(Memory Maps) Added MemoryMap::empty()
(Yices Solver) YicesSolver::available_linkage() is a class method
(Work List) Factored out work lists to its own class template

WorkList<T> is a linked list with Perl-like push/pop/unshift/shift
operations but which supports lists of unique items (push/unshift is
a no-op if an item is already on the list).
(Binary Pointer Detection) New analysis

This analysis is to find variables of pointer type in binaries
and determine whether the pointer is to code and/or data.
(Binary Analysis) Fixed defining instruction list for memory writes

The list of defining instructions for values written into memory
was accidentally cleared during the write.  This made it impossible
to tell where memory values originally came from.
(Binary Analysis) Fixed a problem with the post-dominance analysis

The binary post-dominance analysis failed an assertion when invoked
on a function that did not have any exit or termination nodes (such
as a function like "void f() { while(1); }".

This commit fixes that bug two ways:

1. The algorithm is changed to report that none of the function's
   basic blocks have post dominators.

2. New methods are added to allow the caller to specify a basic
   block to use as the termination node when ROSE is not able
   to find such a node (such as in the example above).
(Binary Simulator) Replaced pointer detection with ROSE's analysis

The pointer detection analysis in the simulator has been superseded
by the analysis in ROSE.  So we use the one in ROSE now.
(Binary Analysis) Example to show subclassing BinaryAnalysis::Dominance
(Binary Simulator) The x86 HLT instruction throws a Halt exception

Old stubbed in behavior was to print "hlt" and abort.  At this time,
the main simulator control path doesn't catch the exception (HLT isn't
normally encountered in user code, and it causes a SIGSEGV when it
is), but some of the binary analyses need to handle it.
(Binary Simulator) More work on clone detection

* When a non-null pointer input value is use, a page of
  memory is allocated at that address in order to avoid
  a segmentation fault.  The pages are allocated using
  the simulator's mem_map(), which is the same function
  used by simulated mmap and mmap2 syscalls.

* Each specimen functions has a pointer-variable detection
  analysis performed so that we know what memory addresses
  are pointers and which are non-pointers.  This info is
  used when consuming input values, to decide whether we
  should consume a pointer input value or a non-pointer value.

* The analysis runs in the concrete domain (see
  HighLevel::domains_for_instruction()).  As with the original mixed
  semantics implementation, memory addresses are always in the
  symbolic domain (although they're all constants).

* The outputs are converted from any domain to the concrete domain and
  placed in a set.

* Turned off some debugging output. Search for "#if 0 /*DEBUGGING" if
  you need to turn these back on.  Even when turned on, most of them
  only produce output if you run the analysis with "--debug".
(Binary Analysis) CFG Dominance tests filter their output

These tests are too sensitive to variable numbering in the instruction
semantics layers, so variable numbers are filtered out like we do for
most of the other similar tests.
(Binary Analysis) Changing CFG dominance tests

These tests didn't work well because they used too many
temporary files without any good bookkeeping of the file names.
(Binary Simulator) More work on clone detection
(Binary Simulator) Added SQL support

Generates SQL output in a clones.sql file.  I chose this approach
rather than the typical ROSE database methods because ROSE does
not support a generic database interface (such as ODBC) at this
time.  Generating SQL will allow the clone detection to be used
with pretty much any SQL-based database (SQLite, MySQL, PostgreSQL,
etc.).
(Binary Analysis) Fixed bug in CFG dominance test
(Binary Simulator) Clone detection can use concrete or symbolic for mem addr

The binary clone detector can compile-time select either the symbolic or
the concrete domain for memory address operations.  The concrete domain
is much faster since it doesn't incur calls to an SMT solver to answer
address aliasing questions, and it uses an std::map rather than an std:list.
(Binary Simulator) Added test specimen for binary clone detection

This test specimen is a set of very simple, closely related functions
which are compiled with different optimization levels (0,1,2,3,s) and
linked into a single executable.
(Binary Simulator) Pointer detection analysis now immune to disassembly failure
(Binary Simulator) Added sorting specimens to binary clone detection
added syntactic clone detection algorithm