Skip to content

Sound variable merge in HLIL results in incorrect decompilation #8440

Description

@ElykDeer

Version and Platform:

  • Binary Ninja Version: 6.0.10501-dev
  • Edition: Ultimate
  • OS: OSX
  • OS Version: 26.5.2
  • CPU Architecture: M3

Bug Description:
Merging two variables used as i in consecutive for loops results in semantically incorrect code when merging in the wrong order. When merging the second variable into the first, it loses that variable's first initialization. There might be another bug here that the initialization is not inside the for loop's initialization slot. Merging the second variable into the first seems to work how I expect it to.

Steps To Reproduce:

  1. Merge i_1 in the second for loop with i from the first
  2. See error

Expected Behavior:
I expect to see the initialization of i to zero before/inside the first for loop regardless of variable merge order (or for this behavior to be documented plus a warning when merging in the incorrect order, and probably not labeling them as sound merges).

Screenshots/Video Recording:
i merged with i_1, correctly clears value to zero before each loop
Image

i_1 merged with i, doesn't initialize i to zero
Image

Binary:
phoenix index traces logarithmically

Metadata

Metadata

Assignees

No one assigned

    Labels

    Component: CoreIssue needs changes to the coreCore: HLILIssue involves High Level ILCore: MLILIssue involves Medium Level ILImpact: LowIssue is a papercut or has a good, supported workaround

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions