slither/tests/unit/slithir/test_ssa_generation.py

# pylint: disable=too-many-lines
import os
import pathlib
from argparse import ArgumentTypeError
from collections import defaultdict
from contextlib import contextmanager
from inspect import getsourcefile
from tempfile import NamedTemporaryFile
from typing import Union, List, Optional, Dict, Callable

import pytest
from solc_select import solc_select
from solc_select.solc_select import valid_version as solc_valid_version

from slither import Slither
from slither.core.cfg.node import Node, NodeType
from slither.core.declarations import Function, Contract
from slither.core.variables.local_variable import LocalVariable
from slither.core.variables.state_variable import StateVariable
from slither.slithir.operations import (
    OperationWithLValue,
    Phi,
    Assignment,
    HighLevelCall,
    Return,
    Operation,
    Binary,
    BinaryType,
    InternalCall,
    Index,
    InitArray,
)
from slither.slithir.utils.ssa import is_used_later
from slither.slithir.variables import (
    Constant,
    ReferenceVariable,
    LocalIRVariable,
    StateIRVariable,
    TemporaryVariableSSA,
)

# Directory of currently executing script. Will be used as basis for temporary file names.
SCRIPT_DIR = pathlib.Path(getsourcefile(lambda: 0)).parent  # type:ignore


def valid_version(ver: str) -> bool:
    """Wrapper function to check if the solc-version is valid

    The solc_select function raises and exception but for checks below,
    only a bool is needed.
    """
    try:
        solc_valid_version(ver)
        return True
    except ArgumentTypeError:
        return False


def have_ssa_if_ir(function: Function) -> None:
    """Verifies that all nodes in a function that have IR also have SSA IR"""
    for n in function.nodes:
        if n.irs:
            assert n.irs_ssa


# pylint: disable=too-many-branches, too-many-locals
def ssa_basic_properties(function: Function) -> None:
    """Verifies that basic properties of ssa holds

    1. Every name is defined only once
    2. A l-value is never index zero - there is always a zero-value available for each var
    3. Every r-value is at least defined at some point
    4. The number of ssa defs is >= the number of assignments to var
    5. Function parameters SSA are stored in function.parameters_ssa
       - if function parameter is_storage it refers to a fake variable
    6. Function returns SSA are stored in function.returns_ssa
        - if function return is_storage it refers to a fake variable
    """
    ssa_lvalues = set()
    ssa_rvalues = set()
    lvalue_assignments: Dict[str, int] = {}

    for n in function.nodes:
        for ir in n.irs:
            if isinstance(ir, OperationWithLValue) and ir.lvalue:
                name = ir.lvalue.name
                if name is None:
                    continue
                if name in lvalue_assignments:
                    lvalue_assignments[name] += 1
                else:
                    lvalue_assignments[name] = 1

        for ssa in n.irs_ssa:
            if isinstance(ssa, OperationWithLValue):
                # 1
                assert ssa.lvalue not in ssa_lvalues
                ssa_lvalues.add(ssa.lvalue)

                # 2 (if Local/State Var)
                ssa_lvalue = ssa.lvalue
                if isinstance(ssa_lvalue, (StateIRVariable, LocalIRVariable)):
                    assert ssa_lvalue.index > 0

            for rvalue in filter(
                lambda x: not isinstance(x, (StateIRVariable, Constant)), ssa.read
            ):
                ssa_rvalues.add(rvalue)

    # 3
    # Each var can have one non-defined value, the value initially held. Typically,
    # var_0, i_0, state_0 or similar.
    undef_vars = set()
    for rvalue in ssa_rvalues:
        if rvalue not in ssa_lvalues:
            assert rvalue.non_ssa_version not in undef_vars
            undef_vars.add(rvalue.non_ssa_version)

    # 4
    ssa_defs: Dict[str, int] = defaultdict(int)
    for v in ssa_lvalues:
        if v and v.name:
            ssa_defs[v.name] += 1

    for (k, count) in lvalue_assignments.items():
        assert ssa_defs[k] >= count

    # Helper 5/6
    def check_property_5_and_6(
        variables: List[LocalVariable], ssavars: List[LocalIRVariable]
    ) -> None:
        for var in filter(lambda x: x.name, variables):
            ssa_vars = [x for x in ssavars if x.non_ssa_version == var]
            assert len(ssa_vars) == 1
            ssa_var = ssa_vars[0]
            assert var.is_storage == ssa_var.is_storage
            if ssa_var.is_storage:
                assert len(ssa_var.refers_to) == 1
                assert ssa_var.refers_to[0].location == "reference_to_storage"

    # 5
    check_property_5_and_6(function.parameters, function.parameters_ssa)

    # 6
    check_property_5_and_6(function.returns, function.returns_ssa)


def ssa_phi_node_properties(f: Function) -> None:
    """Every phi-function should have as many args as predecessors

    This does not apply if the phi-node refers to state variables,
    they make use os special phi-nodes for tracking potential values
    a state variable can have
    """
    for node in f.nodes:
        for ssa in node.irs_ssa:
            if isinstance(ssa, Phi):
                n = len(ssa.read)
                if not isinstance(ssa.lvalue, StateIRVariable):
                    assert len(node.fathers) == n


# TODO (hbrodin): This should probably go into another file, not specific to SSA
def dominance_properties(f: Function) -> None:
    """Verifies properties related to dominators holds

    1. Every node have an immediate dominator except entry_node which have none
    2. From every node immediate dominator there is a path via its successors to the node
    """

    def find_path(from_node: Node, to: Node) -> bool:
        visited = set()
        worklist = list(from_node.sons)
        while worklist:
            first, *worklist = worklist
            if first == to:
                return True
            visited.add(first)
            for successor in first.sons:
                if successor not in visited:
                    worklist.append(successor)
        return False

    for node in f.nodes:
        if node is f.entry_point:
            assert node.immediate_dominator is None
        else:
            assert node.immediate_dominator is not None
            assert find_path(node.immediate_dominator, node)


def phi_values_inserted(f: Function) -> None:
    """Verifies that phi-values are inserted at the right places

    For every node that has a dominance frontier, any def (including
    phi) should be a phi function in its dominance frontier
    """

    def have_phi_for_var(
        node: Node, var: Union[StateIRVariable, LocalIRVariable, TemporaryVariableSSA]
    ) -> bool:
        """Checks if a node has a phi-instruction for var

        The ssa version would ideally be checked, but then
        more data flow analysis would be needed, for cases
        where a new def for var is introduced before reaching
        DF
        """
        non_ssa = var.non_ssa_version
        for ssa in node.irs_ssa:
            if isinstance(ssa, Phi):
                if non_ssa in map(
                    lambda ssa_var: ssa_var.non_ssa_version,
                    [
                        r
                        for r in ssa.read
                        if isinstance(r, (StateIRVariable, LocalIRVariable, TemporaryVariableSSA))
                    ],
                ):
                    return True
        return False

    for node in filter(lambda n: n.dominance_frontier, f.nodes):
        for df in node.dominance_frontier:
            for ssa in node.irs_ssa:
                if isinstance(ssa, OperationWithLValue):
                    ssa_lvalue = ssa.lvalue
                    if isinstance(
                        ssa_lvalue, (StateIRVariable, LocalIRVariable, TemporaryVariableSSA)
                    ) and is_used_later(node, ssa_lvalue):
                        assert have_phi_for_var(df, ssa_lvalue)


@contextmanager
def select_solc_version(version: Optional[str]) -> None:
    """Selects solc version to use for running tests.

    If no version is provided, latest is used."""
    # If no solc_version selected just use the latest avail
    if not version:
        # This sorts the versions numerically
        vers = sorted(
            map(
                lambda x: (int(x[0]), int(x[1]), int(x[2])),
                map(lambda x: x.split(".", 3), solc_select.installed_versions()),
            )
        )
        ver = list(vers)[-1]
        version = ".".join(map(str, ver))
    env = dict(os.environ)
    env_restore = dict(env)
    env["SOLC_VERSION"] = version
    os.environ.clear()
    os.environ.update(env)

    yield version

    os.environ.clear()
    os.environ.update(env_restore)


@contextmanager
def slither_from_source(source_code: str, solc_version: Optional[str] = None):
    """Yields a Slither instance using source_code string and solc_version

    Creates a temporary file and changes the solc-version temporary to solc_version.
    """

    fname = ""
    try:
        with NamedTemporaryFile(dir=SCRIPT_DIR, mode="w", suffix=".sol", delete=False) as f:
            fname = f.name
            f.write(source_code)
        with select_solc_version(solc_version):
            yield Slither(fname)
    finally:
        pathlib.Path(fname).unlink()


def verify_properties_hold(source_code_or_slither: Union[str, Slither]) -> None:
    """Ensures that basic properties of SSA hold true"""

    def verify_func(func: Function) -> None:
        have_ssa_if_ir(func)
        phi_values_inserted(func)
        ssa_basic_properties(func)
        ssa_phi_node_properties(func)
        dominance_properties(func)

    def verify(slither: Slither) -> None:
        for cu in slither.compilation_units:
            for func in cu.functions_and_modifiers:
                _dump_function(func)
                verify_func(func)
            for contract in cu.contracts:
                for f in contract.functions:
                    if f.is_constructor or f.is_constructor_variables:
                        _dump_function(f)
                        verify_func(f)

    if isinstance(source_code_or_slither, Slither):
        verify(source_code_or_slither)
    else:
        slither: Slither
        with slither_from_source(source_code_or_slither) as slither:
            verify(slither)


def _dump_function(f: Function) -> None:
    """Helper function to print nodes/ssa ir for a function or modifier"""
    print(f"---- {f.name} ----")
    for n in f.nodes:
        print(n)
        for ir in n.irs_ssa:
            print(f"\t{ir}")
    print("")


def _dump_functions(c: Contract) -> None:
    """Helper function to print functions and modifiers of a contract"""
    for f in c.functions_and_modifiers:
        _dump_function(f)


def get_filtered_ssa(f: Union[Function, Node], flt: Callable) -> List[Operation]:
    """Returns a list of all ssanodes filtered by filter for all nodes in function f"""
    if isinstance(f, Function):
        return [ssanode for node in f.nodes for ssanode in node.irs_ssa if flt(ssanode)]

    assert isinstance(f, Node)
    return [ssanode for ssanode in f.irs_ssa if flt(ssanode)]


def get_ssa_of_type(f: Union[Function, Node], ssatype) -> List[Operation]:
    """Returns a list of all ssanodes of a specific type for all nodes in function f"""
    return get_filtered_ssa(f, lambda ssanode: isinstance(ssanode, ssatype))


def test_multi_write() -> None:
    contract = """
    pragma solidity ^0.8.11;
    contract Test {
    function multi_write(uint val) external pure returns(uint) {
        val = 1;
        val = 2;
        val = 3;
    }
    }"""
    verify_properties_hold(contract)


def test_single_branch_phi() -> None:
    contract = """
        pragma solidity ^0.8.11;
        contract Test {
        function single_branch_phi(uint val) external pure returns(uint) {
            if (val == 3) {
                val = 9;
            }
            return val;
        }
        }
        """
    verify_properties_hold(contract)


def test_basic_phi() -> None:
    contract = """
    pragma solidity ^0.8.11;
    contract Test {
    function basic_phi(uint val) external pure returns(uint) {
        if (val == 3) {
            val = 9;
        } else {
            val = 1;
        }
        return val;
    }
    }
    """
    verify_properties_hold(contract)


def test_basic_loop_phi() -> None:
    contract = """
    pragma solidity ^0.8.11;
    contract Test {
    function basic_loop_phi(uint val) external pure returns(uint) {
        for (uint i=0;i<128;i++) {
            val = val + 1;
        }
        return val;
    }
    }
    """
    verify_properties_hold(contract)


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_phi_propagation_loop():
    contract = """
     pragma solidity ^0.8.11;
     contract Test {
     function looping(uint v) external pure returns(uint) {
        uint val = 0;
        for (uint i=0;i<v;i++) {
            if (val > i) {
                val = i;
            } else {
                val = 3;
            }
        }
        return val;
    }
    }
    """
    verify_properties_hold(contract)


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_free_function_properties():
    contract = """
        pragma solidity ^0.8.11;

        function free_looping(uint v) returns(uint) {
           uint val = 0;
           for (uint i=0;i<v;i++) {
               if (val > i) {
                   val = i;
               } else {
                   val = 3;
               }
           }
           return val;
       }

       contract Test {}
       """
    verify_properties_hold(contract)


def test_ssa_inter_transactional() -> None:
    source = """
    pragma solidity ^0.8.11;
    contract A {
        uint my_var_A;
        uint my_var_B;

        function direct_set(uint i) public {
            my_var_A = i;
        }

        function direct_set_plus_one(uint i) public {
            my_var_A = i + 1;
        }

        function indirect_set() public {
            my_var_B = my_var_A;
        }
    }
    """
    with slither_from_source(source) as slither:
        c = slither.contracts[0]
        variables = c.variables_as_dict
        funcs = c.available_functions_as_dict()
        direct_set = funcs["direct_set(uint256)"]
        # Skip entry point and go straight to assignment ir
        assign1 = direct_set.nodes[1].irs_ssa[0]
        assert isinstance(assign1, Assignment)

        assign2 = direct_set.nodes[1].irs_ssa[0]
        assert isinstance(assign2, Assignment)

        indirect_set = funcs["indirect_set()"]
        phi = indirect_set.entry_point.irs_ssa[0]
        assert isinstance(phi, Phi)
        # phi rvalues come from 1, initial value of my_var_a and 2, assignment in direct_set
        assert len(phi.rvalues) == 3
        assert all(x.non_ssa_version == variables["my_var_A"] for x in phi.rvalues)
        assert assign1.lvalue in phi.rvalues
        assert assign2.lvalue in phi.rvalues


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_ssa_phi_callbacks():
    source = """
    pragma solidity ^0.8.11;
    contract A {
        uint my_var_A;
        uint my_var_B;

        function direct_set(uint i) public {
            my_var_A = i;
        }

        function use_a() public {
            // Expect a phi-node here
            my_var_B = my_var_A;
            B b = new B();
            my_var_A = 3;
            b.do_stuff();
            // Expect a phi-node here
            my_var_B = my_var_A;
        }
    }

    contract B {
        function do_stuff() public returns (uint) {
            // This could be calling back into A
        }
    }
    """
    with slither_from_source(source) as slither:
        c = slither.get_contract_from_name("A")[0]
        _dump_functions(c)
        f = [x for x in c.functions if x.name == "use_a"][0]
        var_a = [x for x in c.variables if x.name == "my_var_A"][0]

        entry_phi = [
            x
            for x in f.entry_point.irs_ssa
            if isinstance(x, Phi) and x.lvalue.non_ssa_version == var_a
        ][0]
        # The four potential sources are:
        # 1. initial value
        # 2. my_var_A = i;
        # 3. my_var_A = 3;
        # 4. phi-value after call to b.do_stuff(), which could be reentrant.
        assert len(entry_phi.rvalues) == 4

        # Locate the first high-level call (should be b.do_stuff())
        call_node = [x for y in f.nodes for x in y.irs_ssa if isinstance(x, HighLevelCall)][0]
        n = call_node.node
        # Get phi-node after call
        after_call_phi = n.irs_ssa[n.irs_ssa.index(call_node) + 1]
        # The two sources for this phi node is
        # 1. my_var_A = i;
        # 2. my_var_A = 3;
        assert isinstance(after_call_phi, Phi)
        assert len(after_call_phi.rvalues) == 2


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_storage_refers_to():
    """Test the storage aspects of the SSA IR

    When declaring a var as being storage, start tracking what storage it refers_to.
    When a phi-node is created, ensure refers_to is propagated to the phi-node.
    Assignments also propagate refers_to.
    Whenever a ReferenceVariable is the destination of an assignment (e.g. s.v = 10)
    below, create additional versions of the variables it refers to record that a a
    write was made. In the current implementation, this is referenced by phis.
    """
    source = """
   contract A{

    struct St{
        int v;
    }

    St state0;
    St state1;

    function f() public{
        St storage s = state0;
        if(true){
            s = state1;
        }
        s.v = 10;
    }
}
    """
    with slither_from_source(source) as slither:
        c = slither.contracts[0]
        f = c.functions[0]

        phinodes = get_ssa_of_type(f, Phi)
        # Expect 2 in entrypoint (state0/state1 initial values), 1 at 'ENDIF' and two related to the
        # ReferenceVariable write s.v = 10.
        assert len(phinodes) == 5

        # Assign s to state0, s to state1, s.v to 10
        assigns = get_ssa_of_type(f, Assignment)
        assert len(assigns) == 3

        # The IR variables have is_storage
        assert all(x.lvalue.is_storage for x in assigns if isinstance(x, LocalIRVariable))

        # s.v ReferenceVariable points to one of the phi vars...
        ref0 = [x.lvalue for x in assigns if isinstance(x.lvalue, ReferenceVariable)][0]
        sphis = [x for x in phinodes if x.lvalue == ref0.points_to]
        assert len(sphis) == 1
        sphi = sphis[0]

        # ...and that phi refers to the two entry phi-values
        entryphi = [x for x in phinodes if x.lvalue in sphi.lvalue.refers_to]
        assert len(entryphi) == 2

        # The remaining two phis are the ones recording that write through ReferenceVariable occured
        for ephi in entryphi:
            phinodes.remove(ephi)
        phinodes.remove(sphi)
        assert len(phinodes) == 2

        # And they are recorded in one of the entry phis
        assert phinodes[0].lvalue in entryphi[0].rvalues or entryphi[1].rvalues
        assert phinodes[1].lvalue in entryphi[0].rvalues or entryphi[1].rvalues


@pytest.mark.skipif(
    not valid_version("0.4.0"), reason="Solidity version 0.4.0 not available on this platform"
)
def test_initial_version_exists_for_locals():
    """
    In solidity you can write statements such as
    uint a = a + 1, this test ensures that can be handled for local variables.
    """
    src = """
    contract C {
        function func() internal {
            uint a = a + 1;
        }
    }
    """
    with slither_from_source(src, "0.4.0") as slither:
        verify_properties_hold(slither)
        c = slither.contracts[0]
        f = c.functions[0]

        addition = get_ssa_of_type(f, Binary)[0]
        assert addition.type == BinaryType.ADDITION
        assert isinstance(addition.variable_right, Constant)
        a_0 = addition.variable_left
        assert a_0.index == 0
        assert a_0.name == "a"

        assignment = get_ssa_of_type(f, Assignment)[0]
        a_1 = assignment.lvalue
        assert a_1.index == 1
        assert a_1.name == "a"
        assert assignment.rvalue == addition.lvalue

        assert a_0.non_ssa_version == a_1.non_ssa_version


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
@pytest.mark.skipif(
    not valid_version("0.4.0"), reason="Solidity version 0.4.0 not available on this platform"
)
def test_initial_version_exists_for_state_variables():
    """
    In solidity you can write statements such as
    uint a = a + 1, this test ensures that can be handled for state variables.
    """
    src = """
    contract C {
        uint a = a + 1;
    }
    """
    with slither_from_source(src, "0.4.0") as slither:
        verify_properties_hold(slither)
        c = slither.contracts[0]
        f = c.functions[0]  # There will be one artificial ctor function for the state vars

        addition = get_ssa_of_type(f, Binary)[0]
        assert addition.type == BinaryType.ADDITION
        assert isinstance(addition.variable_right, Constant)
        a_0 = addition.variable_left
        assert isinstance(a_0, StateIRVariable)
        assert a_0.name == "a"

        assignment = get_ssa_of_type(f, Assignment)[0]
        a_1 = assignment.lvalue
        assert isinstance(a_1, StateIRVariable)
        assert a_1.index == a_0.index + 1
        assert a_1.name == "a"
        assert assignment.rvalue == addition.lvalue

        assert a_0.non_ssa_version == a_1.non_ssa_version
        assert isinstance(a_0.non_ssa_version, StateVariable)

        # No conditional/other function interaction so no phis
        assert len(get_ssa_of_type(f, Phi)) == 0


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_initial_version_exists_for_state_variables_function_assign():
    """
    In solidity you can write statements such as
    uint a = a + 1, this test ensures that can be handled for local variables.
    """
    # TODO (hbrodin): Could be a detector that a is not used in f
    src = """
    contract C {
        uint a = f();

        function f() internal returns(uint) {
            return a;
        }
    }
    """
    with slither_from_source(src) as slither:
        verify_properties_hold(slither)
        c = slither.contracts[0]
        f, ctor = c.functions
        if f.is_constructor_variables:
            f, ctor = ctor, f

        # ctor should have a single call to f that assigns to a
        # temporary variable, that is then assigned to a

        call = get_ssa_of_type(ctor, InternalCall)[0]
        assert call.node.function == f
        assign = get_ssa_of_type(ctor, Assignment)[0]
        assert assign.rvalue == call.lvalue
        assert isinstance(assign.lvalue, StateIRVariable)
        assert assign.lvalue.name == "a"

        # f should have a phi node on entry of a0, a1 and should return
        # a2
        phi = get_ssa_of_type(f, Phi)[0]
        assert len(phi.rvalues) == 2
        assert assign.lvalue in phi.rvalues


@pytest.mark.skipif(
    not valid_version("0.4.0"), reason="Solidity version 0.4.0 not available on this platform"
)
def test_return_local_before_assign():
    src = """
    // this require solidity < 0.5
    // a variable can be returned before declared. Ensure it can be
    // handled by Slither.
    contract A {
    function local(bool my_bool) internal returns(uint){
        if(my_bool){
            return a_local;
        }

        uint a_local = 10;
    }
    }
    """
    with slither_from_source(src, "0.4.0") as slither:
        f = slither.contracts[0].functions[0]

        ret = get_ssa_of_type(f, Return)[0]
        assert len(ret.values) == 1
        assert ret.values[0].index == 0

        assign = get_ssa_of_type(f, Assignment)[0]
        assert assign.lvalue.index == 1
        assert assign.lvalue.non_ssa_version == ret.values[0].non_ssa_version


@pytest.mark.skipif(
    not valid_version("0.5.0"), reason="Solidity version 0.5.0 not available on this platform"
)
def test_shadow_local():
    src = """
    contract A {
     // this require solidity 0.5
    function shadowing_local() internal{
        uint local = 0;
        {
            uint local = 1;
            {
                uint local = 2;
            }
        }
    }
    }
    """
    with slither_from_source(src, "0.5.0") as slither:
        _dump_functions(slither.contracts[0])
        f = slither.contracts[0].functions[0]

        # Ensure all assignments are to a variable of index 1
        # not using the same IR var.
        assert all(map(lambda x: x.lvalue.index == 1, get_ssa_of_type(f, Assignment)))


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_multiple_named_args_returns():
    """Verifies that named arguments and return values have correct versions

    Each arg/ret have an initial version, version 0, and is written once and should
    then have version 1.
    """
    src = """
    contract A {
        function multi(uint arg1, uint arg2) internal returns (uint ret1, uint ret2) {
            arg1 = arg1 + 1;
            arg2 = arg2 + 2;
            ret1 = arg1 + 3;
            ret2 = arg2 + 4;
        }
    }"""
    with slither_from_source(src) as slither:
        verify_properties_hold(slither)
        f = slither.contracts[0].functions[0]

        # Ensure all LocalIRVariables (not TemporaryVariables) have index 1
        assert all(
            map(
                lambda x: x.lvalue.index == 1 or not isinstance(x.lvalue, LocalIRVariable),
                get_ssa_of_type(f, OperationWithLValue),
            )
        )


@pytest.mark.xfail(reason="Tests for wanted state of SSA IR, not current.", strict=True)
def test_memory_array():
    src = """
    contract MemArray {
        struct A {
            uint val1;
            uint val2;
        }

        function test_array() internal {
            A[] memory a= new A[](4);
            // Create REF_0 -> a_1[2]
            accept_array_entry(a[2]);

            // Create REF_1 -> a_1[3]
            accept_array_entry(a[3]);

            A memory alocal;
            accept_array_entry(alocal);

        }

        // val_1 = ϕ(val_0, REF_0, REF_1, alocal_1)
        // val_0 is an unknown external value
        function accept_array_entry(A memory val) public returns (uint) {
            uint zero = 0;
            b(zero);
            // Create REF_2 -> val_1.val1
            return b(val.val1);
        }

        function b(uint arg) public returns (uint){
            // arg_1 = ϕ(arg_0, zero_1, REF_2)
            return arg + 1;
        }
    }"""
    with slither_from_source(src) as slither:
        c = slither.contracts[0]

        ftest_array, faccept, fb = c.functions

        # Locate REF_0/REF_1/alocal (they are all args to the call)
        accept_args = [x.arguments[0] for x in get_ssa_of_type(ftest_array, InternalCall)]

        # Check entrypoint of accept_array_entry, it should contain a phi-node
        # of expected rvalues
        [phi_entry_accept] = get_ssa_of_type(faccept.entry_point, Phi)
        for arg in accept_args:
            assert arg in phi_entry_accept.rvalues
        # NOTE(hbrodin): There should be an additional val_0 in the phi-node.
        # That additional val_0 indicates an external caller of this function.
        assert len(phi_entry_accept.rvalues) == len(accept_args) + 1

        # Args used to invoke b
        b_args = [x.arguments[0] for x in get_ssa_of_type(faccept, InternalCall)]

        # Check entrypoint of B, it should contain a phi-node of expected
        # rvalues
        [phi_entry_b] = get_ssa_of_type(fb.entry_point, Phi)
        for arg in b_args:
            assert arg in phi_entry_b.rvalues

        # NOTE(hbrodin): There should be an additional arg_0 (see comment about phi_entry_accept).
        assert len(phi_entry_b.rvalues) == len(b_args) + 1


@pytest.mark.xfail(reason="Tests for wanted state of SSA IR, not current.", strict=True)
def test_storage_array():
    src = """
    contract StorageArray {
        struct A {
            uint val1;
            uint val2;
        }

        // NOTE(hbrodin): a is never written, should only become a_0. Same for astorage (astorage_0). Phi-nodes at entry
        // should only add new versions of a state variable if it is actually written.
        A[] a;
        A astorage;

        function test_array() internal {
            accept_array_entry(a[2]);
            accept_array_entry(a[3]);
            accept_array_entry(astorage);
        }

        function accept_array_entry(A storage val) internal returns (uint) {
            // val is either a[2], a[3] or astorage_0. Ideally this could be identified.
            uint five = 5;

            // NOTE(hbrodin): If the following line is enabled, there would ideally be a phi-node representing writes
            // to either a or astorage.
            //val.val2 = 4;
            b(five);
            return b(val.val1);
        }

        function b(uint value) public returns (uint){
            // Expect a phi-node at the entrypoint
            // value_1 = ϕ(value_0, five_0, REF_x), where REF_x is the reference to val.val1 in accept_array_entry.
            return value + 1;
        }
    }"""
    with slither_from_source(src) as slither:
        c = slither.contracts[0]
        _dump_functions(c)
        ftest, faccept, fb = c.functions

        # None of a/astorage is written so expect that there are no phi-nodes at entrypoint.
        assert len(get_ssa_of_type(ftest.entry_point, Phi)) == 0

        # Expect all references to start from index 0 (no writes)
        assert all(x.variable_left.index == 0 for x in get_ssa_of_type(ftest, Index))

        [phi_entry_accept] = get_ssa_of_type(faccept.entry_point, Phi)
        assert len(phi_entry_accept.rvalues) == 3  # See comment in b above

        [phi_entry_b] = get_ssa_of_type(fb.entry_point, Phi)
        assert len(phi_entry_b.rvalues) == 3  # See comment in b above


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_issue_468():
    """
    Ensure issue 468 is corrected as per
    https://github.com/crytic/slither/issues/468#issuecomment-620974151
    The one difference is that we allow the phi-function at entry of f to
    hold exit state which contains init state and state from branch, which
    is a bit redundant. This could be further simplified.
    """
    source = """
    contract State {
    int state = 0;
    function f(int a) public returns (int) {
        // phi-node here for state
        if (a < 1) {
            state += 1;
        }
        // phi-node here for state
        return state;
    }
    }
    """
    with slither_from_source(source) as slither:
        c = slither.get_contract_from_name("State")[0]
        f = [x for x in c.functions if x.name == "f"][0]

        # Check that there is an entry point phi values for each later value
        # plus one additional which is the initial value
        entry_ssa = f.entry_point.irs_ssa
        assert len(entry_ssa) == 1
        phi_entry = entry_ssa[0]
        assert isinstance(phi_entry, Phi)

        # Find the second phi function
        endif_node = [x for x in f.nodes if x.type == NodeType.ENDIF][0]
        assert len(endif_node.irs_ssa) == 1
        phi_endif = endif_node.irs_ssa[0]
        assert isinstance(phi_endif, Phi)

        # Ensure second phi-function contains init-phi and one additional
        assert len(phi_endif.rvalues) == 2
        assert phi_entry.lvalue in phi_endif.rvalues

        # Find return-statement and ensure it returns the phi_endif
        return_node = [x for x in f.nodes if x.type == NodeType.RETURN][0]
        assert len(return_node.irs_ssa) == 1
        ret = return_node.irs_ssa[0]
        assert len(ret.values) == 1
        assert phi_endif.lvalue in ret.values

        # Ensure that the phi_endif (which is the end-state for function as well) is in the entry_phi
        assert phi_endif.lvalue in phi_entry.rvalues


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_issue_434():
    source = """
     contract Contract {
        int public a;
        function f() public {
            g();
            a += 1;
        }

        function e() public {
            a -= 1;
        }

        function g() public {
            e();
        }
    }
    """
    with slither_from_source(source) as slither:
        c = slither.get_contract_from_name("Contract")[0]

        e = [x for x in c.functions if x.name == "e"][0]
        f = [x for x in c.functions if x.name == "f"][0]
        g = [x for x in c.functions if x.name == "g"][0]

        # Ensure there is a phi-node at the beginning of f and e
        phi_entry_e = get_ssa_of_type(e.entry_point, Phi)[0]
        phi_entry_f = get_ssa_of_type(f.entry_point, Phi)[0]
        # But not at g
        assert len(get_ssa_of_type(g, Phi)) == 0

        # Ensure that the final states of f and e are in the entry-states
        add_f = get_filtered_ssa(
            f, lambda x: isinstance(x, Binary) and x.type == BinaryType.ADDITION
        )[0]
        sub_e = get_filtered_ssa(
            e, lambda x: isinstance(x, Binary) and x.type == BinaryType.SUBTRACTION
        )[0]
        assert add_f.lvalue in phi_entry_f.rvalues
        assert add_f.lvalue in phi_entry_e.rvalues
        assert sub_e.lvalue in phi_entry_f.rvalues
        assert sub_e.lvalue in phi_entry_e.rvalues

        # Ensure there is a phi-node after call to g
        call = get_ssa_of_type(f, InternalCall)[0]
        idx = call.node.irs_ssa.index(call)
        aftercall_phi = call.node.irs_ssa[idx + 1]
        assert isinstance(aftercall_phi, Phi)

        # Ensure that phi node ^ is used in the addition afterwards
        assert aftercall_phi.lvalue in (add_f.variable_left, add_f.variable_right)


@pytest.mark.xfail(strict=True, reason="Fails in current slither version. Fix in #1102.")
def test_issue_473():
    source = """
    contract Contract {
    function f() public returns (int) {
        int a = 1;
        if (a > 0) {
            a = 2;
        }
        if (a == 3) {
            a = 6;
        }
        return a;
    }
    }
    """
    with slither_from_source(source) as slither:
        c = slither.get_contract_from_name("Contract")[0]
        f = c.functions[0]

        phis = get_ssa_of_type(f, Phi)
        return_value = get_ssa_of_type(f, Return)[0]

        # There shall be two phi functions
        assert len(phis) == 2
        first_phi = phis[0]
        second_phi = phis[1]

        # The second phi is the one being returned, if it's the first swap them (iteration order)
        if first_phi.lvalue in return_value.values:
            first_phi, second_phi = second_phi, first_phi

        # First phi is for [a=1 or a=2]
        assert len(first_phi.rvalues) == 2

        # second is for [a=6 or first phi]
        assert first_phi.lvalue in second_phi.rvalues
        assert len(second_phi.rvalues) == 2

        # return is for second phi
        assert len(return_value.values) == 1
        assert second_phi.lvalue in return_value.values


def test_issue_1748():
    source = """
    contract Contract {
        uint[] arr;
        function foo(uint i) public {
            arr = [1];
        }
    }
    """
    with slither_from_source(source) as slither:
        c = slither.get_contract_from_name("Contract")[0]
        f = c.functions[0]
        operations = f.slithir_operations
        assign_op = operations[0]
        assert isinstance(assign_op, InitArray)