Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 120fa6c

Browse files
author
Robert Marsh
committed
C++: alias fixes for ReturnIndirection
1 parent 5e946cc commit 120fa6c

13 files changed

Lines changed: 120 additions & 58 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,9 @@ class SideEffectOperand extends TypedOperand {
411411
or
412412
useInstr instanceof BufferMayWriteSideEffectInstruction and
413413
result instanceof BufferMayMemoryAccess
414+
or
415+
useInstr instanceof ReturnIndirectionInstruction and
416+
result instanceof BufferMemoryAccess
414417
}
415418
}
416419

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ private predicate operandEscapesDomain(Operand operand) {
6969
not isArgumentForParameter(_, operand, _) and
7070
not isOnlyEscapesViaReturnArgument(operand) and
7171
not operand.getUse() instanceof ReturnValueInstruction and
72+
not operand.getUse() instanceof ReturnIndirectionInstruction and
7273
not operand instanceof PhiInputOperand
7374
}
7475

‎cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,9 @@ class SideEffectOperand extends TypedOperand {
411411
or
412412
useInstr instanceof BufferMayWriteSideEffectInstruction and
413413
result instanceof BufferMayMemoryAccess
414+
or
415+
useInstr instanceof ReturnIndirectionInstruction and
416+
result instanceof BufferMemoryAccess
414417
}
415418
}
416419

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,9 @@ class SideEffectOperand extends TypedOperand {
411411
or
412412
useInstr instanceof BufferMayWriteSideEffectInstruction and
413413
result instanceof BufferMayMemoryAccess
414+
or
415+
useInstr instanceof ReturnIndirectionInstruction and
416+
result instanceof BufferMemoryAccess
414417
}
415418
}
416419

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ private predicate operandEscapesDomain(Operand operand) {
6969
not isArgumentForParameter(_, operand, _) and
7070
not isOnlyEscapesViaReturnArgument(operand) and
7171
not operand.getUse() instanceof ReturnValueInstruction and
72+
not operand.getUse() instanceof ReturnIndirectionInstruction and
7273
not operand instanceof PhiInputOperand
7374
}
7475

‎cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ ssa.cpp:
8484
# 28| r6_9(int) = Load : &:r6_8, ~m6_0
8585
# 28| r6_10(int) = Add : r6_5, r6_9
8686
# 28| m6_11(int) = Store : &:r6_1, r6_10
87-
# 13| v6_12(void) = ReturnIndirection : &:r0_5, ~mu0_2
87+
# 13| v6_12(void) = ReturnIndirection : &:r0_5, ~m6_0
8888
# 13| r6_13(glval<int>) = VariableAddress[#return] :
8989
# 13| v6_14(void) = ReturnValue : &:r6_13, m6_11
9090
# 13| v6_15(void) = UnmodeledUse : mu*
@@ -224,7 +224,7 @@ ssa.cpp:
224224

225225
# 71| Block 2
226226
# 71| v2_0(void) = NoOp :
227-
# 68| v2_1(void) = ReturnIndirection : &:r0_7, ~mu0_2
227+
# 68| v2_1(void) = ReturnIndirection : &:r0_7, ~m3_0
228228
# 68| v2_2(void) = ReturnVoid :
229229
# 68| v2_3(void) = UnmodeledUse : mu*
230230
# 68| v2_4(void) = ExitFunction :
@@ -746,7 +746,7 @@ ssa.cpp:
746746
# 181| r0_12(int *) = Load : &:r0_11, m0_4
747747
# 181| r0_13(int) = Load : &:r0_12, ~m0_9
748748
# 181| m0_14(int) = Store : &:r0_10, r0_13
749-
# 179| v0_15(void) = ReturnIndirection : &:r0_5, ~mu0_2
749+
# 179| v0_15(void) = ReturnIndirection : &:r0_5, ~m0_9
750750
# 179| r0_16(glval<int>) = VariableAddress[#return] :
751751
# 179| v0_17(void) = ReturnValue : &:r0_16, m0_14
752752
# 179| v0_18(void) = UnmodeledUse : mu*
@@ -788,10 +788,10 @@ ssa.cpp:
788788
# 186| m0_31(unknown) = InlineAsm : ~mu0_2, 0:r0_27, 1:r0_28, 2:r0_29, 3:r0_30
789789
# 186| m0_32(unknown) = Chi : total:m0_26, partial:m0_31
790790
# 192| v0_33(void) = NoOp :
791-
# 184| v0_34(void) = ReturnIndirection : &:r0_6, ~mu0_2
792-
# 184| v0_35(void) = ReturnIndirection : &:r0_12, ~mu0_2
793-
# 184| v0_36(void) = ReturnIndirection : &:r0_18, ~mu0_2
794-
# 184| v0_37(void) = ReturnIndirection : &:r0_24, ~mu0_2
791+
# 184| v0_34(void) = ReturnIndirection : &:r0_6, ~m0_32
792+
# 184| v0_35(void) = ReturnIndirection : &:r0_12, ~m0_32
793+
# 184| v0_36(void) = ReturnIndirection : &:r0_18, ~m0_32
794+
# 184| v0_37(void) = ReturnIndirection : &:r0_24, ~m0_32
795795
# 184| v0_38(void) = ReturnVoid :
796796
# 184| v0_39(void) = UnmodeledUse : mu*
797797
# 184| v0_40(void) = ExitFunction :
@@ -846,8 +846,8 @@ ssa.cpp:
846846
# 202| r0_45(glval<int>) = VariableAddress[ret] :
847847
# 202| r0_46(int) = Load : &:r0_45, m0_43
848848
# 202| m0_47(int) = Store : &:r0_44, r0_46
849-
# 198| v0_48(void) = ReturnIndirection : &:r0_5, ~mu0_2
850-
# 198| v0_49(void) = ReturnIndirection : &:r0_10, ~mu0_2
849+
# 198| v0_48(void) = ReturnIndirection : &:r0_5, ~m0_12
850+
# 198| v0_49(void) = ReturnIndirection : &:r0_10, ~m0_12
851851
# 198| r0_50(glval<int>) = VariableAddress[#return] :
852852
# 198| v0_51(void) = ReturnValue : &:r0_50, m0_47
853853
# 198| v0_52(void) = UnmodeledUse : mu*

‎cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -610,6 +610,8 @@ lostReachability
610610
| range_analysis.c:371:37:371:39 | Constant: 500 |
611611
backEdgeCountMismatch
612612
useNotDominatedByDefinition
613+
| VacuousDestructorCall.cpp:2:29:2:29 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | VacuousDestructorCall.cpp:2:6:2:6 | IR: CallDestructor | void CallDestructor<int>(int, int*) |
614+
| VacuousDestructorCall.cpp:2:29:2:29 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | VacuousDestructorCall.cpp:2:6:2:6 | IR: CallDestructor | void CallDestructor<int>(int, int*) |
613615
| VacuousDestructorCall.cpp:4:3:4:3 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | VacuousDestructorCall.cpp:2:6:2:6 | IR: CallDestructor | void CallDestructor<int>(int, int*) |
614616
| assume0.cpp:11:2:11:2 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | assume0.cpp:5:6:5:6 | IR: h | void h() |
615617
| condition_decls.cpp:16:15:16:15 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | condition_decls.cpp:15:6:15:17 | IR: if_decl_bind | void if_decl_bind(int) |
@@ -662,6 +664,8 @@ useNotDominatedByDefinition
662664
| misc.c:174:17:174:22 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | misc.c:168:6:168:8 | IR: vla | void vla() |
663665
| misc.c:174:30:174:35 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | misc.c:168:6:168:8 | IR: vla | void vla() |
664666
| misc.c:219:5:219:26 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
667+
| misc.c:219:47:219:48 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
668+
| misc.c:219:47:219:48 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
665669
| misc.c:220:4:220:5 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | misc.c:219:5:219:26 | IR: assign_designated_init | int assign_designated_init(someStruct*) |
666670
| ms_try_except.cpp:9:19:9:19 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | ms_try_except.cpp:2:6:2:18 | IR: ms_try_except | void ms_try_except(int) |
667671
| ms_try_except.cpp:19:17:19:17 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | ms_try_except.cpp:2:6:2:18 | IR: ms_try_except | void ms_try_except(int) |
@@ -684,6 +688,8 @@ useNotDominatedByDefinition
684688
| stmt_expr.cpp:31:16:31:18 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | stmt_expr.cpp:21:6:21:6 | IR: g | void stmtexpr::g(int) |
685689
| try_catch.cpp:21:13:21:24 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | try_catch.cpp:19:6:19:23 | IR: throw_from_nonstmt | void throw_from_nonstmt(int) |
686690
| vla.c:3:5:3:8 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | IR: main | int main(int, char**) |
691+
| vla.c:3:27:3:30 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | IR: main | int main(int, char**) |
692+
| vla.c:3:27:3:30 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | IR: main | int main(int, char**) |
687693
| vla.c:5:16:5:19 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | IR: main | int main(int, char**) |
688694
| vla.c:5:22:5:25 | Operand | Operand 'Operand' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | IR: main | int main(int, char**) |
689695
| vla.c:5:27:5:30 | Load | Operand 'Load' is not dominated by its definition in function '$@'. | vla.c:3:5:3:8 | IR: main | int main(int, char**) |

