The previous conversion from LLVM to MLIR was translating plain LLVM IR
to LLVM MLIR Dialect, as a preliminary step for further conversion from
LLVM MLIR Dialect to Clift.
This is not how things are expected to work anymore, so the old code is
now dead and can be removed.
The tests was testing if a function whose entry address is the target of
load was identified as a function or not (it shouldn't).
This test was passing accidentally. This has not been supported since
the introduction of `RootAnalyzer`. In order to support this again, we
need to resurrect `processLoadsAndStores`.
This commit ensures that parts of the model that must point to code
(specifically `Binary::EntryPoint`, `Binary::ExtraCodeAddresses` and
`Function::Entry`) actually point to a segment mapped as +x.
`module.ll` is now a zstd-compressed bitcode file. Change the tests
where it relied on the module being LLVM IR by decompressing and
disassembling the input on the fly.
The DLAStep SimplifyInstanceAtOffset0 now only triggers if the parent
node has the child-at-offset-0 node as its only successor, or when the
child-at-offset-0 doesn't have other predecessors.
Doing this guarantees that it's impossible for another predecessor of
the child-at-offset-0 to start seeing memory accesses that were
initially relative to the parent.
This condition is slightly more restrictive than the previous one, but
it takes into consideration some far reaching consequences.
If SimplifyInstanceAtOffset0 aggressively like we did before, DLA can
end up inferring types in some memory locations, like executable
segments, for which there aren't clues in the binary.
This isn't bad per se, but if DLA does that, the newly recovered type is
identified as non-executable data, causing misdecompilation because
rev.ng doesn't decompile memory regions that it understands as non
executable.
This commit, making SimplifyInstanceAtOffset0 less aggressive, makes it
play better with the rest of the assumptions of the decompilation
pipeline.
It also relaxes a decompilation test that was previously working by
chance and that was effectively beyond the current expressive power of
reasoning for DLA at the moment.
End-to-end tests were disabled due to a bug in ModelToHeader that caused
the decompiled C header with the types not to be recompilable in some
cases.
However, the commit that disabled the tests was too aggressive, because
the only part that needed to be disabled was the part of the tests that
actually recompiled the C code.
This commit re-enables the end-to-end tests except for the recompilation
part, that will be re-enabled after the bug in ModelToHeader is fixed.
This is due to the fact that type inlining currently is broken in some
corner cases involving recursive types.
The bugs are caused by the fact that TypeInlineHelper uses its own
custom graph instead of using the DependencyGraph used by ModelToHeader,
causing different decisions about the order of emission of types.
As a result, the generated C types are not valid C, and they fail to
compile because a field of a struct has a type that is defined later
than its use.
After refactoring TypeInlineHelper to use DependencyGraph like
ModelToHeader, this can be reverted.
Before this commit, the test was implicitly relying on control-flow
recovery and on the specific order of the then/else scopes in an
if-statement.
This commit relaxes that requirement, since it's not part of what the
test is designed to test.
Giacomo Vercesi