explicit find_qvar_visitort(const exprt &qvar): qvar_(qvar), found(false) {}
 
-  void operator()(const exprt &expr)
+  void operator()(const exprt &expr) override
   {
     if(expr==qvar_)
       found=true;
   }
 };
 
-/// looks for the symbol and return true if it is found
+/// look for the symbol and return true if it is found
 /// \par parameters: an index expression and a symbol qvar
 /// \return a Boolean
 static bool find_qvar(const exprt index, const symbol_exprt &qvar)
@@ -716,9 +1472,50 @@ void string_refinementt::update_index_set(const std::vector<exprt> &cur)
     update_index_set(axiom);
 }
 
+/// An expression representing an array of characters can be in the form of an
+/// if expression for instance `cond?array1:(cond2:array2:array3)`.
+/// We return all the array expressions contained in `array_expr`.
+/// \param array_expr : an expression representing an array
+/// \return a vector containing symbols and constant arrays contained in the
+///         expression
+static std::vector<exprt> sub_arrays(const exprt &array_expr)
+{
+  if(array_expr.id()==ID_if)
+  {
+    std::vector<exprt> res1=sub_arrays(to_if_expr(array_expr).true_case());
+    std::vector<exprt> res2=sub_arrays(to_if_expr(array_expr).false_case());
+    res1.insert(res1.end(), res2.begin(), res2.end());
+    return res1;
+  }
+  else
+  {
+    INVARIANT(
+      array_expr.id()==ID_symbol || array_expr.id()==ID_array,
+      "character arrays should be symbol, constant array, or if expression");
+    return std::vector<exprt>(1, array_expr);
+  }
+}
+
 /// add to the index set all the indices that appear in the formula and the
 /// upper bound minus one
 /// \par parameters: a string constraint
+void string_refinementt::add_to_index_set(const exprt &s, exprt i)
+{
+  simplify(i, ns);
+  if(i.id()==ID_constant)
+  {
+    mp_integer mpi;
+    to_integer(i, mpi);
+    if(mpi<0)
+      return;
+  }
+
+  std::vector<exprt> subs=sub_arrays(s);
+  for(const auto &sub : subs)
+    if(index_set[sub].insert(i).second)
+      current_index_set[sub].insert(i);
+}
+
 void string_refinementt::initial_index_set(const string_constraintt &axiom)
 {
   symbol_exprt qvar=axiom.univ_var();
@@ -739,8 +1536,7 @@ void string_refinementt::initial_index_set(const string_constraintt &axiom)
       // if cur is of the form s[i] and no quantified variable appears in i
       if(!has_quant_var)
       {
-        current_index_set[s].insert(i);
-        index_set[s].insert(i);
+        add_to_index_set(s, i);
       }
       else
       {
@@ -750,8 +1546,7 @@ void string_refinementt::initial_index_set(const string_constraintt &axiom)
           axiom.upper_bound(),
           from_integer(1, axiom.upper_bound().type()));
         replace_expr(qvar, kminus1, e);
-        current_index_set[s].insert(e);
-        index_set[s].insert(e);
+        add_to_index_set(s, e);
       }
     }
     else
@@ -775,14 +1570,11 @@ void string_refinementt::update_index_set(const exprt &formula)
     {
       const exprt &s=cur.op0();
       const exprt &i=cur.op1();
-      assert(s.type().id()==ID_array);
+      DATA_INVARIANT(
+        s.type().id()==ID_array,
+        string_refinement_invariantt("index expressions must index on arrays"));
       exprt simplified=simplify_sum(i);
-      if(index_set[s].insert(simplified).second)
-      {
-        debug() << "adding to index set of " << from_expr(s)
-                << ": " << from_expr(simplified) << eom;
-        current_index_set[s].insert(simplified);
-      }
+      add_to_index_set(s, simplified);
     }
     else
     {
@@ -792,59 +1584,61 @@ void string_refinementt::update_index_set(const exprt &formula)
   }
 }
 
-
 // Will be used to visit an expression and return the index used
-// with the given char array
+// with the given char array that contains qvar
 class find_index_visitort: public const_expr_visitort
 {
 private:
   const exprt &str_;
+  const symbol_exprt &qvar_;
 
 public:
-  explicit find_index_visitort(const exprt &str): str_(str) {}
+  exprt index;
 
-  void operator()(const exprt &expr)
+  explicit find_index_visitort(
+    const exprt &str, const symbol_exprt &qvar):
+      str_(str),
+      qvar_(qvar),
+      index(nil_exprt()) {}
+
+  void operator()(const exprt &expr) override
   {
-    if(expr.id()==ID_index)
+    if(index.is_nil() && expr.id()==ID_index)
     {
       const index_exprt &i=to_index_expr(expr);
-      if(i.array()==str_)
-        throw i.index();
+      if(i.array()==str_ && find_qvar(i.index(), qvar_))
+        index=i.index();
     }
   }
 };
 
-/// find an index used in the expression for str, for instance with arguments
-/// (str[k] == 'a') and str, the function should return k
-/// \par parameters: a formula expr and a char array str
-/// \return an index expression
-exprt find_index(const exprt &expr, const exprt &str)
+/// Finds an index on `str` used in `expr` that contains `qvar`, for instance
+/// with arguments ``(str[k] == 'a')``, `str`, and `k`, the function should
+/// return `k`.
+/// \param [in] expr: the expression to search
+/// \param [in] str: the string which must be indexed
+/// \param [in] qvar: the universal variable that must be in the index
+/// \return an index expression in `expr` on `str` containing `qvar`
+exprt find_index(const exprt &expr, const exprt &str, const symbol_exprt &qvar)
 {
-  find_index_visitort v1(str);
-  try
-  {
-    expr.visit(v1);
-    return nil_exprt();
-  }
-  catch (exprt i) { return i; }
+  find_index_visitort v(str, qvar);
+  expr.visit(v);
+  return v.index;
 }
 
-
-/// \par parameters: an universaly quantified formula `axiom`, an array of char
+/// \par parameters: a universally quantified formula `axiom`, an array of char
 /// variable `str`, and an index expression `val`.
-/// \return substitute `qvar` the universaly quantified variable of `axiom`, by
+/// \return substitute `qvar` the universally quantified variable of `axiom`, by
 ///   an index `val`, in `axiom`, so that the index used for `str` equals `val`.
 ///   For instance, if `axiom` corresponds to $\forall q. s[q+x]='a' &&
-///   t[q]='b'$, `instantiate(axom,s,v)` would return an expression for
+///   t[q]='b'$, `instantiate(axiom,s,v)` would return an expression for
 ///   $s[v]='a' && t[v-x]='b'$.
 exprt string_refinementt::instantiate(
   const string_constraintt &axiom, const exprt &str, const exprt &val)
 {
-  exprt idx=find_index(axiom.body(), str);
+  exprt idx=find_index(axiom.body(), str, axiom.univ_var());
   if(idx.is_nil())
     return true_exprt();
-  if(!find_qvar(idx, axiom.univ_var()))
-    return true_exprt();
 
   exprt r=compute_inverse_function(axiom.univ_var(), val, idx);
   implies_exprt instance(axiom.premise(), axiom.body());
@@ -858,54 +1652,296 @@ exprt string_refinementt::instantiate(
   return implies_exprt(bounds, instance);
 }
 
+/// Instantiates a quantified formula representing `not_contains` by
+/// substituting the quantifiers and generating axioms.
+/// \param [in] axiom: the axiom to instantiate
+/// \return the lemmas produced through instantiation
+std::vector<exprt> string_refinementt::instantiate_not_contains(
+  const string_not_contains_constraintt &axiom)
+{
+  const string_exprt s0=to_string_expr(axiom.s0());
+  const string_exprt s1=to_string_expr(axiom.s1());
+
+  debug() << "instantiate not contains " << from_expr(ns, "", s0) << " : "
+          << from_expr(ns, "", s1) << eom;
+  const expr_sett index_set0=index_set[s0.content()];
+  const expr_sett index_set1=index_set[s1.content()];
+
+  return ::instantiate_not_contains(
+    axiom, index_set0, index_set1, generator);
+}
 
-void string_refinementt::instantiate_not_contains(
-  const string_not_contains_constraintt &axiom, std::list<exprt> &new_lemmas)
-{
-  exprt s0=axiom.s0();
-  exprt s1=axiom.s1();
-
-  debug() << "instantiate not contains " << from_expr(s0) << " : "
-          << from_expr(s1) << eom;
-  expr_sett index_set0=index_set[to_string_expr(s0).content()];
-  expr_sett index_set1=index_set[to_string_expr(s1).content()];
-
-  for(auto it0 : index_set0)
-    for(auto it1 : index_set1)
-    {
-      debug() << from_expr(it0) << " : " << from_expr(it1) << eom;
-      exprt val=minus_exprt(it0, it1);
-      exprt witness=generator.get_witness_of(axiom, val);
-      and_exprt prem_and_is_witness(
-        axiom.premise(),
-        equal_exprt(witness, it1));
-
-      not_exprt differ(
-        equal_exprt(
-          to_string_expr(s0)[it0],
-          to_string_expr(s1)[it1]));
-      exprt lemma=implies_exprt(prem_and_is_witness, differ);
-
-      new_lemmas.push_back(lemma);
-      // we put bounds on the witnesses:
-      // 0 <= v <= |s0| - |s1| ==> 0 <= v+w[v] < |s0| && 0 <= w[v] < |s1|
-      exprt zero=from_integer(0, val.type());
-      binary_relation_exprt c1(zero, ID_le, plus_exprt(val, witness));
-      binary_relation_exprt c2
-        (to_string_expr(s0).length(), ID_gt, plus_exprt(val, witness));
-      binary_relation_exprt c3(to_string_expr(s1).length(), ID_gt, witness);
-      binary_relation_exprt c4(zero, ID_le, witness);
-
-      minus_exprt diff(
-        to_string_expr(s0).length(),
-        to_string_expr(s1).length());
-
-      and_exprt premise(
-        binary_relation_exprt(zero, ID_le, val),
-        binary_relation_exprt(diff, ID_ge, val));
-      exprt witness_bounds=implies_exprt(
-        premise,
-        and_exprt(and_exprt(c1, c2), and_exprt(c3, c4)));
-      new_lemmas.push_back(witness_bounds);
+/// Replace array-lists by 'with' expressions.
+/// For instance `array-list [ 0 , x , 1 , y ]` is replaced by
+/// `ARRAYOF(0) WITH [0:=x] WITH [1:=y]`.
+/// Indexes exceeding the maximal string length are ignored.
+/// \param expr: an expression containing array-list expressions
+/// \param string_max_length: maximum length allowed for strings
+/// \return an expression containing no array-list
+exprt substitute_array_lists(exprt expr, size_t string_max_length)
+{
+  for(size_t i=0; i<expr.operands().size(); ++i)
+  {
+    // TODO: only copy when necessary
+    exprt op=(expr.operands()[i]);
+    expr.operands()[i]=substitute_array_lists(op, string_max_length);
+  }
+
+  if(expr.id()=="array-list")
+  {
+    DATA_INVARIANT(
+      expr.operands().size()>=2,
+      string_refinement_invariantt("array-lists must have at least two "
+        "operands"));
+    typet &char_type=expr.operands()[1].type();
+    array_typet arr_type(char_type, infinity_exprt(char_type));
+    exprt ret_expr=array_of_exprt(from_integer(0, char_type), arr_type);
+
+    for(size_t i=0; i<expr.operands().size()/2; i++)
+    {
+      const exprt &index=expr.operands()[i*2];
+      const exprt &value=expr.operands()[i*2+1];
+      mp_integer index_value;
+      bool not_constant=to_integer(index, index_value);
+      if(not_constant ||
+         (index_value>=0 && index_value<string_max_length))
+        ret_expr=with_exprt(ret_expr, index, value);
     }
+    return ret_expr;
+  }
+
+  return expr;
+}
+
+/// evaluation of the expression in the current model
+/// \par parameters: an expression
+/// \return an expression
+exprt string_refinementt::get(const exprt &expr) const
+{
+  exprt ecopy(expr);
+  replace_expr(symbol_resolve, ecopy);
+  if(is_char_array(ecopy.type()))
+  {
+    auto it_content=found_content.find(ecopy);
+    if(it_content!=found_content.end())
+      return it_content->second;
+
+    auto it=found_length.find(ecopy);
+    if(it!=found_length.end())
+      return get_array(ecopy, it->second);
+  }
+  else if(is_refined_string_type(ecopy.type()) && ecopy.id()==ID_struct)
+  {
+    const string_exprt &string=to_string_expr(ecopy);
+    const exprt &content=string.content();
+    const exprt &length=string.length();
+
+    const exprt arr=get_array(content, length);
+    ecopy=string_exprt(length, arr, string.type());
+  }
+
+  ecopy=supert::get(ecopy);
+
+  return substitute_array_lists(ecopy, generator.max_string_length);
+}
+
+/// Creates a solver with `axiom` as the only formula added and runs it. If it
+/// is SAT, then true is returned and the given evaluation of `var` is stored
+/// in `witness`. If UNSAT, then what witness is is undefined.
+/// \param [in] axiom: the axiom to be checked
+/// \param [in] var: the variable whose evaluation will be stored in witness
+/// \param [out] witness: the witness of the satisfying assignment if one
+///   exists. If UNSAT, then behaviour is undefined.
+/// \return: true if axiom is SAT, false if UNSAT
+bool string_refinementt::is_axiom_sat(
+  const exprt &axiom, const symbol_exprt& var, exprt &witness)
+{
+  satcheck_no_simplifiert sat_check;
+  supert::infot info;
+  info.ns=&ns;
+  info.prop=&sat_check;
+  info.refine_arithmetic=true;
+  info.refine_arrays=true;
+  info.max_node_refinement=5;
+  info.ui=ui;
+  supert solver(info);
+  solver << axiom;
+
+  switch(solver())
+  {
+  case decision_proceduret::resultt::D_SATISFIABLE:
+    {
+      witness=solver.get(var);
+      return true;
+    }
+  case decision_proceduret::resultt::D_UNSATISFIABLE:
+    return false;
+  case decision_proceduret::resultt::D_ERROR:
+  default:
+    INVARIANT(false, string_refinement_invariantt("failure in checking axiom"));
+    // To tell the compiler that the previous line bails
+    throw 0;
+  }
+}
+
+/// \related string_constraintt
+typedef std::map<exprt, std::vector<exprt>> array_index_mapt;
+
+/// \related string_constraintt
+class gather_indices_visitort: public const_expr_visitort
+{
+public:
+  array_index_mapt indices;
+
+  gather_indices_visitort(): indices() {}
+
+  void operator()(const exprt &expr) override
+  {
+    if(expr.id()==ID_index)
+    {
+      const index_exprt index=to_index_expr(expr);
+      const exprt s(index.array());
+      const exprt i(index.index());
+      indices[s].push_back(i);
+    }
+  }
+};
+
+/// \related string_constraintt
+static array_index_mapt gather_indices(const exprt &expr)
+{
+  gather_indices_visitort v;
+  expr.visit(v);
+  return v.indices;
+}
+
+/// \related string_constraintt
+class is_linear_arithmetic_expr_visitort: public const_expr_visitort
+{
+public:
+  bool correct;
+
+  is_linear_arithmetic_expr_visitort(): correct(true) {}
+
+  void operator()(const exprt &expr) override
+  {
+    if(expr.id()!=ID_plus && expr.id()!=ID_minus && expr.id()!=ID_unary_minus)
+    {
+      // This represents that the expr is a valid leaf, may not be future proof
+      // or 100% enforced, but is correct prescriptively. All non-sum exprs must
+      // be leaves.
+      correct&=expr.operands().empty();
+    }
+  }
+};
+
+/// \related string_constraintt
+static bool is_linear_arithmetic_expr(const exprt &expr)
+{
+  is_linear_arithmetic_expr_visitort v;
+  expr.visit(v);
+  return v.correct;
+}
+
+/// The universally quantified variable is only allowed to occur in index
+/// expressions in the body of a string constraint. This function returns true
+/// if this is the case and false otherwise.
+/// \related string_constraintt
+/// \param [in] expr: The string constraint to check
+/// \return true if the universal variable only occurs in index expressions,
+///   false otherwise.
+static bool universal_only_in_index(const string_constraintt &expr)
+{
+  // For efficiency, we do a depth-first search of the
+  // body. The exprt visitors do a BFS and hide the stack/queue, so we would
+  // need to store a map from child to parent.
+
+  // The unsigned int represents index depth we are. For example, if we are
+  // considering the fragment `a[b[x]]` (not inside an index expression), then
+  // the stack would look something like `[..., (a, 0), (b, 1), (x, 2)]`.
+  typedef std::pair<exprt, unsigned> valuet;
+  std::stack<valuet> stack;
+  // We start at 0 since expr is not an index expression, so expr.body() is not
+  // in an index expression.
+  stack.push(valuet(expr.body(), 0));
+  while(!stack.empty())
+  {
+    // Inspect current value
+    const valuet cur=stack.top();
+    stack.pop();
+    const exprt e=cur.first;
+    const unsigned index_depth=cur.second;
+    const unsigned child_index_depth=index_depth+(e.id()==ID_index?0:1);
+
+    // If we found the universal variable not in an index_exprt, fail
+    if(e==expr.univ_var() && index_depth==0)
+      return false;
+    else
+      forall_operands(it, e)
+        stack.push(valuet(*it, child_index_depth));
+  }
+  return true;
+}
+
+/// Checks the data invariant for \link string_constraintt
+/// \related string_constraintt
+/// \param [in] expr: the string constraint to check
+/// \return whether the constraint satisfies the invariant
+bool string_refinementt::is_valid_string_constraint(
+  const string_constraintt &expr)
+{
+  // Condition 1: The premise cannot contain any string indices
+  const array_index_mapt premise_indices=gather_indices(expr.premise());
+  if(!premise_indices.empty())
+  {
+    error() << "Premise has indices: " << from_expr(ns, "", expr) << ", map: {";
+    for(const auto &pair : premise_indices)
+    {
+      error() << from_expr(ns, "", pair.first) << ": {";
+      for(const auto &i : pair.second)
+        error() << from_expr(ns, "", i) <<  ", ";
+    }
+    error() << "}}" << eom;
+    return false;
+  }
+
+  const array_index_mapt body_indices=gather_indices(expr.body());
+  // Must validate for each string. Note that we have an invariant that the
+  // second value in the pair is non-empty.
+  for(const auto &pair : body_indices)
+  {
+    // Condition 2: All indices of the same string must be the of the same form
+    const exprt rep=pair.second.back();
+    for(size_t j=0; j<pair.second.size()-1; j++)
+    {
+      const exprt i=pair.second[j];
+      const equal_exprt equals(rep, i);
+      const exprt result=simplify_expr(equals, ns);
+      if(result.is_false())
+      {
+        error() << "Indices not equal: " << from_expr(ns, "", expr) << ", str: "
+                << from_expr(ns, "", pair.first) << eom;
+        return false;
+      }
+    }
+
+    // Condition 3: f must be linear
+    if(!is_linear_arithmetic_expr(rep))
+    {
+      error() << "f is not linear: " << from_expr(ns, "", expr) << ", str: "
+              << from_expr(ns, "", pair.first) << eom;
+      return false;
+    }
+
+    // Condition 4: the quantified variable can only occur in indices in the
+    // body
+    if(!universal_only_in_index(expr))
+    {
+      error() << "Universal variable outside of index:"
+              << from_expr(ns, "", expr) << eom;
+      return false;
+    }
+  }
+
+  return true;
 }
diff --git a/src/solvers/refinement/string_refinement.h b/src/solvers/refinement/string_refinement.h
index aa28f8a0c96..021176d4178 100644
--- a/src/solvers/refinement/string_refinement.h
+++ b/src/solvers/refinement/string_refinement.h
@@ -2,7 +2,7 @@
 
 Module: String support via creating string constraints and progressively
         instantiating the universal constraints as needed.
-	The procedure is described in the PASS paper at HVC'13:
+        The procedure is described in the PASS paper at HVC'13:
         "PASS: String Solving with Parameterized Array and Interval Automaton"
         by Guodong Li and Indradeep Ghosh
 
@@ -11,7 +11,7 @@ Author: Alberto Griggio, alberto.griggio@gmail.com
 \*******************************************************************/
 
 /// \file
-///  String support via creating string constraints and progressively
+/// String support via creating string constraints and progressively
 ///   instantiating the universal constraints as needed. The procedure is
 ///   described in the PASS paper at HVC'13: "PASS: String Solving with
 ///   Parameterized Array and Interval Automaton" by Guodong Li and Indradeep
@@ -20,55 +20,70 @@ Author: Alberto Griggio, alberto.griggio@gmail.com
 #ifndef CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_H
 #define CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_H
 
+#include <limits>
 #include <util/string_expr.h>
+#include <util/replace_expr.h>
 #include <solvers/refinement/string_constraint.h>
 #include <solvers/refinement/string_constraint_generator.h>
-
-// Defines a limit on the string witnesses we will output.
-// Longer strings are still concidered possible by the solver but
-// it will not output them.
-#define MAX_CONCRETE_STRING_SIZE 500
+#include <solvers/refinement/string_refinement_invariant.h>
 
 #define MAX_NB_REFINEMENT 100
 
-class string_refinementt: public bv_refinementt
+class string_refinementt final: public bv_refinementt
 {
 public:
-  // refinement_bound is a bound on the number of refinement allowed
-  string_refinementt(
-    const namespacet &_ns, propt &_prop, unsigned refinement_bound);
-
-  void set_mode();
-
-  // Should we use counter examples at each iteration?
-  bool use_counter_example;
-
-  virtual std::string decision_procedure_text() const
+  /// string_refinementt constructor arguments
+  struct infot
+  {
+    const namespacet *ns=nullptr;
+    propt *prop=nullptr;
+    language_uit::uit ui=language_uit::uit::PLAIN;
+    unsigned refinement_bound=0;
+    size_t string_max_length=std::numeric_limits<size_t>::max();
+    /// Make non-deterministic character arrays have at least one character
+    bool string_non_empty=false;
+    /// Concretize strings after solver is finished
+    bool trace=false;
+    /// Make non-deterministic characters printable
+    bool string_printable=false;
+    unsigned max_node_refinement=5;
+    bool refine_arrays=false;
+    bool refine_arithmetic=false;
+    bool use_counter_example=false;
+  };
+
+  explicit string_refinementt(const infot &);
+
+
+  virtual std::string decision_procedure_text() const override
   {
     return "string refinement loop with "+prop.solver_text();
   }
 
-  static exprt is_positive(const exprt &x);
+  exprt get(const exprt &expr) const override;
 
 protected:
-  typedef std::set<exprt> expr_sett;
-
-  virtual bvt convert_symbol(const exprt &expr);
-  virtual bvt convert_function_application(
-    const function_application_exprt &expr);
-
-  decision_proceduret::resultt dec_solve();
-
-  bvt convert_bool_bv(const exprt &boole, const exprt &orig);
+  decision_proceduret::resultt dec_solve() override;
 
 private:
+  const bool use_counter_example;
+  const bool do_concretizing;
   // Base class
   typedef bv_refinementt supert;
 
+  typedef std::set<exprt> expr_sett;
+  typedef std::list<exprt> exprt_listt;
+
+  string_refinementt(const infot &, bool);
+  bvt convert_bool_bv(const exprt &boole, const exprt &orig);
+
   unsigned initial_loop_bound;
 
   string_constraint_generatort generator;
 
+  const bool non_empty_string;
+  expr_sett nondet_arrays;
+
   // Simple constraints that have been given to the solver
   expr_sett seen_instances;
 
@@ -83,42 +98,105 @@ class string_refinementt: public bv_refinementt
   // Warning: this is indexed by array_expressions and not string expressions
   std::map<exprt, expr_sett> current_index_set;
   std::map<exprt, expr_sett> index_set;
+  replace_mapt symbol_resolve;
+  std::map<exprt, exprt_listt> reverse_symbol_resolve;
+  std::list<std::pair<exprt, bool>> non_string_axioms;
 
-  void display_index_set();
+  // Length of char arrays found during concretization
+  std::map<exprt, exprt> found_length;
+  // Content of char arrays found during concretization
+  std::map<exprt, array_exprt> found_content;
 
-  void add_lemma(const exprt &lemma, bool add_to_index_set=true);
+  void add_equivalence(const irep_idt & lhs, const exprt & rhs);
 
-  bool boolbv_set_equality_to_true(const equal_exprt &expr);
+  void display_index_set();
 
-  literalt convert_rest(const exprt &expr);
+  void add_lemma(const exprt &lemma,
+                 bool simplify=true,
+                 bool add_to_index_set=true);
 
-  void add_instantiations();
+  exprt substitute_function_applications(exprt expr);
+  typet substitute_java_string_types(typet type);
+  exprt substitute_java_strings(exprt expr);
+  exprt substitute_array_with_expr(const exprt &expr, const exprt &index) const;
+  void substitute_array_access(exprt &expr) const;
+  void add_symbol_to_symbol_map(const exprt &lhs, const exprt &rhs);
+  bool is_char_array(const typet &type) const;
+  bool add_axioms_for_string_assigns(const exprt &lhs, const exprt &rhs);
+  void set_to(const exprt &expr, bool value) override;
 
+  void add_instantiations();
+  void debug_model();
   bool check_axioms();
+  bool is_axiom_sat(
+    const exprt &axiom, const symbol_exprt& var, exprt &witness);
 
+  void set_char_array_equality(const exprt &lhs, const exprt &rhs);
   void update_index_set(const exprt &formula);
   void update_index_set(const std::vector<exprt> &cur);
   void initial_index_set(const string_constraintt &axiom);
   void initial_index_set(const std::vector<string_constraintt> &string_axioms);
+  void add_to_index_set(const exprt &s, exprt i);
 
   exprt instantiate(
     const string_constraintt &axiom, const exprt &str, const exprt &val);
 
-  void instantiate_not_contains(
-    const string_not_contains_constraintt &axiom,
-    std::list<exprt> &new_lemmas);
+  std::vector<exprt> instantiate_not_contains(
+    const string_not_contains_constraintt &axiom);
 
   exprt compute_inverse_function(
     const exprt &qvar, const exprt &val, const exprt &f);
 
   std::map<exprt, int> map_representation_of_sum(const exprt &f) const;
-  exprt sum_over_map(std::map<exprt, int> &m, bool negated=false) const;
+  exprt sum_over_map(
+    std::map<exprt, int> &m, const typet &type, bool negated=false) const;
+
+  bool is_valid_string_constraint(const string_constraintt &expr);
 
   exprt simplify_sum(const exprt &f) const;
 
-  exprt get_array(const exprt &arr, const exprt &size);
+  void concretize_string(const exprt &expr);
+  void concretize_results();
+  void concretize_lengths();
 
-  std::string string_of_array(const exprt &arr, const exprt &size) const;
+  exprt get_array(const exprt &arr, const exprt &size) const;
+  exprt get_array(const exprt &arr) const;
+
+  std::string string_of_array(const array_exprt &arr);
 };
 
+exprt substitute_array_lists(exprt expr, size_t string_max_length);
+
+exprt concretize_arrays_in_expression(
+  exprt expr, std::size_t string_max_length);
+
+/// Convert index-value map to a vector of values. If a value for an
+/// index is not defined, set it to the value referenced by the next higher
+/// index. The length of the resulting vector is the key of the map's
+/// last element + 1
+/// \param index_value: map containing values of specific vector cells
+/// \return Vector containing values as described in the map
+template <typename T>
+std::vector<T> fill_in_map_as_vector(
+  const std::map<std::size_t, T> &index_value)
+{
+  std::vector<T> result;
+  if(!index_value.empty())
+  {
+    result.resize(index_value.rbegin()->first+1);
+    for(auto it=index_value.rbegin(); it!=index_value.rend(); ++it)
+    {
+      const std::size_t index=it->first;
+      const T value=it->second;
+      const auto next=std::next(it);
+      const std::size_t leftmost_index_to_pad=
+        next!=index_value.rend()
+        ? next->first+1
+        : 0;
+      for(std::size_t j=leftmost_index_to_pad; j<=index; j++)
+        result[j]=value;
+    }
+  }
+  return result;
+}
 #endif
diff --git a/src/solvers/refinement/string_refinement_invariant.h b/src/solvers/refinement/string_refinement_invariant.h
new file mode 100644
index 00000000000..59f0c64cc28
--- /dev/null
+++ b/src/solvers/refinement/string_refinement_invariant.h
@@ -0,0 +1,15 @@
+/*******************************************************************\
+
+Module: Placeholder for eventual upgraded invariants.
+
+Author: Jesse Sigal, jesse.sigal@diffblue.com
+
+\*******************************************************************/
+
+#ifndef CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_INVARIANT_H
+#define CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_INVARIANT_H
+
+#define string_refinement_invariantt(reason) \
+  (("string_refinement_invariantt("+std::string(reason)+")").c_str())
+
+#endif // CPROVER_SOLVERS_REFINEMENT_STRING_REFINEMENT_INVARIANT_H
diff --git a/src/solvers/sat/satcheck_minisat2.cpp b/src/solvers/sat/satcheck_minisat2.cpp
index ef6605532c1..9e3faa2e19f 100644
--- a/src/solvers/sat/satcheck_minisat2.cpp
+++ b/src/solvers/sat/satcheck_minisat2.cpp
@@ -12,6 +12,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <inttypes.h>
 #endif
 
+#include <signal.h>
+#include <unistd.h>
+
 #include <cassert>
 #include <stack>
 
@@ -113,6 +116,17 @@ void satcheck_minisat2_baset<T>::lcnf(const bvt &bv)
   clause_counter++;
 }
 
+#ifndef _WIN32
+
+static Minisat::Solver *solver_to_interrupt=nullptr;
+
+static void interrupt_solver(int signum)
+{
+  solver_to_interrupt->interrupt();
+}
+
+#endif
+
 template<typename T>
 propt::resultt satcheck_minisat2_baset<T>::prop_solve()
 {
@@ -152,7 +166,45 @@ propt::resultt satcheck_minisat2_baset<T>::prop_solve()
         Minisat::vec<Minisat::Lit> solver_assumptions;
         convert(assumptions, solver_assumptions);
 
-        if(solver->solve(solver_assumptions))
+        using Minisat::lbool;
+
+#ifndef _WIN32
+
+        void (*old_handler)(int)=SIG_ERR;
+
+        if(time_limit_seconds!=0)
+        {
+          solver_to_interrupt=solver;
+          old_handler=signal(SIGALRM, interrupt_solver);
+          if(old_handler==SIG_ERR)
+            warning() << "Failed to set solver time limit" << eom;
+          else
+            alarm(time_limit_seconds);
+        }
+
+        lbool solver_result=solver->solveLimited(solver_assumptions);
+
+        if(old_handler!=SIG_ERR)
+        {
+          alarm(0);
+          signal(SIGALRM, old_handler);
+          solver_to_interrupt=solver;
+        }
+
+#else // _WIN32
+
+        if(time_limit_seconds!=0)
+        {
+          messaget::warning() <<
+            "Time limit ignored (not supported on Win32 yet)" << messaget::eom;
+        }
+
+        lbool solver_result=
+          solver->solve(solver_assumptions) ? l_True : l_False;
+
+#endif
+
+        if(solver_result==l_True)
         {
           messaget::status() <<
             "SAT checker: instance is SATISFIABLE" << eom;
@@ -160,11 +212,18 @@ propt::resultt satcheck_minisat2_baset<T>::prop_solve()
           status=statust::SAT;
           return resultt::P_SATISFIABLE;
         }
-        else
+        else if(solver_result==l_False)
         {
           messaget::status() <<
             "SAT checker: instance is UNSATISFIABLE" << eom;
         }
+        else
+        {
+          messaget::status() <<
+            "SAT checker: timed out or other error" << eom;
+          status=statust::ERROR;
+          return resultt::P_ERROR;
+        }
       }
     }
 
@@ -196,7 +255,7 @@ void satcheck_minisat2_baset<T>::set_assignment(literalt a, bool value)
 
 template<typename T>
 satcheck_minisat2_baset<T>::satcheck_minisat2_baset(T *_solver):
-  solver(_solver)
+  solver(_solver), time_limit_seconds(0)
 {
 }
 
diff --git a/src/solvers/sat/satcheck_minisat2.h b/src/solvers/sat/satcheck_minisat2.h
index 22026e27d85..cda5ab21bac 100644
--- a/src/solvers/sat/satcheck_minisat2.h
+++ b/src/solvers/sat/satcheck_minisat2.h
@@ -46,8 +46,14 @@ class satcheck_minisat2_baset:public cnf_solvert
   virtual bool has_set_assumptions() const final { return true; }
   virtual bool has_is_in_conflict() const final { return true; }
 
