call.go

     1  // Copyright 2018 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package escape
     6  
     7  import (
     8  	"cmd/compile/internal/base"
     9  	"cmd/compile/internal/ir"
    10  	"cmd/compile/internal/typecheck"
    11  	"cmd/compile/internal/types"
    12  	"cmd/internal/src"
    13  	"strings"
    14  )
    15  
    16  // call evaluates a call expressions, including builtin calls. ks
    17  // should contain the holes representing where the function callee's
    18  // results flows.
    19  func (e *escape) call(ks []hole, call ir.Node) {
    20  	argument := func(k hole, arg ir.Node) {
    21  		// TODO(mdempsky): Should be "call argument".
    22  		e.expr(k.note(call, "call parameter"), arg)
    23  	}
    24  
    25  	switch call.Op() {
    26  	default:
    27  		ir.Dump("esc", call)
    28  		base.Fatalf("unexpected call op: %v", call.Op())
    29  
    30  	case ir.OCALLFUNC, ir.OCALLINTER:
    31  		call := call.(*ir.CallExpr)
    32  		typecheck.AssertFixedCall(call)
    33  
    34  		// Pick out the function callee(s), if statically known.
    35  		// fns collects all known callees; for a single static callee
    36  		// it has one element. For unknown callees fns is nil.
    37  		//
    38  		// TODO(mdempsky): Change fns from []*ir.Name to []*ir.Func,
    39  		// but some functions (e.g., runtime builtins, method wrappers,
    40  		// generated eq/hash functions) don't have it set. Investigate
    41  		// whether that's a concern.
    42  		var fns []*ir.Name
    43  		switch call.Op() {
    44  		case ir.OCALLFUNC:
    45  			ro := e.reassignOracle(e.curfn)
    46  			v := ro.StaticValue(call.Fun)
    47  			if fn := ir.StaticCalleeName(v); fn != nil {
    48  				fns = []*ir.Name{fn}
    49  			} else if name, ok := v.(*ir.Name); ok {
    50  				fns = resolveAssignedCallees(ro.FuncAssignments(name.Canonical()))
    51  			}
    52  		}
    53  
    54  		fntype := call.Fun.Type()
    55  		if len(fns) == 1 {
    56  			fntype = fns[0].Type()
    57  		}
    58  
    59  		// Wire result flows for in-batch callees.
    60  		if ks != nil {
    61  			for _, f := range fns {
    62  				if e.inMutualBatch(f) {
    63  					for i, result := range f.Type().Results() {
    64  						e.expr(ks[i], result.Nname.(*ir.Name))
    65  					}
    66  				}
    67  			}
    68  		}
    69  
    70  		var recvArg ir.Node
    71  		if call.Op() == ir.OCALLFUNC {
    72  			// Evaluate callee function expression.
    73  			calleeK := e.discardHole()
    74  			if len(fns) == 0 { // unknown callee
    75  				for _, k := range ks {
    76  					if k.dst != &e.blankLoc {
    77  						// The results flow somewhere, but we don't statically
    78  						// know the callee function. If a closure flows here, we
    79  						// need to conservatively assume its results might flow to
    80  						// the heap.
    81  						calleeK = e.calleeHole().note(call, "callee operand")
    82  						break
    83  					}
    84  				}
    85  			}
    86  			e.expr(calleeK, call.Fun)
    87  		} else {
    88  			recvArg = call.Fun.(*ir.SelectorExpr).X
    89  		}
    90  
    91  		args := call.Args
    92  		if fntype.Recv() != nil {
    93  			if recvArg == nil {
    94  				// Function call using method expression. Receiver argument is
    95  				// at the front of the regular arguments list.
    96  				recvArg, args = args[0], args[1:]
    97  			}
    98  		}
    99  
   100  		if call.IsCompilerVarLive {
   101  			// Don't escape compiler-inserted KeepAlive.
