Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Recursion limit exceeded when mutating tar derivation tree #95

Open
Kristopher38 opened this issue Nov 22, 2024 · 1 comment
Open

Comments

@Kristopher38
Copy link

Kristopher38 commented Nov 22, 2024

Describe the bug
Hi, I'm hitting a recursion limit when I try to generate a tar derivation tree and then mutate it.

Traceback (most recent call last):
  File "/home/kris/fuzzing/run.py", line 12, in <module>
    print(solver.mutate(dt))
          ^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 908, in mutate
    mutated = mutator.mutate(inp)
              ^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/mutator.py", line 77, in mutate
    self.__get_mutator()(inp).map(tap(inc_applied_mutations)).value_or(inp)
    ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/mutator.py", line 165, in generalize_subtree
    self.fuzzer.expand_tree(
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 369, in expand_tree
    tree = self.expand_tree_with_strategy(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 335, in expand_tree_with_strategy
    limit is None or self.possible_expansions(tree) < limit
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in possible_expansions
    return sum(self.possible_expansions(c) for c in node.children)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in <genexpr>
    return sum(self.possible_expansions(c) for c in node.children)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  [...]
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in possible_expansions
    return sum(self.possible_expansions(c) for c in node.children)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/fuzzer.py", line 196, in <genexpr>
    return sum(self.possible_expansions(c) for c in node.children)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
RecursionError: maximum recursion depth exceeded

To Reproduce
Run this minimum reproducible example:

from isla_formalizations.tar import TAR_CONSTRAINTS, TAR_GRAMMAR
from isla.solver import ISLaSolver

solver = ISLaSolver(
    grammar=TAR_GRAMMAR,
    formula=TAR_CONSTRAINTS,
    max_number_free_instantiations=1,
    max_number_smt_instantiations=1
)
dt = solver.solve()
print(dt)
print(solver.mutate(dt))

Expected behavior
I should get a mutated derivation tree.

System/Installation Specs:

  • ISLa Version: latest main (commit 1a04b7833d2960cffe037fb88826111769fefbeb)
  • Python Version: 3.12
  • OS: 5.15.167-1-MANJARO x86_64 GNU/Linux
@Kristopher38
Copy link
Author

Even if the limit is raised via sys.setrecursionlimit(100000), a different exception is thrown:

Traceback (most recent call last):
  File "/home/kris/fuzzing/run.py", line 15, in <module>
    print(solver.mutate(dt))
          ^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 911, in mutate
    maybe_fixed = self.repair(mutated, fix_timeout_seconds)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 806, in repair
    if self.check(inp) or not is_successful(self.top_constant):
       ^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/solver.py", line 735, in check
    result = evaluate(self.formula, inp, self.grammar)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/evaluator.py", line 182, in evaluate
    without_predicates: Formula = replace_formula(
                                  ^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2283, in replace_formula
    replace_formula(child, to_replace, replace_with)
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2283, in replace_formula
    replace_formula(child, to_replace, replace_with)
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2283, in replace_formula
    replace_formula(child, to_replace, replace_with)
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/language.py", line 2268, in replace_formula
    result = to_replace(in_formula)
             ^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/evaluator.py", line 184, in <lambda>
    lambda f: evaluate_predicates_action(f, reference_tree, graph),
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kris/fuzzing/venv/lib/python3.12/site-packages/isla/evaluator.py", line 249, in evaluate_predicates_action
    assert all(
           ^^^^
AssertionError

Still, it shouldn't be required to raise the recursion depth limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant