coretrace-python-analyzer 0.1.0__py3-none-any.whl

coretrace_python/__init__.py

@@ -0,0 +1,4 @@
+"""CoreTrace's Python static analysis frontend."""
+
+__version__ = "0.1.0"
+

coretrace_python/__main__.py

@@ -0,0 +1,4 @@
+from coretrace_python.cli import main
+
+raise SystemExit(main())
+

coretrace_python/abstract/__init__.py

@@ -0,0 +1,45 @@
+"""Abstract values and the analyses that compute them (architecture §18)."""
+
+from coretrace_python.abstract.constants import (
+    ConstantFacts,
+    ConstantPropagation,
+    propagate_constants,
+)
+from coretrace_python.abstract.heap import (
+    ATTRIBUTES,
+    ELEMENTS,
+    MUTATORS,
+    AbstractObject,
+    AliasSet,
+    AllocationSite,
+    HeapAnalysis,
+    HeapFacts,
+    HeapLocation,
+    analyze_heap,
+    mutated_by,
+)
+from coretrace_python.abstract.ranges import Interval, RangeAnalysis, RangeFacts, analyze_ranges
+from coretrace_python.abstract.values import AbstractValue, Truth
+
+__all__ = [
+    "ATTRIBUTES",
+    "ELEMENTS",
+    "MUTATORS",
+    "AbstractObject",
+    "AbstractValue",
+    "AliasSet",
+    "AllocationSite",
+    "ConstantFacts",
+    "ConstantPropagation",
+    "HeapAnalysis",
+    "HeapFacts",
+    "HeapLocation",
+    "Interval",
+    "RangeAnalysis",
+    "RangeFacts",
+    "Truth",
+    "analyze_heap",
+    "analyze_ranges",
+    "mutated_by",
+    "propagate_constants",
+]

