Bug with uniqueness transformation

[vaibhavbsharma]

There is a bug with the type information table in our regions. Here's the method in ExprUniqueVisitor.java that visits a WalaVarExpr object. On line 8 of this code, you look up the type by the stack slot that this WalaVarExpr object corresponds to. But on line 11, you look up the type by the Wala variable number present in this WalaVarExpr object.

public Expression visit(WalaVarExpr expr){
        String varId = "w" + Integer.toString(expr.number);
        varId = varId.concat(Integer.toString(uniqueNum));

        String type = null;
        if(dynRegion.slotParamTable.lookup(expr.number) != null ) {
            int slot = dynRegion.slotParamTable.lookup(expr.number)[0];
            type = dynRegion.varTypeTable.lookup(slot);
        }
        if (type == null) {
            type = dynRegion.varTypeTable.lookup(expr.number);
        }
        if (type == null) return expr;
        else return createGreenVar(type, varId);
    }

AFAIK varTypeTable maps Wala variable numbers to their types. This bug can cause an incorrect type to be used when constructing the Green variable for a WalaVarExpr. For example, if w2 corresponds to a integer at stack slot 1 but w1 is a float. This can result in operations on variables that are incompatible types, for example, adding an integer to a real. At such time, Green would (probably) throw an exception, causing Java Ranger to crash.