import { Scene } from '../../Scene'; import { Stmt } from '../../core/base/Stmt'; import { ClassSignature } from '../../core/model/ArkSignature'; import { NodeID } from '../../core/graph/BaseExplicitGraph'; import { CallGraph, CallSite, FuncID } from '../model/CallGraph'; import { AbstractAnalysis } from './AbstractAnalysis'; import { CallGraphBuilder } from '../model/builder/CallGraphBuilder'; export declare class RapidTypeAnalysis extends AbstractAnalysis { private instancedClasses; private ignoredCalls; private virtualDispatchIndex; private enableThisPrune; private callbackBindings; private callbackFieldBindings; private closureTraceVisited; private aliasTypeUnwrapVisited; private executableCalleeScratch; private builtinArrayClassSignature; private builtinArrayClassResolved; private static readonly CALLBACK_CLASS_SIG_KEY; constructor(scene: Scene, cg: CallGraph, cb: CallGraphBuilder, enableThisPrune?: boolean); protected init(): void; resolveCall(callerMethod: NodeID, invokeStmt: Stmt): CallSite[]; private resolveDirectOrVirtual; /** * Single args scan: * - if any executable real callee exists (or declared callee has CFG), record callback bindings * (concrete FunctionType) or forward parameter bindings into callee slots; * - otherwise, for no-CFG SDK / built-in / unresolved (`%unk`) callees, append virtual * callback CallSites for concrete FunctionType args, parameter bindings, and callback * fields. */ private processCallbackArguments; /** * Bind a FunctionType callback argument to the callee's parameter binding slot. * Extracted from processCallbackArguments for readability. */ private bindFunctionTypeCallback; /** * Bind a ClassType callback (Callback, AsyncCallback, ...) argument to the * callee's parameter binding slot via field binding state. * Extracted from processCallbackArguments for readability. */ private bindClassTypeCallback; private scanExecutableCallees; private handleNoExecutableCalleePath; /** * Unresolved declaring file (`@%unk/%unk:...`) — common when type inference fails for * built-ins such as Promise.constructor in large apps. */ private isUnresolvedProjectName; /** * Built-in container APIs that accept FunctionType values without invoking them * (writes such as push/set, and lookups such as indexOf/has). Caller must already * know the method is a `@built-in` SDK method. */ private isBuiltInContainerNonInvokingMethod; private isBuiltInContainerNonInvokingMethodByMethodName; /** * Whether a no-CFG callee should synthesize virtual edges into callback args. * OH SDK and unresolved (`%unk`) APIs always qualify. Built-ins qualify by default * except container non-invoking APIs (Array.push / Array.indexOf / Map.set / ...). * Resolves the CG node and declaring projectName once. */ private shouldSynthesizeVirtualCallback; /** * Invoke-site gate when {@link resolveInvokeExpr} cannot produce a usable declared method * (e.g. `@%unk/%unk: Promise.constructor` with no Scene body). */ private shouldSynthesizeVirtualCallbackFromInvoke; /** * No-CFG callee that invokes callbacks: emit virtual edges into every callback-shaped argument. * Caller must have already gated on {@link shouldSynthesizeVirtualCallback}. Built-in container * non-invoking APIs (Array.push / Array.indexOf / Map.set / ...) remain excluded by that gate. */ private appendVirtualCallbackCallSites; private resolvePtrInvoke; /** * Resolve a callback value through all supported representations. * A value may have both a concrete static target and a field/binding origin; * both paths are retained so later field targets cannot be hidden by the * concrete FunctionType fast path. */ private appendCallbackValueCallSites; private appendCallbackCallSite; private subscribeToCallbackField; /** * Subscribe invokeStmt to bindingState and collect already-known targets as CallSites. * Late-arriving targets are delivered via addCallbackTarget → emitCallbackEdge. */ private subscribeAndCollectBoundTargets; private getTypeFromAliasType; /** * Whether a type can serve as a callback — FunctionType (direct or aliased) * or a ClassType callback wrapper (Callback, AsyncCallback, ...). * * Unlike {@link unwrapFunctionType}, this accepts ClassType callbacks whose real * FunctionType is only discoverable at the assignment site (right-hand side), * not from the ClassType itself. This lets the field-subscription and field-store * pipelines accept `private cb: Callback = (...) => {...}` fields. */ private isCallbackType; /** * Peel AliasType layers until a FunctionType is found. * Fast-path: FunctionType returns immediately; non-alias types return undefined * without touching the visited scratch set. */ private unwrapFunctionType; private resolveFuncPtrToBindingState; private resolveFuncPtrToBindingKey; /** * Resolve a function-pointer local to an instance callback field. * The short-term field model follows one local alias at most; it does not * perform receiver points-to analysis. */ private resolveFuncPtrToFieldRef; private resolveFuncPtrValueToBindingKey; /** * AliasType-typed ptr locals on invoke exprs may lack declaringStmt even when the * method body has a same-named local that carries the real definition. */ private recoverLocalWithDeclaringStmt; /** * Recursively trace a Local back to a parameter binding key. * Follows local aliases and unique closure captures until an ArkParameterRef is * found; returns the packed (ownerFuncID, logicalArgIndex) key, or undefined if * the value does not originate from a parameter slot. */ private resolveFuncPtrToBindingKeyRec; private toLogicalArgIndex; private encodeCallbackBindingKey; private decodeOwnerFuncID; private decodeLogicalArgIndex; private getOrCreateBindingState; private getCallbackFieldKey; private getOrCreateCallbackFieldState; private linkCallbackField; private addCallbackFieldTarget; /** * Link a callback field to a callee parameter binding slot. When the field's * targets are populated later (e.g. field initializer processed after the * call site due to RTA workList ordering), targets propagate to the binding * slot via {@link addCallbackFieldTarget} → bindingForwards → addCallbackTarget. */ private linkFieldToBinding; private subscribeAndCollectFieldTargets; private recordCallbackFieldStore; /** * Link source parameter binding to a callee parameter slot and copy existing targets. * Future addCallbackTarget calls on the source also propagate through forwards. */ private linkCallbackBinding; private addCallbackTarget; /** * Create a CallbackCallSite, register it via CallSiteManager (for ID allocation * and getCallSiteById lookup) and via CallGraph maps (for getCallSiteByStmt and * getCallSitesByMethod lookup). The argIndex is set for callback virtual edges * and left undefined for regular (direct/virtual/constructor) call sites. */ private newRTACallSite; private emitCallbackEdge; private getOrBuildVirtualDispatchRows; private tryResolveAggressiveThisPruneCall; private resolveConstructorClassFromNew; protected preProcessMethod(funcID: FuncID): CallSite[]; private collectInstancedClassesInMethod; private getBuiltinArrayClassSignature; addIgnoredCalls(arkClass: ClassSignature, callerID: FuncID, calleeID: FuncID, invokeStmt: Stmt): void; } //# sourceMappingURL=RapidTypeAnalysis.d.ts.map