arkanalyzer 1.0.91 → 1.0.93

package/lib/callgraph/algorithm/RapidTypeAnalysis.js

@@ -40,25 +40,58 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RapidTypeAnalysis = void 0;
 const Expr_1 = require("../../core/base/Expr");
 const Stmt_1 = require("../../core/base/Stmt");
+const ArkClass_1 = require("../../core/model/ArkClass");
+const CallGraph_1 = require("../model/CallGraph");
 const AbstractAnalysis_1 = require("./AbstractAnalysis");
 const logger_1 = __importStar(require("../../utils/logger"));
+const Type_1 = require("../../core/base/Type");
 const TSConst_1 = require("../../core/common/TSConst");
 const Local_1 = require("../../core/base/Local");
 const Const_1 = require("../../core/common/Const");
+const SdkUtils_1 = require("../../core/common/SdkUtils");
+const Ref_1 = require("../../core/base/Ref");
 const logger = logger_1.default.getLogger(logger_1.LOG_MODULE_TYPE.ARKANALYZER, 'RTA');
+const BUILTIN_ARRAY_CLASS_NAME = 'Array';
+/**
+ * Built-in container APIs that may take FunctionType args but only store them
+ * (do not invoke). These must not get virtual callback CallSites.
+ * All other no-CFG built-ins default to synthesizing callback edges (forEach/map/then/...).
+ */
+const BUILTIN_CONTAINER_NON_INVOKING_METHODS = new Map([
+    ['Array', new Set(['push', 'unshift', 'splice', 'indexOf', 'lastIndexOf', 'includes'])],
+    ['Map', new Set(['set', 'get', 'has', 'delete'])],
+    ['Set', new Set(['add', 'has', 'delete'])],
+    ['WeakMap', new Set(['set', 'get', 'has', 'delete'])],
+    ['WeakSet', new Set(['add', 'has', 'delete'])],
+]);
+const NON_INVOKING_METHOD_NAMES = new Set(Array.from(BUILTIN_CONTAINER_NON_INVOKING_METHODS.values()).flatMap(s => Array.from(s)));
+const CALLBACK_BINDING_ARG_BITS = 8;
+const CALLBACK_BINDING_ARG_STRIDE = 1 << CALLBACK_BINDING_ARG_BITS;
 class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
     constructor(scene, cg, cb, enableThisPrune = false) {
         super(scene, cg);
         // TODO: signature duplicated check
         this.instancedClasses = new Set();
-        // TODO: Set duplicated check
         this.ignoredCalls = new Map();
         this.virtualDispatchIndex = new Map();
+        // ownerFuncID → logical argument index → lazily-created binding state
+        this.callbackBindings = new Map();
+        // FieldSignature → callback targets/subscribers. This is intentionally type-based,
+        // not allocation-site-sensitive, to keep field callback propagation lightweight.
+        this.callbackFieldBindings = new Map();
+        // Reused scratch storage for closure-chain cycle detection.
+        this.closureTraceVisited = new Set();
+        // Reused scratch for AliasType peeling in unwrapFunctionType.
+        this.aliasTypeUnwrapVisited = new Set();
+        // Reused scratch list of executable callee FuncIDs for one resolveCall.
+        this.executableCalleeScratch = [];
+        // Whether getBuiltinArrayClassSignature has completed its one-time lookup (hit or miss).
+        this.builtinArrayClassResolved = false;
         this.cgBuilder = cb;
         this.enableThisPrune = enableThisPrune;
     }
     init() {
-        this.scene.getClasses().filter(c => c.getName() === Const_1.DEFAULT_ARK_CLASS_NAME).forEach(c => {
+        this.scene.getClasses().filter((c) => c.getName() === Const_1.DEFAULT_ARK_CLASS_NAME).forEach((c) => {
             var _a;
             const dfltMethod = (_a = c.getMethodWithName(Const_1.DEFAULT_ARK_METHOD_NAME)) === null || _a === void 0 ? void 0 : _a.getSignature();
             if (dfltMethod) {
@@ -69,63 +102,718 @@ class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
         super.init();
     }
     resolveCall(callerMethod, invokeStmt) {
-        let invokeExpr = invokeStmt.getInvokeExpr();
-        let resolveResult = [];
+        const invokeExpr = invokeStmt.getInvokeExpr();
         if (!invokeExpr) {
             return [];
         }
-        // process anonymous method call
-        this.getParamAnonymousMethod(invokeExpr).forEach(method => {
-            resolveResult.push(this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, this.cg.getCallGraphNodeByMethod(method).getID(), callerMethod));
-        });
-        let calleeMethod = this.resolveInvokeExpr(invokeExpr);
+        if (invokeExpr instanceof Expr_1.ArkPtrInvokeExpr) {
+            return this.resolvePtrInvoke(callerMethod, invokeStmt, invokeExpr);
+        }
+        const resolveResult = [];
+        const declared = this.resolveInvokeExpr(invokeExpr);
+        this.resolveDirectOrVirtual(callerMethod, invokeStmt, invokeExpr, declared, resolveResult);
+        this.processCallbackArguments(callerMethod, invokeStmt, invokeExpr, declared, resolveResult);
+        return resolveResult;
+    }
+    resolveDirectOrVirtual(callerMethod, invokeStmt, invokeExpr, calleeMethod, resolveResult) {
         if (!calleeMethod) {
-            return resolveResult;
+            return;
         }
         if (invokeExpr instanceof Expr_1.ArkStaticInvokeExpr) {
-            // get specific method
-            resolveResult.push(this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, this.cg.getCallGraphNodeByMethod(calleeMethod.getSignature()).getID(), callerMethod));
-        }
-        else {
-            let declareClass = calleeMethod.getDeclaringArkClass();
-            const methodName = calleeMethod.getName();
-            // Aggressive heuristic: when enabled and the call is `this.foo()`,
-            // only keep the implementation of `foo` in the current declaring class,
-            // or the first superclass that defines it (e.g. B.m() calling this.foo() → A.foo() when B extends A).
