[GR-80706] Refactor field injection and correct conservative summaries.

PullRequest: graal/25748

Author: cstancu

substratevm/docs/architecture/PARTIALLY-OPEN-WORLD-ANALYSIS.md

@@ -88,7 +88,7 @@ It can result from a precision cutoff or from the need to represent values suppl
 **Recovering a finite type approximation** means replacing such an incomplete set with an explicit set that covers all permitted runtime types at that point.
 One mechanism uses an **all-instantiated flow**, which collects types registered as instantiated and assignable to a particular bound.
 Recovery based solely on that bound requires both a complete assignable-type hierarchy and registration of every type that may occur, including types allocated only by extensions.
-A successful checked cast can provide the bound, but does not by itself establish either condition.
+A successful checked cast or an explicit guarantee from a value's producer can establish the bound, but does not by itself establish either condition.
 An open bound alone cannot justify enumerating all possible types; a particular value can nevertheless have a precise type established by its analyzed allocation.
 
 ### Array Bounds

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/BigBang.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2021, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -115,10 +115,6 @@ default boolean isCallAllowed(PointsToAnalysis bb, AnalysisMethod caller, Analys
     default void onFieldAccessed(AnalysisField field) {
     }
 
-    @SuppressWarnings("unused")
-    default void injectFieldTypes(AnalysisField aField, List<AnalysisType> customTypes, boolean canBeNull) {
-    }
-
     @SuppressWarnings("unused")
     default void onTypeInstantiated(AnalysisType type) {
     }

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/PointsToAnalysis.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -267,7 +267,7 @@ public void forceUnsafeUpdate() {
 
     @Override
     public void registerAsJNIAccessed(AnalysisField field, boolean writable) {
-        field.injectDeclaredType();
+        field.injectConservativeFieldValues();
     }
 
     /**
@@ -509,7 +509,7 @@ public AnalysisType addRootClass(AnalysisType type, boolean addFields, boolean a
             if (addFields) {
                 field.registerAsAccessed("field of root class");
             }
-            field.injectDeclaredType();
+            field.injectConservativeFieldValues();
         }
         if (type.getSuperclass() != null) {
             addRootClass(type.getSuperclass(), addFields, addArrayClass);
@@ -530,7 +530,7 @@ public AnalysisType addRootField(Class<?> clazz, String fieldName) {
     @Override
     public AnalysisType addRootField(AnalysisField field) {
         field.registerAsAccessed((field.isStatic() ? "static" : "instance") + " root field");
-        field.injectDeclaredType();
+        field.injectConservativeFieldValues();
         return field.getType();
     }
 
@@ -659,58 +659,6 @@ public void onTypeInstantiated(AnalysisType type) {
         });
     }
 
-    /**
-     * Injects custom types into a reference field's initial flow. This utility is used for:
-     * <ul>
-     * <li>root fields - whose state is forced to be that of the declared type</li>
-     * <li>unsafe accessed fields - whose state is conservatively also the declared type</li>
-     * <li>lazily computed fields - for which writes are not visible during analysis</li>
-     * </ul>
-     * <p>
-     * For instance fields, injection alone does not propagate state to the sink. This requires a
-     * receiver-specific field flow created and connected by analyzing a field load or store, or by
-     * heap scanning. A retained load creates these connections only when its receiver flow contains
-     * an analyzed object. Once connected, the field flow propagates both existing and future
-     * initial-flow values to the sink. Static reference fields share their initial and sink flows.
-     */
-    @Override
-    public void injectFieldTypes(AnalysisField aField, List<AnalysisType> customTypes, boolean canBeNull) {
-        assert aField.getStorageKind().isObject();
-        var ptaField = (PointsToAnalysisField) aField;
-
-        /* Link the field with all declared types. */
-        for (AnalysisType type : customTypes) {
-            if (type.isPrimitive() || type.isWordType()) {
-                continue;
-            }
-            type.getTypeFlow(this, canBeNull).addUse(this, ptaField.getInitialFlow());
-
-            if (type.isArray()) {
-                AnalysisType fieldComponentType = type.getComponentType();
-                if (!(fieldComponentType.isPrimitive() || fieldComponentType.isWordType())) {
-                    /*
-                     * Write the component type abstract object into the field array elements type
-                     * flow, i.e., the array elements type flow of the abstract object of the field
-                     * declared type.
-                     *
-                     * This is required so that the index loads from this array return all the
-                     * possible objects that can be stored in the array.
-                     */
-                    TypeFlow<?> elementsFlow = type.getContextInsensitiveAnalysisObject().getArrayElementsFlow(this, true);
-                    fieldComponentType.getTypeFlow(this, false).addUse(this, elementsFlow);
-
-                    /*
-                     * In the current implementation it is not necessary to do it recursively for
-                     * multidimensional arrays since we don't model individual array elements, so
-                     * from the point of view of the static analysis the field's array elements
-                     * value is non-null (in the case of an n-dimensional array that value is
-                     * another array, n-1 dimensional).
-                     */
-                }
-            }
-        }
-    }
-
     public static class ConstantObjectsProfiler {
 
