Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Return and parameter types of methods is not entirelly correct. #44

Open
ElektroKill opened this issue Jan 16, 2022 · 1 comment
Open
Labels
bug Something isn't working

Comments

@ElektroKill
Copy link
Contributor

Describe the bug
When a method does not have a physical counterpart, the return type and parameter types are unknown and need to be inferred. In my testing, it looks like the return type of these methods is not inferred at all and is just set to System.Object. This causes many boxing issues to occur when these methods are used.

In this method, we see that the parameter was inferred but the return type is System.Object.
image
If we look at the IL code we see that the return value is boxed as System.UInt32.
image
However, if we look at the usage of this method we see that the return value is unboxed as System.Int32.
image
This leads to an exception at runtime since the types do not match. The return type should be inferred so that hopefully casts can be inferred at later stages of recompilation.
Furthermore, this is a bit more nitpicky but the parameter of __VMFUNCTION__07F2 could also be inferred as System.Byte[] instead of System.Array for greater accuracy.

To Reproduce
Attempt to devirtualize the sample provided in the zip below.
NOTE: there are other methods in this unrelated to the problem.
sample.zip

@ElektroKill ElektroKill added the bug Something isn't working label Jan 16, 2022
@Washi1337
Copy link
Owner

This will require quite some architectural changes probably, as reliable return type inference will most likely require type analysis on an inter-procedure level.

Type inference is done by inspecting all data flow sinks of a value (i.e. where the value is consumed), and inferring some common base type between them. Sinks of a return value are places that are near the original call of the subroutine, which usually resides in another subroutine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants