import cpp

/**
 * Align the specified offset up to the specified alignment boundary.
 * The result is the smallest integer `i` such that `(i % alignment) = 0`
 * and `(i >= offset)`.
 */
bindingset[offset, alignment]
private int alignUp(int offset, int alignment) {
  result = (offset.(float) / alignment).ceil() * alignment
}

private Type stripSpecifiers(Type t) {
  result = t.getUnspecifiedType()
  or
  result = t and not exists(t.getUnspecifiedType())
}

/**
 * A string that represents an architecture.
 * An "architecture" defines the sizes of variable-sized types and
 * the properties of alignment for fields of various
 * types. Two are provided out-of-the-box: ILP32 and LP64,
 * corresponding to gcc's behavior on x86 and amd64.
 */
abstract class Architecture extends string {
  bindingset[this]
  Architecture() { any() }

  /** Gets the size of a pointer, in bits. */
  abstract int pointerSize();

  /** Gets the size of a `long int`, in bits. */
  abstract int longSize();

  /** Gets the size of a `long double`, in bits. */
  abstract int longDoubleSize();

  /** Gets the size of a `long long`, in bits. */
  abstract int longLongSize();

  /** Gets the size of a `wchar_t`, in bits. */
  abstract int wideCharSize();

  /** Gets the alignment boundary for doubles, in bits. */
  abstract int doubleAlign();

  /** Gets the alignment boundary for long doubles, in bits. */
  abstract int longDoubleAlign();

  /** Gets the alignment boundary for long longs, in bits. */
  abstract int longLongAlign();

  /**
   * Holds if this architecture allow bitfields with declared types of different sizes
   * to be packed together.
   */
  abstract predicate allowHeterogeneousBitfields();

  /**
   * Gets the bit size of class `cd.getBaseClass()` when used as a base class of
   * class `cd.getDerivedClass()`.
   */
  abstract int baseClassSize(ClassDerivation cd);

  /**
   * Gets the bit size of type `t`. Only holds if `t` is an integral or enum type.
   */
  cached
  int integralBitSize(Type t) {
    t instanceof BoolType and result = 8
    or
    t instanceof CharType and result = 8
    or
    t instanceof WideCharType and result = this.wideCharSize()
    or
    t instanceof Char8Type and result = 8
    or
    t instanceof Char16Type and result = 16
    or
    t instanceof Char32Type and result = 32
    or
    t instanceof ShortType and result = 16
    or
    t instanceof IntType and result = 32
    or
    t instanceof LongType and result = this.longSize()
    or
    t instanceof LongLongType and result = this.longLongSize()
    or
    result = this.enumBitSize(t)
    or
    result = this.integralBitSize(t.(SpecifiedType).getBaseType())
    or
    result = this.integralBitSize(t.(TypedefType).getBaseType())
  }

  /**
   * Gets the bit size of enum type `e`.
   */
  int enumBitSize(Enum e) {
    result = this.integralBitSize(e.getExplicitUnderlyingType())
    or
    not exists(e.getExplicitUnderlyingType()) and result = 32
  }

  /**
   * Gets the alignment of enum type `e`.
   */
  int enumAlignment(Enum e) {
    result = this.alignment(e.getExplicitUnderlyingType())
    or
    not exists(e.getExplicitUnderlyingType()) and result = 32
  }

  /**
   * Gets the bit size of type `t`; that is, the number of bits a value
   * with type `t` takes up on this architecture, without any trailing
   * padding on structs and unions.
   */
  cached
  int bitSize(Type t) {
    result = this.integralBitSize(t)
    or
    t instanceof FloatType and result = 32
    or
    t instanceof DoubleType and result = 64
    or
    t instanceof LongDoubleType and result = this.longDoubleSize()
    or
    t instanceof PointerType and result = this.pointerSize()
    or
    t instanceof ReferenceType and result = this.pointerSize()
    or
    t instanceof FunctionPointerType and result = this.pointerSize()
    or
    result = this.bitSize(t.(SpecifiedType).getBaseType())
    or
    result = this.bitSize(t.(TypedefType).getBaseType())
    or
    exists(ArrayType array | array = t |
      result = array.getArraySize() * this.paddedSize(array.getBaseType())
    )
    or
    result = t.(PaddedType).typeBitSize(this)
  }

  /**
   * Gets the desired alignment boundary of type `t` as a struct field
   * on this architecture, in bits.
   */
  cached
  int alignment(Type t) {
    t instanceof BoolType and result = 8
    or
    t instanceof CharType and result = 8
    or
    t instanceof WideCharType and result = this.wideCharSize()
    or
    t instanceof Char8Type and result = 8
    or
    t instanceof Char16Type and result = 16
    or
    t instanceof Char32Type and result = 32
    or
    t instanceof ShortType and result = 16
    or
    t instanceof IntType and result = 32
    or
    t instanceof FloatType and result = 32
    or
    t instanceof DoubleType and result = this.doubleAlign()
    or
    t instanceof LongType and result = this.longSize()
    or
    t instanceof LongDoubleType and result = this.longDoubleAlign()
    or
    t instanceof LongLongType and result = this.longLongAlign()
    or
    t instanceof PointerType and result = this.pointerSize()
    or
    t instanceof FunctionPointerType and result = this.pointerSize()
    or
    t instanceof ReferenceType and result = this.pointerSize()
    or
    result = this.enumAlignment(t)
    or
    result = this.alignment(t.(SpecifiedType).getBaseType())
    or
    result = this.alignment(t.(TypedefType).getBaseType())
    or
    result = this.alignment(t.(ArrayType).getBaseType())
    or
    result = t.(PaddedType).typeAlignment(this)
  }

  /**
   * Gets the padded size of type `t` on this architecture; that is,
   * the number of bits that 'sizeof' should return, taking into account
   * any trailing padding on top of the bit size.
   */
  int paddedSize(Type t) {
    exists(Type realType | realType = stripSpecifiers(t) |
      if realType instanceof PaddedType
      then result = realType.(PaddedType).paddedSize(this)
      else result = this.bitSize(realType)
    )
  }

  /**
   * Gets the wasted space of type `t`; that is, the number of bits
   * spent on padding. This is zero for primitive types, and depends on
   * struct fields and their alignment otherwise. Trailing padding is
   * counted.
   */
  int wastedSpace(Type t) {
    if t instanceof PaddedType then result = t.(PaddedType).wastedSpace(this) else result = 0
  }
}

/**
 * Gets an initial field of type `t`. If `t` is not a union, an initial field is
 * either the first field declared in type `t`, or an initial field of the type
 * of the first field declared in `t`. If `t` is a union, an initial field is
 * either any field declared in type `t`, or an initial field of the type of any
 * field declared in `t`.
 */
private Field getAnInitialField(PaddedType t) {
  if t instanceof Union
  then
    // Any field of the union is an initial field
    result = t.getAField()
    or
    // Initial field of the type of a field of the union
    result = getAnInitialField(t.getAField().getUnspecifiedType())
  else
    exists(Field firstField | t.fieldIndex(firstField) = 1 |
      // The first field of `t`
      result = firstField
      or
      // Initial field of the first field of `t`
      result = getAnInitialField(firstField.getUnspecifiedType())
    )
}

/**
 * Base class for architectures that follow the Itanium ABI. This includes
 * pretty much everything except Windows, so we'll refer to this as
 * "UnixArchitecture" to avoid any confusion due to the use of the name
 * "Itanium".
 */
abstract class UnixArchitecture extends Architecture {
  bindingset[this]
  UnixArchitecture() { any() }

  override int baseClassSize(ClassDerivation cd) {
    if
      not exists(cd.getBaseClass().getABaseClass*().getAField()) and
      not exists(PaddedType fieldType |
        fieldType = getAnInitialField(cd.getDerivedClass()).getUnspecifiedType() and
        (
          // Check if the type of the field is a base type of the class, or
          // vice versa. This is an approximation of the actual rule, which is
          // that the field type and the class must not share a common
          // ancestor. This approximation should be sufficient for the vast
          // majority of cases.
          fieldType.getABaseClass*() = cd.getBaseClass() or
          fieldType = cd.getBaseClass().getABaseClass*()
        )
      )
    then
      // No fields in this class or any base classes.
      result = 0
    else result = cd.getBaseClass().(PaddedType).paddedSize(this)
  }

  override int longLongSize() { result = 64 }

  override int wideCharSize() { result = 32 }

  override predicate allowHeterogeneousBitfields() { any() }
}

/**
 * The ILP32 architecture has ints, longs and pointers
 * of 32 bits.
 */
class ILP32 extends UnixArchitecture {
  ILP32() { this = "ILP32" }

  override int pointerSize() { result = 32 }

  override int longSize() { result = 32 }

  override int longDoubleSize() { result = 96 }

  override int doubleAlign() { result = 32 }

  override int longLongAlign() { result = 32 }

  override int longDoubleAlign() { result = 32 }
}

/**
 * The LP64 architecture has longs and pointers of 64 bits.
 */
class LP64 extends UnixArchitecture {
  LP64() { this = "LP64" }