         static final ConcurrentHashMap<AnalysisType, MyInteger> constantTypes = new ConcurrentHashMap<>(ESTIMATED_NUMBER_OF_TYPES);

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/flow/FieldTypeFlow.java

@@ -71,8 +71,8 @@ public TypeFlow<AnalysisField> copy(PointsToAnalysis bb, MethodFlowsGraph method
     @Override
     public boolean canSaturate(PointsToAnalysis bb) {
         /*
-         * Fields with a closed declared type don't saturate; when their input saturates they are
-         * injected their declared type, and they track all its instantiated subtypes.
+         * Object fields with a closed effective value bound retain finite type information. A
+         * saturated input is replaced with all instantiated types assignable to that bound.
          */
         return !bb.getExtensionPolicy().isTypeClosed(declaredType);
     }
@@ -82,12 +82,11 @@ protected void onInputSaturated(PointsToAnalysis bb, TypeFlow<?> input) {
         /* The field input, which is usually a field-store, is saturated. */
         if (bb.getExtensionPolicy().isTypeClosed(declaredType)) {
             /*
-             * If the field's declared type is closed, conservatively assume that the field state
-             * can contain any subtype of its declared type or any primitive value for primitive
-             * fields. Even if a store is not visible to the analysis, i.e., it is from the
-             * open-world, the complete hierarchy of the field's declared type is visible.
+             * Recover all instantiated types under the effective bound, or any primitive value.
+             * The effective bound drops unchecked interface constraints from the declaration.
+             * A saturated reference input does not establish an additional array-element write.
              */
-            source.injectDeclaredType();
+            source.injectFieldValueBound();
         } else {
             /* Otherwise, propagate saturation stamp through the field flow. */
             super.onInputSaturated(bb, input);

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/flow/MethodTypeFlowBuilder.java

@@ -2131,10 +2131,10 @@ protected void processLoadField(ValueNode node, PointsToAnalysisField field, Val
     private void processOpenWorldField(PointsToAnalysisField field) {
         if (!bb.getExtensionPolicy().isFieldClosed(field)) {
             /*
-             * Open fields can be written from the open world and may contain state not seen by the
-             * analysis. This is equivalent with assuming any of their input is saturated.
+             * External writes may supply arrays whose elements are not covered by analyzed stores
+             * or heap scanning. Summarize these contents as well as the field references.
              */
-            field.getInitialFlow().onInputSaturated(bb, null);
+            field.injectConservativeFieldValues();
         }
     }
 
@@ -2143,9 +2143,9 @@ protected void processStoreField(ValueNode node, PointsToAnalysisField field, Va
 
         if (!bb.getExtensionPolicy().isFieldClosed(field)) {
             /*
-             * Open fields can be written from the open world and may contain state not seen by the
-             * analysis. We don't track their writes, instead we eagerly saturate their loads (See
-             * processLoadField).
+             * Open fields use conservative summaries for external writes. Instead of tracking
+             * individual field stores, processLoadField installs these summaries when the field is
+             * read.
              */
             return;
         }

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/heap/ImageHeapScanner.java

@@ -175,7 +175,7 @@ private void onStaticFieldRead(AnalysisField field) {
              *
              * GR-52421: the field state needs to be serialized from the base layer analysis
              */
-            field.injectDeclaredType();
+            field.injectConservativeFieldValues();
         } else if (isValueAvailable(field, null)) {
             JavaConstant fieldValue = readStaticFieldValue(field);
             if (fieldValue instanceof ImageHeapConstant imageHeapConstant && field.isFinal()) {

