    001/*
    002 * Licensed to the Apache Software Foundation (ASF) under one
    003 * or more contributor license agreements.  See the NOTICE file
    004 * distributed with this work for additional information
    005 * regarding copyright ownership.  The ASF licenses this file
    006 * to you under the Apache License, Version 2.0 (the
    007 * "License"); you may not use this file except in compliance
    008 * with the License.  You may obtain a copy of the License at
    009 *
    010 *   https://www.apache.org/licenses/LICENSE-2.0
    011 *
    012 * Unless required by applicable law or agreed to in writing,
    013 * software distributed under the License is distributed on an
    014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
    015 * KIND, either express or implied.  See the License for the
    016 * specific language governing permissions and limitations
    017 * under the License.
    018 */
    019package org.apache.bcel.verifier.structurals;
    020
    021import java.util.ArrayList;
    022import java.util.Arrays;
    023import java.util.HashMap;
    024import java.util.List;
    025import java.util.Map;
    026
    027import org.apache.bcel.generic.ATHROW;
    028import org.apache.bcel.generic.BranchInstruction;
    029import org.apache.bcel.generic.GotoInstruction;
    030import org.apache.bcel.generic.Instruction;
    031import org.apache.bcel.generic.InstructionHandle;
    032import org.apache.bcel.generic.JsrInstruction;
    033import org.apache.bcel.generic.MethodGen;
    034import org.apache.bcel.generic.RET;
    035import org.apache.bcel.generic.ReturnInstruction;
    036import org.apache.bcel.generic.Select;
    037import org.apache.bcel.verifier.exc.AssertionViolatedException;
    038import org.apache.bcel.verifier.exc.StructuralCodeConstraintException;
    039
    040/**
    041 * This class represents a control flow graph of a method.
    042 */
    043public class ControlFlowGraph {
    044
    045    /**
    046     * Objects of this class represent a node in a ControlFlowGraph. These nodes are instructions, not basic blocks.
    047     */
    048    private final class InstructionContextImpl implements InstructionContext {
    049
    050        /**
    051         * The TAG field is here for external temporary flagging, such as graph coloring.
    052         *
    053         * @see #getTag()
    054         * @see #setTag(int)
    055         */
    056        private int TAG;
    057
    058        /**
    059         * The InstructionHandle this InstructionContext is wrapped around.
    060         */
    061        private final InstructionHandle instruction;
    062
    063        /**
    064         * The 'incoming' execution Frames.
    065         */
    066        private final Map<InstructionContext, Frame> inFrames; // key: the last-executed JSR
    067
    068        /**
    069         * The 'outgoing' execution Frames.
    070         */
    071        private final Map<InstructionContext, Frame> outFrames; // key: the last-executed JSR
    072
    073        /**
    074         * The 'execution predecessors' - a list of type InstructionContext of those instances that have been execute()d before
    075         * in that order.
    076         */
    077        private List<InstructionContext> executionPredecessors; // Type: InstructionContext
    078
    079        /**
    080         * Creates an InstructionHandleImpl object from an InstructionHandle. Creation of one per InstructionHandle suffices.
    081         * Don't create more.
    082         */
    083        InstructionContextImpl(final InstructionHandle inst) {
    084            if (inst == null) {
    085                throw new AssertionViolatedException("Cannot instantiate InstructionContextImpl from NULL.");
    086            }
    087            instruction = inst;
    088            inFrames = new HashMap<>();
    089            outFrames = new HashMap<>();
    090        }
    091
    092        /**
    093         * A utility method that calculates the successors of a given InstructionHandle That means, a RET does have successors
    094         * as defined here. A JsrInstruction has its target as its successor (opposed to its physical successor) as defined
    095         * here.
    096         */
    097// TODO: implement caching!
    098        private InstructionHandle[] _getSuccessors() {
    099            final InstructionHandle[] single = new InstructionHandle[1];
    100
    101            final Instruction inst = getInstruction().getInstruction();
    102
    103            if (inst instanceof RET) {
    104                final Subroutine s = subroutines.subroutineOf(getInstruction());
    105                if (s == null) { // return empty;
    106                    // RET in dead code. "empty" would be the correct answer, but we know something about the surrounding project...
    107                    throw new AssertionViolatedException("Asking for successors of a RET in dead code?!");
    108                }
    109
    110//TODO: remove. Only JustIce must not use it, but foreign users of the ControlFlowGraph
    111//      will want it. Thanks Johannes Wust.
