-
Notifications
You must be signed in to change notification settings - Fork 27
[TS Calls] Centralize unknown-call classification and dispatch #371
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
CaelmBleidd
merged 3 commits into
main
from
caelmbleidd/issue-362-unknown-call-dispatch
Aug 22, 2026
Merged
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
174 changes: 174 additions & 0 deletions
174
usvm-ts/src/main/kotlin/org/usvm/machine/call/TsUnknownCall.kt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,174 @@ | ||
| package org.usvm.machine.call | ||
|
|
||
| import org.jacodb.ets.model.EtsCallExpr | ||
| import org.jacodb.ets.model.EtsInstanceCallExpr | ||
| import org.jacodb.ets.model.EtsMethodSignature | ||
| import org.jacodb.ets.model.EtsPtrCallExpr | ||
| import org.jacodb.ets.model.EtsStmt | ||
| import org.jacodb.ets.model.EtsType | ||
| import org.jacodb.ets.model.EtsValue | ||
| import org.jacodb.ets.utils.CONSTRUCTOR_NAME | ||
| import org.usvm.UExpr | ||
| import org.usvm.api.mockMethodCall | ||
| import org.usvm.machine.TsConcreteMethodCallStmt | ||
| import org.usvm.machine.TsVirtualMethodCallStmt | ||
| import org.usvm.machine.interpreter.TsStepScope | ||
| import org.usvm.machine.state.TsMethodResult | ||
| import org.usvm.machine.state.newStmt | ||
|
|
||
| /** | ||
| * A call that the regular TypeScript execution pipeline could not execute. | ||
| * | ||
| * Frontend call resolution and the existing built-in approximations run before this boundary. A call reaches the | ||
| * dispatcher only after one of those stages cannot continue normally. Successful compatibility approximations such | ||
| * as `toString`, `valueOf`, `Math.floor`, and `$r` therefore remain outside this boundary until they are classified | ||
| * and migrated as semantic models. Failures that happen while evaluating a callee or allocating its receiver also | ||
| * remain pre-call failures and are not dispatched. | ||
| */ | ||
| data class TsUnknownCall( | ||
| val callee: EtsMethodSignature, | ||
| val receiver: TsUnknownCallValue?, | ||
| val arguments: List<TsUnknownCallValue>, | ||
| val resultType: EtsType, | ||
| val callSite: EtsStmt, | ||
| val failureReason: TsUnknownCallFailureReason, | ||
| ) | ||
|
|
||
| /** | ||
| * Keeps the frontend value and the symbolic value, when the latter was available at the point of failure. | ||
| * | ||
| * Compatibility behavior deliberately does not resolve missing values eagerly: doing so could evaluate argument | ||
| * expressions that the old implementation never evaluated before stopping or mocking the call. | ||
| */ | ||
| data class TsUnknownCallValue( | ||
| val source: EtsValue, | ||
| val resolved: UExpr<*>?, | ||
| ) | ||
|
|
||
| /** Identifies the execution stage that prevented a TypeScript call from continuing normally. */ | ||
| enum class TsUnknownCallFailureReason { | ||
| STATIC_METHOD_NOT_FOUND, | ||
| NON_REFERENCE_RECEIVER, | ||
| RECEIVER_CLASS_NOT_FOUND, | ||
| UNSUPPORTED_RECEIVER_TYPE, | ||
| VIRTUAL_METHOD_NOT_FOUND, | ||
| RECEIVER_TYPE_STREAM_UNAVAILABLE, | ||
| ANY_RECEIVER, | ||
| NO_SUITABLE_VIRTUAL_TARGET, | ||
| POINTER_TARGET_NOT_FOUND, | ||
| NON_REFERENCE_POINTER, | ||
| METHOD_BODY_UNAVAILABLE, | ||
| INTERPROCEDURAL_ANALYSIS_DISABLED, | ||
| LOGGING_CALL, | ||
| } | ||
|
|
||
| /** Handles TypeScript calls that could not be executed by the regular call pipeline. */ | ||
| fun interface TsUnknownCallDispatcher { | ||
|
github-advanced-security[bot] marked this conversation as resolved.
