packages/deriver/tests/Unit/Deriver/Evaluator/Execution/HavocTest.php

1<?php
2
3declare (strict_types=1);
4
5namespace Tests\Unit\Deriver\Evaluator\Execution;
6
7use Deriver\Deriver;
8use Deriver\Deriver\Candidate\ResultRef;
9use Deriver\Deriver\Candidate\Snapshot;
10use Deriver\Deriver\Candidate\Statistics;
11use Deriver\Deriver\Contributions;
12use Deriver\Deriver\DeriverConfig;
13use Deriver\Deriver\Evaluator\Builtin\Library;
14use Deriver\Deriver\Evaluator\Call\Evaluators;
15use Deriver\Deriver\Evaluator\Call\Extensions;
16use Deriver\Deriver\Evaluator\Call\Registrations;
17use Deriver\Deriver\Evaluator\Call\State\InvalidationPolicy;
18use Deriver\Deriver\Evaluator\Call\State\StateSlot;
19use Deriver\Deriver\Evaluator\Call\StateRegistry;
20use Deriver\Deriver\Evaluator\EvaluatorConfig;
21use Deriver\Deriver\Evaluator\Evidence\Frontier;
22use Deriver\Deriver\Evaluator\Execution\Call\Allocation;
23use Deriver\Deriver\Evaluator\Execution\Call\ArgumentBinding;
24use Deriver\Deriver\Evaluator\Execution\Call\ArgumentOrder;
25use Deriver\Deriver\Evaluator\Execution\Call\CallableCheck;
26use Deriver\Deriver\Evaluator\Execution\Call\CallExecutor;
27use Deriver\Deriver\Evaluator\Execution\Call\CallResolution;
28use Deriver\Deriver\Evaluator\Execution\Call\Creation\Access;
29use Deriver\Deriver\Evaluator\Execution\Call\Member\Invocation;
30use Deriver\Deriver\Evaluator\Execution\Call\Native\Invocation as NativeInvocation;
31use Deriver\Deriver\Evaluator\Execution\Call\Native\Properties;
32use Deriver\Deriver\Evaluator\Execution\Call\Native\Signatures;
33use Deriver\Deriver\Evaluator\Execution\Call\PassedArgument;
34use Deriver\Deriver\Evaluator\Execution\Call\Preparation\Arguments;
35use Deriver\Deriver\Evaluator\Execution\Call\Preparation\Creation;
36use Deriver\Deriver\Evaluator\Execution\Call\Preparation\Modes;
37use Deriver\Deriver\Evaluator\Execution\Call\Preparation\Resolution;
38use Deriver\Deriver\Evaluator\Execution\Call\Preparation\Target;
39use Deriver\Deriver\Evaluator\Execution\Call\Preparation\Transfer;
40use Deriver\Deriver\Evaluator\Execution\Call\TypeBinding;
41use Deriver\Deriver\Evaluator\Execution\Call\TypeCheck;
42use Deriver\Deriver\Evaluator\Execution\Call\UnknownCall;
43use Deriver\Deriver\Evaluator\Execution\Completion\Alternative;
44use Deriver\Deriver\Evaluator\Execution\Completion\Assessment;
45use Deriver\Deriver\Evaluator\Execution\Completion\Completion;
46use Deriver\Deriver\Evaluator\Execution\Completion\Exceptional;
47use Deriver\Deriver\Evaluator\Execution\Completion\Quality\DependencyClosure;
48use Deriver\Deriver\Evaluator\Execution\Completion\StorageSnapshot;
49use Deriver\Deriver\Evaluator\Execution\Context;
50use Deriver\Deriver\Evaluator\Execution\Control\ExceptionMatch;
51use Deriver\Deriver\Evaluator\Execution\Control\ObservationLimit;
52use Deriver\Deriver\Evaluator\Execution\Control\StateJoin;
53use Deriver\Deriver\Evaluator\Execution\Control\Unwinding;
54use Deriver\Deriver\Evaluator\Execution\Demand\Discovery;
55use Deriver\Deriver\Evaluator\Execution\Dependencies;
56use Deriver\Deriver\Evaluator\Execution\Evaluator;
57use Deriver\Deriver\Evaluator\Execution\EvaluatorConfig as ExecutionEvaluatorConfig;
58use Deriver\Deriver\Evaluator\Execution\Havoc;
59use Deriver\Deriver\Evaluator\Execution\InstructionTransfer;
60use Deriver\Deriver\Evaluator\Execution\Memory\Location;
61use Deriver\Deriver\Evaluator\Execution\Memory\Materialization;
62use Deriver\Deriver\Evaluator\Execution\Memory\Memory;
63use Deriver\Deriver\Evaluator\Execution\Memory\ReferenceConstraint;
64use Deriver\Deriver\Evaluator\Execution\Memory\Slots\SlotReference;
65use Deriver\Deriver\Evaluator\Execution\Memory\Slots\StateStorage;
66use Deriver\Deriver\Evaluator\Execution\Memory\StorageCapture;
