A register whose value on return is computed rather than carried in the
return pack: the linked function is this function’s projection for that
one output — a pure function of its inputs, returning what the register
would have held.
C-prototype-derived argmem summary for a prototyped external: the ordered
per-parameter ArgMemKinds (in lockstep with the materialized register
interface inputs, so params[i] describes the i-th positional argument /
Param(i)) and whether the callee is variadic. Read by the RAM effect
channel’s external_leaf to derive a bounded argmem footprint in place of ⊤.
None on the signature for non-externals and un-prototyped externals.
Serde-defaulted, so older .harbinger snapshots load with it absent.
C-prototype-derived call interface for an external (imported, bodyless)
function, planned once by external_sigs and consumed by
argpromote_external, which needs neither the binary nor cabi afterwards.
The precise half of a memory summary. Analysis first computes these sets;
materialization may attach SSA values to the same location keys, but must
never add or remove keys.
A function body: arenas, roster, root, reverse use-def, local names. The
caller-reasoning surface lives separately in FunctionInterface, stored in
Context::interfaces
under the same FunctionId.
A function’s full effect summary, one component per side-effect channel:
the register-lifecycle state and the memory write-space verdict. Serialized
as part of FunctionInterface.
Everything a caller reasons about a function: its name, address, semantic
kind, external-ness, and ABI/analysis signature. This is the caller-reasoning
surface (ruling 1 of the context-split design): it is precisely the data a
function pass may read about another function. Its counterpart is the
function body (arenas, roster, users, local names) — everything only the
function’s own passes touch.
The ordered, machine-readable memory interface of a function whose memory
channel has been materialized: where each by-value memory input parameter is
loaded from, and where each memory write-set output is replayed to.
Per-parameter pointer attributes, LLVM-style, inferred (or read from a C
prototype) and consumed at call sites to relax the default “every pointer
argument aliases everything and is written through by the callee” assumption.
One whole-object location: the entire (extent-unknown) object addressed
by base. Minted only
from an external prototype’s pointer parameters; bodied-function scans never
mint object entries (their footprint is exhaustively classified into
fields/regions). write == true models a read+write (possibly in-out)
access — the object is both potentially read and clobbered.
The solved (transitive) register effect of a function whose interface is
not materialized: the registers a call to it may read / write, callee
effects included. Sorted, deduplicated varnode lists — the persistable form
of the register channel’s solved lattice value.
The ordered, machine-readable register interface of a materialized
function: which register each by-value input parameter binds, and which
register each return-pack slot stores back. Slot i of inputs is the
i-th register param; slot i of outputs is the i-th pack field.
The memory kind of one prototyped-external parameter, as seen by the RAM
argmem model. An external can only touch memory we model through pointers
we pass it (its own libc-internal state lives outside the lifted image), so
each pointer parameter bounds a whole-object effect on the caller’s argument.
Owned tri-state of a function’s coarse written-space verdict, subsuming the
old written_spaces: Option<Vec<SpaceId>> + written_spaces_stamped: bool
pair. The borrowing view WrittenSpaces is derived from this.