-            const prunedCallSite = this.tryResolveAggressiveThisPruneCall(invokeStmt, methodName, callerMethod);
-            if (prunedCallSite) {
-                resolveResult.push(prunedCallSite);
-                return resolveResult;
-            }
-            const directCallSite = this.resolveConstructorClassFromNew(methodName, invokeStmt, callerMethod);
-            if (directCallSite) {
-                resolveResult.push(directCallSite);
-                return resolveResult;
-            }
-            // Private methods cannot be overridden; only the declaring class has an implementation.
-            if (calleeMethod.isPrivate()) {
-                const calleeNode = this.cg.getCallGraphNodeByMethod(calleeMethod.getSignature());
-                if (this.instancedClasses.has(declareClass.getSignature())) {
-                    resolveResult.push(this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, calleeNode.getID(), callerMethod));
-                }
-                else {
-                    this.addIgnoredCalls(declareClass.getSignature(), callerMethod, calleeNode.getID(), invokeStmt);
+            resolveResult.push(this.newRTACallSite(invokeStmt, callerMethod, this.cg.getCallGraphNodeByMethod(calleeMethod.getSignature()).getID()));
+            return;
+        }
+        const declareClass = calleeMethod.getDeclaringArkClass();
+        const methodName = calleeMethod.getName();
+        // Aggressive heuristic: when enabled and the call is `this.foo()`,
+        // only keep the implementation of `foo` in the current declaring class,
+        // or the first superclass that defines it (e.g. B.m() calling this.foo() → A.foo() when B extends A).
+        const prunedCallSite = this.tryResolveAggressiveThisPruneCall(invokeStmt, methodName, callerMethod);
+        if (prunedCallSite) {
+            resolveResult.push(prunedCallSite);
+            return;
+        }
+        const directCallSite = this.resolveConstructorClassFromNew(methodName, invokeStmt, callerMethod);
+        if (directCallSite) {
+            resolveResult.push(directCallSite);
+            return;
+        }
+        // Private methods cannot be overridden; only the declaring class has an implementation.
+        if (calleeMethod.isPrivate()) {
+            const calleeNode = this.cg.getCallGraphNodeByMethod(calleeMethod.getSignature());
+            if (this.instancedClasses.has(declareClass.getSignature())) {
+                resolveResult.push(this.newRTACallSite(invokeStmt, callerMethod, calleeNode.getID()));
+            }
+            else {
+                this.addIgnoredCalls(declareClass.getSignature(), callerMethod, calleeNode.getID(), invokeStmt);
+            }
+            return;
+        }
+        const virtualDispatchRows = this.getOrBuildVirtualDispatchRows(declareClass, methodName);
+        for (let i = 0; i < virtualDispatchRows.classSignatures.length; i++) {
+            const classSignature = virtualDispatchRows.classSignatures[i];
+            if (virtualDispatchRows.isUnconditionallyReachable[i] || this.instancedClasses.has(classSignature)) {
+                resolveResult.push(this.newRTACallSite(invokeStmt, callerMethod, virtualDispatchRows.calleeNodeIDs[i]));
+            }
+            else {
+                this.addIgnoredCalls(classSignature, callerMethod, virtualDispatchRows.calleeNodeIDs[i], invokeStmt);
+            }
+        }
+    }
+    /**
+     * Single args scan:
+     * - if any executable real callee exists (or declared callee has CFG), record callback bindings
+     *   (concrete FunctionType) or forward parameter bindings into callee slots;
+     * - otherwise, for no-CFG SDK / built-in / unresolved (`%unk`) callees, append virtual
+     *   callback CallSites for concrete FunctionType args, parameter bindings, and callback
+     *   fields.
+     */
+    processCallbackArguments(callerMethod, invokeStmt, invokeExpr, declared, resolveResult) {
+        const hasVirtualCallbackCallee = this.scanExecutableCallees(resolveResult);
+        const hasExecutableTarget = this.executableCalleeScratch.length > 0;
+        const declaredHasCfg = declared !== undefined && declared.getCfg() !== undefined;
+        if (!hasExecutableTarget && !declaredHasCfg) {
+            this.handleNoExecutableCalleePath(callerMethod, invokeStmt, declared, hasVirtualCallbackCallee, resolveResult);
+            return;
+        }
+        let declaredOwnerFuncID;
+        if (declared && !hasExecutableTarget) {
+            declaredOwnerFuncID = this.cg.getCallGraphNodeByMethod(declared.getSignature()).getID();
+        }
+        const args = invokeExpr.getArgs();
+        const callerArkMethod = this.cg.getArkMethodByFuncID(callerMethod);
+        for (let i = 0; i < args.length; i++) {
+            const arg = args[i];
+            const functionType = this.unwrapFunctionType(arg.getType());
+            if (!functionType && !this.isCallbackType(arg.getType())) {
+                continue;
+            }
+            if (functionType) {
+                this.bindFunctionTypeCallback(functionType, i, hasExecutableTarget, declaredOwnerFuncID);
+            }
+            else {
+                this.bindClassTypeCallback(arg, i, callerArkMethod, hasExecutableTarget, declaredOwnerFuncID);
+            }
+            // Parameter forwarding: start(cb) { this.schedule(cb); }
+            // Propagate caller's parameter binding into each callee's argument slot i.
+            if (!(arg instanceof Local_1.Local) || !callerArkMethod) {
+                continue;
+            }
+            const sourceKey = this.resolveFuncPtrToBindingKey(arg, callerArkMethod);
+            if (sourceKey === undefined) {
+                continue;
+            }
+            if (hasExecutableTarget) {
+                for (let j = 0; j < this.executableCalleeScratch.length; j++) {
+                    this.linkCallbackBinding(sourceKey, this.encodeCallbackBindingKey(this.executableCalleeScratch[j], i));
                 }
-                return resolveResult;
             }
-            const virtualDispatchRows = this.getOrBuildVirtualDispatchRows(declareClass, methodName);
-            for (let i = 0; i < virtualDispatchRows.classSignatures.length; i++) {
-                const classSignature = virtualDispatchRows.classSignatures[i];
-                if (virtualDispatchRows.isSdkClasses[i] || this.instancedClasses.has(classSignature)) {
-                    resolveResult.push(this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, virtualDispatchRows.calleeNodeIDs[i], callerMethod));
+            else if (declaredOwnerFuncID !== undefined) {
+                this.linkCallbackBinding(sourceKey, this.encodeCallbackBindingKey(declaredOwnerFuncID, i));
+            }
+        }
+    }
+    /**
+     * Bind a FunctionType callback argument to the callee's parameter binding slot.