  override int pointerSize() { result = 64 }

  override int longSize() { result = 64 }

  override int longDoubleSize() { result = 128 }

  override int doubleAlign() { result = 64 }

  override int longLongAlign() { result = 64 }

  override int longDoubleAlign() { result = 128 }
}

/**
 * Base class for Windows architectures.
 */
abstract class WindowsArchitecture extends Architecture {
  bindingset[this]
  WindowsArchitecture() { any() }

  override int baseClassSize(ClassDerivation cd) {
    if not exists(cd.getBaseClass().getABaseClass*().getAField())
    then
      // No fields in this class or any base classes.
      result = 0
    else result = cd.getBaseClass().(PaddedType).paddedSize(this)
  }

  override int longSize() { result = 32 }

  override int longDoubleSize() { result = 64 }

  override int longLongSize() { result = 64 }

  override int wideCharSize() { result = 16 }

  override int doubleAlign() { result = 64 }

  override int longLongAlign() { result = 64 }

  override int longDoubleAlign() { result = 64 }

  override predicate allowHeterogeneousBitfields() { none() }
}

/**
 * The ILP32_MS architecture is essentially the same as the
 * ILP32 architecture, except that long doubles are 64 bits.
 */
class ILP32_MS extends WindowsArchitecture {
  ILP32_MS() { this = "ILP32_MS" }

  override int pointerSize() { result = 32 }
}

/**
 * The LLP64_MS architecture has pointers of 64 bits, but both
 * long and int are still 32 bits.
 */
class LLP64_MS extends WindowsArchitecture {
  LLP64_MS() { this = "LLP64_MS" }

  override int pointerSize() { result = 64 }
}

/**
 * A class that is subject to padding by the compiler, and hence can
 * introduce waste. Does not include types with virtual member functions,
 * virtual base classes, or multiple base classes. These are excluded due
 * to the complexity of the implementation.
 */
class PaddedType extends Class {
  PaddedType() {
    // We can't talk about bit size of template types.
    not this instanceof TemplateClass and
    // If the class has any virtual functions, the layout will be more
    // complicated due to the presence of a virtual function table pointer.
    not exists(MemberFunction f | f = this.getAMemberFunction() and f.isVirtual()) and
    not exists(ClassDerivation cd | cd = this.getADerivation() |
      // If the class has any virtual functions, the layout will be more
      // complicated due to the presence of a virtual base table pointer.
      cd.hasSpecifier("virtual")
      or
      // If one of the base classes was not a PaddedType, then we should not
      // attempt to lay out the derived class, either.
      not cd.getBaseClass() instanceof PaddedType
    ) and
    // Support only single inheritance for now. If multiple inheritance is
    // supported, be sure to fix up the calls to getABaseClass*() to correctly
    // handle the presence of multiple base class subojects with the same type.
    not exists(this.getDerivation(1))
  }

  /**
   * Holds if, for each architecture, a single padded size is
   * calculated for this type.
   * This is normally the case, but sometimes the same type can be
   * defined in different compilations with different sizes, normally
   * due to use of the preprocessor in its definition.
   */
  predicate isPrecise() { forex(Architecture arch | 1 = strictcount(arch.paddedSize(this))) }

  /**
   * Gets the padded size of this type on architecture `arch`, in bits.
   * This is its `bitSize`, rounded up to the next multiple of its
   * `alignment`.
   */
  int paddedSize(Architecture arch) {
    // Struct padding is weird: It needs to be such that struct arrays
    // can be allocated contiguously. That means that the trailing padding
    // has to bring the alignment up to the smallest common multiple of
    // the alignment values of all fields. In practice, since valid
    // alignment values are 1, 2, 4, 8 and 16, this means "the largest
    // alignment value".
    // If the class is empty, the size is rounded up to one byte.
    result = alignUp(arch.bitSize(this), arch.alignment(this)).maximum(8)
  }

  /**
   * Gets the number of bits wasted by padding at the end of this
   * struct.
   */
  int trailingPadding(Architecture arch) { result = this.paddedSize(arch) - arch.bitSize(this) }

  /**
   * Gets the number of bits wasted in this struct definition; that is.
   * the waste between fields plus any waste from trailing padding.
   * Only the space wasted directly in this type is counted, not space
   * wasted in nested structs. Note that for unions, the wasted space
   * is simply the amount of trailing padding, as other fields are not
   * laid out one after another, and hence there is no padding between
   * them.
   */
  int wastedSpace(Architecture arch) { result = arch.paddedSize(this) - this.dataSize(arch) }

  /**
   * Gets the total size of all fields declared in this class, not including any
   * padding between fields.
   */
  private int fieldDataSize(Architecture arch) {
    if this instanceof Union
    then result = max(Field f | f = this.getAMember() | this.fieldSize(f, arch))
    else result = sum(Field f | f = this.getAMember() | this.fieldSize(f, arch))
  }

  /**
   * Gets the data size of this type on architecture `arch`; that is,
   * the number of bits taken up by data, rather than any kind of
   * padding. Padding of fields that have struct type is
   * considered "data" for the purposes of this definition, since
   * removing it requires reorganizing other parts of the code.
   */
  int dataSize(Architecture arch) {
    result = sum(PaddedType c | c = this.getABaseClass*() | c.fieldDataSize(arch))
  }

  /**
   * Gets the optimal size of this type on architecture `arch`, that is,
   * the sum of the sizes of all fields, ignoring padding
   * between them, but adding any trailing padding required to align
   * the type properly. This is a lower bound on the actual size that
   * can be achieved just by reordering fields, and without
   * reorganizing member structs' field layouts.
   */
  int optimalSize(Architecture arch) {
    result = alignUp(this.dataSize(arch), arch.alignment(this)).maximum(8)
  }

  /**
   * Gets the bit size of this type on architecture `arch`, that is, the
   * size its fields and required padding take up, without including
   * any trailing padding that is necessary.
   */
  int typeBitSize(Architecture arch) {
    if this instanceof Union
    then
      // A correct implementation for unions would be:
      // ```
      //     result = max(fieldSize(_, arch))
      // ```
      // but that uses a recursive aggregate, which isn't supported in
      // QL. We therefore use this slightly more complex implementation
      // instead.
      result = this.biggestFieldSizeUpTo(this.lastFieldIndex(), arch)
    else
      // If we're not a union type, the size is the padded
      // sum of field sizes, padded.
      result = this.fieldEnd(this.lastFieldIndex(), arch)
  }

  /**
   * Gets the alignment, in bits, of the entire struct/union type for
   * architecture `arch`.
   */
  language[monotonicAggregates]
  int typeAlignment(Architecture arch) {
    // The alignment of the type is the largest alignment of any of its fields,
    // including fields from base class subobjects.
    result =
      max(PaddedType c |
        c = this.getABaseClass*()
      |
        c.biggestAlignmentUpTo(c.lastFieldIndex(), arch)
      )
  }

  /**
   * Gets the largest size, in bits, of the size of a field with
   * (1-based) index less than or equal to `index` on architecture
   * `arch`.
   */
  int biggestFieldSizeUpTo(int index, Architecture arch) {
    if index = 0
    then result = 0
    else
      exists(Field f, int fSize | index = this.fieldIndex(f) and fSize = this.fieldSize(f, arch) |
        result = fSize.maximum(this.biggestFieldSizeUpTo(index - 1, arch))
      )
  }

  /**
   * Gets the largest alignment boundary, in bits, required by a field
   * with (1-based) index less than or equal to `index` on architecture
   * `arch`.
   */
  int biggestAlignmentUpTo(int index, Architecture arch) {
    if index = 0
    then result = 1 // Minimum possible alignment
    else
      exists(Field f, int fAlign |
        index = this.fieldIndex(f) and fAlign = arch.alignment(f.getType())
      |
        result = fAlign.maximum(this.biggestAlignmentUpTo(index - 1, arch))
      )
  }

  /**
   * Gets the 1-based index for each field.
   */
  int fieldIndex(Field f) {
    this.memberIndex(f) =
      rank[result](Field field, int index | this.memberIndex(field) = index | index)
  }

  private int memberIndex(Field f) { result = min(int i | this.getCanonicalMember(i) = f) }

  /**
   * Gets the 1-based index for the last field.
   */
  int lastFieldIndex() {
    if exists(this.lastField())
    then result = this.fieldIndex(this.lastField())
    else
      // Field indices are 1-based, so return 0 to represent the lack of fields.
      result = 0
  }

  /**
   * Gets the size, in bits, of field `f` on architecture
   * `arch`.
   */
  int fieldSize(Field f, Architecture arch) {
    exists(this.fieldIndex(f)) and
    if f instanceof BitField
    then result = f.(BitField).getNumBits()
    else result = arch.paddedSize(f.getType())
  }

