|
// Copyright (c) .NET Foundation and contributors. All rights reserved.
// Licensed under the MIT license. See LICENSE file in the project root for full license information.
using System;
using System.Collections.Immutable;
using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using ILLink.RoslynAnalyzer.TrimAnalysis;
using ILLink.Shared.DataFlow;
using Microsoft.CodeAnalysis;
using Microsoft.CodeAnalysis.FlowAnalysis;
using Microsoft.CodeAnalysis.Operations;
namespace ILLink.RoslynAnalyzer.DataFlow
{
// Visitor which tracks the values of locals in a block. It provides extension points that get called
// whenever a value that comes from a tracked local reference flows into one of the following:
// - field
// - parameter
// - method return
public abstract class LocalDataFlowVisitor<TValue, TContext, TValueLattice, TContextLattice, TConditionValue> :
OperationWalker<LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice>, TValue>,
ITransfer<
BlockProxy,
LocalStateAndContext<TValue, TContext>,
LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice>,
LocalStateAndContextLattice<TValue, TContext, TValueLattice, TContextLattice>,
TConditionValue>
// This struct constraint prevents warnings due to possible null returns from the visitor methods.
// Note that this assumes that default(TValue) is equal to the TopValue.
where TValue : struct, IEquatable<TValue>
where TContext : struct, IEquatable<TContext>
where TValueLattice : ILattice<TValue>
where TContextLattice : ILattice<TContext>
where TConditionValue : struct, INegate<TConditionValue>
{
protected readonly LocalStateAndContextLattice<TValue, TContext, TValueLattice, TContextLattice> LocalStateAndContextLattice;
protected readonly InterproceduralStateLattice<TValue, TValueLattice> InterproceduralStateLattice;
protected readonly Compilation Compilation;
protected readonly ISymbol OwningSymbol;
private readonly ControlFlowGraph ControlFlowGraph;
protected TValue TopValue => LocalStateAndContextLattice.LocalStateLattice.Lattice.ValueLattice.Top;
private readonly ImmutableDictionary<CaptureId, FlowCaptureKind> lValueFlowCaptures;
public InterproceduralState<TValue, TValueLattice> InterproceduralState;
private bool IsLValueFlowCapture(CaptureId captureId)
=> lValueFlowCaptures.ContainsKey(captureId);
private bool IsRValueFlowCapture(CaptureId captureId)
=> !lValueFlowCaptures.TryGetValue(captureId, out var captureKind) || captureKind != FlowCaptureKind.LValueCapture;
public LocalDataFlowVisitor(
Compilation compilation,
LocalStateAndContextLattice<TValue, TContext, TValueLattice, TContextLattice> lattice,
ISymbol owningSymbol,
ControlFlowGraph cfg,
ImmutableDictionary<CaptureId, FlowCaptureKind> lValueFlowCaptures,
InterproceduralState<TValue, TValueLattice> interproceduralState)
{
Compilation = compilation;
LocalStateAndContextLattice = lattice;
InterproceduralStateLattice = default;
OwningSymbol = owningSymbol;
ControlFlowGraph = cfg;
this.lValueFlowCaptures = lValueFlowCaptures;
InterproceduralState = interproceduralState;
}
public abstract void ApplyCondition(TConditionValue condition, ref LocalStateAndContext<TValue, TContext> localContextState);
public TConditionValue? Transfer(
BlockProxy block,
LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
foreach (IOperation operation in block.Block.Operations)
Visit(operation, state);
// Blocks may end with a BranchValue computation. Visit the BranchValue operation after all others.
IOperation? branchValueOperation = block.Block.BranchValue;
if (branchValueOperation == null)
return null;
var branchValue = Visit(branchValueOperation, state);
TConditionValue conditionValue = GetConditionValue(branchValueOperation, state);
if (block.Block.ConditionKind != ControlFlowConditionKind.None)
{
// BranchValue may represent a value used in a conditional branch to the ConditionalSuccessor.
// If so, give the analysis an opportunity to model the checked condition, and return the model
// of the condition back to the generic analysis. It will be applied to the state of each outgoing branch.
return conditionValue;
}
// If not, the BranchValue represents a return or throw value associated with the FallThroughSuccessor of this block.
