Comments (4)
I'll have a look, thanks.
from symcc.
I think it's a problem with vectors:
$ opt -load ./libSymbolize.so -symbolize ~/Downloads/g-alleve.bc -o /dev/null
[...]
Call parameter type does not match function signature!
%21 = icmp slt <16 x i8> %wide.load, zeroinitializer, !dbg !1369
i1 call void @_sym_push_path_constraint(i8* %20, <16 x i1> %21, i64 94669052009640), !dbg !1369
Call parameter type does not match function signature!
%14 = icmp eq <16 x i8> %wide.load, <i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128, i8 -128>, !dbg !1369
i1 call void @_sym_push_path_constraint(i8* %13, <16 x i1> %14, i64 94669052009784), !dbg !1369
in function gnat__altivec__low_level_vectors__ll_vsc_operations__abs_vxiXnn
LLVM ERROR: Broken function found, compilation aborted!
LLVM uses vectors to represent SIMD operations, and it defines most of the bitcode instructions on vectors as well. Unfortunately, we don't currently support them in SymCC; the pass is deliberately located in the middle of the optimization pipeline so that we run before the auto-vectorizer (which converts certain loops to vector operations). I suspect that in your case the frontend already emits vectors, and our inability to handle them properly leads to the problem you're seeing when we try to pass one of the literals to the symbolic backend.
Do you have a way to make your code use a less optimized version of the same function for the time being? I've occasionally seen libraries that use SIMD operations but provide a fallback implementation for processors that lack the required instruction support. Alternatively, one could look into handling vector instructions in SymCC (see also #10). It's probably rather straightforward, but it requires revisiting all the code in Symbolizer.cpp
to handle the case where the input or output of any instruction is a vector.
from symcc.
Hi Sebastian and thank you for your time. I compiled with -O0 and indeed the bug is gone for now. Although, I run it to some more unknown and unhandled instructions with the most common being the:
unhandled LLVM intrinsic llvm.eh.typeid.for
Warning: unknown instruction %50 = fneg float
and less common:
Warning: unhandled LLVM intrinsic llvm.umul.with.overflow
Warning: unhandled LLVM intrinsic llvm.ssub.with.overflow
Warning: unhandled LLVM intrinsic llvm.sadd.with.overflow
Warning: unhandled LLVM intrinsic llvm.smul.with.overflow
Warning: unknown instruction %7 = cmpxchg volatile
Warning: unknown instruction %2 = atomicrmw volatile sub
Warning: unknown instruction %1 = atomicrmw volatile add
are any of these handle concretely or it means that the SE will completely stop when hitting them?
I am completely new to SE but I would like to increase my understanding and start contributing to the enchantment of SymCC if it is possible.
Thank you,
Kyriakos
from symcc.
In general, the results of unhandled instructions and LLVM intrinsics are concretized, the same way that we would handle the results of calls to uninstrumented functions; I've pushed a small change to make this clear in the log messages. There is one caveat though: in all of those cases (i.e., uninstrumented functions, unhandled instructions, and unknown intrinsics), if the code changes memory then SymCC has no way of knowing about it, so the expressions that it stores for the affected memory region may no longer represent the data correctly. As a consequence, the quality of our symbolic reasoning may degrade, but we will always keep executing.
Your contributions would be highly welcome! I'll be happy to give you an overview of the internals, either here or via email.
from symcc.
Related Issues (20)
- Failed to run hybrid fuzzing(AFL+SymCC) in VM. HOT 1
- Failed to Compile with "-DTARGET_32BIT=ON" HOT 1
- Wrong handling of i1 in visitCastInst HOT 2
- visitSelectInst does not propagate the symbolic expression HOT 2
- Store i1 into memory HOT 2
- Change the license of the runtime to LGPL HOT 6
- Support for variadic functions HOT 1
- Failed to build the Vagrantfile
- LLVM compatibility policy HOT 6
- Can't create expressions for concrete non-undef structs HOT 2
- _sym_get_input_byte() in simple backend
- sprintf wrapper
- Crash when concrete non-undef structs contain floats
- afl-showmap generating incorrectly sized map HOT 1
- SymCC may crash if test-case handlers are instrumented
- cannot generate new testcase for a simple case
- program links to libstdc++, not instructmented libc++
- Could not compile libcxx: malloc/malloc.h not found HOT 7
- Fail to compile gpac with clang frontend error HOT 1
- Fuzzing with AFL and Symcc does not work HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from symcc.