cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/vm/interpret/explore.rs

@@ -1,11 +1,12 @@
 //! Explores feasible paths through an instruction handler.
 
-use std::mem;
+use std::{mem, ptr};
 
 use swc_core::ecma::ast::Function;
 
 use super::copies::Copies;
-use super::run::{Run, Stop};
+use super::intrinsic;
+use super::run::{Decrypted, Run, Snapshot, Stop};
 use crate::vm::dispatch::Decoded;
 use crate::vm::output::Path;
 use crate::vm::session::Session;
@@ -26,6 +27,8 @@ pub(crate) struct Invocation<'session, 'ast> {
     pub handler: &'ast Function,
     /// The instance fields the constructor derives from the program.
     pub fields: &'session HashMap<String, Value<'ast>>,
+    /// Strings decrypted from the program so far.
+    pub decrypted: &'session Decrypted<'ast>,
     /// Registers whose values are known, such as a candidate string.
     pub known: &'session [(u8, Value<'ast>)],
 }
@@ -45,41 +48,147 @@ pub(crate) struct Way<'ast> {
 
 /// Runs the handler for each feasible combination of symbolic branches, depth-first with true
 /// before false. Returns `None` if there are more than [`MAXIMUM_PATHS`].
+///
+/// Paths that differ only after the top-level statement where the handler's first branch was
+/// seen resume from a [`Snapshot`] taken before it rather than rerunning the whole handler.
+/// Each path still sees exactly the state a rerun would.
 #[must_use]
 pub(crate) fn explore<'ast>(invocation: &Invocation<'_, 'ast>) -> Option<Ways<'ast>> {
-    let mut ways = Ways::default();
-    let handler = Callable::Script {
-        name: None,
-        function: invocation.handler,
-        scope: None,
+    let session = invocation.session;
+    let handler = invocation.handler;
+    let address = intrinsic::address(handler);
+    // `Run::script` runs these natively or caches them, rather than through a slot plan.
+    let special = session.intrinsics.contains_key(&address)
+        || session
+            .record_decoder
+            .is_some_and(|decoder| ptr::eq(decoder, handler));
+    let plan = if special {
+        None
+    } else {
+        session.compiled.slots(handler)
     };
-    let mut decisions = Vec::new();
-    for _ in 0..MAXIMUM_PATHS {
-        let mut run = Run::handler(invocation, decisions);
-        let outcome = run.invoke(&handler, Value::Undefined, vec![Value::Machine]);
-        decisions = mem::take(&mut run.branches.decisions);
-        decisions.truncate(run.branches.decided);
-        let scopes = run.scopes();
-        let fields = mem::take(&mut run.fields);
-        let way = run.finish(outcome);
-        // Clear captured scopes to break cycles between functions and the scopes holding them.
-        for scope in scopes {
-            scope.borrow_mut().variables.clear();
-        }
-        match way {
-            Ok(path) => ways.taken.push(Way { path, fields }),
-            Err(fault) => ways.faults.push(fault),
-        }
-        // Retry the last branch taken as `true` that has not yet been tried as `false`.
-        while decisions.last() == Some(&false) {
-            decisions.pop();
-        }
-        match decisions.last_mut() {
-            Some(last) => *last = false,
-            None => return Some(ways),
+    // A run that thaws a shared session object leaves no results; explore again with the
+    // object copied.
+    'explore: loop {
+        let branching = session
+            .branching
+            .borrow()
+            .get(&address)
+            .copied()
+            .unwrap_or_default();
+        // Snapshots usually repay their copying only for handlers whose instructions have
+        // averaged at least 1.5 runs.
+        let split = branching
+            .statement
+            .filter(|&statement| statement > 0 && 2 * branching.runs >= 3 * branching.instructions);
+        let mut ways = Ways::default();
+        let mut decisions = Vec::new();
+        let mut snapshot: Option<Snapshot<'ast>> = None;
+        for _ in 0..MAXIMUM_PATHS {
+            let resumed = snapshot
+                .as_ref()
+                .filter(|snapshot| snapshot.resumes(&decisions));
+            let (mut run, outcome, copied) = match (plan.as_deref(), resumed) {
+                (Some(plan), Some(snapshot)) => {
+                    let (mut run, mut locals, copied) =
+                        Run::resume(invocation, snapshot, decisions);
+                    // Snapshot locals are dropped rather than returned to the spare buffers.
+                    let outcome = run.handler_statements(
+                        plan,
+                        snapshot.statement,
+                        &mut locals,
+                        &mut |_, _, _| {},
+                    );
+                    (run, outcome, copied)
+                }
+                (Some(plan), None) => {
+                    let mut run = Run::handler(invocation, decisions);
+                    let mut taken = None;
+                    // The last top-level statement started before any decision was consumed.
+                    let mut undecided = None;
+                    let outcome = run.call_handler(
+                        plan,
+                        Value::Undefined,
+                        vec![Value::Machine],
+                        &mut |run, statement, locals| {
+                            if run.branches.decided == 0 {
+                                undecided = Some(statement);
+                            }
+                            if split == Some(statement) {
+                                taken = run.snapshot(statement, locals);
+                            }
+                        },
+                    );
+                    if branching.statement.is_none()
+                        && !run.thawed
+                        && run.branches.decided > 0
+                        && let Some(statement) = undecided
+                    {
+                        let mut learned = session.branching.borrow_mut();
+                        learned
+                            .entry(address)
+                            .or_default()
+                            .statement
+                            .get_or_insert(statement);
+                    }
+                    snapshot = taken;
+                    (run, outcome, Vec::new())
+                }
+                (None, _) => {
+                    let mut run = Run::handler(invocation, decisions);
+                    let handler = Callable::Script {
+                        name: None,
+                        function: handler,
+                        scope: None,
+                    };
+                    let outcome = run.invoke(&handler, Value::Undefined, vec![Value::Machine]);
+                    (run, outcome, Vec::new())
+                }
+            };
+            decisions = mem::take(&mut run.branches.decisions);
+            decisions.truncate(run.branches.decided);
+            let thawed = run.thawed;
+            let scopes = run.scopes();
+            let fields = mem::take(&mut run.fields);
+            let way = run.finish(outcome);
+            // Clear captured scopes to break cycles between functions and the scopes holding
+            // them.
+            for scope in scopes.into_iter().chain(copied) {
+                scope.borrow_mut().variables.clear();
+            }
+            if thawed {
+                continue 'explore;
+            }
+            match way {
+                Ok(path) => ways.taken.push(Way { path, fields }),
+                Err(fault) => ways.faults.push(fault),
+            }
+            // Retry the last branch taken as `true` that has not yet been tried as `false`.
+            while decisions.last() == Some(&false) {
+                decisions.pop();
+            }
+            let Some(last) = decisions.last_mut() else {
+                let mut learned = session.branching.borrow_mut();
+                let learned = learned.entry(address).or_default();
+                learned.instructions += 1;
+                learned.runs += ways.taken.len() + ways.faults.len();
+                return Some(ways);
+            };
+            *last = false;
         }
+        break None;
     }
-    None
+}
+
+/// What exploration has learned about a handler's paths.
+#[derive(Clone, Copy, Default)]
+pub(crate) struct Branching {
+    /// The top-level statement where its first decision was seen.
+    statement: Option<usize>,
+    /// Instructions explored.
+    instructions: usize,
+    /// Runs the explored instructions took.
+    runs: usize,
 }
 
 /// Runs `decoder` after setting the program counter and dispatch key registers. Returns the decoded
@@ -92,18 +201,25 @@ pub(crate) fn decode<'ast>(
     pc: u32,
     key: u8,
 ) -> Result<Decoded, String> {
-    let mut run = Run::new(session, program, Vec::new(), Some(Copies::default()));
-    run.start_at(pc, key);
     let decoder = Callable::Script {
         name: None,
         function: decoder,
         scope: None,
     };
-    let outcome = run.invoke(&decoder, Value::Undefined, arguments);
-    let next = run.register_value(session.layout.key);
-    for scope in run.scopes() {
-        scope.borrow_mut().variables.clear();
-    }
+    // A run that thaws a shared session object decodes again with the object copied.
+    let (outcome, next) = loop {
+        let mut run = Run::new(session, program, Vec::new(), Some(Copies::default()));
+        run.sharing = true;
+        run.start_at(pc, key);
+        let outcome = run.invoke(&decoder, Value::Undefined, arguments.clone());
+        let next = run.register_value(session.layout.key);
+        for scope in run.scopes() {
+            scope.borrow_mut().variables.clear();
+        }
+        if !run.thawed {
+            break (outcome, next);
+        }
+    };
     let opcode = outcome.map_err(|stop| match *stop {
         Stop::Throw(value) => format!("throws {}", value.expr()),
         Stop::Unsupported(reason) => reason,