coretrace_python/abstract/constants.py

@@ -0,0 +1,226 @@
+"""Constant propagation: the reference client of the data-flow solver (§18, §38)."""
+
+from __future__ import annotations
+
+import operator
+from collections.abc import Callable, Mapping
+from types import MappingProxyType
+from typing import Any, ClassVar
+
+from coretrace_python.abstract.values import AbstractValue, Truth
+from coretrace_python.analysis import AnalysisContext, AnyAnalysis, FunctionAnalysis
+from coretrace_python.cfg import CFG, BlockId, CFGAnalysis
+from coretrace_python.dataflow import BOTTOM, TOP, DataflowProblem, Direction, solve
+from coretrace_python.hir import nodes
+from coretrace_python.ir.model import (
+    BasicBlock,
+    BinaryOp,
+    Branch,
+    Compare,
+    Constant,
+    ForNext,
+    FunctionIR,
+    Instruction,
+    Jump,
+    Phi,
+    UnaryOp,
+    Value,
+)
+from coretrace_python.ir.ssa import SSAAnalysis
+
+State = Mapping[Value, AbstractValue]
+
+_SAFE_TYPES = (int, float, bool, str, bytes, type(None))
+_NUMERIC = frozenset({"int", "float", "bool"})
+
+_BINARY: Mapping[str, Callable[..., Any]] = {
+    "add": operator.add,
+    "sub": operator.sub,
+    "mul": operator.mul,
+    "div": operator.truediv,
+    "floor_div": operator.floordiv,
+    "mod": operator.mod,
+    "bit_or": operator.or_,
+    "bit_xor": operator.xor,
+    "bit_and": operator.and_,
+}
+_COMPARE: Mapping[str, Callable[..., Any]] = {
+    "eq": operator.eq,
+    "not_eq": operator.ne,
+    "lt": operator.lt,
+    "lt_eq": operator.le,
+    "gt": operator.gt,
+    "gt_eq": operator.ge,
+    "is": operator.is_,
+    "is_not": operator.is_not,
+    "in": lambda a, b: a in b,
+    "not_in": lambda a, b: a not in b,
+}
+_UNARY: Mapping[str, Callable[..., Any]] = {
+    "neg": operator.neg,
+    "pos": operator.pos,
+    "invert": operator.invert,
+}
+
+
+class ConstantFacts:
+    def __init__(self, values: Mapping[Value, AbstractValue], reachable: frozenset[BlockId]):
+        self._values = MappingProxyType(dict(values))
+        self._reachable = reachable
+
+    def value(self, value: Value) -> AbstractValue:
+        return self._values.get(value, AbstractValue.bottom())
+
+    def reachable(self, block: BlockId) -> bool:
+        return block in self._reachable
+
+
+class _ConstantProblem(DataflowProblem[State]):
+    direction: ClassVar[Direction] = Direction.FORWARD
+
+    def __init__(self, function: FunctionIR) -> None:
+        self.function = function
+        self.blocks = {block.id: block for block in function.blocks}
+
+    def initial(self) -> State:
+        return MappingProxyType({p: AbstractValue.unknown() for p in self.function.parameters})
+
+    def join(self, a: State, b: State) -> State:
+        merged = dict(a)
+        for value, fact in b.items():
+            merged[value] = merged[value].join(fact) if value in merged else fact
+        return MappingProxyType(merged)
+
+    def evaluate(self, block: BasicBlock, incoming: Mapping[BlockId, State]) -> State:
+        """State after ``block`` given the states on its executable incoming edges."""
+
+        states = list(incoming.values())
+        state = dict(states[0])
+        for other in states[1:]:
+            state = dict(self.join(state, other))
+        for instruction in block.instructions:
+            if instruction.result is None:
+                continue
+            state[instruction.result] = (
+                self.phi(instruction, incoming)
+                if isinstance(instruction, Phi)
+                else self.instruction(instruction, state)
+            )
+        if isinstance(block.terminator, ForNext) and block.terminator.result is not None:
+            state[block.terminator.result] = AbstractValue.unknown()
+        return MappingProxyType(state)
+
+    def flow(self, cfg: CFG, block_id: BlockId, incoming: Mapping[BlockId, State]) -> Mapping[BlockId, State]:
+        block = self.blocks[block_id]
+        state = self.evaluate(block, incoming)
+        exits = {target: state for target in block.exception_targets}
+        terminator = block.terminator
+        if isinstance(terminator, Branch):
+            truth = state[terminator.condition].truthiness
+            targets = {
+                Truth.TRUE: (terminator.then_block,),
+                Truth.FALSE: (terminator.else_block,),
+                Truth.UNKNOWN: (terminator.then_block, terminator.else_block),
+            }[truth]
+            return {**exits, **{target: state for target in targets}}
+        if isinstance(terminator, Jump):
+            return {**exits, terminator.target: state}
+        if isinstance(terminator, ForNext):
