Sorting the BasicBlocks on which DisjointRanges works is detrimental for
performance. Using a random order takes less time. This is due to the
fact that the number of BasicBlocks to analyze is significantly smaller
than the whole list of BasicBlocks.
This simple commit reduces the number of times we query the size of the
`BasicBlock` list of a `Function` during the final reodering of blocks
before emission.
This change introduces a 25% speedup when lifting `/bin/bash`.
It is important to let the pass manager go out of scope ASAP:
LazyValueInfo registers a lot of callbacks to get notified when a Value
is destroyed, slowing down OptimizedFunction->eraseFromParent
enormously.
This commit introduces a speedup of approximately 25% when lifting
`/bin/bash`.
The format file has also been renamed to revng-clang-format-style-file.
The check-revng-conventions scripts now always uses the same format
file, unless otherwise specified with the new option
--use-local-clang-format-file.
In this way, the check-revng-conventions uses the same format in all the
projects by default, but if a project needs to customize it (e.g.
cold-revng which follows the Qt style) it can use the new flag to
fallback to using the local .clang-format file.
This commit introduces the PruneRetSuccessors pass, whose role is to
identify all the indirect jumps whose devirtualized destinations
correspond to return addresses. In fact, they are most likely to be
return instructions and devirtualizing them is always detrimental.
After combining two AS objects, removing an ASOContent in the cleanup
phase may lead to a mismatch in the CSVs promoted to function argument,
with some registers actually being used. In most cases, this results in
promoting only one or few alive registers as function argument.
We used to accidentaly call `resetCacheMustHit` on the just popped
element of the set, resulting in an out-of-bounds access within the
container.
This bug has been spotted thanks to AddressSanitizer.
Add an additional opaque store the the `pc` after each function call in
the enforced functions. In this way, when the `pc` will be promoted to
an alloca, we won't have an inconsistent state of the IR (the callee
cannot propagate the correct value of pc, the safety check introduced by
the function isolation will always be false, and llvm will place a
`llvm.assume` which will in turn make the rest of the code dead and
purged by an additional `-simplifycfg`).
This commit drops the `--isolate-no-safety-checks` flags since we
adopted a new approach later on in the decompilation pipeline, i.e.,
dropping calls to `raise_exception_helper` and running dead code
elimination.
FunctionIsolation used to base its work on calls to the marker function
`function_call`, as opposed to information provided by the StackAnalysis
(i.e., `revng.member.type` along with `func.call`).
This also affected EnforceABI, which took care of finishing the work
left over by FunctionIsolation. This was hackish and inelegant.
This commit makes FunctionIsolation work exclusively employing
information from StackAnalysis and purges away code that is no longer
necessary from EnforceABI.
We used to detect callee-saved registers only by checking if their final
value was identical to the initial one. However, the need for a more
precise heuristic emerged: we now also check if at least on of the stack
slots contains that same value.
This commit fixes a subtle bug that was preventing us from correctly
considering the effects of function calls during ABI analysis.
Specifically, when merging information from the call site to the caller,
in case the caller did not provide any information about a certain
slots, we used the `DefaultMap::Default` field, which is the correct
thing to do, except for the fact that, in two methods, the `Default`
field was being updated to early.
This basically had the effect of not considering arguments of function
calls as used, e.g., in URAOF.
When the `--enforce-no-safety-checks` flag is passed during the
enforcing, we avoid emitting the inlined `function_dispatcher` and we
emit instead a call to an `indirect_handle` disposable call created on
the fly to respect the ABI information on the callsite.
Under certain conditions, we ended up having code in the ABI IR which
was not reachable. This was due to the fact that a certain instruction
was initially detected as an indirect call, triggering inclusion in the
function of the fallthrough code, and then as a return, which has no
successors within the function.
This commit simply prunes the ABI IR in the finalization method.
Alessandro Di Federico