data/vendor/cfsolve/src/vm/interpret/frozen.rs

@@ -0,0 +1,171 @@
+//! Session objects that handler runs share instead of copying while no run changes them.
+//!
+//! Runs copy every session object they reach (see [`super::copies`]), but most session
+//! bindings are tables that handlers only read. Objects reachable from bindings form groups:
+//! bindings that share an object belong to one group. Handler and decoder runs share a
+//! group's objects as they are. The first run that writes to one thaws its group, so later
+//! runs copy it as before, and stops; the caller then reruns the instruction from the start.
+//! Every completed run therefore sees what a run that copied everything would.
+//!
+//! Groups that reach a function with captured state are never shared: calling it would write
+//! to a session scope.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use rustc_hash::FxHashSet as HashSet;
+use swc_core::atoms::Atom;
+
+use crate::vm::HashMap;
+use crate::vm::value::Value;
+
+#[derive(Default)]
+pub(crate) struct Frozen {
+    /// Addresses of the objects runs share.
+    shared: RefCell<HashSet<usize>>,
+    /// Each shared object's group root, by address.
+    groups: HashMap<usize, usize>,
+    /// Each group's objects, by root.
+    members: HashMap<usize, Vec<usize>>,
+}
+
+impl Frozen {
+    /// Groups the objects reachable from `bindings` and shares those of groups that reach no
+    /// function with captured state.
+    pub(crate) fn of(bindings: &HashMap<Atom, Value<'_>>) -> Self {
+        let mut groups = Groups::default();
+        for value in bindings.values() {
+            let mut reached = Reached::default();
+            reached.visit(value);
+            groups.join(&reached);
+        }
+        groups.frozen()
+    }
+
+    /// Whether runs share the object at `address`.
+    pub(super) fn contains(&self, address: usize) -> bool {
+        let shared = self.shared.borrow();
+        !shared.is_empty() && shared.contains(&address)
+    }
+
+    /// Stops sharing the group of the object at `address`.
+    pub(super) fn thaw(&self, address: usize) {
+        if let Some(&group) = self.groups.get(&address) {
+            let mut shared = self.shared.borrow_mut();
+            for member in &self.members[&group] {
+                shared.remove(member);
+            }
+        }
+    }
+}
+
+/// The address of `value` if it is an object a run can change.
+pub(super) fn address(value: &Value<'_>) -> Option<usize> {
+    Some(match value {
+        Value::Array(elements) => Rc::as_ptr(elements).addr(),
+        Value::Object(properties) => Rc::as_ptr(properties).addr(),
+        Value::Set(members) => Rc::as_ptr(members).addr(),
+        Value::Map(entries) => Rc::as_ptr(entries).addr(),
+        _ => return None,
+    })
+}
+
+/// The objects reachable from one binding.
+#[derive(Default)]
+struct Reached {
+    seen: HashSet<usize>,
+    /// Whether a function with captured state is reachable.
+    stateful: bool,
+}
+
+impl Reached {
+    fn visit(&mut self, value: &Value<'_>) {
+        if let Value::Function(_) = value {
+            self.stateful |= !value.is_immutable();
+            return;
+        }
+        let Some(address) = address(value) else {
+            return;
+        };
+        if !self.seen.insert(address) {
+            return;
+        }
+        match value {
+            Value::Array(elements) | Value::Set(elements) => {
+                for element in elements.borrow().iter() {
+                    self.visit(element);
+                }
+            }
+            Value::Object(properties) => {
+                for (_, property) in properties.borrow().iter() {
+                    self.visit(property);
+                }
+            }
+            Value::Map(entries) => {
+                for (key, entry) in entries.borrow().iter() {
+                    self.visit(key);
+                    self.visit(entry);
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Union-find over objects, joining the objects each binding reaches.
+#[derive(Default)]
+struct Groups {
+    /// Each object's parent in the union-find forest, by address.
+    parents: HashMap<usize, usize>,
+    /// Roots whose group reaches a function with captured state.
+    stateful: HashSet<usize>,
+}
+
+impl Groups {
+    fn root(&mut self, mut address: usize) -> usize {
+        self.parents.entry(address).or_insert(address);
+        while let Some(&parent) = self.parents.get(&address)
+            && parent != address
+        {
+            let grandparent = self.parents[&parent];
+            self.parents.insert(address, grandparent);
+            address = grandparent;
+        }
+        address
+    }
+
+    fn join(&mut self, reached: &Reached) {
+        let mut objects = reached.seen.iter().copied();
+        let Some(first) = objects.next() else {
+            return;
+        };
+        let root = self.root(first);
+        for object in objects {
+            let other = self.root(object);
+            if other != root {
+                self.parents.insert(other, root);
+                if self.stateful.remove(&other) {
+                    self.stateful.insert(root);
+                }
+            }
+        }
+        if reached.stateful {
+            self.stateful.insert(root);
+        }
+    }
+
+    fn frozen(mut self) -> Frozen {
+        let objects: Vec<_> = self.parents.keys().copied().collect();
+        let mut frozen = Frozen::default();
+        for object in objects {
+            let root = self.root(object);
+            if self.stateful.contains(&root) {
+                continue;
+            }
+            frozen.members.entry(root).or_default().push(object);
+            frozen.groups.insert(object, root);
+            frozen.shared.get_mut().insert(object);
+        }
+        frozen
+    }
+}