‎cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/ir_gvn.expected‎

Lines changed: 55 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -336,11 +336,12 @@ test.cpp:
336336
# 46| m0_46(int) = Store : &:r0_45, r0_44
337337
# 46| valnum = r0_40
338338
# 47| v0_47(void) = NoOp :
339-
# 39| r0_48(glval<int>) = VariableAddress[#return] :
339+
# 39| v0_48(void) = ReturnIndirection : &:r0_9, ~m0_32
340+
# 39| r0_49(glval<int>) = VariableAddress[#return] :
340341
# 39| valnum = unique
341-
# 39| v0_49(void) = ReturnValue : &:r0_48
342-
# 39| v0_50(void) = UnmodeledUse : mu*
343-
# 39| v0_51(void) = ExitFunction :
342+
# 39| v0_50(void) = ReturnValue : &:r0_49
343+
# 39| v0_51(void) = UnmodeledUse : mu*
344+
# 39| v0_52(void) = ExitFunction :
344345

345346
# 49| unsigned int my_strspn(char const*, char const*)
346347
# 49| Block 0
@@ -510,11 +511,13 @@ test.cpp:
510511
# 65| valnum = m1_0
511512
# 65| m9_4(unsigned int) = Store : &:r9_1, r9_3
512513
# 65| valnum = m1_0
513-
# 49| r9_5(glval<unsigned int>) = VariableAddress[#return] :
514+
# 49| v9_5(void) = ReturnIndirection : &:r0_5, ~m0_12
515+
# 49| v9_6(void) = ReturnIndirection : &:r0_10, ~m0_12
516+
# 49| r9_7(glval<unsigned int>) = VariableAddress[#return] :
514517
# 49| valnum = r9_1
515-
# 49| v9_6(void) = ReturnValue : &:r9_5, m9_4
516-
# 49| v9_7(void) = UnmodeledUse : mu*
517-
# 49| v9_8(void) = ExitFunction :
518+
# 49| v9_8(void) = ReturnValue : &:r9_7, m9_4
519+
# 49| v9_9(void) = UnmodeledUse : mu*
520+
# 49| v9_10(void) = ExitFunction :
518521

519522
# 75| void test04(two_values*)
520523
# 75| Block 0
@@ -599,10 +602,13 @@ test.cpp:
599602
#-----| Goto -> Block 2
600603