    112//throw new AssertionViolatedException("DID YOU REALLY WANT TO ASK FOR RET'S SUCCS?");
    113
    114                final InstructionHandle[] jsrs = s.getEnteringJsrInstructions();
    115                final InstructionHandle[] ret = new InstructionHandle[jsrs.length];
    116                Arrays.setAll(ret, i -> jsrs[i].getNext());
    117                return ret;
    118            }
    119
    120            // Terminates method normally.
    121            // Terminates method abnormally, because JustIce mandates
    122            // subroutines not to be protected by exception handlers.
    123            if (inst instanceof ReturnInstruction || inst instanceof ATHROW) {
    124                return InstructionHandle.EMPTY_ARRAY;
    125            }
    126
    127            // See method comment.
    128            if (inst instanceof JsrInstruction) {
    129                single[0] = ((JsrInstruction) inst).getTarget();
    130                return single;
    131            }
    132
    133            if (inst instanceof GotoInstruction) {
    134                single[0] = ((GotoInstruction) inst).getTarget();
    135                return single;
    136            }
    137
    138            if (inst instanceof BranchInstruction) {
    139                if (inst instanceof Select) {
    140                    // BCEL's getTargets() returns only the non-default targets,
    141                    // thanks to Eli Tilevich for reporting.
    142                    final InstructionHandle[] matchTargets = ((Select) inst).getTargets();
    143                    final InstructionHandle[] ret = new InstructionHandle[matchTargets.length + 1];
    144                    ret[0] = ((Select) inst).getTarget();
    145                    System.arraycopy(matchTargets, 0, ret, 1, matchTargets.length);
    146                    return ret;
    147                }
    148                final InstructionHandle[] pair = new InstructionHandle[2];
    149                pair[0] = getInstruction().getNext();
    150                pair[1] = ((BranchInstruction) inst).getTarget();
    151                return pair;
    152            }
    153
    154            // default case: Fall through.
    155            single[0] = getInstruction().getNext();
    156            return single;
    157        }
    158
    159        /**
    160         * "Merges in" (vmspec2, page 146) the "incoming" frame situation; executes the instructions symbolically and therefore
    161         * calculates the "outgoing" frame situation. Returns: True iff the "incoming" frame situation changed after merging
    162         * with "inFrame". The execPreds ArrayList must contain the InstructionContext objects executed so far in the correct
    163         * order. This is just one execution path [out of many]. This is needed to correctly "merge" in the special case of a
    164         * RET's successor. <B>The InstConstraintVisitor and ExecutionVisitor instances must be set up correctly.</B>
    165         *
    166         * @return true - if and only if the "outgoing" frame situation changed from the one before execute()ing.
    167         */
    168        @Override
    169        public boolean execute(final Frame inFrame, final ArrayList<InstructionContext> execPreds, final InstConstraintVisitor icv, final ExecutionVisitor ev) {
    170
    171            @SuppressWarnings("unchecked") // OK because execPreds is compatible type
    172            final List<InstructionContext> clone = (List<InstructionContext>) execPreds.clone();
    173            executionPredecessors = clone;
    174
    175            // sanity check
    176            if (lastExecutionJSR() == null && subroutines.subroutineOf(getInstruction()) != subroutines.getTopLevel()
    177                || lastExecutionJSR() != null && subroutines.subroutineOf(getInstruction()) == subroutines.getTopLevel()) {
    178                throw new AssertionViolatedException("Huh?! Am I '" + this + "' part of a subroutine or not?");
    179            }
    180
    181            Frame inF = inFrames.get(lastExecutionJSR());
    182            if (inF == null) { // no incoming frame was set, so set it.
    183                inFrames.put(lastExecutionJSR(), inFrame);
    184                inF = inFrame;
    185            } else if (inF.equals(inFrame) || !mergeInFrames(inFrame)) { // if there was an "old" inFrame
    186                return false;
    187            }
    188
    189            // Now we're sure the inFrame has changed!
    190
    191            // new inFrame is already merged in, see above.
    192            final Frame workingFrame = inF.getClone();
    193
    194            try {
    195                // This verifies the InstructionConstraint for the current
    196                // instruction, but does not modify the workingFrame object.
    197//InstConstraintVisitor icv = InstConstraintVisitor.getInstance(VerifierFactory.getVerifier(method_gen.getClassName()));
    198                icv.setFrame(workingFrame);
    199                getInstruction().accept(icv);
    200            } catch (final StructuralCodeConstraintException ce) {
    201                ce.extendMessage("", "\nInstructionHandle: " + getInstruction() + "\n");
    202                ce.extendMessage("", "\nExecution Frame:\n" + workingFrame);
    203                extendMessageWithFlow(ce);
    204                throw ce;
    205            }
    206
    207            // This executes the Instruction.
