/******************************************************************************
* Copyright (c) 2002 - 2014 IBM Corporation.
* All rights reserved. This program and the accompanying materials
* are made available under the terms of the Eclipse Public License v1.0
* which accompanies this distribution, and is available at
* http://www.eclipse.org/legal/epl-v10.html
*
* Contributors:
* IBM Corporation - initial API and implementation
*****************************************************************************/
package com.ibm.wala.cfg.exc.intra;
import java.util.Collection;
import java.util.HashSet;
import java.util.Iterator;
import java.util.LinkedList;
import java.util.List;
import java.util.Set;
import com.ibm.wala.cfg.ControlFlowGraph;
import com.ibm.wala.dataflow.graph.DataflowSolver;
import com.ibm.wala.ipa.cfg.PrunedCFG;
import com.ibm.wala.ssa.IR;
import com.ibm.wala.ssa.ISSABasicBlock;
import com.ibm.wala.ssa.SSAAbstractInvokeInstruction;
import com.ibm.wala.ssa.SSAArrayLengthInstruction;
import com.ibm.wala.ssa.SSAArrayLoadInstruction;
import com.ibm.wala.ssa.SSAArrayStoreInstruction;
import com.ibm.wala.ssa.SSABinaryOpInstruction;
import com.ibm.wala.ssa.SSACheckCastInstruction;
import com.ibm.wala.ssa.SSAComparisonInstruction;
import com.ibm.wala.ssa.SSAConditionalBranchInstruction;
import com.ibm.wala.ssa.SSAConversionInstruction;
import com.ibm.wala.ssa.SSAGetCaughtExceptionInstruction;
import com.ibm.wala.ssa.SSAGetInstruction;
import com.ibm.wala.ssa.SSAGotoInstruction;
import com.ibm.wala.ssa.SSAInstanceofInstruction;
import com.ibm.wala.ssa.SSAInstruction;
import com.ibm.wala.ssa.SSAInstruction.IVisitor;
import com.ibm.wala.ssa.SSAInvokeInstruction;
import com.ibm.wala.ssa.SSALoadMetadataInstruction;
import com.ibm.wala.ssa.SSAMonitorInstruction;
import com.ibm.wala.ssa.SSANewInstruction;
import com.ibm.wala.ssa.SSAPhiInstruction;
import com.ibm.wala.ssa.SSAPiInstruction;
import com.ibm.wala.ssa.SSAPutInstruction;
import com.ibm.wala.ssa.SSAReturnInstruction;
import com.ibm.wala.ssa.SSASwitchInstruction;
import com.ibm.wala.ssa.SSAThrowInstruction;
import com.ibm.wala.ssa.SSAUnaryOpInstruction;
import com.ibm.wala.types.TypeReference;
import com.ibm.wala.util.CancelException;
import com.ibm.wala.util.MonitorUtil.IProgressMonitor;
import com.ibm.wala.util.graph.Graph;
import com.ibm.wala.util.graph.impl.SparseNumberedGraph;
/**
* Intraprocedural dataflow analysis to detect impossible NullPointerExceptions.