+     * Extracted from processCallbackArguments for readability.
+     */
+    bindFunctionTypeCallback(functionType, argIndex, hasExecutableTarget, declaredOwnerFuncID) {
+        const callbackMethod = this.scene.getMethod(functionType.getMethodSignature());
+        if (callbackMethod && callbackMethod.getCfg()) {
+            const targetFuncID = this.cg.getCallGraphNodeByMethod(callbackMethod.getSignature()).getID();
+            if (hasExecutableTarget) {
+                for (let j = 0; j < this.executableCalleeScratch.length; j++) {
+                    this.addCallbackTarget(this.executableCalleeScratch[j], argIndex, targetFuncID);
                 }
-                else {
-                    this.addIgnoredCalls(classSignature, callerMethod, virtualDispatchRows.calleeNodeIDs[i], invokeStmt);
+            }
+            else if (declaredOwnerFuncID !== undefined) {
+                this.addCallbackTarget(declaredOwnerFuncID, argIndex, targetFuncID);
+            }
+        }
+    }
+    /**
+     * Bind a ClassType callback (Callback<T>, AsyncCallback<T>, ...) argument to the
+     * callee's parameter binding slot via field binding state.
+     * Extracted from processCallbackArguments for readability.
+     */
+    bindClassTypeCallback(arg, argIndex, callerArkMethod, hasExecutableTarget, declaredOwnerFuncID) {
+        let fieldRef;
+        if (arg instanceof Ref_1.ArkInstanceFieldRef) {
+            fieldRef = arg;
+        }
+        else if (arg instanceof Local_1.Local && callerArkMethod) {
+            fieldRef = this.resolveFuncPtrToFieldRef(arg, callerArkMethod);
+        }
+        if (fieldRef) {
+            const fieldKey = this.getCallbackFieldKey(fieldRef);
+            if (hasExecutableTarget) {
+                for (let j = 0; j < this.executableCalleeScratch.length; j++) {
+                    const bindingKey = this.encodeCallbackBindingKey(this.executableCalleeScratch[j], argIndex);
+                    this.linkFieldToBinding(fieldKey, bindingKey);
                 }
             }
+            else if (declaredOwnerFuncID !== undefined) {
+                const bindingKey = this.encodeCallbackBindingKey(declaredOwnerFuncID, argIndex);
+                this.linkFieldToBinding(fieldKey, bindingKey);
+            }
+        }
+    }
+    scanExecutableCallees(resolveResult) {
+        this.executableCalleeScratch.length = 0;
+        let hasVirtualCallbackCallee = false;
+        for (let i = 0; i < resolveResult.length; i++) {
+            const calleeId = resolveResult[i].getCalleeFuncID();
+            if (calleeId === undefined) {
+                continue;
+            }
+            const method = this.cg.getArkMethodByFuncID(calleeId);
+            if (method && method.getCfg()) {
+                this.executableCalleeScratch.push(calleeId);
+            }
+            else if (this.shouldSynthesizeVirtualCallback(calleeId)) {
+                hasVirtualCallbackCallee = true;
+            }
         }
+        return hasVirtualCallbackCallee;
+    }
+    handleNoExecutableCalleePath(callerMethod, invokeStmt, declared, hasVirtualCallbackCallee, resolveResult) {
+        const invokeExpr = invokeStmt.getInvokeExpr();
+        if (!invokeExpr) {
+            return;
+        }
+        const args = invokeExpr.getArgs();
+        let shouldAppendVirtual = hasVirtualCallbackCallee;
+        if (!shouldAppendVirtual && declared) {
+            const declaredOwnerFuncID = this.cg.getCallGraphNodeByMethod(declared.getSignature()).getID();
+            shouldAppendVirtual = this.shouldSynthesizeVirtualCallback(declaredOwnerFuncID);
+        }
+        // Declaring signature may be `@%unk/%unk:...` with no Scene method / no CFG node that
+        // passes the SDK/built-in gates; still synthesize callback edges from the invoke itself.
+        if (!shouldAppendVirtual) {
+            shouldAppendVirtual = this.shouldSynthesizeVirtualCallbackFromInvoke(invokeExpr);
+        }
+        if (shouldAppendVirtual) {
+            this.appendVirtualCallbackCallSites(callerMethod, invokeStmt, args, resolveResult);
+        }
+    }
+    /**
+     * Unresolved declaring file (`@%unk/%unk:...`) — common when type inference fails for
+     * built-ins such as Promise.constructor in large apps.
+     */
+    isUnresolvedProjectName(projectName) {
+        return projectName === '%unk';
+    }
+    /**
+     * Built-in container APIs that accept FunctionType values without invoking them
+     * (writes such as push/set, and lookups such as indexOf/has). Caller must already
+     * know the method is a `@built-in` SDK method.
+     */
+    isBuiltInContainerNonInvokingMethod(method) {
+        if (!method) {
+            return false;
+        }
+        const nonInvokingNames = BUILTIN_CONTAINER_NON_INVOKING_METHODS.get(method.getDeclaringArkClass().getName());
+        if (!nonInvokingNames) {
+            return false;
+        }
+        return nonInvokingNames.has(method.getName());
+    }
+    isBuiltInContainerNonInvokingMethodByMethodName(methodName) {
+        return NON_INVOKING_METHOD_NAMES.has(methodName);
+    }
+    /**
+     * Whether a no-CFG callee should synthesize virtual edges into callback args.
+     * OH SDK and unresolved (`%unk`) APIs always qualify. Built-ins qualify by default
+     * except container non-invoking APIs (Array.push / Array.indexOf / Map.set / ...).
+     * Resolves the CG node and declaring projectName once.