+  void set_time_limit_seconds(uint32_t lim) override
+  {
+    time_limit_seconds=lim;
+  }
+
 protected:
   T *solver;
+  uint32_t time_limit_seconds;
 
   void add_variables();
   bvt assumptions;
diff --git a/src/solvers/smt1/smt1_conv.cpp b/src/solvers/smt1/smt1_conv.cpp
index ee85dfc63a0..1a5553370f8 100644
--- a/src/solvers/smt1/smt1_conv.cpp
+++ b/src/solvers/smt1/smt1_conv.cpp
@@ -21,6 +21,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/base_type.h>
 #include <util/ieee_float.h>
 #include <util/byte_operators.h>
+#include <util/config.h>
 #include <util/c_types.h>
 
 #include <ansi-c/string_constant.h>
@@ -153,10 +154,11 @@ exprt smt1_convt::ce_value(
     pointer_logict::pointert p;
     p.object=integer2unsigned(
       binary2integer(
-        value.substr(0, BV_ADDR_BITS), false));
+        value.substr(0, config.bv_encoding.object_bits), false));
 
     p.offset=
-      binary2integer(value.substr(BV_ADDR_BITS, std::string::npos), true);
+      binary2integer(
+        value.substr(config.bv_encoding.object_bits, std::string::npos), true);
 
     result.copy_to_operands(pointer_logic.pointer_expr(p, type));
 
@@ -260,8 +262,10 @@ void smt1_convt::convert_address_of_rec(
   {
     out
       << "(concat"
-      << " bv" << pointer_logic.add_object(expr) << "[" << BV_ADDR_BITS << "]"
-      << " bv0[" << boolbv_width(result_type)-BV_ADDR_BITS << "]"
+      << " bv" << pointer_logic.add_object(expr) << "["
+      << config.bv_encoding.object_bits << "]"
+      << " bv0["
+      << boolbv_width(result_type)-config.bv_encoding.object_bits << "]"
       << ")";
   }
   else if(expr.id()==ID_index)
@@ -889,8 +893,8 @@ void smt1_convt::convert_expr(const exprt &expr, bool bool_as_bv)
     assert(expr.operands().size()==1);
     assert(expr.op0().type().id()==ID_pointer);
     std::size_t op_width=boolbv_width(expr.op0().type());
-    out << "(zero_extend[" << BV_ADDR_BITS << "] (extract["
-        << (op_width-1-BV_ADDR_BITS)
+    out << "(zero_extend[" << config.bv_encoding.object_bits << "] (extract["
+        << (op_width-1-config.bv_encoding.object_bits)
         << ":0] ";
     convert_expr(expr.op0(), true);
     out << "))";
@@ -901,7 +905,7 @@ void smt1_convt::convert_expr(const exprt &expr, bool bool_as_bv)
     assert(expr.operands().size()==1);
     assert(expr.op0().type().id()==ID_pointer);
     std::size_t op_width=boolbv_width(expr.op0().type());
-    signed int ext=boolbv_width(expr.type())-BV_ADDR_BITS;
+    signed int ext=boolbv_width(expr.type())-config.bv_encoding.object_bits;
 
     if(ext>0)
       out << "(zero_extend[" << ext << "] ";
@@ -909,7 +913,7 @@ void smt1_convt::convert_expr(const exprt &expr, bool bool_as_bv)
     out << "(extract["
         << (op_width-1)
         << ":"
-        << op_width-1-BV_ADDR_BITS << "] ";
+        << op_width-1-config.bv_encoding.object_bits << "] ";
     convert_expr(expr.op0(), true);
     out << ")";
 
@@ -933,10 +937,10 @@ void smt1_convt::convert_expr(const exprt &expr, bool bool_as_bv)
 
     out << "(= (extract["
         << (op_width-1)
-        << ":" << op_width-BV_ADDR_BITS << "] ";
+        << ":" << op_width-config.bv_encoding.object_bits << "] ";
     convert_expr(expr.op0(), true);
     out << ") bv" << pointer_logic.get_invalid_object()
-        << "[" << BV_ADDR_BITS << "])";
+        << "[" << config.bv_encoding.object_bits << "])";
 
     // this may have to be converted
     from_bool_end(type, bool_as_bv);
@@ -1853,8 +1857,8 @@ void smt1_convt::convert_constant(
       assert(boolbv_width(expr.type())!=0);
       out << "(concat"
           << " bv" << pointer_logic.get_null_object()
-          << "[" << BV_ADDR_BITS << "]"
-          << " bv0[" << boolbv_width(expr.type())-BV_ADDR_BITS
+          << "[" << config.bv_encoding.object_bits << "]"
+          << " bv0[" << boolbv_width(expr.type())-config.bv_encoding.object_bits
           << "]"
           << ")"; // concat
     }
@@ -1945,14 +1949,14 @@ void smt1_convt::convert_is_dynamic_object(
 
     out << "(let (?obj (extract["
         << (op_width-1)
-        << ":" << op_width-BV_ADDR_BITS << "] ";
+        << ":" << op_width-config.bv_encoding.object_bits << "] ";
     convert_expr(expr.op0(), true);
     out << ")) ";
 
     if(dynamic_objects.size()==1)
     {
       out << "(= bv" << dynamic_objects.front()
-          << "[" << BV_ADDR_BITS << "] ?obj)";
+          << "[" << config.bv_encoding.object_bits << "] ?obj)";
     }
     else
     {
@@ -1960,7 +1964,7 @@ void smt1_convt::convert_is_dynamic_object(
 
       for(const auto &obj : dynamic_objects)
         out << " (= bv" << obj
-            << "[" << BV_ADDR_BITS << "] ?obj)";
+            << "[" << config.bv_encoding.object_bits << "] ?obj)";
 
       out << ")"; // or
     }
diff --git a/src/solvers/smt2/smt2_conv.cpp b/src/solvers/smt2/smt2_conv.cpp
index 50aff65da36..a362435e91a 100644
--- a/src/solvers/smt2/smt2_conv.cpp
+++ b/src/solvers/smt2/smt2_conv.cpp
@@ -20,6 +20,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <util/fixedbv.h>
 #include <util/ieee_float.h>
 #include <util/invariant.h>
+#include <util/config.h>
 #include <util/pointer_offset_size.h>
 #include <util/std_types.h>
 #include <util/std_expr.h>
@@ -142,7 +143,7 @@ void smt2_convt::define_object_size(
   std::size_t pointer_width = boolbv_width(ptr.type());
   std::size_t number = 0;
   std::size_t h=pointer_width-1;
-  std::size_t l=pointer_width-BV_ADDR_BITS;
+  std::size_t l=pointer_width-config.bv_encoding.object_bits;
 
   for(const auto &o : pointer_logic.objects)
   {
@@ -161,9 +162,10 @@ void smt2_convt::define_object_size(
     out << "(assert (implies (= " <<
       "((_ extract " << h << " " << l << ") ";
     convert_expr(ptr);
-    out << ") (_ bv" << number << " " << BV_ADDR_BITS << "))" <<
-      "(= " << id << " (_ bv" << object_size.to_ulong() << " " <<
-      size_width << "))))\n";
+    out << ") (_ bv" << number << " "
+        << config.bv_encoding.object_bits << "))"
+        << "(= " << id << " (_ bv" << object_size.to_ulong() << " "
+        << size_width << "))))\n";
 
     ++number;
   }
@@ -454,7 +456,7 @@ exprt smt2_convt::parse_rec(const irept &src, const typet &_type)
     to_integer(bv_expr, v);
 
     // split into object and offset
-    mp_integer pow=power(2, width-BV_ADDR_BITS);
+    mp_integer pow=power(2, width-config.bv_encoding.object_bits);
     pointer_logict::pointert ptr;
     ptr.object=integer2size_t(v/pow);
     ptr.offset=v%pow;
@@ -487,8 +489,10 @@ void smt2_convt::convert_address_of_rec(
   {
     out
       << "(concat (_ bv"
-      << pointer_logic.add_object(expr) << " " << BV_ADDR_BITS << ")"
-      << " (_ bv0 " << boolbv_width(result_type)-BV_ADDR_BITS << "))";
+      << pointer_logic.add_object(expr) << " "
+      << config.bv_encoding.object_bits << ")"
+      << " (_ bv0 "
+      << boolbv_width(result_type)-config.bv_encoding.object_bits << "))";
   }
   else if(expr.id()==ID_index)
   {
@@ -1308,7 +1312,8 @@ void smt2_convt::convert_expr(const exprt &expr)
   {
     assert(expr.operands().size()==1);
     assert(expr.op0().type().id()==ID_pointer);
-    std::size_t offset_bits=boolbv_width(expr.op0().type())-BV_ADDR_BITS;
+    std::size_t offset_bits=
+      boolbv_width(expr.op0().type())-config.bv_encoding.object_bits;
     std::size_t result_width=boolbv_width(expr.type());
 
     // max extract width
@@ -1330,7 +1335,7 @@ void smt2_convt::convert_expr(const exprt &expr)
   {
     assert(expr.operands().size()==1);
     assert(expr.op0().type().id()==ID_pointer);
-    std::size_t ext=boolbv_width(expr.type())-BV_ADDR_BITS;
+    std::size_t ext=boolbv_width(expr.type())-config.bv_encoding.object_bits;
     std::size_t pointer_width=boolbv_width(expr.op0().type());
 
     if(ext>0)
@@ -1338,7 +1343,7 @@ void smt2_convt::convert_expr(const exprt &expr)
 
     out << "((_ extract "
         << pointer_width-1 << " "
-        << pointer_width-BV_ADDR_BITS << ") ";
+        << pointer_width-config.bv_encoding.object_bits << ") ";
     convert_expr(expr.op0());
     out << ")";
 
@@ -1356,10 +1361,10 @@ void smt2_convt::convert_expr(const exprt &expr)
     std::size_t pointer_width=boolbv_width(expr.op0().type());
     out << "(= ((_ extract "
         << pointer_width-1 << " "
-        << pointer_width-BV_ADDR_BITS << ") ";
+        << pointer_width-config.bv_encoding.object_bits << ") ";
     convert_expr(expr.op0());
     out << ") (_ bv" << pointer_logic.get_invalid_object()
-        << " " << BV_ADDR_BITS << "))";
+        << " " << config.bv_encoding.object_bits << "))";
   }
   else if(expr.id()=="pointer_object_has_type")
   {
@@ -2725,14 +2730,14 @@ void smt2_convt::convert_is_dynamic_object(const exprt &expr)
 
     out << "(let ((?obj ((_ extract "
         << pointer_width-1 << " "
-        << pointer_width-BV_ADDR_BITS << ") ";
+        << pointer_width-config.bv_encoding.object_bits << ") ";
     convert_expr(expr.op0());
     out << "))) ";
 
     if(dynamic_objects.size()==1)
     {
       out << "(= (_ bv" << dynamic_objects.front()
-          << " " << BV_ADDR_BITS << ") ?obj)";
+          << " " << config.bv_encoding.object_bits << ") ?obj)";
     }
     else
     {
@@ -2740,7 +2745,7 @@ void smt2_convt::convert_is_dynamic_object(const exprt &expr)
 
       for(const auto &object : dynamic_objects)
         out << " (= (_ bv" << object
-            << " " << BV_ADDR_BITS << ") ?obj)";
+            << " " << config.bv_encoding.object_bits << ") ?obj)";
 
       out << ")"; // or
     }
diff --git a/src/symex/path_search.cpp b/src/symex/path_search.cpp
index 54f15543430..6da4eab0856 100644
--- a/src/symex/path_search.cpp
+++ b/src/symex/path_search.cpp
@@ -293,7 +293,7 @@ bool path_searcht::drop_state(const statet &state)
     return true;
 
   // unwinding limit -- loops
-  if(unwind_limit!=std::numeric_limits<unsigned>::max() && 
+  if(unwind_limit!=std::numeric_limits<unsigned>::max() &&
      pc->is_backwards_goto())
   {
     bool stop=false;
diff --git a/src/symex/symex_main.cpp b/src/symex/symex_main.cpp
index 36080f4a69a..8d6f4a2089c 100644
--- a/src/symex/symex_main.cpp
+++ b/src/symex/symex_main.cpp
@@ -16,14 +16,13 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifdef _MSC_VER
 int wmain(int argc, const wchar_t **argv_wide)
 {
-  const char **argv=narrow_argv(argc, argv_wide);
-  symex_parse_optionst parse_options(argc, argv);
-  return parse_options.main();
-}
+  auto vec=narrow_argv(argc, argv_wide);
+  auto narrow=to_c_str_array(std::begin(vec), std::end(vec));
+  auto argv=narrow.data();
 #else
 int main(int argc, const char **argv)
 {
+#endif
   symex_parse_optionst parse_options(argc, argv);
   return parse_options.main();
 }
-#endif
diff --git a/src/symex/symex_parse_options.cpp b/src/symex/symex_parse_options.cpp
index c2e567cc643..2361f3c494c 100644
--- a/src/symex/symex_parse_options.cpp
+++ b/src/symex/symex_parse_options.cpp
@@ -37,6 +37,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <goto-programs/xml_goto_trace.h>
 #include <goto-programs/remove_complex.h>
 #include <goto-programs/remove_function_pointers.h>
+#include <goto-programs/remove_skip.h>
 #include <goto-programs/remove_vector.h>
 #include <goto-programs/remove_virtual_functions.h>
 #include <goto-programs/remove_exceptions.h>
@@ -314,6 +315,7 @@ bool symex_parse_optionst::process_goto_program(const optionst &options)
     // Java virtual functions -> explicit dispatch tables:
     remove_virtual_functions(goto_model);
     // Java throw and catch -> explicit exceptional return variables:
+    // This introduces instanceof, so order is important:
     remove_exceptions(goto_model);
     // Java instanceof -> clsid comparison:
     remove_instanceof(goto_model);
@@ -333,6 +335,10 @@ bool symex_parse_optionst::process_goto_program(const optionst &options)
       remove_unused_functions(goto_model.goto_functions, ui_message_handler);
     }
 
+    // remove skips such that trivial GOTOs are deleted and not considered
+    // for coverage annotation:
+    remove_skip(goto_model.goto_functions);
+
     if(cmdline.isset("cover"))
     {
       std::string criterion=cmdline.get_value("cover");
@@ -493,7 +499,7 @@ void symex_parse_optionst::report_success()
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -518,7 +524,7 @@ void symex_parse_optionst::show_counterexample(
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -541,7 +547,7 @@ void symex_parse_optionst::report_failure()
     break;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -607,6 +613,9 @@ void symex_parse_optionst::help()
     " --round-to-zero              IEEE floating point rounding mode\n"
     " --function name              set main function name\n"
     "\n"
+    "Java Bytecode frontend options:\n"
+    JAVA_BYTECODE_LANGUAGE_OPTIONS_HELP
+    "\n"
     "Program instrumentation options:\n"
     HELP_GOTO_CHECK
     " --no-assertions              ignore user assertions\n"
diff --git a/src/symex/symex_parse_options.h b/src/symex/symex_parse_options.h
index a9f3d9e3e83..7278cbf1261 100644
--- a/src/symex/symex_parse_options.h
+++ b/src/symex/symex_parse_options.h
@@ -22,6 +22,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <analyses/goto_check.h>
 
+#include <java_bytecode/java_bytecode_language.h>
+
 #include "path_search.h"
 
 class goto_functionst;
@@ -47,7 +49,8 @@ class optionst;
   "(drop-unused-functions)" \
   OPT_SHOW_GOTO_FUNCTIONS \
   "(property):(trace)(show-trace)(stop-on-fail)(eager-infeasibility)" \
-  "(no-simplify)(no-unwinding-assertions)(no-propagation)"
+  "(no-simplify)(no-unwinding-assertions)(no-propagation)" \
+  JAVA_BYTECODE_LANGUAGE_OPTIONS
   // the last line is for CBMC-regression testing only
 
 class symex_parse_optionst:
diff --git a/src/util/Makefile b/src/util/Makefile
index 63be2f999b0..37c7ea25aa0 100644
--- a/src/util/Makefile
+++ b/src/util/Makefile
@@ -17,6 +17,7 @@ SRC = arith_tools.cpp \
       find_symbols.cpp \
       fixedbv.cpp \
       format_constant.cpp \
+      format_number_range.cpp \
       fresh_symbol.cpp \
       get_base_name.cpp \
       get_module.cpp \
@@ -30,6 +31,7 @@ SRC = arith_tools.cpp \
       irep_hash_container.cpp \
       irep_ids.cpp \
       irep_serialization.cpp \
+      invariant_utils.cpp \
       json.cpp \
       json_expr.cpp \
       json_irep.cpp \
@@ -42,6 +44,7 @@ SRC = arith_tools.cpp \
       message.cpp \
       mp_arith.cpp \
       namespace.cpp \
+      nondet_ifthenelse.cpp \
       options.cpp \
       parameter_indices.cpp \
       parse_options.cpp \
@@ -52,6 +55,7 @@ SRC = arith_tools.cpp \
       rational.cpp \
       rational_tools.cpp \
       ref_expr_set.cpp \
+      refined_string_type.cpp \
       rename.cpp \
       rename_symbol.cpp \
       replace_expr.cpp \
diff --git a/src/util/arith_tools.cpp b/src/util/arith_tools.cpp
index 5b94a141dfa..680b5309775 100644
--- a/src/util/arith_tools.cpp
+++ b/src/util/arith_tools.cpp
@@ -199,7 +199,7 @@ constant_exprt from_integer(
   }
 
   {
-    assert(false);
+    PRECONDITION(false);
     constant_exprt r;
     r.make_nil();
     return r;
diff --git a/src/util/arith_tools.h b/src/util/arith_tools.h
index e9691db7322..ebb243952f4 100644
--- a/src/util/arith_tools.h
+++ b/src/util/arith_tools.h
@@ -26,7 +26,7 @@ bool to_integer(const constant_exprt &expr, mp_integer &int_value);
 // returns 'true' on error
 bool to_unsigned_integer(const constant_exprt &expr, unsigned &uint_value);
 
-// assert(false) in case of unsupported type
+// PRECONDITION(false) in case of unsupported type
 constant_exprt from_integer(const mp_integer &int_value, const typet &type);
 
 // ceil(log2(size))
diff --git a/src/util/bv_arithmetic.cpp b/src/util/bv_arithmetic.cpp
index 4287e04adf1..b04dee98aa0 100644
--- a/src/util/bv_arithmetic.cpp
+++ b/src/util/bv_arithmetic.cpp
@@ -42,7 +42,7 @@ void bv_spect::from_type(const typet &type)
   else if(type.id()==ID_signedbv)
     is_signed=true;
   else
-    assert(0);
+    UNREACHABLE;
 
   width=unsafe_string2unsigned(type.get_string(ID_width));
 }
diff --git a/src/util/byte_operators.cpp b/src/util/byte_operators.cpp
index 9ebc340d9cb..74aa67e53d7 100644
--- a/src/util/byte_operators.cpp
+++ b/src/util/byte_operators.cpp
@@ -10,6 +10,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include <cassert>
 
+#include "invariant.h"
 #include "config.h"
 
 irep_idt byte_extract_id()
@@ -23,7 +24,7 @@ irep_idt byte_extract_id()
     return ID_byte_extract_big_endian;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -38,6 +39,6 @@ irep_idt byte_update_id()
     return ID_byte_update_big_endian;
 
   default:
-    assert(false);
+    UNREACHABLE;
   }
 }
diff --git a/src/util/c_types.cpp b/src/util/c_types.cpp
index cc2880cb577..6c553f5adbc 100644
--- a/src/util/c_types.cpp
+++ b/src/util/c_types.cpp
@@ -9,6 +9,7 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "std_types.h"
 #include "config.h"
+#include "invariant.h"
 
 #include "c_types.h"
 
@@ -67,7 +68,7 @@ unsignedbv_typet size_type()
   else if(config.ansi_c.pointer_width==config.ansi_c.long_long_int_width)
     return unsigned_long_long_int_type();
   else
-    assert(false); // aaah!
+    INVARIANT(false, "width of size type"); // aaah!
 }
 
 signedbv_typet signed_size_type()
@@ -249,7 +250,7 @@ bitvector_typet long_double_type()
       // not quite right. The extra bits beyond 80 are usually padded.
     }
     else
-      assert(false);
+      INVARIANT(false, "width of long double");
 
     result.set(ID_C_c_type, ID_long_double);
 
@@ -290,7 +291,7 @@ signedbv_typet pointer_diff_type()
   else if(config.ansi_c.pointer_width==config.ansi_c.long_long_int_width)
     return signed_long_long_int_type();
   else
-    assert(false); // aaah!
+    INVARIANT(false, "width of pointer difference");
 }
 
 pointer_typet pointer_type(const typet &subtype)
diff --git a/src/util/cmdline.cpp b/src/util/cmdline.cpp
index 5010a48e8d3..a310a6c28cd 100644
--- a/src/util/cmdline.cpp
+++ b/src/util/cmdline.cpp
@@ -70,10 +70,13 @@ void cmdlinet::set(const std::string &option, const std::string &value)
   options[i].values.push_back(value);
 }
 
+static std::list<std::string> immutable_empty_list;
+
 const std::list<std::string> &cmdlinet::get_values(char option) const
 {
   int i=getoptnr(option);
-  assert(i>=0);
+  if(i<0)
+    return immutable_empty_list;
   return options[i].values;
 }
 
@@ -91,7 +94,8 @@ const std::list<std::string> &cmdlinet::get_values(
   const std::string &option) const
 {
   int i=getoptnr(option);
-  assert(i>=0);
+  if(i<0)
+    return immutable_empty_list;
   return options[i].values;
 }
 
@@ -184,7 +188,10 @@ bool cmdlinet::parse(int argc, const char **argv, const char *optstring)
       }
 
       if(optnr<0)
+      {
+        unknown_arg=argv[i];
         return true;
+      }
       options[optnr].isset=true;
       if(options[optnr].hasval)
       {
diff --git a/src/util/cmdline.h b/src/util/cmdline.h
index 94ac1db5c6f..2d58daa8d44 100644
--- a/src/util/cmdline.h
+++ b/src/util/cmdline.h
@@ -33,6 +33,7 @@ class cmdlinet
 
   typedef std::vector<std::string> argst;
   argst args;
+  std::string unknown_arg;
 
   cmdlinet();
   virtual ~cmdlinet();
diff --git a/src/util/config.cpp b/src/util/config.cpp
index a256ff6b17e..4048cfd417a 100644
--- a/src/util/config.cpp
+++ b/src/util/config.cpp
@@ -17,6 +17,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "simplify_expr.h"
 #include "std_expr.h"
 #include "cprover_prefix.h"
+#include "string2int.h"
 
 configt config;
 
@@ -171,7 +172,7 @@ void configt::ansi_ct::set_arch_spec_i386()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -208,7 +209,7 @@ void configt::ansi_ct::set_arch_spec_x86_64()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -269,7 +270,7 @@ void configt::ansi_ct::set_arch_spec_power(const irep_idt &subarch)
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -312,7 +313,7 @@ void configt::ansi_ct::set_arch_spec_arm(const irep_idt &subarch)
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -341,7 +342,7 @@ void configt::ansi_ct::set_arch_spec_alpha()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -381,7 +382,7 @@ void configt::ansi_ct::set_arch_spec_mips(const irep_idt &subarch)
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -391,7 +392,7 @@ void configt::ansi_ct::set_arch_spec_mips(const irep_idt &subarch)
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -410,7 +411,7 @@ void configt::ansi_ct::set_arch_spec_s390()
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -420,7 +421,7 @@ void configt::ansi_ct::set_arch_spec_s390()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -438,7 +439,7 @@ void configt::ansi_ct::set_arch_spec_s390x()
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -448,7 +449,7 @@ void configt::ansi_ct::set_arch_spec_s390x()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -478,7 +479,7 @@ void configt::ansi_ct::set_arch_spec_sparc(const irep_idt &subarch)
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -488,7 +489,7 @@ void configt::ansi_ct::set_arch_spec_sparc(const irep_idt &subarch)
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -519,7 +520,7 @@ void configt::ansi_ct::set_arch_spec_ia64()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -544,7 +545,7 @@ void configt::ansi_ct::set_arch_spec_x32()
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -554,7 +555,7 @@ void configt::ansi_ct::set_arch_spec_x32()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -598,7 +599,7 @@ void configt::ansi_ct::set_arch_spec_hppa()
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -608,7 +609,7 @@ void configt::ansi_ct::set_arch_spec_hppa()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -628,7 +629,7 @@ void configt::ansi_ct::set_arch_spec_sh4()
     break;
 
   case flavourt::VISUAL_STUDIO:
-    assert(false); // not supported by Visual Studio
+    UNREACHABLE; // not supported by Visual Studio
     break;
 
   case flavourt::APPLE:
@@ -638,7 +639,7 @@ void configt::ansi_ct::set_arch_spec_sh4()
     break;
 
   case flavourt::NONE:
-    assert(false);
+    UNREACHABLE;
   }
 }
 
@@ -730,6 +731,10 @@ bool configt::set(const cmdlinet &cmdline)
 
   cpp.cpp_standard=cppt::default_cpp_standard();
 
+  bv_encoding.object_bits=bv_encoding.default_object_bits;
+  // This will allow us to override by language defaults later.
+  bv_encoding.is_object_bits_default=true;
+
   ansi_c.single_precision_constant=false;
   ansi_c.for_has_scope=true; // C99 or later
   ansi_c.c_standard=ansi_ct::default_c_standard();
@@ -1010,6 +1015,20 @@ bool configt::set(const cmdlinet &cmdline)
   if(cmdline.isset("round-to-zero"))
     ansi_c.rounding_mode=ieee_floatt::ROUND_TO_ZERO;
 
+  if(cmdline.isset("object-bits"))
+  {
+    bv_encoding.object_bits=
+      unsafe_string2unsigned(cmdline.get_value("object-bits"));
+    bv_encoding.is_object_bits_default=false;
+
+    if(!(0<bv_encoding.object_bits &&
+         bv_encoding.object_bits<ansi_c.pointer_width))
+    {
+      throw "object-bits must be positive and less than the pointer width ("+
+        std::to_string(ansi_c.pointer_width)+") ";
+    }
+  }
+
   return false;
 }
 
@@ -1143,6 +1162,46 @@ void configt::set_from_symbol_table(
 
   // mode, preprocessor (and all preprocessor command line options),
   // lib, string_abstraction not stored in namespace
+
+  set_object_bits_from_symbol_table(symbol_table);
+}
+
+/// Sets the number of bits used for object addresses
+/// \param symbol_table The symbol table
+void configt::set_object_bits_from_symbol_table(
+  const symbol_tablet &symbol_table)
+{
+  // has been overridden by command line option,
+  //   thus do not apply language defaults
+  if(!bv_encoding.is_object_bits_default)
+    return;
+
+  // set object_bits according to entry point language
+  if(symbol_table.has_symbol(CPROVER_PREFIX "_start"))
+  {
+    const symbolt &entry_point_symbol=
+      symbol_table.lookup(CPROVER_PREFIX "_start");
+
+    if(entry_point_symbol.mode==ID_java)
+      bv_encoding.object_bits=java.default_object_bits;
+    else if(entry_point_symbol.mode==ID_C)
+      bv_encoding.object_bits=ansi_c.default_object_bits;
+    else if(entry_point_symbol.mode==ID_cpp)
+      bv_encoding.object_bits=cpp.default_object_bits;
+    DATA_INVARIANT(
+      0<bv_encoding.object_bits && bv_encoding.object_bits<ansi_c.pointer_width,
+      "object_bits should fit into pointer width");
+  }
+}
+
+std::string configt::object_bits_info()
+{
+  return "Running with "+std::to_string(bv_encoding.object_bits)+
+    " object bits, "+
+    std::to_string(ansi_c.pointer_width-bv_encoding.object_bits)+
+    " offset bits ("+
+    (bv_encoding.is_object_bits_default ? "default" : "user-specified")+
+    ")";
 }
 
 irep_idt configt::this_architecture()
diff --git a/src/util/config.h b/src/util/config.h
index 6fb4a5a2376..4b1b39c1402 100644
--- a/src/util/config.h
+++ b/src/util/config.h
@@ -118,6 +118,8 @@ class configt
     libt lib;
 
     bool string_abstraction;
+
+    static const unsigned default_object_bits=8;
   } ansi_c;
 
   struct cppt
@@ -129,6 +131,8 @@ class configt
     void set_cpp03() { cpp_standard=cpp_standardt::CPP03; }
     void set_cpp11() { cpp_standard=cpp_standardt::CPP11; }
     void set_cpp14() { cpp_standard=cpp_standardt::CPP14; }
+
+    static const unsigned default_object_bits=8;
   } cpp;
 
   struct verilogt
@@ -141,8 +145,19 @@ class configt
     typedef std::list<std::string> classpatht;
     classpatht classpath;
     irep_idt main_class;
+
+    static const unsigned default_object_bits=16;
   } java;
 
+  struct bv_encodingt
+  {
+    // number of bits to encode heap object addresses
+    unsigned object_bits;
+    bool is_object_bits_default;
+
+    static const unsigned default_object_bits=8;
+  } bv_encoding;
+
   // this is the function to start executing
   std::string main;
 
@@ -152,10 +167,14 @@ class configt
 
   bool set(const cmdlinet &cmdline);
 
-  void set_classpath(const std::string &cp);
+  void set_object_bits_from_symbol_table(const symbol_tablet &);
+  std::string object_bits_info();
 
   static irep_idt this_architecture();
   static irep_idt this_operating_system();
+
+private:
+  void set_classpath(const std::string &cp);
 };
 
 extern configt config;
diff --git a/src/util/constexpr.def b/src/util/constexpr.def
new file mode 100644
index 00000000000..fa4f20fa0f4
--- /dev/null
+++ b/src/util/constexpr.def
@@ -0,0 +1,6 @@
+#if defined(__GNUC__) || defined(__clang__)
+#define CBMC_CONSTEXPR constexpr
+#else
+#define CBMC_CONSTEXPR
+#endif
+
diff --git a/src/util/cout_message.cpp b/src/util/cout_message.cpp
index 5221fda0f21..3f84ea3e802 100644
--- a/src/util/cout_message.cpp
+++ b/src/util/cout_message.cpp
@@ -31,9 +31,10 @@ cerr_message_handlert::cerr_message_handlert():
 
 void console_message_handlert::print(
   unsigned level,
-  const std::string &message)
+  const std::string &message,
+  bool preformatted)
 {
-  message_handlert::print(level, message);
+  message_handlert::print(level, message, preformatted);
 
   if(verbosity<level)
     return;
@@ -101,7 +102,8 @@ void gcc_message_handlert::print(
   unsigned level,
   const std::string &message,
   int sequence_number,
-  const source_locationt &location)
+  const source_locationt &location,
+  bool preformatted)
 {
   const irep_idt file=location.get_file();
   const irep_idt line=location.get_line();
@@ -139,14 +141,15 @@ void gcc_message_handlert::print(
 
   dest+=message;
 
-  print(level, dest);
+  print(level, dest, preformatted);
 }
 
 void gcc_message_handlert::print(
   unsigned level,
-  const std::string &message)
+  const std::string &message,
+  bool preformatted)
 {
-  message_handlert::print(level, message);
+  message_handlert::print(level, message, preformatted);
 
   // gcc appears to send everything to cerr
   if(verbosity>=level)
diff --git a/src/util/cout_message.h b/src/util/cout_message.h
index 39d4bddd349..df3fd535dd6 100644
--- a/src/util/cout_message.h
+++ b/src/util/cout_message.h
@@ -32,7 +32,8 @@ class console_message_handlert:public ui_message_handlert
   // level 4 and upwards go to cout, level 1-3 to cerr
   virtual void print(
     unsigned level,
-    const std::string &message) override;
+    const std::string &message,
+    bool preformatted) override;
 
   virtual void flush(unsigned level) override;
 };
@@ -43,13 +44,15 @@ class gcc_message_handlert:public ui_message_handlert
   // aims to imitate the messages gcc prints
   virtual void print(
     unsigned level,
-    const std::string &message) override;
+    const std::string &message,
+    bool preformatted) override;
 
   virtual void print(
     unsigned level,
     const std::string &message,
     int sequence_number,
-    const source_locationt &location) override;
+    const source_locationt &location,
+    bool preformatted) override;
 };
 
 #endif // CPROVER_UTIL_COUT_MESSAGE_H
diff --git a/src/util/decision_procedure.cpp b/src/util/decision_procedure.cpp
index 85f52acdba2..61f30f626b4 100644
--- a/src/util/decision_procedure.cpp
+++ b/src/util/decision_procedure.cpp
@@ -15,6 +15,6 @@ Author: Daniel Kroening, kroening@kroening.com
 
 bool decision_proceduret::in_core(const exprt &expr)
 {
-  assert(false);
+  UNREACHABLE;
   return true;
 }
diff --git a/src/util/endianness_map.cpp b/src/util/endianness_map.cpp
index 913bc8ad5df..677f7b6b81e 100644
--- a/src/util/endianness_map.cpp
+++ b/src/util/endianness_map.cpp
@@ -9,8 +9,8 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "endianness_map.h"
 
 #include <ostream>
-#include <cassert>
 
+#include "invariant.h"
 #include "std_types.h"
 #include "pointer_offset_size.h"
 #include "arith_tools.h"
@@ -64,7 +64,7 @@ void endianness_mapt::build_big_endian(const typet &src)
   {
     // these do get re-ordered!
     mp_integer bits=pointer_offset_bits(src, ns); // error is -1
-    assert(bits>=0);
+    CHECK_RETURN(bits>=0);
 
     size_t bits_int=integer2size_t(bits), base=map.size();
 
@@ -107,7 +107,7 @@ void endianness_mapt::build_big_endian(const typet &src)
 
     mp_integer s;
     if(to_integer(vector_type.size(), s))
-      assert(false);
+      CHECK_RETURN(false);
 
     while(s>0)
     {
diff --git a/src/util/expanding_vector.h b/src/util/expanding_vector.h
index f8b0421db72..8c2af9cdb3f 100644
--- a/src/util/expanding_vector.h
+++ b/src/util/expanding_vector.h
@@ -13,31 +13,40 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <vector>
 
 template<typename T>
-class expanding_vectort:public std::vector<T>
+class expanding_vectort
 {
+  typedef std::vector<T> data_typet;
+  data_typet data;
+
 public:
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::size_type size_type;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::iterator iterator;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::const_iterator const_iterator;
+
   T &operator[] (typename std::vector<T>::size_type n)
   {
-    check_index(n);
-    return subt::operator[](n);
+    if(n>=data.size())
+      data.resize(n+1);
+    return data[n];
   }
 
-  const T &operator[] (typename std::vector<T>::size_type n) const
-  {
-    // hack-ish const cast
-    const_cast<expanding_vectort*>(this)->check_index(n);
-    return subt::operator[](n);
-  }
+  void clear() { data.clear(); }
 
-protected:
-  typedef std::vector<T> subt;
+  iterator begin() { return data.begin(); }
+  const_iterator begin() const { return data.begin(); }
+  const_iterator cbegin() const { return data.cbegin(); }
 
-  // make the vector large enough to contain 'n'
-  void check_index(typename std::vector<T>::size_type n)
-  {
-    if(n>=subt::size())
-      subt::resize(n+1);
-  }
+  iterator end() { return data.end(); }
+  const_iterator end() const { return data.end(); }
+  const_iterator cend() const { return data.cend(); }
+
+  size_type size() const { return data.size(); }
+
+  void push_back(const T &t) { data.push_back(t); }
+  void push_back(T &&t) { data.push_back(std::move(t)); }
 };
 
 #endif // CPROVER_UTIL_EXPANDING_VECTOR_H
diff --git a/src/util/expr.cpp b/src/util/expr.cpp
index ee7f310d471..d252e6cbd91 100644
--- a/src/util/expr.cpp
+++ b/src/util/expr.cpp
@@ -10,16 +10,14 @@ Author: Daniel Kroening, kroening@kroening.com
 /// Expression Representation
 
 #include "expr.h"
-
 #include <cassert>
-
 #include <stack>
-
 #include "string2int.h"
 #include "mp_arith.h"
 #include "fixedbv.h"
 #include "ieee_float.h"
 #include "invariant.h"
+#include "expr_iterator.h"
 #include "rational.h"
 #include "rational_tools.h"
 #include "arith_tools.h"
@@ -515,3 +513,25 @@ void exprt::visit(const_expr_visitort &visitor) const
       stack.push(&(*it));
   }
 }
+
+depth_iteratort exprt::depth_begin()
+{ return depth_iteratort(*this); }
+depth_iteratort exprt::depth_end()
+{ return depth_iteratort(); }
+const_depth_iteratort exprt::depth_begin() const
+{ return const_depth_iteratort(*this); }
+const_depth_iteratort exprt::depth_end() const
+{ return const_depth_iteratort(); }
+const_depth_iteratort exprt::depth_cbegin() const
+{ return const_depth_iteratort(*this); }
+const_depth_iteratort exprt::depth_cend() const
+{ return const_depth_iteratort(); }
+
+const_unique_depth_iteratort exprt::unique_depth_begin() const
+{ return const_unique_depth_iteratort(*this); }
+const_unique_depth_iteratort exprt::unique_depth_end() const
+{ return const_unique_depth_iteratort(); }
+const_unique_depth_iteratort exprt::unique_depth_cbegin() const
+{ return const_unique_depth_iteratort(*this); }
+const_unique_depth_iteratort exprt::unique_depth_cend() const
+{ return const_unique_depth_iteratort(); }
diff --git a/src/util/expr.h b/src/util/expr.h
index 2d58dca1cf2..b58803f5689 100644
--- a/src/util/expr.h
+++ b/src/util/expr.h
@@ -41,6 +41,10 @@ Author: Daniel Kroening, kroening@kroening.com
   for(expr_listt::iterator it=(expr).begin(); \
       it!=(expr).end(); ++it)
 
+class depth_iteratort;
+class const_depth_iteratort;
+class const_unique_depth_iteratort;
+
 /*! \brief Base class for all expressions
 */
 class exprt:public irept
@@ -161,6 +165,17 @@ class exprt:public irept
 
   void visit(class expr_visitort &visitor);
   void visit(class const_expr_visitort &visitor) const;
+
+  depth_iteratort depth_begin();
+  depth_iteratort depth_end();
+  const_depth_iteratort depth_begin() const;
+  const_depth_iteratort depth_end() const;
+  const_depth_iteratort depth_cbegin() const;
+  const_depth_iteratort depth_cend() const;
+  const_unique_depth_iteratort unique_depth_begin() const;
+  const_unique_depth_iteratort unique_depth_end() const;
+  const_unique_depth_iteratort unique_depth_cbegin() const;
+  const_unique_depth_iteratort unique_depth_cend() const;
 };
 
 typedef std::list<exprt> expr_listt;
diff --git a/src/util/expr_iterator.h b/src/util/expr_iterator.h
new file mode 100644
index 00000000000..be228bcfba4
--- /dev/null
+++ b/src/util/expr_iterator.h
@@ -0,0 +1,247 @@
+/*******************************************************************\
+
+ Module: exprt iterator module
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#ifndef CPROVER_UTIL_EXPR_ITERATOR_H
+#define CPROVER_UTIL_EXPR_ITERATOR_H
+
+#include <iterator>
+#include <functional>
+#include <set>
+#include <algorithm>
+#include "expr.h"
+#include "invariant.h"
+
+// Forward declarations - table of contents
+
+/// \file Forward depth-first search iterators
+/// These iterators' copy operations are expensive, so use auto&, and avoid
+/// std::next(), std::prev() and post-increment iterator
+///
+/// Non-const iterators dereference to const exprt (for use with STL
+/// algorithms) but have an extra .mutate() method. That method is used
+/// to access non-const exprt reference but is an expensive operation
+
+/// Naive depth-first-search iterator with .mutate method for
+/// modifying exprt under the iterator.
+class depth_iteratort;
+/// Naive depth-first-search iterator.
+class const_depth_iteratort;
+/// Depth first-search iterator with duplicate avoidance (skips over
+/// duplicates, shows only first encountered child)
+/// Slower iteration than naive version. Very expensive copy.
+class const_unique_depth_iteratort;
+
+/// Helper class for depth_iterator_baset
+struct depth_iterator_expr_statet final
+{
+  typedef std::vector<exprt>::const_iterator operands_iteratort;
+  inline depth_iterator_expr_statet(
+    const exprt &expr,
+    operands_iteratort it,
+    operands_iteratort end):
+    expr(expr), it(it), end(end) { }
+  std::reference_wrapper<const exprt> expr;
+  operands_iteratort it;
+  operands_iteratort end;
+};
+
+inline bool operator==(
+  const depth_iterator_expr_statet &left,
+  const depth_iterator_expr_statet &right)
+{ return left.it==right.it && left.expr.get()==right.expr.get(); }
+
+/// Depth first search iterator base - iterates over supplied expression
+/// and all its operands recursively.
+/// Base class using CRTP
+/// Do override .push_expr method of this class, but when doing so
+/// make this class a friend so it has access to that overridden .push_expr
+/// method in the child class
+template<typename depth_iterator_t>
+class depth_iterator_baset
+{
+public:
+  typedef void difference_type;   // NOLINT Required by STL
+  typedef exprt value_type;       // NOLINT
+  typedef const exprt *pointer;   // NOLINT
+  typedef const exprt &reference; // NOLINT
+  typedef std::forward_iterator_tag iterator_category; // NOLINT
+  bool operator==(const depth_iterator_t &other) const
+  {
+    return m_stack==other.m_stack;
+  }
+
+  /// Preincrement operator
+  /// Do not call on the end() iterator
+  depth_iterator_t &operator++()
+  {
+    PRECONDITION(!m_stack.empty());
+    while(true)
+    {
+      if(m_stack.back().it==m_stack.back().end)
+      {
+        m_stack.pop_back();
+        if(m_stack.empty())
+          break;
+      }
+      // Check eg. if we haven't seen this node before
+      else if(this->downcast().push_expr(*m_stack.back().it))
+        break;
+      m_stack.back().it++;
+    }
+    return this->downcast();
+  }
+
+  depth_iterator_t &next_sibling_or_parent()
+  {
+    PRECONDITION(!m_stack.empty());
+    m_stack.back().it=m_stack.back().end;
+    ++(*this);
+    return this->downcast();
+  }
+
+  /// Post-increment operator
+  /// Expensive copy. Avoid if possible
+  depth_iterator_t operator++(int)
+  {
+    depth_iterator_t tmp(this->downcast());
+    this->operator++();
+    return tmp;
+  }
+
+  /// Dereference operator
+  /// Dereferencing end() iterator is undefined behaviour
+  const exprt &operator*() const
+  {
+    PRECONDITION(!m_stack.empty());
+    return m_stack.back().expr.get();
+  }
+
+  /// Dereference operator (member access)
+  /// Dereferencing end() iterator is undefined behaviour
+  const exprt *operator->() const
+  { return &**this; }
+
+protected:
+  /// Create end iterator
+  depth_iterator_baset()=default;
+
+  /// Create begin iterator, starting at the supplied node
+  explicit depth_iterator_baset(const exprt &root)
+  { this->push_expr(root); }
+
+  /// Destructor
+  /// Protected to discourage upcasting
+  ~depth_iterator_baset()=default;
+
+  depth_iterator_baset(const depth_iterator_baset &)=default;
+  depth_iterator_baset(depth_iterator_baset &&other)
+  { m_stack=std::move(other.m_stack); }
+  depth_iterator_baset &operator=(const depth_iterator_baset&)=default;
+  depth_iterator_baset &operator=(depth_iterator_baset &&other)
+  { m_stack=std::move(other.m_stack); }
+
+  /// Obtain non-const exprt reference. Performs a copy-on-write on
+  /// the root node as a side effect. To be called only if a the root
+  /// is a non-const exprt. Do not call on the end() iterator
+  exprt &mutate()
+  {
+    PRECONDITION(!m_stack.empty());
+    auto expr=std::ref(const_cast<exprt &>(m_stack.front().expr.get()));
+    for(auto &state : m_stack)
+    {
+      auto &operands=expr.get().operands();
+      const auto i=operands.size()-(state.end-state.it);
+      const auto it=operands.begin()+i;
+      state.expr=expr.get();
+      state.it=it;
+      state.end=operands.end();
+      if(!(state==m_stack.back()))
+      {
+        expr=std::ref(*it);
+      }
+    }
+    return expr.get();
+  }
+
+  /// Pushes expression onto the stack
+  /// If overridden, this function should be called from the inheriting
+  /// class by the override function
+  /// \return true if element was successfully pushed onto the stack,
+  /// false otherwise
+  /// If returning false, child will not be iterated over
+  bool push_expr(const exprt &expr)
+  {
+    m_stack.emplace_back(expr, expr.operands().begin(), expr.operands().end());
+    return true;
+  }
+
+private:
+  std::vector<depth_iterator_expr_statet> m_stack;
+
+  depth_iterator_t &downcast()
+  { return static_cast<depth_iterator_t &>(*this); }
+};
+
+template<typename T, typename std::enable_if<
+  std::is_base_of<depth_iterator_baset<T>, T>::value, int>::type=0>
+bool operator!=(
+  const T &left,
+  const T &right)
+{ return !(left==right); }
+
+class const_depth_iteratort final:
+  public depth_iterator_baset<const_depth_iteratort>
+{
+public:
+  /// Create iterator starting at the supplied node (root)
+  explicit const_depth_iteratort(const exprt &expr):
+    depth_iterator_baset(expr) { }
+  /// Create an end iterator
+  const_depth_iteratort()=default;
+};
+
+class depth_iteratort final:
+  public depth_iterator_baset<depth_iteratort>
+{
+public:
+  /// Create an end iterator
+  depth_iteratort()=default;
+  /// Create iterator starting at the supplied node (root)
+  /// All mutations of the child nodes will be reflected on this node
+  explicit depth_iteratort(exprt &expr):
+    depth_iterator_baset(expr) { }
+  /// Obtain non-const reference to the pointed exprt instance
+  /// Modifies root expression
+  exprt &mutate()
+  { return depth_iterator_baset::mutate(); }
+};
+
+class const_unique_depth_iteratort final:
+  public depth_iterator_baset<const_unique_depth_iteratort>
+{
+  friend depth_iterator_baset;
+public:
+  /// Create iterator starting at the supplied node (root)
+  explicit const_unique_depth_iteratort(const exprt &expr):
+    depth_iterator_baset(expr),
+    m_traversed({ expr }) { }
+  /// Create an end iterator
+  const_unique_depth_iteratort()=default;
+private:
+  /// Push expression onto the stack and add to the set of traversed exprts
+  bool push_expr(const exprt &expr) // "override" - hide base class method
+  {
+    const bool inserted=this->m_traversed.insert(expr).second;
+    if(inserted)
+      depth_iterator_baset::push_expr(expr);
+    return inserted;
+  }
+  std::set<exprt> m_traversed;
+};
+
+#endif
diff --git a/src/util/file_util.cpp b/src/util/file_util.cpp
index dea8955fb11..d5aa21f691e 100644
--- a/src/util/file_util.cpp
+++ b/src/util/file_util.cpp
@@ -13,8 +13,11 @@ Date: January 2012
 
 #include "file_util.h"
 
+#include "invariant.h"
+
 #include <cerrno>
 #include <cassert>
+#include <cstring>
 
 #include <fstream>
 #include <cstring>
@@ -46,29 +49,26 @@ Date: January 2012
 #define chdir _chdir
 #define popen _popen
 #define pclose _pclose
-#else
-#include <cstring>
 #endif
 
 /// \return current working directory
 std::string get_current_working_directory()
 {
-  unsigned bsize=50;
-
-  char *buf=reinterpret_cast<char*>(malloc(sizeof(char)*bsize));
-  if(!buf)
-    abort();
-
+  #ifndef _WIN32
   errno=0;
-
-  while(buf && getcwd(buf, bsize-1)==nullptr && errno==ERANGE)
-  {
-    bsize*=2;
-    buf=reinterpret_cast<char*>(realloc(buf, sizeof(char)*bsize));
-  }
-
-  std::string working_directory=buf;
-  free(buf);
+  char *wd=realpath(".", nullptr);
+  INVARIANT(
+    wd!=nullptr && errno==0,
+    std::string("realpath failed: ")+strerror(errno));
+
+  std::string working_directory=wd;
+  free(wd);
+  #else
+  char buffer[4096];
+  DWORD retval=GetCurrentDirectory(4096, buffer);
+  CHECK_RETURN(retval>0);
+  std::string working_directory(buffer);
+  #endif
 
   return working_directory;
 }
diff --git a/src/util/format_number_range.cpp b/src/util/format_number_range.cpp
new file mode 100644
index 00000000000..c3cc9d24b9c
--- /dev/null
+++ b/src/util/format_number_range.cpp
@@ -0,0 +1,116 @@
+/*******************************************************************\
+
+Module: Format vector of numbers into a compressed range
+
+Author: Daniel Kroening, kroening@kroening.com
+
+\*******************************************************************/
+
+/// \file
+/// Format vector of numbers into a compressed range
+
+#include <algorithm>
+#include <cassert>
+#include <string>
+
+#include "format_number_range.h"
+
+/// create shorter representation for output
+/// \par parameters: vector of numbers
+/// \return string of compressed number range representation
+std::string format_number_ranget::operator()(std::vector<unsigned> &numbers)
+{
+  std::string number_range;
+  std::sort(numbers.begin(), numbers.end());
+  unsigned end_number=numbers.back();
+  if(numbers.front()==end_number)
+    number_range=std::to_string(end_number); // only single number
+  else
+  {
+    bool next=true;
+    bool first=true;
+    bool range=false;
+    unsigned start_number=numbers.front();
+    unsigned last_number=start_number;
+
+    for(const auto &number : numbers)
+    {
+      if(next)
+      {
+        next=false;
+        start_number=number;
+        last_number=number;
+      }
+      // advance one forward
+      else
+      {
+        if(number==last_number+1 && !(number==end_number))
+        {
+          last_number++;
+          if(last_number>start_number+1)
+            range=true;
+        }
+        // end this block range
+        else
+        {
+          if(first)
+            first=false;
+          else
+            number_range+=",";
+          if(last_number>start_number)
+          {
+            if(range)
+            {
+              if(number==end_number && number==last_number+1)
+                number_range+=
+                  std::to_string(start_number)+"-"+std::to_string(end_number);
+              else if(number==end_number)
+                number_range+=
+                  std::to_string(start_number)+"-"+std::to_string(last_number)+
+                  ","+std::to_string(end_number);
+              else
+                number_range+=
+                  std::to_string(start_number)+"-"+std::to_string(last_number);
+            }
+            else
+            {
+              if(number!=end_number)
+                number_range+=
+                  std::to_string(start_number)+","+std::to_string(last_number);
+              else
+              {
+                if(start_number+1==last_number && last_number+1==number)
+                  number_range+=
+                    std::to_string(start_number)+"-"+std::to_string(end_number);
+                else
+                  number_range+=
+                    std::to_string(start_number)+
+                    ","+std::to_string(last_number)+
+                    ","+std::to_string(end_number);
+              }
+            }
+            start_number=number;
+            last_number=number;
+            range=false;
+            continue;
+          }
+          else
+          {
+            if(number!=end_number)
+              number_range+=std::to_string(start_number);
+            else
+              number_range+=std::to_string(start_number)+","+
+                std::to_string(end_number);
+            start_number=number;
+            last_number=number;
+            range=false;
+            continue; // already set next start number
+          }
+          next=true;
+        }
+      }
+    }
+  }
+  assert(!number_range.empty());
+  return number_range;
+}
diff --git a/src/util/format_number_range.h b/src/util/format_number_range.h
new file mode 100644
index 00000000000..493b82abc99
--- /dev/null
+++ b/src/util/format_number_range.h
@@ -0,0 +1,24 @@
+/*******************************************************************\
+
+Module: Format vector of numbers into a compressed range
+
+Author: Daniel Kroening, kroening@kroening.com
+
+\*******************************************************************/
+
+/// \file
+/// Format vector of numbers into a compressed range
+
+#ifndef CPROVER_UTIL_FORMAT_NUMBER_RANGE_H
+#define CPROVER_UTIL_FORMAT_NUMBER_RANGE_H
+
+#include <string>
+#include <vector>
+
+class format_number_ranget
+{
+public:
+  std::string operator()(std::vector<unsigned> &);
+};
+
+#endif // CPROVER_UTIL_FORMAT_NUMBER_RANGE_H
diff --git a/src/util/freer.h b/src/util/freer.h
new file mode 100644
index 00000000000..72b6faeab70
--- /dev/null
+++ b/src/util/freer.h
@@ -0,0 +1,33 @@
+/*******************************************************************\
+
+Module:
+
+Author: Reuben Thomas, reuben.thomas@diffblue.com
+
+\*******************************************************************/
+
+#ifndef CPROVER_UTIL_FREER_H
+#define CPROVER_UTIL_FREER_H
+
+#include <cstdlib>
+#include <utility>
+
+/// A functor wrapping `std::free`. Can be used as the deleter of a unique_ptr
+/// to free memory originally allocated by `std::malloc`. This is primarily
+/// useful for interfacing with C APIs in a memory-safe way.
+/// Note that the approach of using an empty functor as a unique_ptr deleter
+/// does not impose any space overhead on the unique_ptr instance, whereas
+/// using a function-pointer as the deleter requires the unique_ptr to store
+/// this function pointer internally, effectively doubling the size of the
+/// object. Therefore, `std::unique_ptr<T, freert>` should be preferred to
+/// `std::unique_ptr<T, decltype(&std::free)>`.
+struct freert
+{
+  template <typename T>
+  void operator()(T &&t) const
+  {
+    free(std::forward<T>(t));
+  }
+};
+
+#endif
diff --git a/src/util/graph.h b/src/util/graph.h
index 3673b4544c0..607a7e3d8e2 100644
--- a/src/util/graph.h
+++ b/src/util/graph.h
@@ -607,7 +607,7 @@ void grapht<N>::make_chordal()
 }
 
 /// Find a topological order of the nodes if graph is DAG, return empty list for
-/// non-DAG or empty graph. Uses Kahn's algorithm running in O(#edges+#nodes).
+/// non-DAG or empty graph. Uses Kahn's algorithm running in O(n_edges+n_nodes).
 template<class N>
 std::list<typename grapht<N>::node_indext> grapht<N>::topsort() const
 {
diff --git a/src/util/ieee_float.cpp b/src/util/ieee_float.cpp
index ba9fb9ac857..c5fdb82de38 100644
--- a/src/util/ieee_float.cpp
+++ b/src/util/ieee_float.cpp
@@ -678,7 +678,7 @@ void ieee_floatt::divide_and_round(
       break;
 
     default:
-      assert(false);
+      UNREACHABLE;
     }
   }
 }
diff --git a/src/util/invariant.cpp b/src/util/invariant.cpp
index d3f750041a3..ff31d044829 100644
--- a/src/util/invariant.cpp
+++ b/src/util/invariant.cpp
@@ -6,9 +6,11 @@ Author: Martin Brain, martin.brain@diffblue.com
 
 \*******************************************************************/
 
-
 #include "invariant.h"
 
+#include "util/freer.h"
+
+#include <memory>
 #include <string>
 #include <sstream>
 
@@ -53,18 +55,17 @@ static bool output_demangled_name(
     std::string mangled(working.substr(start+1, length));
 
     int demangle_success=1;
-    char *demangled=
-      abi::__cxa_demangle(mangled.c_str(), nullptr, nullptr, &demangle_success);
+    std::unique_ptr<char, freert> demangled(
+      abi::__cxa_demangle(
+        mangled.c_str(), nullptr, nullptr, &demangle_success));
 
     if(demangle_success==0)
     {
       out << working.substr(0, start+1)
-          << demangled
+          << demangled.get()
           << working.substr(end);
       return_value=true;
     }
-
-    free(demangled);
   }
 
   return return_value;
@@ -83,17 +84,16 @@ void print_backtrace(
     void * stack[50] = {};
 
     std::size_t entries=backtrace(stack, sizeof(stack) / sizeof(void *));
-    char **description=backtrace_symbols(stack, entries);
+    std::unique_ptr<char*, freert> description(
+      backtrace_symbols(stack, entries));
 
     for(std::size_t i=0; i<entries; i++)
     {
-      if(!output_demangled_name(out, description[i]))
-        out << description[i];
+      if(!output_demangled_name(out, description.get()[i]))
+        out << description.get()[i];
       out << '\n' << std::flush;
     }
 
-    free(description);
-
 #else
     out << "Backtraces not supported\n" << std::flush;
 #endif
@@ -129,7 +129,7 @@ std::string invariant_failedt::get_invariant_failed_message(
       << " function " << function
       << " line " << line << '\n'
       << "Reason: " << reason
-      << "Backtrace:\n"
+      << "\nBacktrace:\n"
       << backtrace << '\n';
   return out.str();
 }
diff --git a/src/util/invariant.h b/src/util/invariant.h
index a7df274e81d..cd8fa2c8e01 100644
--- a/src/util/invariant.h
+++ b/src/util/invariant.h
@@ -142,7 +142,7 @@ void report_exception_to_stderr(const invariant_failedt &);
 /// Takes a backtrace, gives it to the reason structure, then aborts, printing
 /// reason.what() (which therefore includes the backtrace).
 /// In future this may throw `reason` instead of aborting.
-/// \param ET : (template type parameter), type of exception to construct
+/// Template parameter ET: type of exception to construct
 /// \param file : C string giving the name of the file.
 /// \param function : C string giving the name of the function.
 /// \param line : The line number of the invariant
diff --git a/src/util/invariant_utils.cpp b/src/util/invariant_utils.cpp
new file mode 100644
index 00000000000..6e1c897da54
--- /dev/null
+++ b/src/util/invariant_utils.cpp
@@ -0,0 +1,27 @@
+/*******************************************************************\
+
+Module: Invariant helper utilities
+
+Author: Chris Smowton, chris.smowton@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Invariant helper utilities
+
+#include "invariant_utils.h"
+
+std::string pretty_print_invariant_with_irep(
+  const irept &problem_node,
+  const std::string &description)
+{
+  if(problem_node.is_nil())
+    return description;
+  else
+  {
+    std::string ret=description;
+    ret+="\nProblem irep:\n";
+    ret+=problem_node.pretty(0,0);
+    return ret;
+  }
+}
diff --git a/src/util/invariant_utils.h b/src/util/invariant_utils.h
new file mode 100644
index 00000000000..d448fedfeb3
--- /dev/null
+++ b/src/util/invariant_utils.h
@@ -0,0 +1,48 @@
+/*******************************************************************\
+
+Module: Invariant helper utilities
+
+Author: Chris Smowton, chris.smowton@diffblue.com
+
+\*******************************************************************/
+
+#ifndef CPROVER_UTIL_INVARIANT_TYPES_H
+#define CPROVER_UTIL_INVARIANT_TYPES_H
+
+#include "invariant.h"
+
+#include <util/irep.h>
+
+#include <string>
+
+/// Produces a plain string error description from an irep and some
+/// explanatory text. If `problem_node` is nil, returns `description`.
+/// \param problem_node: irep to pretty-print
+/// \param description: descriptive text to prepend
+/// \return error message
+std::string pretty_print_invariant_with_irep(
+  const irept &problem_node,
+  const std::string &description);
+
+/// Equivalent to
+/// `INVARIANT_STRUCTURED(CONDITION, invariant_failedt,
+///   pretty_print_invariant_with_irep(IREP, DESCRIPTION))`
+#define INVARIANT_WITH_IREP(CONDITION, DESCRIPTION, IREP)               \
+  INVARIANT_STRUCTURED(                                                 \
+    CONDITION,                                                          \
+    invariant_failedt,                                                  \
+    pretty_print_invariant_with_irep((IREP), (DESCRIPTION)))
+
+/// See `INVARIANT_WITH_IREP`
+#define PRECONDITION_WITH_IREP(CONDITION, DESCRIPTION, IREP) \
+  INVARIANT_WITH_IREP((CONDITION), (DESCRIPTION), (IREP))
+#define POSTCONDITION_WITH_IREP(CONDITION, DESCRIPTION, IREP) \
+  INVARIANT_WITH_IREP((CONDITION), (DESCRIPTION), (IREP))
+#define CHECK_RETURN_WITH_IREP(CONDITION, DESCRIPTION, IREP) \
+  INVARIANT_WITH_IREP((CONDITION), (DESCRIPTION), (IREP))
+#define UNREACHABLE_WITH_IREP(CONDITION, DESCRIPTION, IREP) \
+  INVARIANT_WITH_IREP((CONDITION), (DESCRIPTION), (IREP))
+#define DATA_INVARIANT_WITH_IREP(CONDITION, DESCRIPTION, IREP) \
+  INVARIANT_WITH_IREP((CONDITION), (DESCRIPTION), (IREP))
+
+#endif
diff --git a/src/util/irep_ids.def b/src/util/irep_ids.def
index 90b7b46b7bf..de144771e44 100644
--- a/src/util/irep_ids.def
+++ b/src/util/irep_ids.def
@@ -748,11 +748,14 @@ IREP_ID_ONE(java_instanceof)
 IREP_ID_ONE(java_super_method_call)
 IREP_ID_ONE(java_enum_static_unwind)
 IREP_ID_ONE(push_catch)
+IREP_ID_ONE(pop_catch)
+IREP_ID_ONE(exception_landingpad)
 IREP_ID_ONE(length_upper_bound)
 IREP_ID_ONE(string_constraint)
 IREP_ID_ONE(string_not_contains_constraint)
 IREP_ID_ONE(cprover_char_literal_func)
 IREP_ID_ONE(cprover_string_literal_func)
+IREP_ID_ONE(cprover_string_array_of_char_pointer_func)
 IREP_ID_ONE(cprover_string_char_at_func)
 IREP_ID_ONE(cprover_string_char_set_func)
 IREP_ID_ONE(cprover_string_code_point_at_func)
@@ -799,6 +802,7 @@ IREP_ID_ONE(cprover_string_of_int_hex_func)
 IREP_ID_ONE(cprover_string_of_long_func)
 IREP_ID_ONE(cprover_string_of_bool_func)
 IREP_ID_ONE(cprover_string_of_float_func)
+IREP_ID_ONE(cprover_string_of_float_scientific_notation_func)
 IREP_ID_ONE(cprover_string_of_double_func)
 IREP_ID_ONE(cprover_string_of_char_func)
 IREP_ID_ONE(cprover_string_of_char_array_func)
@@ -812,6 +816,9 @@ IREP_ID_ONE(cprover_string_to_lower_case_func)
 IREP_ID_ONE(cprover_string_to_upper_case_func)
 IREP_ID_ONE(cprover_string_trim_func)
 IREP_ID_ONE(cprover_string_value_of_func)
+IREP_ID_ONE(skip_initialize)
+IREP_ID_ONE(basic_block_covered_lines)
+IREP_ID_ONE(is_nondet_nullable)
 IREP_ID_ONE(array_replace)
 IREP_ID_ONE(external_value_set)
 IREP_ID_ONE(access_path_entry)
@@ -819,6 +826,9 @@ IREP_ID_ONE(access_path_label)
 IREP_ID_ONE(access_path_function)
 IREP_ID_ONE(access_path_loc)
 IREP_ID_ONE(declared_on_type)
+IREP_ID_ONE(switch_case_number)
+IREP_ID_ONE(java_array_access)
+IREP_ID_ONE(java_member_access)
 
 #undef IREP_ID_ONE
 #undef IREP_ID_TWO
diff --git a/src/util/json_expr.cpp b/src/util/json_expr.cpp
index 43f12ee82b9..2fbb8155714 100644
--- a/src/util/json_expr.cpp
+++ b/src/util/json_expr.cpp
@@ -19,11 +19,75 @@ Author: Peter Schrammel
 #include "fixedbv.h"
 #include "std_expr.h"
 #include "config.h"
+#include "identifier.h"
+#include "language.h"
+#include "invariant.h"
+
+#include <langapi/mode.h>
+
+#include <memory>
+
+static exprt simplify_json_expr(
+  const exprt &src,
+  const namespacet &ns)
+{
+  if(src.id()==ID_constant)
+  {
+    const typet &type=ns.follow(src.type());
+
+    if(type.id()==ID_pointer)
+    {
+      const irep_idt &value=to_constant_expr(src).get_value();
+
+      if(value!=ID_NULL &&
+         (value!=std::string(value.size(), '0') ||
+          !config.ansi_c.NULL_is_zero) &&
+         src.operands().size()==1 &&
+         src.op0().id()!=ID_constant)
+        // try to simplify the constant pointer
+        return simplify_json_expr(src.op0(), ns);
+    }
+  }
+  else if(src.id()==ID_address_of &&
+          src.operands().size()==1 &&
+          src.op0().id()==ID_member &&
+          id2string(to_member_expr(
+            src.op0()).get_component_name()).find("@")!=std::string::npos)
+  {
+    // simplify expressions of the form &member_expr(object, @class_identifier)
+    return simplify_json_expr(src.op0(), ns);
+  }
+  else if(src.id()==ID_address_of &&
+          src.operands().size()==1 &&
+          src.op0().id()==ID_index &&
+          to_index_expr(src.op0()).index().id()==ID_constant &&
+          to_constant_expr(
+            to_index_expr(src.op0()).index()).value_is_zero_string())
+  {
+    // simplify expressions of the form  &array[0]
+    return simplify_json_expr(to_index_expr(src.op0()).array(), ns);
+  }
+  else if(src.id()==ID_member &&
+          src.operands().size()==1 &&
+          id2string(
+            to_member_expr(src).get_component_name())
+              .find("@")!=std::string::npos)
+  {
+    // simplify expressions of the form  member_expr(object, @class_identifier)
+    return simplify_json_expr(src.op0(), ns);
+  }
+
+  return src;
+}
 
 json_objectt json(const source_locationt &location)
 {
   json_objectt result;
 