67use Deriver\Deriver\Evaluator\Execution\ObservationCollector;
68use Deriver\Deriver\Evaluator\Execution\Operation\Conversions;
69use Deriver\Deriver\Evaluator\Execution\Operation\ScalarErrors;
70use Deriver\Deriver\Evaluator\Execution\State;
71use Deriver\Deriver\Evaluator\Execution\Summary\Evaluation;
72use Deriver\Deriver\Evaluator\Execution\Summary\Isolation;
73use Deriver\Deriver\Evaluator\Execution\Trace\Derivation;
74use Deriver\Deriver\Evaluator\Execution\Transfer\MemoryStep;
75use Deriver\Deriver\Evaluator\Execution\Transfer\ObjectAccess;
76use Deriver\Deriver\Evaluator\Execution\Transfer\PropertyAccessCheck;
77use Deriver\Deriver\Evaluator\Execution\Transfer\PropertyLookup;
78use Deriver\Deriver\Evaluator\Execution\Transfer\PropertyMagic;
79use Deriver\Deriver\Evaluator\Execution\Transfer\PropertySlot;
80use Deriver\Deriver\Evaluator\Execution\Transfer\PropertyTransfer;
81use Deriver\Deriver\Evaluator\Execution\Transfer\PureStep;
82use Deriver\Deriver\Evaluator\Execution\Transfer\ReferenceAssignment;
83use Deriver\Deriver\Evaluator\Request\Budget;
84use Deriver\Deriver\Evaluator\Request\EntryPoint;
85use Deriver\Deriver\Evaluator\Request\QueryScope;
86use Deriver\Deriver\Evaluator\Request\ReturnQuery;
87use Deriver\Deriver\Evaluator\Scalar\Arrays;
88use Deriver\Deriver\Evaluator\Scalar\Identity;
89use Deriver\Deriver\Evaluator\Scalar\Operations;
90use Deriver\Deriver\Evaluator\TargetProfile;
91use Deriver\Deriver\Evaluator\Term;
92use Deriver\Deriver\Evaluator\TermKind;
93use Deriver\Deriver\Execution\DerivationResult;
94use Deriver\Deriver\Execution\QueryExecution;
95use Deriver\Deriver\Execution\ResultAssessment;
96use Deriver\Deriver\Identity\QueryEncoding;
97use Deriver\Deriver\Identity\ValueGraph;
98use Deriver\Deriver\Lowerer\AggregateLowering;
99use Deriver\Deriver\Lowerer\AssignmentLowering;
100use Deriver\Deriver\Lowerer\CallLowering;
101use Deriver\Deriver\Lowerer\Control\DestructuringLowering;
102use Deriver\Deriver\Lowerer\Declaration\CallableIdentity;
103use Deriver\Deriver\Lowerer\Declaration\CallableSource;
104use Deriver\Deriver\Lowerer\Declaration\ConstantSignatures;
105use Deriver\Deriver\Lowerer\Declaration\Index;
106use Deriver\Deriver\Lowerer\Declaration\Indexer;
107use Deriver\Deriver\Lowerer\Declaration\Metadata\ClassDeclaration;
108use Deriver\Deriver\Lowerer\Declaration\Metadata\PropertyDeclaration;
109use Deriver\Deriver\Lowerer\Declaration\Traits\Composition;
110use Deriver\Deriver\Lowerer\ExpressionLowering;
111use Deriver\Deriver\Lowerer\Graph\Argument;
112use Deriver\Deriver\Lowerer\Graph\BasicBlock;
113use Deriver\Deriver\Lowerer\Graph\CallableGraph;
114use Deriver\Deriver\Lowerer\Graph\Instruction;
115use Deriver\Deriver\Lowerer\Graph\Terminator;
116use Deriver\Deriver\Lowerer\Hierarchy\Builtins;
117use Deriver\Deriver\Lowerer\Hierarchy\Dispatch;
118use Deriver\Deriver\Lowerer\InstructionEmitter;
119use Deriver\Deriver\Lowerer\Lowerer;
120use Deriver\Deriver\Lowerer\LoweringScope;
121use Deriver\Deriver\Lowerer\StatementLowering;
122use Deriver\Deriver\MicroEvaluatorConversion;
123use Deriver\Deriver\Parser\Node\File;
124use Deriver\Deriver\Parser\Parser;
125use Deriver\Deriver\Parser\ParserConfig;
126use Deriver\Deriver\Parser\TargetSyntax;
127use Deriver\Deriver\Providers\ProviderExpansion;
128use Deriver\Deriver\Resolver\AssignmentPatterns;
129use Deriver\Deriver\Resolver\ClassScope;
130use Deriver\Deriver\Resolver\ExpressionValidation;
131use Deriver\Deriver\Resolver\MagicContext;
132use Deriver\Deriver\Resolver\Resolver;
133use Deriver\Deriver\Selection\QueryValidation;
134use Deriver\Deriver\SnapshotIdentity;
135use Deriver\Deriver\Sources\LineMap;
136use Deriver\Deriver\Sources\Path;
137use Deriver\Deriver\Sources\Source;
138use Deriver\Deriver\Sources\SourceRef;
139use Deriver\Deriver\Sources\Sources;
140use Deriver\Exception\ParserException;
141use Deriver\Exception\ResolutionException;
142use PHPUnit\Framework\Attributes\CoversClass;
143use PHPUnit\Framework\Attributes\DataProvider;
144use PHPUnit\Framework\Attributes\Small;
145use PHPUnit\Framework\Attributes\UsesClass;
146use PHPUnit\Framework\TestCase;
147
148#[UsesClass(Resolver::class)]
149#[UsesClass(ExpressionValidation::class)]
150#[UsesClass(ResolutionException::class)]
151#[UsesClass(ParserConfig::class)]
152#[UsesClass(ParserException::class)]
153#[CoversClass(Havoc::class)]
154#[UsesClass(QueryExecution::class)]
155#[UsesClass(QueryValidation::class)]
156#[UsesClass(ResultAssessment::class)]
157#[UsesClass(Deriver::class)]
158#[UsesClass(Argument::class)]
159#[UsesClass(BasicBlock::class)]
160#[UsesClass(CallableGraph::class)]
161#[UsesClass(CallableIdentity::class)]
162#[UsesClass(ClassDeclaration::class)]
163#[UsesClass(Instruction::class)]
164#[UsesClass(PropertyDeclaration::class)]
165#[UsesClass(Terminator::class)]
166#[UsesClass(Allocation::class)]
167#[UsesClass(ArgumentBinding::class)]
168#[UsesClass(ArgumentOrder::class)]
169#[UsesClass(CallExecutor::class)]
170#[UsesClass(CallResolution::class)]
171#[UsesClass(CallableCheck::class)]
172#[UsesClass(Access::class)]
173#[UsesClass(Builtins::class)]
174#[UsesClass(Dispatch::class)]
175#[UsesClass(Invocation::class)]
176#[UsesClass(NativeInvocation::class)]
177#[UsesClass(Properties::class)]
178#[UsesClass(Signatures::class)]
179#[UsesClass(PassedArgument::class)]
180#[UsesClass(Arguments::class)]
181#[UsesClass(Creation::class)]
182#[UsesClass(Modes::class)]
183#[UsesClass(Resolution::class)]
184#[UsesClass(Target::class)]
185#[UsesClass(Transfer::class)]
186#[UsesClass(TypeBinding::class)]
187#[UsesClass(TypeCheck::class)]
188#[UsesClass(UnknownCall::class)]
189#[UsesClass(Completion::class)]
190#[UsesClass(Context::class)]
191#[UsesClass(ExceptionMatch::class)]
192#[UsesClass(ObservationLimit::class)]
193#[UsesClass(StateJoin::class)]
194#[UsesClass(Unwinding::class)]
195#[UsesClass(Discovery::class)]
196#[UsesClass(Dependencies::class)]
197#[UsesClass(InstructionTransfer::class)]
198#[UsesClass(Evaluator::class)]
199#[UsesClass(SlotReference::class)]
200#[UsesClass(StateStorage::class)]
201#[UsesClass(ObservationCollector::class)]
202#[UsesClass(Conversions::class)]
203#[UsesClass(ScalarErrors::class)]
204#[UsesClass(State::class)]
205#[UsesClass(Evaluation::class)]
206#[UsesClass(Isolation::class)]
207#[UsesClass(MemoryStep::class)]
208#[UsesClass(ObjectAccess::class)]
209#[UsesClass(PropertyAccessCheck::class)]
210#[UsesClass(PropertyLookup::class)]
211#[UsesClass(PropertyMagic::class)]
212#[UsesClass(PropertySlot::class)]
213#[UsesClass(PropertyTransfer::class)]
214#[UsesClass(PureStep::class)]
215#[UsesClass(ReferenceAssignment::class)]
216#[UsesClass(Location::class)]
217#[UsesClass(Materialization::class)]
218#[UsesClass(Memory::class)]
219#[UsesClass(ReferenceConstraint::class)]
220#[UsesClass(StorageCapture::class)]
221#[UsesClass(Library::class)]
222#[UsesClass(Extensions::class)]
223#[UsesClass(ProviderExpansion::class)]
224#[UsesClass(Evaluators::class)]
225#[UsesClass(StateRegistry::class)]
226#[UsesClass(StateSlot::class)]
227#[UsesClass(DeriverConfig::class)]
228#[UsesClass(EntryPoint::class)]
229#[UsesClass(Sources::class)]
230#[UsesClass(Path::class)]
231#[UsesClass(Snapshot::class)]
232#[UsesClass(Source::class)]
233#[UsesClass(TargetProfile::class)]
234#[UsesClass(Budget::class)]
235#[UsesClass(QueryScope::class)]
236#[UsesClass(ReturnQuery::class)]
237#[UsesClass(ResultRef::class)]
238#[UsesClass(SourceRef::class)]
239#[UsesClass(Alternative::class)]
240#[UsesClass(Assessment::class)]
241#[UsesClass(Derivation::class)]
242#[UsesClass(DerivationResult::class)]
243#[UsesClass(Exceptional::class)]
244#[UsesClass(Frontier::class)]
245#[UsesClass(QueryEncoding::class)]
246#[UsesClass(ValueGraph::class)]
247#[UsesClass(Statistics::class)]
248#[UsesClass(StorageSnapshot::class)]
249#[UsesClass(Parser::class)]
250#[UsesClass(File::class)]
251#[UsesClass(AggregateLowering::class)]
252#[UsesClass(AssignmentLowering::class)]
253#[UsesClass(CallLowering::class)]
254#[UsesClass(Lowerer::class)]
255#[UsesClass(DestructuringLowering::class)]
256#[UsesClass(ExpressionLowering::class)]
257#[UsesClass(InstructionEmitter::class)]
258#[UsesClass(LoweringScope::class)]
259#[UsesClass(StatementLowering::class)]
260#[UsesClass(ConstantSignatures::class)]
261#[UsesClass(CallableSource::class)]
262#[UsesClass(Indexer::class)]
263#[UsesClass(Index::class)]
264#[UsesClass(Composition::class)]
265#[UsesClass(LineMap::class)]
266#[UsesClass(MagicContext::class)]
267#[UsesClass(AssignmentPatterns::class)]
268#[UsesClass(ClassScope::class)]
269#[UsesClass(TargetSyntax::class)]
270#[UsesClass(Arrays::class)]
271#[UsesClass(Identity::class)]
272#[UsesClass(Operations::class)]
273#[UsesClass(Term::class)]
274#[Small]
275final class HavocTest extends TestCase
276{
277    public function testCallPreservesTheSemanticContract(): void
278    {
279        $source = '<?php class Box{public $value="known";} function target(){$box=new Box; $local="unrelated"; externalMutation($box);return [$box->value,$local];}';
280        $symbol = 'target';
281        $input = new Sources([new Source('fixture.php', $source)]);
282        $configuration = new DeriverConfig();
283        $contributions = new Contributions();
284        $target = new TargetProfile($configuration->phpVersion, $configuration->integerBits, $configuration->floatPrecision);
285        $providers = new ProviderExpansion($input, array_map(Term::fromNative(...), $configuration->environment), $contributions);
286        $contributions1 = $providers->contributions;
287        $evaluators = new Evaluators(new TargetProfile($configuration->phpVersion, $configuration->integerBits, $configuration->floatPrecision), new Registrations($contributions1->evaluators, $contributions1->providers, $contributions1->domains, $contributions1->intrinsics, $contributions1->stateSlots), $configuration->standardEvaluators);
288        $settings = new EvaluatorConfig($target, $providers->environment, $configuration->standardEvaluators, array_map((new MicroEvaluatorConversion())->convert(...), $configuration->evaluators));
289        $identity = new SnapshotIdentity($providers->input, $settings, $evaluators, $providers->manifest);
290        $snapshotId = $identity->id;
291        $input1 = $providers->input;
292        $parser = new Parser(new ParserConfig($target->version));
293        $trees = array_map(static fn (Source $source1): File => (new Resolver())->resolve($parser->parse(new Source(Path::normalize($source1->path), $source1->contents, $source1->declarationsOnly))), iterator_to_array($input1, false));
294        $program = new Index($snapshotId, $trees);
295        $result = (new QueryExecution($program, new ExecutionEvaluatorConfig($target, $providers->environment, $configuration->standardEvaluators), $evaluators, $identity->snapshot(array_map(Frontier::fromDiagnostic(...), $program->diagnostics()))))->derive(new ReturnQuery($symbol));
296        self::assertSame(DependencyClosure::Open, $result->assessment->closure);
297        self::assertSame('MISSING_CALL_MODEL', $result->frontiers[0]->code);
298        self::assertSame('unrelated', $result->normalOutcomes[0]->values['return']->operands[1]->native());