+            return {**exits, terminator.body: state, terminator.exit: state}
+        return exits
+
+    # ------------------------------------------------------------------ transfer
+
+    def phi(self, phi: Phi, incoming: Mapping[BlockId, State]) -> AbstractValue:
+        result = AbstractValue.bottom()
+        for value, predecessor in phi.incoming:
+            if predecessor in incoming:
+                result = result.join(incoming[predecessor].get(value, AbstractValue.unknown()))
+        return result
+
+    def instruction(self, instruction: Instruction, state: Mapping[Value, AbstractValue]) -> AbstractValue:
+        if isinstance(instruction, Constant):
+            return AbstractValue.of(instruction.value)
+        if isinstance(instruction, BinaryOp):
+            return self.binary(instruction, state[instruction.left], state[instruction.right])
+        if isinstance(instruction, Compare):
+            return self.fold(_COMPARE[instruction.operator], state[instruction.left], state[instruction.right])
+        if isinstance(instruction, UnaryOp):
+            return self.unary(instruction, state[instruction.operand])
+        return AbstractValue.unknown()
+
+    def binary(self, op: BinaryOp, left: AbstractValue, right: AbstractValue) -> AbstractValue:
+        folder = _BINARY.get(op.operator)
+        if folder is not None:
+            numeric_only = op.operator == "mul"
+            folded = self.fold(folder, left, right, numeric_only=numeric_only)
+            if folded.constant is not TOP:
+                return folded
+        return AbstractValue.unknown(self.result_types(op.operator, left, right))
+
+    @staticmethod
+    def result_types(operator_name: str, left: AbstractValue, right: AbstractValue) -> frozenset[str] | None:
+        if left.types is None or right.types is None:
+            return None
+        if left.types <= _NUMERIC and right.types <= _NUMERIC:
+            if operator_name == "div" or "float" in left.types | right.types:
+                return frozenset({"float"})
+            if operator_name in _BINARY:
+                return frozenset({"int"})
+        if operator_name == "add" and left.types == right.types == frozenset({"str"}):
+            return frozenset({"str"})
+        return None
+
+    def unary(self, op: UnaryOp, operand: AbstractValue) -> AbstractValue:
+        if op.operator == "not":
+            if operand.truthiness is Truth.UNKNOWN:
+                return AbstractValue.unknown(frozenset({"bool"}))
+            return AbstractValue.of(operand.truthiness is Truth.FALSE)
+        folder = _UNARY.get(op.operator)
+        if folder is None or operand.constant is TOP or operand.constant is BOTTOM:
+            return AbstractValue.unknown()
+        if not isinstance(operand.constant, (int, float, bool)):
+            return AbstractValue.unknown()
+        try:
+            return AbstractValue.of(folder(operand.constant))
+        except (TypeError, ValueError, ArithmeticError):
+            return AbstractValue.unknown()
+
+    @staticmethod
+    def fold(
+        folder: Callable[..., Any],
+        left: AbstractValue,
+        right: AbstractValue,
+        *,
+        numeric_only: bool = False,
+    ) -> AbstractValue:
+        for side in (left.constant, right.constant):
+            if side is TOP or side is BOTTOM or not isinstance(side, _SAFE_TYPES):
+                return AbstractValue.unknown()
+        if numeric_only and not all(isinstance(c, (int, float, bool)) for c in (left.constant, right.constant)):
+            return AbstractValue.unknown()
+        try:
+            return AbstractValue.of(folder(left.constant, right.constant))
+        except (TypeError, ValueError, ArithmeticError):
+            return AbstractValue.unknown()
+
+
+def propagate_constants(function: FunctionIR, cfg: CFG) -> ConstantFacts:
+    problem = _ConstantProblem(function)
+    solution = solve(problem, cfg)
+    values: dict[Value, AbstractValue] = {}
+    reachable: set[BlockId] = set()
+    for block in function.blocks:
+        if solution.reached(block.id):
+            reachable.add(block.id)
+            values.update(problem.evaluate(block, solution.incoming(block.id)))
+    return ConstantFacts(values, frozenset(reachable))
+
+
+class ConstantPropagation(FunctionAnalysis[ConstantFacts]):
+    name: ClassVar[str] = "abstract.constants"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis, CFGAnalysis})
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext, function: nodes.Function) -> ConstantFacts:
+        return propagate_constants(ctx.get(SSAAnalysis, function), ctx.get(CFGAnalysis, function))

