SMAT-Lab / Scalpel

Scalpel: The Python Static Analysis Framework
Apache License 2.0
286 stars 43 forks source link

SSA computes wrong results #117

Closed Lord-Turmoil closed 9 months ago

Lord-Turmoil commented 11 months ago

It seems that the function compute_SSA cannot correctly handle variable that appears in both sides of an assignment statement.

Given the example in your docs SSA & Constant Propagation, I changed the code_str to make this problem more obvious, replacing a = a + 1 to a = a + c + 1 in line 4.

code_str = """
c = 10
a = -1
if c > 0:
    a = a + c + 1
else:
    a = 0
total = c + a
"""

After some typos in your example are fixed, it will output the following result:

These are the results for block 1
[{}, {}, {'c': {0}}]
These are the results for block 2
[{'a': {1}, 'c': {0}}]
These are the results for block 4
[{}]
These are the results for block 3
[{'c': {0}, 'a': {1, 2}}]
('c', 0) <_ast.Constant object at 0x7f32580a7bb0>
('a', 0) <_ast.UnaryOp object at 0x7f325743a4c0>
('a', 1) <_ast.BinOp object at 0x7f3258054b20>
('a', 2) <_ast.Constant object at 0x7f32572c81f0>
('total', 0) <_ast.BinOp object at 0x7f32572c8250>
{1: [{}, {}, {'c': {0}}], 2: [{'a': {1}, 'c': {0}}], 4: [{}], 3: [{'c': {0}, 'a': {1, 2}}]}

We can tell that block 2 represents the SSA for a = a + c + 1. However, we expect that in this line, both a and c should come from (a, 0) and (c, 0) in line 2 and 1. Plus, with the results for block 3, (a, 1) should be the target of assignment, not value.

Therefore, it looks like that the computation of SSA mistakenly mixed-up variables appearing in both sides of the assignment.


So, do you agree, or did I misunderstand how SSA should work?

Jarvx commented 9 months ago

Many thanks for the fix!