*
* @author Juergen Graf <graf@kit.edu>
*
*/
public class IntraprocNullPointerAnalysis<T extends ISSABasicBlock> {
private NullPointerSolver<T> solver;
private final Set<TypeReference> ignoreExceptions;
private final IR ir;
private final ControlFlowGraph<SSAInstruction, T> cfg;
private final int maxVarNum;
private int deletedEdges;
private ControlFlowGraph<SSAInstruction, T> pruned = null;
private final ParameterState initialState;
private final MethodState mState;
IntraprocNullPointerAnalysis(IR ir, ControlFlowGraph<SSAInstruction, T> cfg,
TypeReference[] ignoreExceptions, ParameterState initialState, MethodState mState) {
this.cfg = cfg;
this.ir = ir;
if (ir == null || ir.isEmptyIR()) {
maxVarNum = -1;
} else {
maxVarNum = ir.getSymbolTable().getMaxValueNumber();
}
this.ignoreExceptions = new HashSet<TypeReference>();
if (ignoreExceptions != null) {
for (TypeReference tRef : ignoreExceptions) {
this.ignoreExceptions.add(tRef);
}
}
this.initialState = initialState;
this.mState = mState;
}
private static <T extends ISSABasicBlock> List<T>
searchNodesWithPathToCatchAll(ControlFlowGraph<SSAInstruction, T> cfg) {
final List<T> nodes = new LinkedList<T>();
for (final T exp : cfg) {
final List<T> excSucc = cfg.getExceptionalSuccessors(exp);
if (excSucc != null && excSucc.size() > 1) {
boolean foundExit = false;
boolean foundCatchAll = false;
for (final T succ : excSucc) {
if (succ.isExitBlock()) {
foundExit = true;
} else if (succ.isCatchBlock()) {
final Iterator<TypeReference> caught = succ.getCaughtExceptionTypes();
while (caught.hasNext()) {
final TypeReference t = caught.next();
if (t.equals(TypeReference.JavaLangException) || t.equals(TypeReference.JavaLangThrowable)) {
foundCatchAll = true;
}
}
}
}
if (foundExit && foundCatchAll) {
nodes.add(exp);
}
}
}
return nodes;
}
void run(IProgressMonitor progress) throws CancelException {
if (pruned == null) {
if (ir == null || ir.isEmptyIR()) {
pruned = cfg;
} else {
final List<T> catched = searchNodesWithPathToCatchAll(cfg);
final NullPointerFrameWork<T> problem = new NullPointerFrameWork<T>(cfg, ir);
final int[] paramValNum = ir.getParameterValueNumbers();
solver = new NullPointerSolver<T>(problem, maxVarNum, paramValNum, initialState);
solver.solve(progress);
final Graph<T> deleted = createDeletedGraph(solver);
for (final T ch : catched) {
deleted.addNode(ch);
deleted.addNode(cfg.exit());
deleted.addEdge(ch, cfg.exit());
}
for (T node : deleted) {
deletedEdges += deleted.getSuccNodeCount(node);
}
final NegativeGraphFilter<T> filter = new NegativeGraphFilter<T>(deleted);
final PrunedCFG<SSAInstruction, T> newCfg = PrunedCFG.make(cfg, filter);
pruned = newCfg;
}
}
}
private Graph<T> createDeletedGraph(NullPointerSolver<T> solver) {
NegativeCFGBuilderVisitor nCFGbuilder = new NegativeCFGBuilderVisitor(solver);
for (T bb : cfg) {
nCFGbuilder.work(bb);
}
Graph<T> deleted = nCFGbuilder.getNegativeCFG();
return deleted;
}
ControlFlowGraph<SSAInstruction, T> getPrunedCFG() {
if (pruned == null) {
throw new IllegalStateException("Run analysis first! (call run())");
}
return pruned;
}
int getNumberOfDeletedEdges() {
if (pruned == null) {
throw new IllegalStateException("Run analysis first! (call run())");
}
return deletedEdges;
}
public NullPointerState getState(T block) {
assert pruned != null || solver != null : "No solver initialized for method " + ir.getMethod().toString();
if (pruned != null && solver == null) {
// empty IR ... so states have not changed and we can return the initial state as a save approximation
return new NullPointerState(maxVarNum, ir.getSymbolTable(), initialState);
} else {
return solver.getIn(block);
}
}
private class NullPointerSolver<B extends ISSABasicBlock> extends DataflowSolver<B, NullPointerState> {
private final int maxVarNum;
private final ParameterState parameterState;
private NullPointerSolver(NullPointerFrameWork<B> problem, int maxVarNum, int[] paramVarNum) {
this(problem, maxVarNum, paramVarNum, null);
}
private NullPointerSolver(NullPointerFrameWork<B> problem, int maxVarNum, int[] paramVarNum, ParameterState initialState) {
super(problem);
this.maxVarNum = maxVarNum;
this.parameterState = initialState;
}
/* (non-Javadoc)
* @see com.ibm.wala.dataflow.graph.DataflowSolver#makeEdgeVariable(java.lang.Object, java.lang.Object)
*/
@Override
protected NullPointerState makeEdgeVariable(B src, B dst) {
return new NullPointerState(maxVarNum, ir.getSymbolTable(), parameterState);
}
/* (non-Javadoc)
* @see com.ibm.wala.dataflow.graph.DataflowSolver#makeNodeVariable(java.lang.Object, boolean)
*/
@Override
protected NullPointerState makeNodeVariable(B n, boolean IN) {
return new NullPointerState(maxVarNum, ir.getSymbolTable(), parameterState);
}
@Override
protected NullPointerState[] makeStmtRHS(int size) {
return new NullPointerState[size];
}
}
private class NegativeCFGBuilderVisitor implements IVisitor {
private final Graph<T> deleted;
private final NullPointerSolver<T> solver;
private NegativeCFGBuilderVisitor(NullPointerSolver<T> solver) {
this.solver = solver;
this.deleted = new SparseNumberedGraph<T>(2);
for (T bb : cfg) {
deleted.addNode(bb);
}
}
private NullPointerState currentState;
private T currentBlock;
public void work(T bb) {
if (bb == null) {
throw new IllegalArgumentException("Null not allowed");
} else if (!cfg.containsNode(bb)) {
throw new IllegalArgumentException("Block not part of current CFG");
}
SSAInstruction instr = NullPointerTransferFunctionProvider.getRelevantInstruction(bb);
if (instr != null) {
currentState = solver.getIn(bb);
currentBlock = bb;
instr.visit(this);
currentState = null;
currentBlock = null;
}
}
public Graph<T> getNegativeCFG() {
return deleted;
}
/**
* We have to be careful here. If the invoke instruction can not throw a NullPointerException,
* because the reference object is not null, the method itself may throw a NullPointerException.
* So we can only remove the edge if the method itself throws no exception.
*/
private boolean isOnlyNullPointerExc(SSAInstruction instr) {
assert instr.isPEI();
if (instr instanceof SSAAbstractInvokeInstruction) {
return mState != null && !mState.throwsException((SSAAbstractInvokeInstruction) instr);
} else {
Collection<TypeReference> exc = instr.getExceptionTypes();
Set<TypeReference> myExcs = new HashSet<TypeReference>(exc);
myExcs.removeAll(ignoreExceptions);
return myExcs.size() == 1 && myExcs.contains(TypeReference.JavaLangNullPointerException);
}
}
private boolean noExceptions(SSAInstruction instr) {
assert instr.isPEI();
if (instr instanceof SSAAbstractInvokeInstruction) {
return mState != null && !mState.throwsException((SSAAbstractInvokeInstruction) instr);
} else {
Collection<TypeReference> exc = instr.getExceptionTypes();
Set<TypeReference> myExcs = new HashSet<TypeReference>(exc);
myExcs.removeAll(ignoreExceptions);
return myExcs.isEmpty();
}
}
private void removeImpossibleSuccessors(SSAInstruction instr, int varNum) {
if (isOnlyNullPointerExc(instr)) {
if (currentState.isNeverNull(varNum)) {
for (T succ : cfg.getExceptionalSuccessors(currentBlock)) {
deleted.addEdge(currentBlock, succ);
}
} else if (currentState.isAlwaysNull(varNum)) {
for (T succ : cfg.getNormalSuccessors(currentBlock)) {
deleted.addEdge(currentBlock, succ);
}
}
}
}
private void removeImpossibleSuccessors(SSAInstruction instr) {
if (noExceptions(instr)) {
for (T succ : cfg.getExceptionalSuccessors(currentBlock)) {
deleted.addEdge(currentBlock, succ);
}
}
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitArrayLength(com.ibm.wala.ssa.SSAArrayLengthInstruction)
*/
@Override
public void visitArrayLength(SSAArrayLengthInstruction instruction) {
int varNum = instruction.getArrayRef();
removeImpossibleSuccessors(instruction, varNum);
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitArrayLoad(com.ibm.wala.ssa.SSAArrayLoadInstruction)
*/
@Override
public void visitArrayLoad(SSAArrayLoadInstruction instruction) {
int varNum = instruction.getArrayRef();
removeImpossibleSuccessors(instruction, varNum);
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitArrayStore(com.ibm.wala.ssa.SSAArrayStoreInstruction)
*/
@Override
public void visitArrayStore(SSAArrayStoreInstruction instruction) {
int varNum = instruction.getArrayRef();
removeImpossibleSuccessors(instruction, varNum);
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitBinaryOp(com.ibm.wala.ssa.SSABinaryOpInstruction)
*/
@Override
public void visitBinaryOp(SSABinaryOpInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitCheckCast(com.ibm.wala.ssa.SSACheckCastInstruction)
*/
@Override
public void visitCheckCast(SSACheckCastInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitComparison(com.ibm.wala.ssa.SSAComparisonInstruction)
*/
@Override
public void visitComparison(SSAComparisonInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitConditionalBranch(com.ibm.wala.ssa.SSAConditionalBranchInstruction)
*/
@Override
public void visitConditionalBranch(SSAConditionalBranchInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitConversion(com.ibm.wala.ssa.SSAConversionInstruction)
*/
@Override
public void visitConversion(SSAConversionInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitGet(com.ibm.wala.ssa.SSAGetInstruction)
*/
@Override
public void visitGet(SSAGetInstruction instruction) {
if (!instruction.isStatic()) {
int varNum = instruction.getRef();
removeImpossibleSuccessors(instruction, varNum);
}
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitGetCaughtException(com.ibm.wala.ssa.SSAGetCaughtExceptionInstruction)
*/
@Override
public void visitGetCaughtException(SSAGetCaughtExceptionInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitGoto(com.ibm.wala.ssa.SSAGotoInstruction)
*/
@Override
public void visitGoto(SSAGotoInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitInstanceof(com.ibm.wala.ssa.SSAInstanceofInstruction)
*/
@Override
public void visitInstanceof(SSAInstanceofInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitInvoke(com.ibm.wala.ssa.SSAInvokeInstruction)
*/
@Override
public void visitInvoke(SSAInvokeInstruction instruction) {
if (!instruction.isStatic()) {
int varNum = instruction.getReceiver();
removeImpossibleSuccessors(instruction, varNum);
} else {
removeImpossibleSuccessors(instruction);
}
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitLoadMetadata(com.ibm.wala.ssa.SSALoadMetadataInstruction)
*/
@Override
public void visitLoadMetadata(SSALoadMetadataInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitMonitor(com.ibm.wala.ssa.SSAMonitorInstruction)
*/
@Override
public void visitMonitor(SSAMonitorInstruction instruction) {
int varNum = instruction.getRef();
removeImpossibleSuccessors(instruction, varNum);
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitNew(com.ibm.wala.ssa.SSANewInstruction)
*/
@Override
public void visitNew(SSANewInstruction instruction) {
removeImpossibleSuccessors(instruction);
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitPhi(com.ibm.wala.ssa.SSAPhiInstruction)
*/
@Override
public void visitPhi(SSAPhiInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitPi(com.ibm.wala.ssa.SSAPiInstruction)
*/
@Override
public void visitPi(SSAPiInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitPut(com.ibm.wala.ssa.SSAPutInstruction)
*/
@Override
public void visitPut(SSAPutInstruction instruction) {
if (!instruction.isStatic()) {
int varNum = instruction.getRef();
removeImpossibleSuccessors(instruction, varNum);
}
}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitReturn(com.ibm.wala.ssa.SSAReturnInstruction)
*/
@Override
public void visitReturn(SSAReturnInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitSwitch(com.ibm.wala.ssa.SSASwitchInstruction)
*/
@Override
public void visitSwitch(SSASwitchInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitThrow(com.ibm.wala.ssa.SSAThrowInstruction)
*/
@Override
public void visitThrow(SSAThrowInstruction instruction) {}
/* (non-Javadoc)
* @see com.ibm.wala.ssa.SSAInstruction.IVisitor#visitUnaryOp(com.ibm.wala.ssa.SSAUnaryOpInstruction)
*/
@Override
public void visitUnaryOp(SSAUnaryOpInstruction instruction) {}
}
}