+  if(!location.get_working_directory().empty())
+    result["workingDirectory"]=
+      json_stringt(id2string(location.get_working_directory()));
+
   if(!location.get_file().empty())
     result["file"]=json_stringt(id2string(location.get_file()));
 
@@ -37,18 +101,26 @@ json_objectt json(const source_locationt &location)
     result["function"]=json_stringt(id2string(location.get_function()));
 
   if(!location.get_java_bytecode_index().empty())
-    result["bytecode_index"]=
+    result["bytecodeIndex"]=
       json_stringt(id2string(location.get_java_bytecode_index()));
 
   return result;
 }
 
+/// Output a CBMC type in json.
+/// The `mode` argument is used to correctly report types.
+/// \param type: a type
+/// \param ns: a namespace
+/// \param mode: language in which the code was written; for now ID_C and
+///   ID_java are supported
+/// \return a json object
 json_objectt json(
   const typet &type,
-  const namespacet &ns)
+  const namespacet &ns,
+  const irep_idt &mode)
 {
   if(type.id()==ID_symbol)
-    return json(ns.follow(type), ns);
+    return json(ns.follow(type), ns, mode);
 
   json_objectt result;
 
@@ -84,7 +156,7 @@ json_objectt json(
   else if(type.id()==ID_c_enum_tag)
   {
     // we return the base type
-    return json(ns.follow_tag(to_c_enum_tag_type(type)).subtype(), ns);
+    return json(ns.follow_tag(to_c_enum_tag_type(type)).subtype(), ns, mode);
   }
   else if(type.id()==ID_fixedbv)
   {
@@ -95,7 +167,7 @@ json_objectt json(
   else if(type.id()==ID_pointer)
   {
     result["name"]=json_stringt("pointer");
-    result["subtype"]=json(type.subtype(), ns);
+    result["subtype"]=json(type.subtype(), ns, mode);
   }
   else if(type.id()==ID_bool)
   {
@@ -104,13 +176,13 @@ json_objectt json(
   else if(type.id()==ID_array)
   {
     result["name"]=json_stringt("array");
-    result["subtype"]=json(type.subtype(), ns);
+    result["subtype"]=json(type.subtype(), ns, mode);
   }
   else if(type.id()==ID_vector)
   {
     result["name"]=json_stringt("vector");
-    result["subtype"]=json(type.subtype(), ns);
-    result["size"]=json(to_vector_type(type).size(), ns);
+    result["subtype"]=json(type.subtype(), ns, mode);
+    result["size"]=json(to_vector_type(type).size(), ns, mode);
   }
   else if(type.id()==ID_struct)
   {
@@ -122,7 +194,7 @@ json_objectt json(
     {
       json_objectt &e=members.push_back().make_object();
       e["name"]=json_stringt(id2string(component.get_name()));
-      e["type"]=json(component.type(), ns);
+      e["type"]=json(component.type(), ns, mode);
     }
   }
   else if(type.id()==ID_union)
@@ -135,7 +207,7 @@ json_objectt json(
     {
       json_objectt &e=members.push_back().make_object();
       e["name"]=json_stringt(id2string(component.get_name()));
-      e["type"]=json(component.type(), ns);
+      e["type"]=json(component.type(), ns, mode);
     }
   }
   else
@@ -144,9 +216,17 @@ json_objectt json(
   return result;
 }
 
+/// Output a CBMC expression in json.
+/// The mode is used to correctly report types.
+/// \param expr: an expression
+/// \param ns: a namespace
+/// \param mode: language in which the code was written; for now ID_C and
+///   ID_java are supported
+/// \return a json object
 json_objectt json(
   const exprt &expr,
-  const namespacet &ns)
+  const namespacet &ns,
+  const irep_idt &mode)
 {
   json_objectt result;
 
@@ -154,6 +234,28 @@ json_objectt json(
 
   if(expr.id()==ID_constant)
   {
+    std::unique_ptr<languaget> lang;
+    if(mode==ID_unknown)
+      lang=std::unique_ptr<languaget>(get_default_language());
+    else
+    {
+      lang=std::unique_ptr<languaget>(get_language_from_mode(mode));
+      if(!lang)
+        lang=std::unique_ptr<languaget>(get_default_language());
+    }
+
+    const typet &underlying_type=
+      type.id()==ID_c_bit_field?type.subtype():
+      type;
+
+    std::string type_string;
+    bool error=lang->from_type(underlying_type, type_string, ns);
+    CHECK_RETURN(!error);
+
+    std::string value_string;
+    lang->from_expr(expr, value_string, ns);
+
+    const constant_exprt &constant_expr=to_constant_expr(expr);
     if(type.id()==ID_unsignedbv ||
        type.id()==ID_signedbv ||
        type.id()==ID_c_bit_field)
@@ -161,60 +263,36 @@ json_objectt json(
       std::size_t width=to_bitvector_type(type).get_width();
 
       result["name"]=json_stringt("integer");
-      result["binary"]=json_stringt(expr.get_string(ID_value));
+      result["binary"]=json_stringt(id2string(constant_expr.get_value()));
       result["width"]=json_numbert(std::to_string(width));
-
-      const typet &underlying_type=
-        type.id()==ID_c_bit_field?type.subtype():
-        type;
-
-      bool is_signed=underlying_type.id()==ID_signedbv;
-
-      std::string sig=is_signed?"":"unsigned ";
-
-      if(width==config.ansi_c.char_width)
-        result["c_type"]=json_stringt(sig+"char");
-      else if(width==config.ansi_c.int_width)
-        result["c_type"]=json_stringt(sig+"int");
-      else if(width==config.ansi_c.short_int_width)
-        result["c_type"]=json_stringt(sig+"short int");
-      else if(width==config.ansi_c.long_int_width)
-        result["c_type"]=json_stringt(sig+"long int");
-      else if(width==config.ansi_c.long_long_int_width)
-        result["c_type"]=json_stringt(sig+"long long int");
-
-      mp_integer i;
-      if(!to_integer(expr, i))
-        result["data"]=json_stringt(integer2string(i));
+      result["type"]=json_stringt(type_string);
+      result["data"]=json_stringt(value_string);
     }
     else if(type.id()==ID_c_enum)
     {
       result["name"]=json_stringt("integer");
-      result["binary"]=json_stringt(expr.get_string(ID_value));
+      result["binary"]=json_stringt(id2string(constant_expr.get_value()));
       result["width"]=json_numbert(type.subtype().get_string(ID_width));
-      result["c_type"]=json_stringt("enum");
-
-      mp_integer i;
-      if(!to_integer(expr, i))
-        result["data"]=json_stringt(integer2string(i));
+      result["type"]=json_stringt("enum");
+      result["data"]=json_stringt(value_string);
     }
     else if(type.id()==ID_c_enum_tag)
     {
       constant_exprt tmp;
       tmp.type()=ns.follow_tag(to_c_enum_tag_type(type));
       tmp.set_value(to_constant_expr(expr).get_value());
-      return json(tmp, ns);
+      return json(tmp, ns, mode);
     }
     else if(type.id()==ID_bv)
     {
       result["name"]=json_stringt("bitvector");
-      result["binary"]=json_stringt(expr.get_string(ID_value));
+      result["binary"]=json_stringt(id2string(constant_expr.get_value()));
     }
     else if(type.id()==ID_fixedbv)
     {
       result["name"]=json_stringt("fixed");
       result["width"]=json_numbert(type.get_string(ID_width));
-      result["binary"]=json_stringt(expr.get_string(ID_value));
+      result["binary"]=json_stringt(id2string(constant_expr.get_value()));
       result["data"]=
         json_stringt(fixedbvt(to_constant_expr(expr)).to_ansi_c_string());
     }
@@ -222,16 +300,29 @@ json_objectt json(
     {
       result["name"]=json_stringt("float");
       result["width"]=json_numbert(type.get_string(ID_width));
-      result["binary"]=json_stringt(expr.get_string(ID_value));
+      result["binary"]=json_stringt(id2string(constant_expr.get_value()));
       result["data"]=
         json_stringt(ieee_floatt(to_constant_expr(expr)).to_ansi_c_string());
     }
     else if(type.id()==ID_pointer)
     {
       result["name"]=json_stringt("pointer");
-      result["binary"]=json_stringt(expr.get_string(ID_value));
-      if(expr.get(ID_value)==ID_NULL)
-        result["data"]=json_stringt("NULL");
+      result["type"]=json_stringt(type_string);
+      exprt simpl_expr=simplify_json_expr(expr, ns);
+      if(simpl_expr.get(ID_value)==ID_NULL ||
+         // remove typecast on NULL
+         (simpl_expr.id()==ID_constant && simpl_expr.type().id()==ID_pointer &&
+          simpl_expr.op0().get(ID_value)==ID_NULL))
+        result["data"]=json_stringt(value_string);
+      else if(simpl_expr.id()==ID_symbol)
+      {
+        const irep_idt &ptr_id=to_symbol_expr(simpl_expr).get_identifier();
+        identifiert identifier(id2string(ptr_id));
+        DATA_INVARIANT(
+          !identifier.components.empty(),
+          "pointer identifier should have non-empty components");
+        result["data"]=json_stringt(identifier.components.back());
+      }
     }
     else if(type.id()==ID_bool)
     {
@@ -242,11 +333,15 @@ json_objectt json(
     else if(type.id()==ID_c_bool)
     {
       result["name"]=json_stringt("integer");
-      result["c_type"]=json_stringt("_Bool");
+      result["width"]=json_numbert(type.get_string(ID_width));
+      result["type"]=json_stringt(type_string);
       result["binary"]=json_stringt(expr.get_string(ID_value));
-      mp_integer b;
-      to_integer(to_constant_expr(expr), b);
-      result["data"]=json_stringt(integer2string(b));
+      result["data"]=json_stringt(value_string);
+    }
+    else if(type.id()==ID_string)
+    {
+      result["name"]=json_stringt("string");
+      result["data"]=json_stringt(id2string(constant_expr.get_value()));
     }
     else
     {
@@ -264,7 +359,7 @@ json_objectt json(
     {
       json_objectt &e=elements.push_back().make_object();
       e["index"]=json_numbert(std::to_string(index));
-      e["value"]=json(*it, ns);
+      e["value"]=json(*it, ns, mode);
       index++;
     }
   }
@@ -277,13 +372,15 @@ json_objectt json(
     {
       const struct_typet &struct_type=to_struct_type(type);
       const struct_typet::componentst &components=struct_type.components();
-      assert(components.size()==expr.operands().size());
+      DATA_INVARIANT(
+        components.size()==expr.operands().size(),
+        "number of struct components should match with its type");
 
       json_arrayt &members=result["members"].make_array();
       for(unsigned m=0; m<expr.operands().size(); m++)
       {
         json_objectt &e=members.push_back().make_object();
-        e["value"]=json(expr.operands()[m], ns);
+        e["value"]=json(expr.operands()[m], ns, mode);
         e["name"]=json_stringt(id2string(components[m].get_name()));
       }
     }
@@ -292,11 +389,10 @@ json_objectt json(
   {
     result["name"]=json_stringt("union");
 
-    assert(expr.operands().size()==1);
-
+    const union_exprt &union_expr=to_union_expr(expr);
     json_objectt &e=result["member"].make_object();
-    e["value"]=json(expr.op0(), ns);
-    e["name"]=json_stringt(id2string(to_union_expr(expr).get_component_name()));
+    e["value"]=json(union_expr.op(), ns, mode);
+    e["name"]=json_stringt(id2string(union_expr.get_component_name()));
   }
   else
     result["name"]=json_stringt("unknown");
diff --git a/src/util/json_expr.h b/src/util/json_expr.h
index 28a6f3de102..6b9a124680b 100644
--- a/src/util/json_expr.h
+++ b/src/util/json_expr.h
@@ -13,6 +13,7 @@ Author: Peter Schrammel
 #define CPROVER_UTIL_JSON_EXPR_H
 
 #include "json.h"
+#include "irep.h"
 
 class source_locationt;
 class typet;
@@ -21,11 +22,13 @@ class namespacet;
 
 json_objectt json(
   const exprt &,
-  const namespacet &);
+  const namespacet &,
+  const irep_idt &mode=ID_unknown);
 
 json_objectt json(
   const typet &,
-  const namespacet &);
+  const namespacet &,
+  const irep_idt &mode=ID_unknown);
 
 json_objectt json(const source_locationt &);
 
diff --git a/src/util/language.cpp b/src/util/language.cpp
index fec2ba03d1d..dbd962e129a 100644
--- a/src/util/language.cpp
+++ b/src/util/language.cpp
@@ -12,6 +12,11 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "language.h"
 
 #include "expr.h"
+#include <util/symbol.h>
+#include <util/symbol_table.h>
+#include <util/prefix.h>
+#include <util/cprover_prefix.h>
+#include <util/std_types.h>
 
 bool languaget::final(symbol_tablet &symbol_table, bool generate_start_function)
 {
@@ -57,3 +62,132 @@ bool languaget::type_to_name(
   name=type.pretty();
   return false;
 }
+
+/// Turn on or off stub generation.
+/// \param should_generate_stubs: Should stub generation be enabled
+void languaget::set_should_generate_opaque_method_stubs(
+  bool should_generate_stubs)
+{
+  generate_opaque_stubs=should_generate_stubs;
+}
+
+/// When there are opaque methods (e.g. ones where we don't have a body), we
+/// create a stub function in the goto program and mark it as opaque so the
+/// interpreter fills in appropriate values for it. This will only happen if
+/// generate_opaque_stubs is enabled.
+/// \param symbol_table: the symbol table for the program
+void languaget::generate_opaque_method_stubs(symbol_tablet &symbol_table)
+{
+  if(generate_opaque_stubs)
+  {
+    system_symbols=system_library_symbolst();
+
+    for(auto &symbol_entry : symbol_table.symbols)
+    {
+      if(is_symbol_opaque_function(symbol_entry.second))
+      {
+        symbolt &symbol=symbol_entry.second;
+
+        generate_opaque_parameter_symbols(symbol, symbol_table);
+
+        irep_idt return_symbol_id=generate_opaque_stub_body(
+          symbol,
+          symbol_table);
+
+        if(return_symbol_id!=ID_nil)
+        {
+          symbol.type.set("opaque_method_capture_symbol", return_symbol_id);
+        }
+      }
+    }
+  }
+}
+
+/// To generate the stub function for the opaque function in question. The
+/// identifier is used in the flag to the interpreter that the function is
+/// opaque. This function should be implemented in the languages.
+/// \param symbol: the function symbol which is opaque
+/// \param symbol_table: the symbol table
+/// \return The identifier of the return variable. ID_nil if the function
+///   doesn't return anything.
+irep_idt languaget::generate_opaque_stub_body(
+  symbolt &symbol,
+  symbol_tablet &symbol_table)
+{
+  return ID_nil;
+}
+
+/// To build the parameter symbol and choose its name. This should be
+/// implemented in each language.
+/// \param function_symbol: the symbol of an opaque function
+/// \param parameter_index: the index of the parameter within the the parameter
+///   list
+/// \param parameter_type: the type of the parameter
+/// \return A named symbol to be added to the symbol table representing one of
+///   the parameters in this opaque function.
+parameter_symbolt languaget::build_stub_parameter_symbol(
+  const symbolt &function_symbol,
+  size_t parameter_index,
+  const code_typet::parametert &parameter)
+{
+  error() << "language " << id()
+          << " doesn't implement build_stub_parameter_symbol. "
+          << "This means cannot use opaque functions." << eom;
+
+  return parameter_symbolt();
+}
+
+/// To get the name of the symbol to be used for the return value of the
+/// function. Generates a name like to_return_function_name
+/// \param function_id: the function that has a return value
+/// \return the identifier to use for the symbol that will store the return
+///   value of this function.
+irep_idt languaget::get_stub_return_symbol_name(const irep_idt &function_id)
+{
+  std::ostringstream return_symbol_name_builder;
+  return_symbol_name_builder << "to_return_" << function_id;
+  return return_symbol_name_builder.str();
+}
+
+
+/// To identify if a given symbol is an opaque function and hence needs to be
+/// stubbed. We explicitly exclude CPROVER functions, if they have no body it is
+/// because we haven't generated it yet.
+/// \param symbol: the symbol to be checked
+/// \return True if the symbol is an opaque (e.g. non-bodied) function
+bool languaget::is_symbol_opaque_function(const symbolt &symbol)
+{
+  std::set<std::string> headers;
+  // Don't create stubs for symbols like:
+  // __CPROVER_blah (which aren't real external functions)
+  // and strstr (which we will model for ourselves later)
+  bool is_internal=system_symbols.is_symbol_internal_symbol(symbol, headers);
+
+  return !symbol.is_type &&
+    symbol.value.id()==ID_nil &&
+    symbol.type.id()==ID_code &&
+    !is_internal;
+}
+
+/// To create stub parameter symbols for each parameter the function has and
+/// assign their IDs into the parameters identifier.
+/// \param function_symbol: the symbol of an opaque function
+/// \param symbol_table: the symbol table to add the new parameter symbols into
+void languaget::generate_opaque_parameter_symbols(
+  symbolt &function_symbol,
+  symbol_tablet &symbol_table)
+{
+  code_typet &function_type = to_code_type(function_symbol.type);
+  code_typet::parameterst &parameters=function_type.parameters();
+  for(std::size_t i=0; i<parameters.size(); ++i)
+  {
+    code_typet::parametert &param=parameters[i];
+    const parameter_symbolt &param_symbol=
+      build_stub_parameter_symbol(function_symbol, i, param);
+
+    param.set_base_name(param_symbol.base_name);
+    param.set_identifier(param_symbol.name);
+
+    symbol_table.add(param_symbol);
+  }
+}
diff --git a/src/util/language.h b/src/util/language.h
index c8c7756a126..3472d42216c 100644
--- a/src/util/language.h
+++ b/src/util/language.h
@@ -15,8 +15,10 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <set>
 #include <iosfwd>
 #include <string>
-#include <memory>
-
+#include <memory> // unique_ptr
+#include <util/symbol.h>
+#include <util/std_types.h>
+#include <goto-programs/system_library_symbols.h>
 #include <langapi/pretty_printer.h>
 
 #include "message.h"
@@ -117,11 +119,37 @@ class languaget:public messaget
     exprt &expr,
     const namespacet &ns)=0;
 
-  virtual languaget *new_language()=0;
+  virtual std::unique_ptr<languaget> new_language()=0;
+
+  void set_should_generate_opaque_method_stubs(bool should_generate_stubs);
 
   // constructor / destructor
 
   languaget() { }
   virtual ~languaget() { }
+
+protected:
+  void generate_opaque_method_stubs(symbol_tablet &symbol_table);
+  virtual irep_idt generate_opaque_stub_body(
+    symbolt &symbol,
+    symbol_tablet &symbol_table);
+
+  virtual parameter_symbolt build_stub_parameter_symbol(
+    const symbolt &function_symbol,
+    size_t parameter_index,
+    const code_typet::parametert &parameter);
+
+  static irep_idt get_stub_return_symbol_name(const irep_idt &function_id);
+
+  bool generate_opaque_stubs;
+  bool language_options_initialized=false;
+
+private:
+  bool is_symbol_opaque_function(const symbolt &symbol);
+  void generate_opaque_parameter_symbols(
+    symbolt &function_symbol,
+    symbol_tablet &symbol_table);
+
+  system_library_symbolst system_symbols;
 };
 #endif // CPROVER_UTIL_LANGUAGE_H
diff --git a/src/util/language_file.cpp b/src/util/language_file.cpp
index 856435107df..85a6f8ea1ec 100644
--- a/src/util/language_file.cpp
+++ b/src/util/language_file.cpp
@@ -19,11 +19,13 @@ language_filet::language_filet(const language_filet &rhs):
 {
 }
 
-language_filet::~language_filet()
-{
-  if(language!=nullptr)
-    delete language;
-}
+/// To avoid compiler errors, the complete definition of a pointed-to type must
+/// be visible at the point at which the unique_ptr destructor is created.  In
+/// this case, the pointed-to type is forward-declared, so we have to place the
+/// destructor in the source file, where the full definition is availible.
+language_filet::~language_filet()=default;
+
+language_filet::language_filet()=default;
 
 void language_filet::get_modules()
 {
@@ -44,6 +46,18 @@ void language_filest::show_parse(std::ostream &out)
     it->second.language->show_parse(out);
 }
 
+/// Turn on or off stub generation for all the languages
+/// \param should_generate_stubs: Should stub generation be enabled
+void language_filest::set_should_generate_opaque_method_stubs(
+  bool stubs_enabled)
+{
+  for(file_mapt::value_type &language_file_entry : file_map)
+  {
+    auto &language=*language_file_entry.second.language;
+    language.set_should_generate_opaque_method_stubs(stubs_enabled);
+  }
+}
+
 bool language_filest::parse()
 {
   for(file_mapt::iterator it=file_map.begin();
diff --git a/src/util/language_file.h b/src/util/language_file.h
index 2049e609e8d..e8157a9628d 100644
--- a/src/util/language_file.h
+++ b/src/util/language_file.h
@@ -14,6 +14,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <set>
 #include <map>
 #include <string>
+#include <memory> // unique_ptr
 
 #include "message.h"
 
@@ -21,7 +22,7 @@ class symbol_tablet;
 class language_filet;
 class languaget;
 
-class language_modulet
+class language_modulet final
 {
 public:
   std::string name;
@@ -35,13 +36,13 @@ class language_modulet
   {}
 };
 
-class language_filet
+class language_filet final
 {
 public:
   typedef std::set<std::string> modulest;
   modulest modules;
 
-  languaget *language;
+  std::unique_ptr<languaget> language;
   std::string filename;
 
   void get_modules();
@@ -50,12 +51,9 @@ class language_filet
     const irep_idt &id,
     symbol_tablet &symbol_table);
 
+  language_filet();
   language_filet(const language_filet &rhs);
 
-  language_filet():language(nullptr)
-  {
-  }
-
   ~language_filet();
 };
 
@@ -79,6 +77,8 @@ class language_filest:public messaget
     file_map.clear();
   }
 
+  void set_should_generate_opaque_method_stubs(bool stubs_enabled);
+
   bool parse();
 
   void show_parse(std::ostream &out);
diff --git a/src/util/make_unique.h b/src/util/make_unique.h
new file mode 100644
index 00000000000..0f4ba41ac3e
--- /dev/null
+++ b/src/util/make_unique.h
@@ -0,0 +1,24 @@
+/*******************************************************************\
+
+Module: Really simple unique_ptr utilities
+
+Author: Reuben Thomas, reuben.thomas@diffblue.com
+
+\*******************************************************************/
+
+#ifndef CPROVER_UTIL_MAKE_UNIQUE_H
+#define CPROVER_UTIL_MAKE_UNIQUE_H
+
+#include <memory> // unique_ptr
+
+// This is a stand-in for std::make_unique, which isn't part of the standard
+// library until C++14.  When we move to C++14, we should do a find-and-replace
+// on this to use std::make_unique instead.
+
+template<typename T, typename... Ts>
+std::unique_ptr<T> util_make_unique(Ts &&... ts)
+{
+  return std::unique_ptr<T>(new T(std::forward<Ts>(ts)...));
+}
+
+#endif
diff --git a/src/util/message.cpp b/src/util/message.cpp
index ad0448adf28..522c9cd7b25 100644
--- a/src/util/message.cpp
+++ b/src/util/message.cpp
@@ -13,7 +13,8 @@ void message_handlert::print(
   unsigned level,
   const std::string &message,
   int sequence_number,
-  const source_locationt &location)
+  const source_locationt &location,
+  bool preformatted)
 {
   std::string dest;
 
@@ -51,12 +52,13 @@ void message_handlert::print(
     dest+=": ";
   dest+=message;
 
-  print(level, dest);
+  print(level, dest, preformatted);
 }
 
 void message_handlert::print(
   unsigned level,
-  const std::string &message)
+  const std::string &message,
+  bool preformatted)
 {
   if(level>=message_count.size())
     message_count.resize(level+1, 0);
diff --git a/src/util/message.h b/src/util/message.h
index c3d73d5f4d2..9da886b0404 100644
--- a/src/util/message.h
+++ b/src/util/message.h
@@ -24,13 +24,17 @@ class message_handlert
   {
   }
 
-  virtual void print(unsigned level, const std::string &message) = 0;
+  virtual void print(
+    unsigned level,
+    const std::string &message,
+    bool preformatted) = 0;
 
   virtual void print(
     unsigned level,
     const std::string &message,
     int sequence_number,
-    const source_locationt &location);
+    const source_locationt &location,
+    bool preformatted);
 
   virtual void flush(unsigned level)
   {
@@ -60,18 +64,22 @@ class message_handlert
 class null_message_handlert:public message_handlert
 {
 public:
-  virtual void print(unsigned level, const std::string &message)
+  virtual void print(
+    unsigned level,
+    const std::string &message,
+    bool preformatted)
   {
-    message_handlert::print(level, message);
+    message_handlert::print(level, message, preformatted);
   }
 
   virtual void print(
     unsigned level,
     const std::string &message,
     int sequence_number,
-    const source_locationt &location)
+    const source_locationt &location,
+    bool preformatted)
   {
-    print(level, message);
+    print(level, message, preformatted);
   }
 };
 
@@ -82,9 +90,12 @@ class stream_message_handlert:public message_handlert
   {
   }
 
-  virtual void print(unsigned level, const std::string &message)
+  virtual void print(
+    unsigned level,
+    const std::string &message,
+    bool preformatted)
   {
-    message_handlert::print(level, message);
+    message_handlert::print(level, message, preformatted);
 
     if(verbosity>=level)
       out << message << '\n';
@@ -159,20 +170,23 @@ class messaget
       unsigned _message_level,
       messaget &_message):
       message_level(_message_level),
-      message(_message)
+      message(_message),
+      preformatted(false)
     {
     }
 
     mstreamt(const mstreamt &other):
       message_level(other.message_level),
       message(other.message),
-      source_location(other.source_location)
+      source_location(other.source_location),
+      preformatted(false)
     {
     }
 
     unsigned message_level;
     messaget &message;
     source_locationt source_location;
+    bool preformatted;
 
     template <class T>
     mstreamt &operator << (const T &x)
@@ -198,15 +212,23 @@ class messaget
         m.message_level,
         m.str(),
         -1,
-        m.source_location);
+        m.source_location,
+        m.preformatted);
       m.message.message_handler->flush(m.message_level);
     }
+    m.preformatted=false;
     m.clear(); // clears error bits
     m.str(std::string()); // clears the string
     m.source_location.clear();
     return m;
   }
 
+  static mstreamt &preformatted_output(mstreamt &m)
+  {
+    m.preformatted=true;
+    return m;
+  }
+
   // in lieu of std::endl
   static mstreamt &endl(mstreamt &m)
   {
@@ -214,50 +236,50 @@ class messaget
     return m;
   }
 
-  mstreamt &get_mstream(unsigned message_level)
+  mstreamt &get_mstream(unsigned message_level) const
   {
     mstream.message_level=message_level;
     return mstream;
   }
 
-  mstreamt &error()
+  mstreamt &error() const
   {
     return get_mstream(M_ERROR);
   }
 
-  mstreamt &warning()
+  mstreamt &warning() const
   {
     return get_mstream(M_WARNING);
   }
 
-  mstreamt &result()
+  mstreamt &result() const
   {
     return get_mstream(M_RESULT);
   }
 
-  mstreamt &status()
+  mstreamt &status() const
   {
     return get_mstream(M_STATUS);
   }
 
-  mstreamt &statistics()
+  mstreamt &statistics() const
   {
     return get_mstream(M_STATISTICS);
   }
 
-  mstreamt &progress()
+  mstreamt &progress() const
   {
     return get_mstream(M_PROGRESS);
   }
 
-  mstreamt &debug()
+  mstreamt &debug() const
   {
     return get_mstream(M_DEBUG);
   }
 
 protected:
   message_handlert *message_handler;
-  mstreamt mstream;
+  mutable mstreamt mstream;
 };
 
 #endif // CPROVER_UTIL_MESSAGE_H
diff --git a/src/util/mp_arith.cpp b/src/util/mp_arith.cpp
index 035541749e1..6de218f24ed 100644
--- a/src/util/mp_arith.cpp
+++ b/src/util/mp_arith.cpp
@@ -8,15 +8,19 @@ Author: Daniel Kroening, kroening@kroening.com
 
 #include "mp_arith.h"
 
-#include <cstdlib>
-#include <cctype>
 #include <cassert>
-
-#include <sstream>
-#include <ostream>
+#include <cctype>
+#include <cstdlib>
 #include <limits>
+#include <ostream>
+#include <sstream>
+#include <vector>
 
 #include "arith_tools.h"
+#include "invariant.h"
+
+typedef BigInt::ullong_t ullong_t; // NOLINT(readability/identifiers)
+typedef BigInt::llong_t llong_t; // NOLINT(readability/identifiers)
 
 mp_integer operator>>(const mp_integer &a, const mp_integer &b)
 {
@@ -76,13 +80,11 @@ const std::string integer2binary(const mp_integer &n, std::size_t width)
   }
 
   std::size_t len = a.digits(2) + 2;
-  char *buffer=new char[len];
-  char *s = a.as_string(buffer, len, 2);
+  std::vector<char> buffer(len);
+  char *s = a.as_string(buffer.data(), len, 2);
 
   std::string result(s);
 
-  delete[] buffer;
-
   if(result.size()<width)
   {
     std::string fill;
@@ -104,13 +106,11 @@ const std::string integer2binary(const mp_integer &n, std::size_t width)
 const std::string integer2string(const mp_integer &n, unsigned base)
 {
   unsigned len = n.digits(base) + 2;
-  char *buffer=new char[len];
-  char *s = n.as_string(buffer, len, base);
+  std::vector<char> buffer(len);
+  char *s = n.as_string(buffer.data(), len, base);
 
   std::string result(s);
 
