Skip to content

implementing Interprocedural Dataflow - #8

Open
SchWiniX wants to merge 84 commits into
mainfrom
flo_dev
Open

SchWiniX wants to merge 84 commits into
mainfrom
flo_dev

Conversation

@SchWiniX

Copy link
Copy Markdown
Collaborator

This PR implements the interpersonal dataflow strategy presented in my thesis.
The implementation consists of the following main components:

  • FCallEmbedder/FCallStrategy: Main driver for embedding functions into leaf functions; uses the strategy pattern for ease of use. This can be controlled by the --Xdataflow-strategy flag.
  • Rewrite Engine: Block mutator used to both diversify and introduce the interprocedural dataflow.
  • Pattern Matching: Used by the rewrite engine to match on statements.
  • Rule/Reduce Info: Used to dump rule application information to file and input reduce information (used by RyReduce).
  • VarState: Used during RySmith to dump runtime state of leaf function and in RyLink to read the same information back in.
  • ModAssStmt/ModExpr: New structure in SymIR used to express modular arithmetic polynomials.
  • Bitwise ops: Adds most bitwise operations for SymIR for use in both RySmith and the Rewrite Engine.
  • Stmt/Block Copier: Used by the Rewrite Engine to rewrite the actual SymIR expression.
  • Randfill: used in RySmith to fill unsolved symbolic values, needed since the old approach of filling all regardless of context is problematic for shift operations.

Scripts:

  • New RyReduce: used to reduce the number of rule applications of a given program identified by its seed and sample number.
  • --save-func flag in fuzz.py: Stores the original function set for each buggy whole program found. Needed by RyReduce to rerun whole program generation.

New RyLink flags:

  • -n, --sno: only runs this sample number (i.e., skips all other samples)
  • --Xcoeff-replace-proba: equivalent to the old --Xreplace-proba
  • --Xdataflow-strategy: {0=literal, 1=Prime interpolating, 2=Rewrite} select for different strategies of introducing interprocedural dataflow.
  • --Xinit-replace-proba: Probability of replacing an argument literal with a variable during function embedding.
  • --Xvar-take-proba: Probability of selecting any given variable in an interprocedural dataflow expression.
  • --Xrule-count: Maximal number of rule applications applied by the Rewrite Engine.
  • --Xrule-info: Dump rule info file (used by RyReduce)
  • --Xreduce-mode: Read rule info file (used by RyReduce)

Additionally, this PR introduced 1 new dependency to the Flint library

This accounts for the fact that currently only onpath stmts
are replaced.
Wrong flatting during variable extraction.
This is in case of randomly introduced unsolvability
SchWiniX and others added 29 commits September 17, 2026 01:56
Add two more const creating rules
Names created by the rewritter now are constant regardless of -l / -n
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants