Decompiler: Fix simplifier replacing incorrect constants, add methodInfo resolution

Author: SamboyCoding

Cpp2IL.Core.Tests/Analysis/SimplifierTests.cs

@@ -63,4 +63,69 @@ public void DoesNotInlineAcrossJoinWhenLocalHasMultipleDefinitions()
         Assert.That(ReferenceEquals(writeLineCall.Operands[1], selected), Is.True,
             "join-point call must keep the selected local, not a branch-specific constant");
     }
+
+    [Test]
+    public void DoesNotCorruptUnrelatedConstantMemoryAddends()
+    {
+        var aLocal = new LocalVariable("a", new Register(null, "a"));
+        var bLocal = new LocalVariable("b", new Register(null, "b"));
+
+        // a := [0xAAAA]; f(a); b := [0xBBBB]; g(b).  Inlining a's constant load must not touch the
+        // unrelated constant address [0xBBBB] - they are distinct absolute addresses.
+        var instructions = new List<Instruction>
+        {
+            new(0, OpCode.Move, aLocal, new MemoryOperand(null, null, 0xAAAA, 0)),
+            new(1, OpCode.CallVoid, "f", aLocal, 0),
+            new(2, OpCode.Move, bLocal, new MemoryOperand(null, null, 0xBBBB, 0)),
+            new(3, OpCode.CallVoid, "g", bLocal, 0),
+            new(4, OpCode.Return),
+        };
+
+        var graph = new ISILControlFlowGraph(instructions);
+        var method = CreateMethod(graph, aLocal, bLocal);
+
+        Simplifier.Simplify(method);
+
+        var live = graph.Blocks.SelectMany(b => b.Instructions).ToList();
+
+        var gCall = live.Single(i => i.OpCode == OpCode.CallVoid && i.Operands[0] is "g");
+        Assert.That(gCall.Operands[1], Is.InstanceOf<MemoryOperand>());
+        Assert.That(((MemoryOperand)gCall.Operands[1]).Addend, Is.EqualTo(0xBBBBL),
+            "an unrelated constant address must not be rewritten by another inline");
+
+        // The intended inline still happens.
+        var fCall = live.Single(i => i.OpCode == OpCode.CallVoid && i.Operands[0] is "f");
+        Assert.That(fCall.Operands[1], Is.InstanceOf<MemoryOperand>());
+        Assert.That(((MemoryOperand)fCall.Operands[1]).Addend, Is.EqualTo(0xAAAAL));
+    }
+
+    [Test]
+    public void PropagatesCopyThroughMemoryBase()
+    {
+        var x = new LocalVariable("x", new Register(null, "x"));
+        var y = new LocalVariable("y", new Register(null, "y"));
+        var z = new LocalVariable("z", new Register(null, "z"));
+
+        // x := y; z := [x]; f(z).  Copy propagation must rewrite the load's base x -> y (a base must
+        // stay a local), so the surviving load reads [y].
+        var instructions = new List<Instruction>
+        {
+            new(0, OpCode.Move, x, y),
+            new(1, OpCode.Move, z, new MemoryOperand(x, null, 0, 0)),
+            new(2, OpCode.CallVoid, "f", z, 0),
+            new(3, OpCode.Return),
+        };
+
+        var graph = new ISILControlFlowGraph(instructions);
+        var method = CreateMethod(graph, x, y, z);
+
+        Simplifier.Simplify(method);
+
+        var live = graph.Blocks.SelectMany(b => b.Instructions).ToList();
+        var load = live.Single(i => i.Operands.Any(o => o is MemoryOperand));
+        var memory = (MemoryOperand)load.Operands.First(o => o is MemoryOperand);
+        Assert.That(ReferenceEquals(memory.Base, y), Is.True, "the copy's source must be propagated into the memory base");
+        Assert.That(live.Any(i => i.OpCode == OpCode.Move && ReferenceEquals(i.Operands[0], x)), Is.False,
+            "the now-dead copy is removed");
+    }
 }

Cpp2IL.Core/Analysis/LocalVariables.cs

@@ -207,6 +207,7 @@ public static void ResolveTypesAndFields(MethodAnalysisContext method)
         PropagateFromReturn(method);
         PropagateFromParameters(method);
         SeedRuntimeClassTypes(method);
+        SeedMethodInfoTypes(method);
         SeedComparisonResults(method);
 
         // Everything else is mutually enabling and so runs to a fixpoint: a typed receiver lets an
@@ -241,11 +242,28 @@ private static void SeedRuntimeClassTypes(MethodAnalysisContext method)
             if (instruction.OpCode != OpCode.Move || instruction.Operands.Count < 2)
                 continue;
 