-  delete[] buffer;
-
   return result;
 }
 
@@ -188,22 +188,184 @@ const mp_integer binary2integer(const std::string &n, bool is_signed)
 
 mp_integer::ullong_t integer2ulong(const mp_integer &n)
 {
-  assert(n.is_ulong());
+  PRECONDITION(n.is_ulong());
   return n.to_ulong();
 }
 
 std::size_t integer2size_t(const mp_integer &n)
 {
-  assert(n>=0);
+  PRECONDITION(n>=0 && n<=std::numeric_limits<std::size_t>::max());
   mp_integer::ullong_t ull=integer2ulong(n);
-  assert(ull <= std::numeric_limits<std::size_t>::max());
-  return (std::size_t)ull;
+  return (std::size_t) ull;
 }
 
 unsigned integer2unsigned(const mp_integer &n)
 {
-  assert(n>=0);
+  PRECONDITION(n>=0 && n<=std::numeric_limits<unsigned>::max());
   mp_integer::ullong_t ull=integer2ulong(n);
-  assert(ull <= std::numeric_limits<unsigned>::max());
   return (unsigned)ull;
 }
+
+/// bitwise or bitwise operations only make sense on native objects, hence the
+/// largest object size should be the largest available c++ integer size
+/// (currently long long)
+mp_integer bitwise_or(const mp_integer &a, const mp_integer &b)
+{
+  PRECONDITION(a.is_ulong() && b.is_ulong());
+  ullong_t result=a.to_ulong()|b.to_ulong();
+  return result;
+}
+
+/// bitwise and bitwise operations only make sense on native objects, hence the
+/// largest object size should be the largest available c++ integer size
+/// (currently long long)
+mp_integer bitwise_and(const mp_integer &a, const mp_integer &b)
+{
+  PRECONDITION(a.is_ulong() && b.is_ulong());
+  ullong_t result=a.to_ulong()&b.to_ulong();
+  return result;
+}
+
+/// bitwise xor bitwise operations only make sense on native objects, hence the
+/// largest object size should be the largest available c++ integer size
+/// (currently long long)
+mp_integer bitwise_xor(const mp_integer &a, const mp_integer &b)
+{
+  PRECONDITION(a.is_ulong() && b.is_ulong());
+  ullong_t result=a.to_ulong()^b.to_ulong();
+  return result;
+}
+
+/// bitwise negation bitwise operations only make sense on native objects, hence
+/// the largest object size should be the largest available c++ integer size
+/// (currently long long)
+mp_integer bitwise_neg(const mp_integer &a)
+{
+  PRECONDITION(a.is_ulong());
+  ullong_t result=~a.to_ulong();
+  return result;
+}
+
+/// arithmetic left shift bitwise operations only make sense on native objects,
+/// hence the largest object size should be the largest available c++ integer
+/// size (currently long long)
+mp_integer arith_left_shift(
+  const mp_integer &a,
+  const mp_integer &b,
+  std::size_t true_size)
+{
+  PRECONDITION(a.is_long() && b.is_ulong());
+  ullong_t shift=b.to_ulong();
+  if(shift>true_size && a!=mp_integer(0))
+    throw "shift value out of range";
+
+  llong_t result=a.to_long()<<shift;
+  llong_t mask=
+    true_size<(sizeof(llong_t)*8) ?
+    (1L<<true_size)-1 :
+    -1;
+  return result&mask;
+}
+
+/// arithmetic right shift (loads sign on MSB) bitwise operations only make
+/// sense on native objects, hence the largest object size should be the largest
+/// available c++ integer size (currently long long)
+mp_integer arith_right_shift(
+  const mp_integer &a,
+  const mp_integer &b,
+  std::size_t true_size)
+{
+  PRECONDITION(a.is_long() && b.is_ulong());
+  llong_t number=a.to_long();
+  ullong_t shift=b.to_ulong();
+  if(shift>true_size)
+    throw "shift value out of range";
+
+  llong_t sign=(1<<(true_size-1))&number;
+  llong_t pad=(sign==0) ? 0 : ~((1<<(true_size-shift))-1);
+  llong_t result=(number >> shift)|pad;
+  return result;
+}
+
+/// logic left shift bitwise operations only make sense on native objects, hence
+/// the largest object size should be the largest available c++ integer size
+/// (currently long long)
+mp_integer logic_left_shift(
+  const mp_integer &a,
+  const mp_integer &b,
+  std::size_t true_size)
+{
+  PRECONDITION(a.is_long() && b.is_ulong());
+  ullong_t shift=b.to_ulong();
+  if(shift>true_size && a!=mp_integer(0))
+    throw "shift value out of range";
+  llong_t result=a.to_long()<<shift;
+  if(true_size<(sizeof(llong_t)*8))
+  {
+    llong_t sign=(1L<<(true_size-1))&result;
+    llong_t mask=(1L<<true_size)-1;
+    // Sign-fill out-of-range bits:
+    if(sign==0)
+      result&=mask;
+    else
+      result|=~mask;
+  }
+  return result;
+}
+
+/// logic right shift (loads 0 on MSB) bitwise operations only make sense on
+/// native objects, hence the largest object size should be the largest
+/// available c++ integer size (currently long long)
+mp_integer logic_right_shift(
+  const mp_integer &a,
+  const mp_integer &b,
+  std::size_t true_size)
+{
+  PRECONDITION(a.is_long() && b.is_ulong());
+  ullong_t shift=b.to_ulong();
+  if(shift>true_size)
+    throw "shift value out of range";
+
+  ullong_t result=((ullong_t)a.to_long()) >> shift;
+  return result;
+}
+
+/// rotates right (MSB=LSB) bitwise operations only make sense on native
+/// objects, hence the largest object size should be the largest available c++
+/// integer size (currently long long)
+mp_integer rotate_right(
+  const mp_integer &a,
+  const mp_integer &b,
+  std::size_t true_size)
+{
+  PRECONDITION(a.is_ulong() && b.is_ulong());
+  ullong_t number=a.to_ulong();
+  ullong_t shift=b.to_ulong();
+  if(shift>true_size)
+    throw "shift value out of range";
+
+  ullong_t revShift=true_size-shift;
+  ullong_t filter=1<<(true_size-1);
+  ullong_t result=(number >> shift)|((number<<revShift)&filter);
+  return result;
+}
+
+/// rotate left (LSB=MSB) bitwise operations only make sense on native objects,
+/// hence the largest object size should be the largest available c++ integer
+/// size (currently long long)
+mp_integer rotate_left(
+  const mp_integer &a,
+  const mp_integer &b,
+  std::size_t true_size)
+{
+  PRECONDITION(a.is_ulong() && b.is_ulong());
+  ullong_t number=a.to_ulong();
+  ullong_t shift=b.to_ulong();
+  if(shift>true_size)
+    throw "shift value out of range";
+
+  ullong_t revShift=true_size-shift;
+  ullong_t filter=1<<(true_size-1);
+  ullong_t result=((number<<shift)&filter)|((number&filter) >> revShift);
+  return result;
+}
diff --git a/src/util/mp_arith.h b/src/util/mp_arith.h
index eede5855b75..7cc4dd7dfad 100644
--- a/src/util/mp_arith.h
+++ b/src/util/mp_arith.h
@@ -21,6 +21,28 @@ typedef BigInt mp_integer;
 std::ostream &operator<<(std::ostream &, const mp_integer &);
 mp_integer operator>>(const mp_integer &, const mp_integer &);
 mp_integer operator<<(const mp_integer &, const mp_integer &);
+mp_integer bitwise_or(const mp_integer &, const mp_integer &);
+mp_integer bitwise_and(const mp_integer &, const mp_integer &);
+mp_integer bitwise_xor(const mp_integer &, const mp_integer &);
+mp_integer bitwise_neg(const mp_integer &);
+
+mp_integer arith_left_shift(
+  const mp_integer &, const mp_integer &, std::size_t true_size);
+
+mp_integer arith_right_shift(
+  const mp_integer &, const mp_integer &, std::size_t true_size);
+
+mp_integer logic_left_shift(
+  const mp_integer &, const mp_integer &, std::size_t true_size);
+
+mp_integer logic_right_shift(
+  const mp_integer &, const mp_integer &, std::size_t true_size);
+
+mp_integer rotate_right(
+  const mp_integer &, const mp_integer &, std::size_t true_size);
+
+mp_integer rotate_left(
+  const mp_integer &, const mp_integer &, std::size_t true_size);
 
 const std::string integer2string(const mp_integer &, unsigned base=10);
 const mp_integer string2integer(const std::string &, unsigned base=10);
@@ -29,5 +51,6 @@ const mp_integer binary2integer(const std::string &, bool is_signed);
 mp_integer::ullong_t integer2ulong(const mp_integer &);
 std::size_t integer2size_t(const mp_integer &);
 unsigned integer2unsigned(const mp_integer &);
+const mp_integer mp_zero=string2integer("0");
 
 #endif // CPROVER_UTIL_MP_ARITH_H
diff --git a/src/util/namespace.h b/src/util/namespace.h
index a3b9f3827c6..a72a3ba8a19 100644
--- a/src/util/namespace.h
+++ b/src/util/namespace.h
@@ -52,8 +52,19 @@ class namespace_baset
   const typet &follow_tag(const struct_tag_typet &src) const;
   const typet &follow_tag(const c_enum_tag_typet &src) const;
 
-  // these do the actual lookup
+  /// Returns the maximum integer n such that there is a symbol (in some of the
+  /// symbol tables) whose name is of the form "AB" where A is \p prefix and B
+  /// is n.  Symbols where B is not a number count as if B was equal to 0.
+  /// The intended use case is finding the next available symbol name for a
+  /// sequence of auto-generated symbols.
   virtual unsigned get_max(const std::string &prefix) const=0;
+
+  /// Searches for a symbol named \p name. Iff found, set \p symbol to point to
+  /// the symbol and return false; else \p symbol is unmodified and `true` is
+  /// returned. With multiple symbol tables, `symbol_table1` is searched first
+  /// and then symbol_table2.
+  /// \return False iff the requested symbol is found in at least one of the
+  /// tables.
   virtual bool lookup(const irep_idt &name, const symbolt *&symbol) const=0;
 };
 
@@ -84,8 +95,11 @@ class namespacet:public namespace_baset
 
   using namespace_baset::lookup;
 
-  // these do the actual lookup
+  /// See namespace_baset::lookup(). Note that \ref namespacet has two symbol
+  /// tables.
   virtual bool lookup(const irep_idt &name, const symbolt *&symbol) const;
+
+  /// See documentation for namespace_baset::get_max().
   virtual unsigned get_max(const std::string &prefix) const;
 
   const symbol_tablet &get_symbol_table() const
diff --git a/src/util/nondet_bool.h b/src/util/nondet_bool.h
new file mode 100644
index 00000000000..af628d3456e
--- /dev/null
+++ b/src/util/nondet_bool.h
@@ -0,0 +1,27 @@
+/*******************************************************************\
+
+Module: Nondeterministic boolean helper
+
+Author: Chris Smowton, chris@smowton.net
+
+\*******************************************************************/
+
+/// \file
+/// Nondeterministic boolean helper
+
+#ifndef CPROVER_UTIL_NONDET_BOOL_H
+#define CPROVER_UTIL_NONDET_BOOL_H
+
+#include <util/std_types.h>
+#include <util/std_expr.h>
+
+/// \par parameters: Desired type (C_bool or plain bool)
+/// \return nondet expr of that type
+inline exprt get_nondet_bool(const typet &type)
+{
+  // We force this to 0 and 1 and won't consider
+  // other values.
+  return typecast_exprt(side_effect_expr_nondett(bool_typet()), type);
+}
+
+#endif // CPROVER_UTIL_NONDET_BOOL_H
diff --git a/src/util/nondet_ifthenelse.cpp b/src/util/nondet_ifthenelse.cpp
new file mode 100644
index 00000000000..d02f1ecd114
--- /dev/null
+++ b/src/util/nondet_ifthenelse.cpp
@@ -0,0 +1,97 @@
+/*******************************************************************\
+
+Module: Nondeterministic if-then-else
+
+Author: Chris Smowton, chris@smowton.net
+
+\*******************************************************************/
+
+/// \file
+/// Nondeterministic if-then-else
+
+#include "nondet_ifthenelse.h"
+
+#include <sstream>
+
+#include <util/nondet_bool.h>
+#include <util/std_code.h>
+#include <util/std_types.h>
+#include <util/std_expr.h>
+#include <util/symbol_table.h>
+#include <util/source_location.h>
+
+// This will be unified with other similar fresh-symbol routines shortly
+static symbolt &new_tmp_symbol(
+  symbol_tablet &symbol_table,
+  const std::string &prefix,
+  const irep_idt &mode)
+{
+  static size_t temporary_counter=0;
+
+  auxiliary_symbolt new_symbol;
+  symbolt *symbol_ptr;
+
+  do
+  {
+    new_symbol.name="tmp_object_factory$"+std::to_string(++temporary_counter);
+    new_symbol.base_name=new_symbol.name;
+    new_symbol.mode=mode;
+  }
+  while(symbol_table.move(new_symbol, symbol_ptr));
+
+  return *symbol_ptr;
+}
+
+/// Emits instructions and defines labels for the beginning of a
+/// nondeterministic if-else diamond. Code is emitted to the `result_code`
+/// member of this object's associated `java_object_factoryt` instance `state`.
+/// The caller should use the following pattern (where *this is an instance of
+/// java_object_factoryt): ``` nondet_ifthenelset diamond(*this, "name");
+/// diamond.begin_if(); result_code.copy_to_operands(Some if-branch code)
+/// diamond.begin_else(); result_code.copy_to_operands(Some else-branch code)
+/// diamond.finish(); ```
+void nondet_ifthenelset::begin_if()
+{
+  static size_t nondet_ifthenelse_count=0;
+
+  auto choice_sym=
+    new_tmp_symbol(symbol_table, choice_symname, fresh_symbol_mode);
+  choice_sym.type=c_bool_typet(1);
+  auto choice=choice_sym.symbol_expr();
+  auto assign_choice=
+    code_assignt(choice, get_nondet_bool(choice_sym.type));
+  assign_choice.add_source_location()=loc;
+  result_code.move_to_operands(assign_choice);
+
+  std::ostringstream fresh_label_oss;
+  fresh_label_oss << choice_symname << "_else_"
+                  << (++nondet_ifthenelse_count);
+  std::string fresh_label=fresh_label_oss.str();
+  else_label=code_labelt(fresh_label, code_skipt());
+
+  std::ostringstream done_label_oss;
+  done_label_oss << choice_symname << "_done_"
+                 << nondet_ifthenelse_count;
+  join_label=code_labelt(done_label_oss.str(), code_skipt());
+
+  code_ifthenelset test;
+  test.cond()=equal_exprt(
+    choice,
+    constant_exprt("0", choice_sym.type));
+  test.then_case()=code_gotot(fresh_label);
+  result_code.move_to_operands(test);
+}
+
+/// Terminates the if-block and begins the else-block of a nondet if-then-else
+/// diamond. See ::begin_if for detail.
+void nondet_ifthenelset::begin_else()
+{
+  result_code.copy_to_operands(code_gotot(join_label.get_label()));
+  result_code.copy_to_operands(else_label);
+}
+
+/// Concludes a nondet if-then-else diamond. See ::begin_if for detail.
+void nondet_ifthenelset::finish()
+{
+  result_code.move_to_operands(join_label);
+}
diff --git a/src/util/nondet_ifthenelse.h b/src/util/nondet_ifthenelse.h
new file mode 100644
index 00000000000..664a6bdf1b2
--- /dev/null
+++ b/src/util/nondet_ifthenelse.h
@@ -0,0 +1,47 @@
+/*******************************************************************\
+
+Module: Nondeterministic if-then-else
+
+Author: Chris Smowton, chris@smowton.net
+
+\*******************************************************************/
+
+/// \file
+/// Nondeterministic if-then-else
+
+#ifndef CPROVER_UTIL_NONDET_IFTHENELSE_H
+#define CPROVER_UTIL_NONDET_IFTHENELSE_H
+
+#include <util/std_code.h>
+
+class symbol_tablet;
+class source_locationt;
+
+class nondet_ifthenelset
+{
+  code_blockt &result_code;
+  symbol_tablet &symbol_table;
+  const source_locationt &loc;
+  irep_idt fresh_symbol_mode;
+  code_labelt else_label;
+  code_labelt join_label;
+  const std::string choice_symname;
+ public:
+  nondet_ifthenelset(
+    code_blockt &_result_code,
+    symbol_tablet &_symbol_table,
+    const source_locationt &_loc,
+    const irep_idt &_fresh_symbol_mode,
+    const std::string &name) :
+    result_code(_result_code),
+    symbol_table(_symbol_table),
+    loc(_loc),
+    fresh_symbol_mode(_fresh_symbol_mode),
+    choice_symname(name)
+    {}
+  void begin_if();
+  void begin_else();
+  void finish();
+};
+
+#endif // CPROVER_UTIL_NONDET_IFTHENELSE_H
diff --git a/src/util/numbering.h b/src/util/numbering.h
index 359f3c48ed2..4e0113a117a 100644
--- a/src/util/numbering.h
+++ b/src/util/numbering.h
@@ -15,15 +15,30 @@ Author: Daniel Kroening, kroening@kroening.com
 #include <unordered_map>
 #include <vector>
 
+#include <util/invariant.h>
 
 template <typename T>
 // NOLINTNEXTLINE(readability/identifiers)
-class numbering:public std::vector<T>
+class numbering final
 {
 public:
   // NOLINTNEXTLINE(readability/identifiers)
   typedef std::size_t number_type;
 
+private:
+  typedef std::vector<T> data_typet;
+  data_typet data;
+  typedef std::map<T, number_type> numberst;
+  numberst numbers;
+
+public:
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::size_type size_type;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::iterator iterator;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::const_iterator const_iterator;
+
   number_type number(const T &a)
   {
     std::pair<typename numberst::const_iterator, bool> result=
@@ -33,8 +48,8 @@ class numbering:public std::vector<T>
 
     if(result.second) // inserted?
     {
-      this->push_back(a);
-      assert(this->size()==numbers.size());
+      data.push_back(a);
+      INVARIANT(data.size()==numbers.size(), "vector sizes must match");
     }
 
     return (result.first)->second;
@@ -58,25 +73,46 @@ class numbering:public std::vector<T>
 
   void clear()
   {
-    subt::clear();
+    data.clear();
     numbers.clear();
   }
 
-protected:
-  typedef std::vector<T> subt;
+  size_t size() const { return data.size(); }
 
-  typedef std::map<T, number_type> numberst;
-  numberst numbers;
+  T &operator[](size_type t) { return data[t]; }
+  const T &operator[](size_type t) const { return data[t]; }
+
+  iterator begin() { return data.begin(); }
+  const_iterator begin() const { return data.begin(); }
+  const_iterator cbegin() const { return data.cbegin(); }
+
+  iterator end() { return data.end(); }
+  const_iterator end() const { return data.end(); }
+  const_iterator cend() const { return data.cend(); }
 };
 
 template <typename T, class hash_fkt>
 // NOLINTNEXTLINE(readability/identifiers)
-class hash_numbering:public std::vector<T>
+class hash_numbering final
 {
 public:
   // NOLINTNEXTLINE(readability/identifiers)
   typedef unsigned int number_type;
 
+private:
+  typedef std::vector<T> data_typet;
+  data_typet data;
+  typedef std::unordered_map<T, number_type, hash_fkt> numberst;
+  numberst numbers;
+
+public:
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::size_type size_type;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::iterator iterator;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename data_typet::const_iterator const_iterator;
+
   number_type number(const T &a)
   {
     std::pair<typename numberst::const_iterator, bool> result=
@@ -106,15 +142,25 @@ class hash_numbering:public std::vector<T>
 
   void clear()
   {
-    subt::clear();
+    data.clear();
     numbers.clear();
   }
 
-protected:
-  typedef std::vector<T> subt;
+  template <typename U>
+  void push_back(U &&u) { data.push_back(std::forward<U>(u)); }
 
-  typedef std::unordered_map<T, number_type, hash_fkt> numberst;
-  numberst numbers;
+  T &operator[](size_type t) { return data[t]; }
+  const T &operator[](size_type t) const { return data[t]; }
+
+  size_type size() const { return data.size(); }
+
+  iterator begin() { return data.begin(); }
+  const_iterator begin() const { return data.begin(); }
+  const_iterator cbegin() const { return data.cbegin(); }
+
+  iterator end() { return data.end(); }
+  const_iterator end() const { return data.end(); }
+  const_iterator cend() const { return data.cend(); }
 };
 
 #endif // CPROVER_UTIL_NUMBERING_H
diff --git a/src/util/parse_options.cpp b/src/util/parse_options.cpp
index db809a387a3..79feb29bc8f 100644
--- a/src/util/parse_options.cpp
+++ b/src/util/parse_options.cpp
@@ -37,11 +37,20 @@ void parse_options_baset::usage_error()
   help();
 }
 
+/// Print an error message mentioning the option that was not recognized when
+/// parsing the command line.
+void parse_options_baset::unknown_option_msg()
+{
+  if(!cmdline.unknown_arg.empty())
+    std::cerr << "Unknown option: " << cmdline.unknown_arg << "\n";
+}
+
 int parse_options_baset::main()
 {
   if(parse_result)
   {
     usage_error();
+    unknown_option_msg();
     return EX_USAGE;
   }
 
diff --git a/src/util/parse_options.h b/src/util/parse_options.h
index 73f436cf331..b2e64722e85 100644
--- a/src/util/parse_options.h
+++ b/src/util/parse_options.h
@@ -31,6 +31,7 @@ class parse_options_baset
   virtual ~parse_options_baset() { }
 
 private:
+  void unknown_option_msg();
   bool parse_result;
 };
 
diff --git a/src/util/pipe_stream.cpp b/src/util/pipe_stream.cpp
index e9fc1887fb5..c2875a11d12 100644
--- a/src/util/pipe_stream.cpp
+++ b/src/util/pipe_stream.cpp
@@ -106,19 +106,17 @@ int pipe_streamt::run()
   for(const auto &s : args)
         command += L" " + ::widen(s);
 
-  LPWSTR lpCommandLine = new wchar_t[command.length()+1];
+  std::vector<wchar_t> lpCommandLine(command.length()+1);
 
   #ifdef _MSC_VER
-  wcscpy_s(lpCommandLine, command.length()+1, command.c_str());
+  wcscpy_s(lpCommandLine.data(), command.length()+1, command.c_str());
   #else
-  wcsncpy(lpCommandLine, command.c_str(), command.length()+1);
+  wcsncpy(lpCommandLine.data(), command.c_str(), command.length()+1);
   #endif
 
-  BOOL ret=CreateProcessW(NULL, lpCommandLine, NULL, NULL, TRUE,
+  BOOL ret=CreateProcessW(NULL, lpCommandLine.data(), NULL, NULL, TRUE,
                           CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
 
-  delete lpCommandLine; // clean up
-
   if(!ret)
     return -1;
 
@@ -147,7 +145,7 @@ int pipe_streamt::run()
     dup2(in[0], STDIN_FILENO);
     dup2(out[1], STDOUT_FILENO);
 
-    char **_argv=new char * [args.size()+2];
+    std::vector<char *> _argv(args.size()+2);
 
     _argv[0]=strdup(executable.c_str());
 
@@ -161,7 +159,7 @@ int pipe_streamt::run()
 
     _argv[args.size()+1]=nullptr;
 
-    int result=execvp(executable.c_str(), _argv);
+    int result=execvp(executable.c_str(), _argv.data());
 
     if(result==-1)
       perror(nullptr);
@@ -218,14 +216,14 @@ int pipe_streamt::wait()
 filedescriptor_streambuft::filedescriptor_streambuft():
   #ifdef _WIN32
   proc_in(INVALID_HANDLE_VALUE),
-  proc_out(INVALID_HANDLE_VALUE)
+  proc_out(INVALID_HANDLE_VALUE),
   #else
   proc_in(STDOUT_FILENO),
-  proc_out(STDIN_FILENO)
+  proc_out(STDIN_FILENO),
   #endif
+  in_buffer(READ_BUFFER_SIZE)
 {
-  in_buffer=new char[READ_BUFFER_SIZE];
-  setg(in_buffer, in_buffer, in_buffer);
+  setg(in_buffer.data(), in_buffer.data(), in_buffer.data());
 }
 
 /// Destructor
@@ -248,8 +246,6 @@ filedescriptor_streambuft::~filedescriptor_streambuft()
     close(proc_out);
 
   #endif
-
-  delete in_buffer;
 }
 
 /// write one character to the piped process
diff --git a/src/util/pipe_stream.h b/src/util/pipe_stream.h
index 385cb65f790..748038ff2b6 100644
--- a/src/util/pipe_stream.h
+++ b/src/util/pipe_stream.h
@@ -15,6 +15,7 @@ Module: A stdin/stdout pipe as STL stream
 #include <iostream>
 #include <string>
 #include <list>
+#include <vector>
 
 #ifdef _WIN32
 #include <windows.h>
@@ -43,7 +44,7 @@ class filedescriptor_streambuft:public std::streambuf
 
 protected:
   HANDLE proc_in, proc_out;
-  char *in_buffer;
+  std::vector<char> in_buffer;
 
   int_type overflow(int_type);
   std::streamsize xsputn(const char *, std::streamsize);
diff --git a/src/util/refined_string_type.cpp b/src/util/refined_string_type.cpp
new file mode 100644
index 00000000000..91ac2e4661d
--- /dev/null
+++ b/src/util/refined_string_type.cpp
@@ -0,0 +1,29 @@
+/********************************************************************\
+
+Module: Type for string expressions used by the string solver.
+        These string expressions contain a field `length`, of type
+        `index_type`, a field `content` of type `content_type`.
+        This module also defines functions to recognise the C and java
+        string types.
+
+Author: Romain Brenguier, romain.brenguier@diffblue.com
+
+\*******************************************************************/
+
+/// \file
+/// Type for string expressions used by the string solver. These string
+///   expressions contain a field `length`, of type `index_type`, a field
+///   `content` of type `content_type`. This module also defines functions to
+///   recognise the C and java string types.
+
+#include "refined_string_type.h"
+
+refined_string_typet::refined_string_typet(
+  const typet &index_type, const typet &char_type)
+{
+  infinity_exprt infinite_index(index_type);
+  array_typet char_array(char_type, infinite_index);
+  components().emplace_back("length", index_type);
+  components().emplace_back("content", char_array);
+  set_tag(CPROVER_PREFIX"refined_string_type");
+}
diff --git a/src/solvers/refinement/refined_string_type.h b/src/util/refined_string_type.h
similarity index 54%
rename from src/solvers/refinement/refined_string_type.h
rename to src/util/refined_string_type.h
index 4d5e11afa84..f20f0048151 100644
--- a/src/solvers/refinement/refined_string_type.h
+++ b/src/util/refined_string_type.h
@@ -16,12 +16,13 @@ Author: Romain Brenguier, romain.brenguier@diffblue.com
 ///   `content` of type `content_type`. This module also defines functions to
 ///   recognise the C and java string types.
 
-#ifndef CPROVER_SOLVERS_REFINEMENT_REFINED_STRING_TYPE_H
-#define CPROVER_SOLVERS_REFINEMENT_REFINED_STRING_TYPE_H
+#ifndef CPROVER_UTIL_REFINED_STRING_TYPE_H
+#define CPROVER_UTIL_REFINED_STRING_TYPE_H
 
 #include <util/std_types.h>
 #include <util/std_expr.h>
 #include <util/arith_tools.h>
+#include <util/cprover_prefix.h>
 #include <util/expr_util.h>
 
 // Internal type used for string refinement
@@ -33,57 +34,33 @@ class refined_string_typet: public struct_typet
   // Type for the content (list of characters) of a string
   const array_typet &get_content_type() const
   {
-    assert(components().size()==2);
+    PRECONDITION(components().size()==2);
     return to_array_type(components()[1].type());
   }
 
   const typet &get_char_type() const
   {
-    assert(components().size()==2);
-    return components()[0].type();
+    return get_content_type().subtype();
   }
 
   const typet &get_index_type() const
   {
-    return get_content_type().size().type();
-  }
-
-  // For C the unrefined string type is __CPROVER_string, for java it is a
-  // pointer to a struct with tag java.lang.String
-
-  static bool is_c_string_type(const typet &type);
-
-  static bool is_java_string_pointer_type(const typet &type);
-
-  static bool is_java_string_type(const typet &type);
-
-  static bool is_java_string_builder_type(const typet &type);
-
-  static bool is_java_char_sequence_type(const typet &type);
-
-  static bool is_unrefined_string_type(const typet &type)
-  {
-    return (
-      is_c_string_type(type) ||
-      is_java_string_pointer_type(type) ||
-      is_java_string_builder_type(type) ||
-      is_java_char_sequence_type(type));
-  }
-
-  static bool is_unrefined_string(const exprt &expr)
-  {
-    return (is_unrefined_string_type(expr.type()));
-  }
-
-  constant_exprt index_of_int(int i) const
-  {
-    return from_integer(i, get_index_type());
+    PRECONDITION(components().size()==2);
+    return components()[0].type();
   }
 };
 
-const refined_string_typet &to_refined_string_type(const typet &type)
+inline bool is_refined_string_type(const typet &type)
+{
+    return
+      type.id()==ID_struct &&
+      to_struct_type(type).get_tag()==CPROVER_PREFIX"refined_string_type";
+}
+
+extern inline const refined_string_typet &to_refined_string_type(
+  const typet &type)
 {
-  assert(type.id()==ID_struct);
+  PRECONDITION(is_refined_string_type(type));
   return static_cast<const refined_string_typet &>(type);
 }
 
diff --git a/src/util/run.cpp b/src/util/run.cpp
index c01aff35bd6..f106309002e 100644
--- a/src/util/run.cpp
+++ b/src/util/run.cpp
@@ -61,7 +61,7 @@ int run(
   for(std::size_t i=0; i<argv.size(); i++)
     wargv[i]=widen(argv[i]);
 
-  const wchar_t **_argv=new const wchar_t * [argv.size()+1];
+  std::vector<const wchar_t *> _argv(argv.size()+1);
 
   for(std::size_t i=0; i<wargv.size(); i++)
     _argv[i]=wargv[i].c_str();
@@ -72,9 +72,7 @@ int run(
 
   std::wstring wide_what=widen(what);
 
-  int status=_wspawnvp(_P_WAIT, wide_what.c_str(), _argv);
-
-  delete[] _argv;
+  int status=_wspawnvp(_P_WAIT, wide_what.c_str(), _argv.data());
 
   return status;
 
@@ -119,7 +117,7 @@ int run(
       remove_signal_catcher();
       sigprocmask(SIG_SETMASK, &old_mask, nullptr);
 
-      char **_argv=new char * [argv.size()+1];
+      std::vector<char *> _argv(argv.size()+1);
       for(std::size_t i=0; i<argv.size(); i++)
         _argv[i]=strdup(argv[i].c_str());
 
@@ -129,7 +127,7 @@ int run(
         dup2(stdin_fd, STDIN_FILENO);
       if(stdout_fd!=STDOUT_FILENO)
         dup2(stdout_fd, STDOUT_FILENO);
-      execvp(what.c_str(), _argv);
+      execvp(what.c_str(), _argv.data());
 
       /* usually no return */
       return 1;
diff --git a/src/util/sharing_map.h b/src/util/sharing_map.h
index 8cbfcce4002..a558ec42901 100644
--- a/src/util/sharing_map.h
+++ b/src/util/sharing_map.h
@@ -386,7 +386,7 @@ SHARING_MAPT(void)::get_delta_view(
     }
     else
     {
-      assert(false);
+      UNREACHABLE;
     }
   }
   while(!stack.empty());
diff --git a/src/util/sharing_node.h b/src/util/sharing_node.h
index 9f8cc0a4416..19b41712649 100644
--- a/src/util/sharing_node.h
+++ b/src/util/sharing_node.h
@@ -17,6 +17,8 @@ Author: Daniel Poetzl
 #include <memory>
 #include <cassert>
 
+#include "invariant.h"
+
 #define _sn_assert(b) assert(b)
 //#define _sn_assert(b)
 
@@ -64,7 +66,7 @@ class sharing_nodet
     d.k=std::make_shared<key_type>(k);
 
     _sn_assert(d.m==nullptr);
-    d.m.reset(new mapped_type(m));
+    d.m=std::make_shared<mapped_type>(m);
   }
 
   sharing_nodet(const self_type &other)
@@ -235,7 +237,7 @@ class sharing_nodet
       }
     }
 
-    assert(false);
+    UNREACHABLE;
   }
 
   // misc
@@ -266,7 +268,7 @@ class sharing_nodet
       if(d.is_leaf())
       {
         _sn_assert(m==nullptr);
-        m.reset(new mapped_type(*d.m));
+        m=std::make_shared<mapped_type>(*d.m);
       }
     }
 
@@ -277,7 +279,7 @@ class sharing_nodet
     }
 
     std::shared_ptr<key_type> k;
-    std::unique_ptr<mapped_type> m;
+    std::shared_ptr<mapped_type> m;
 
     subt sub;
     containert con;
@@ -339,8 +341,8 @@ class sharing_nodet
 
 template <class keyT, class valueT, class predT, bool no_sharing>
 std::shared_ptr<typename sharing_nodet<keyT, valueT, predT, no_sharing>::dt>
-  sharing_nodet<keyT, valueT, predT, no_sharing>::empty_data(
-    new sharing_nodet<keyT, valueT, predT, no_sharing>::dt());
+  sharing_nodet<keyT, valueT, predT, no_sharing>::empty_data=
+    std::make_shared<sharing_nodet<keyT, valueT, predT, no_sharing>::dt>();
 
 template <class keyT, class valueT, class predT, bool no_sharing>
 sharing_nodet<keyT, valueT, predT, no_sharing>
diff --git a/src/util/simplify_expr.cpp b/src/util/simplify_expr.cpp
index ee6492c8124..882f0b2bfa6 100644
--- a/src/util/simplify_expr.cpp
+++ b/src/util/simplify_expr.cpp
@@ -1539,7 +1539,7 @@ exprt simplify_exprt::bits2expr(
 
     mp_integer size;
     if(to_integer(array_type.size(), size))
-      assert(false);
+      UNREACHABLE;
     std::size_t n_el=integer2size_t(size);
 
     std::size_t el_size=
diff --git a/src/util/simplify_expr_floatbv.cpp b/src/util/simplify_expr_floatbv.cpp
index cff452cfcbd..41f92a4a514 100644
--- a/src/util/simplify_expr_floatbv.cpp
+++ b/src/util/simplify_expr_floatbv.cpp
@@ -310,7 +310,7 @@ bool simplify_exprt::simplify_floatbv_op(exprt &expr)
       else if(expr.id()==ID_floatbv_div)
         result/=v1;
       else
-        assert(false);
+        UNREACHABLE;
 
       expr=result.to_expr();
       return false;
@@ -363,7 +363,7 @@ bool simplify_exprt::simplify_ieee_float_relation(exprt &expr)
     else if(expr.id()==ID_ieee_float_equal)
       expr.make_bool(f0.ieee_equal(f1));
     else
-      assert(false);
+      UNREACHABLE;
 
     return false;
   }
@@ -380,7 +380,7 @@ bool simplify_exprt::simplify_ieee_float_relation(exprt &expr)
     else if(expr.id()==ID_ieee_float_equal)
       isnan.make_not();
     else
-      assert(false);
+      UNREACHABLE;
 
     expr.swap(isnan);
     return false;
diff --git a/src/util/simplify_expr_int.cpp b/src/util/simplify_expr_int.cpp
index a94674c3fd9..995447c1c7e 100644
--- a/src/util/simplify_expr_int.cpp
+++ b/src/util/simplify_expr_int.cpp
@@ -581,7 +581,7 @@ bool simplify_exprt::simplify_bitwise(exprt &expr)
       else if(expr.id()==ID_bitxor)
         new_expr.id(ID_xor);
       else
-        assert(false);
+        UNREACHABLE;
 
