C++: fix identical chi node operands

Robert Marsh · Robert Marsh · commit 057c634fe425 · 2019-10-04T13:05:47.000-07:00
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
@@ -740,7 +740,9 @@ module DefUse {
       block.getInstruction(index) = def and
       overlap = Alias::getOverlap(defLocation, useLocation) and
       if
-        overlap instanceof MayPartiallyOverlap
+        overlap instanceof MayPartiallyOverlap or
+        def.getResultMemoryAccess() instanceof IndirectMayMemoryAccess or
+        def.getResultMemoryAccess() instanceof BufferMayMemoryAccess
       then offset = (index * 2) + 1 // The use will be connected to the definition on the `Chi` instruction.
       else offset = index * 2 // The use will be connected to the definition on the original instruction.
     )
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -740,7 +740,9 @@ module DefUse {
       block.getInstruction(index) = def and
       overlap = Alias::getOverlap(defLocation, useLocation) and
       if
-        overlap instanceof MayPartiallyOverlap
+        overlap instanceof MayPartiallyOverlap or
+        def.getResultMemoryAccess() instanceof IndirectMayMemoryAccess or
+        def.getResultMemoryAccess() instanceof BufferMayMemoryAccess
       then offset = (index * 2) + 1 // The use will be connected to the definition on the `Chi` instruction.
       else offset = index * 2 // The use will be connected to the definition on the original instruction.
     )
diff --git a/cpp/ql/test/library-tests/ir/ir/aliased_ssa_sanity.expected b/cpp/ql/test/library-tests/ir/ir/aliased_ssa_sanity.expected
@@ -8,10 +8,6 @@ duplicateOperand
 missingPhiOperand
 missingOperandType
 duplicateChiOperand
-| ir.cpp:1035:3:1035:12 | Chi: (const lambda [] type at line 1034, col. 21)... |
-| ir.cpp:1039:3:1039:21 | Chi: (const lambda [] type at line 1038, col. 30)... |
-| ir.cpp:1043:3:1043:23 | Chi: (const lambda [] type at line 1042, col. 32)... |
-| ir.cpp:1046:3:1046:14 | Chi: (const lambda [] type at line 1045, col. 23)... |
 instructionWithoutSuccessor
 ambiguousSuccessors
 unexplainedLoop
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -884,23 +884,23 @@ ssa.cpp:
 #  220|     m0_8(unknown)               = ^CallSideEffect                 : ~m0_1
 #  220|     m0_9(unknown)               = Chi                             : total:m0_1, partial:m0_8
 #  220|     m0_10(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r0_3
-#  220|     m0_11(Constructible)        = Chi                             : total:m0_10, partial:m0_10
+#  220|     m0_11(Constructible)        = Chi                             : total:m0_4, partial:m0_10
 #  221|     r0_12(glval<Constructible>) = VariableAddress[c]              : 
 #  221|     r0_13(glval<unknown>)       = FunctionAddress[g]              : 
 #  221|     v0_14(void)                 = Call                            : func:r0_13, this:r0_12
 #  221|     m0_15(unknown)              = ^CallSideEffect                 : ~m0_9
 #  221|     m0_16(unknown)              = Chi                             : total:m0_9, partial:m0_15
-#  221|     v0_17(void)                 = ^IndirectReadSideEffect[-1]     : &:r0_12, m0_10
+#  221|     v0_17(void)                 = ^IndirectReadSideEffect[-1]     : &:r0_12, m0_11
 #  221|     m0_18(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r0_12
-#  221|     m0_19(Constructible)        = Chi                             : total:m0_18, partial:m0_18
+#  221|     m0_19(Constructible)        = Chi                             : total:m0_11, partial:m0_18
 #  222|     r0_20(glval<Constructible>) = VariableAddress[c]              : 
 #  222|     r0_21(glval<unknown>)       = FunctionAddress[g]              : 
 #  222|     v0_22(void)                 = Call                            : func:r0_21, this:r0_20
 #  222|     m0_23(unknown)              = ^CallSideEffect                 : ~m0_16
 #  222|     m0_24(unknown)              = Chi                             : total:m0_16, partial:m0_23
-#  222|     v0_25(void)                 = ^IndirectReadSideEffect[-1]     : &:r0_20, m0_18
+#  222|     v0_25(void)                 = ^IndirectReadSideEffect[-1]     : &:r0_20, m0_19
 #  222|     m0_26(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r0_20
-#  222|     m0_27(Constructible)        = Chi                             : total:m0_26, partial:m0_26
+#  222|     m0_27(Constructible)        = Chi                             : total:m0_19, partial:m0_26
 #  223|     r0_28(glval<Constructible>) = VariableAddress[c2]             : 
 #  223|     m0_29(Constructible)        = Uninitialized[c2]               : &:r0_28
 #  223|     r0_30(glval<unknown>)       = FunctionAddress[Constructible]  : 
@@ -909,15 +909,15 @@ ssa.cpp:
 #  223|     m0_33(unknown)              = ^CallSideEffect                 : ~m0_24
 #  223|     m0_34(unknown)              = Chi                             : total:m0_24, partial:m0_33
 #  223|     m0_35(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r0_28
-#  223|     m0_36(Constructible)        = Chi                             : total:m0_35, partial:m0_35
+#  223|     m0_36(Constructible)        = Chi                             : total:m0_29, partial:m0_35
 #  224|     r0_37(glval<Constructible>) = VariableAddress[c2]             : 
 #  224|     r0_38(glval<unknown>)       = FunctionAddress[g]              : 
 #  224|     v0_39(void)                 = Call                            : func:r0_38, this:r0_37
 #  224|     m0_40(unknown)              = ^CallSideEffect                 : ~m0_34
 #  224|     m0_41(unknown)              = Chi                             : total:m0_34, partial:m0_40
-#  224|     v0_42(void)                 = ^IndirectReadSideEffect[-1]     : &:r0_37, m0_35
+#  224|     v0_42(void)                 = ^IndirectReadSideEffect[-1]     : &:r0_37, m0_36
 #  224|     m0_43(Constructible)        = ^IndirectMayWriteSideEffect[-1] : &:r0_37
-#  224|     m0_44(Constructible)        = Chi                             : total:m0_43, partial:m0_43
+#  224|     m0_44(Constructible)        = Chi                             : total:m0_36, partial:m0_43
 #  225|     v0_45(void)                 = NoOp                            : 
 #  219|     v0_46(void)                 = ReturnVoid                      : 
 #  219|     v0_47(void)                 = UnmodeledUse                    : mu*
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_sanity.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_sanity.expected
@@ -4,11 +4,6 @@ duplicateOperand
 missingPhiOperand
 missingOperandType
 duplicateChiOperand
-| ssa.cpp:220:19:220:20 | Chi: call to Constructible |
-| ssa.cpp:221:3:221:3 | Chi: c |
-| ssa.cpp:222:3:222:3 | Chi: c |
-| ssa.cpp:223:21:223:37 | Chi: call to Constructible |
-| ssa.cpp:224:3:224:4 | Chi: c2 |
 instructionWithoutSuccessor
 ambiguousSuccessors
 unexplainedLoop