601604
# 82| Block 2
602-
# 82| v2_0(void) = NoOp :
603-
# 75| v2_1(void) = ReturnVoid :
604-
# 75| v2_2(void) = UnmodeledUse : mu*
605-
# 75| v2_3(void) = ExitFunction :
605+
# 82| m2_0(unknown) = Phi : from 0:~m0_12, from 1:~m1_3
606+
# 82| valnum = unique
607+
# 82| v2_1(void) = NoOp :
608+
# 75| v2_2(void) = ReturnIndirection : &:r0_5, ~m2_0
609+
# 75| v2_3(void) = ReturnVoid :
610+
# 75| v2_4(void) = UnmodeledUse : mu*
611+
# 75| v2_5(void) = ExitFunction :
606612

607613
# 84| void test05(int, int, void*)
608614
# 84| Block 0
@@ -642,46 +648,47 @@ test.cpp:
642648
# 88| r0_17(bool) = CompareNE : r0_15, r0_16
643649
# 88| valnum = unique
644650
# 88| v0_18(void) = ConditionalBranch : r0_17
645-
#-----| False -> Block 2
646-
#-----| True -> Block 1
651+
#-----| False -> Block 3
652+
#-----| True -> Block 2
647653

648654
# 88| Block 1
649-
# 88| r1_0(glval<int>) = VariableAddress[x] :
655+
# 88| m1_0(int) = Phi : from 2:m2_3, from 3:m3_3
656+
# 88| valnum = m1_0
657+
# 88| r1_1(glval<int>) = VariableAddress[#temp88:7] :
658+
# 88| valnum = r1_1
659+
# 88| r1_2(int) = Load : &:r1_1, m1_0
660+
# 88| valnum = m1_0
661+
# 88| r1_3(glval<int>) = VariableAddress[v] :
662+
# 88| valnum = r0_12
663+
# 88| m1_4(int) = Store : &:r1_3, r1_2
664+
# 88| valnum = m1_0
665+
# 89| v1_5(void) = NoOp :
666+
# 84| v1_6(void) = ReturnIndirection : &:r0_9, ~m0_11
667+
# 84| v1_7(void) = ReturnVoid :
668+
# 84| v1_8(void) = UnmodeledUse : mu*
669+
# 84| v1_9(void) = ExitFunction :
670+
671+
# 88| Block 2
672+
# 88| r2_0(glval<int>) = VariableAddress[x] :
650673
# 88| valnum = r0_3
651-
# 88| r1_1(int) = Load : &:r1_0, m0_4
674+
# 88| r2_1(int) = Load : &:r2_0, m0_4
652675
# 88| valnum = m0_4
653-
# 88| r1_2(glval<int>) = VariableAddress[#temp88:7] :
654-
# 88| valnum = r1_2
655-
# 88| m1_3(int) = Store : &:r1_2, r1_1
676+
# 88| r2_2(glval<int>) = VariableAddress[#temp88:7] :
677+
# 88| valnum = r1_1
678+
# 88| m2_3(int) = Store : &:r2_2, r2_1
656679
# 88| valnum = m0_4
657-
#-----| Goto -> Block 3
680+
#-----| Goto -> Block 1
658681

659-
# 88| Block 2
660-
# 88| r2_0(glval<int>) = VariableAddress[y] :
682+
# 88| Block 3
683+
# 88| r3_0(glval<int>) = VariableAddress[y] :
661684
# 88| valnum = r0_5
662-
# 88| r2_1(int) = Load : &:r2_0, m0_6
685+
# 88| r3_1(int) = Load : &:r3_0, m0_6
663686
# 88| valnum = m0_6
664-
# 88| r2_2(glval<int>) = VariableAddress[#temp88:7] :
665-
# 88| valnum = r1_2
666-
# 88| m2_3(int) = Store : &:r2_2, r2_1
687+
# 88| r3_2(glval<int>) = VariableAddress[#temp88:7] :
688+
# 88| valnum = r1_1
689+
# 88| m3_3(int) = Store : &:r3_2, r3_1
667690
# 88| valnum = m0_6
668-
#-----| Goto -> Block 3
669-
670-
# 88| Block 3
671-
# 88| m3_0(int) = Phi : from 1:m1_3, from 2:m2_3
672-
# 88| valnum = m3_0
673-
# 88| r3_1(glval<int>) = VariableAddress[#temp88:7] :
674-
# 88| valnum = r1_2
675-
# 88| r3_2(int) = Load : &:r3_1, m3_0
676-
# 88| valnum = m3_0
677-
# 88| r3_3(glval<int>) = VariableAddress[v] :
678-
# 88| valnum = r0_12
679-
# 88| m3_4(int) = Store : &:r3_3, r3_2
680-
# 88| valnum = m3_0
681-
# 89| v3_5(void) = NoOp :
682-
# 84| v3_6(void) = ReturnVoid :
683-
# 84| v3_7(void) = UnmodeledUse : mu*
684-
# 84| v3_8(void) = ExitFunction :
691+
#-----| Goto -> Block 1
685692