-            if (instruction.Operands[0] is LocalVariable destination && instruction.Operands[1] is TypeAnalysisContext type)
+            if (instruction.Operands[0] is LocalVariable destination
+                && instruction.Operands[1] is TypeAnalysisContext type and not RuntimeMethodInfoAnalysisContext)
                 destination.Type = new RuntimeClassTypeAnalysisContext(type, type.DeclaringAssembly);
         }
     }
 
+    // A method-metadata global load (Move local, methodof(M)) puts a MethodInfo* for M into the local.
+    // MetadataResolver already resolved the address to a RuntimeMethodInfoAnalysisContext naming the
+    // method; that same context is the local's type (a runtime handle, recoverable via its
+    // RepresentedMethod).
+    private static void SeedMethodInfoTypes(MethodAnalysisContext method)
+    {
+        foreach (var instruction in method.ControlFlowGraph!.Instructions)
+        {
+            if (instruction.OpCode != OpCode.Move || instruction.Operands.Count < 2)
+                continue;
+
+            if (instruction.Operands[0] is LocalVariable destination && instruction.Operands[1] is RuntimeMethodInfoAnalysisContext methodInfo)
+                destination.Type = methodInfo;
+        }
+    }
+
     // A comparison (CheckEqual, CheckLess, ...) writes a 0/1 result into its destination, so that local
     // is a System.Boolean regardless of what the compared operands are.
     private static void SeedComparisonResults(MethodAnalysisContext method)

Cpp2IL.Core/Analysis/MetadataResolver.cs

@@ -15,39 +15,57 @@ public static void ResolveAll(MethodAnalysisContext method)
     {
         ResolveCalls(method);
         ResolveGetter(method);
-        ResolveStrings(method);
+        ResolveMetadataUsages(method);
     }
 
-    private static void ResolveStrings(MethodAnalysisContext method)
+    /// <summary>
+    /// Resolves <c>Move local, [absoluteAddress]</c> loads of IL2CPP metadata-usage globals into a
+    /// strongly-typed operand: a string literal, a <see cref="TypeAnalysisContext"/> (an Il2CppType*/
+    /// Il2CppClass* usage) or, for a MethodInfo* usage, a <see cref="RuntimeMethodInfoAnalysisContext"/>
+    /// naming the method it refers to (also used to type the local - see <see cref="LocalVariables"/>).
+    /// </summary>
+    private static void ResolveMetadataUsages(MethodAnalysisContext method)
     {
+        var libContext = method.AppContext.LibCpp2IlContext;
+
         foreach (var instruction in method.ControlFlowGraph!.Instructions)
         {
             if (instruction.OpCode != OpCode.Move)
                 continue;
 
-            if ((instruction.Operands[0] is not LocalVariable) || (instruction.Operands[1] is not MemoryOperand memory))
+            // Only an absolute-address load [addr] (no base/index/scale) can be a metadata-usage global.
+            if (instruction.Operands[0] is not LocalVariable
+                || instruction.Operands[1] is not MemoryOperand { Base: null, Index: null, Scale: 0 } memory)
                 continue;
 
-            if (memory.Base == null && memory.Index == null && memory.Scale == 0)
+            var address = (ulong)memory.Addend;
+
+            // String literal.
+            var stringLiteral = libContext.GetLiteralByAddress(address);
+            if (stringLiteral != null)
             {
-                var stringLiteral = method.AppContext.LibCpp2IlContext.GetLiteralByAddress((ulong)memory.Addend);
+                instruction.Operands[1] = stringLiteral;
+                continue;
+            }
 
-                if (stringLiteral == null)
+            // Type metadata usage (Il2CppType* / Il2CppClass*).
+            if (method.DeclaringType is { } declaringType)
+            {
+                var typeContext = libContext.GetTypeGlobalByAddress(address)?.ToContext(declaringType.DeclaringAssembly);
+                if (typeContext != null)
                 {
-                    // Try instead check if its type metadata usage
-                    var metadataUsage = method.AppContext.LibCpp2IlContext.GetTypeGlobalByAddress((ulong)memory.Addend);
-                    if (metadataUsage != null && method.DeclaringType is not null)
-                    {
-                        var typeAnalysisContext = metadataUsage.ToContext(method.DeclaringType!.DeclaringAssembly);
-                        if (typeAnalysisContext != null)
-                            instruction.Operands[1] = typeAnalysisContext;
-                    }
-
+                    instruction.Operands[1] = typeContext;
                     continue;
                 }
-
-                instruction.Operands[1] = stringLiteral;
             }
+
+            // Method metadata usage (MethodInfo*). On metadata v27+ GetMethodGlobalByAddress can return
+            // any global, so confirm it is actually a method before resolving - the resolver's switch
+            // throws on other usage kinds.
+            var methodUsage = libContext.GetMethodGlobalByAddress(address);
+            if (methodUsage?.Type is MetadataUsageType.MethodDef or MetadataUsageType.MethodRef
+                && method.AppContext.ResolveContextForMethod(methodUsage) is { DeclaringType: { } methodDeclaringType } methodContext)
+                instruction.Operands[1] = new RuntimeMethodInfoAnalysisContext(methodContext, methodDeclaringType.DeclaringAssembly);
         }
     }
 

