001/*
002 * Licensed to the Apache Software Foundation (ASF) under one or more
003 * contributor license agreements.  See the NOTICE file distributed with
004 * this work for additional information regarding copyright ownership.
005 * The ASF licenses this file to You under the Apache License, Version 2.0
006 * (the "License"); you may not use this file except in compliance with
007 * the License.  You may obtain a copy of the License at
008 *
009 *      http://www.apache.org/licenses/LICENSE-2.0
010 *
011 *  Unless required by applicable law or agreed to in writing, software
012 *  distributed under the License is distributed on an "AS IS" BASIS,
013 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014 *  See the License for the specific language governing permissions and
015 *  limitations under the License.
016 */
017package org.apache.bcel.verifier.structurals;
018
019import java.util.ArrayList;
020import java.util.Arrays;
021import java.util.HashMap;
022import java.util.List;
023import java.util.Map;
024
025import org.apache.bcel.generic.ATHROW;
026import org.apache.bcel.generic.BranchInstruction;
027import org.apache.bcel.generic.GotoInstruction;
028import org.apache.bcel.generic.Instruction;
029import org.apache.bcel.generic.InstructionHandle;
030import org.apache.bcel.generic.JsrInstruction;
031import org.apache.bcel.generic.MethodGen;
032import org.apache.bcel.generic.RET;
033import org.apache.bcel.generic.ReturnInstruction;
034import org.apache.bcel.generic.Select;
035import org.apache.bcel.verifier.exc.AssertionViolatedException;
036import org.apache.bcel.verifier.exc.StructuralCodeConstraintException;
037
038/**
039 * This class represents a control flow graph of a method.
040 */
041public class ControlFlowGraph {
042
043    /**
044     * Objects of this class represent a node in a ControlFlowGraph. These nodes are instructions, not basic blocks.
045     */
046    private class InstructionContextImpl implements InstructionContext {
047
048        /**
049         * The TAG field is here for external temporary flagging, such as graph colouring.
050         *
051         * @see #getTag()
052         * @see #setTag(int)
053         */
054        private int TAG;
055
056        /**
057         * The InstructionHandle this InstructionContext is wrapped around.
058         */
059        private final InstructionHandle instruction;
060
061        /**
062         * The 'incoming' execution Frames.
063         */
064        private final Map<InstructionContext, Frame> inFrames; // key: the last-executed JSR
065
066        /**
067         * The 'outgoing' execution Frames.
068         */
069        private final Map<InstructionContext, Frame> outFrames; // key: the last-executed JSR
070
071        /**
072         * The 'execution predecessors' - a list of type InstructionContext of those instances that have been execute()d before
073         * in that order.
074         */
075        private List<InstructionContext> executionPredecessors; // Type: InstructionContext
076
077        /**
078         * Creates an InstructionHandleImpl object from an InstructionHandle. Creation of one per InstructionHandle suffices.
079         * Don't create more.
080         */
081        public InstructionContextImpl(final InstructionHandle inst) {
082            if (inst == null) {
083                throw new AssertionViolatedException("Cannot instantiate InstructionContextImpl from NULL.");
084            }
085
086            instruction = inst;
087            inFrames = new HashMap<>();
088            outFrames = new HashMap<>();
089        }
090
091        /**
092         * A utility method that calculates the successors of a given InstructionHandle That means, a RET does have successors
093         * as defined here. A JsrInstruction has its target as its successor (opposed to its physical successor) as defined
094         * here.
095         */
096// TODO: implement caching!
097        private InstructionHandle[] _getSuccessors() {
098            final InstructionHandle[] single = new InstructionHandle[1];
099
100            final Instruction inst = getInstruction().getInstruction();
101
102            if (inst instanceof RET) {
103                final Subroutine s = subroutines.subroutineOf(getInstruction());
104                if (s == null) { // return empty;
105                    // RET in dead code. "empty" would be the correct answer, but we know something about the surrounding project...
106                    throw new AssertionViolatedException("Asking for successors of a RET in dead code?!");
107                }
108
109//TODO: remove. Only JustIce must not use it, but foreign users of the ControlFlowGraph
110//      will want it. Thanks Johannes Wust.