+     */
+    shouldSynthesizeVirtualCallback(id) {
+        const node = this.cg.getNode(id);
+        if (!node) {
+            return false;
+        }
+        const projectName = node.getMethod().getDeclaringClassSignature().getDeclaringFileSignature().getProjectName();
+        // Same order as previous isOHSdkMethod → isUnresolved → isBuiltIn path.
+        if (node.isSdkMethod() && projectName !== SdkUtils_1.SdkUtils.BUILT_IN_NAME) {
+            return true;
+        }
+        if (this.isUnresolvedProjectName(projectName)) {
+            return !this.isBuiltInContainerNonInvokingMethodByMethodName(node.getMethod().getMethodSubSignature().getMethodName());
+        }
+        if (node.isSdkMethod() && projectName === SdkUtils_1.SdkUtils.BUILT_IN_NAME) {
+            return !this.isBuiltInContainerNonInvokingMethod(this.cg.getArkMethodByFuncID(id));
+        }
+        return false;
+    }
+    /**
+     * Invoke-site gate when {@link resolveInvokeExpr} cannot produce a usable declared method
+     * (e.g. `@%unk/%unk: Promise.constructor` with no Scene body).
+     */
+    shouldSynthesizeVirtualCallbackFromInvoke(invokeExpr) {
+        const projectName = invokeExpr.getMethodSignature().getDeclaringClassSignature().getDeclaringFileSignature().getProjectName();
+        if (!this.isUnresolvedProjectName(projectName)) {
+            return false;
+        }
+        return !this.isBuiltInContainerNonInvokingMethodByMethodName(invokeExpr.getMethodSignature().getMethodSubSignature().getMethodName());
+    }
+    /**
+     * No-CFG callee that invokes callbacks: emit virtual edges into every callback-shaped argument.
+     * Caller must have already gated on {@link shouldSynthesizeVirtualCallback}. Built-in container
+     * non-invoking APIs (Array.push / Array.indexOf / Map.set / ...) remain excluded by that gate.
+     */
+    appendVirtualCallbackCallSites(callerMethod, invokeStmt, args, resolveResult) {
+        for (let i = 0; i < args.length; i++) {
+            this.appendCallbackValueCallSites(args[i], invokeStmt, callerMethod, resolveResult, i);
+        }
+    }
+    resolvePtrInvoke(callerMethod, invokeStmt, invokeExpr) {
+        const resolveResult = [];
+        const ptr = invokeExpr.getFuncPtrLocal();
+        this.appendCallbackValueCallSites(ptr, invokeStmt, callerMethod, resolveResult, -1);
         return resolveResult;
     }
+    /**
+     * Resolve a callback value through all supported representations.
+     * A value may have both a concrete static target and a field/binding origin;
+     * both paths are retained so later field targets cannot be hidden by the
+     * concrete FunctionType fast path.
+     */
+    appendCallbackValueCallSites(value, invokeStmt, callerMethod, resolveResult, argIndex) {
+        var _a;
+        let functionType = this.unwrapFunctionType(value.getType());
+        if (!functionType) {
+            if (value instanceof Local_1.Local && this.isCallbackType(value.getType())) {
+                const defStmt = value.getDeclaringStmt();
+                if (defStmt instanceof Stmt_1.ArkAssignStmt) {
+                    functionType = this.unwrapFunctionType(defStmt.getRightOp().getType());
+                }
+            }
+        }
+        if (functionType) {
+            const concreteMethod = this.scene.getMethod(functionType.getMethodSignature());
+            if (concreteMethod && concreteMethod.getCfg()) {
+                const targetFuncID = this.cg.getCallGraphNodeByMethod(concreteMethod.getSignature()).getID();
+                this.appendCallbackCallSite(invokeStmt, callerMethod, targetFuncID, resolveResult, argIndex);
+            }
+        }
+        if (value instanceof Ref_1.ArkInstanceFieldRef) {
+            this.subscribeToCallbackField(value, invokeStmt, callerMethod, resolveResult, argIndex);
+        }
+        const ownerMethod = (_a = invokeStmt.getCfg()) === null || _a === void 0 ? void 0 : _a.getDeclaringMethod();
+        if (!(value instanceof Local_1.Local) || !ownerMethod) {
+            return;
+        }
+        const bindingState = this.resolveFuncPtrToBindingState(value, ownerMethod);
+        if (bindingState) {
+            this.subscribeAndCollectBoundTargets(bindingState, invokeStmt, callerMethod, resolveResult, argIndex);
+        }
+        const fieldRef = this.resolveFuncPtrToFieldRef(value, ownerMethod);
+        if (fieldRef && this.isCallbackType(fieldRef.getType())) {
+            this.subscribeToCallbackField(fieldRef, invokeStmt, callerMethod, resolveResult, argIndex);
+        }
+    }
+    appendCallbackCallSite(invokeStmt, callerMethod, targetFuncID, resolveResult, argIndex) {
+        const hasTarget = resolveResult.some((callSite) => {
+            return callSite.getCalleeFuncID() === targetFuncID;
+        });
+        if (hasTarget) {
+            return;
+        }
+        resolveResult.push(this.newRTACallSite(invokeStmt, callerMethod, targetFuncID, argIndex));
+    }
+    subscribeToCallbackField(fieldRef, invokeStmt, callerMethod, resolveResult, argIndex) {
+        if (!this.isCallbackType(fieldRef.getType())) {
+            return;
+        }
+        const fieldKey = this.getCallbackFieldKey(fieldRef);
+        this.subscribeAndCollectFieldTargets(fieldKey, invokeStmt, callerMethod, resolveResult, argIndex);
+    }
+    /**
+     * Subscribe invokeStmt to bindingState and collect already-known targets as CallSites.
+     * Late-arriving targets are delivered via addCallbackTarget → emitCallbackEdge.