   102  			if recvArg != nil {
   103  				argument(e.discardHole(), recvArg)
   104  			}
   105  			for _, arg := range args {
   106  				argument(e.discardHole(), arg)
   107  			}
   108  		} else if isEscapeNonString(fns, fntype) {
   109  			// internal/abi.EscapeNonString forces its argument to
   110  			// the heap if it contains a non-string pointer. This is
   111  			// used in hash/maphash.Comparable (where we cannot hash
   112  			// pointers to locals whose address may change on stack
   113  			// growth) and unique.clone (to model the data flow edge
   114  			// with strings excluded, because strings are cloned by
   115  			// content). The actual call we match is:
   116  			//   internal/abi.EscapeNonString[go.shape.T](dict, go.shape.T)
   117  			k := e.heapHole()
   118  			if !hasNonStringPointers(fntype.Params()[1].Type) {
   119  				k = e.discardHole()
   120  			}
   121  			for _, arg := range args {
   122  				argument(k, arg)
   123  			}
   124  		} else {
   125  			if recvArg != nil {
   126  				e.rewriteArgument(recvArg, call, fns)
   127  				argument(e.mergedTagHole(ks, fns, -1, len(fntype.Params())), recvArg)
   128  			}
   129  			for i := range fntype.Params() {
   130  				e.rewriteArgument(args[i], call, fns)
   131  				argument(e.mergedTagHole(ks, fns, i, len(fntype.Params())), args[i])
   132  			}
   133  		}
   134  
   135  	case ir.OINLCALL:
   136  		call := call.(*ir.InlinedCallExpr)
   137  		e.stmts(call.Body)
   138  		for i, result := range call.ReturnVars {
   139  			k := e.discardHole()
   140  			if ks != nil {
   141  				k = ks[i]
   142  			}
   143  			e.expr(k, result)
   144  		}
   145  
   146  	case ir.OAPPEND:
   147  		call := call.(*ir.CallExpr)
   148  		args := call.Args
   149  
   150  		// Appendee slice may flow directly to the result, if
   151  		// it has enough capacity. Alternatively, a new heap
   152  		// slice might be allocated, and all slice elements
   153  		// might flow to heap.
   154  		appendeeK := e.teeHole(ks[0], e.mutatorHole())
   155  		if args[0].Type().Elem().HasPointers() {
   156  			appendeeK = e.teeHole(appendeeK, e.heapHole().deref(call, "appendee slice"))
   157  		}
   158  		argument(appendeeK, args[0])
   159  
   160  		if call.IsDDD {
   161  			appendedK := e.discardHole()
   162  			if args[1].Type().IsSlice() && args[1].Type().Elem().HasPointers() {
   163  				appendedK = e.heapHole().deref(call, "appended slice...")
   164  			}
   165  			argument(appendedK, args[1])
   166  		} else {
   167  			for i := 1; i < len(args); i++ {
   168  				argument(e.heapHole(), args[i])
   169  			}
   170  		}
   171  		e.discard(call.RType)
   172  
   173  		// Model the new backing store that might be allocated by append.
   174  		// Its address flows to the result.
   175  		// Users of escape analysis can look at the escape information for OAPPEND
   176  		// and use that to decide where to allocate the backing store.
   177  		backingStore := e.spill(ks[0], call)
   178  		// As we have a boolean to prevent reuse, we can treat these allocations as outside any loops.
   179  		backingStore.dst.loopDepth = 0
   180  
   181  	case ir.OCOPY:
   182  		call := call.(*ir.BinaryExpr)
   183  		argument(e.mutatorHole(), call.X)
   184  
   185  		copiedK := e.discardHole()
   186  		if call.Y.Type().IsSlice() && call.Y.Type().Elem().HasPointers() {
   187  			copiedK = e.heapHole().deref(call, "copied slice")
   188  		}
   189  		argument(copiedK, call.Y)
   190  		e.discard(call.RType)
   191  
   192  	case ir.OPANIC:
   193  		call := call.(*ir.UnaryExpr)
   194  		argument(e.heapHole(), call.X)
   195  
   196  	case ir.OCOMPLEX:
   197  		call := call.(*ir.BinaryExpr)
   198  		e.discard(call.X)
   199  		e.discard(call.Y)
   200  
   201  	case ir.ODELETE, ir.OPRINT, ir.OPRINTLN, ir.ORECOVER:
   202  		call := call.(*ir.CallExpr)
   203  		for _, arg := range call.Args {
   204  			e.discard(arg)
   205  		}
   206  		e.discard(call.RType)
   207  
   208  	case ir.OMIN, ir.OMAX:
   209  		call := call.(*ir.CallExpr)
   210  		for _, arg := range call.Args {
   211  			argument(ks[0], arg)
   212  		}
   213  		e.discard(call.RType)
   214  
   215  	case ir.OLEN, ir.OCAP, ir.OREAL, ir.OIMAG, ir.OCLOSE:
   216  		call := call.(*ir.UnaryExpr)
   217  		e.discard(call.X)
   218  
   219  	case ir.OCLEAR:
   220  		call := call.(*ir.UnaryExpr)
   221  		argument(e.mutatorHole(), call.X)
   222  
   223  	case ir.OUNSAFESTRINGDATA, ir.OUNSAFESLICEDATA:
   224  		call := call.(*ir.UnaryExpr)
   225  		argument(ks[0], call.X)
   226  
   227  	case ir.OUNSAFEADD, ir.OUNSAFESLICE, ir.OUNSAFESTRING:
   228  		call := call.(*ir.BinaryExpr)
   229  		argument(ks[0], call.X)
   230  		e.discard(call.Y)
   231  		e.discard(call.RType)
   232  	}
   233  }
   234  
   235  // goDeferStmt analyzes a "go" or "defer" statement.
   236  func (e *escape) goDeferStmt(n *ir.GoDeferStmt) {
   237  	k := e.heapHole()
   238  	if n.Op() == ir.ODEFER && e.loopDepth == 1 && n.DeferAt == nil {
   239  		// Top-level defer arguments don't escape to the heap,
   240  		// but they do need to last until they're invoked.
   241  		k = e.later(e.discardHole())
   242  
   243  		// force stack allocation of defer record, unless
   244  		// open-coded defers are used (see ssa.go)
   245  		n.SetEsc(ir.EscNever)
   246  	}
   247  
   248  	// If the function is already a zero argument/result function call,
   249  	// just escape analyze it normally.
   250  	//
   251  	// Note that the runtime is aware of this optimization for
   252  	// "go" statements that start in reflect.makeFuncStub or
   253  	// reflect.methodValueCall.
   254  
   255  	call, ok := n.Call.(*ir.CallExpr)
   256  	if !ok || call.Op() != ir.OCALLFUNC {
   257  		base.FatalfAt(n.Pos(), "expected function call: %v", n.Call)
   258  	}
   259  	if sig := call.Fun.Type(); sig.NumParams()+sig.NumResults() != 0 {
   260  		base.FatalfAt(n.Pos(), "expected signature without parameters or results: %v", sig)
   261  	}
   262  
   263  	if clo, ok := call.Fun.(*ir.ClosureExpr); ok && n.Op() == ir.OGO {
   264  		clo.IsGoWrap = true
   265  	}
   266  
   267  	e.expr(k, call.Fun)
   268  }
   269  
   270  // rewriteArgument rewrites the argument arg of the given call expression.
   271  // fns is the list of statically known callees, if any.
   272  func (e *escape) rewriteArgument(arg ir.Node, call *ir.CallExpr, fns []*ir.Name) {
   273  	var pragma ir.PragmaFlag
   274  	for _, fn := range fns {
   275  		if fn.Func != nil {
   276  			pragma |= fn.Func.Pragma
   277  		}
   278  	}
   279  	if pragma&(ir.UintptrKeepAlive|ir.UintptrEscapes) == 0 {
   280  		return
   281  	}
   282  
   283  	// unsafeUintptr rewrites "uintptr(ptr)" arguments to syscall-like
   284  	// functions, so that ptr is kept alive and/or escaped as
   285  	// appropriate. unsafeUintptr also reports whether it modified arg0.