    208            // Therefore the workingFrame object is modified.
    209//ExecutionVisitor ev = ExecutionVisitor.getInstance(VerifierFactory.getVerifier(method_gen.getClassName()));
    210            ev.setFrame(workingFrame);
    211            getInstruction().accept(ev);
    212            // getInstruction().accept(ExecutionVisitor.withFrame(workingFrame));
    213            outFrames.put(lastExecutionJSR(), workingFrame);
    214
    215            return true; // new inFrame was different from old inFrame so merging them
    216                         // yielded a different this.inFrame.
    217        }
    218
    219        /**
    220         * Extends the StructuralCodeConstraintException ("e") object with an at-the-end-extended message. This extended message
    221         * will then reflect the execution flow needed to get to the constraint violation that triggered the throwing of the "e"
    222         * object.
    223         */
    224        private void extendMessageWithFlow(final StructuralCodeConstraintException e) {
    225            final String s = "Execution flow:\n";
    226            e.extendMessage("", s + getExecutionChain());
    227        }
    228
    229        /**
    230         * Returns the exception handlers of this instruction.
    231         */
    232        @Override
    233        public ExceptionHandler[] getExceptionHandlers() {
    234            return exceptionhandlers.getExceptionHandlers(getInstruction());
    235        }
    236
    237        /**
    238         * Returns the control flow execution chain. This is built while execute(Frame, ArrayList)-ing the code represented by
    239         * the surrounding ControlFlowGraph.
    240         */
    241        private String getExecutionChain() {
    242            final StringBuilder s = new StringBuilder(toString());
    243            for (int i = executionPredecessors.size() - 1; i >= 0; i--) {
    244                s.insert(0, executionPredecessors.get(i) + "\n");
    245            }
    246            return s.toString();
    247        }
    248
    249        @Override
    250        public Frame getInFrame() {
    251            final InstructionContext jsr = lastExecutionJSR();
    252            final Frame org = inFrames.get(jsr);
    253            if (org == null) {
    254                throw new AssertionViolatedException("inFrame not set! This:\n" + this + "\nInFrames: '" + inFrames + "'.");
    255            }
    256            return org.getClone();
    257        }
    258
    259        @Override
    260        public InstructionHandle getInstruction() {
    261            return instruction;
    262        }
    263
    264        /**
    265         * Returns a clone of the "outgoing" frame situation with respect to the given ExecutionChain.
    266         */
    267        @Override
    268        public Frame getOutFrame(final ArrayList<InstructionContext> execChain) {
    269            executionPredecessors = execChain;
    270            final InstructionContext jsr = lastExecutionJSR();
    271            final Frame org = outFrames.get(jsr);
    272            if (org == null) {
    273                throw new AssertionViolatedException(
    274                        "outFrame not set! This:\n" + this + "\nExecutionChain: " + getExecutionChain() + "\nOutFrames: '" + outFrames + "'.");
    275            }
    276            return org.getClone();
    277        }
    278
    279        @Override
    280        public InstructionContext[] getSuccessors() {
    281            return contextsOf(_getSuccessors());
    282        }
    283
    284        @Override
    285        public int getTag() {
    286            return TAG;
    287        }
    288
    289        /**
    290         * Returns the InstructionContextImpl with an JSR/JSR_W that was last in the ExecutionChain, without a corresponding
    291         * RET, i.e. we were called by this one. Returns null if we were called from the top level.
    292         */
    293        private InstructionContextImpl lastExecutionJSR() {
    294
    295            final int size = executionPredecessors.size();
    296            int retcount = 0;
    297
    298            for (int i = size - 1; i >= 0; i--) {
    299                final InstructionContextImpl current = (InstructionContextImpl) executionPredecessors.get(i);
    300                final Instruction currentlast = current.getInstruction().getInstruction();
    301                if (currentlast instanceof RET) {
    302                    retcount++;
    303                }
    304                if (currentlast instanceof JsrInstruction) {
    305                    retcount--;
    306                    if (retcount == -1) {
    307                        return current;
    308                    }
    309                }
    310            }
    311            return null;
    312        }
    313
    314        /**
    315         * Does the actual merging (vmspec2, page 146). Returns true IFF this.inFrame was changed in course of merging with
    316         * inFrame.
    317         */
    318        private boolean mergeInFrames(final Frame inFrame) {
    319            // TODO: Can be performance-improved.