+     */
+    subscribeAndCollectBoundTargets(bindingState, invokeStmt, callerMethod, resolveResult, argIndex) {
+        if (bindingState.subscribers.has(invokeStmt)) {
+            return;
+        }
+        bindingState.subscribers.set(invokeStmt, callerMethod);
+        for (const targetFuncID of bindingState.targets) {
+            this.appendCallbackCallSite(invokeStmt, callerMethod, targetFuncID, resolveResult, argIndex);
+        }
+    }
+    getTypeFromAliasType(aliasType) {
+        const visited = this.aliasTypeUnwrapVisited;
+        visited.clear();
+        let current = aliasType;
+        while (current instanceof Type_1.AliasType) {
+            if (visited.has(current)) {
+                return null;
+            }
+            visited.add(current);
+            current = current.getOriginalType();
+        }
+        return current;
+    }
+    /**
+     * Whether a type can serve as a callback — FunctionType (direct or aliased)
+     * or a ClassType callback wrapper (Callback<T>, AsyncCallback<T>, ...).
+     *
+     * Unlike {@link unwrapFunctionType}, this accepts ClassType callbacks whose real
+     * FunctionType is only discoverable at the assignment site (right-hand side),
+     * not from the ClassType itself. This lets the field-subscription and field-store
+     * pipelines accept `private cb: Callback<X> = (...) => {...}` fields.
+     */
+    isCallbackType(type) {
+        let targetType = type;
+        if (type instanceof Type_1.AliasType) {
+            targetType = this.getTypeFromAliasType(type);
+        }
+        if (targetType instanceof Type_1.FunctionType) {
+            return true;
+        }
+        if (targetType instanceof Type_1.ClassType) {
+            const targetSig = targetType.getClassSignature().toString();
+            return RapidTypeAnalysis.CALLBACK_CLASS_SIG_KEY.some(sig => targetSig.includes(sig));
+        }
+        return false;
+    }
+    /**
+     * Peel AliasType layers until a FunctionType is found.
+     * Fast-path: FunctionType returns immediately; non-alias types return undefined
+     * without touching the visited scratch set.
+     */
+    unwrapFunctionType(type) {
+        let targetType = type;
+        if (type instanceof Type_1.AliasType) {
+            targetType = this.getTypeFromAliasType(type);
+        }
+        if (targetType instanceof Type_1.FunctionType) {
+            return targetType;
+        }
+        return null;
+    }
+    resolveFuncPtrToBindingState(ptr, ownerMethod) {
+        const key = this.resolveFuncPtrToBindingKey(ptr, ownerMethod);
+        if (key === undefined) {
+            return undefined;
+        }
+        return this.getOrCreateBindingState(this.decodeOwnerFuncID(key), this.decodeLogicalArgIndex(key));
+    }
+    resolveFuncPtrToBindingKey(ptr, ownerMethod) {
+        this.closureTraceVisited.clear();
+        const startLocal = this.recoverLocalWithDeclaringStmt(ptr, ownerMethod);
+        if (!startLocal) {
+            return undefined;
+        }
+        return this.resolveFuncPtrToBindingKeyRec(startLocal);
+    }
+    /**
+     * Resolve a function-pointer local to an instance callback field.
+     * The short-term field model follows one local alias at most; it does not
+     * perform receiver points-to analysis.
+     */
+    resolveFuncPtrToFieldRef(ptr, ownerMethod) {
+        this.closureTraceVisited.clear();
+        let current = this.recoverLocalWithDeclaringStmt(ptr, ownerMethod);
+        while (current) {
+            if (this.closureTraceVisited.has(current)) {
+                return undefined;
+            }
+            this.closureTraceVisited.add(current);
+            const declaringStmt = current.getDeclaringStmt();
+            if (!(declaringStmt instanceof Stmt_1.ArkAssignStmt)) {
+                return undefined;
+            }
+            const rightOp = declaringStmt.getRightOp();
+            if (rightOp instanceof Ref_1.ArkInstanceFieldRef) {
+                return rightOp;
+            }
+            if (!(rightOp instanceof Local_1.Local)) {
+                return undefined;
+            }
+            current = this.recoverLocalWithDeclaringStmt(rightOp, ownerMethod);
+        }
+        return undefined;
+    }
+    resolveFuncPtrValueToBindingKey(value, ownerMethod) {
+        if (value instanceof Local_1.Local) {
+            return this.resolveFuncPtrToBindingKey(value, ownerMethod);
+        }
+        if (!(value instanceof Ref_1.ArkParameterRef)) {
+            return undefined;
+        }
+        const logicalArgIndex = this.toLogicalArgIndex(ownerMethod, value.getIndex());
+        if (logicalArgIndex < 0) {
+            return undefined;
+        }
+        const ownerFuncID = this.cg.getCallGraphNodeByMethod(ownerMethod.getSignature()).getID();
+        return this.encodeCallbackBindingKey(ownerFuncID, logicalArgIndex);
+    }
+    /**
+     * AliasType-typed ptr locals on invoke exprs may lack declaringStmt even when the
+     * method body has a same-named local that carries the real definition.
+     */
+    recoverLocalWithDeclaringStmt(local, ownerMethod) {
+        if (local.getDeclaringStmt()) {
+            return local;
+        }
+        const body = ownerMethod.getBody();
+        if (!body) {
+            return undefined;
+        }
+        const candidate = body.getLocals().get(local.getName());
+        if (candidate && candidate.getDeclaringStmt()) {
+            return candidate;
+        }
+        return undefined;
+    }
+    /**
+     * Recursively trace a Local back to a parameter binding key.
+     * Follows local aliases and unique closure captures until an ArkParameterRef is
+     * found; returns the packed (ownerFuncID, logicalArgIndex) key, or undefined if
+     * the value does not originate from a parameter slot.
