Skip to content

Commit 1420e2a

Browse files
committed
Fix bvxor A^A=0 optimization incorrectly eliminating symbolic expressions
The A^A=0 optimization in bvxor() was using equalTo() to detect when both operands are the same expression. However, equalTo() compares concrete values, hash, size, and level - not AST structure. This caused a bug where two different symbolic expressions that happened to evaluate to the same concrete value (e.g., both evaluating to 0) would be incorrectly identified as equal, causing the optimizer to replace the symbolic XOR with a concrete 0. Example scenario: - op1: symbolic register w8, evaluates to 0 - op2: bvxor(concrete_val, symbolic_result), also evaluates to 0 - bvxor(op1, op2) incorrectly returns concrete 0 instead of preserving the symbolic computation This broke symbolic execution of AArch64 conditional branches where the carry flag (computed via XOR operations in cfSub_s) would lose its symbolic status, causing branches like b.lo to not be recognized as symbolized. The fix adds isSymbolized() checks to ensure the A^A=0 optimization only applies when both operands are concrete. When either operand is symbolic, the full XOR node is preserved to maintain symbolic information flow.
1 parent 8b43626 commit 1420e2a

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

src/libtriton/ast/astContext.cpp

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -732,7 +732,10 @@ namespace triton {
732732
return expr2;
733733

734734
/* Optimization: A ^ A = 0 */
735-
if (expr1->equalTo(expr2))
735+
/* Only apply when both operands are concrete to avoid losing symbolic information.
736+
* Two different symbolic expressions may have the same concrete value temporarily,
737+
* but they represent different symbolic computations that must be preserved. */
738+
if (!expr1->isSymbolized() && !expr2->isSymbolized() && expr1->equalTo(expr2))
736739
return this->bv(0, expr1->getBitvectorSize());
737740
}
738741

0 commit comments

Comments
 (0)