// Copyright (c) 2016 Daniel Grunwald // // Permission is hereby granted, free of charge, to any person obtaining a copy of this // software and associated documentation files (the "Software"), to deal in the Software // without restriction, including without limitation the rights to use, copy, modify, merge, // publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons // to whom the Software is furnished to do so, subject to the following conditions: // // The above copyright notice and this permission notice shall be included in all copies or // substantial portions of the Software. // // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, // INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR // PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE // FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER // DEALINGS IN THE SOFTWARE. using System; using System.Collections; using System.Collections.Generic; using System.Collections.Immutable; using System.Diagnostics; using System.Linq; using ICSharpCode.Decompiler.IL; namespace ICSharpCode.Decompiler.FlowAnalysis { /// /// Implements the "reaching definitions" analysis. /// /// https://en.wikipedia.org/wiki/Reaching_definition /// /// By "definitions", we mean stores to local variables. /// /// /// Possible "definitions" that store to a variable are: /// * StLoc /// * TryCatchHandler (for the exception variable) /// * ReachingDefinitions.UninitializedVariable for uninitialized variables. /// Note that we do not keep track of LdLoca/references/pointers. /// The analysis will likely be wrong/incomplete for variables with AddressCount != 0. /// public class ReachingDefinitions { #region State representation /// /// The state during the reaching definitions analysis. /// /// /// A state can either be reachable, or unreachable: /// 1) unreachable /// Note that during the analysis, "unreachable" just means we have not yet found a path /// from the entry point to the node. States transition from unreachable to reachable as /// the analysis processes more control flow paths. /// 2) reachable /// In this case, the state contains, for each variable, the set of stores that might have /// written to the variable before the control flow reached the state's source code position. /// This set does not include stores that were definitely overwritten by other stores to the /// same variable. /// During the analysis, the set of stores gets extended as the analysis processes more code paths. /// /// The reachable state could be represented as a `Dictionary{ILVariable, ISet{ILInstruction}}`. /// To consume less memory, we instead assign an integer index to all stores in the analyzed function ("store index"), /// and store the state as a `BitSet` instead. /// Each bit in the set corresponds to one store instruction, and is `true` iff the store is a reaching definition /// for the variable it is storing to. /// The `allStores` array has the same length as the bit sets and holds the corresponding `ILInstruction` objects (store instructions). /// All stores for a single variable occupy a contiguous segment of the `allStores` array (and thus also of the `state`), /// which allows us to efficient clear out all stores that get overwritten by a new store. /// [DebuggerDisplay("{bits}")] struct State : IDataFlowState { /// /// bit 0: This state's position is reachable from the entry point. /// bit i+1: There is a code path from the entry point to this state's position /// that passes through through allStores[i] and does not pass through another /// store to allStores[i].Variable. /// readonly internal BitSet bits; public State(BitSet bits) { this.bits = bits; } public bool LessThanOrEqual(State otherState) { return bits.IsSubsetOf(otherState.bits); } public State Clone() { return new State(bits.Clone()); } public void ReplaceWith(State newContent) { bits.ReplaceWith(newContent.bits); } public void JoinWith(State incomingState) { bits.UnionWith(incomingState.bits); } public void MeetWith(State incomingState) { bits.IntersectWith(incomingState.bits); } public void MarkUnreachable() { bits.ClearAll(); } public bool IsUnreachable { get { return !bits[ReachableBit]; } } } /// /// To distinguish unreachable from reachable states, we use the first bit in the bitset to store the 'reachable bit'. /// If this bit is set, the state is reachable, and the remaining bits /// const int ReachableBit = 0; /// /// Because bit number 0 is the ReachableBit, we start counting store indices at 1. /// const int FirstStoreIndex = 1; #endregion #region Documentation + member fields /// /// A special Nop instruction that gets used as a fake store if the variable /// is possibly uninitialized. /// public static readonly ILInstruction UninitializedVariable = new Nop(); /// /// The function being analyzed. /// readonly ILVariableScope scope; /// /// All stores for all variables in the scope. /// /// state[storeIndex] is true iff allStores[storeIndex] is a reaching definition. /// Invariant: state.bits.Length == allStores.Length. /// readonly ILInstruction[] allStores; /// /// Maps instructions appearing in allStores to their index. /// /// Invariant: allStores[storeIndexMap[inst]] == inst /// /// Does not contain UninitializedVariable (as that special instruction has multiple store indices, one per variable) /// readonly Dictionary storeIndexMap = new Dictionary(); /// /// For all variables v: allStores[firstStoreIndexForVariable[v.IndexInScope]] is the UninitializedVariable entry for v. /// The next few stores (up to firstStoreIndexForVariable[v.IndexInScope + 1], exclusive) are the full list of stores for v. /// /// /// Invariant: firstStoreIndexForVariable[scope.Variables.Count] == allStores.Length /// readonly int[] firstStoreIndexForVariable; /// /// activeVariable[v.IndexInScope] is true iff RD analysis is enabled for the variable. /// readonly BitSet activeVariables; #endregion #region Constructor /// /// Run reaching definitions analysis for the specified variable scope. /// public ReachingDefinitions(ILVariableScope scope, Predicate pred) : this(scope, GetActiveVariableBitSet(scope, pred)) { } static BitSet GetActiveVariableBitSet(ILVariableScope scope, Predicate pred) { if (scope == null) throw new ArgumentNullException("scope"); BitSet activeVariables = new BitSet(scope.Variables.Count); for (int vi = 0; vi < scope.Variables.Count; vi++) { activeVariables[vi] = pred(scope.Variables[vi]); } return activeVariables; } /// /// Run reaching definitions analysis for the specified variable scope. /// public ReachingDefinitions(ILVariableScope scope, BitSet activeVariables) { if (scope == null) throw new ArgumentNullException("scope"); if (activeVariables == null) throw new ArgumentNullException("activeVariables"); this.scope = scope; this.activeVariables = activeVariables; // Fill `allStores` and `storeIndexMap` and `firstStoreIndexForVariable`. var storesByVar = FindAllStoresByVariable(scope, activeVariables); allStores = new ILInstruction[FirstStoreIndex + storesByVar.Sum(l => l != null ? l.Count : 0)]; firstStoreIndexForVariable = new int[scope.Variables.Count + 1]; int si = FirstStoreIndex; for (int vi = 0; vi < storesByVar.Length; vi++) { firstStoreIndexForVariable[vi] = si; var stores = storesByVar[vi]; if (stores != null) { int expectedStoreCount = scope.Variables[vi].StoreCount; if (!scope.Variables[vi].HasInitialValue) { // Extra store for UninitializedVariable expectedStoreCount += 1; // Note that for variables with HasInitialValue=true, // this extra store is already accounted for in ILVariable.StoreCount. } Debug.Assert(stores.Count == expectedStoreCount); stores.CopyTo(allStores, si); // Add all stores except for UninitializedVariable to storeIndexMap. for (int i = 1; i < stores.Count; i++) { storeIndexMap.Add(stores[i], si + i); } si += stores.Count; } } firstStoreIndexForVariable[scope.Variables.Count] = si; Debug.Assert(si == allStores.Length); RDVisitor visitor = new RDVisitor(this); scope.Children.Single().AcceptVisitor(visitor); } /// /// Fill allStores and storeIndexMap. /// static List[] FindAllStoresByVariable(ILVariableScope scope, BitSet activeVariables) { // For each variable, find the list of ILInstructions storing to that variable List[] storesByVar = new List[scope.Variables.Count]; for (int vi = 0; vi < storesByVar.Length; vi++) { if (activeVariables[vi]) storesByVar[vi] = new List { UninitializedVariable }; } foreach (var inst in scope.Descendants) { ILVariable v; if (inst.MatchStLoc(out v) || inst.MatchTryCatchHandler(out v)) { if (v.Scope == scope && activeVariables[v.IndexInScope]) { storesByVar[v.IndexInScope].Add(inst); } } } return storesByVar; } #endregion #region CreateInitialState /// /// Create the initial state (reachable + all variables uninitialized). /// State CreateInitialState() { BitSet initialState = new BitSet(allStores.Length); initialState.Set(ReachableBit); for (int vi = 0; vi < scope.Variables.Count; vi++) { if (activeVariables[vi]) { Debug.Assert(allStores[firstStoreIndexForVariable[vi]] == UninitializedVariable); initialState.Set(firstStoreIndexForVariable[vi]); } } return new State(initialState); } #endregion /// /// Visitor that traverses the ILInstruction tree. /// class RDVisitor : DataFlowVisitor { readonly ReachingDefinitions rd; internal RDVisitor(ReachingDefinitions rd) : base(rd.CreateInitialState()) { this.rd = rd; } void HandleStore(ILInstruction inst, ILVariable v) { if (v.Scope == rd.scope && rd.activeVariables[v.IndexInScope] && !state.IsUnreachable) { // Clear the set of stores for this variable: state.bits.Clear(rd.firstStoreIndexForVariable[v.IndexInScope], rd.firstStoreIndexForVariable[v.IndexInScope + 1]); // And replace it with this store: state.bits.Set(rd.storeIndexMap[inst]); } } protected internal override void VisitStLoc(StLoc inst) { base.VisitStLoc(inst); HandleStore(inst, inst.Variable); } protected override void BeginTryCatchHandler(TryCatchHandler inst) { HandleStore(inst, inst.Variable); } } } }