// (ConditionalSuccessor == null iff ConditionKind == None).
// If we get here, we should be analyzing code in a method or field/property initializer,
// not an attribute instance, since attributes can't have throws or return statements
Debug.Assert(OwningSymbol is IMethodSymbol or IFieldSymbol or IPropertySymbol,
$"{OwningSymbol.GetType()}: {branchValueOperation.Syntax.GetLocation().GetLineSpan()}");
// The BranchValue for a thrown value is not involved in dataflow tracking.
if (block.Block.FallThroughSuccessor?.Semantics == ControlFlowBranchSemantics.Throw)
return null;
// Field/property initializers can't have return statements.
Debug.Assert(OwningSymbol is IMethodSymbol,
$"{OwningSymbol.GetType()}: {branchValueOperation.Syntax.GetLocation().GetLineSpan()}");
// Return statements with return values are represented in the control flow graph as
// a branch value operation that computes the return value.
// Use the branch value operation as the key for the warning store and the location of the warning.
// We don't want the return operation because this might have multiple possible return values in general.
var current = state.Current;
HandleReturnValue(branchValue, branchValueOperation, in current.Context);
// Must be called for every return value even if it did not return an understood condition,
// because the non-understood conditions will produce warnings for FeatureGuard properties.
HandleReturnConditionValue(conditionValue, branchValueOperation);
return null;
}
public abstract TConditionValue GetConditionValue(
IOperation branchValueOperation,
LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state);
public abstract TValue GetFieldTargetValue(IFieldReferenceOperation fieldReference, in TContext context);
public abstract TValue GetBackingFieldTargetValue(IPropertyReferenceOperation propertyReference, in TContext context);
public abstract TValue GetParameterTargetValue(IParameterSymbol parameter);
public abstract void HandleAssignment(
TValue source,
TValue target,
IOperation operation,
in TContext context);
public abstract TValue HandleArrayElementRead(TValue arrayValue, TValue indexValue, IOperation operation);
public abstract void HandleArrayElementWrite(TValue arrayValue, TValue indexValue, TValue valueToWrite, IOperation operation, bool merge);
// This takes an IOperation rather than an IReturnOperation because the return value
// may (must?) come from BranchValue of an operation whose FallThroughSuccessor is the exit block.
public abstract void HandleReturnValue(
TValue returnValue,
IOperation operation,
in TContext context);
public abstract void HandleReturnConditionValue(
TConditionValue returnConditionValue,
IOperation branchValueOperation);
// This is called for any method call, which includes:
// - Normal invocation operation
// - Accessing property value - which is treated as a call to the getter
// - Setting a property value - which is treated as a call to the setter
// All inputs are already visited and turned into values.
// The return value should be a value representing the return value from the called method.
public abstract TValue HandleMethodCall(
IMethodSymbol calledMethod,
TValue instance,
ImmutableArray<TValue> arguments,
IOperation operation,
in TContext context);
public override TValue VisitLocalReference(ILocalReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
return GetLocal(operation, state);
}
private TValue ProcessBinderCall(IOperation operation, string methodName, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
var assemblyType = Compilation.GetTypeByMetadataName("Microsoft.CSharp.RuntimeBinder.Binder");
Debug.Assert(assemblyType != null);
if (assemblyType == null)
return TopValue;
var method = assemblyType.GetMembers(methodName).OfType<IMethodSymbol>().SingleOrDefault();
Debug.Assert(method != null);
if (method == null)
return TopValue;
return ProcessMethodCall(operation, method, null, ImmutableArray<IArgumentOperation>.Empty, state);
}
public override TValue VisitDynamicInvocation(IDynamicInvocationOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
=> ProcessBinderCall(operation, "InvokeMember", state);
public override TValue VisitDynamicObjectCreation(IDynamicObjectCreationOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
=> ProcessBinderCall(operation, "InvokeConstructor", state);
public override TValue VisitDynamicMemberReference(IDynamicMemberReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
=> ProcessBinderCall(operation, operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write) ? "SetMember" : "GetMember", state);
public override TValue VisitDynamicIndexerAccess(IDynamicIndexerAccessOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
=> ProcessBinderCall(operation, operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write) ? "SetIndex" : "GetIndex", state);
private bool IsReferenceToCapturedVariable(ILocalReferenceOperation localReference)
{
var local = localReference.Local;
if (local.IsConst)
return false;
Debug.Assert(local.ContainingSymbol is IMethodSymbol or IFieldSymbol, // backing field for property initializers
$"{local.ContainingSymbol.GetType()}: {localReference.Syntax.GetLocation().GetLineSpan()}");
return !ReferenceEquals(local.ContainingSymbol, OwningSymbol);
}
private TValue GetLocal(ILocalReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
var local = new LocalKey(operation.Local);
if (IsReferenceToCapturedVariable(operation))
InterproceduralState.TrackHoistedLocal(local);
// Get the value from the hoisted locals, if it's tracked there.
if (InterproceduralState.TryGetHoistedLocal(local, out TValue? value))
return value.Value;
return state.Get(local);
}
private void SetLocal(ILocalReferenceOperation operation, TValue value, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state, bool merge = false)
{
var local = new LocalKey(operation.Local);
if (IsReferenceToCapturedVariable(operation))
InterproceduralState.TrackHoistedLocal(local);
// Update the value stored in the hoisted locals, if it's tracked there.
if (InterproceduralState.TrySetHoistedLocal(local, value))
return;
var newValue = merge
? state.Lattice.LocalStateLattice.Lattice.ValueLattice.Meet(state.Get(local), value)
: value;
state.Set(local, newValue);
}
private TValue ProcessSingleTargetAssignment(IOperation targetOperation, IAssignmentOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state, bool merge)
{
switch (targetOperation)
{
case IFieldReferenceOperation:
case IParameterReferenceOperation:
{
var current = state.Current;
TValue targetValue = targetOperation switch
{
IFieldReferenceOperation fieldRef => GetFieldTargetValue(fieldRef, in current.Context),
IParameterReferenceOperation parameterRef => GetParameterTargetValue(parameterRef.Parameter),
_ => throw new InvalidOperationException()
};
TValue value = Visit(operation.Value, state);
HandleAssignment(value, targetValue, operation, in current.Context);
return value;
}
// The remaining cases don't have a dataflow value that represents LValues, so we need
// to handle the LHS specially.
case IPropertyReferenceOperation propertyRef:
{
// Avoid visiting the property reference because for captured properties, we can't
// correctly detect whether it is used for reading or writing inside of VisitPropertyReference.
// https://github.com/dotnet/roslyn/issues/25057
TValue instanceValue = Visit(propertyRef.Instance, state);
TValue value = Visit(operation.Value, state);
IMethodSymbol? setMethod = propertyRef.Property.GetSetMethod();
if (setMethod == null ||
(OwningSymbol is IPropertySymbol && (ControlFlowGraph.OriginalOperation is not IAttributeOperation)))
{
// This can be a write to a byref return of a property getter.
// Skip for now: https://github.com/dotnet/linker/issues/2158
if (propertyRef.Property.RefKind is not RefKind.None)
break;
// This can happen in a constructor - there it is possible to assign to a property
// without a setter. This turns into an assignment to the compiler-generated backing field.
// Handle this similarly to field assignments.
// Even if the property has a set method, if the assignment takes place in a property initializer,
// the write becomes a direct write to the underlying field. This should be treated the same as
// the case where there is no set method.
var current = state.Current;
TValue targetValue = GetBackingFieldTargetValue(propertyRef, in current.Context);
HandleAssignment(value, targetValue, operation, in current.Context);
return value;
}
// Property may be an indexer, in which case there will be one or more index arguments followed by a value argument
ImmutableArray<TValue>.Builder arguments = ImmutableArray.CreateBuilder<TValue>();
foreach (var val in propertyRef.Arguments)
arguments.Add(Visit(val, state));
arguments.Add(value);
HandleMethodCallHelper(setMethod, instanceValue, arguments.ToImmutableArray(), operation, state);
// The return value of a property set expression is the value,
// even though a property setter has no return value.