Fixed
|
||
| fun dispatch(scope: TsStepScope, call: TsUnknownCall) | ||
| } | ||
|
|
||
| /** Preserves the pruning and opaque-return behavior that existed before the common dispatch boundary. */ | ||
| object TsCompatibilityUnknownCallDispatcher : TsUnknownCallDispatcher { | ||
| override fun dispatch(scope: TsStepScope, call: TsUnknownCall) { | ||
| val isUnresolvedConstructor = call.failureReason == TsUnknownCallFailureReason.RECEIVER_CLASS_NOT_FOUND && | ||
| call.callee.name == CONSTRUCTOR_NAME | ||
|
|
||
| if (isUnresolvedConstructor) { | ||
| val receiver = requireNotNull(call.receiver?.resolved) { | ||
| "An unresolved constructor must have a resolved receiver" | ||
| } | ||
| scope.doWithState { | ||
| methodResult = TsMethodResult.Success.MockedCall(receiver, call.callee) | ||
| newStmt(call.callSite) | ||
| } | ||
| return | ||
| } | ||
|
|
||
| when (call.failureReason) { | ||
| TsUnknownCallFailureReason.ANY_RECEIVER, | ||
| TsUnknownCallFailureReason.NO_SUITABLE_VIRTUAL_TARGET, | ||
| TsUnknownCallFailureReason.NON_REFERENCE_POINTER, | ||
| TsUnknownCallFailureReason.METHOD_BODY_UNAVAILABLE, | ||
| TsUnknownCallFailureReason.INTERPROCEDURAL_ANALYSIS_DISABLED, | ||
| TsUnknownCallFailureReason.LOGGING_CALL, | ||
| -> { | ||
| mockMethodCall(scope, call.callee) | ||
| scope.doWithState { newStmt(call.callSite) } | ||
| } | ||
|
|
||
| TsUnknownCallFailureReason.STATIC_METHOD_NOT_FOUND, | ||
| TsUnknownCallFailureReason.NON_REFERENCE_RECEIVER, | ||
| TsUnknownCallFailureReason.RECEIVER_CLASS_NOT_FOUND, | ||
| TsUnknownCallFailureReason.UNSUPPORTED_RECEIVER_TYPE, | ||
| TsUnknownCallFailureReason.VIRTUAL_METHOD_NOT_FOUND, | ||
| TsUnknownCallFailureReason.RECEIVER_TYPE_STREAM_UNAVAILABLE, | ||
| TsUnknownCallFailureReason.POINTER_TARGET_NOT_FOUND, | ||
| -> { | ||
| val falseExpr = scope.calcOnState { ctx.falseExpr } | ||
| scope.assert(falseExpr) | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| internal fun TsUnknownCallDispatcher.dispatch( | ||
| scope: TsStepScope, | ||
| call: EtsCallExpr, | ||
| callSite: EtsStmt, | ||
| failureReason: TsUnknownCallFailureReason, | ||
| callee: EtsMethodSignature = call.callee, | ||
| resolvedReceiver: UExpr<*>? = null, | ||
| resolvedArguments: List<UExpr<*>?> = List(call.args.size) { null }, | ||
| ) { | ||
| require(resolvedArguments.size == call.args.size) { | ||
| "Expected ${call.args.size} resolved argument slots, got ${resolvedArguments.size}" | ||
| } | ||
|
|
||
| val receiverSource = when (call) { | ||
| is EtsInstanceCallExpr -> call.instance | ||
| is EtsPtrCallExpr -> call.ptr | ||
| else -> null | ||
| } | ||
| dispatch( | ||
| scope, | ||
| TsUnknownCall( | ||
| callee = callee, | ||
| receiver = receiverSource?.let { TsUnknownCallValue(it, resolvedReceiver) }, | ||
| arguments = call.args.zip(resolvedArguments) { source, resolved -> | ||
| TsUnknownCallValue(source, resolved) | ||
| }, | ||
| resultType = call.type, | ||
| callSite = callSite, | ||
| failureReason = failureReason, | ||
| ), | ||
| ) | ||
| } | ||
|
|
||
| internal fun TsUnknownCallDispatcher.dispatch( | ||
| scope: TsStepScope, | ||
| call: TsVirtualMethodCallStmt, | ||
| failureReason: TsUnknownCallFailureReason, | ||
| resolvedReceiver: UExpr<*>, | ||
| ) = dispatch( | ||
| scope = scope, | ||
| call = call.call, | ||
| callSite = call.returnSite, | ||
| failureReason = failureReason, | ||
| resolvedReceiver = resolvedReceiver, | ||
| resolvedArguments = call.args, | ||
| ) | ||
|
|
||
| internal fun TsUnknownCallDispatcher.dispatch( | ||
| scope: TsStepScope, | ||
| call: TsConcreteMethodCallStmt, | ||
| failureReason: TsUnknownCallFailureReason, | ||
| callee: EtsMethodSignature, | ||
| ) = dispatch( | ||
| scope = scope, | ||
| call = call.call, | ||
| callSite = call.returnSite, | ||
| failureReason = failureReason, | ||
| callee = callee, | ||
| resolvedReceiver = call.resolvedReceiver, | ||
| resolvedArguments = call.args.takeLast(call.call.args.size), | ||
| ) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.