+     */
+    resolveFuncPtrToBindingKeyRec(local) {
+        var _a;
+        if (this.closureTraceVisited.has(local)) {
+            return undefined;
+        }
+        this.closureTraceVisited.add(local);
+        const declaringStmt = local.getDeclaringStmt();
+        if (!(declaringStmt instanceof Stmt_1.ArkAssignStmt)) {
+            return undefined;
+        }
+        const rightOp = declaringStmt.getRightOp();
+        if (rightOp instanceof Ref_1.ArkParameterRef) {
+            const ownerMethod = (_a = declaringStmt.getCfg()) === null || _a === void 0 ? void 0 : _a.getDeclaringMethod();
+            if (!ownerMethod) {
+                return undefined;
+            }
+            const logicalArgIndex = this.toLogicalArgIndex(ownerMethod, rightOp.getIndex());
+            if (logicalArgIndex < 0) {
+                return undefined;
+            }
+            const ownerFuncID = this.cg.getCallGraphNodeByMethod(ownerMethod.getSignature()).getID();
+            return this.encodeCallbackBindingKey(ownerFuncID, logicalArgIndex);
+        }
+        // Local alias: const invoke = cb;
+        if (rightOp instanceof Local_1.Local) {
+            return this.resolveFuncPtrToBindingKeyRec(rightOp);
+        }
+        if (rightOp instanceof Ref_1.ClosureFieldRef) {
+            const baseType = rightOp.getBase().getType();
+            if (!(baseType instanceof Type_1.LexicalEnvType)) {
+                return undefined;
+            }
+            const closures = baseType.getClosures();
+            const fieldName = rightOp.getFieldName();
+            let match;
+            let matchCount = 0;
+            for (let i = 0; i < closures.length; i++) {
+                if (closures[i].getName() === fieldName) {
+                    match = closures[i];
+                    matchCount++;
+                }
+            }
+            if (matchCount !== 1 || !match) {
+                return undefined;
+            }
+            return this.resolveFuncPtrToBindingKeyRec(match);
+        }
+        return undefined;
+    }
+    toLogicalArgIndex(method, rawParamIndex) {
+        const params = method.getParameters();
+        let offset = 0;
+        if (params && params.length > 0 && params[0].getType() instanceof Type_1.LexicalEnvType) {
+            offset = 1;
+        }
+        const logicalIndex = rawParamIndex - offset;
+        if (logicalIndex < 0) {
+            return -1;
+        }
+        return logicalIndex;
+    }
+    encodeCallbackBindingKey(ownerFuncID, logicalArgIndex) {
+        return ownerFuncID * CALLBACK_BINDING_ARG_STRIDE + logicalArgIndex;
+    }
+    decodeOwnerFuncID(key) {
+        return Math.floor(key / CALLBACK_BINDING_ARG_STRIDE);
+    }
+    decodeLogicalArgIndex(key) {
+        return key % CALLBACK_BINDING_ARG_STRIDE;
+    }
+    getOrCreateBindingState(ownerFuncID, logicalArgIndex) {
+        let states = this.callbackBindings.get(ownerFuncID);
+        if (!states) {
+            states = [];
+            this.callbackBindings.set(ownerFuncID, states);
+        }
+        while (states.length <= logicalArgIndex) {
+            states.push(undefined);
+        }
+        let state = states[logicalArgIndex];
+        if (!state) {
+            state = {
+                targets: new Set(),
+                subscribers: new Map(),
+                forwards: new Set(),
+                fieldForwards: new Set(),
+            };
+            states[logicalArgIndex] = state;
+        }
+        return state;
+    }
+    getCallbackFieldKey(fieldRef) {
+        return fieldRef.getFieldSignature().toString();
+    }
+    getOrCreateCallbackFieldState(fieldKey) {
+        let state = this.callbackFieldBindings.get(fieldKey);
+        if (!state) {
+            state = {
+                targets: new Set(),
+                subscribers: new Map(),
+                bindingForwards: new Set(),
+            };
+            this.callbackFieldBindings.set(fieldKey, state);
+        }
+        return state;
+    }
+    linkCallbackField(source, fieldKey) {
+        const sourceState = this.getOrCreateBindingState(this.decodeOwnerFuncID(source), this.decodeLogicalArgIndex(source));
+        if (sourceState.fieldForwards.has(fieldKey)) {
+            return;
+        }
+        sourceState.fieldForwards.add(fieldKey);
+        for (const targetFuncID of sourceState.targets) {
+            this.addCallbackFieldTarget(fieldKey, targetFuncID);
+        }
+    }
+    addCallbackFieldTarget(fieldKey, targetFuncID) {
+        const state = this.getOrCreateCallbackFieldState(fieldKey);
+        if (state.targets.has(targetFuncID)) {
+            return;
+        }
+        state.targets.add(targetFuncID);
+        for (const [stmt, subscriberList] of state.subscribers) {
+            for (const sub of subscriberList) {
+                this.emitCallbackEdge(sub.callerFuncID, targetFuncID, stmt, sub.argIndex);
+            }
+        }
+        for (const bindingKey of state.bindingForwards) {
+            this.addCallbackTarget(this.decodeOwnerFuncID(bindingKey), this.decodeLogicalArgIndex(bindingKey), targetFuncID);
+        }
+    }
+    /**
+     * Link a callback field to a callee parameter binding slot. When the field's
+     * targets are populated later (e.g. field initializer processed after the
+     * call site due to RTA workList ordering), targets propagate to the binding
+     * slot via {@link addCallbackFieldTarget} → bindingForwards → addCallbackTarget.
+     */
+    linkFieldToBinding(fieldKey, bindingKey) {
+        const fieldState = this.getOrCreateCallbackFieldState(fieldKey);
+        if (fieldState.bindingForwards.has(bindingKey)) {
+            return;
+        }
+        fieldState.bindingForwards.add(bindingKey);
+        for (const targetFuncID of fieldState.targets) {
+            this.addCallbackTarget(this.decodeOwnerFuncID(bindingKey), this.decodeLogicalArgIndex(bindingKey), targetFuncID);
+        }
+    }
+    subscribeAndCollectFieldTargets(fieldKey, invokeStmt, callerMethod, resolveResult, argIndex) {
+        const state = this.getOrCreateCallbackFieldState(fieldKey);
+        if (!state.subscribers.has(invokeStmt)) {
+            state.subscribers.set(invokeStmt, []);
+        }
+        const list = state.subscribers.get(invokeStmt);
+        if (list.some(s => s.callerFuncID === callerMethod && s.argIndex === argIndex)) {
+            return;
+        }
+        list.push({ callerFuncID: callerMethod, argIndex });
+        for (const targetFuncID of state.targets) {
+            this.appendCallbackCallSite(invokeStmt, callerMethod, targetFuncID, resolveResult, argIndex);
+        }
+    }
+    recordCallbackFieldStore(stmt, ownerMethod) {
+        const leftOp = stmt.getLeftOp();
+        if (!(leftOp instanceof Ref_1.ArkInstanceFieldRef)) {
+            return;
+        }
+        if (!this.isCallbackType(leftOp.getType())) {
+            return;
+        }
+        const fieldKey = this.getCallbackFieldKey(leftOp);
+        const rightOp = stmt.getRightOp();
+        const functionType = this.unwrapFunctionType(rightOp.getType());
+        if (functionType) {
+            const callbackMethod = this.scene.getMethod(functionType.getMethodSignature());
+            if (callbackMethod && callbackMethod.getCfg()) {
+                const targetFuncID = this.cg.getCallGraphNodeByMethod(callbackMethod.getSignature()).getID();
+                this.addCallbackFieldTarget(fieldKey, targetFuncID);
+            }
+        }
+        const sourceKey = this.resolveFuncPtrValueToBindingKey(rightOp, ownerMethod);
+        if (sourceKey !== undefined) {
+            this.linkCallbackField(sourceKey, fieldKey);
+        }
+    }
+    /**
+     * Link source parameter binding to a callee parameter slot and copy existing targets.