return value;
}
case IEventReferenceOperation eventRef:
{
// Handles assignment to an event like 'Event = Handler;', which is a write to the underlying field,
// not a call to an event accessor method. There is no Roslyn API to access the field,
// so just visit the instance and the value. https://github.com/dotnet/roslyn/issues/40103
Visit(eventRef.Instance, state);
return Visit(operation.Value, state);
}
case IImplicitIndexerReferenceOperation indexerRef:
{
// An implicit reference to an indexer where the argument is a System.Index
TValue instanceValue = Visit(indexerRef.Instance, state);
TValue indexArgumentValue = Visit(indexerRef.Argument, state);
TValue value = Visit(operation.Value, state);
var property = (IPropertySymbol)indexerRef.IndexerSymbol;
var argumentsBuilder = ImmutableArray.CreateBuilder<TValue>();
argumentsBuilder.Add(indexArgumentValue);
argumentsBuilder.Add(value);
IMethodSymbol? setMethod = property.GetSetMethod();
if (setMethod == null)
{
// It might actually be a call to a ref-returning get method,
// like Span<T>.this[int].get. We don't handle ref returns yet.
break;
}
HandleMethodCallHelper(setMethod, instanceValue, argumentsBuilder.ToImmutableArray(), operation, state);
return value;
}
// TODO: when setting a property in an attribute, target is an IPropertyReference.
case ILocalReferenceOperation localRef:
{
TValue value = Visit(operation.Value, state);
SetLocal(localRef, value, state, merge);
return value;
}
case IArrayElementReferenceOperation arrayElementRef:
{
if (arrayElementRef.Indices.Length != 1)
break;
TValue arrayRef = Visit(arrayElementRef.ArrayReference, state);
TValue index = Visit(arrayElementRef.Indices[0], state);
TValue value = Visit(operation.Value, state);
HandleArrayElementWrite(arrayRef, index, value, operation, merge: merge);
return value;
}
case IInlineArrayAccessOperation inlineArrayAccess:
{
TValue arrayRef = Visit(inlineArrayAccess.Instance, state);
TValue index = Visit(inlineArrayAccess.Argument, state);
TValue value = Visit(operation.Value, state);
HandleArrayElementWrite(arrayRef, index, value, operation, merge: merge);
return value;
}
case IDiscardOperation:
// Assignments like "_ = SomeMethod();" don't need dataflow tracking.
// Seems like this can't happen with a flow capture operation.
Debug.Assert(operation.Target is not IFlowCaptureReferenceOperation);
break;
case IInstanceReferenceOperation:
// Assignment to 'this' is not tracked currently.
// Not relevant for trimming dataflow.
case IInvocationOperation:
// This can happen for an assignment to a ref return. Skip for now.
// The analyzer doesn't handle refs yet. This should be fixed once the analyzer
// also produces warnings for ref params/locals/returns.
// https://github.com/dotnet/linker/issues/2632
// https://github.com/dotnet/linker/issues/2158
case IDynamicMemberReferenceOperation:
case IDynamicIndexerAccessOperation:
// Assignment to dynamic member/indexer will translate into a call to runtime binder methods
// which should produce warnings, but isn't relevant for dataflow.
Visit(targetOperation, state);
break;
// Keep these cases in sync with those in CapturedReferenceValue, for any that
// can show up in a flow capture reference (for example, where the right-hand side
// is a null-coalescing operator).
default:
UnexpectedOperationHandler.Handle(targetOperation);
break;
}
return Visit(operation.Value, state);
}
public override TValue VisitSimpleAssignment(ISimpleAssignmentOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
return ProcessAssignment(operation, state);
}
public override TValue VisitCompoundAssignment(ICompoundAssignmentOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
return ProcessAssignment(operation, state);
}
// Note: this is called both for normal assignments and ICompoundAssignmentOperation.
// The resulting value of a compound assignment isn't important for our dataflow analysis
// (we don't model addition of integers, for example), so we just treat these the same
// as normal assignments.
private TValue ProcessAssignment(IAssignmentOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
var targetOperation = operation.Target;
if (targetOperation is not IFlowCaptureReferenceOperation flowCaptureReference)
return ProcessSingleTargetAssignment(targetOperation, operation, state, merge: false);
// Note: technically we should avoid visiting the target operation in ProcessNonCapturedAssignment when assigning
// to a flow capture reference, because this should be done when the capture is created.
// For example, a flow capture used as both an LValue and a RValue should only evaluate the expression that
// computes the object instance of a property reference once. However, we just visit the instance again below
// for simplicity. This could be generalized if we encounter a dataflow behavior where this makes a difference.
Debug.Assert(IsLValueFlowCapture(flowCaptureReference.Id));
Debug.Assert(flowCaptureReference.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write));
var capturedReferences = state.Current.LocalState.CapturedReferences.Get(flowCaptureReference.Id);
Debug.Assert(!capturedReferences.IsUnknown());
if (!capturedReferences.HasMultipleValues)
{
// Single captured reference. Treat this as an overwriting assignment.
var enumerator = capturedReferences.GetKnownValues().GetEnumerator();
enumerator.MoveNext();
targetOperation = enumerator.Current.Reference;
return ProcessSingleTargetAssignment(targetOperation, operation, state, merge: false);
}
// The capture id may have captured multiple references, as in:
// (b ? ref v1 : ref v2) = value;
// We treat this as a possible write to each of the captured references,
// which requires merging with the previous values of each.
// Note: technically this should only visit the RHS of the assignment once.
// For now we visit the RHS in ProcessSingleTargetAssignment for simplicity, and
// rely on the warning deduplication to prevent this from producing multiple warnings
// if the RHS has dataflow warnings.
TValue value = TopValue;
foreach (var capturedReference in capturedReferences.GetKnownValues())
{
targetOperation = capturedReference.Reference;
var singleValue = ProcessSingleTargetAssignment(targetOperation, operation, state, merge: true);
value = LocalStateAndContextLattice.LocalStateLattice.Lattice.ValueLattice.Meet(value, singleValue);
}
return value;
}
public override TValue VisitEventAssignment(IEventAssignmentOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
var eventReference = (IEventReferenceOperation)operation.EventReference;
TValue instanceValue = Visit(eventReference.Instance, state);
TValue value = Visit(operation.HandlerValue, state);
if (operation.Adds)
{
IMethodSymbol? addMethod = eventReference.Event.AddMethod;
Debug.Assert(addMethod != null);
if (addMethod != null)
HandleMethodCallHelper(addMethod, instanceValue, ImmutableArray.Create(value), operation, state);
return value;
}
else
{
IMethodSymbol? removeMethod = eventReference.Event.RemoveMethod;
Debug.Assert(removeMethod != null);
if (removeMethod != null)
HandleMethodCallHelper(removeMethod, instanceValue, ImmutableArray.Create(value), operation, state);
return value;
}
}
private TValue GetFlowCaptureValue(IFlowCaptureReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
Debug.Assert(!IsLValueFlowCapture(operation.Id),
$"{operation.Syntax.GetLocation().GetLineSpan()}");
Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Read),
$"{operation.Syntax.GetLocation().GetLineSpan()}");
return state.Get(new LocalKey(operation.Id));
}
// Similar to VisitLocalReference
public override TValue VisitFlowCaptureReference(IFlowCaptureReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (operation.IsInitialization)
{
// This capture reference is a temporary byref. This can happen for string
// interpolation handlers: https://github.com/dotnet/roslyn/issues/57484.
// Should really be treated as creating a new l-value flow capture,
// but this is likely irrelevant for dataflow analysis.
// LValueFlowCaptureProvider doesn't take into account IsInitialization = true,
// so it doesn't properly detect this as an l-value capture.
// Context: https://github.com/dotnet/roslyn/issues/60757
// Debug.Assert(IsLValueFlowCapture(operation.Id));
Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write),
$"{operation.Syntax.GetLocation().GetLineSpan()}");
Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Reference),
$"{operation.Syntax.GetLocation().GetLineSpan()}");
return TopValue;
}
if (operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write))
{
// If we get here, it means we're visiting a flow capture reference that may be
// assigned to. Similar to the IsInitialization case, this can happen for an out param
// where the variable is declared before being passed as an out param, for example:
// string s;
// Method(out s, b ? 0 : 1);
// The second argument is necessary to create multiple branches so that the compiler
// turns both arguments into flow capture references, instead of just passing a local
// reference for s.
