[Bug]: Dominator-deadcode problem

[Tiko7454]

Describe the issue:

The i++ node has no father though it's not an ENTRY_POINT, so the only dominator of the node i++ is i++ itself. So when slither wants to find dominators for IF_LOOP node, it intersects the dominators of BEGIN_LOOP and i++, and gets nothing. Thus IF_LOOP has no immediate dominator which throws an assertion error

Code example to reproduce the issue:

contract C {
    function f() public {
        for (uint256 i = 1; i < 10; i++) {
            break;  // continue
        }
    }
}

Version:

0.9.3

Relevant log output:

'solc --version' running
'solc a.sol --combined-json abi,ast,bin,bin-runtime,srcmap,srcmap-runtime,userdoc,devdoc,hashes,compact-format --allow-paths . a.sol' running
Compilation warnings/errors on a.sol:
Warning: SPDX license identifier not provided in source file. Before publishing, consider adding a comment containing "SPDX-License-Identifier: <SPDX-License>" to each source file. Use "SPDX-License-Identifier: UNLICENSED" for non-open-source code. Please see https://spdx.org for more information.
--> a.sol

Warning: Source file does not specify required compiler version! Consider adding "pragma solidity ^0.7.5;"
--> a.sol

Warning: Unreachable code.
 --> a.sol:3:37:
  |
3 |         for (uint256 i = 1; i < 10; i++) {
  |                                     ^^^

Warning: Function state mutability can be restricted to pure
 --> a.sol:2:5:
  |
2 |     function f() public {
  |     ^ (Relevant source part starts here and spans across multiple lines).


ERROR:SlitherSolcParsing:
Failed to convert IR to SSA for C contract. Please open an issue https://github.com/crytic/slither/issues.
 
Traceback (most recent call last):
  File "/usr/lib/python3.10/site-packages/slither/__main__.py", line 810, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/usr/lib/python3.10/site-packages/slither/__main__.py", line 101, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/usr/lib/python3.10/site-packages/slither/__main__.py", line 79, in process_single
    slither = Slither(target, ast_format=ast, **vars(args))
  File "/usr/lib/python3.10/site-packages/slither/slither.py", line 135, in __init__
    self._init_parsing_and_analyses(kwargs.get("skip_analyze", False))
  File "/usr/lib/python3.10/site-packages/slither/slither.py", line 155, in _init_parsing_and_analyses
    raise e
  File "/usr/lib/python3.10/site-packages/slither/slither.py", line 151, in _init_parsing_and_analyses
    parser.analyze_contracts()
  File "/usr/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 541, in analyze_contracts
    self._convert_to_slithir()
  File "/usr/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 774, in _convert_to_slithir
    raise e
  File "/usr/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 769, in _convert_to_slithir
    contract.convert_expression_to_slithir_ssa()
  File "/usr/lib/python3.10/site-packages/slither/core/declarations/contract.py", line 1502, in convert_expression_to_slithir_ssa
    func.generate_slithir_ssa(all_ssa_state_variables_instances)
  File "/usr/lib/python3.10/site-packages/slither/core/declarations/function_contract.py", line 134, in generate_slithir_ssa
    compute_dominance_frontier(self.nodes)
  File "/usr/lib/python3.10/site-packages/slither/core/dominators/utils.py", line 98, in compute_dominance_frontier
    assert runner.immediate_dominator
AssertionError
ERROR:root:Error in a.sol
ERROR:root:Traceback (most recent call last):
  File "/usr/lib/python3.10/site-packages/slither/__main__.py", line 810, in main_impl
    ) = process_all(filename, args, detector_classes, printer_classes)
  File "/usr/lib/python3.10/site-packages/slither/__main__.py", line 101, in process_all
    ) = process_single(compilation, args, detector_classes, printer_classes)
  File "/usr/lib/python3.10/site-packages/slither/__main__.py", line 79, in process_single
    slither = Slither(target, ast_format=ast, **vars(args))
  File "/usr/lib/python3.10/site-packages/slither/slither.py", line 135, in __init__
    self._init_parsing_and_analyses(kwargs.get("skip_analyze", False))
  File "/usr/lib/python3.10/site-packages/slither/slither.py", line 155, in _init_parsing_and_analyses
    raise e
  File "/usr/lib/python3.10/site-packages/slither/slither.py", line 151, in _init_parsing_and_analyses
    parser.analyze_contracts()
  File "/usr/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 541, in analyze_contracts
    self._convert_to_slithir()
  File "/usr/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 774, in _convert_to_slithir
    raise e
  File "/usr/lib/python3.10/site-packages/slither/solc_parsing/slither_compilation_unit_solc.py", line 769, in _convert_to_slithir
    contract.convert_expression_to_slithir_ssa()
  File "/usr/lib/python3.10/site-packages/slither/core/declarations/contract.py", line 1502, in convert_expression_to_slithir_ssa
    func.generate_slithir_ssa(all_ssa_state_variables_instances)
  File "/usr/lib/python3.10/site-packages/slither/core/declarations/function_contract.py", line 134, in generate_slithir_ssa
    compute_dominance_frontier(self.nodes)
  File "/usr/lib/python3.10/site-packages/slither/core/dominators/utils.py", line 98, in compute_dominance_frontier
    assert runner.immediate_dominator
AssertionError

[0xalpharush]

@Tiko7454 Thanks for reporting this and providing an example! It's really helpful

[0xalpharush]

This was introduced here 371e3cb#diff-da17d02003c2bcfd4974cafb281c5b587b72398a8de28f65a8963cfa5f029970R98

[Tiko7454]

I think we can have an attribute is_reachable for every node, which shows whether there is a path from ENTRY_POINT to that node. The attribute can be set with a DFS from the ENTRY_POINT. Then when we are getting the dominators of a node, we can intersect the dominators of the father nodes which are reachable only

[Tiko7454]

Also #1982 doesn't fully solve the problem because IF_LOOP node doesn't have any dominator except itself though BEGIN_LOOP is a dominator (IF_LOOP is not reachable from i++ node so by the definition BEGIN_LOOP is a dominator)

[thiagodeev]

Hi guys, what about that? I'm facing the same error

[0xalpharush]

Closed by #1984

[bestengineer1112]

Hello @0xalpharush How are you today?
I am getting this issue again
How can i fix it?