299        self::assertFalse($result->normalOutcomes[0]->values['return']->operands[0]->isConcrete());
300    }
301    public function testReachableFollowsNestedObjectReferences(): void
302    {
303        $state = new State();
304        $object = new Term(TermKind::Object, 'a');
305        $state->memory->cells['object:a'] = Term::array(['child' => new Term(TermKind::Object, 'b')]);
306        $state->memory->cells['object:b'] = Term::fromNative(['x' => 1]);
307        $seen = [];
308        (new Havoc())->reachable($state, $object, 'UNKNOWN_EFFECT', $seen);
309        self::assertSame(TermKind::Opaque, $state->memory->cells['object:b']->operands['x']->kind);
310        self::assertSame(['object:a' => true, 'object:b' => true], $seen);
311    }
312    public function testAllInvalidatesEveryExistingStorageRoot(): void
313    {
314        $state = new State();
315        $state->memory->write($state->local('x'), Term::constant(1));
316        $state->memory->cells['global:y'] = Term::constant(2);
317        (new Havoc())->all($state, 'EVAL');
318        self::assertSame(TermKind::Opaque, $state->snapshot()['x']->kind);
319        self::assertSame(TermKind::Opaque, $state->memory->cells['global:y']->kind);
320    }
321    public function testSlotsHonorsExplicitStableContracts(): void
322    {
323        $state = new State();
324        $state->memory->slotContracts['example.stable'] = new StateSlot('example.stable', 'int', invalidation: InvalidationPolicy::Preserve);
325        $state->memory->slotContracts['example.mutable'] = new StateSlot('example.mutable', 'int');
326        $state->memory->cells['evaluator:a'] = Term::fromNative(['example.stable' => 1, 'example.mutable' => 2]);
327        $seen = [];
328        (new Havoc())->slots($state, 'a', 'UNKNOWN', $seen);
329        self::assertSame(1, $state->memory->read(new Location('evaluator:a', ['example.stable']))->native());
330        self::assertSame(TermKind::Opaque, $state->memory->read(new Location('evaluator:a', ['example.mutable']))->kind);
331    }
332    public function testReachableHandlesSharedGraphsWithoutExpandingEveryPath(): void
333    {
334        $state = new State();
335        $state->memory->cells['object:box'] = Term::fromNative(['x' => 1]);
336        $depth = 2000;
337        $leaf = new Term(TermKind::Object, 'box');
338        $leaf = array_reduce(array_fill(0, $depth, null), static fn (Term $leaf): Term => Term::array([$leaf, $leaf]), $leaf);
339        $value = $leaf;
340        $seen = [];
341        (new Havoc())->reachable($state, $value, 'TEST', $seen);
342        self::assertSame(TermKind::Opaque, $state->memory->cells['object:box']->operands['x']->kind);
343    }
344    public function testCallInvalidatesObjectsReachableThroughGlobalStorage(): void
345    {
346        $state = new State();
347        $state->memory->cells['global:box'] = new Term(TermKind::Object, 'box');
348        $state->memory->cells['object:box'] = Term::fromNative(['x' => 1]);
349        (new Havoc())->call($state, [], [], 'TEST');
350        self::assertSame(TermKind::Opaque, $state->memory->cells['object:box']->operands['x']->kind);
351    }
352    public function testSlotValuesRespectsStableContractsWhileReturningMutableDescendants(): void
353    {
354        $state = new State();
355        $state->memory->slotContracts = ['test:value' => new StateSlot('test:value'), 'test:stable' => new StateSlot('test:stable', invalidation: InvalidationPolicy::Preserve)];
356        $state->memory->cells['evaluator:box'] = Term::fromNative(['test:value' => 1, 'test:stable' => 2]);
357        $seen = [];
358        $values = (new Havoc())->slotValues($state, 'box', 'TEST', $seen);
359        self::assertCount(1, $values);
360        self::assertSame(1, $values[0]->native());
361        self::assertSame(2, $state->memory->cells['evaluator:box']->operands['test:stable']->native());
362    }
363    public function testCallInvalidatesReferenceReachabilityAndSharedStorageWithoutTouchingIndependentLocals(): void
364    {
365        $state = new State();
366        $leaf = Term::constant(7);
367        $object = new Term(TermKind::Object, 'box');
368        $reference = $state->memory->allocate(Term::array(['object' => $object]));
369        $independent = $state->memory->allocate(Term::constant(9));
370        $state->memory->cells['object:box'] = Term::array(['value' => $leaf]);
371        $state->memory->cells['global:exposed'] = Term::constant(3);
372        $state->memory->cells['static:Counter:value'] = Term::constant(4);
373        (new Havoc())->call($state, [], [$reference], 'MISSING_CALL_MODEL');
374        self::assertSame('MISSING_CALL_MODEL', $state->memory->unknownShared);
375        self::assertSame(TermKind::Opaque, $state->memory->read($reference)->kind);
376        self::assertSame('MISSING_CALL_MODEL', $state->memory->read($reference)->literal);
377        self::assertSame(9, $state->memory->read($independent)->literal);
378        $field = $state->memory->cells['object:box']->operands['value'];
379        self::assertSame(TermKind::Opaque, $field->kind);
380        self::assertSame('MISSING_CALL_MODEL', $field->literal);
381        self::assertSame([$leaf], $field->operands);
382        self::assertTrue($field->attributes['maybeUninitialized']);
383        self::assertTrue($state->memory->cells['object:box']->attributes['open']);
384        self::assertSame('MISSING_CALL_MODEL', $state->memory->cells['global:exposed']->literal);
385        self::assertSame(3, $state->memory->cells['global:exposed']->operands[0]->literal);
386        self::assertSame('MISSING_CALL_MODEL', $state->memory->cells['static:Counter:value']->literal);
387        self::assertSame(4, $state->memory->cells['static:Counter:value']->operands[0]->literal);
388    }
389    public function testReachableFollowsCapturedCellsAndTerminatesObjectCycles(): void
390    {
391        $state = new State();
392        $a = new Term(TermKind::Object, 'a');
393        $b = new Term(TermKind::Object, 'b');
394        $state->memory->cells['object:a'] = Term::array(['child' => $b]);
395        $state->memory->cells['object:b'] = Term::array(['parent' => $a]);
396        $state->memory->cells['captured'] = $a;
397        $closure = new Term(TermKind::Closure, 'callable', ['capture' => new Term(TermKind::Cell, 'captured')]);
398        $seen = [];
399        $havoc = new Havoc();
400        $havoc->reachable($state, $closure, 'BOUNDARY', $seen);
401        self::assertSame(['captured' => true, 'object:a' => true, 'object:b' => true], $seen);
402        self::assertSame([$a], $state->memory->cells['captured']->operands);
403        self::assertSame([$b], $state->memory->cells['object:a']->operands['child']->operands);
404        self::assertSame([$a], $state->memory->cells['object:b']->operands['parent']->operands);
405        $before = $state->memory->cells;
406        $havoc->reachable($state, $closure, 'SECOND', $seen);
407        self::assertSame($before, $state->memory->cells);
408    }
409    public function testSlotsTraversesMutableDescendantsAndPreservesStableValues(): void
410    {
411        $state = new State();
412        $object = new Term(TermKind::Object, 'child');
413        $stable = Term::constant(7);
414        $state->memory->slotContracts = ['example.mutable' => new StateSlot('example.mutable', 'object'), 'example.stable' => new StateSlot('example.stable', 'int', invalidation: InvalidationPolicy::Preserve)];
415        $state->memory->cells['evaluator:receiver'] = Term::array(['example.mutable' => $object, 'example.stable' => $stable]);