// This can also happen for a deconstruction assignments, where the write is not to a byref.
// Once the analyzer implements support for deconstruction assignments (https://github.com/dotnet/linker/issues/3158),
// we can try enabling this assert to ensure that this case is only hit for byrefs.
// Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Reference),
// $"{operation.Syntax.GetLocation().GetLineSpan()}");
return TopValue;
}
return GetFlowCaptureValue(operation, state);
}
// Similar to VisitSimpleAssignment when assigning to a local, but for values which are captured without a
// corresponding local variable. The "flow capture" is like a local assignment, and the "flow capture reference"
// is like a local reference.
public override TValue VisitFlowCapture(IFlowCaptureOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (IsLValueFlowCapture(operation.Id))
{
// Should never see an l-value flow capture of another flow capture.
Debug.Assert(operation.Value is not IFlowCaptureReferenceOperation);
if (operation.Value is IFlowCaptureReferenceOperation)
return TopValue;
// Note: technically we should save some information about the value for LValue flow captures
// (for example, the object instance of a property reference) and avoid re-computing it when
// assigning to the FlowCaptureReference.
var capturedRef = new CapturedReferenceValue(operation.Value);
var currentState = state.Current;
currentState.LocalState.CapturedReferences.Set(operation.Id, capturedRef);
state.Current = currentState;
return TopValue;
}
else
{
TValue capturedValue;
if (operation.Value is IFlowCaptureReferenceOperation captureRef)
{
if (IsLValueFlowCapture(captureRef.Id))
{
// If an r-value captures an l-value, we must dereference the l-value
// and copy out the value to capture.
capturedValue = TopValue;
var capturedReferences = state.Current.LocalState.CapturedReferences.Get(captureRef.Id);
Debug.Assert(!capturedReferences.IsUnknown());
foreach (var capturedReference in capturedReferences.GetKnownValues())
{
var value = Visit(capturedReference.Reference, state);
capturedValue = LocalStateAndContextLattice.LocalStateLattice.Lattice.ValueLattice.Meet(capturedValue, value);
}
}
else
{
capturedValue = state.Get(new LocalKey(captureRef.Id));
}
}
else
{
capturedValue = Visit(operation.Value, state);
}
state.Set(new LocalKey(operation.Id), capturedValue);
return capturedValue;
}
}
public override TValue VisitExpressionStatement(IExpressionStatementOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
Visit(operation.Operation, state);
return TopValue;
}
public override TValue VisitInvocation(IInvocationOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
=> ProcessMethodCall(operation, operation.TargetMethod, operation.Instance, operation.Arguments, state);
public override TValue VisitDelegateCreation(IDelegateCreationOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
Visit(operation.Target, state);
IMethodSymbol? targetMethodSymbol = null;
switch (operation.Target)
{
case IFlowAnonymousFunctionOperation lambda:
// Tracking lambdas is handled by normal visiting logic for IFlowAnonymousFunctionOperation.
// Instance of a lambda or local function should be the instance of the containing method.
// Don't need to track a dataflow value, since the delegate creation will warn if the
// lambda or local function has an annotated this parameter.
targetMethodSymbol = lambda.Symbol;
break;
case IMethodReferenceOperation methodReference:
IMethodSymbol methodDefinition = methodReference.Method.OriginalDefinition;
if (methodDefinition.ContainingSymbol is IMethodSymbol)
{
// Track references to local functions
var localFunction = methodDefinition;
Debug.Assert(localFunction.MethodKind == MethodKind.LocalFunction);
var localFunctionCFG = ControlFlowGraph.GetLocalFunctionControlFlowGraphInScope(localFunction);
InterproceduralState.TrackMethod(new MethodBodyValue(localFunction, localFunctionCFG));
}
targetMethodSymbol = methodReference.Method;
break;
case IMemberReferenceOperation:
case IInvocationOperation:
// No method symbol.
break;
default:
UnexpectedOperationHandler.Handle(operation.Target);
break;
}
if (targetMethodSymbol == null)
return TopValue;
return HandleDelegateCreation(targetMethodSymbol, operation, state.Current.Context);
}
public abstract TValue HandleDelegateCreation(IMethodSymbol methodReference, IOperation operation, in TContext context);
public override TValue VisitPropertyReference(IPropertyReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write))
{
// Property references may be passed as ref/out parameters.