       Forall_operands(it, new_expr)
       {
@@ -1266,7 +1266,7 @@ bool simplify_exprt::simplify_inequality(exprt &expr)
       else if(expr.id()==ID_lt)
         expr.make_bool(f0<f1);
       else
-        assert(false);
+        UNREACHABLE;
 
       return false;
     }
@@ -1288,7 +1288,7 @@ bool simplify_exprt::simplify_inequality(exprt &expr)
       else if(expr.id()==ID_lt)
         expr.make_bool(f0<f1);
       else
-        assert(false);
+        UNREACHABLE;
 
       return false;
     }
@@ -1315,7 +1315,7 @@ bool simplify_exprt::simplify_inequality(exprt &expr)
       else if(expr.id()==ID_lt)
         expr.make_bool(r0<r1);
       else
-        assert(false);
+        UNREACHABLE;
 
       return false;
     }
@@ -1342,7 +1342,7 @@ bool simplify_exprt::simplify_inequality(exprt &expr)
       else if(expr.id()==ID_lt)
         expr.make_bool(v0<v1);
       else
-        assert(false);
+        UNREACHABLE;
 
       return false;
     }
@@ -1377,7 +1377,7 @@ bool simplify_exprt::simplify_inequality(exprt &expr)
     return simplify_inequality_not_constant(expr);
   }
 
-  assert(false);
+  UNREACHABLE;
   return false;
 }
 
@@ -1516,7 +1516,7 @@ bool simplify_exprt::simplify_inequality_not_constant(exprt &expr)
         else
         {
           tmp=false;
-          assert(0);
+          UNREACHABLE;
         }
 
         if(first)
diff --git a/src/util/source_location.cpp b/src/util/source_location.cpp
index 7fc392620b7..46f7f5282d9 100644
--- a/src/util/source_location.cpp
+++ b/src/util/source_location.cpp
@@ -56,12 +56,21 @@ std::string source_locationt::as_string(bool print_cwd) const
   {
     if(dest!="")
       dest+=' ';
-    dest+="bytecode_index "+id2string(bytecode);
+    dest+="bytecode-index "+id2string(bytecode);
   }
 
   return dest;
 }
 
+void source_locationt::merge(const source_locationt &from)
+{
+  forall_named_irep(it, from.get_named_sub())
+  {
+    if(get(it->first).empty())
+      set(it->first, it->second);
+  }
+}
+
 std::ostream &operator << (
   std::ostream &out,
   const source_locationt &source_location)
diff --git a/src/util/source_location.h b/src/util/source_location.h
index 4186f3e35e2..d09f8f2e36f 100644
--- a/src/util/source_location.h
+++ b/src/util/source_location.h
@@ -70,11 +70,21 @@ class source_locationt:public irept
     return get(ID_comment);
   }
 
+  const irep_idt &get_case_number() const
+  {
+    return get(ID_switch_case_number);
+  }
+
   const irep_idt &get_java_bytecode_index() const
   {
     return get(ID_java_bytecode_index);
   }
 
+  const irep_idt &get_basic_block_covered_lines() const
+  {
+    return get(ID_basic_block_covered_lines);
+  }
+
   void set_file(const irep_idt &file)
   {
     set(ID_file, file);
@@ -125,11 +135,22 @@ class source_locationt:public irept
     set(ID_comment, comment);
   }
 
+  // for switch case number
+  void set_case_number(const irep_idt &number)
+  {
+    set(ID_switch_case_number, number);
+  }
+
   void set_java_bytecode_index(const irep_idt &index)
   {
     set(ID_java_bytecode_index, index);
   }
 
+  void set_basic_block_covered_lines(const irep_idt &covered_lines)
+  {
+    return set(ID_basic_block_covered_lines, covered_lines);
+  }
+
   void set_hide()
   {
     set(ID_hide, true);
@@ -152,6 +173,10 @@ class source_locationt:public irept
     return is_built_in(id2string(get_file()));
   }
 
+  /// Set all unset source-location fields in this object to their values in
+  /// 'from'. Leave set fields in this object alone.
+  void merge(const source_locationt &from);
+
   static const source_locationt &nil()
   {
     return static_cast<const source_locationt &>(get_nil_irep());
diff --git a/src/util/sparse_vector.h b/src/util/sparse_vector.h
new file mode 100644
index 00000000000..0b8332400a7
--- /dev/null
+++ b/src/util/sparse_vector.h
@@ -0,0 +1,66 @@
+/*******************************************************************\
+
+Module: Sparse Vectors
+
+Author: Romain Brenguier
+
+\*******************************************************************/
+
+/// \file
+/// Sparse Vectors
+
+#ifndef CPROVER_UTIL_SPARSE_VECTOR_H
+#define CPROVER_UTIL_SPARSE_VECTOR_H
+
+#include "invariant.h"
+
+#include <cstdint>
+#include <map>
+
+template<class T> class sparse_vectort
+{
+protected:
+  typedef std::map<uint64_t, T> underlyingt;
+  underlyingt underlying;
+  uint64_t _size;
+
+public:
+  sparse_vectort() :
+    _size(0) {}
+
+  const T &operator[](uint64_t idx) const
+  {
+    INVARIANT(idx<_size, "index out of range");
+    return underlying[idx];
+  }
+
+  T &operator[](uint64_t idx)
+  {
+    INVARIANT(idx<_size, "index out of range");
+    return underlying[idx];
+  }
+
+  uint64_t size() const
+  {
+    return _size;
+  }
+
+  void resize(uint64_t new_size)
+  {
+    INVARIANT(new_size>=_size, "sparse vector can't be shrunk (yet)");
+    _size=new_size;
+  }
+
+  typedef typename underlyingt::iterator iteratort;
+  typedef typename underlyingt::const_iterator const_iteratort;
+
+  iteratort begin() { return underlying.begin(); }
+  const_iteratort begin() const { return underlying.begin(); }
+
+  iteratort end() { return underlying.end(); }
+  const_iteratort end() const { return underlying.end(); }
+
+  const_iteratort find(uint64_t idx) { return underlying.find(idx); }
+};
+
+#endif // CPROVER_UTIL_SPARSE_VECTOR_H
diff --git a/src/util/ssa_expr.cpp b/src/util/ssa_expr.cpp
index 1285a8b260d..3e687b2bb55 100644
--- a/src/util/ssa_expr.cpp
+++ b/src/util/ssa_expr.cpp
@@ -37,7 +37,7 @@ static void build_ssa_identifier_rec(
 
     mp_integer idx;
     if(to_integer(to_constant_expr(index.index()), idx))
-      assert(false);
+      UNREACHABLE;
 
     os << '[' << idx << ']';
   }
@@ -68,7 +68,20 @@ static void build_ssa_identifier_rec(
     }
   }
   else
-    assert(false);
+    UNREACHABLE;
+}
+
+/* Used to determine whether or not an identifier can be built
+   * before trying and getting an exception */
+bool ssa_exprt::can_build_identifier(const exprt &expr)
+{
+  if(expr.id()==ID_symbol)
+    return true;
+  else if(expr.id()==ID_member ||
+          expr.id()==ID_index)
+    return can_build_identifier(expr.op0());
+  else
+    return false;
 }
 
 std::pair<irep_idt, irep_idt> ssa_exprt::build_identifier(
diff --git a/src/util/ssa_expr.h b/src/util/ssa_expr.h
index 61cbc566ef1..63e6dfaf7d7 100644
--- a/src/util/ssa_expr.h
+++ b/src/util/ssa_expr.h
@@ -65,7 +65,7 @@ class ssa_exprt:public symbol_exprt
 
   const irep_idt get_l1_object_identifier() const
   {
-    #if 0
+    #if 1
     return get_l1_object().get_identifier();
     #else
     // the above is the clean version, this is the fast one, using
@@ -135,6 +135,10 @@ class ssa_exprt:public symbol_exprt
     const irep_idt &l0,
     const irep_idt &l1,
     const irep_idt &l2);
+
+  /* Used to determine whether or not an identifier can be built
+   * before trying and getting an exception */
+  static bool can_build_identifier(const exprt &src);
 };
 
 /*! \brief Cast a generic exprt to an \ref ssa_exprt
diff --git a/src/util/std_code.h b/src/util/std_code.h
index cd017a658ba..f48c48cb71a 100644
--- a/src/util/std_code.h
+++ b/src/util/std_code.h
@@ -1039,14 +1039,41 @@ class side_effect_expr_nondett:public side_effect_exprt
 public:
   side_effect_expr_nondett():side_effect_exprt(ID_nondet)
   {
+    set_nullable(true);
   }
 
   explicit side_effect_expr_nondett(const typet &_type):
     side_effect_exprt(ID_nondet, _type)
   {
+    set_nullable(true);
+  }
+
+  void set_nullable(bool nullable)
+  {
+    set(ID_is_nondet_nullable, nullable);
+  }
+
+  bool get_nullable() const
+  {
+    return get_bool(ID_is_nondet_nullable);
   }
 };
 
+inline side_effect_expr_nondett &to_side_effect_expr_nondet(exprt &expr)
+{
+  auto &side_effect_expr_nondet=to_side_effect_expr(expr);
+  assert(side_effect_expr_nondet.get_statement()==ID_nondet);
+  return static_cast<side_effect_expr_nondett &>(side_effect_expr_nondet);
+}
+
+inline const side_effect_expr_nondett &to_side_effect_expr_nondet(
+  const exprt &expr)
+{
+  const auto &side_effect_expr_nondet=to_side_effect_expr(expr);
+  assert(side_effect_expr_nondet.get_statement()==ID_nondet);
+  return static_cast<const side_effect_expr_nondett &>(side_effect_expr_nondet);
+}
+
 /*! \brief A function call side effect
 */
 class side_effect_expr_function_callt:public side_effect_exprt
@@ -1125,34 +1152,153 @@ inline const side_effect_expr_throwt &to_side_effect_expr_throw(
   assert(expr.get(ID_statement)==ID_throw);
   return static_cast<const side_effect_expr_throwt &>(expr);
 }
-/*! \brief A side effect that pushes/pops a catch handler
-*/
-class side_effect_expr_catcht:public side_effect_exprt
+
+/// Pushes an exception handler, of the form:
+/// exception_tag1 -> label1
+/// exception_tag2 -> label2
+/// ...
+/// When used in a GOTO program instruction, the corresponding
+/// opcode must be CATCH, and the instruction's `targets` must
+/// be in one-to-one correspondence with the exception tags.
+/// The labels may be unspecified for the case where
+/// there is no corresponding source-language label, in whic
+/// case the GOTO instruction targets must be set at the same
+/// time.
+class code_push_catcht:public codet
 {
 public:
-  side_effect_expr_catcht():side_effect_exprt(ID_push_catch)
+  code_push_catcht():codet(ID_push_catch)
   {
+    set(ID_exception_list, irept(ID_exception_list));
   }
-  explicit side_effect_expr_catcht(const irept &exception_list):
-    side_effect_exprt(ID_push_catch)
+
+  class exception_list_entryt:public irept
   {
-    set(ID_exception_list, exception_list);
+  public:
+    exception_list_entryt()
+    {
+    }
+
+    explicit exception_list_entryt(const irep_idt &tag)
+    {
+      set(ID_tag, tag);
+    }
+
+    exception_list_entryt(const irep_idt &tag, const irep_idt &label)
+    {
+      set(ID_tag, tag);
+      set(ID_label, label);
+    }
+
+    void set_tag(const irep_idt &tag)
+    {
+      set(ID_tag, tag);
+    }
+
+    const irep_idt &get_tag() const {
+      return get(ID_tag);
+    }
+
+    void set_label(const irep_idt &label)
+    {
+      set(ID_label, label);
+    }
+
+    const irep_idt &get_label() const {
+      return get(ID_label);
+    }
+  };
+
+  typedef std::vector<exception_list_entryt> exception_listt;
+
+  code_push_catcht(
+    const irep_idt &tag,
+    const irep_idt &label):
+    codet(ID_push_catch)
+  {
+    set(ID_exception_list, irept(ID_exception_list));
+    exception_list().push_back(exception_list_entryt(tag, label));
+  }
+
+  exception_listt &exception_list() {
+    return (exception_listt &)find(ID_exception_list).get_sub();
+  }
+
+  const exception_listt &exception_list() const {
+    return (const exception_listt &)find(ID_exception_list).get_sub();
   }
 };
 
-static inline side_effect_expr_catcht &to_side_effect_expr_catch(exprt &expr)
+static inline code_push_catcht &to_code_push_catch(codet &code)
 {
-  assert(expr.id()==ID_side_effect);
-  assert(expr.get(ID_statement)==ID_push_catch);
-  return static_cast<side_effect_expr_catcht &>(expr);
+  assert(code.get_statement()==ID_push_catch);
+  return static_cast<code_push_catcht &>(code);
 }
 
-static inline const side_effect_expr_catcht &to_side_effect_expr_catch(
-  const exprt &expr)
+static inline const code_push_catcht &to_code_push_catch(const codet &code)
 {
-  assert(expr.id()==ID_side_effect);
-  assert(expr.get(ID_statement)==ID_push_catch);
-  return static_cast<const side_effect_expr_catcht &>(expr);
+  assert(code.get_statement()==ID_push_catch);
+  return static_cast<const code_push_catcht &>(code);
+}
+
+/// Pops an exception handler from the stack of active handlers
+/// (i.e. whichever handler was most recently pushed by a
+/// `code_push_catcht`).
+class code_pop_catcht:public codet
+{
+public:
+  code_pop_catcht():codet(ID_pop_catch)
+  {
+  }
+};
+
+static inline code_pop_catcht &to_code_pop_catch(codet &code)
+{
+  assert(code.get_statement()==ID_pop_catch);
+  return static_cast<code_pop_catcht &>(code);
+}
+
+static inline const code_pop_catcht &to_code_pop_catch(const codet &code)
+{
+  assert(code.get_statement()==ID_pop_catch);
+  return static_cast<const code_pop_catcht &>(code);
+}
+
+/// A statement that catches an exception, assigning the exception
+/// in flight to an expression (e.g. Java catch(Exception e) might be expressed
+/// landingpadt(symbol_expr("e", ...)))
+class code_landingpadt:public codet
+{
+ public:
+  code_landingpadt():codet(ID_exception_landingpad)
+  {
+    operands().resize(1);
+  }
+  explicit code_landingpadt(const exprt &catch_expr):
+  codet(ID_exception_landingpad)
+  {
+    copy_to_operands(catch_expr);
+  }
+  const exprt &catch_expr() const
+  {
+    return op0();
+  }
+  exprt &catch_expr()
+  {
+    return op0();
+  }
+};
+
+static inline code_landingpadt &to_code_landingpad(codet &code)
+{
+  assert(code.get_statement()==ID_exception_landingpad);
+  return static_cast<code_landingpadt &>(code);
+}
+
+static inline const code_landingpadt &to_code_landingpad(const codet &code)
+{
+  assert(code.get_statement()==ID_exception_landingpad);
+  return static_cast<const code_landingpadt &>(code);
 }
 
 /*! \brief A try/catch block
diff --git a/src/util/std_expr.cpp b/src/util/std_expr.cpp
index 71d8b0e42d3..445c31c3c27 100644
--- a/src/util/std_expr.cpp
+++ b/src/util/std_expr.cpp
@@ -135,16 +135,11 @@ void object_descriptor_exprt::build(
   assert(root_object().type().id()!=ID_empty);
 }
 
-static constant_exprt integer_constant(unsigned v)
-{
-  return constant_exprt(std::to_string(v), integer_typet());
-}
-
 shift_exprt::shift_exprt(
   const exprt &_src,
   const irep_idt &_id,
   const std::size_t _distance):
-  binary_exprt(_src, _id, integer_constant(_distance))
+  binary_exprt(_src, _id, from_integer(_distance, integer_typet()))
 {
 }
 
@@ -152,7 +147,7 @@ extractbit_exprt::extractbit_exprt(
   const exprt &_src,
   const std::size_t _index):
   binary_predicate_exprt(
-    _src, ID_extractbit, integer_constant(_index))
+    _src, ID_extractbit, from_integer(_index, integer_typet()))
 {
 }
 
@@ -166,8 +161,8 @@ extractbits_exprt::extractbits_exprt(
   assert(_upper>=_lower);
   operands().resize(3);
   src()=_src;
-  upper()=integer_constant(_upper);
-  lower()=integer_constant(_lower);
+  upper()=from_integer(_upper, integer_typet());
+  lower()=from_integer(_lower, integer_typet());
 }
 
 address_of_exprt::address_of_exprt(const exprt &_op):
diff --git a/src/util/std_expr.h b/src/util/std_expr.h
index 8323333d203..bf7001bb4dd 100644
--- a/src/util/std_expr.h
+++ b/src/util/std_expr.h
@@ -1826,9 +1826,8 @@ class floatbv_typecast_exprt:public binary_exprt
   floatbv_typecast_exprt(
     const exprt &op,
     const exprt &rounding,
-    const typet &_type):binary_exprt(ID_floatbv_typecast, _type)
+    const typet &_type):binary_exprt(op, ID_floatbv_typecast, rounding, _type)
   {
-    copy_to_operands(op, rounding);
   }
 
   exprt &op()
@@ -3323,6 +3322,17 @@ class member_exprt:public exprt
   {
     return op0();
   }
+
+  // Retrieves the object(symbol) this member corresponds to
+  inline const symbol_exprt &symbol() const
+  {
+    const exprt &op=op0();
+    if(op.id()==ID_member)
+    {
+      return static_cast<const member_exprt &>(op).symbol();
+    }
+    return to_symbol_expr(op);
+  }
 };
 
 /*! \brief Cast a generic exprt to a \ref member_exprt
@@ -3748,6 +3758,7 @@ class constant_exprt:public exprt
   bool value_is_zero_string() const;
 };
 
+
 /*! \brief Cast a generic exprt to a \ref constant_exprt
  *
  * This is an unchecked conversion. \a expr must be known to be \ref
@@ -3826,6 +3837,19 @@ class function_application_exprt:public exprt
     operands().resize(2);
   }
 
+  explicit function_application_exprt(const typet &_type):
+    exprt(ID_function_application, _type)
+  {
+    operands().resize(2);
+  }
+
+  function_application_exprt(
+    const symbol_exprt &_function, const typet &_type):
+      function_application_exprt(_type) // NOLINT(runtime/explicit)
+  {
+    function()=_function;
+  }
+
   exprt &function()
   {
     return op0();
diff --git a/src/util/std_types.cpp b/src/util/std_types.cpp
index b2d0c4f36d5..1b074b9522f 100644
--- a/src/util/std_types.cpp
+++ b/src/util/std_types.cpp
@@ -44,7 +44,7 @@ std::size_t struct_union_typet::component_number(
     number++;
   }
 
-  assert(false);
+  UNREACHABLE;
   return 0;
 }
 
diff --git a/src/util/std_types.h b/src/util/std_types.h
index ef6bc05a43b..d45d8ed3d8c 100644
--- a/src/util/std_types.h
+++ b/src/util/std_types.h
@@ -362,36 +362,50 @@ class class_typet:public struct_typet
     return is_class()?ID_private:ID_public;
   }
 
-  const irept::subt &bases() const
+  class baset:public exprt
   {
-    return find(ID_bases).get_sub();
+  public:
+    baset():exprt(ID_base)
+    {
+    }
+
+    explicit baset(const typet &base):exprt(ID_base, base)
+    {
+    }
+  };
+
+  typedef std::vector<baset> basest;
+
+  const basest &bases() const
+  {
+    return (const basest &)find(ID_bases).get_sub();
   }
 
-  irept::subt &bases()
+  basest &bases()
   {
-    return add(ID_bases).get_sub();
+    return (basest &)add(ID_bases).get_sub();
   }
 
   void add_base(const typet &base)
   {
-    bases().push_back(exprt(ID_base, base));
+    bases().push_back(baset(base));
   }
 
   bool has_base(const irep_idt &id) const
   {
-    const irept::subt &b=bases();
-
-    forall_irep(it, b)
+    for(const auto &b : bases())
     {
-      assert(it->id()==ID_base);
-      const irept &type=it->find(ID_type);
-      assert(type.id()==ID_symbol);
-      if(type.get(ID_identifier)==id)
+      if(to_symbol_type(b.type()).get(ID_identifier)==id)
         return true;
     }
 
     return false;
   }
+
+  bool is_abstract() const
+  {
+    return get_bool(ID_abstract);
+  }
 };
 
 /*! \brief Cast a generic typet to a \ref class_typet
@@ -884,6 +898,16 @@ class code_typet:public typet
     set(ID_C_inlined, value);
   }
 
+  const irep_idt &get_access() const
+  {
+    return get(ID_access);
+  }
+
+  void set_access(const irep_idt &access)
+  {
+    return set(ID_access, access);
+  }
+
   // this produces the list of parameter identifiers
   std::vector<irep_idt> parameter_identifiers() const
   {
diff --git a/src/util/string_expr.h b/src/util/string_expr.h
index e141f2a1598..693df01d87f 100644
--- a/src/util/string_expr.h
+++ b/src/util/string_expr.h
@@ -53,59 +53,59 @@ class string_exprt: public struct_exprt
   }
 
   // Comparison on the length of the strings
-  binary_relation_exprt axiom_for_is_longer_than(
+  binary_relation_exprt axiom_for_length_ge(
     const string_exprt &rhs) const
   {
     return binary_relation_exprt(length(), ID_ge, rhs.length());
   }
 
-  binary_relation_exprt axiom_for_is_longer_than(
+  binary_relation_exprt axiom_for_length_ge(
     const exprt &rhs) const
   {
     return binary_relation_exprt(length(), ID_ge, rhs);
   }
 
-  binary_relation_exprt axiom_for_is_strictly_longer_than(
+  binary_relation_exprt axiom_for_length_gt(
     const exprt &rhs) const
   {
     return binary_relation_exprt(rhs, ID_lt, length());
   }
 
-  binary_relation_exprt axiom_for_is_strictly_longer_than(
+  binary_relation_exprt axiom_for_length_gt(
     const string_exprt &rhs) const
   {
     return binary_relation_exprt(rhs.length(), ID_lt, length());
   }
 
-  binary_relation_exprt axiom_for_is_strictly_longer_than(int i) const
+  binary_relation_exprt axiom_for_length_gt(mp_integer i) const
   {
-    return axiom_for_is_strictly_longer_than(from_integer(i, length().type()));
+    return axiom_for_length_gt(from_integer(i, length().type()));
   }
 
-  binary_relation_exprt axiom_for_is_shorter_than(
+  binary_relation_exprt axiom_for_length_le(
     const string_exprt &rhs) const
   {
     return binary_relation_exprt(length(), ID_le, rhs.length());
   }
 
-  binary_relation_exprt axiom_for_is_shorter_than(
+  binary_relation_exprt axiom_for_length_le(
     const exprt &rhs) const
   {
     return binary_relation_exprt(length(), ID_le, rhs);
   }
 
-  binary_relation_exprt axiom_for_is_shorter_than(int i) const
+  binary_relation_exprt axiom_for_length_le(mp_integer i) const
   {
-    return axiom_for_is_shorter_than(from_integer(i, length().type()));
+    return axiom_for_length_le(from_integer(i, length().type()));
   }
 
-  binary_relation_exprt axiom_for_is_strictly_shorter_than(
+  binary_relation_exprt axiom_for_length_lt(
     const string_exprt &rhs) const
   {
     return binary_relation_exprt(length(), ID_lt, rhs.length());
   }
 
-  binary_relation_exprt axiom_for_is_strictly_shorter_than(
+  binary_relation_exprt axiom_for_length_lt(
     const exprt &rhs) const
   {
     return binary_relation_exprt(length(), ID_lt, rhs);
@@ -122,7 +122,7 @@ class string_exprt: public struct_exprt
     return equal_exprt(length(), rhs);
   }
 
-  equal_exprt axiom_for_has_length(int i) const
+  equal_exprt axiom_for_has_length(mp_integer i) const
   {
     return axiom_for_has_length(from_integer(i, length().type()));
   }
@@ -132,15 +132,15 @@ class string_exprt: public struct_exprt
 
 inline string_exprt &to_string_expr(exprt &expr)
 {
-  assert(expr.id()==ID_struct);
-  assert(expr.operands().size()==2);
+  PRECONDITION(expr.id()==ID_struct);
+  PRECONDITION(expr.operands().size()==2);
   return static_cast<string_exprt &>(expr);
 }
 
 inline const string_exprt &to_string_expr(const exprt &expr)
 {
-  assert(expr.id()==ID_struct);
-  assert(expr.operands().size()==2);
+  PRECONDITION(expr.id()==ID_struct);
+  PRECONDITION(expr.operands().size()==2);
   return static_cast<const string_exprt &>(expr);
 }
 
diff --git a/src/util/string_utils.cpp b/src/util/string_utils.cpp
index 101b6cd520c..65c95011e6b 100644
--- a/src/util/string_utils.cpp
+++ b/src/util/string_utils.cpp
@@ -98,3 +98,14 @@ void split_string(
   left=result[0];
   right=result[1];
 }
+
+std::string trim_from_last_delimiter(
+  const std::string &s,
+  const char delim)
+{
+  std::string result="";
+  const size_t index=s.find_last_of(delim);
+  if(index!=std::string::npos)
+    result=s.substr(0, index);
+  return result;
+}
diff --git a/src/util/string_utils.h b/src/util/string_utils.h
index 5e4ef23a63a..5779596cdcf 100644
--- a/src/util/string_utils.h
+++ b/src/util/string_utils.h
@@ -29,4 +29,8 @@ void split_string(
   std::string &right,
   bool strip=false);
 
+std::string trim_from_last_delimiter(
+  const std::string &s,
+  const char delim);
+
 #endif
diff --git a/src/util/symbol_table.cpp b/src/util/symbol_table.cpp
index 3ee5211e99b..c9e42ff5517 100644
--- a/src/util/symbol_table.cpp
+++ b/src/util/symbol_table.cpp
@@ -12,9 +12,8 @@ Author: Daniel Kroening, kroening@kroening.com
 
 /// Add a new symbol to the symbol table
 /// \param symbol: The symbol to be added to the symbol table
-/// \return Returns a boolean indicating whether the process failed, which
-///   should only happen if there is a symbol with the same name already in the
-///   symbol table
+/// \return Returns true if the process failed, which should only happen if
+///   there is a symbol with the same name already in the symbol table.
 bool symbol_tablet::add(const symbolt &symbol)
 {
   if(!symbols.insert(std::pair<irep_idt, symbolt>(symbol.name, symbol)).second)
diff --git a/src/util/tempdir.cpp b/src/util/tempdir.cpp
index b796befa707..7a2f9a460a2 100644
--- a/src/util/tempdir.cpp
+++ b/src/util/tempdir.cpp
@@ -14,7 +14,6 @@ Author: CM Wintersteiger
 #include <direct.h>
 #endif
 
-#include <cassert>
 #include <cstdlib>
 #include <cstring>
 
@@ -27,6 +26,7 @@ Author: CM Wintersteiger
 #include <unistd.h>
 #endif
 
+#include "invariant.h"
 #include "file_util.h"
 
 std::string get_temporary_directory(const std::string &name_template)
@@ -100,11 +100,11 @@ temp_working_dirt::temp_working_dirt(const std::string &name_template):
 {
   old_working_directory=get_current_working_directory();
   if(chdir(path.c_str())!=0)
-    assert(false);
+    CHECK_RETURN(false);
 }
 
 temp_working_dirt::~temp_working_dirt()
 {
   if(chdir(old_working_directory.c_str())!=0)
-    assert(false);
+    CHECK_RETURN(false);
 }
diff --git a/src/util/ui_message.cpp b/src/util/ui_message.cpp
index b680184e5ac..5757fc36acd 100644
--- a/src/util/ui_message.cpp
+++ b/src/util/ui_message.cpp
@@ -14,6 +14,7 @@ Author: Daniel Kroening, kroening@kroening.com
 #include "xml.h"
 #include "json.h"
 #include "xml_expr.h"
+#include "json_expr.h"
 #include "cout_message.h"
 #include "cmdline.h"
 
@@ -89,7 +90,8 @@ const char *ui_message_handlert::level_string(unsigned level)
 
 void ui_message_handlert::print(
   unsigned level,
-  const std::string &message)
+  const std::string &message,
+  bool preformatted)
 {
   if(verbosity>=level)
   {
@@ -98,7 +100,7 @@ void ui_message_handlert::print(
     case uit::PLAIN:
     {
       console_message_handlert console_message_handler;
-      console_message_handler.print(level, message);
+      console_message_handler.print(level, message, preformatted);
     }
     break;
 
@@ -107,7 +109,7 @@ void ui_message_handlert::print(
     {
       source_locationt location;
       location.make_nil();
-      print(level, message, -1, location);
+      print(level, message, -1, location, preformatted);
     }
     break;
     }
@@ -118,9 +120,10 @@ void ui_message_handlert::print(
   unsigned level,
   const std::string &message,
   int sequence_number,
-  const source_locationt &location)
+  const source_locationt &location,
+  bool preformatted)
 {
-  message_handlert::print(level, message);
+  message_handlert::print(level, message, preformatted);
 
   if(verbosity>=level)
   {
@@ -128,7 +131,7 @@ void ui_message_handlert::print(
     {
     case uit::PLAIN:
       message_handlert::print(
-        level, message, sequence_number, location);
+        level, message, sequence_number, location, preformatted);
       break;
 
     case uit::XML_UI:
@@ -144,7 +147,7 @@ void ui_message_handlert::print(
       std::string sequence_number_str=
         sequence_number>=0?std::to_string(sequence_number):"";
 
-      ui_msg(type, tmp_message, sequence_number_str, location);
+      ui_msg(type, tmp_message, sequence_number_str, location, preformatted);
     }
     break;
     }
@@ -155,7 +158,8 @@ void ui_message_handlert::ui_msg(
   const std::string &type,
   const std::string &msg1,
   const std::string &msg2,
-  const source_locationt &location)
+  const source_locationt &location,
+  bool preformatted)
 {
   switch(get_ui())
   {
@@ -163,11 +167,11 @@ void ui_message_handlert::ui_msg(
     break;
 
   case uit::XML_UI:
-    xml_ui_msg(type, msg1, msg2, location);
+    xml_ui_msg(type, msg1, msg2, location, preformatted);
     break;
 
   case uit::JSON_UI:
-    json_ui_msg(type, msg1, msg2, location);
+    json_ui_msg(type, msg1, msg2, location, preformatted);
     break;
   }
 }
@@ -176,8 +180,16 @@ void ui_message_handlert::xml_ui_msg(
   const std::string &type,
   const std::string &msg1,
   const std::string &msg2,
-  const source_locationt &location)
+  const source_locationt &location,
+  bool preformatted)
 {
+  if(preformatted)
+  {
+    // Expect the message is already an XML fragment.
+    std::cout << msg1 << '\n';
+    return;
+  }
+
   xmlt result;
   result.name="message";
 
@@ -196,15 +208,21 @@ void ui_message_handlert::json_ui_msg(
   const std::string &type,
   const std::string &msg1,
   const std::string &msg2,
-  const source_locationt &location)
+  const source_locationt &location,
+  bool preformatted)
 {
+  if(preformatted)
+  {
+    // Expect the message is already a JSON fragment.
+    std::cout << ",\n" << msg1;
+    return;
+  }
+
   json_objectt result;
 
-  #if 0
   if(location.is_not_nil() &&
      !location.get_file().empty())
-    result.new_element(xml(location));
-  #endif
+    result["sourceLocation"] = json(location);
 
   result["messageType"] = json_stringt(type);
   result["messageText"] = json_stringt(msg1);
diff --git a/src/util/ui_message.h b/src/util/ui_message.h
index 757108483f1..646c96d1ea4 100644
--- a/src/util/ui_message.h
+++ b/src/util/ui_message.h
@@ -44,32 +44,37 @@ class ui_message_handlert:public message_handlert
   // overloading
   virtual void print(
     unsigned level,
-    const std::string &message);
+    const std::string &message,
+    bool preformatted);
 