   286  	unsafeUintptr := func(arg ir.Node) {
   287  		// If the argument is really a pointer being converted to uintptr,
   288  		// arrange for the pointer to be kept alive until the call
   289  		// returns, by copying it into a temp and marking that temp still
   290  		// alive when we pop the temp stack.
   291  		conv, ok := arg.(*ir.ConvExpr)
   292  		if !ok || conv.Op() != ir.OCONVNOP {
   293  			return // not a conversion
   294  		}
   295  		if !conv.X.Type().IsUnsafePtr() || !conv.Type().IsUintptr() {
   296  			return // not an unsafe.Pointer->uintptr conversion
   297  		}
   298  
   299  		// Create and declare a new pointer-typed temp variable.
   300  		//
   301  		// TODO(mdempsky): This potentially violates the Go spec's order
   302  		// of evaluations, by evaluating arg.X before any other
   303  		// operands.
   304  		tmp := e.copyExpr(conv.Pos(), conv.X, call.PtrInit())
   305  		conv.X = tmp
   306  
   307  		k := e.mutatorHole()
   308  		if pragma&ir.UintptrEscapes != 0 {
   309  			k = e.heapHole().note(conv, "//go:uintptrescapes")
   310  		}
   311  		e.flow(k, e.oldLoc(tmp))
   312  
   313  		if pragma&ir.UintptrKeepAlive != 0 {
   314  			tmp.SetAddrtaken(true) // ensure SSA keeps the tmp variable
   315  			call.KeepAlive = append(call.KeepAlive, tmp)
   316  		}
   317  	}
   318  
   319  	// For variadic functions, the compiler has already rewritten:
   320  	//
   321  	//     f(a, b, c)
   322  	//
   323  	// to:
   324  	//
   325  	//     f([]T{a, b, c}...)
   326  	//
   327  	// So we need to look into slice elements to handle uintptr(ptr)
   328  	// arguments to variadic syscall-like functions correctly.
   329  	if arg.Op() == ir.OSLICELIT {
   330  		list := arg.(*ir.CompLitExpr).List
   331  		for _, el := range list {
   332  			if el.Op() == ir.OKEY {
   333  				el = el.(*ir.KeyExpr).Value
   334  			}
   335  			unsafeUintptr(el)
   336  		}
   337  	} else {
   338  		unsafeUintptr(arg)
   339  	}
   340  }
   341  
   342  // copyExpr creates and returns a new temporary variable within fn;
   343  // appends statements to init to declare and initialize it to expr;
   344  // and escape analyzes the data flow.
   345  func (e *escape) copyExpr(pos src.XPos, expr ir.Node, init *ir.Nodes) *ir.Name {
   346  	if ir.HasUniquePos(expr) {
   347  		pos = expr.Pos()
   348  	}
   349  
   350  	tmp := typecheck.TempAt(pos, e.curfn, expr.Type())
   351  
   352  	stmts := []ir.Node{
   353  		ir.NewDecl(pos, ir.ODCL, tmp),
   354  		ir.NewAssignStmt(pos, tmp, expr),
   355  	}
   356  	typecheck.Stmts(stmts)
   357  	init.Append(stmts...)
   358  
   359  	e.newLoc(tmp, true)
   360  	e.stmts(stmts)
   361  
   362  	return tmp
   363  }
   364  
   365  func (e *escape) mergedTagHole(ks []hole, fns []*ir.Name, paramIdx int, nParams int) hole {
   366  	if len(fns) == 0 {
   367  		return e.heapHole()
   368  	}
   369  	holes := make([]hole, 0, len(fns))
   370  	for _, f := range fns {
   371  		offset := nParams - len(f.Type().Params())
   372  		j := paramIdx - offset
   373  		var p *types.Field
   374  		if j >= 0 {
   375  			p = f.Type().Params()[j]
   376  		} else {
   377  			p = f.Type().Recv()
   378  		}
   379  		holes = append(holes, e.tagHole(ks, f, p))
   380  	}
   381  	return e.teeHole(holes...)
