feat(dataflow): make vendored scalpel the default L4 alias oracle

Repoint ScalpelAliasOracle.from_function at the vendored, typed_ast-free
codeanalyzer.dataflow.scalpel slice instead of the external python-scalpel
package, and drop the now-dead ImportError fallback branch in
make_alias_oracle -- Scalpel can no longer be "absent" since it ships in
the package. TypeBasedAliasOracle remains the runtime safety net for a
per-callable Scalpel build failure only.

Reframe the two L4 tests whose premise this repoint invalidates:
test_make_alias_oracle_falls_back_when_scalpel_absent now forces a
per-callable build failure instead of poisoning sys.modules["scalpel"]
(which no longer affects the vendored import path), and
test_scalpel_oracle_copy_chain drops its pytest.importorskip("scalpel")
guard since the vendored oracle is always present.

Author: rahlk

codeanalyzer/dataflow/scalpel_oracle.py

@@ -22,7 +22,7 @@
 forks or re-runs Scalpel's solver — and turns the copy/const records into
 per-function copy-closure equivalence classes:
 
-    ``from scalpel.SSA.const import SSA``
+    ``from codeanalyzer.dataflow.scalpel.SSA.const import SSA``
     ``ssa_results, const_dict = SSA().compute_SSA(func_cfg)``
 
 ``const_dict`` maps ``(name, version)`` to the ``ast`` value node that defined
@@ -138,14 +138,14 @@ def from_function(
     ) -> "ScalpelAliasOracle":
         """Build from a function AST by consuming Scalpel's solved SSA state.
 
-        Imports Scalpel lazily (``ImportError`` if the optional dependency is
-        absent) and reuses the *same source* both graphs are built from — the
+        Imports the vendored Scalpel slice (``codeanalyzer.dataflow.scalpel``)
+        and reuses the *same source* both graphs are built from — the
         function's unparsed text — so the join is identity, not a fuzzy match.
         Raises on any build failure; :func:`make_alias_oracle` is the total,
         never-raising entry point callers should prefer.
         """
-        from scalpel.SSA.const import SSA
-        from scalpel.cfg import CFGBuilder
+        from codeanalyzer.dataflow.scalpel.SSA.const import SSA
+        from codeanalyzer.dataflow.scalpel.cfg import CFGBuilder
 
         src = ast.unparse(func_ast)
         fname = name or getattr(func_ast, "name", None)
@@ -250,19 +250,16 @@ def may_alias(self, path_a: str, path_b: str) -> bool:
 def make_alias_oracle(pycallable, func_ast, base_types) -> object:
     """Total selector for the L4 may-alias oracle.
 
-    Returns a :class:`ScalpelAliasOracle` when ``python-scalpel`` is importable
-    *and* builds successfully on ``func_ast``; otherwise logs once (INFO) and
-    returns a :class:`TypeBasedAliasOracle` over ``base_types``.  Never raises —
-    mirrors how ``core._get_pycg_call_graph`` degrades on a missing/failed PyCG.
+    Returns a :class:`ScalpelAliasOracle` built on the vendored, typed_ast-free
+    Scalpel slice (``codeanalyzer.dataflow.scalpel``) — the default L4 oracle.
+    Falls back to :class:`TypeBasedAliasOracle` only when the per-callable
+    Scalpel build fails on this AST. Never raises.
     """
     fallback = TypeBasedAliasOracle(base_types)
     try:
         return ScalpelAliasOracle.from_function(
             func_ast, base_types=base_types, fallback=fallback
         )
-    except ImportError:
-        _note_fallback("python-scalpel not installed")
-        return fallback
     except Exception:
         _note_fallback("scalpel alias build failed")
         logger.debug("scalpel alias oracle build error", exc_info=True)

test/test_v2_l4.py

@@ -5,8 +5,6 @@
 import sys
 from pathlib import Path
 
-import pytest
-
 from codeanalyzer.dataflow.alias import TypeBasedAliasOracle
 from codeanalyzer.dataflow.identity import IdentityMap
 from codeanalyzer.dataflow.sdg import ParamNode
@@ -104,18 +102,19 @@ def emit(self, record):
         self.records.append(record)
 