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/meta/AnalysisField.java

@@ -264,7 +264,50 @@ public boolean registerAsWritten(Object reason) {
         });
     }
 
-    public void injectDeclaredType() {
+    /**
+     * Supplies conservative field summaries for roots, conservative unsafe writes, and hosted
+     * values unavailable during analysis.
+     * <p>
+     * In points-to analysis, uses the effective field bound after dropping unchecked interface
+     * constraints and permits null. Closed bounds supply all instantiated assignable types,
+     * including types instantiated later during analysis. Open bounds require saturation, which may
+     * lose bound and nullability precision. Finite reference coverage requires every possible value
+     * type to be registered as instantiated; injection does not perform that registration. Tracked
+     * primitive fields receive unconstrained values.
+     * <p>
+     * Also summarizes immediate reference-array elements, permitting null independently of the
+     * array reference, including arrays held through an effective Object bound. Further array
+     * dimensions require separate coverage. Injection does not change write permissions.
+     * <p>
+     * Reference values enter the initial flow. Propagation to an instance field's sink requires a
+     * receiver-specific field flow created and connected by analyzing a field load or store, or by
+     * heap scanning. A retained load creates these connections only when its receiver flow contains
+     * an analyzed object. Once connected, both existing and future initial-flow values reach the
+     * sink. Static reference fields share their initial and sink flows.
+     */
+    public void injectConservativeFieldValues() {
+        /* By default, nothing to do. */
+    }
+
+    /**
+     * Summarizes unavailable reference values using bounds and nullability guaranteed by the
+     * producer. The bounds must cover all summarized non-null values and be assignable to the effective
+     * field bound. They may supply stricter guarantees, including interface constraints that the
+     * field declaration does not enforce.
+     * <p>
+     * Saturation, type registration, array element summaries, and propagation follow
+     * {@link #injectConservativeFieldValues()}. {@code canBeNull} applies to field references;
+     * reference-array elements remain nullable. An empty list contributes null when
+     * {@code canBeNull} is true, and no values otherwise.
+     */
+    public abstract void injectConservativeFieldValues(List<AnalysisType> customBounds, boolean canBeNull);
+
+    /**
+     * Injects field values without summarizing array contents. Uses the effective bound, nullability,
+     * and propagation rules of {@link #injectConservativeFieldValues()}. Use when array contents are
+     * already covered by analyzed stores, heap scanning, or another summary.
+     */
+    public void injectFieldValueBound() {
         /* By default, nothing to do. */
     }
 

substratevm/src/com.oracle.graal.pointsto/src/com/oracle/graal/pointsto/meta/PointsToAnalysisField.java

@@ -33,6 +33,7 @@
 import com.oracle.graal.pointsto.flow.FieldTypeFlow;
 import com.oracle.graal.pointsto.flow.StoreFieldTypeFlow;
 import com.oracle.graal.pointsto.flow.StoreFieldTypeFlow.StoreInstanceFieldTypeFlow;
+import com.oracle.graal.pointsto.flow.TypeFlow;
 import com.oracle.graal.pointsto.typestate.TypeState;
 import com.oracle.graal.pointsto.util.AtomicUtils;
 
@@ -116,22 +117,72 @@ public FieldTypeFlow getStaticFieldFlow() {
     }
 
     @Override
-    public void injectDeclaredType() {
-        var bb = getUniverse().getBigbang();
+    public void injectConservativeFieldValues() {
+        if (getStorageKind().isObject()) {
+            injectConservativeFieldValues(List.of(initialFlow.getDeclaredType()), true);
+        } else {
+            injectFieldValueBound();
+        }
+    }
+
+    @Override
+    public void injectConservativeFieldValues(List<AnalysisType> customBounds, boolean canBeNull) {
+        assert getStorageKind().isObject();
+        var bb = (PointsToAnalysis) getUniverse().getBigbang();
+        var effectiveBound = initialFlow.getDeclaredType();
+        if (canBeNull) {
+            initialFlow.addState(bb, TypeState.forNull());
+        }
+        for (AnalysisType valueBound : customBounds) {
+            assert !valueBound.isPrimitive() && !valueBound.isWordType() : valueBound;
+            assert effectiveBound.isAssignableFrom(valueBound) : "Custom bound must be assignable to the effective field bound: field: " + this +
+                            " | effective bound: " + effectiveBound + " | custom bound: " + valueBound;
+            injectBoundValues(bb, valueBound, initialFlow, false);
+            injectArrayContents(bb, valueBound);
+        }
+    }
+
+    @Override
+    public void injectFieldValueBound() {
+        var bb = (PointsToAnalysis) getUniverse().getBigbang();
         if (!bb.isSupportedJavaKind(getStorageKind())) {
-            /*
-             * If this JavaKind is not tracked by the analysis, there is no point in inserting any
-             * state into the field.
-             */
+            /* There is no point in inserting state for a kind not tracked by the analysis. */
             return;
         }
         if (getStorageKind().isObject()) {
-            bb.injectFieldTypes(this, List.of(initialFlow.getDeclaredType()), true);
+            injectBoundValues(bb, initialFlow.getDeclaredType(), initialFlow, true);
         } else {
             this.saturatePrimitiveField();
         }
     }
 
