246 lines
7.0 KiB
Go
246 lines
7.0 KiB
Go
// Copyright 2013 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package pointer
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"go/token"
|
|
"io"
|
|
|
|
"golang.org/x/tools/container/intsets"
|
|
"golang.org/x/tools/go/callgraph"
|
|
"golang.org/x/tools/go/ssa"
|
|
"golang.org/x/tools/go/types/typeutil"
|
|
)
|
|
|
|
// A Config formulates a pointer analysis problem for Analyze().
|
|
type Config struct {
|
|
// Mains contains the set of 'main' packages to analyze
|
|
// Clients must provide the analysis with at least one
|
|
// package defining a main() function.
|
|
//
|
|
// Non-main packages in the ssa.Program that are not
|
|
// dependencies of any main package may still affect the
|
|
// analysis result, because they contribute runtime types and
|
|
// thus methods.
|
|
// TODO(adonovan): investigate whether this is desirable.
|
|
Mains []*ssa.Package
|
|
|
|
// Reflection determines whether to handle reflection
|
|
// operators soundly, which is currently rather slow since it
|
|
// causes constraint to be generated during solving
|
|
// proportional to the number of constraint variables, which
|
|
// has not yet been reduced by presolver optimisation.
|
|
Reflection bool
|
|
|
|
// BuildCallGraph determines whether to construct a callgraph.
|
|
// If enabled, the graph will be available in Result.CallGraph.
|
|
BuildCallGraph bool
|
|
|
|
// The client populates Queries[v] or IndirectQueries[v]
|
|
// for each ssa.Value v of interest, to request that the
|
|
// points-to sets pts(v) or pts(*v) be computed. If the
|
|
// client needs both points-to sets, v may appear in both
|
|
// maps.
|
|
//
|
|
// (IndirectQueries is typically used for Values corresponding
|
|
// to source-level lvalues, e.g. an *ssa.Global.)
|
|
//
|
|
// The analysis populates the corresponding
|
|
// Result.{Indirect,}Queries map when it creates the pointer
|
|
// variable for v or *v. Upon completion the client can
|
|
// inspect that map for the results.
|
|
//
|
|
// TODO(adonovan): this API doesn't scale well for batch tools
|
|
// that want to dump the entire solution. Perhaps optionally
|
|
// populate a map[*ssa.DebugRef]Pointer in the Result, one
|
|
// entry per source expression.
|
|
//
|
|
Queries map[ssa.Value]struct{}
|
|
IndirectQueries map[ssa.Value]struct{}
|
|
|
|
// If Log is non-nil, log messages are written to it.
|
|
// Logging is extremely verbose.
|
|
Log io.Writer
|
|
}
|
|
|
|
type track uint32
|
|
|
|
const (
|
|
trackChan track = 1 << iota // track 'chan' references
|
|
trackMap // track 'map' references
|
|
trackPtr // track regular pointers
|
|
trackSlice // track slice references
|
|
|
|
trackAll = ^track(0)
|
|
)
|
|
|
|
// AddQuery adds v to Config.Queries.
|
|
// Precondition: CanPoint(v.Type()).
|
|
// TODO(adonovan): consider returning a new Pointer for this query,
|
|
// which will be initialized during analysis. That avoids the needs
|
|
// for the corresponding ssa.Value-keyed maps in Config and Result.
|
|
func (c *Config) AddQuery(v ssa.Value) {
|
|
if !CanPoint(v.Type()) {
|
|
panic(fmt.Sprintf("%s is not a pointer-like value: %s", v, v.Type()))
|
|
}
|
|
if c.Queries == nil {
|
|
c.Queries = make(map[ssa.Value]struct{})
|
|
}
|
|
c.Queries[v] = struct{}{}
|
|
}
|
|
|
|
// AddQuery adds v to Config.IndirectQueries.
|
|
// Precondition: CanPoint(v.Type().Underlying().(*types.Pointer).Elem()).
|
|
func (c *Config) AddIndirectQuery(v ssa.Value) {
|
|
if c.IndirectQueries == nil {
|
|
c.IndirectQueries = make(map[ssa.Value]struct{})
|
|
}
|
|
if !CanPoint(mustDeref(v.Type())) {
|
|
panic(fmt.Sprintf("%s is not the address of a pointer-like value: %s", v, v.Type()))
|
|
}
|
|
c.IndirectQueries[v] = struct{}{}
|
|
}
|
|
|
|
func (c *Config) prog() *ssa.Program {
|
|
for _, main := range c.Mains {
|
|
return main.Prog
|
|
}
|
|
panic("empty scope")
|
|
}
|
|
|
|
type Warning struct {
|
|
Pos token.Pos
|
|
Message string
|
|
}
|
|
|
|
// A Result contains the results of a pointer analysis.
|
|
//
|
|
// See Config for how to request the various Result components.