coretrace_python/abstract/heap.py

@@ -0,0 +1,252 @@
+"""Coarse heap and aliasing abstraction (architecture §22).
+
+SSA names values, not objects. This domain gives every allocation site one
+``AbstractObject``: containers and calls at their instruction, parameters, module
+globals and imported symbols by name, and the fields loaded from an object by field.
+Each value points to an ``AliasSet`` of objects, computed by a flow-insensitive
+points-to fixpoint over the SSA form; each object has two ``HeapLocation`` fields,
+``elements`` for its items and ``attributes`` for its attributes, field-insensitive
+within each. Taint and dependence analyses key their states by these locations, so a
+store, a mutating method call or a load on any alias reads and writes the same place.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from types import MappingProxyType
+from typing import ClassVar
+
+from coretrace_python.analysis import AnalysisContext, AnyAnalysis, FunctionAnalysis
+from coretrace_python.hir import nodes
+from coretrace_python.ir.model import (
+    Await,
+    BuildDict,
+    BuildList,
+    BuildSet,
+    BuildTuple,
+    Call,
+    Catch,
+    ForNext,
+    FunctionIR,
+    GetAttr,
+    GetItem,
+    GetIter,
+    Global,
+    Instruction,
+    Phi,
+    SetAttr,
+    SetItem,
+    Symbol,
+    Value,
+    WithEnter,
+    Yield,
+)
+from coretrace_python.ir.ssa import SSAAnalysis
+from coretrace_python.source import SourceSpan
+
+ELEMENTS = "elements"
+ATTRIBUTES = "attributes"
+
+# Method names that store their arguments into the receiver's elements.
+MUTATORS = frozenset(
+    {"append", "appendleft", "extend", "extendleft", "insert", "add", "update", "setdefault", "put"}
+)
+
+
+@dataclass(frozen=True)
+class AllocationSite:
+    kind: str
+    location: SourceSpan
+    name: str = ""
+    ordinal: int = 0
+
+    def __str__(self) -> str:
+        text = f"{self.kind}@{self.location.source_id}:{self.location.start_line}"
+        if self.name:
+            text += f":{self.name}"
+        if self.ordinal:
+            text += f"#{self.ordinal}"
+        return text
+
+
+@dataclass(frozen=True)
+class AbstractObject:
+    site: AllocationSite
+
+    def __str__(self) -> str:
+        return str(self.site)
+
+
+@dataclass(frozen=True)
+class HeapLocation:
+    object: AbstractObject
+    field: str
+
+    def __str__(self) -> str:
+        return f"{self.object}.{self.field}"
+
+
+AliasSet = frozenset[AbstractObject]
+NOTHING: AliasSet = frozenset()
+
+
+class HeapFacts:
+    def __init__(self, objects: Mapping[Value, AliasSet]) -> None:
+        self._objects: Mapping[Value, AliasSet] = MappingProxyType(dict(objects))
+        self.values = tuple(objects)
+
+    def objects(self, value: Value) -> AliasSet:
+        return self._objects.get(value, NOTHING)
+
+    def locations(self, value: Value, field: str) -> tuple[HeapLocation, ...]:
+        return tuple(HeapLocation(o, field) for o in sorted(self.objects(value), key=str))
+
+
+def mutated_by(call: Call, defs: Mapping[Value, Instruction]) -> Value | None:
+    """The receiver of a call to a mutating method (``xs.append(v)``), if any."""
+
+    callee = defs.get(call.callee)
+    if isinstance(callee, GetAttr) and callee.attribute in MUTATORS:
+        return callee.object
+    return None
+
+
+class _PointsTo:
+    def __init__(self, function: FunctionIR) -> None:
+        self.function = function
+        self.defs: dict[Value, Instruction] = {
+            i.result: i for block in function.blocks for i in block.instructions if i.result
+        }
+        self.points: dict[Value, set[AbstractObject]] = {}
+        self.heap: dict[HeapLocation, set[AbstractObject]] = {}
+        self.named: dict[tuple[str, str], AbstractObject] = {}
+        for index, parameter in enumerate(function.parameters):
+            self.points[parameter] = {
+                AbstractObject(AllocationSite("parameter", function.location, ordinal=index))
+            }
+
+    def named_object(self, kind: str, name: str) -> AbstractObject:
+        key = (kind, name)
+        if key not in self.named:
+            self.named[key] = AbstractObject(AllocationSite(kind, self.function.location, name))
+        return self.named[key]
+
+    @staticmethod
+    def field_object(owner: AbstractObject, field: str) -> AbstractObject:
+        # A field of a field collapses onto itself, so chains such as ``node.next``
+        # in a loop stay finite.
+        if owner.site.kind == "field":
+            return owner
+        return AbstractObject(AllocationSite("field", owner.site.location, f"{owner.site}.{field}"))
+
+    def of(self, value: Value) -> set[AbstractObject]:
+        return self.points.setdefault(value, set())
+
+    def at(self, objects: set[AbstractObject], field: str) -> set[AbstractObject]:
+        found: set[AbstractObject] = set()
+        for owner in objects:
