    001/*
    002 * Licensed to the Apache Software Foundation (ASF) under one or more
    003 * contributor license agreements.  See the NOTICE file distributed with
    004 * this work for additional information regarding copyright ownership.
    005 * The ASF licenses this file to You under the Apache License, Version 2.0
    006 * (the "License"); you may not use this file except in compliance with
    007 * the License.  You may obtain a copy of the License at
    008 *
    009 *      http://www.apache.org/licenses/LICENSE-2.0
    010 *
    011 *  Unless required by applicable law or agreed to in writing, software
    012 *  distributed under the License is distributed on an "AS IS" BASIS,
    013 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    014 *  See the License for the specific language governing permissions and
    015 *  limitations under the License.
    016 */
    017package org.apache.bcel.verifier.structurals;
    018
    019import java.util.ArrayList;
    020import java.util.Arrays;
    021import java.util.HashMap;
    022import java.util.List;
    023import java.util.Map;
    024
    025import org.apache.bcel.generic.ATHROW;
    026import org.apache.bcel.generic.BranchInstruction;
    027import org.apache.bcel.generic.GotoInstruction;
    028import org.apache.bcel.generic.Instruction;
    029import org.apache.bcel.generic.InstructionHandle;
    030import org.apache.bcel.generic.JsrInstruction;
    031import org.apache.bcel.generic.MethodGen;
    032import org.apache.bcel.generic.RET;
    033import org.apache.bcel.generic.ReturnInstruction;
    034import org.apache.bcel.generic.Select;
    035import org.apache.bcel.verifier.exc.AssertionViolatedException;
    036import org.apache.bcel.verifier.exc.StructuralCodeConstraintException;
    037
    038/**
    039 * This class represents a control flow graph of a method.
    040 */
    041public class ControlFlowGraph {
    042
    043    /**
    044     * Objects of this class represent a node in a ControlFlowGraph. These nodes are instructions, not basic blocks.
    045     */
    046    private class InstructionContextImpl implements InstructionContext {
    047
    048        /**
    049         * The TAG field is here for external temporary flagging, such as graph colouring.
    050         *
    051         * @see #getTag()
    052         * @see #setTag(int)
    053         */
    054        private int TAG;
    055
    056        /**
    057         * The InstructionHandle this InstructionContext is wrapped around.
    058         */
    059        private final InstructionHandle instruction;
    060
    061        /**
    062         * The 'incoming' execution Frames.
    063         */
    064        private final Map<InstructionContext, Frame> inFrames; // key: the last-executed JSR
    065
    066        /**
    067         * The 'outgoing' execution Frames.
    068         */
    069        private final Map<InstructionContext, Frame> outFrames; // key: the last-executed JSR
    070
    071        /**
    072         * The 'execution predecessors' - a list of type InstructionContext of those instances that have been execute()d before
    073         * in that order.
    074         */
    075        private List<InstructionContext> executionPredecessors; // Type: InstructionContext
    076
    077        /**
    078         * Creates an InstructionHandleImpl object from an InstructionHandle. Creation of one per InstructionHandle suffices.
    079         * Don't create more.
    080         */
    081        public InstructionContextImpl(final InstructionHandle inst) {
    082            if (inst == null) {
    083                throw new AssertionViolatedException("Cannot instantiate InstructionContextImpl from NULL.");
    084            }
    085
    086            instruction = inst;
    087            inFrames = new HashMap<>();
    088            outFrames = new HashMap<>();
    089        }
    090
    091        /**
    092         * A utility method that calculates the successors of a given InstructionHandle That means, a RET does have successors
    093         * as defined here. A JsrInstruction has its target as its successor (opposed to its physical successor) as defined
    094         * here.
    095         */
    096// TODO: implement caching!
    097        private InstructionHandle[] _getSuccessors() {
    098            final InstructionHandle[] single = new InstructionHandle[1];
    099
    100            final Instruction inst = getInstruction().getInstruction();
    101
    102            if (inst instanceof RET) {
    103                final Subroutine s = subroutines.subroutineOf(getInstruction());
    104                if (s == null) { // return empty;
    105                    // RET in dead code. "empty" would be the correct answer, but we know something about the surrounding project...
    106                    throw new AssertionViolatedException("Asking for successors of a RET in dead code?!");
    107                }
    108
    109//TODO: remove. Only JustIce must not use it, but foreign users of the ControlFlowGraph
    110//      will want it. Thanks Johannes Wust.
    111//throw new AssertionViolatedException("DID YOU REALLY WANT TO ASK FOR RET'S SUCCS?");
    112
    113                final InstructionHandle[] jsrs = s.getEnteringJsrInstructions();
    114                final InstructionHandle[] ret = new InstructionHandle[jsrs.length];
    115                Arrays.setAll(ret, i -> jsrs[i].getNext());
    116                return ret;
    117            }
    118
    119            // Terminates method normally.
    120            // Terminates method abnormally, because JustIce mandates
    121            // subroutines not to be protected by exception handlers.
    122            if (inst instanceof ReturnInstruction || inst instanceof ATHROW) {
    123                return InstructionHandle.EMPTY_ARRAY;
    124            }
    125
    126            // See method comment.
    127            if (inst instanceof JsrInstruction) {
    128                single[0] = ((JsrInstruction) inst).getTarget();
    129                return single;
    130            }
    131
    132            if (inst instanceof GotoInstruction) {
    133                single[0] = ((GotoInstruction) inst).getTarget();
    134                return single;
    135            }
    136
    137            if (inst instanceof BranchInstruction) {
    138                if (inst instanceof Select) {
    139                    // BCEL's getTargets() returns only the non-default targets,
    140                    // thanks to Eli Tilevich for reporting.
    141                    final InstructionHandle[] matchTargets = ((Select) inst).getTargets();
    142                    final InstructionHandle[] ret = new InstructionHandle[matchTargets.length + 1];
    143                    ret[0] = ((Select) inst).getTarget();
    144                    System.arraycopy(matchTargets, 0, ret, 1, matchTargets.length);
    145                    return ret;
    146                }
    147                final InstructionHandle[] pair = new InstructionHandle[2];
    148                pair[0] = getInstruction().getNext();
    149                pair[1] = ((BranchInstruction) inst).getTarget();
    150                return pair;
    151            }
    152
    153            // default case: Fall through.
    154            single[0] = getInstruction().getNext();
    155            return single;
    156        }
    157
    158        /**
    159         * "Merges in" (vmspec2, page 146) the "incoming" frame situation; executes the instructions symbolically and therefore
    160         * calculates the "outgoing" frame situation. Returns: True iff the "incoming" frame situation changed after merging
    161         * with "inFrame". The execPreds ArrayList must contain the InstructionContext objects executed so far in the correct
    162         * order. This is just one execution path [out of many]. This is needed to correctly "merge" in the special case of a
    163         * RET's successor. <B>The InstConstraintVisitor and ExecutionVisitor instances must be set up correctly.</B>
    164         *
    165         * @return true - if and only if the "outgoing" frame situation changed from the one before execute()ing.
    166         */
    167        @Override
    168        public boolean execute(final Frame inFrame, final ArrayList<InstructionContext> execPreds, final InstConstraintVisitor icv, final ExecutionVisitor ev) {
    169
    170            @SuppressWarnings("unchecked") // OK because execPreds is compatible type
    171            final List<InstructionContext> clone = (List<InstructionContext>) execPreds.clone();
    172            executionPredecessors = clone;
    173
    174            // sanity check
    175            if (lastExecutionJSR() == null && subroutines.subroutineOf(getInstruction()) != subroutines.getTopLevel()
    176                || lastExecutionJSR() != null && subroutines.subroutineOf(getInstruction()) == subroutines.getTopLevel()) {
    177                throw new AssertionViolatedException("Huh?! Am I '" + this + "' part of a subroutine or not?");
    178            }
    179
    180            Frame inF = inFrames.get(lastExecutionJSR());
    181            if (inF == null) {// no incoming frame was set, so set it.
    182                inFrames.put(lastExecutionJSR(), inFrame);
    183                inF = inFrame;
    184            } else if (inF.equals(inFrame) || !mergeInFrames(inFrame)) { // if there was an "old" inFrame
    185                return false;
    186            }
    187
    188            // Now we're sure the inFrame has changed!
    189
    190            // new inFrame is already merged in, see above.
    191            final Frame workingFrame = inF.getClone();
    192
    193            try {
    194                // This verifies the InstructionConstraint for the current
    195                // instruction, but does not modify the workingFrame object.
    196//InstConstraintVisitor icv = InstConstraintVisitor.getInstance(VerifierFactory.getVerifier(method_gen.getClassName()));
    197                icv.setFrame(workingFrame);
    198                getInstruction().accept(icv);
    199            } catch (final StructuralCodeConstraintException ce) {
    200                ce.extendMessage("", "\nInstructionHandle: " + getInstruction() + "\n");
    201                ce.extendMessage("", "\nExecution Frame:\n" + workingFrame);
    202                extendMessageWithFlow(ce);
    203                throw ce;
    204            }
    205
    206            // This executes the Instruction.
    207            // Therefore the workingFrame object is modified.
    208//ExecutionVisitor ev = ExecutionVisitor.getInstance(VerifierFactory.getVerifier(method_gen.getClassName()));
    209            ev.setFrame(workingFrame);
    210            getInstruction().accept(ev);
    211            // getInstruction().accept(ExecutionVisitor.withFrame(workingFrame));
    212            outFrames.put(lastExecutionJSR(), workingFrame);
    213
    214            return true; // new inFrame was different from old inFrame so merging them
    215                         // yielded a different this.inFrame.
    216        }
    217
    218        /**
    219         * Extends the StructuralCodeConstraintException ("e") object with an at-the-end-extended message. This extended message
    220         * will then reflect the execution flow needed to get to the constraint violation that triggered the throwing of the "e"
    221         * object.
    222         */
    223        private void extendMessageWithFlow(final StructuralCodeConstraintException e) {
    224            final String s = "Execution flow:\n";
    225            e.extendMessage("", s + getExecutionChain());
    226        }
    227
    228        /**
    229         * Returns the exception handlers of this instruction.
    230         */
    231        @Override
    232        public ExceptionHandler[] getExceptionHandlers() {
    233            return exceptionhandlers.getExceptionHandlers(getInstruction());
    234        }
    235
    236        /**
    237         * Returns the control flow execution chain. This is built while execute(Frame, ArrayList)-ing the code represented by
    238         * the surrounding ControlFlowGraph.
    239         */
    240        private String getExecutionChain() {
    241            final StringBuilder s = new StringBuilder(this.toString());
    242            for (int i = executionPredecessors.size() - 1; i >= 0; i--) {
    243                s.insert(0, executionPredecessors.get(i) + "\n");
    244            }
    245            return s.toString();
    246        }
    247
    248        @Override
    249        public Frame getInFrame() {
    250            Frame org;
    251
    252            final InstructionContext jsr = lastExecutionJSR();
    253
    254            org = inFrames.get(jsr);
    255
    256            if (org == null) {
    257                throw new AssertionViolatedException("inFrame not set! This:\n" + this + "\nInFrames: '" + inFrames + "'.");
    258            }
    259            return org.getClone();
    260        }
    261
    262        /*
    263         * Fulfils the contract of InstructionContext.getInstruction().
    264         */
    265        @Override
    266        public InstructionHandle getInstruction() {
    267            return instruction;
    268        }
    269
    270        /**
    271         * Returns a clone of the "outgoing" frame situation with respect to the given ExecutionChain.
    272         */
    273        @Override
    274        public Frame getOutFrame(final ArrayList<InstructionContext> execChain) {
    275            executionPredecessors = execChain;
    276
    277            Frame org;
    278
    279            final InstructionContext jsr = lastExecutionJSR();
    280
    281            org = outFrames.get(jsr);
    282
    283            if (org == null) {
    284                throw new AssertionViolatedException(
    285                    "outFrame not set! This:\n" + this + "\nExecutionChain: " + getExecutionChain() + "\nOutFrames: '" + outFrames + "'.");
    286            }
    287            return org.getClone();
    288        }
    289
    290        /* Satisfies InstructionContext.getSuccessors(). */
    291        @Override
    292        public InstructionContext[] getSuccessors() {
    293            return contextsOf(_getSuccessors());
    294        }
    295
    296        /* Satisfies InstructionContext.getTag(). */
    297        @Override
    298        public int getTag() {
    299            return TAG;
    300        }
    301
    302        /**
    303         * Returns the InstructionContextImpl with an JSR/JSR_W that was last in the ExecutionChain, without a corresponding
    304         * RET, i.e. we were called by this one. Returns null if we were called from the top level.
    305         */
    306        private InstructionContextImpl lastExecutionJSR() {
    307
    308            final int size = executionPredecessors.size();
    309            int retcount = 0;
    310
    311            for (int i = size - 1; i >= 0; i--) {
    312                final InstructionContextImpl current = (InstructionContextImpl) executionPredecessors.get(i);
    313                final Instruction currentlast = current.getInstruction().getInstruction();
    314                if (currentlast instanceof RET) {
    315                    retcount++;
    316                }
    317                if (currentlast instanceof JsrInstruction) {
    318                    retcount--;
    319                    if (retcount == -1) {
    320                        return current;
    321                    }
    322                }
    323            }
    324            return null;
    325        }
    326
    327        /**
    328         * Does the actual merging (vmspec2, page 146). Returns true IFF this.inFrame was changed in course of merging with
    329         * inFrame.
    330         */
    331        private boolean mergeInFrames(final Frame inFrame) {
    332            // TODO: Can be performance-improved.
    333            final Frame inF = inFrames.get(lastExecutionJSR());
    334            final OperandStack oldstack = inF.getStack().getClone();
    335            final LocalVariables oldlocals = inF.getLocals().getClone();
    336            try {
    337                inF.getStack().merge(inFrame.getStack());
    338                inF.getLocals().merge(inFrame.getLocals());
    339            } catch (final StructuralCodeConstraintException sce) {
    340                extendMessageWithFlow(sce);
    341                throw sce;
    342            }
    343            return !(oldstack.equals(inF.getStack()) && oldlocals.equals(inF.getLocals()));
    344        }
    345
    346        /* Satisfies InstructionContext.setTag(int). */
    347        @Override
    348        public void setTag(final int tag) { // part of InstructionContext interface
    349            TAG = tag;
    350        }
    351
    352        /**
    353         * Returns a simple String representation of this InstructionContext.
    354         */
    355        @Override
    356        public String toString() {
    357            // TODO: Put information in the brackets, e.g.
    358            // Is this an ExceptionHandler? Is this a RET? Is this the start of
    359            // a subroutine?
    360            return getInstruction().toString(false) + "\t[InstructionContext]";
    361        }
    362
    363    } // End Inner InstructionContextImpl Class.
    364
    365    /// ** The MethodGen object we're working on. */
    366    // private final MethodGen method_gen;
    367
    368    /** The Subroutines object for the method whose control flow is represented by this ControlFlowGraph. */
    369    private final Subroutines subroutines;
    370
    371    /** The ExceptionHandlers object for the method whose control flow is represented by this ControlFlowGraph. */
    372    private final ExceptionHandlers exceptionhandlers;
    373
    374    /** All InstructionContext instances of this ControlFlowGraph. */
    375    private final Map<InstructionHandle, InstructionContext> instructionContexts = new HashMap<>();
    376
    377    /**
    378     * A Control Flow Graph; with additional JustIce checks
    379     *
    380     * @param methodGen the method generator instance
    381     */
    382    public ControlFlowGraph(final MethodGen methodGen) {
    383        this(methodGen, true);
    384    }
    385
    386    /**
    387     * A Control Flow Graph.
    388     *
    389     * @param methodGen the method generator instance
    390     * @param enableJustIceCheck if true, additional JustIce checks are performed
    391     * @since 6.0
    392     */
    393    public ControlFlowGraph(final MethodGen methodGen, final boolean enableJustIceCheck) {
    394        subroutines = new Subroutines(methodGen, enableJustIceCheck);
    395        exceptionhandlers = new ExceptionHandlers(methodGen);
    396
    397        final InstructionHandle[] instructionhandles = methodGen.getInstructionList().getInstructionHandles();
    398        for (final InstructionHandle instructionhandle : instructionhandles) {
    399            instructionContexts.put(instructionhandle, new InstructionContextImpl(instructionhandle));
    400        }
    401
    402        // this.method_gen = method_gen;
    403    }
    404
    405    /**
    406     * Returns the InstructionContext of a given instruction.
    407     */
    408    public InstructionContext contextOf(final InstructionHandle inst) {
    409        final InstructionContext ic = instructionContexts.get(inst);
    410        if (ic == null) {
    411            throw new AssertionViolatedException("InstructionContext requested for an InstructionHandle that's not known!");
    412        }
    413        return ic;
    414    }
    415
    416    /**
    417     * Returns the InstructionContext[] of a given InstructionHandle[], in a naturally ordered manner.
    418     */
    419    public InstructionContext[] contextsOf(final InstructionHandle[] insts) {
    420        final InstructionContext[] ret = new InstructionContext[insts.length];
    421        Arrays.setAll(ret, i -> contextOf(insts[i]));
    422        return ret;
    423    }
    424
    425    /**
    426     * Returns an InstructionContext[] with all the InstructionContext instances for the method whose control flow is
    427     * represented by this ControlFlowGraph <B>(NOT ORDERED!)</B>.
    428     */
    429    public InstructionContext[] getInstructionContexts() {
    430        final InstructionContext[] ret = new InstructionContext[instructionContexts.size()];
    431        return instructionContexts.values().toArray(ret);
    432    }
    433
    434    /**
    435     * Returns true, if and only if the said instruction is not reachable; that means, if it is not part of this
    436     * ControlFlowGraph.
    437     */
    438    public boolean isDead(final InstructionHandle i) {
    439        return subroutines.subroutineOf(i) == null;
    440    }
    441}