416        $state->memory->cells['object:child'] = Term::fromNative(['value' => 3]);
417        $seen = [];
418        (new Havoc())->slots($state, 'receiver', 'EXTERNAL_EFFECT', $seen);
419        $mutable = $state->memory->cells['evaluator:receiver']->operands['example.mutable'];
420        self::assertSame(TermKind::Opaque, $mutable->kind);
421        self::assertSame('EXTERNAL_EFFECT', $mutable->literal);
422        self::assertSame('object', $mutable->attributes['type']);
423        self::assertSame([$object], $mutable->operands);
424        self::assertSame($stable, $state->memory->cells['evaluator:receiver']->operands['example.stable']);
425        self::assertSame('EXTERNAL_EFFECT', $state->memory->cells['object:child']->operands['value']->literal);
426        self::assertSame(['evaluator:receiver' => true, 'object:child' => true], $seen);
427        self::assertSame([], (new Havoc())->slotValues($state, 'receiver', 'SECOND', $seen));
428        self::assertSame([], (new Havoc())->slotValues($state, 'absent', 'SECOND', $seen));
429        self::assertArrayNotHasKey('evaluator:absent', $state->memory->cells);
430    }
431    #[DataProvider('providerSymbolicReceivers')]
432    public function testReachableInvalidatesModelStateForSymbolicObjectIdentities(string $kind): void
433    {
434        $state = new State();
435        $state->memory->slotContracts['example.value'] = new StateSlot('example.value', 'int');
436        $state->memory->cells['evaluator:receiver'] = Term::fromNative(['example.value' => 1]);
437        $seen = [];
438        (new Havoc())->reachable($state, new Term(TermKind::from($kind), 'receiver', attributes: ['type' => 'Box']), 'EXTERNAL_EFFECT', $seen);
439        self::assertSame('EXTERNAL_EFFECT', $state->memory->cells['evaluator:receiver']->operands['example.value']->literal);
440        self::assertSame('int', $state->memory->cells['evaluator:receiver']->operands['example.value']->attributes['type']);
441        self::assertSame('EXTERNAL_EFFECT', $state->memory->cells['object:receiver']->literal);
442        self::assertSame(['evaluator:receiver' => true, 'object:receiver' => true], $seen);
443    }
444    /**
445     * @return iterable<string,array{string}>
446     */
447    public static function providerSymbolicReceivers(): iterable
448    {
449        yield 'parameter' => ['parameter'];
450        yield 'external' => ['external'];
451    }
452    public function testAllRetainsThePreviousValuesAsResidualDependencies(): void
453    {
454        $state = new State();
455        $local = $state->memory->allocate(Term::constant(1));
456        $global = Term::constant(2);
457        $state->memory->cells['global:value'] = $global;
458        $before = $state->memory->read($local);
459        (new Havoc())->all($state, 'EVAL');
460        self::assertSame('EVAL', $state->memory->unknownShared);
461        self::assertSame('EVAL', $state->memory->read($local)->literal);
462        self::assertSame([$before], $state->memory->read($local)->operands);
463        self::assertSame('EVAL', $state->memory->cells['global:value']->literal);
464        self::assertSame([$global], $state->memory->cells['global:value']->operands);
465    }
466    public function testSymbolsInvalidateExistingAndFutureLocalBindings(): void
467    {
468        $state = new State();
469        $state->memory->write($state->local('sql'), Term::constant('old'));
470        (new Havoc())->symbols($state, 'DYNAMIC_VARIABLE_WRITE');
471        self::assertSame(TermKind::Opaque, $state->memory->read($state->local('sql'))->kind);
472        self::assertSame(TermKind::Opaque, $state->memory->read($state->local('new'))->kind);
473    }
474}
475