lifting-bits / rellic

Rellic produces goto-free C output from LLVM bitcode
Apache License 2.0
529 stars 44 forks source link

Using substitution maps for provenance tracking loses info #221

Open frabert opened 2 years ago

frabert commented 2 years ago

Master branch uses a substitutions map in each pass to keep track of how AST nodes are substituted, but this not fine-grained enough.

As an example, let's say we have a pass which turns if(!cond) { a(); } else { b(); } into if(cond) { b(); } else { a(); }: by substituting the whole IfStmt without tracking the condition, we lose information about it. Adding substitution info about the condition is not always possible due to interaction between substituting a node and one of its children at the same time.

In the decomp-api branch this is addressed by making it so that each pass keeps track of provenance on its own, but it would be nice to find a way to make the substitution map work.

pgoodman commented 2 years ago

At least in this particular case, !cond and cond relating to a br instruction is valid. It's just about different interpretations of the two successors. Are there any guarantees right now on the true target of a br actually being the if branch of the statement?

frabert commented 2 years ago

Right now, br instructions are never the source of provenance of anything. cond would originate from the predicate of a br instruction, not the instruction itself