Fix a taint propagation bug in compute_dependent_locals
#1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When re-running the standard library benchmark from Scrutinizer, I noticed that certain calls in leakage-free functions, e.g.,
test_crate::collections::hashmap::get_key_value, are skipped, while they shouldn't have been.This issue comes from the fact that
compute_dependent_localsonly deems the destination local in the terminator important. It assumes that all arguments have previously been marked important if they are indeed so. However, this is not always the case, so the taint was not propagated to some arguments.This fix conservatively marks all arguments as important. Even if coarse-grained, it doesn't seem like the specificity on the benchmark has been affected much. Ideally, one would want to implement per-argument tracking, which is what PEAR-based Scrutinizer does.