// Enable this assert once we have support for deconstruction assignments.
// https://github.com/dotnet/linker/issues/3158
// Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Reference),
// $"{operation.Syntax.GetLocation().GetLineSpan()}");
return TopValue;
}
// Accessing property for reading is really a call to the getter
// The setter case is handled in assignment operation since here we don't have access to the value to pass to the setter
TValue instanceValue = Visit(operation.Instance, state);
IMethodSymbol? getMethod = operation.Property.GetGetMethod();
// Property may be an indexer, in which case there will be one or more index arguments
ImmutableArray<TValue>.Builder arguments = ImmutableArray.CreateBuilder<TValue>();
foreach (var val in operation.Arguments)
arguments.Add(Visit(val, state));
return HandleMethodCallHelper(getMethod!, instanceValue, arguments.ToImmutableArray(), operation, state);
}
public override TValue VisitEventReference(IEventReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
// Writing to an event should not go through this path.
Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Read));
if (!operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Read))
return TopValue;
Visit(operation.Instance, state);
// Accessing event for reading retrieves the event delegate from the event's backing field,
// so there is no method call to handle.
return TopValue;
}
public override TValue VisitImplicitIndexerReference(IImplicitIndexerReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Write))
{
// Implicit indexer references may be passed as ref/out parameters.
Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Reference));
return TopValue;
}
TValue instanceValue = Visit(operation.Instance, state);
TValue indexArgumentValue = Visit(operation.Argument, state);
if (operation.IndexerSymbol is not IPropertySymbol indexerProperty)
{
// For example, System.Span<T>.Slice(int, int).
// Don't try to handle it for now.
return TopValue;
}
IMethodSymbol getMethod = indexerProperty.GetGetMethod()!;
return HandleMethodCallHelper(getMethod, instanceValue, ImmutableArray.Create(indexArgumentValue), operation, state);
}
public override TValue VisitArrayElementReference(IArrayElementReferenceOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (!operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Read))
return TopValue;
// Accessing an array element for reading is a call to the indexer
// or a plain array access. Just handle plain array access for now.
// Only handle simple index access
if (operation.Indices.Length != 1)
return TopValue;
return HandleArrayElementRead(Visit(operation.ArrayReference, state), Visit(operation.Indices[0], state), operation);
}
public override TValue VisitInlineArrayAccess(IInlineArrayAccessOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
Debug.Assert(operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Read));
if (!operation.GetValueUsageInfo(OwningSymbol).HasFlag(ValueUsageInfo.Read))
return TopValue;
return HandleArrayElementRead(Visit(operation.Instance, state), Visit(operation.Argument, state), operation);
}
public override TValue VisitArgument(IArgumentOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
return Visit(operation.Value, state);
}
public override TValue VisitReturn(IReturnOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (operation.ReturnedValue != null)
{
var value = Visit(operation.ReturnedValue, state);
var current = state.Current;
HandleReturnValue(value, operation, in current.Context);
return value;
}
return TopValue;
}
public override TValue VisitConversion(IConversionOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
var operandValue = Visit(operation.Operand, state);
return operation.OperatorMethod == null ? operandValue : TopValue;
}
public override TValue VisitObjectCreation(IObjectCreationOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
if (operation.Constructor == null)
return TopValue;
return ProcessMethodCall(operation, operation.Constructor, null, operation.Arguments, state);
}
public override TValue VisitFlowAnonymousFunction(IFlowAnonymousFunctionOperation operation, LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
// The containing symbol of a lambda is either another method, or a field (for field initializers).
// For property initializers, the containing symbol is the compiler-generated backing field.
// For property accessors, the containing symbol is the accessor method.
Debug.Assert(operation.Symbol.ContainingSymbol is IMethodSymbol or IFieldSymbol);
var lambda = operation.Symbol;
Debug.Assert(lambda.MethodKind == MethodKind.LambdaMethod);
var lambdaCFG = ControlFlowGraph.GetAnonymousFunctionControlFlowGraphInScope(operation);
InterproceduralState.TrackMethod(new MethodBodyValue(lambda, lambdaCFG));
return TopValue;
}
private TValue HandleMethodCallHelper(
IMethodSymbol calledMethod,
TValue instance,
ImmutableArray<TValue> arguments,
IOperation operation,
LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
var value = HandleMethodCall(calledMethod, instance, arguments, operation, state.Current.Context);
if (calledMethod.TryGetAttribute(nameof(DoesNotReturnAttribute), out var doesNotReturnAttributeData))
{
// If it doesn't return, then after the called method we are free to assume that we
// are in the Top state. This will have the correct behavior if meeting with another
// state in the CFG. For example:
// var x = SomeTrackedValue;
// if (SomeCondition)
// DoesNotReturn();
// WitnessState(x);
// The state at 'WitnessState(x)' and 'WitnessContext()' is computed as the meet of:
// - the output at the end of the block inside of the if (Top), and
// - the fall-through output of the block with the check (x: SomeTrackedValue).
// Because Top is the identity of meet, the state from before the if block is preserved,
// so 'WitnessState(x)' sees that x has 'SomeTrackedValue' in this case.
state.Current = LocalStateAndContextLattice.Top;
return value;
}
foreach (var parameterProxy in calledMethod.GetParameters())
{
if (parameterProxy.ParameterSymbol is not IParameterSymbol parameter)
continue;
if (!parameter.TryGetAttribute(nameof(DoesNotReturnIfAttribute), out var attributeData))
continue;
if (attributeData.ConstructorArguments.Length != 1)
continue;
var attributeArgument = attributeData.ConstructorArguments[0];
if (attributeArgument.Kind != TypedConstantKind.Primitive)
continue;
if (attributeArgument.Value is not bool doesNotReturnIfConditionValue)
continue;
var argumentIndex = parameterProxy.MetadataIndex;
var argument = arguments[argumentIndex];
IArgumentOperation argumentOperation;
switch (operation)
{
case IInvocationOperation callOperation:
argumentOperation = callOperation.Arguments[argumentIndex];
break;
case IObjectCreationOperation callOperation:
argumentOperation = callOperation.Arguments[argumentIndex];
break;
default:
UnexpectedOperationHandler.Handle(operation);
continue;
}
;
// Get the condition value that is being asserted. If the attribute is DoesNotReturnIf(true),
// the condition value needs to be negated so that we can assert the false condition.
TConditionValue conditionValue = GetConditionValue(argumentOperation, state);
var current = state.Current;
ApplyCondition(
doesNotReturnIfConditionValue == false
? conditionValue
: conditionValue.Negate(),
ref current);
state.Current = current;
}
return value;
}
private TValue ProcessMethodCall(
IOperation operation,
IMethodSymbol method,
IOperation? instance,
ImmutableArray<IArgumentOperation> arguments,
LocalDataFlowState<TValue, TContext, TValueLattice, TContextLattice> state)
{
TValue instanceValue = Visit(instance, state);
var argumentsBuilder = ImmutableArray.CreateBuilder<TValue>();
foreach (var argument in arguments)
{
// For __arglist argument there might not be any parameter
// __arglist is only legal as the last argument to a method and there's also no supported
// way for it to carry annotations or participate in data flow in any way, so it's OK to ignore it.
// Since it's always last, it's also OK to simply pass a shorter arguments array to the call.
if (argument?.Parameter == null)
break;
argumentsBuilder.Add(VisitArgument(argument, state));
}
// For local functions with generic arguments, the substituted method symbol's containing
// symbol is not the containing method, so we need to check the OriginalDefinition.
if (method.OriginalDefinition.ContainingSymbol is IMethodSymbol)
{
var localFunction = method.OriginalDefinition;
Debug.Assert(localFunction.MethodKind == MethodKind.LocalFunction);
var localFunctionCFG = ControlFlowGraph.GetLocalFunctionControlFlowGraphInScope(localFunction);
InterproceduralState.TrackMethod(new MethodBodyValue(localFunction, localFunctionCFG));
}
return HandleMethodCallHelper(
method,
instanceValue,
argumentsBuilder.ToImmutableArray(),
operation,
state);
}
}
}
|