+     * Future addCallbackTarget calls on the source also propagate through forwards.
+     */
+    linkCallbackBinding(source, target) {
+        if (source === target) {
+            return;
+        }
+        const sourceState = this.getOrCreateBindingState(this.decodeOwnerFuncID(source), this.decodeLogicalArgIndex(source));
+        sourceState.forwards.add(target);
+        const targetOwnerFuncID = this.decodeOwnerFuncID(target);
+        const targetLogicalArgIndex = this.decodeLogicalArgIndex(target);
+        for (const targetFuncID of sourceState.targets) {
+            this.addCallbackTarget(targetOwnerFuncID, targetLogicalArgIndex, targetFuncID);
+        }
+    }
+    addCallbackTarget(ownerFuncID, logicalArgIndex, targetFuncID) {
+        const state = this.getOrCreateBindingState(ownerFuncID, logicalArgIndex);
+        if (state.targets.has(targetFuncID)) {
+            return;
+        }
+        state.targets.add(targetFuncID);
+        for (const [stmt, callerFuncID] of state.subscribers) {
+            this.emitCallbackEdge(callerFuncID, targetFuncID, stmt, logicalArgIndex);
+        }
+        for (const forward of state.forwards) {
+            this.addCallbackTarget(this.decodeOwnerFuncID(forward), this.decodeLogicalArgIndex(forward), targetFuncID);
+        }
+        for (const fieldKey of state.fieldForwards) {
+            this.addCallbackFieldTarget(fieldKey, targetFuncID);
+        }
+    }
+    /**
+     * Create a CallbackCallSite, register it via CallSiteManager (for ID allocation
+     * and getCallSiteById lookup) and via CallGraph maps (for getCallSiteByStmt and
+     * getCallSitesByMethod lookup). The argIndex is set for callback virtual edges
+     * and left undefined for regular (direct/virtual/constructor) call sites.
+     */
+    newRTACallSite(invokeStmt, callerFuncID, calleeFuncID, argIndex) {
+        const normalized = argIndex !== undefined && argIndex >= 0 ? argIndex : undefined;
+        const base = this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, calleeFuncID, callerFuncID);
+        const cs = new CallGraph_1.CallSite(base.id, base.callStmt, base.args, base.calleeFuncID, base.callerFuncID, normalized);
+        this.cg.recordCallSite(invokeStmt, cs);
+        return cs;
+    }
+    emitCallbackEdge(callerFuncID, calleeFuncID, callStmt, argIndex) {
+        this.cg.addDynamicCallEdge(callerFuncID, calleeFuncID, callStmt);
+        this.newRTACallSite(callStmt, callerFuncID, calleeFuncID, argIndex);
+        const calleeNode = this.cg.getNode(calleeFuncID);
+        if (!calleeNode || calleeNode.isSdkMethod()) {
+            return;
+        }
+        if (this.processedMethod.contains(calleeFuncID)) {
+            return;
+        }
+        this.workList.push(calleeFuncID);
+    }
     getOrBuildVirtualDispatchRows(declareClass, methodName) {
         const declareSig = declareClass.getSignature();
         let methodIndex = this.virtualDispatchIndex.get(declareSig);
@@ -140,7 +828,7 @@ class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
         const rows = {
             classSignatures: [],
             calleeNodeIDs: [],
-            isSdkClasses: [],
+            isUnconditionallyReachable: [],
         };
         for (const arkClass of this.getClassHierarchy(declareClass)) {
             const possibleCalleeMethod = arkClass.getMethodWithName(methodName);
@@ -148,16 +836,19 @@ class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
                 continue;
             }
             const classSignature = arkClass.getSignature();
-            if (possibleCalleeMethod.isGenerated() &&
-                classSignature !== declareSig) {
+            if (possibleCalleeMethod.isGenerated() && classSignature !== declareSig) {
                 continue;
             }
             if (possibleCalleeMethod.isAbstract()) {
                 continue;
             }
+            const calleeNodeID = this.cg.getCallGraphNodeByMethod(possibleCalleeMethod.getSignature()).getID();
             rows.classSignatures.push(classSignature);
-            rows.calleeNodeIDs.push(this.cg.getCallGraphNodeByMethod(possibleCalleeMethod.getSignature()).getID());
-            rows.isSdkClasses.push(this.scene.hasSdkFile(classSignature.getDeclaringFileSignature()));
+            rows.calleeNodeIDs.push(calleeNodeID);
+            // OH SDK declare targets, and invoking built-ins (Promise.then / Array.forEach /
+            // ...), need no local `new` to be callable. Container non-invoking APIs still require
+            // instancedClasses (e.g. newarray → Array) so push/indexOf/set are not always-on.