111//throw new AssertionViolatedException("DID YOU REALLY WANT TO ASK FOR RET'S SUCCS?");
112
113                final InstructionHandle[] jsrs = s.getEnteringJsrInstructions();
114                final InstructionHandle[] ret = new InstructionHandle[jsrs.length];
115                Arrays.setAll(ret, i -> jsrs[i].getNext());
116                return ret;
117            }
118
119            // Terminates method normally.
120            // Terminates method abnormally, because JustIce mandates
121            // subroutines not to be protected by exception handlers.
122            if (inst instanceof ReturnInstruction || inst instanceof ATHROW) {
123                return InstructionHandle.EMPTY_ARRAY;
124            }
125
126            // See method comment.
127            if (inst instanceof JsrInstruction) {
128                single[0] = ((JsrInstruction) inst).getTarget();
129                return single;
130            }
131
132            if (inst instanceof GotoInstruction) {
133                single[0] = ((GotoInstruction) inst).getTarget();
134                return single;
135            }
136
137            if (inst instanceof BranchInstruction) {
138                if (inst instanceof Select) {
139                    // BCEL's getTargets() returns only the non-default targets,
140                    // thanks to Eli Tilevich for reporting.
141                    final InstructionHandle[] matchTargets = ((Select) inst).getTargets();
142                    final InstructionHandle[] ret = new InstructionHandle[matchTargets.length + 1];
143                    ret[0] = ((Select) inst).getTarget();
144                    System.arraycopy(matchTargets, 0, ret, 1, matchTargets.length);
145                    return ret;
146                }
147                final InstructionHandle[] pair = new InstructionHandle[2];
148                pair[0] = getInstruction().getNext();
149                pair[1] = ((BranchInstruction) inst).getTarget();
150                return pair;
151            }
152
153            // default case: Fall through.
154            single[0] = getInstruction().getNext();
155            return single;
156        }
157
158        /**
159         * "Merges in" (vmspec2, page 146) the "incoming" frame situation; executes the instructions symbolically and therefore
160         * calculates the "outgoing" frame situation. Returns: True iff the "incoming" frame situation changed after merging
161         * with "inFrame". The execPreds ArrayList must contain the InstructionContext objects executed so far in the correct
162         * order. This is just one execution path [out of many]. This is needed to correctly "merge" in the special case of a
163         * RET's successor. <B>The InstConstraintVisitor and ExecutionVisitor instances must be set up correctly.</B>
164         *
165         * @return true - if and only if the "outgoing" frame situation changed from the one before execute()ing.
166         */
167        @Override
168        public boolean execute(final Frame inFrame, final ArrayList<InstructionContext> execPreds, final InstConstraintVisitor icv, final ExecutionVisitor ev) {
169
170            @SuppressWarnings("unchecked") // OK because execPreds is compatible type
171            final List<InstructionContext> clone = (List<InstructionContext>) execPreds.clone();
172            executionPredecessors = clone;
173
174            // sanity check
175            if (lastExecutionJSR() == null && subroutines.subroutineOf(getInstruction()) != subroutines.getTopLevel()
176                || lastExecutionJSR() != null && subroutines.subroutineOf(getInstruction()) == subroutines.getTopLevel()) {
177                throw new AssertionViolatedException("Huh?! Am I '" + this + "' part of a subroutine or not?");
178            }
179
180            Frame inF = inFrames.get(lastExecutionJSR());
181            if (inF == null) {// no incoming frame was set, so set it.
182                inFrames.put(lastExecutionJSR(), inFrame);
183                inF = inFrame;
184            } else if (inF.equals(inFrame) || !mergeInFrames(inFrame)) { // if there was an "old" inFrame
185                return false;
186            }
187
188            // Now we're sure the inFrame has changed!
189
190            // new inFrame is already merged in, see above.
191            final Frame workingFrame = inF.getClone();
192
193            try {
194                // This verifies the InstructionConstraint for the current
195                // instruction, but does not modify the workingFrame object.
196//InstConstraintVisitor icv = InstConstraintVisitor.getInstance(VerifierFactory.getVerifier(method_gen.getClassName()));
197                icv.setFrame(workingFrame);
198                getInstruction().accept(icv);
199            } catch (final StructuralCodeConstraintException ce) {
200                ce.extendMessage("", "\nInstructionHandle: " + getInstruction() + "\n");
201                ce.extendMessage("", "\nExecution Frame:\n" + workingFrame);
202                extendMessageWithFlow(ce);
203                throw ce;
204            }
205
206            // This executes the Instruction.
207            // Therefore the workingFrame object is modified.
208//ExecutionVisitor ev = ExecutionVisitor.getInstance(VerifierFactory.getVerifier(method_gen.getClassName()));
209            ev.setFrame(workingFrame);
210            getInstruction().accept(ev);
211            // getInstruction().accept(ExecutionVisitor.withFrame(workingFrame));
212            outFrames.put(lastExecutionJSR(), workingFrame);
213
214            return true; // new inFrame was different from old inFrame so merging them
215                         // yielded a different this.inFrame.
216        }
217
218        /**
219         * Extends the StructuralCodeConstraintException ("e") object with an at-the-end-extended message. This extended message
220         * will then reflect the execution flow needed to get to the constraint violation that triggered the throwing of the "e"
221         * object.
222         */
223        private void extendMessageWithFlow(final StructuralCodeConstraintException e) {
224            final String s = "Execution flow:\n";
225            e.extendMessage("", s + getExecutionChain());
226        }
227
228        /**
229         * Returns the exception handlers of this instruction.
230         */
231        @Override
232        public ExceptionHandler[] getExceptionHandlers() {
233            return exceptionhandlers.getExceptionHandlers(getInstruction());
234        }
235
236        /**
237         * Returns the control flow execution chain. This is built while execute(Frame, ArrayList)-ing the code represented by
238         * the surrounding ControlFlowGraph.
239         */
240        private String getExecutionChain() {
241            final StringBuilder s = new StringBuilder(this.toString());
242            for (int i = executionPredecessors.size() - 1; i >= 0; i--) {
243                s.insert(0, executionPredecessors.get(i) + "\n");
244            }
245            return s.toString();
246        }
247
248        @Override
249        public Frame getInFrame() {
250            Frame org;
251
252            final InstructionContext jsr = lastExecutionJSR();
253
254            org = inFrames.get(jsr);
255
256            if (org == null) {
257                throw new AssertionViolatedException("inFrame not set! This:\n" + this + "\nInFrames: '" + inFrames + "'.");
258            }
259            return org.getClone();
260        }
261
262        /*
263         * Fulfils the contract of InstructionContext.getInstruction().
264         */
265        @Override
266        public InstructionHandle getInstruction() {
267            return instruction;
268        }
269
270        /**
271         * Returns a clone of the "outgoing" frame situation with respect to the given ExecutionChain.
272         */
273        @Override
274        public Frame getOutFrame(final ArrayList<InstructionContext> execChain) {
275            executionPredecessors = execChain;
276
277            Frame org;
278
279            final InstructionContext jsr = lastExecutionJSR();
280
281            org = outFrames.get(jsr);
282
283            if (org == null) {
284                throw new AssertionViolatedException(
285                    "outFrame not set! This:\n" + this + "\nExecutionChain: " + getExecutionChain() + "\nOutFrames: '" + outFrames + "'.");
286            }
287            return org.getClone();
288        }
289
290        /* Satisfies InstructionContext.getSuccessors(). */
291        @Override
292        public InstructionContext[] getSuccessors() {
293            return contextsOf(_getSuccessors());
294        }
295
296        /* Satisfies InstructionContext.getTag(). */
297        @Override
298        public int getTag() {
299            return TAG;
300        }
301
302        /**
303         * Returns the InstructionContextImpl with an JSR/JSR_W that was last in the ExecutionChain, without a corresponding
304         * RET, i.e. we were called by this one. Returns null if we were called from the top level.
305         */
306        private InstructionContextImpl lastExecutionJSR() {
307
308            final int size = executionPredecessors.size();
309            int retcount = 0;
310
311            for (int i = size - 1; i >= 0; i--) {
312                final InstructionContextImpl current = (InstructionContextImpl) executionPredecessors.get(i);
313                final Instruction currentlast = current.getInstruction().getInstruction();
314                if (currentlast instanceof RET) {
315                    retcount++;
316                }
317                if (currentlast instanceof JsrInstruction) {
318                    retcount--;
319                    if (retcount == -1) {
320                        return current;
321                    }
322                }
323            }
324            return null;
325        }
326
327        /**
328         * Does the actual merging (vmspec2, page 146). Returns true IFF this.inFrame was changed in course of merging with
329         * inFrame.
330         */
331        private boolean mergeInFrames(final Frame inFrame) {
332            // TODO: Can be performance-improved.
333            final Frame inF = inFrames.get(lastExecutionJSR());
334            final OperandStack oldstack = inF.getStack().getClone();
335            final LocalVariables oldlocals = inF.getLocals().getClone();
336            try {
337                inF.getStack().merge(inFrame.getStack());
338                inF.getLocals().merge(inFrame.getLocals());
339            } catch (final StructuralCodeConstraintException sce) {
340                extendMessageWithFlow(sce);
341                throw sce;
342            }
343            return !(oldstack.equals(inF.getStack()) && oldlocals.equals(inF.getLocals()));
344        }
345
346        /* Satisfies InstructionContext.setTag(int). */
347        @Override
348        public void setTag(final int tag) { // part of InstructionContext interface
349            TAG = tag;
350        }
351
352        /**
353         * Returns a simple String representation of this InstructionContext.
354         */
355        @Override
356        public String toString() {
357            // TODO: Put information in the brackets, e.g.
358            // Is this an ExceptionHandler? Is this a RET? Is this the start of
359            // a subroutine?
360            return getInstruction().toString(false) + "\t[InstructionContext]";
361        }
362
363    } // End Inner InstructionContextImpl Class.
364
365    /// ** The MethodGen object we're working on. */
366    // private final MethodGen method_gen;
367
368    /** The Subroutines object for the method whose control flow is represented by this ControlFlowGraph. */
369    private final Subroutines subroutines;
370
371    /** The ExceptionHandlers object for the method whose control flow is represented by this ControlFlowGraph. */
372    private final ExceptionHandlers exceptionhandlers;
373
374    /** All InstructionContext instances of this ControlFlowGraph. */
375    private final Map<InstructionHandle, InstructionContext> instructionContexts = new HashMap<>();
376
377    /**
378     * A Control Flow Graph; with additional JustIce checks
379     *
380     * @param methodGen the method generator instance
381     */
382    public ControlFlowGraph(final MethodGen methodGen) {
383        this(methodGen, true);
384    }
385
386    /**
387     * A Control Flow Graph.
388     *
389     * @param methodGen the method generator instance
390     * @param enableJustIceCheck if true, additional JustIce checks are performed
391     * @since 6.0
392     */
393    public ControlFlowGraph(final MethodGen methodGen, final boolean enableJustIceCheck) {
394        subroutines = new Subroutines(methodGen, enableJustIceCheck);
395        exceptionhandlers = new ExceptionHandlers(methodGen);
396
397        final InstructionHandle[] instructionhandles = methodGen.getInstructionList().getInstructionHandles();
398        for (final InstructionHandle instructionhandle : instructionhandles) {
399            instructionContexts.put(instructionhandle, new InstructionContextImpl(instructionhandle));
400        }
401
402        // this.method_gen = method_gen;
403    }
404
405    /**
406     * Returns the InstructionContext of a given instruction.
407     */
408    public InstructionContext contextOf(final InstructionHandle inst) {
409        final InstructionContext ic = instructionContexts.get(inst);
410        if (ic == null) {
411            throw new AssertionViolatedException("InstructionContext requested for an InstructionHandle that's not known!");
412        }
413        return ic;
414    }
415
416    /**
417     * Returns the InstructionContext[] of a given InstructionHandle[], in a naturally ordered manner.
418     */
419    public InstructionContext[] contextsOf(final InstructionHandle[] insts) {
420        final InstructionContext[] ret = new InstructionContext[insts.length];
421        Arrays.setAll(ret, i -> contextOf(insts[i]));
422        return ret;
423    }
424
425    /**
426     * Returns an InstructionContext[] with all the InstructionContext instances for the method whose control flow is
427     * represented by this ControlFlowGraph <B>(NOT ORDERED!)</B>.
428     */
429    public InstructionContext[] getInstructionContexts() {
430        final InstructionContext[] ret = new InstructionContext[instructionContexts.size()];
431        return instructionContexts.values().toArray(ret);
432    }
433
434    /**
435     * Returns true, if and only if the said instruction is not reachable; that means, if it is not part of this
436     * ControlFlowGraph.
437     */
438    public boolean isDead(final InstructionHandle i) {
439        return subroutines.subroutineOf(i) == null;
440    }
441}