Fix decompiler crash on stack-returned values in c_return_as_atoms

[vietd0x]

Summary

FunctionHandler.c_return_as_atoms calls Atom.from_argument(...) without a stack pointer. When a callee's recovered return value maps to a SimStackArg (e.g. a value returned on the stack), Atom.from_argument raises:

ValueError: You must provide a stack pointer to translate a SimStackArg

This propagates out of the ReachingDefinitionsAnalysis (invoked via CompleteCallingConventions / the decompiler). Under the decompiler's resilience mode the exception is swallowed, decompilation aborts, and Decompiler.codegen ends up None — so the function silently fails to decompile.

The sibling helper c_args_as_atoms already handles this correctly: it resolves sp from the state and wraps the call in try/except ValueError: continue. This PR makes c_return_as_atoms consistent with it.

Root cause

c_return_as_atoms (in angr/analyses/reaching_definitions/function_handler.py):

return {
    Atom.from_argument(footprint_arg, state.arch, full_reg=True)  # no sp, no try/except
    for footprint_arg in retval.get_footprint()
}

Fix

Resolve sp from the state and skip footprint args that can't be translated, mirroring c_args_as_atoms:

sp_value = state.get_one_value(Register(state.arch.sp_offset, state.arch.bytes), strip_annotations=True)
sp = state.get_stack_offset(sp_value) if sp_value is not None else None
atoms = set()
for footprint_arg in retval.get_footprint():
    try:
        atoms.add(Atom.from_argument(footprint_arg, state.arch, full_reg=True, sp=sp))
    except ValueError:
        continue
return atoms

Behavior impact

• Register-returned values (the common case): unchanged — SimRegArg ignores sp, and no ValueError is raised, so output is identical.
• Stack-returned values: previously crashed (and killed decompilation); now produce the correct MemoryLocation atom when sp is resolvable, or are skipped gracefully when it isn't — exactly the strategy c_args_as_atoms already uses for arguments.

Test plan

• Reproduced the crash on a real (stripped) Rust binary: decompilation produced codegen=None with two swallowed SimStackArg ValueErrors; fail_fast=True pinpointed the call site at c_return_as_atoms.
• After the fix, the same function decompiles successfully with no errors.

🤖 Generated with Claude Code

[bluesadi]

Hi,

Thanks for summitting this PR! Could you please move it to angr/angr instead? Oxidizer has already been merged into angr and this repo is supposed to be archieved.

Best

[ltfish]

@bluesadi You probably want to make it clear in README.md :)