 
-def test_make_alias_oracle_falls_back_when_scalpel_absent(monkeypatch):
+def test_make_alias_oracle_falls_back_on_build_failure(monkeypatch):
     """`make_alias_oracle` degrades to TypeBasedAliasOracle behavior and logs
-    once when Scalpel cannot be imported — regardless of whether the optional
-    dependency is actually installed in the runner."""
+    once when the (now-vendored, always-present) Scalpel oracle fails to build
+    for a given callable — the only surviving fallback path now that Scalpel
+    can no longer be "absent" (it is vendored, not an optional import)."""
     import codeanalyzer.dataflow.scalpel_oracle as so
 
-    # Force `import scalpel...` to raise ImportError even if it is installed:
-    # a None entry in sys.modules makes the import machinery halt. Cover the
-    # top-level package and every submodule the oracle imports so a previously
-    # cached submodule cannot satisfy the import.
-    for mod in ("scalpel", "scalpel.cfg", "scalpel.SSA", "scalpel.SSA.const"):
-        monkeypatch.setitem(sys.modules, mod, None)
+    # Force the per-callable Scalpel build to fail, regardless of input.
+    monkeypatch.setattr(
+        so.ScalpelAliasOracle,
+        "from_function",
+        classmethod(lambda cls, *a, **k: (_ for _ in ()).throw(RuntimeError("boom"))),
+    )
 
     # Reset the process-wide "logged once" guard and capture on the actual
     # (propagate=False) codeanalyzer logger.
@@ -144,9 +143,9 @@ def test_make_alias_oracle_falls_back_when_scalpel_absent(monkeypatch):
 
 
 def test_scalpel_oracle_copy_chain():
-    """When Scalpel is importable, the copy chain `b = a; c = b` places a, b, c
-    in one copy-closure class: a/b may-alias, an unrelated name does not."""
-    pytest.importorskip("scalpel")
+    """Scalpel is vendored and always importable now, so the copy chain
+    `b = a; c = b` always places a, b, c in one copy-closure class: a/b
+    may-alias, an unrelated name does not."""
     from codeanalyzer.dataflow.scalpel_oracle import ScalpelAliasOracle
 
     func_ast = ast.parse(COPY_CHAIN).body[0]

test/test_vendored_scalpel.py

@@ -1,7 +1,6 @@
 """The vendored, typed_ast-free scalpel slice: it must import and compute SSA
 with no external scalpel / typed_ast / graphviz, and never pull in typeinfer."""
 import sys
-import importlib
 
 
 def test_vendored_scalpel_imports_and_computes_ssa_typed_ast_free():
@@ -24,3 +23,31 @@ def test_vendored_scalpel_imports_and_computes_ssa_typed_ast_free():
     assert "typed_ast" not in sys.modules
     loaded = [m for m in sys.modules if m.startswith("codeanalyzer.dataflow.scalpel")]
     assert not any("typeinfer" in m for m in loaded), f"typeinfer leaked: {loaded}"
+
+
+import ast
+
+
+def test_make_alias_oracle_defaults_to_scalpel_without_typed_ast():
+    import sys
+    assert "typed_ast" not in sys.modules
+    from codeanalyzer.dataflow.scalpel_oracle import make_alias_oracle, ScalpelAliasOracle
+
+    src = "def f(a):\n    b = a\n    c = b\n    return c\n"
+    func_ast = ast.parse(src).body[0]
+    oracle = make_alias_oracle(pycallable=None, func_ast=func_ast, base_types={})
+    # The whole point: scalpel is the default, not the type-based fallback.
+    assert isinstance(oracle, ScalpelAliasOracle), type(oracle).__name__
+    # It answers queries (copies alias; unrelated locals do not).
+    assert oracle.may_alias("b", "c") is True
+
+
+def test_make_alias_oracle_is_deterministic():
+    import ast as _ast
+    from codeanalyzer.dataflow.scalpel_oracle import make_alias_oracle
+    src = "def f(a):\n    b = a\n    c = b\n    return c\n"
+    fa = _ast.parse(src).body[0]
+    o1 = make_alias_oracle(None, _ast.parse(src).body[0], {})
+    o2 = make_alias_oracle(None, _ast.parse(src).body[0], {})
+    pairs = [("a", "b"), ("b", "c"), ("a", "c"), ("b", "b")]
+    assert [o1.may_alias(x, y) for x, y in pairs] == [o2.may_alias(x, y) for x, y in pairs]