When CALLLESS option is enabled, the engine skips function calls by
converting Ijk_Call successors to simulate an immediate return. Previously
this was done by setting jumpkind to Ijk_Ret, which caused
CFGEmulated._update_function_transition_graph to treat it as a real
cross-function return, invoking _add_return_from instead of _add_fakeret_to.
As a result, em_ret.graph remained correct (since _graph_add_edge is
jumpkind-agnostic), but function.graph was broken: call blocks had no
predecessors or successors, making function.graph inconsistent with
em_ret.graph.
Fix by changing the jumpkind from Ijk_Ret to Ijk_FakeRet in both
heavy.py and engine.py. This matches the true semantic intent of
CALLLESS — "assume the function returns, continue after the call site"
— and causes _update_function_transition_graph to invoke _add_fakeret_to,
correctly building intra-function edges in function.graph.
Affected files:
- angr/engines/vex/heavy/heavy.py
- angr/engines/engine.py
* Preliminary implementation of a spilling CFG graph.
* Fix some test cases.
* Fix another test case.
* Fixes.
* Lint code.
* Implement InEdgeView and OutEdgeView.
* Implement InDegreeView and OutDegreeView.
* Fixes.
* Use (Node.addr, Node.size) as key.
* Fix test cases.
* More fixes.
* Fix CFGENode support.
* Fix the remaining issues.
* Get rid of SpillingCFGGraph.reverse().
* Some refactoring.
* Oops
* Fix perf issue.
* Fix set size change error during key iteration.
* Fix db_batch_size assignment. Fix some test cases.
* SpillingCFGNodeDict.__setstate__: Initialize self._all_keys.
* Getting rid of the nodes dictionary.
* Fix logic in cfg_emulated.py
* Multiple fixes.
* Type annotation fix.
* Fix missing edges after merging CFGNodes.
* Fix more logic.
* Add Soot CFGNodes to the CFG model.
* Lint and type check.
* Add USE_SPILLING_CFGNODE_DICT and CFGNode.dirty.
* Oops
* Lint code.
* No more pickling of CFGNodes.
* Fix no_ret being None.
* Lint code.
* Some refactor; Destroy the fallback mechanism.
* Fix node dirty bug after deserialization.
* zero extend in OpBehaviorIntRight
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Make pypcode required
* [pre-commit.ci] auto fixes from pre-commit.com hooks
for more information, see https://pre-commit.ci
* whoops
* Double whoops
---------
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
* Skip tests if a dependency is missing rather than failing them
* Linter fixes
* Fix typo
* Revert do_trace but raise unittest.SkipTest instead of generic exception
Co-authored-by: Kevin Phoenix <kevin@kphoenix.us>
