Report compiler-generated names leaking into decompiled output - #4128
Merged
Conversation
decompdiff counted the substring "<>" in the output text, which both missed
mangled names that do not contain it ("VB$AnonymousType_0", "<Main>$") and
counted every generic argument list ending in an identifier character. The
shape is matched lexically there because only text is available; nugetfuzz has
the syntax tree, so it applies the decompiler's own identifier rule
(EscapeInvalidIdentifiers.IsValid) to the tree's identifiers instead, and any
hit is output that does not compile. Findings collapse to the shape of the
name because the bracketed part and the digits vary per occurrence, so one
unfolded construct stays one finding rather than one per member it hit.
The report's kind list is also the render loop's only source of sections, so
the PDB bucket added with the PDB verification mode never reached the HTML.
Assisted-by: Claude:claude-opus-5:Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
decompdiffmeasured leaked compiler-generated names by counting the substring<>in the output text. That both missed mangled names without it (VB$AnonymousType_0,<Main>$) and counted every generic argument list followed by an identifier character. It only has output text, so the shapes stay lexical there, but the pattern is now written to match what the decompiler itself considers generated.nugetfuzzhas the syntax tree, so it checks identifiers directly against the decompiler's own rule (EscapeInvalidIdentifiers.IsValid: letters, digits and_). Anything else is a compiler-generated entity that was not folded away, and the output does not compile. Findings are bucketed by the shape of the name -- the bracketed part is the enclosing member and the digits are per occurrence -- so one unfolded construct stays one finding instead of one per member it hit.Also fixes a defect in the HTML report: its kind list is the render loop's only source of sections, and the
PDBbucket added with the PDB verification mode was never in it, so PDB findings never appeared in the report.Verified with a run over
System.Text.Json@9.0.0: 6 hits in 2 buckets, including the known<>y__InlineArray<N>leak from ref-struct inline arrays.Mono.Cecil@0.11.6andPolly.Core@8.4.2come back clean.This PR was prepared by an AI agent (Claude Code) on my behalf.