+            found |= self.heap.setdefault(HeapLocation(owner, field), set())
+            found.add(self.field_object(owner, field))
+        return found
+
+    def store(self, objects: set[AbstractObject], field: str, value: Value) -> bool:
+        changed = False
+        for owner in objects:
+            location = self.heap.setdefault(HeapLocation(owner, field), set())
+            before = len(location)
+            location |= self.of(value)
+            changed |= len(location) != before
+        return changed
+
+    def solve(self) -> None:
+        changed = True
+        while changed:
+            changed = False
+            for block in self.function.blocks:
+                for instruction in block.instructions:
+                    changed |= self.instruction(instruction)
+                terminator = block.terminator
+                if isinstance(terminator, ForNext) and terminator.result is not None:
+                    changed |= self.assign(terminator.result, self.at(self.of(terminator.iterator), ELEMENTS))
+
+    def assign(self, value: Value, objects: set[AbstractObject]) -> bool:
+        current = self.of(value)
+        before = len(current)
+        current |= objects
+        return len(current) != before
+
+    def instruction(self, instruction: Instruction) -> bool:
+        if isinstance(instruction, SetAttr):
+            return self.store(self.of(instruction.object), ATTRIBUTES, instruction.value)
+        if isinstance(instruction, SetItem):
+            return self.store(self.of(instruction.object), ELEMENTS, instruction.value)
+        result = instruction.result
+        if result is None:
+            return False
+        if isinstance(instruction, BuildList | BuildTuple | BuildDict | BuildSet | Call | WithEnter | Catch | Yield):
+            kind = {
+                BuildList: "list",
+                BuildTuple: "tuple",
+                BuildDict: "dict",
+                BuildSet: "set",
+                Call: "call",
+                WithEnter: "context",
+                Catch: "exception",
+                Yield: "sent",
+            }[type(instruction)]
+            site = AbstractObject(AllocationSite(kind, instruction.location))
+            changed = self.assign(result, {site})
+            if isinstance(instruction, BuildList | BuildTuple | BuildDict | BuildSet):
+                values = (
+                    tuple(v for _, v in instruction.items)
+                    if isinstance(instruction, BuildDict)
+                    else instruction.elements
+                )
+                for element in values:
+                    changed |= self.store({site}, ELEMENTS, element)
+                for unpacked in instruction.unpacked:
+                    contents = self.at(self.of(unpacked), ELEMENTS)
+                    location = self.heap.setdefault(HeapLocation(site, ELEMENTS), set())
+                    before = len(location)
+                    location |= contents
+                    changed |= len(location) != before
+            elif isinstance(instruction, Call):
+                receiver = mutated_by(instruction, self.defs)
+                if receiver is not None:
+                    for argument in instruction.argument_values():
+                        changed |= self.store(self.of(receiver), ELEMENTS, argument)
+            return changed
+        if isinstance(instruction, Global):
+            return self.assign(result, {self.named_object("global", instruction.name)})
+        if isinstance(instruction, Symbol):
+            return self.assign(result, {self.named_object("symbol", instruction.symbol_id.canonical_name)})
+        if isinstance(instruction, Phi):
+            objects: set[AbstractObject] = set()
+            for value, _ in instruction.incoming:
+                objects |= self.of(value)
+            return self.assign(result, objects)
+        if isinstance(instruction, GetAttr):
+            return self.assign(result, self.at(self.of(instruction.object), ATTRIBUTES))
+        if isinstance(instruction, GetItem):
+            return self.assign(result, self.at(self.of(instruction.object), ELEMENTS))
+        if isinstance(instruction, GetIter):
+            return self.assign(result, self.of(instruction.iterable))
+        if isinstance(instruction, Await):
+            return self.assign(result, self.of(instruction.value))
+        return False
+
+
+def analyze_heap(function: FunctionIR) -> HeapFacts:
+    solver = _PointsTo(function)
+    solver.solve()
+    return HeapFacts({value: frozenset(objects) for value, objects in solver.points.items() if objects})
+
+
+class HeapAnalysis(FunctionAnalysis[HeapFacts]):
+    name: ClassVar[str] = "abstract.heap"
+    requires: ClassVar[frozenset[AnyAnalysis]] = frozenset({SSAAnalysis})
+
+    @classmethod
+    def compute(cls, ctx: AnalysisContext, function: nodes.Function) -> HeapFacts:
+        return analyze_heap(ctx.get(SSAAnalysis, function))