+            rows.isUnconditionallyReachable.push(classSignature === declareSig && this.shouldSynthesizeVirtualCallback(calleeNodeID));
         }
         methodIndex.set(methodName, rows);
         return rows;
@@ -177,7 +868,7 @@ class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
         while (curClass) {
             const methodInClass = curClass.getMethodWithName(methodName);
             if (methodInClass && !methodInClass.isAbstract()) {
-                return this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, this.cg.getCallGraphNodeByMethod(methodInClass.getSignature()).getID(), callerMethod);
+                return this.newRTACallSite(invokeStmt, callerMethod, this.cg.getCallGraphNodeByMethod(methodInClass.getSignature()).getID());
             }
             curClass = curClass.getSuperClass();
         }
@@ -208,25 +899,20 @@ class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
         if (!constructorMethod) {
             return null;
         }
-        return this.cg.getCallSiteManager().newCallSite(invokeStmt, undefined, this.cg.getCallGraphNodeByMethod(constructorMethod.getSignature()).getID(), callerMethod);
+        return this.newRTACallSite(invokeStmt, callerMethod, this.cg.getCallGraphNodeByMethod(constructorMethod.getSignature()).getID());
     }
     preProcessMethod(funcID) {
-        let newCallSites = [];
-        let instancedClasses = this.collectInstancedClassesInMethod(funcID);
-        let newlyInstancedClasses = new Set();
-        for (const sig of instancedClasses) {
-            if (!this.instancedClasses.has(sig)) {
-                newlyInstancedClasses.add(sig);
+        const newCallSites = [];
+        const instancedInMethod = this.collectInstancedClassesInMethod(funcID);
+        instancedInMethod.forEach((sig) => {
+            if (this.instancedClasses.has(sig)) {
+                return;
             }
-        }
-        newlyInstancedClasses.forEach(sig => {
-            let ignoredCalls = this.ignoredCalls.get(sig);
+            const ignoredCalls = this.ignoredCalls.get(sig);
             if (ignoredCalls) {
-                ignoredCalls.forEach(call => {
+                ignoredCalls.forEach((call) => {
                     this.cg.addDynamicCallEdge(call.caller, call.callee, call.callStmt);
-                    const newCallSite = this.cg.getCallSiteManager().newCallSite(call.callStmt, undefined, call.callee, call.caller);
-                    this.cg.addStmtToCallSiteMap(call.callStmt, newCallSite);
-                    this.cg.addMethodToCallSiteMap(call.callee, newCallSite);
+                    const newCallSite = this.newRTACallSite(call.callStmt, call.caller, call.callee);
                     newCallSites.push(newCallSite);
                 });
             }
@@ -247,26 +933,67 @@ class RapidTypeAnalysis extends AbstractAnalysis_1.AbstractAnalysis {
             return instancedClasses;
         }
         for (let stmt of cfg.getStmts()) {
-            let stmtExpr;
-            if (stmt instanceof Stmt_1.ArkAssignStmt && stmt.getRightOp() instanceof Expr_1.ArkNewExpr) {
-                stmtExpr = stmt.getRightOp();
+            if (!(stmt instanceof Stmt_1.ArkAssignStmt)) {
+                continue;
             }
-            else {
+            const rightOp = stmt.getRightOp();
+            this.recordCallbackFieldStore(stmt, arkMethod);
+            if (rightOp instanceof Expr_1.ArkNewExpr) {
+                const classSig = rightOp.getType().getClassSignature();
+                if (classSig !== null && classSig !== undefined) {
+                    // TODO: need to check if different stmt has single sig
+                    instancedClasses.add(classSig);
+                }
                 continue;
             }
-            let classSig = stmtExpr.getType().getClassSignature();
-            if (classSig != null) {
-                // TODO: need to check if different stmt has single sig
-                instancedClasses.add(classSig);
+            // `handlers = []` lowers to newarray, not `new Array`. Treat it as Array instantiation
+            // so built-in Array methods (e.g. push) can pass the RTA instancedClasses gate.
+            if (rightOp instanceof Expr_1.ArkNewArrayExpr) {
+                const arraySig = this.getBuiltinArrayClassSignature();
+                if (arraySig) {
+                    instancedClasses.add(arraySig);
+                }
             }
         }
         return instancedClasses;
     }
+    getBuiltinArrayClassSignature() {
+        if (this.builtinArrayClassResolved) {
+            return this.builtinArrayClassSignature;
+        }
+        this.builtinArrayClassResolved = true;
+        // Built-in Array is not in scene.getClasses(); use the SDK global export
+        // (lib.es5 Array) so the signature matches virtual-dispatch declareClass.
+        const globalArray = this.scene.getSdkGlobal(BUILTIN_ARRAY_CLASS_NAME);
+        if (globalArray instanceof ArkClass_1.ArkClass) {
+            const classSig = globalArray.getSignature();
+            if (classSig.getDeclaringFileSignature().getProjectName() === SdkUtils_1.SdkUtils.BUILT_IN_NAME) {
+                this.builtinArrayClassSignature = classSig;
+            }
+        }
+        return this.builtinArrayClassSignature;
+    }
     addIgnoredCalls(arkClass, callerID, calleeID, invokeStmt) {
-        var _a;
-        let classMap = (_a = this.ignoredCalls.get(arkClass)) !== null && _a !== void 0 ? _a : new Set();
+        let classMap = this.ignoredCalls.get(arkClass);
+        if (!classMap) {
+            classMap = new Set();
+            this.ignoredCalls.set(arkClass, classMap);
+        }
+        for (const existing of classMap) {
+            if (existing.caller === callerID &&
+                existing.callee === calleeID &&
+                existing.callStmt === invokeStmt) {
+                return;
+            }
+        }
         classMap.add({ caller: callerID, callee: calleeID, callStmt: invokeStmt });
-        this.ignoredCalls.set(arkClass, classMap);
     }
 }
 exports.RapidTypeAnalysis = RapidTypeAnalysis;
+RapidTypeAnalysis.CALLBACK_CLASS_SIG_KEY = [
+    '@ohos.base.d.ts: Callback', '@ohos.window.d.ts: Callback', 'component/common.d.ts: Callback',
+    '@ohos.base.d.ts: ErrorCallback',
+    '@ohos.base.d.ts: AsyncCallback',
+    '@ohos.base.d.ts: BusinessError',
+    'lib.es5.d.ts: Function',
+];