   // overloading
   virtual void print(
     unsigned level,
     const std::string &message,
     int sequence_number,
-    const source_locationt &location);
+    const source_locationt &location,
+    bool preformatted);
 
   virtual void xml_ui_msg(
     const std::string &type,
     const std::string &msg1,
     const std::string &msg2,
-    const source_locationt &location);
+    const source_locationt &location,
+    bool preformatted);
 
   virtual void json_ui_msg(
     const std::string &type,
     const std::string &msg1,
     const std::string &msg2,
-    const source_locationt &location);
+    const source_locationt &location,
+    bool preformatted);
 
   virtual void ui_msg(
     const std::string &type,
     const std::string &msg1,
     const std::string &msg2,
-    const source_locationt &location);
+    const source_locationt &location,
+    bool preformatted);
 
   const char *level_string(unsigned level);
 };
diff --git a/src/util/unicode.cpp b/src/util/unicode.cpp
index df38d52f8e7..4603d6d8023 100644
--- a/src/util/unicode.cpp
+++ b/src/util/unicode.cpp
@@ -152,17 +152,15 @@ std::string utf32_to_utf8(const std::basic_string<unsigned int> &s)
   return result;
 }
 
-const char **narrow_argv(int argc, const wchar_t **argv_wide)
+std::vector<std::string> narrow_argv(int argc, const wchar_t **argv_wide)
 {
   if(argv_wide==nullptr)
-    return nullptr;
+    return std::vector<std::string>();
 
-  // the following never gets deleted
-  const char **argv_narrow=new const char *[argc+1];
-  argv_narrow[argc]=nullptr;
+  std::vector<std::string> argv_narrow(argc);
 
-  for(int i=0; i<argc; i++)
-    argv_narrow[i]=strdup(narrow(argv_wide[i]).c_str());
+  for(int i=0; i!=argc; ++i)
+    argv_narrow[i]=narrow(argv_wide[i]);
 
   return argv_narrow;
 }
@@ -272,7 +270,7 @@ std::wstring utf8_to_utf16(const std::string& in, bool swap_bytes)
 
 /// \par parameters: String in UTF-8 format
 /// \return String in UTF-16BE format
-std::wstring utf8_to_utf16_big_endian(const std::string& in)
+std::wstring utf8_to_utf16_big_endian(const std::string &in)
 {
   bool swap_bytes=is_little_endian_arch();
   return utf8_to_utf16(in, swap_bytes);
@@ -280,7 +278,7 @@ std::wstring utf8_to_utf16_big_endian(const std::string& in)
 
 /// \par parameters: String in UTF-8 format
 /// \return String in UTF-16LE format
-std::wstring utf8_to_utf16_little_endian(const std::string& in)
+std::wstring utf8_to_utf16_little_endian(const std::string &in)
 {
   bool swap_bytes=!is_little_endian_arch();
   return utf8_to_utf16(in, swap_bytes);
@@ -288,21 +286,36 @@ std::wstring utf8_to_utf16_little_endian(const std::string& in)
 
 /// \par parameters: String in UTF-16LE format
 /// \return String in US-ASCII format, with \uxxxx escapes for other characters
-std::string utf16_little_endian_to_ascii(const std::wstring& in)
+std::string utf16_little_endian_to_java(const std::wstring &in)
 {
   std::ostringstream result;
-  std::locale loc;
-  for(const auto c : in)
+  const std::locale loc;
+  for(const auto ch : in)
   {
-    if(c<=255 && isprint(c, loc))
-      result << (unsigned char)c;
+    if(ch=='\n')
+      result << "\\n";
+    else if(ch=='\r')
+      result << "\\r";
+    else if(ch=='\f')
+      result << "\\f";
+    else if(ch=='\b')
+      result << "\\b";
+    else if(ch=='\t')
+      result << "\\t";
+    else if(ch<=255 && isprint(ch, loc))
+    {
+      const auto uch=static_cast<unsigned char>(ch);
+      if(uch=='"' || uch=='\\')
+        result << '\\';
+      result << uch;
+    }
     else
     {
       result << "\\u"
              << std::hex
              << std::setw(4)
              << std::setfill('0')
-             << (unsigned int)c;
+             << static_cast<unsigned int>(ch);
     }
   }
   return result.str();
diff --git a/src/util/unicode.h b/src/util/unicode.h
index 93e83c5b64f..2133123f50c 100644
--- a/src/util/unicode.h
+++ b/src/util/unicode.h
@@ -10,7 +10,9 @@ Author: Daniel Kroening, kroening@kroening.com
 #ifndef CPROVER_UTIL_UNICODE_H
 #define CPROVER_UTIL_UNICODE_H
 
+#include <algorithm>
 #include <string>
+#include <vector>
 
 // we follow the ideas suggested at
 // http://www.utf8everywhere.org/
@@ -24,8 +26,20 @@ std::string utf32_to_utf8(const std::basic_string<unsigned int> &s);
 
 std::wstring utf8_to_utf16_big_endian(const std::string &);
 std::wstring utf8_to_utf16_little_endian(const std::string &);
-std::string utf16_little_endian_to_ascii(const std::wstring &in);
-
-const char **narrow_argv(int argc, const wchar_t **argv_wide);
+std::string utf16_little_endian_to_java(const std::wstring &in);
+
+std::vector<std::string> narrow_argv(int argc, const wchar_t **argv_wide);
+
+template <typename It>
+std::vector<const char *> to_c_str_array(It b, It e)
+{
+  // Assumes that walking the range will be faster than repeated allocation
+  std::vector<const char *> ret(std::distance(b, e) + 1, nullptr);
+  std::transform(b, e, std::begin(ret), [] (const std::string & s)
+    {
+      return s.c_str();
+    });
+  return ret;
+}
 
 #endif // CPROVER_UTIL_UNICODE_H
diff --git a/src/util/union_find.cpp b/src/util/union_find.cpp
index e7b3230f305..e30744c7c24 100644
--- a/src/util/union_find.cpp
+++ b/src/util/union_find.cpp
@@ -117,7 +117,7 @@ unsigned_union_find::size_type unsigned_union_find::get_other(size_type a)
     if(find(i)==a && i!=a)
       return i;
 
-//  assert(false);
+//  UNREACHABLE;
   return 0;
 }
 
diff --git a/src/util/union_find.h b/src/util/union_find.h
index 4908bf65a49..42dd4738735 100644
--- a/src/util/union_find.h
+++ b/src/util/union_find.h
@@ -130,11 +130,21 @@ class unsigned_union_find
 
 template <typename T>
 // NOLINTNEXTLINE(readability/identifiers)
-class union_find:public numbering<T>
+class union_find final
 {
+  typedef numbering<T> numbering_typet;
+  numbering_typet numbers;
+
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename numbering_typet::number_type number_type;
+
 public:
   // NOLINTNEXTLINE(readability/identifiers)
-  typedef typename numbering<T>::size_type size_type;
+  typedef typename numbering_typet::size_type size_type;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename numbering_typet::iterator iterator;
+  // NOLINTNEXTLINE(readability/identifiers)
+  typedef typename numbering_typet::const_iterator const_iterator;
 
   // true == already in same set
   bool make_union(const T &a, const T &b)
@@ -149,7 +159,7 @@ class union_find:public numbering<T>
   bool make_union(typename numbering<T>::const_iterator it_a,
                   typename numbering<T>::const_iterator it_b)
   {
-    size_type na=it_a-numbering<T>::begin(), nb=it_b-numbering<T>::begin();
+    size_type na=it_a-numbers.begin(), nb=it_b-numbers.begin();
     bool is_union=find_number(na)==find_number(nb);
     uuf.make_union(na, nb);
     return is_union;
@@ -158,10 +168,9 @@ class union_find:public numbering<T>
   // are 'a' and 'b' in the same set?
   bool same_set(const T &a, const T &b) const
   {
-    typedef typename subt::number_type subt_number_typet;
-    subt_number_typet na=subt_number_typet(), nb=subt_number_typet();
-    bool have_na=!subt::get_number(a, na),
-         have_nb=!subt::get_number(b, nb);
+    number_type na, nb;
+    bool have_na=!numbers.get_number(a, na),
+         have_nb=!numbers.get_number(b, nb);
 
     if(have_na && have_nb)
       return uuf.same_set(na, nb);
@@ -175,22 +184,22 @@ class union_find:public numbering<T>
   bool same_set(typename numbering<T>::const_iterator it_a,
                 typename numbering<T>::const_iterator it_b) const
   {
-    return uuf.same_set(it_a-numbering<T>::begin(), it_b-numbering<T>::begin());
+    return uuf.same_set(it_a-numbers.begin(), it_b-numbers.begin());
   }
 
   const T &find(typename numbering<T>::const_iterator it) const
   {
-    return numbering<T>::operator[](find_number(it-numbering<T>::begin()));
+    return numbers[find_number(it-numbers.begin())];
   }
 
   const T &find(const T &a)
   {
-    return numbering<T>::operator[](find_number(number(a)));
+    return numbers[find_number(number(a))];
   }
 
   size_type find_number(typename numbering<T>::const_iterator it) const
   {
-    return find_number(it-numbering<T>::begin());
+    return find_number(it-numbers.begin());
   }
 
   size_type find_number(size_type a) const
@@ -210,9 +219,8 @@ class union_find:public numbering<T>
 
   bool is_root(const T &a) const
   {
-    typename subt::number_type na;
-
-    if(subt::get_number(a, na))
+    number_type na;
+    if(numbers.get_number(a, na))
       return true; // not found, it's a root
     else
       return uuf.is_root(na);
@@ -220,30 +228,30 @@ class union_find:public numbering<T>
 
   bool is_root(typename numbering<T>::const_iterator it) const
   {
-    return uuf.is_root(it-numbering<T>::begin());
+    return uuf.is_root(it-numbers.begin());
   }
 
   size_type number(const T &a)
   {
-    size_type n=subt::number(a);
+    size_type n=numbers.number(a);
 
     if(n>=uuf.size())
-      uuf.resize(this->size());
+      uuf.resize(numbers.size());
 
-    assert(uuf.size()==this->size());
+    INVARIANT(uuf.size()==numbers.size(), "container sizes must match");
 
     return n;
   }
 
   void clear()
   {
-    subt::clear();
+    numbers.clear();
     uuf.clear();
   }
 
   void isolate(typename numbering<T>::const_iterator it)
   {
-    uuf.isolate(it-numbering<T>::begin());
+    uuf.isolate(it-numbers.begin());
   }
 
   void isolate(const T &a)
@@ -251,6 +259,24 @@ class union_find:public numbering<T>
     uuf.isolate(number(a));
   }
 
+  bool get_number(const T &a, number_type &n) const
+  {
+    return numbers.get_number(a, n);
+  }
+
+  size_t size() const { return numbers.size(); }
+
+  T &operator[](size_type t) { return numbers[t]; }
+  const T &operator[](size_type t) const { return numbers[t]; }
+
+  iterator begin() { return numbers.begin(); }
+  const_iterator begin() const { return numbers.begin(); }
+  const_iterator cbegin() const { return numbers.cbegin(); }
+
+  iterator end() { return numbers.end(); }
+  const_iterator end() const { return numbers.end(); }
+  const_iterator cend() const { return numbers.cend(); }
+
 protected:
   unsigned_union_find uuf;
   typedef numbering<T> subt;
diff --git a/src/util/xml_expr.cpp b/src/util/xml_expr.cpp
index c3551617b68..3b9c8a719ba 100644
--- a/src/util/xml_expr.cpp
+++ b/src/util/xml_expr.cpp
@@ -28,6 +28,10 @@ xmlt xml(const source_locationt &location)
 
   result.name="location";
 
+  if(!location.get_working_directory().empty())
+    result.set_attribute(
+      "working-directory", id2string(location.get_working_directory()));
+
   if(!location.get_file().empty())
     result.set_attribute("file", id2string(location.get_file()));
 
diff --git a/src/xmllang/graphml.cpp b/src/xmllang/graphml.cpp
index d76f5b1f956..84df9d7a3ad 100644
--- a/src/xmllang/graphml.cpp
+++ b/src/xmllang/graphml.cpp
@@ -140,7 +140,7 @@ static bool build_graph_rec(
   }
   else
   {
-    assert(false);
+    UNREACHABLE;
     return true;
   }
 
diff --git a/unit/Makefile b/unit/Makefile
index 409402af1f1..b24eeeab1ad 100644
--- a/unit/Makefile
+++ b/unit/Makefile
@@ -3,15 +3,28 @@
 # Source files for test utilities
 SRC = src/expr/require_expr.cpp \
       src/ansi-c/c_to_expr.cpp \
+      unit_tests.cpp \
+      catch_example.cpp \
+      util/expr_iterator.cpp \
+      analyses/call_graph.cpp \
+      java_bytecode/java_bytecode_convert_class/convert_abstract_class.cpp \
       # Empty last line
 
 # Test source files
 SRC += unit_tests.cpp \
        analyses/ai/ai_simplify_lhs.cpp \
+       analyses/call_graph.cpp \
        analyses/does_remove_const/does_expr_lose_const.cpp \
        analyses/does_remove_const/does_type_preserve_const_correctness.cpp \
        analyses/does_remove_const/is_type_at_least_as_const_as.cpp \
+       java_bytecode/java_bytecode_convert_class/convert_abstract_class.cpp \
        miniBDD_new.cpp \
+       solvers/refinement/string_constraint_generator_valueof/calculate_max_string_length.cpp \
+       solvers/refinement/string_constraint_generator_valueof/get_numeric_value_from_character.cpp \
+       solvers/refinement/string_constraint_generator_valueof/is_digit_with_radix.cpp \
+       solvers/refinement/string_constraint_instantiation/instantiate_not_contains.cpp \
+       solvers/refinement/string_refinement/substitute_array_list.cpp \
+       solvers/refinement/string_refinement/concretize_array.cpp \
        catch_example.cpp \
        # Empty last line
 
@@ -23,7 +36,9 @@ include ../src/common
 cprover.dir:
 	$(MAKE) $(MAKEARGS) -C ../src
 
