trailofbits / binary_type_inference

GNU General Public License v3.0
11 stars 0 forks source link

Examine implications of not considering the original type when using callsite types for concrete refinement #25

Closed 2over12 closed 2 years ago

2over12 commented 2 years ago

In dca941048016d4ef7f802a50fe21f7c757095567 I removed intersecting/unioning callsite types with the original representation. This decision was made because the sketch union of out parameters would result in a loss of information.

Ie. a type like:

sub_id.in <= sub_id.out
sub_id:callsite_0.out.field_at_0 <= int
sub_id:callsite_1.out.field_at_4 <= float

Would discard the structure because the identity function has no language intersection with the original type. We should more carefully examine the implications of this decision.

2over12 commented 2 years ago

Ah ok one plausible issue is we have overlapping types that get refined by binding parameters and we treat those parameters in isolation then we will lose information from other refinements. Bumping this to med/bug since im observing this in a test