Cpp2IL.Core/Analysis/Simplifier.cs

@@ -188,25 +188,17 @@ void ProcessBlock(Block currentBlock, int index)
                     if (operand is LocalVariable usedLocal && usedLocal == local)
                         instruction.Operands[j] = replacement;
 
-                    // [base]
-                    if (operand is MemoryOperand { Index: null, Addend: 0, Scale: 0 } memoryLocal)
+                    // A memory operand's base/index holds an address, so only a local replacement may
+                    // be substituted there (copy propagation). A constant/value replacement is left in
+                    // place - the caller sees the local is still used and keeps its defining move.
+                    if (operand is MemoryOperand memory && replacement is LocalVariable)
                     {
-                        if (memoryLocal.Base is LocalVariable baseLocal && baseLocal == local)
-                            instruction.Operands[j] = replacement;
-                    }
-
-                    if (operand is MemoryOperand memory)
-                    {
-                        // [addend]
-                        if (memory.IsConstant && (replacement is MemoryOperand { IsConstant: true } replacementMemory))
-                            memory.Addend = replacementMemory.Addend;
-
                         if (memory.Base is LocalVariable baseLocal && baseLocal == local)
                             memory.Base = replacement;
 
                         if (memory.Index is LocalVariable indexLocal && indexLocal == local)
                             memory.Index = replacement;
-                        
+
                         instruction.Operands[j] = memory;
                     }
                 }

Cpp2IL.Core/ISIL/Instruction.cs

@@ -127,6 +127,7 @@ private static string FormatOperand(object operand)
         {
             string text => $"\"{text}\"",
             MethodAnalysisContext method => $"{method.DeclaringType!.Name}.{method.Name}",
+            RuntimeMethodInfoAnalysisContext methodInfo => $"methodof({methodInfo.RepresentedMethod.FullName})",
             TypeAnalysisContext type => $"typeof({type.FullName})",
             Instruction instruction => $"@{instruction.Index}",
             Block block => $"@b{block.ID}",

Cpp2IL.Core/IlGenerator.cs

@@ -416,6 +416,11 @@ private static void LoadOperand(object operand, MethodDefinition method,
                 instructions.Add(CilOpCodes.Ldstr, "Unmanaged memory load: " + operand.ToString());
                 instructions.Add(CilOpCodes.Newobj, importer.ImportMethod(stringCtor));
                 break;
+            case RuntimeMethodInfoAnalysisContext:
+                //Not fully implemented, these basically shouldn't actually ever exist in the final IL.
+                instructions.Add(CilOpCodes.Ldc_I4_0);
+                instructions.Add(CilOpCodes.Conv_I);
+                break;
             case TypeAnalysisContext type:
                 if (type.Name == "T")
                 {

Cpp2IL.Core/Model/Contexts/RuntimeMethodInfoAnalysisContext.cs

@@ -0,0 +1,23 @@
+using LibCpp2IL.BinaryStructures;
+
+namespace Cpp2IL.Core.Model.Contexts;
+
+/// <summary>
+/// Synthetic type for a value that holds an IL2CPP runtime method pointer (<c>MethodInfo*</c>) - the
+/// value produced by loading a method-metadata global. 
+/// </summary>
+public class RuntimeMethodInfoAnalysisContext(MethodAnalysisContext representedMethod, AssemblyAnalysisContext referencedFrom)
+    : ReferencedTypeAnalysisContext(referencedFrom)
+{
+    /// <summary>The method whose runtime MethodInfo this value points to.</summary>
+    public MethodAnalysisContext RepresentedMethod { get; } = representedMethod;
+
+    // A pointer-sized runtime handle; there is no Il2CppType enum value for the Il2CppMethodInfo struct.
+    public override Il2CppTypeEnum Type => Il2CppTypeEnum.IL2CPP_TYPE_I;
+
+    public override string DefaultName => "Il2CppMethodInfo";
+
+    public override string DefaultNamespace => "";
+
+    public override bool IsValueType => false;
+}