-CPROVER_LIBS =../src/ansi-c/ansi-c$(LIBEXT) \
+CPROVER_LIBS =../src/java_bytecode/java_bytecode$(LIBEXT) \
+              ../src/miniz/miniz$(OBJEXT) \
+              ../src/ansi-c/ansi-c$(LIBEXT) \
               ../src/cpp/cpp$(LIBEXT) \
               ../src/json/json$(LIBEXT) \
               ../src/linking/linking$(LIBEXT) \
diff --git a/unit/analyses/call_graph.cpp b/unit/analyses/call_graph.cpp
new file mode 100644
index 00000000000..adc2e75e6c8
--- /dev/null
+++ b/unit/analyses/call_graph.cpp
@@ -0,0 +1,123 @@
+
+#include <iostream>
+
+#include <catch.hpp>
+
+#include <analyses/call_graph.h>
+
+#include <util/symbol_table.h>
+#include <util/std_code.h>
+
+#include <goto-programs/goto_convert_functions.h>
+
+static symbolt create_void_function_symbol(
+  const irep_idt &name,
+  const codet &code)
+{
+  code_typet void_function_type;
+  symbolt function;
+  function.name=name;
+  function.type=void_function_type;
+  function.mode=ID_java;
+  function.value=code;
+  return function;
+}
+
+static bool multimap_key_matches(
+  const std::multimap<irep_idt, irep_idt> &map,
+  const irep_idt &key,
+  const std::set<irep_idt> &values)
+{
+  auto matching_values=map.equal_range(key);
+  std::set<irep_idt> matching_set;
+  for(auto it=matching_values.first; it!=matching_values.second; ++it)
+    matching_set.insert(it->second);
+  return matching_set==values;
+}
+
+SCENARIO("call_graph",
+  "[core][util][call_graph]")
+{
+
+  GIVEN("Some cyclic function calls")
+  {
+
+    // Create code like:
+    // void A()
+    // {
+    //    A();
+    //    B();
+    // }
+    // void B()
+    // {
+    //   C();
+    //   D();
+    // }
+    // void C() { }
+    // void D() { }
+
+    symbol_tablet symbol_table;
+    code_typet void_function_type;
+
+    {
+      code_blockt calls;
+      code_function_callt call1;
+      call1.function()=symbol_exprt("A", void_function_type);
+      code_function_callt call2;
+      call2.function()=symbol_exprt("B", void_function_type);
+      calls.move_to_operands(call1);
+      calls.move_to_operands(call2);
+
+      symbol_table.add(create_void_function_symbol("A", calls));
+    }
+
+    {
+      code_blockt calls;
+      code_function_callt call1;
+      call1.function()=symbol_exprt("C", void_function_type);
+      code_function_callt call2;
+      call2.function()=symbol_exprt("D", void_function_type);
+      calls.move_to_operands(call1);
+      calls.move_to_operands(call2);
+
+      symbol_table.add(create_void_function_symbol("B", calls));
+    }
+
+    symbol_table.add(create_void_function_symbol("C", code_skipt()));
+    symbol_table.add(create_void_function_symbol("D", code_skipt()));
+
+    goto_functionst goto_functions;
+    stream_message_handlert msg(std::cout);
+    goto_convert(symbol_table, goto_functions, msg);
+
+    call_grapht call_graph_from_goto_functions(goto_functions);
+
+    WHEN("A call graph is constructed from the GOTO functions")
+    {
+      THEN("We expect A -> { A, B }, B -> { C, D }")
+      {
+        const auto &check_graph=call_graph_from_goto_functions.graph;
+        REQUIRE(check_graph.size()==4);
+        REQUIRE(multimap_key_matches(check_graph, "A", {"A", "B"}));
+        REQUIRE(multimap_key_matches(check_graph, "B", {"C", "D"}));
+      }
+    }
+
+    WHEN("The call graph is inverted")
+    {
+      call_grapht inverse_call_graph_from_goto_functions=
+        call_graph_from_goto_functions.get_inverted();
+      THEN("We expect A -> { A }, B -> { A }, C -> { B }, D -> { B }")
+      {
+        const auto &check_graph=inverse_call_graph_from_goto_functions.graph;
+        REQUIRE(check_graph.size()==4);
+        REQUIRE(multimap_key_matches(check_graph, "A", {"A"}));
+        REQUIRE(multimap_key_matches(check_graph, "B", {"A"}));
+        REQUIRE(multimap_key_matches(check_graph, "C", {"B"}));
+        REQUIRE(multimap_key_matches(check_graph, "D", {"B"}));
+      }
+    }
+
+  }
+
+}
diff --git a/unit/java_bytecode/java_bytecode_convert_class/A.class b/unit/java_bytecode/java_bytecode_convert_class/A.class
new file mode 100644
index 00000000000..9684f38ea7c
Binary files /dev/null and b/unit/java_bytecode/java_bytecode_convert_class/A.class differ
diff --git a/unit/java_bytecode/java_bytecode_convert_class/C.class b/unit/java_bytecode/java_bytecode_convert_class/C.class
new file mode 100644
index 00000000000..70de87e848a
Binary files /dev/null and b/unit/java_bytecode/java_bytecode_convert_class/C.class differ
diff --git a/unit/java_bytecode/java_bytecode_convert_class/ExampleClasses.java b/unit/java_bytecode/java_bytecode_convert_class/ExampleClasses.java
new file mode 100644
index 00000000000..a7816923faa
--- /dev/null
+++ b/unit/java_bytecode/java_bytecode_convert_class/ExampleClasses.java
@@ -0,0 +1,32 @@
+interface I
+{
+  void interface_method();
+}
+
+abstract class A
+{
+  abstract void method();
+
+  int i;
+}
+
+class C
+{
+
+  int j;
+  void concreteMethod() {
+
+  }
+}
+
+class Extendor extends A {
+  void method() {
+
+  }
+}
+
+class Implementor implements I {
+  public void interface_method(){
+
+  }
+}
\ No newline at end of file
diff --git a/unit/java_bytecode/java_bytecode_convert_class/Extendor.class b/unit/java_bytecode/java_bytecode_convert_class/Extendor.class
new file mode 100644
index 00000000000..3986820feee
Binary files /dev/null and b/unit/java_bytecode/java_bytecode_convert_class/Extendor.class differ
diff --git a/unit/java_bytecode/java_bytecode_convert_class/I.class b/unit/java_bytecode/java_bytecode_convert_class/I.class
new file mode 100644
index 00000000000..550de7e7469
Binary files /dev/null and b/unit/java_bytecode/java_bytecode_convert_class/I.class differ
diff --git a/unit/java_bytecode/java_bytecode_convert_class/Implementor.class b/unit/java_bytecode/java_bytecode_convert_class/Implementor.class
new file mode 100644
index 00000000000..1c85bca08ae
Binary files /dev/null and b/unit/java_bytecode/java_bytecode_convert_class/Implementor.class differ
diff --git a/unit/java_bytecode/java_bytecode_convert_class/convert_abstract_class.cpp b/unit/java_bytecode/java_bytecode_convert_class/convert_abstract_class.cpp
new file mode 100644
index 00000000000..5d1bf8fc736
--- /dev/null
+++ b/unit/java_bytecode/java_bytecode_convert_class/convert_abstract_class.cpp
@@ -0,0 +1,149 @@
+/*******************************************************************\
+
+ Module: Unit tests for converting abstract classes
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <istream>
+#include <memory>
+
+#include <util/config.h>
+#include <util/language.h>
+#include <util/message.h>
+#include <java_bytecode/java_bytecode_language.h>
+
+SCENARIO("java_bytecode_convert_abstract_class",
+  "[core][java_bytecode][java_bytecode_convert_class]")
+{
+  std::unique_ptr<languaget>java_lang(new_java_bytecode_language());
+
+  // Configure the path loading
+  cmdlinet command_line;
+  command_line.set(
+    "java-cp-include-files",
+    "./java_bytecode/java_bytecode_convert_class");
+  config.java.classpath.push_back(
+    "./java_bytecode/java_bytecode_convert_class");
+
+  // Configure the language
+  null_message_handlert message_handler;
+  java_lang->get_language_options(command_line);
+  java_lang->set_message_handler(message_handler);
+
+  std::istringstream java_code_stream("ignored");
+
+  GIVEN("Some class files in the class path")
+  {
+    WHEN("Parsing an interface")
+    {
+      java_lang->parse(java_code_stream, "I.class");
+
+      symbol_tablet new_symbol_table;
+      java_lang->typecheck(new_symbol_table, "");
+
+      java_lang->final(new_symbol_table, false);
+
+      REQUIRE(new_symbol_table.has_symbol("java::I"));
+      THEN("The symbol type should be abstract")
+      {
+        const symbolt &class_symbol=new_symbol_table.lookup("java::I");
+        const typet &symbol_type=class_symbol.type;
+
+        REQUIRE(symbol_type.id()==ID_struct);
+        class_typet class_type=to_class_type(symbol_type);
+        REQUIRE(class_type.is_class());
+        REQUIRE(class_type.is_abstract());
+      }
+    }
+    WHEN("Parsing an abstract class")
+    {
+      java_lang->parse(java_code_stream, "A.class");
+
+      symbol_tablet new_symbol_table;
+      java_lang->typecheck(new_symbol_table, "");
+
+      java_lang->final(new_symbol_table, false);
+
+      REQUIRE(new_symbol_table.has_symbol("java::A"));
+      THEN("The symbol type should be abstract")
+      {
+        const symbolt &class_symbol=new_symbol_table.lookup("java::A");
+        const typet &symbol_type=class_symbol.type;
+
+        REQUIRE(symbol_type.id()==ID_struct);
+        class_typet class_type=to_class_type(symbol_type);
+        REQUIRE(class_type.is_class());
+        REQUIRE(class_type.is_abstract());
+      }
+    }
+    WHEN("Passing a concrete class")
+    {
+      java_lang->parse(java_code_stream, "C.class");
+
+      symbol_tablet new_symbol_table;
+      java_lang->typecheck(new_symbol_table, "");
+
+      java_lang->final(new_symbol_table, false);
+
+      REQUIRE(new_symbol_table.has_symbol("java::C"));
+      THEN("The symbol type should not be abstract")
+      {
+        const symbolt &class_symbol=new_symbol_table.lookup("java::C");
+        const typet &symbol_type=class_symbol.type;
+
+        REQUIRE(symbol_type.id()==ID_struct);
+        class_typet class_type=to_class_type(symbol_type);
+        REQUIRE(class_type.is_class());
+        REQUIRE_FALSE(class_type.is_abstract());
+      }
+    }
+    WHEN("Passing a concrete class that implements an interface")
+    {
+      java_lang->parse(java_code_stream, "Implementor.class");
+
+      symbol_tablet new_symbol_table;
+      java_lang->typecheck(new_symbol_table, "");
+
+      java_lang->final(new_symbol_table, false);
+
+      REQUIRE(new_symbol_table.has_symbol("java::Implementor"));
+      THEN("The symbol type should not be abstract")
+      {
+        const symbolt &class_symbol=
+          new_symbol_table.lookup("java::Implementor");
+        const typet &symbol_type=class_symbol.type;
+
+        REQUIRE(symbol_type.id()==ID_struct);
+        class_typet class_type=to_class_type(symbol_type);
+        REQUIRE(class_type.is_class());
+        REQUIRE_FALSE(class_type.is_abstract());
+      }
+    }
+    WHEN("Passing a concrete class that extends an abstract class")
+    {
+      java_lang->parse(java_code_stream, "Extendor.class");
+
+      symbol_tablet new_symbol_table;
+      java_lang->typecheck(new_symbol_table, "");
+
+      java_lang->final(new_symbol_table, false);
+
+      REQUIRE(new_symbol_table.has_symbol("java::Extendor"));
+      THEN("The symbol type should not be abstract")
+      {
+        const symbolt &class_symbol=
+          new_symbol_table.lookup("java::Extendor");
+        const typet &symbol_type=class_symbol.type;
+
+        REQUIRE(symbol_type.id()==ID_struct);
+        class_typet class_type=to_class_type(symbol_type);
+        REQUIRE(class_type.is_class());
+        REQUIRE_FALSE(class_type.is_abstract());
+      }
+    }
+  }
+}
diff --git a/unit/solvers/refinement/string_constraint_generator_valueof/calculate_max_string_length.cpp b/unit/solvers/refinement/string_constraint_generator_valueof/calculate_max_string_length.cpp
new file mode 100644
index 00000000000..82a636a9052
--- /dev/null
+++ b/unit/solvers/refinement/string_constraint_generator_valueof/calculate_max_string_length.cpp
@@ -0,0 +1,145 @@
+/*******************************************************************\
+
+ Module: Unit tests for calculate_max_string_length in
+   solvers/refinement/string_constraint_generator_valueof.cpp
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <solvers/refinement/string_constraint_generator.h>
+#include <util/std_types.h>
+
+/// Get the string length needed to print any value of the given type with the
+/// given radix.
+static size_t expected_length(const int radix, const typet &type)
+{
+  std::string longest("");
+  if(radix==2)
+  {
+    if(type==unsignedbv_typet(32))
+    {
+      longest="11111111111111111111111111111111";
+    }
+    else if(type==unsignedbv_typet(64))
+    {
+      longest=
+        "1111111111111111111111111111111111111111111111111111111111111111";
+    }
+    else if(type==signedbv_typet(32))
+    {
+      longest="-10000000000000000000000000000000";
+    }
+    else if(type==signedbv_typet(64))
+    {
+      longest=
+        "-1000000000000000000000000000000000000000000000000000000000000000";
+    }
+  }
+  else if(radix==8)
+  {
+    if(type==unsignedbv_typet(32))
+    {
+      longest="37777777777";
+    }
+    else if(type==unsignedbv_typet(64))
+    {
+      longest=
+        "1777777777777777777777";
+    }
+    else if(type==signedbv_typet(32))
+    {
+      longest="-20000000000";
+    }
+    else if(type==signedbv_typet(64))
+    {
+      longest=
+        "-1000000000000000000000";
+    }
+  }
+  else if(radix==10)
+  {
+    if(type==unsignedbv_typet(32))
+    {
+      longest="4294967295";
+    }
+    else if(type==unsignedbv_typet(64))
+    {
+      longest=
+        "18446744073709551615";
+    }
+    else if(type==signedbv_typet(32))
+    {
+      longest="-2147483648";
+    }
+    else if(type==signedbv_typet(64))
+    {
+      longest=
+        "-9223372036854775808";
+    }
+  }
+  else if(radix==16)
+  {
+    if(type==unsignedbv_typet(32))
+    {
+      longest="ffffffff";
+    }
+    else if(type==unsignedbv_typet(64))
+    {
+      longest=
+        "ffffffffffffffff";
+    }
+    else if(type==signedbv_typet(32))
+    {
+      longest="-80000000";
+    }
+    else if(type==signedbv_typet(64))
+    {
+      longest=
+        "-8000000000000000";
+    }
+  }
+
+  return longest.size();
+}
+
+SCENARIO("calculate_max_string_length",
+  "[core][solvers][refinement][string_constraint_generator_valueof]")
+{
+  const unsigned long radixes[]={2, 8, 10, 16};
+  const typet int_types[]=
+  {
+    signedbv_typet(32),
+    unsignedbv_typet(32),
+    signedbv_typet(64),
+    unsignedbv_typet(64)};
+
+  for(const typet &type : int_types)
+  {
+    WHEN(std::string("type = ")+type.pretty())
+    {
+      for(const unsigned long radix : radixes)
+      {
+        WHEN(std::string("radix = ")+std::to_string(radix))
+        {
+          size_t actual_value=max_printed_string_length(type, radix);
+          WHEN(std::string("correct value")+type.pretty())
+          {
+            size_t expected_value=expected_length(radix, type);
+            /// Due to floating point rounding errors, we sometime get one more
+            /// than the actual value, which is perfectly fine for our purposes
+            REQUIRE(expected_value<=actual_value);
+            REQUIRE(expected_value+1>=actual_value);
+          }
+          WHEN(std::string("value is less than with default radix"))
+          {
+            size_t actual_value_for_default=max_printed_string_length(type, 0);
+            REQUIRE(actual_value<=actual_value_for_default);
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/unit/solvers/refinement/string_constraint_generator_valueof/get_numeric_value_from_character.cpp b/unit/solvers/refinement/string_constraint_generator_valueof/get_numeric_value_from_character.cpp
new file mode 100644
index 00000000000..3fbcc93832d
--- /dev/null
+++ b/unit/solvers/refinement/string_constraint_generator_valueof/get_numeric_value_from_character.cpp
@@ -0,0 +1,134 @@
+/*******************************************************************\
+
+ Module: Unit tests for get_numeric_value_from_character in
+   solvers/refinement/string_constraint_generator_valueof.cpp
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <solvers/refinement/string_constraint_generator.h>
+#include <util/namespace.h>
+#include <util/symbol_table.h>
+#include <util/simplify_expr.h>
+#include <util/std_types.h>
+
+/// Get the simplified return value of get_numeric_value_from_character called
+/// with a radix
+static exprt actual(
+  const mp_integer &character,
+  const typet &char_type,
+  const typet &int_type,
+  const bool strict_formatting,
+  const unsigned long radix_ul)
+{
+  const constant_exprt chr=from_integer(character, char_type);
+  symbol_tablet symtab;
+  const namespacet ns(symtab);
+  return simplify_expr(
+    get_numeric_value_from_character(
+      chr, char_type, int_type, strict_formatting, radix_ul),
+    ns);
+}
+
+SCENARIO("get_numeric_value_from_character",
+  "[core][solvers][refinement][string_constraint_generator_valueof]")
+{
+  const typet char_type_1=unsignedbv_typet(8);
+  const typet char_type_2=unsignedbv_typet(16);
+  const typet char_type_3=unsignedbv_typet(32);
+  const typet int_type_1=signedbv_typet(8);
+  const typet int_type_2=signedbv_typet(16);
+  const typet int_type_3=signedbv_typet(32);
+  const typet int_type_4=signedbv_typet(64);
+
+  WHEN("character='0'")
+  {
+    mp_integer character='0';
+    mp_integer expected_mp=0;
+    const typet& char_type=char_type_1;
+    const typet& int_type=int_type_1;
+    const constant_exprt expected=from_integer(expected_mp, int_type);
+
+    REQUIRE(expected==actual(character, char_type, int_type, true, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 10));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 10));
+  }
+  WHEN("character='9'")
+  {
+    mp_integer character='9';
+    mp_integer expected_mp=9;
+    const typet& char_type=char_type_2;
+    const typet& int_type=int_type_2;
+    const constant_exprt expected=from_integer(expected_mp, int_type);
+
+    REQUIRE(expected==actual(character, char_type, int_type, true, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 10));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 10));
+  }
+  WHEN("character='A'")
+  {
+    mp_integer character='A';
+    mp_integer expected_mp=10;
+    const typet& char_type=char_type_3;
+    const typet& int_type=int_type_3;
+    const constant_exprt expected=from_integer(expected_mp, int_type);
+
+    REQUIRE(expected==actual(character, char_type, int_type, false, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 36));
+    REQUIRE(expected!=actual(character, char_type, int_type, false, 10));
+  }
+  WHEN("character='z'")
+  {
+    mp_integer character='z';
+    mp_integer expected_mp=35;
+    const typet& char_type=char_type_1;
+    const typet& int_type=int_type_4;
+    const constant_exprt expected=from_integer(expected_mp, int_type);
+
+    REQUIRE(expected==actual(character, char_type, int_type, true, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 36));
+    REQUIRE(expected!=actual(character, char_type, int_type, true, 10));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 36));
+    REQUIRE(expected!=actual(character, char_type, int_type, false, 10));
+  }
+  WHEN("character='+'")
+  {
+    mp_integer character='+';
+    mp_integer expected_mp=0;
+    const typet& char_type=char_type_2;
+    const typet& int_type=int_type_1;
+    const constant_exprt expected=from_integer(expected_mp, int_type);
+
+    REQUIRE(expected==actual(character, char_type, int_type, true, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 10));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 10));
+  }
+  WHEN("character='-'")
+  {
+    mp_integer character='-';
+    mp_integer expected_mp=0;
+    const typet& char_type=char_type_3;
+    const typet& int_type=int_type_2;
+    const constant_exprt expected=from_integer(expected_mp, int_type);
+
+    REQUIRE(expected==actual(character, char_type, int_type, true, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, true, 10));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 0));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 36));
+    REQUIRE(expected==actual(character, char_type, int_type, false, 10));
+  }
+}
diff --git a/unit/solvers/refinement/string_constraint_generator_valueof/is_digit_with_radix.cpp b/unit/solvers/refinement/string_constraint_generator_valueof/is_digit_with_radix.cpp
new file mode 100644
index 00000000000..e4fc9b22397
--- /dev/null
+++ b/unit/solvers/refinement/string_constraint_generator_valueof/is_digit_with_radix.cpp
@@ -0,0 +1,227 @@
+/*******************************************************************\
+
+ Module: Unit tests for is_digit_with_radix in
+   solvers/refinement/string_constraint_generator_valueof.cpp
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <solvers/refinement/string_constraint_generator.h>
+#include <util/namespace.h>
+#include <util/symbol_table.h>
+#include <util/simplify_expr.h>
+#include <util/std_types.h>
+
+/// Get the simplified return value of is_digit_with_radix called with a radix
+static exprt actual(
+  const mp_integer int_value,
+  const exprt &radix_as_char,
+  const unsigned long radix_ul,
+  const bool strict_formatting)
+{
+  const typet char_type=unsignedbv_typet(16);
+  const constant_exprt chr=from_integer(int_value, char_type);
+  symbol_tablet symtab;
+  const namespacet ns(symtab);
+
+  return simplify_expr(
+    is_digit_with_radix(chr, strict_formatting, radix_as_char, radix_ul), ns);
+}
+
+/// Get the simplified return value of is_digit_with_radix called with a radix
+static exprt actual_with_radix(
+  const mp_integer int_value,
+  const unsigned long radix_ul,
+  const bool strict_formatting)
+{
+  const typet char_type=unsignedbv_typet(16);
+  const constant_exprt radix_as_char=from_integer(radix_ul, char_type);
+
+  return actual(int_value, radix_as_char, radix_ul, strict_formatting);
+}
+
+/// Get the simplified return value of is_digit_with_radix called without a
+/// radix
+static exprt actual_without_radix(
+  const mp_integer int_value,
+  const unsigned long radix_ul,
+  const bool strict_formatting)
+{
+  const typet char_type=unsignedbv_typet(16);
+  const constant_exprt radix_as_char=from_integer(radix_ul, char_type);
+
+  return actual(int_value, radix_as_char, 0, strict_formatting);
+}
+
+SCENARIO("is_digit_with_radix without strict formatting",
+  "[core][solvers][refinement][string_constraint_generator_valueof]")
+{
+  WHEN("Radix 10")
+  {
+    const unsigned long radix_ul=10;
+
+    WHEN("char '0'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(true_exprt()==actual_without_radix('0', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('0', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('0', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('0', radix_ul, strict));
+      }
+    }
+    WHEN("char '9'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(true_exprt()==actual_without_radix('9', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('9', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('9', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('9', radix_ul, strict));
+      }
+    }
+    WHEN("char 'a'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(false_exprt()==actual_without_radix('a', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('a', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(false_exprt()==actual_without_radix('a', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('a', radix_ul, strict));
+      }
+    }
+  }
+  WHEN("Radix 8")
+  {
+    const unsigned long radix_ul=8;
+
+    WHEN("char '7'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(true_exprt()==actual_without_radix('7', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('7', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('7', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('7', radix_ul, strict));
+      }
+    }
+    WHEN("char '8'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(false_exprt()==actual_without_radix('8', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('8', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(false_exprt()==actual_without_radix('8', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('8', radix_ul, strict));
+      }
+    }
+  }
+  WHEN("Radix 16")
+  {
+    const unsigned long radix_ul=16;
+
+    WHEN("char '5'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(true_exprt()==actual_without_radix('5', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('5', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('5', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('5', radix_ul, strict));
+      }
+    }
+    WHEN("char 'a'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(true_exprt()==actual_without_radix('a', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('a', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('a', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('a', radix_ul, strict));
+      }
+    }
+    WHEN("char 'A'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(false_exprt()==actual_without_radix('A', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('A', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('A', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('A', radix_ul, strict));
+      }
+    }
+    WHEN("char 'f'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(true_exprt()==actual_without_radix('f', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('f', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(true_exprt()==actual_without_radix('f', radix_ul, strict));
+        REQUIRE(true_exprt()==actual_with_radix('f', radix_ul, strict));
+      }
+    }
+    WHEN("char 'g'")
+    {
+      WHEN("strict formatting on")
+      {
+        const bool strict=true;
+        REQUIRE(false_exprt()==actual_without_radix('g', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('g', radix_ul, strict));
+      }
+      WHEN("strict formatting off")
+      {
+        const bool strict=false;
+        REQUIRE(false_exprt()==actual_without_radix('g', radix_ul, strict));
+        REQUIRE(false_exprt()==actual_with_radix('g', radix_ul, strict));
+      }
+    }
+  }
+}
diff --git a/unit/solvers/refinement/string_constraint_instantiation/instantiate_not_contains.cpp b/unit/solvers/refinement/string_constraint_instantiation/instantiate_not_contains.cpp
new file mode 100644
index 00000000000..48cf3ed8e27
--- /dev/null
+++ b/unit/solvers/refinement/string_constraint_instantiation/instantiate_not_contains.cpp
@@ -0,0 +1,521 @@
+/*******************************************************************\
+
+ Module: Unit tests for `instantiate_not_contains_`.
+
+ Author: Jesse Sigal, jesse.sigal@diffblue.com
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <solvers/refinement/string_constraint_instantiation.h>
+
+#include <solvers/sat/satcheck.h>
+#include <solvers/refinement/bv_refinement.h>
+#include <java_bytecode/java_types.h>
+#include <langapi/mode.h>
+#include <java_bytecode/java_bytecode_language.h>
+#include <util/namespace.h>
+#include <util/symbol_table.h>
+#include <util/simplify_expr.h>
+
+/// \class Types used throughout the test. Currently it is impossible to
+/// statically initialize this value, there is a PR to allow this
+/// diffblue/cbmc/pull/1213
+class tt
+{
+public:
+  tt() {}
+  typet char_type() const {return java_char_type();}
+  typet length_type() const {return java_int_type();}
+  array_typet array_type() const
+  {
+    return array_typet(char_type(), infinity_exprt(length_type()));
+  }
+  refined_string_typet string_type() const
+  {
+    return refined_string_typet(length_type(), char_type());
+  }
+  array_typet witness_type() const
+  {
+    return array_typet(length_type(), infinity_exprt(length_type()));
+  }
+};
+
+// Static variable to get proper types
+const tt t;
+
+/// Creates a `constant_exprt` of the proper length type.
+/// \param [in] i: integer to convert
+/// \return corresponding `constant_exprt`
+constant_exprt from_integer(const mp_integer i)
+{
+  return from_integer(i, t.length_type());
+}
+
+/// Creates a `string_exprt` of the proper string type.
+/// \param [in] str: string to convert
+/// \return corresponding `string_exprt`
+string_exprt make_string_exprt(const std::string &str)
+{
+  const constant_exprt length=from_integer(str.length(), t.length_type());
+  array_exprt content(t.array_type());
+
+  for(const char c : str)
+    content.copy_to_operands(from_integer(c, t.char_type()));
+
+  return string_exprt(length, content, t.string_type());
+}
+
+/// For a constant `string_exprt`, creates a full index set.
+/// \param [in] s: `string_exprt` to create index set for
+/// \return the corresponding index set
+std::set<exprt> full_index_set(const string_exprt &s)
+{
+  PRECONDITION(s.length().is_constant());
+  mp_integer n;
+  to_integer(s.length(), n);
+  std::set<exprt> ret;
+  for(mp_integer i=0; i<n; ++i)
+    ret.insert(from_integer(i));
+  return ret;
+}
+
+/// Simplifies, and returns the conjunction of the lemmas.
+/// \param [in] lemmas: lemmas to process
+/// \param [in] ns: namespace for simplifying
+/// \return conjunction of simplified lemmas
+exprt combine_lemmas(const std::vector<exprt> &lemmas, const namespacet &ns)
+{
+  // Conjunction of new lemmas
+  exprt conj=conjunction(lemmas);
+
+  // Simplify
+  simplify(conj, ns);
+
+  return conj;
+}
+
+/// Creates information string and simplifies lemmas.
+/// \param [in,out] lemmas: lemmas to process (which are simplified)
+/// \param [in] ns: namespace for printing and simplifying
+/// \return information string
+std::string create_info(std::vector<exprt> &lemmas, const namespacet &ns)
+{
+  // Recording new lemmas
+  std::string new_lemmas;
+  for(auto &lemma : lemmas)
+  {
+    simplify(lemma, ns);
+    new_lemmas+=from_expr(ns, "", lemma)+"\n\n";
+  }
+  return "Instantiated lemmas:\n"+new_lemmas;
+}
+
+/// Checks the satisfiability of the given expression.
+/// \param [in] expr: expression to check
+/// \param [in] ns: namespace for solver
+/// \return SAT solver result
+decision_proceduret::resultt check_sat(const exprt &expr, const namespacet &ns)
+{
+  satcheck_no_simplifiert sat_check;
+  bv_refinementt::infot info;
+  info.ns=&ns;
+  info.prop=&sat_check;
+  const auto ui=language_uit::uit::PLAIN;
+  info.ui=ui;
+  bv_refinementt solver(info);
+  solver << expr;
+  return solver();
+}
+
+// The [!mayfail] tag allows tests to fail while reporting the failure
+SCENARIO("instantiate_not_contains",
+  "[!mayfail][core][solvers][refinement][string_constraint_instantiation]")
+{
+  // For printing expression
+  register_language(new_java_bytecode_language);
+  symbol_tablet symtbl;
+  const namespacet ns(symtbl);
+
+  GIVEN("The not_contains axioms of String.lastIndexOf(String, Int)")
+  {
+    // Creating strings
+    const string_exprt ab=make_string_exprt("ab");
+    const string_exprt b=make_string_exprt("b");
+
+    // Creating "ab".lastIndexOf("b", 0)
+    function_application_exprt func(
+      symbol_exprt(ID_cprover_string_last_index_of_func), t.length_type());
+    const exprt::operandst args={ab, b, from_integer(2)};
+    func.arguments()=args;
+
+    // Generating the corresponding axioms and simplifying, recording info
+    symbol_tablet symtab;
+    namespacet empty_ns(symtab);
+    string_constraint_generatort::infot info;
+    info.ns=&empty_ns;
+    string_constraint_generatort generator(info);
+    exprt res=generator.add_axioms_for_function_application(func);
+    std::string axioms;
+    std::vector<string_not_contains_constraintt> nc_axioms;
+    for(exprt axiom : generator.get_axioms())
+    {
+      simplify(axiom, ns);
+      if(axiom.id()==ID_string_constraint)
+      {
+        string_constraintt sc=to_string_constraint(axiom);
+        axioms+=from_expr(ns, "", sc);
+      }
+      else if(axiom.id()==ID_string_not_contains_constraint)
+      {
+        string_not_contains_constraintt sc=
+          to_string_not_contains_constraint(axiom);
+        axioms+=from_expr(ns, "", sc);
+        generator.witness[sc]=
+          generator.fresh_symbol("w", t.witness_type());
+        nc_axioms.push_back(sc);
+      }
+      else
+        axioms+=from_expr(ns, "", axiom);
+
+      axioms+="\n\n";
+    }
+    INFO("Original axioms:\n");
+    INFO(axioms);
+
+    WHEN("we instantiate and simplify")
+    {
+      // Making index sets
+      const std::set<exprt> index_set_ab=full_index_set(ab);
+      const std::set<exprt> index_set_b=full_index_set(b);
+
+      // List of new lemmas to be returned
+      std::vector<exprt> lemmas;
+
+      // Instantiate the lemmas
+      for(const auto &axiom : nc_axioms)
+      {
+        const std::vector<exprt> l=instantiate_not_contains(
+          axiom, index_set_ab, index_set_b, generator);
+        lemmas.insert(lemmas.end(), l.begin(), l.end());
+      }
+
+      const exprt conj=combine_lemmas(lemmas, ns);
+      const std::string info=create_info(lemmas, ns);
+      INFO(info);
+
+      THEN("the conjunction of instantiations is SAT")
+      {
+        // Check if SAT
+        decision_proceduret::resultt result=check_sat(conj, ns);
+
+        // Require SAT
+        if(result==decision_proceduret::resultt::D_ERROR)
+          INFO("Got an error");
+
+        REQUIRE(result==decision_proceduret::resultt::D_SATISFIABLE);
+      }
+    }
+  }
+
+  GIVEN("A vacuously true not_contains axioms")
+  {
+    // Creating strings
+    const string_exprt a=make_string_exprt("a");
+
+    // Make
+    // forall x in [0, 0). true => (exists y in [0, 1).
+    //   { .=1, .={ (char)'a' } }[x+y] != { .=1, .={ (char)'b' } }[y]
+    // )
+    // which is vacuously true.
+    string_not_contains_constraintt vacuous(
+      from_integer(0),
+      from_integer(0),
+      true_exprt(),
+      from_integer(0),
+      from_integer(1),
+      a,
+      a);
+
+    // Create witness for axiom
+    symbol_tablet symtab;
+    namespacet empty_ns(symtab);
+    string_constraint_generatort::infot info;
+    info.ns=&empty_ns;
+    string_constraint_generatort generator(info);
+    generator.witness[vacuous]=
+      generator.fresh_symbol("w", t.witness_type());
+
+    INFO("Original axiom:\n");
+    INFO(from_expr(ns, "", vacuous)+"\n\n");
+
+    WHEN("we instantiate and simplify")
+    {
+      // Making index sets
+      const std::set<exprt> index_set_a=full_index_set(a);
+
+      // Instantiate the lemmas
+      std::vector<exprt> lemmas=instantiate_not_contains(
+        vacuous, index_set_a, index_set_a, generator);
+
+      const exprt conj=combine_lemmas(lemmas, ns);
+      const std::string info=create_info(lemmas, ns);
+      INFO(info);
+
+      THEN("the conjunction of instantiations is SAT")
+      {
+        // Check if SAT
+        decision_proceduret::resultt result=check_sat(conj, ns);
+
+        // Require SAT
+        if(result==decision_proceduret::resultt::D_ERROR)
+          INFO("Got an error");
+
+        REQUIRE(result==decision_proceduret::resultt::D_SATISFIABLE);
+      }
+    }
+  }
+
+  GIVEN("A trivially false (via empty existential) not_contains axioms")
+  {
+    // Creating strings
+    const string_exprt a=make_string_exprt("a");
+    const string_exprt b=make_string_exprt("b");
+
+    // Make
+    // forall x in [0, 1). true => (exists y in [0, 0).
+    //   { .=1, .={ (char)'a' } }[x+y] != { .=1, .={ (char)'b' } }[y]
+    // )
+    // which is false.
+    string_not_contains_constraintt trivial(
+      from_integer(0),
+      from_integer(1),
+      true_exprt(),
+      from_integer(0),
+      from_integer(0),
+      a,
+      b);
+
+    // Create witness for axiom
+    symbol_tablet symtab;
+    namespacet ns(symtab);
+    string_constraint_generatort::infot info;
+    info.ns=&ns;
+    string_constraint_generatort generator(info);
+    generator.witness[trivial]=
+      generator.fresh_symbol("w", t.witness_type());
+
+    INFO("Original axiom:\n");
+    INFO(from_expr(ns, "", trivial)+"\n\n");
+
+    WHEN("we instantiate and simplify")
+    {
+      // Making index sets
+      const std::set<exprt> index_set_a=full_index_set(a);
+      const std::set<exprt> index_set_b=full_index_set(b);
+
+      // Instantiate the lemmas
+      std::vector<exprt> lemmas=instantiate_not_contains(
+        trivial, index_set_a, index_set_b, generator);
+
+      const exprt conj=combine_lemmas(lemmas, ns);
+      const std::string info=create_info(lemmas, ns);
+      INFO(info);
+
+      THEN("the conjunction of instantiations is UNSAT")
+      {
+        // Check if SAT
+        decision_proceduret::resultt result=check_sat(conj, ns);
+
+        // Require UNSAT
+        if(result==decision_proceduret::resultt::D_ERROR)
+          INFO("Got an error");
+
+        REQUIRE(result==decision_proceduret::resultt::D_UNSATISFIABLE);
+      }
+    }
+  }
+
+  GIVEN("A not_contains axioms with an non-empty and empty string")
+  {
+    // Creating strings
+    const string_exprt a=make_string_exprt("a");
+    const string_exprt empty=make_string_exprt("");
+
+    // Make
+    // forall x in [0, 1). true => (exists y in [0, 0).
+    //   { .=1, .={ (char)'a' } }[x+y] != { .=0, .={ } }[y]
+    // )
+    // which is false.
+    string_not_contains_constraintt trivial(
+      from_integer(0),
+      from_integer(1),
+      true_exprt(),
+      from_integer(0),
+      from_integer(0),
+      a,
+      empty);
+
+    // Create witness for axiom
+    symbol_tablet symtab;
+    namespacet empty_ns(symtab);
+    string_constraint_generatort::infot info;
+    info.ns=&empty_ns;
+    string_constraint_generatort generator(info);
+    generator.witness[trivial]=
+      generator.fresh_symbol("w", t.witness_type());
+
+    INFO("Original axiom:\n");
+    INFO(from_expr(ns, "", trivial)+"\n\n");
+
+    WHEN("we instantiate and simplify")
+    {
+      // Making index sets
+      const std::set<exprt> index_set_a=full_index_set(a);
+      const std::set<exprt> index_set_empty=
+        {generator.fresh_exist_index("z", t.length_type())};
+
+      // Instantiate the lemmas
+      std::vector<exprt> lemmas=instantiate_not_contains(
+        trivial, index_set_a, index_set_empty, generator);
+
+      const exprt conj=combine_lemmas(lemmas, ns);
+      const std::string info=create_info(lemmas, ns);
+      INFO(info);
+
+      THEN("the conjunction of instantiations is UNSAT")
+      {
+        // Check if SAT
+        decision_proceduret::resultt result=check_sat(conj, ns);
+
+        // Require UNSAT
+        if(result==decision_proceduret::resultt::D_ERROR)
+          INFO("Got an error");
+
+        REQUIRE(result==decision_proceduret::resultt::D_UNSATISFIABLE);
+      }
+    }
+  }
+
+  GIVEN("A not_contains on the same string twice (hence is false)")
+  {
+    // Creating strings
+    const string_exprt ab=make_string_exprt("ab");
+
+    // Make
+    // forall x in [0, 2). true => (exists y in [0, 2).
+    //   { .=2, .={ (char)'a', (char)'b'} }[x+y] !=
+    //   { .=2, .={ (char)'a', (char)'b'}[y]
+    // )
+    // which is false (for x = 0).
+    string_not_contains_constraintt trivial(
+      from_integer(0),
+      from_integer(2),
+      true_exprt(),
+      from_integer(0),
+      from_integer(2),
+      ab,
+      ab);
+
+    // Create witness for axiom
+    symbol_tablet symtab;
+    namespacet empty_ns(symtab);
+
+    string_constraint_generatort::infot info;
+    info.ns=&empty_ns;
+    string_constraint_generatort generator(info);
+    generator.witness[trivial]=
+      generator.fresh_symbol("w", t.witness_type());
+
+    INFO("Original axiom:\n");
+    INFO(from_expr(ns, "", trivial)+"\n\n");
+
+    WHEN("we instantiate and simplify")
+    {
+      // Making index sets
+      const std::set<exprt> index_set_ab=full_index_set(ab);
+
+      // Instantiate the lemmas
+      std::vector<exprt> lemmas=instantiate_not_contains(
+        trivial, index_set_ab, index_set_ab, generator);
+
+      const exprt conj=combine_lemmas(lemmas, ns);
+      const std::string info=create_info(lemmas, ns);
+      INFO(info);
+
+      THEN("the conjunction of instantiations is UNSAT")
+      {
+        // Check if SAT
+        decision_proceduret::resultt result=check_sat(conj, ns);
+
+        // Require UNSAT
+        if(result==decision_proceduret::resultt::D_ERROR)
+          INFO("Got an error");
+
+        REQUIRE(result==decision_proceduret::resultt::D_UNSATISFIABLE);
+      }
+    }
+  }
+
+  GIVEN("A not_contains on two string with no chars in common (hence is true)")
+  {
+    // Creating strings
+    const string_exprt ab=make_string_exprt("ab");
+    const string_exprt cd=make_string_exprt("cd");
+
+    // Make
+    // forall x in [0, 2). true => (exists y in [0, 2).
+    //   { .=2, .={ (char)'a', (char)'b'} }[x+y] !=
+    //   { .=2, .={ (char)'a', (char)'b'}[y]
+    // )
+    // which is true.
+    string_not_contains_constraintt trivial(
+      from_integer(0),
+      from_integer(2),
+      true_exprt(),
+      from_integer(0),
+      from_integer(2),
+      ab,
+      cd);
+
+    // Create witness for axiom
+    symbol_tablet symtab;
+    namespacet empty_ns(symtab);
+    string_constraint_generatort::infot info;
+    info.ns=&empty_ns;
+    string_constraint_generatort generator(info);
+    generator.witness[trivial]=
+      generator.fresh_symbol("w", t.witness_type());
+
+    INFO("Original axiom:\n");
+    INFO(from_expr(ns, "", trivial)+"\n\n");
+
+    WHEN("we instantiate and simplify")
+    {
+      // Making index sets
+      const std::set<exprt> index_set_ab=full_index_set(ab);
+      const std::set<exprt> index_set_cd=full_index_set(cd);
+
+      // Instantiate the lemmas
+      std::vector<exprt> lemmas=instantiate_not_contains(
+        trivial, index_set_ab, index_set_cd, generator);
+
+      const exprt conj=combine_lemmas(lemmas, ns);
+      const std::string info=create_info(lemmas, ns);
+      INFO(info);
+
+      THEN("the conjunction of instantiations is SAT")
+      {
+        // Check if SAT
+        decision_proceduret::resultt result=check_sat(conj, ns);
+
+        // Require UNSAT
+        if(result==decision_proceduret::resultt::D_ERROR)
+          INFO("Got an error");
+
+        REQUIRE(result==decision_proceduret::resultt::D_SATISFIABLE);
+      }
+    }
+  }
+}
diff --git a/unit/solvers/refinement/string_refinement/concretize_array.cpp b/unit/solvers/refinement/string_refinement/concretize_array.cpp
new file mode 100644
index 00000000000..ab4dc31ae5f
--- /dev/null
+++ b/unit/solvers/refinement/string_refinement/concretize_array.cpp
@@ -0,0 +1,56 @@
+/*******************************************************************\
+
+ Module: Unit tests for concretize_array_expression in
+   solvers/refinement/string_refinement.cpp
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <util/arith_tools.h>
+#include <util/std_types.h>
+#include <util/std_expr.h>
+#include <solvers/refinement/string_refinement.h>
+
+SCENARIO("concretize_array_expression",
+  "[core][solvers][refinement][string_refinement]")
+{
+  const typet char_type=unsignedbv_typet(16);
+  const typet int_type=signedbv_typet(32);
+  const exprt index1=from_integer(1, int_type);
+  const exprt charx=from_integer('x', char_type);
+  const exprt index4=from_integer(4, int_type);
+  const exprt chary=from_integer('y', char_type);
+  const exprt index100=from_integer(100, int_type);
+  const exprt char0=from_integer('0', char_type);
+  const exprt index2=from_integer(2, int_type);
+  array_typet array_type(char_type, infinity_exprt(int_type));
+
+  // input_expr is
+  // `'0' + (ARRAY_OF(0) WITH [1:=x] WITH [4:=y] WITH [100:=z])[2]`
+  const plus_exprt input_expr(
+    from_integer('0', char_type),
+    index_exprt(
+      with_exprt(
+        with_exprt(
+          with_exprt(
+            array_of_exprt(from_integer(0, char_type), array_type),
+            index1,
+            charx),
+          index4,
+          chary),
+        index100,
+        from_integer('z', char_type)),
+      index2));
+
+  // String max length is 50, so index 100 should get ignored.
+  const exprt concrete=concretize_arrays_in_expression(input_expr, 50);
+
+  // The expected result is `'0' + { 'x', 'x', 'y', 'y', 'y' }`
+  array_exprt array(array_type);
+  array.operands()={charx, charx, chary, chary, chary};
+  const plus_exprt expected(char0, index_exprt(array, index2));
+  REQUIRE(concrete==expected);
+}
diff --git a/unit/solvers/refinement/string_refinement/substitute_array_list.cpp b/unit/solvers/refinement/string_refinement/substitute_array_list.cpp
new file mode 100644
index 00000000000..5258406cff1
--- /dev/null
+++ b/unit/solvers/refinement/string_refinement/substitute_array_list.cpp
@@ -0,0 +1,55 @@
+/*******************************************************************\
+
+ Module: Unit tests for get_numeric_value_from_character in
+   solvers/refinement/string_constraint_generator_valueof.cpp
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+
+#include <util/arith_tools.h>
+#include <util/std_types.h>
+#include <util/std_expr.h>
+#include <solvers/refinement/string_refinement.h>
+#include <iostream>
+
+SCENARIO("substitute_array_list",
+  "[core][solvers][refinement][string_refinement]")
+{
+  const typet char_type=unsignedbv_typet(16);
+  const typet int_type=signedbv_typet(32);
+  exprt arr("array-list");
+  const exprt index0=from_integer(0, int_type);
+  const exprt charx=from_integer('x', char_type);
+  const exprt index1=from_integer(1, int_type);
+  const exprt chary=from_integer('y', char_type);
+  const exprt index100=from_integer(100, int_type);
+
+  // arr is `array-list [ 0 , 'x' , 1 , 'y' , 2 , 'z']`
+  arr.operands()=
+    { index0, charx, index1, chary, index100, from_integer('z', char_type) };
+
+  // Max length is 2, so index 2 should get ignored.
+  const exprt subst=substitute_array_lists(arr, 2);
+
+  // Check that `subst = e1 WITH [1:='y']`
+  REQUIRE(subst.id()==ID_with);
+  REQUIRE(subst.operands().size()==3);
+  const exprt &e1=subst.op0();
+  REQUIRE(subst.op1()==index1);
+  REQUIRE(subst.op2()==chary);
+
+  // Check that `e1 = e2 WITH [0:='x']`
+  REQUIRE(e1.id()==ID_with);
+  REQUIRE(e1.operands().size()==3);
+  const exprt &e2=e1.op0();
+  REQUIRE(e1.op1()==index0);
+  REQUIRE(e1.op2()==charx);
+
+  // Check that `e1 = ARRAY_OF 0`
+  REQUIRE(e2.id()==ID_array_of);
+  REQUIRE(e2.operands().size()==1);
+  REQUIRE(e2.op0()==from_integer(0, char_type));
+}
diff --git a/unit/util/expr_iterator.cpp b/unit/util/expr_iterator.cpp
new file mode 100644
index 00000000000..b806448b5c9
--- /dev/null
+++ b/unit/util/expr_iterator.cpp
@@ -0,0 +1,158 @@
+/*******************************************************************\
+
+ Module: Example Catch Tests
+
+ Author: DiffBlue Limited. All rights reserved.
+
+\*******************************************************************/
+
+#include <catch.hpp>
+#include <util/expr.h>
+#include <util/expr_iterator.h>
+
+TEST_CASE("Depth iterator over empty exprt")
+{
+  exprt expr;
+  std::vector<std::reference_wrapper<const exprt>> results;
+  std::copy(expr.depth_begin(),
+            expr.depth_end(),
+            std::back_inserter(results));
+  REQUIRE(results.size()==1);
+  REQUIRE(results.front().get()==expr);
+}
+
+TEST_CASE("Unique depth iterator over empty exprt")
+{
+  exprt expr;
+  std::vector<std::reference_wrapper<const exprt>> results;
+  std::copy(expr.unique_depth_begin(),
+            expr.unique_depth_end(),
+            std::back_inserter(results));
+  REQUIRE(results.size()==1);
+  REQUIRE(results.front().get()==expr);
+}
+
+TEST_CASE("Iterate over a node with 3 children")
+{
+  std::vector<exprt> input(4);
+  input[0].operands()={ input[1], input[2], input[3] };
+  std::vector<std::reference_wrapper<const exprt>> results;
+  std::copy(input[0].depth_begin(),
+            input[0].depth_end(),
+            std::back_inserter(results));
+  REQUIRE(results.size()==input.size());
+
+  auto it=results.begin();
+  for(const auto &expr : input)
+  {
+    REQUIRE(it->get()==expr);
+    it++;
+  }
+}
+
+TEST_CASE("Iterate over a node with 5 children, ignoring duplicates")
+{
+  std::vector<exprt> input(4);
+  input[1].id(ID_int);
+  input[2].id(ID_symbol);
+  input[3].id(ID_array);
+  input[0].operands()={ input[1], input[2], input[1], input[3], input[2] };
+  std::vector<std::reference_wrapper<const exprt>> results;
+  std::copy(input[0].unique_depth_begin(),
+            input[0].unique_depth_end(),
+            std::back_inserter(results));
+  REQUIRE(results.size()==input.size());
+
+  auto it=results.begin();
+  for(const auto &expr : input)
+  {
+    REQUIRE(it->get()==expr);
+    it++;
+  }
+}
+
+TEST_CASE("Iterate over a 3-level node")
+{
+  std::vector<exprt> input(4);
+  input[1].id(ID_int);
+  input[2].operands()={ input[3] };
+  input[0].operands()={ input[1], input[2] };
+  std::vector<std::reference_wrapper<const exprt>> results;
+  std::copy(input[0].depth_begin(),
+            input[0].depth_end(),
+            std::back_inserter(results));
+  REQUIRE(results.size()==input.size());
+
+  auto it=results.begin();
+  for(const auto &expr : input)
+  {
+    REQUIRE(it->get()==expr);
+    it++;
+  }
+}
+
+TEST_CASE("Iterate over a 3-level tree, ignoring duplicates")
+{
+  std::vector<exprt> input(4);
+  input[1].id(ID_int);
+  input[2].operands()={ input[3], input[1] };
+  input[0].operands()={ input[1], input[2], input[3] };
+  std::vector<std::reference_wrapper<const exprt>> results;
+  std::copy(input[0].unique_depth_begin(),
+            input[0].unique_depth_end(),
+            std::back_inserter(results));
+  REQUIRE(results.size()==input.size());
+
+  auto it=results.begin();
+  for(const auto &expr : input)
+  {
+    REQUIRE(it->get()==expr);
+    it++;
+  }
+}
+
+TEST_CASE("Iterate over a 3-level tree, mutate - set all types to ID_symbol")
+{
+  std::vector<exprt> input(4);
+  input[1].id(ID_int);
+  input[2].operands()={ input[3] };
+  input[0].operands()={ input[1], input[2] };
+  std::vector<std::reference_wrapper<exprt>> results;
+  for(auto it=input[0].depth_begin(),
+           end=input[0].depth_end();
+      it != end; ++it)
+  {
+    exprt &expr=it.mutate();
+    results.push_back(std::ref(expr));
+    REQUIRE(*it==expr);
+    expr.id(ID_symbol);
+  }
+  REQUIRE(results.size()==input.size());
+  for(const auto& expr : results)
+  {
+    REQUIRE(expr.get().id()==ID_symbol);
+  }
+}
+
+TEST_CASE("next_sibling_or_parent, next sibling")
+{
+  std::vector<exprt> input(4);
+  input[1].operands()={ input[3] };
+  input[2].id(ID_int);
+  input[0].operands()={ input[1], input[2] };
+  auto it=input[0].depth_begin();
+  it++;
+  it.next_sibling_or_parent();
+  REQUIRE(*it==input[2]);
+}
+
+TEST_CASE("next_sibling_or_parent, next parent ")
+{
+  std::vector<exprt> input(3);
+  input[1].operands()={ input[2] };
+  input[0].operands()={ input[1] };
+  auto it=input[0].depth_begin();
+  it++;
+  it.next_sibling_or_parent();
+  REQUIRE(it==input[0].depth_end());
+}