   382  }
   383  
   384  // tagHole returns a hole for evaluating an argument passed to param.
   385  // ks should contain the holes representing where the function
   386  // callee's results flows. fn is the statically-known callee function,
   387  // if any.
   388  func (e *escape) tagHole(ks []hole, fn *ir.Name, param *types.Field) hole {
   389  	// If this is a dynamic call, we can't rely on param.Note.
   390  	if fn == nil {
   391  		return e.heapHole()
   392  	}
   393  
   394  	if e.inMutualBatch(fn) {
   395  		if param.Nname == nil {
   396  			return e.discardHole()
   397  		}
   398  		return e.addr(param.Nname.(*ir.Name))
   399  	}
   400  
   401  	// Call to previously tagged function.
   402  
   403  	var tagKs []hole
   404  	esc := parseLeaks(param.Note)
   405  
   406  	if x := esc.Heap(); x >= 0 {
   407  		tagKs = append(tagKs, e.heapHole().shift(x))
   408  	}
   409  	if x := esc.Mutator(); x >= 0 {
   410  		tagKs = append(tagKs, e.mutatorHole().shift(x))
   411  	}
   412  	if x := esc.Callee(); x >= 0 {
   413  		tagKs = append(tagKs, e.calleeHole().shift(x))
   414  	}
   415  
   416  	if ks != nil {
   417  		for i := 0; i < numEscResults; i++ {
   418  			if x := esc.Result(i); x >= 0 {
   419  				tagKs = append(tagKs, ks[i].shift(x))
   420  			}
   421  		}
   422  	}
   423  
   424  	return e.teeHole(tagKs...)
   425  }
   426  
   427  // resolveAssignedCallees resolves all assignment RHS values to static
   428  // callee names, skipping zero-value assignments since nil panics on
   429  // call and can't cause escape.
   430  func resolveAssignedCallees(assigns []*ir.AssignStmt) []*ir.Name {
   431  	fns := make([]*ir.Name, 0, len(assigns))
   432  	for _, as := range assigns {
   433  		if ir.IsZero(as.Y) {
   434  			continue // zero value panics on call; skip
   435  		}
   436  		callee := ir.StaticCalleeName(as.Y)
   437  		if callee == nil {
   438  			return nil
   439  		}
   440  		if callee.Func != nil && callee.Func.Pragma&(ir.UintptrKeepAlive|ir.UintptrEscapes) != 0 {
   441  			return nil
   442  		}
   443  		fns = append(fns, callee)
   444  	}
   445  	return fns
   446  }
   447  
   448  func isEscapeNonString(fns []*ir.Name, fntype *types.Type) bool {
   449  	return len(fns) == 1 &&
   450  		fns[0].Sym().Pkg.Path == "internal/abi" &&
   451  		strings.HasPrefix(fns[0].Sym().Name, "EscapeNonString[") &&
   452  		len(fntype.Params()) == 2 && fntype.Params()[1].Type.IsShape()
   453  }
   454  
   455  func hasNonStringPointers(t *types.Type) bool {
   456  	if !t.HasPointers() {
   457  		return false
   458  	}
   459  	switch t.Kind() {
   460  	case types.TSTRING:
   461  		return false
   462  	case types.TSTRUCT:
   463  		for _, f := range t.Fields() {
   464  			if hasNonStringPointers(f.Type) {
   465  				return true
   466  			}
   467  		}
   468  		return false
   469  	case types.TARRAY:
   470  		return hasNonStringPointers(t.Elem())
   471  	}
   472  	return true
   473  }
   474
View as plain text