  /** Gets the last field of this type. */
  Field lastField() { this.fieldIndex(result) = max(Field other | | this.fieldIndex(other)) }

  /**
   * Gets the offset, in bits, of the end of the class' last base class
   * subobject, or zero if the class has no base classes.
   */
  int baseClassEnd(Architecture arch) {
    if exists(this.getABaseClass())
    then result = arch.baseClassSize(this.getADerivation())
    else result = 0
  }

  /** Gets the bitfield at field index `index`, if that field is a bitfield. */
  private BitField bitFieldAt(int index) { this.fieldIndex(result) = index }

  /**
   * Gets the 0-based offset, in bits, of the first free bit after
   * field `f` (which is the `index`th field of
   * this type), taking padding into account, on architecture `arch`.
   */
  int fieldEnd(int index, Architecture arch) {
    if index = 0
    then
      // Base case: No fields seen yet, so return the offset of the end of the
      // base class subojects.
      result = this.baseClassEnd(arch)
    else
      exists(Field f | index = this.fieldIndex(f) |
        exists(int fSize | fSize = this.fieldSize(f, arch) |
          // Recursive case: Take previous field's end point, pad and add
          // this field's size
          exists(int firstFree | firstFree = this.fieldEnd(index - 1, arch) |
            if f instanceof BitField
            then
              // Bitfield packing:
              // (1) A struct containing a bitfield with declared type T (e.g. T bf : 7) will be aligned as if it
              //     contained an actual field of type T. Thus, a struct containing a bitfield 'unsigned int bf : 8'
              //     will have an alignment of at least alignof(unsigned int), even though the bitfield was only 8 bits.
              // (2) If a bitfield with declared type T would straddle a sizeof(T) boundary, padding is inserted
              //     before the bitfield to align it on an alignof(T) boundary. Note the subtle distinction between alignof
              //     and sizeof. This matters for 32-bit Linux, where sizeof(long long) == 8, but alignof(long long) == 4.
              // (3) [MSVC only!] If a bitfield with declared type T immediately follows another bitfield with declared type P,
              //     and sizeof(P) != sizeof(T), padding will be inserted to align the new bitfield to a boundary of
              //     max(alignof(P), alignof(T)).
              exists(int nextSizeofBoundary, int nextAlignofBoundary |
                nextSizeofBoundary = alignUp(firstFree, arch.bitSize(f.getType())) and
                nextAlignofBoundary = alignUp(firstFree, arch.alignment(f.getType()))
              |
                if arch.allowHeterogeneousBitfields()
                then (
                  if nextSizeofBoundary < (firstFree + fSize)
                  then
                    // Straddles a sizeof(T) boundary, so pad for alignment.
                    result = nextAlignofBoundary + fSize
                  else
                    // No additional restrictions, so just pack it in with no padding.
                    result = firstFree + fSize
                ) else (
                  if exists(this.bitFieldAt(index - 1))
                  then
                    exists(BitField previousBitField |
                      previousBitField = this.bitFieldAt(index - 1)
                    |
                      // Previous field was a bitfield.
                      if
                        nextSizeofBoundary >= (firstFree + fSize) and
                        arch.integralBitSize(previousBitField.getType()) =
                          arch.integralBitSize(f.getType())
                      then
                        // The new bitfield can be stored in the same allocation unit as the previous one,
                        // so we can avoid padding.
                        result = firstFree + fSize
                      else
                        // Either we switched types, or we would overlap a sizeof(T) boundary, so we have to insert padding.
                        // Note that we have to align to max(alignof(T), alignof(P)), where P is the type of the previous
                        // bitfield. Without the alignof(P) term, we'll get the wrong layout for:
                        //   struct S {
                        //     unsigned int x : 7;
                        //     unsigned short y : 1;
                        //   };
                        // If we only aligned to sizeof(T), we'd align 'y' to a 2-byte boundary. This is incorrect. The allocation
                        // unit that started with 'x' has to consume an entire unsigned int (4 bytes).
                        result =
                          max(int boundary |
                              boundary = nextAlignofBoundary or
                              boundary =
                                alignUp(firstFree, arch.alignment(previousBitField.getType()))
                            |
                              boundary
                            ) + fSize
                    )
                  else
                    // Previous field was not a bitfield. Align up to an
                    // alignof(T) boundary.
                    result = nextSizeofBoundary + fSize
                )
              )
            else
              // Normal case: Pad as necessary, then add the field.
              result = alignUp(firstFree, arch.alignment(f.getType())) + fSize
          )
        )
      )
  }
}