|
|
//
|
|
type Result struct {
|
|
CallGraph *callgraph.Graph // discovered call graph
|
|
Queries map[ssa.Value]Pointer // pts(v) for each v in Config.Queries.
|
|
IndirectQueries map[ssa.Value]Pointer // pts(*v) for each v in Config.IndirectQueries.
|
|
Warnings []Warning // warnings of unsoundness
|
|
}
|
|
|
|
// A Pointer is an equivalence class of pointer-like values.
|
|
//
|
|
// A Pointer doesn't have a unique type because pointers of distinct
|
|
// types may alias the same object.
|
|
//
|
|
type Pointer struct {
|
|
a *analysis
|
|
n nodeid
|
|
}
|
|
|
|
// A PointsToSet is a set of labels (locations or allocations).
|
|
type PointsToSet struct {
|
|
a *analysis // may be nil if pts is nil
|
|
pts *nodeset
|
|
}
|
|
|
|
func (s PointsToSet) String() string {
|
|
var buf bytes.Buffer
|
|
buf.WriteByte('[')
|
|
if s.pts != nil {
|
|
var space [50]int
|
|
for i, l := range s.pts.AppendTo(space[:0]) {
|
|
if i > 0 {
|
|
buf.WriteString(", ")
|
|
}
|
|
buf.WriteString(s.a.labelFor(nodeid(l)).String())
|
|
}
|
|
}
|
|
buf.WriteByte(']')
|
|
return buf.String()
|
|
}
|
|
|
|
// PointsTo returns the set of labels that this points-to set
|
|
// contains.
|
|
func (s PointsToSet) Labels() []*Label {
|
|
var labels []*Label
|
|
if s.pts != nil {
|
|
var space [50]int
|
|
for _, l := range s.pts.AppendTo(space[:0]) {
|
|
labels = append(labels, s.a.labelFor(nodeid(l)))
|
|
}
|
|
}
|
|
return labels
|
|
}
|
|
|
|
// If this PointsToSet came from a Pointer of interface kind
|
|
// or a reflect.Value, DynamicTypes returns the set of dynamic
|
|
// types that it may contain. (For an interface, they will
|
|
// always be concrete types.)
|
|
//
|
|
// The result is a mapping whose keys are the dynamic types to which
|
|
// it may point. For each pointer-like key type, the corresponding
|
|
// map value is the PointsToSet for pointers of that type.
|
|
//
|
|
// The result is empty unless CanHaveDynamicTypes(T).
|
|
//
|
|
func (s PointsToSet) DynamicTypes() *typeutil.Map {
|
|
var tmap typeutil.Map
|
|
tmap.SetHasher(s.a.hasher)
|
|
if s.pts != nil {
|
|
var space [50]int
|
|
for _, x := range s.pts.AppendTo(space[:0]) {
|
|
ifaceObjId := nodeid(x)
|
|
if !s.a.isTaggedObject(ifaceObjId) {
|
|
continue // !CanHaveDynamicTypes(tDyn)
|
|
}
|
|
tDyn, v, indirect := s.a.taggedValue(ifaceObjId)
|
|
if indirect {
|
|
panic("indirect tagged object") // implement later
|
|
}
|
|
pts, ok := tmap.At(tDyn).(PointsToSet)
|
|
if !ok {
|
|
pts = PointsToSet{s.a, new(nodeset)}
|
|
tmap.Set(tDyn, pts)
|
|
}
|
|
pts.pts.addAll(&s.a.nodes[v].solve.pts)
|
|
}
|
|
}
|
|
return &tmap
|
|
}
|
|
|
|
// Intersects reports whether this points-to set and the
|
|
// argument points-to set contain common members.
|
|
func (x PointsToSet) Intersects(y PointsToSet) bool {
|
|
if x.pts == nil || y.pts == nil {
|
|
return false
|
|
}
|
|
// This takes Θ(|x|+|y|) time.
|
|
var z intsets.Sparse
|
|
z.Intersection(&x.pts.Sparse, &y.pts.Sparse)
|
|
return !z.IsEmpty()
|
|
}
|
|
|
|
func (p Pointer) String() string {
|
|
return fmt.Sprintf("n%d", p.n)
|
|
}
|
|
|
|
// PointsTo returns the points-to set of this pointer.
|
|
func (p Pointer) PointsTo() PointsToSet {
|
|
if p.n == 0 {
|
|
return PointsToSet{}
|
|
}
|
|
return PointsToSet{p.a, &p.a.nodes[p.n].solve.pts}
|
|
}
|
|
|
|
// MayAlias reports whether the receiver pointer may alias
|
|
// the argument pointer.
|
|
func (p Pointer) MayAlias(q Pointer) bool {
|
|
return p.PointsTo().Intersects(q.PointsTo())
|
|
}
|
|
|
|
// DynamicTypes returns p.PointsTo().DynamicTypes().
|
|
func (p Pointer) DynamicTypes() *typeutil.Map {
|
|
return p.PointsTo().DynamicTypes()
|
|
}
|