angr / claripy

An abstraction layer for constraint solvers.
BSD 2-Clause "Simplified" License
275 stars 90 forks source link

"TypeError: unhashable type: 'set'" exception in _unpack_truisms_Or() #322

Closed anadav closed 1 year ago

anadav commented 1 year ago

Description

An exception "TypeError: unhashable type: 'set'" is generated in _unpack_truisms_Or(). The top of the stack is:

File "/home/namit/myvenv/pypy3-venv/lib/pypy3.8/site-packages/claripy/balancer.py", line 25, in init self._doit() File "/home/namit/myvenv/pypy3-venv/lib/pypy3.8/site-packages/claripy/balancer.py", line 228, in _doit unpacked_truisms = self._unpack_truisms(truism) File "/home/namit/myvenv/pypy3-venv/lib/pypy3.8/site-packages/claripy/balancer.py", line 329, in _unpack_truisms return op(c) File "/home/namit/myvenv/pypy3-venv/lib/pypy3.8/site-packages/claripy/balancer.py", line 347, in _unpack_truisms_Or return { self._unpack_truisms(vals[vals.index(False)]) }

The issue also occurs with cpython.

The exception is caused since _unpack_truisms_Or() returns a set instead of returning the output of _unpack_truisms() directly. IOW, the code is currently:

        elif vals.count(False) == 1:
            return { self._unpack_truisms(vals[vals.index(False)]) }

and a set is already returned, so instead it should be:

        elif vals.count(False) == 1:
            return self._unpack_truisms(vals[vals.index(False)])

Such a change eliminates the exception. However, I think that this is also incorrect, since _unpack_truisms look at vals instead of c.args. IIUC, the code should instead be:

        elif vals.count(False) == 1:
            return self._unpack_truisms(c.args[vals.index(False)])

Steps to reproduce the bug

No response

Environment

No response

Additional context

No response

ltfish commented 1 year ago

Thanks for reporting! I couldn't produce a test case without turning off expression simplification. Do you mind sharing your test case (if there is one)?

anadav commented 1 year ago

I am sorry, but I cannot share (for now) the code that triggered the issue. And I did not make any efforts to create a test-case. I hope my triage would suffice. :)

ltfish commented 1 year ago

It's fixed anyway. Thank you for reporting!