Commit a34d106
committed
Fix AST optimizations incorrectly eliminating symbolic expressions
Three optimizations (A^A=0, A|A=A, A-A=0) were using equalTo() to
detect identical operands. However, equalTo() compares concrete values
rather than AST structure, causing different symbolic expressions with
the same concrete value to be incorrectly identified as equal.
This caused the optimizer to eliminate symbolic information:
- bvxor: A^A=0 replaced symbolic XOR with concrete 0
- bvsub: A-A=0 replaced symbolic SUB with concrete 0
- bvor: A|A=A returned one operand, losing the other's dependency
Example: In AArch64 cfSub_s(), the carry flag computation would lose
symbolic status when symbolic operands evaluated to 0, breaking
conditional branch symbolization (e.g., b.lo not recognized as symbolic).
The fix adds isSymbolized() checks to ensure these optimizations only
apply when both operands are concrete, preserving symbolic information.
Note: bvand already had the correct check; this fix makes bvor, bvsub,
and bvxor consistent with that pattern.1 parent 8b43626 commit a34d106
1 file changed
+10
-3
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
353 | 353 | | |
354 | 354 | | |
355 | 355 | | |
356 | | - | |
| 356 | + | |
| 357 | + | |
| 358 | + | |
357 | 359 | | |
358 | 360 | | |
359 | 361 | | |
| |||
603 | 605 | | |
604 | 606 | | |
605 | 607 | | |
606 | | - | |
| 608 | + | |
| 609 | + | |
| 610 | + | |
607 | 611 | | |
608 | 612 | | |
609 | 613 | | |
| |||
732 | 736 | | |
733 | 737 | | |
734 | 738 | | |
735 | | - | |
| 739 | + | |
| 740 | + | |
| 741 | + | |
| 742 | + | |
736 | 743 | | |
737 | 744 | | |
738 | 745 | | |
| |||
0 commit comments