+    private static void injectBoundValues(PointsToAnalysis bb, AnalysisType valueBound, TypeFlow<?> flow, boolean canBeNull) {
+        if (bb.getExtensionPolicy().isTypeClosed(valueBound)) {
+            // A closed bound has a complete assignable-type hierarchy.
+            valueBound.getTypeFlow(bb, canBeNull).addUse(bb, flow);
+        } else {
+            // An open bound must include values whose runtime types are not yet known.
+            bb.getPreSaturatedSourceTypeFlow().addUse(bb, flow);
+        }
+    }
+
+    /**
+     * Summarizes immediate reference-array contents admitted by the bound, using its array type or
+     * Object[] for a supertype such as Object, Cloneable, or Serializable. Further dimensions require
+     * separate coverage (GR-80797).
+     */
+    private static void injectArrayContents(PointsToAnalysis bb, AnalysisType valueBound) {
+        AnalysisType arrayType = valueBound.isArray() ? valueBound : bb.getObjectType().getArrayClass();
+        if (!valueBound.isAssignableFrom(arrayType)) {
+            return;
+        }
+        AnalysisType componentType = arrayType.getComponentType();
+        if (!componentType.isPrimitive() && !componentType.isWordType()) {
+            var elements = arrayType.getContextInsensitiveAnalysisObject().getArrayElementsFlow(bb, true);
+            injectBoundValues(bb, componentType, elements, true);
+        }
+    }
+
     @Override
     public void cleanupAfterAnalysis() {
         super.cleanupAfterAnalysis();
@@ -152,13 +203,7 @@ public boolean registerAsUnsafeAccessed(Object reason) {
                  * classification and the saturation cutoff, so ordinary reads account for unknown
                  * runtime types.
                  */
-                if (getStorageKind().isObject() && !bb.getExtensionPolicy().isTypeClosed(initialFlow.getDeclaredType())) {
-                    // An open reference bound must account for unknown extension types.
-                    bb.getPreSaturatedSourceTypeFlow().addUse(bb, initialFlow);
-                } else {
-                    // Retain declared-type injection for closed reference bounds and primitive values.
-                    injectDeclaredType();
-                }
+                injectConservativeFieldValues();
             }
             if (fieldType.getStorageKind().isPrimitive()) {
                 /*

substratevm/src/com.oracle.graal.reachability/src/com/oracle/graal/reachability/ReachabilityAnalysisEngine.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2021, 2025, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2021, 2026, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -28,7 +28,6 @@
 import java.util.ArrayDeque;
 import java.util.Collections;
 import java.util.Deque;
-import java.util.List;
 import java.util.Set;
 
 import org.graalvm.collections.EconomicSet;
@@ -156,15 +155,6 @@ public AnalysisType addRootField(AnalysisField analysisField) {
         return analysisField.getType();
     }
 
-    @Override
-    public void injectFieldTypes(AnalysisField aField, List<AnalysisType> customTypes, boolean canBeNull) {
-        assert aField.getStorageKind().isObject();
-        aField.registerAsAccessed("@UnknownObjectField annotated field.");
-        for (AnalysisType declaredType : customTypes) {
-            declaredType.registerAsReachable("injected field types for unknown annotated field " + aField.format("%H.%n"));
-        }
-    }
-
     @Override
     public AnalysisMethod addRootMethod(AnalysisMethod m, boolean invokeSpecial, Object reason, MethodVariant.MethodVariantKey... otherRoots) {
         assert otherRoots.length == 0 : otherRoots;