    320            final Frame inF = inFrames.get(lastExecutionJSR());
    321            final OperandStack oldstack = inF.getStack().getClone();
    322            final LocalVariables oldlocals = inF.getLocals().getClone();
    323            try {
    324                inF.getStack().merge(inFrame.getStack());
    325                inF.getLocals().merge(inFrame.getLocals());
    326            } catch (final StructuralCodeConstraintException sce) {
    327                extendMessageWithFlow(sce);
    328                throw sce;
    329            }
    330            return !(oldstack.equals(inF.getStack()) && oldlocals.equals(inF.getLocals()));
    331        }
    332
    333        /* Satisfies InstructionContext.setTag(int). */
    334        @Override
    335        public void setTag(final int tag) { // part of InstructionContext interface
    336            TAG = tag;
    337        }
    338
    339        /**
    340         * Returns a simple String representation of this InstructionContext.
    341         */
    342        @Override
    343        public String toString() {
    344            // TODO: Put information in the brackets, for example
    345            // Is this an ExceptionHandler? Is this a RET? Is this the start of
    346            // a subroutine?
    347            return getInstruction().toString(false) + "\t[InstructionContext]";
    348        }
    349
    350    } // End Inner InstructionContextImpl Class.
    351
    352    /// ** The MethodGen object we're working on. */
    353    // private final MethodGen method_gen;
    354
    355    /** The Subroutines object for the method whose control flow is represented by this ControlFlowGraph. */
    356    private final Subroutines subroutines;
    357
    358    /** The ExceptionHandlers object for the method whose control flow is represented by this ControlFlowGraph. */
    359    private final ExceptionHandlers exceptionhandlers;
    360
    361    /** All InstructionContext instances of this ControlFlowGraph. */
    362    private final Map<InstructionHandle, InstructionContext> instructionContexts = new HashMap<>();
    363
    364    /**
    365     * A Control Flow Graph; with additional JustIce checks
    366     *
    367     * @param methodGen the method generator instance
    368     */
    369    public ControlFlowGraph(final MethodGen methodGen) {
    370        this(methodGen, true);
    371    }
    372
    373    /**
    374     * A Control Flow Graph.
    375     *
    376     * @param methodGen the method generator instance
    377     * @param enableJustIceCheck if true, additional JustIce checks are performed
    378     * @since 6.0
    379     */
    380    public ControlFlowGraph(final MethodGen methodGen, final boolean enableJustIceCheck) {
    381        subroutines = new Subroutines(methodGen, enableJustIceCheck);
    382        exceptionhandlers = new ExceptionHandlers(methodGen);
    383
    384        final InstructionHandle[] instructionhandles = methodGen.getInstructionList().getInstructionHandles();
    385        for (final InstructionHandle instructionhandle : instructionhandles) {
    386            instructionContexts.put(instructionhandle, new InstructionContextImpl(instructionhandle));
    387        }
    388
    389        // this.method_gen = method_gen;
    390    }
    391
    392    /**
    393     * Returns the InstructionContext of a given instruction.
    394     */
    395    public InstructionContext contextOf(final InstructionHandle inst) {
    396        final InstructionContext ic = instructionContexts.get(inst);
    397        if (ic == null) {
    398            throw new AssertionViolatedException("InstructionContext requested for an InstructionHandle that's not known!");
    399        }
    400        return ic;
    401    }
    402
    403    /**
    404     * Returns the InstructionContext[] of a given InstructionHandle[], in a naturally ordered manner.
    405     */
    406    public InstructionContext[] contextsOf(final InstructionHandle[] insts) {
    407        final InstructionContext[] ret = new InstructionContext[insts.length];
    408        Arrays.setAll(ret, i -> contextOf(insts[i]));
    409        return ret;
    410    }
    411
    412    /**
    413     * Returns an InstructionContext[] with all the InstructionContext instances for the method whose control flow is
    414     * represented by this ControlFlowGraph <B>(NOT ORDERED!)</B>.
    415     */
    416    public InstructionContext[] getInstructionContexts() {
    417        final InstructionContext[] ret = new InstructionContext[instructionContexts.size()];
    418        return instructionContexts.values().toArray(ret);
    419    }
    420
    421    /**
    422     * Returns true, if and only if the said instruction is not reachable; that means, if it is not part of this
    423     * ControlFlowGraph.
    424     */
    425    public boolean isDead(final InstructionHandle i) {
    426        return subroutines.subroutineOf(i) == null;
    427    }
    428}