rindPHI / isla

The ISLa (Input Specification Language) language & solver.
https://isla.readthedocs.org
GNU General Public License v3.0
62 stars 8 forks source link

[BUG] Recursion limit exceeded when mutating tar derivation tree #95

Open Kristopher38 opened 9 hours ago

Kristopher38 commented 9 hours ago

Describe the bug Hi, I'm hitting a recursion limit when I try to generate a tar derivation tree and then mutate it.

Traceback (most recent call last):
  File "/home/kris/fuzzing/run.py", line 12, in <module>
    print(solver.mutate(dt))
          ^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 908, in mutate
    mutated = mutator.mutate(inp)
              ^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/mutator.py", line 77, in mutate
    self.__get_mutator()(inp).map(tap(inc_applied_mutations)).value_or(inp)
    ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/mutator.py", line 165, in generalize_subtree
    self.fuzzer.expand_tree(
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 369, in expand_tree
    tree = self.expand_tree_with_strategy(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 335, in expand_tree_with_strategy
    limit is None or self.possible_expansions(tree) < limit
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in possible_expansions
    return sum(self.possible_expansions(c) for c in node.children)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in <genexpr>
    return sum(self.possible_expansions(c) for c in node.children)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  [...]
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in possible_expansions
    return sum(self.possible_expansions(c) for c in node.children)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in <genexpr>
    return sum(self.possible_expansions(c) for c in node.children)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
RecursionError: maximum recursion depth exceeded

To Reproduce Run this minimum reproducible example:

from isla_formalizations.tar import TAR_CONSTRAINTS, TAR_GRAMMAR
from isla.solver import ISLaSolver

solver = ISLaSolver(
    grammar=TAR_GRAMMAR,
    formula=TAR_CONSTRAINTS,
    max_number_free_instantiations=1,
    max_number_smt_instantiations=1
)
dt = solver.solve()
print(dt)
print(solver.mutate(dt))

Expected behavior I should get a mutated derivation tree.

System/Installation Specs:

Kristopher38 commented 8 hours ago

Even if the limit is raised via sys.setrecursionlimit(100000), a different exception is thrown:

Traceback (most recent call last):
  File "/home/kris/fuzzing/run.py", line 15, in <module>
    print(solver.mutate(dt))
          ^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 911, in mutate
    maybe_fixed = self.repair(mutated, fix_timeout_seconds)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 806, in repair
    if self.check(inp) or not is_successful(self.top_constant):
       ^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 735, in check
    result = evaluate(self.formula, inp, self.grammar)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/evaluator.py", line 182, in evaluate
    without_predicates: Formula = replace_formula(
                                  ^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2283, in replace_formula
    replace_formula(child, to_replace, replace_with)
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2283, in replace_formula
    replace_formula(child, to_replace, replace_with)
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2283, in replace_formula
    replace_formula(child, to_replace, replace_with)
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2268, in replace_formula
    result = to_replace(in_formula)
             ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/evaluator.py", line 184, in <lambda>
    lambda f: evaluate_predicates_action(f, reference_tree, graph),
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/evaluator.py", line 249, in evaluate_predicates_action
    assert all(
           ^^^^
AssertionError

Still, it shouldn't be required to raise the recursion depth limit.