686693
# 91| int regression_test00()
687694
# 91| Block 0
@@ -775,11 +782,12 @@ test.cpp:
775782
# 109| valnum = r0_24
776783
# 109| m0_29(int) = Store : &:r0_26, r0_28
777784
# 109| valnum = r0_24
778-
# 104| r0_30(glval<int>) = VariableAddress[#return] :
785+
# 104| v0_30(void) = ReturnIndirection : &:r0_5, ~m0_7
786+
# 104| r0_31(glval<int>) = VariableAddress[#return] :
779787
# 104| valnum = r0_26
780-
# 104| v0_31(void) = ReturnValue : &:r0_30, m0_29
781-
# 104| v0_32(void) = UnmodeledUse : mu*
782-
# 104| v0_33(void) = ExitFunction :
788+
# 104| v0_32(void) = ReturnValue : &:r0_31, m0_29
789+
# 104| v0_33(void) = UnmodeledUse : mu*
790+
# 104| v0_34(void) = ExitFunction :
783791

784792
# 112| void test06()
785793
# 112| Block 0

‎csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ private newtype TOpcode =
99
TExitFunction() or
1010
TReturnValue() or
1111
TReturnVoid() or
12+
TReturnIndirection() or
1213
TCopyValue() or
1314
TLoad() or
1415
TStore() or
@@ -202,6 +203,10 @@ module Opcode {
202203
final override string toString() { result = "ReturnVoid" }
203204
}
204205

206+
class ReturnIndirection extends MemoryAccessOpcode, TReturnIndirection {
207+
final override string toString() { result = "ReturnIndirection" }
208+
}
209+
205210
class CopyValue extends UnaryOpcode, CopyOpcode, TCopyValue {
206211
final override string toString() { result = "CopyValue" }
207212
}

‎csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ module InstructionSanity {
4949
(
5050
opcode instanceof ReadSideEffectOpcode or
5151
opcode instanceof Opcode::InlineAsm or
52-
opcode instanceof Opcode::CallSideEffect
52+
opcode instanceof Opcode::CallSideEffect or
53+
opcode instanceof Opcode::ReturnIndirection
5354
) and
5455
tag instanceof SideEffectOperandTag
5556
)
@@ -743,6 +744,18 @@ class ReturnValueInstruction extends ReturnInstruction {
743744
final Instruction getReturnValue() { result = getReturnValueOperand().getDef() }
744745
}
745746

747+
class ReturnIndirectionInstruction extends Instruction {
748+
ReturnIndirectionInstruction() { getOpcode() instanceof Opcode::ReturnIndirection }
749+
750+
final SideEffectOperand getSideEffectOperand() { result = getAnOperand() }
751+
752+
final Instruction getSideEffect() { result = getSideEffectOperand().getDef() }
753+
754+
final AddressOperand getSourceAddressOperand() { result = getAnOperand() }
755+
756+
final Instruction getSourceAddress() { result = getSourceAddressOperand().getDef() }
757+
}
758+
746759
class CopyInstruction extends Instruction {
747760
CopyInstruction() { getOpcode() instanceof CopyOpcode }
748761

0 commit comments

Comments
 (0)