fieldpath

Documentation

Overview

Package fieldpath proves which parameter-rooted field reads are stable — equal to their value at function entry — so they can serve as size variables without alias analysis. A wrong answer here is a wrong bound, the highest-severity bug class; every rule below is argued from SSA immutability (Rule V) or absence of mutation opportunity (Rule P). Stability reasoning assumes no data race (Go memory model); channel-typed fields are excluded because channel sync makes concurrent mutation legal.

Index

• func SpillArgSize(v ssa.Value) (bound.Var, size.Class, bool)
• type Stability
  • func Analyze(fn *ssa.Function) *Stability
  • func (s *Stability) LenVarFor(v ssa.Value) (bound.Var, bool)
  • func (s *Stability) PathFor(v ssa.Value) (string, bool)
  • func (s *Stability) VarFor(v ssa.Value) (bound.Var, bool)

Functions

func SpillArgSize

func SpillArgSize(v ssa.Value) (bound.Var, size.Class, bool)

SpillArgSize resolves v to a canonical size variable when v is a stable read of a parameter that was captured by a closure. Go boxes a captured variable on the heap, so later reads of the parameter become a load of that non-escaping-beyond-read *ssa.Alloc; sort.Slice's `any` argument additionally wraps the load in a *ssa.MakeInterface. When the cell is written exactly once (the entry spill of the parameter) and every capturing closure only READS it, len/cap/num of the load equal the parameter's value at entry — sound to rename into the parameter's size var. A mutating capture (e.g. `xs = append(xs, 1)`) adds a second store, capturedSpillRoot refuses, and the caller stays ⊤ (pin 3). Nil-safe: operates on the value alone.

Types

type Stability

type Stability struct {
	// contains filtered or unexported fields
}

Stability holds the per-function taint facts Rule P needs. Rule V needs no facts at all — it is structural.

func Analyze

func Analyze(fn *ssa.Function) *Stability

Analyze computes the stability facts for fn. Safe on nil.

func (*Stability) LenVarFor

func (s *Stability) LenVarFor(v ssa.Value) (bound.Var, bool)

LenVarFor maps a COLLECTION to the canonical variable naming its length: len(s.items) for the value s.items itself, rather than for a call to len on it. It is VarFor's len case with the call already peeled off.

Callers that hold a collection rather than a length need this — a slice expression's operand, append's spread argument. VarFor rejects them all: it resolves only len/cap CALLS and integer field paths, and a collection is neither, so calling it in that position silently never fires (the v1.28.0 review's F2).

Soundness is exactly VarFor's: the path must be a provably entry-stable field read rooted at a parameter or receiver, so len(path) names one value for the whole frame. Nil-receiver safe: rejects everything.

func (*Stability) PathFor

func (s *Stability) PathFor(v ssa.Value) (string, bool)

PathFor exposes the dotted path of a stable field read (see fieldPath) for callers that need to name the operand itself — e.g. a ranged map field. Nil-safe.

func (*Stability) VarFor

func (s *Stability) VarFor(v ssa.Value) (bound.Var, bool)

VarFor maps an SSA value to its canonical field-path size variable when it is a provably entry-stable field read (or len/cap of one) rooted at a parameter or receiver. Nil-receiver safe: rejects everything.