jalangi2
jalangi2 copied to clipboard
Reusing iids in src/js/runtime/analysis.js:A
The implementation of A
in src/js/runtime/analysis.js is a bit odd.
It uses the same iids for the calls to G
, B
and P
:
function A(iid, base, offset, op, isComputed) {
var oprnd1 = G(iid, base, offset, isComputed, true, false);
return function (oprnd2) {
var val = B(iid, op, oprnd1, oprnd2, true, false);
return P(iid, base, offset, val, isComputed, true);
};
}
It should use different iids in the style of M
:
function M(iid, base, offset, isConstructor, isComputed) {
return function () {
var f = G(iid + 2, base, offset, isComputed, false, true);
return (lastComputedValue = invokeFun(iid, base, f, arguments, isConstructor, true));
};
}
@esbena is this still a problem?
It has been fixed partly? (see below excerpt from current source)
It is still surprising that the same iid will be used for different callbacks to the analysis. But at least analysis.js documents this now.
// avoid iid collision: make sure that iid+2 has the same source map as iid (@todo)
var oprnd1 = G(iid+2, base, offset, isComputed, true, false);
return function (oprnd2) {
// still possible to get iid collision with a mem operation
var val = B(iid, op, oprnd1, oprnd2, false, true, false);
return P(iid, base, offset, val, isComputed, true);
};