|
| 1 | +/** |
| 2 | + * EXPERIMENTAL: The API of this module may change without notice. |
| 3 | + * |
| 4 | + * Provides a class for modeling `Expr`s with a restricted range. |
| 5 | + */ |
| 6 | + |
| 7 | +import cpp |
| 8 | +import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis |
| 9 | + |
| 10 | +/** |
| 11 | + * EXPERIMENTAL: The API of this class may change without notice. |
| 12 | + * |
| 13 | + * An expression for which a range can be deduced. Extend this class to add |
| 14 | + * functionality to the range analysis library. |
| 15 | + */ |
| 16 | +abstract class SimpleRangeAnalysisExpr extends Expr { |
| 17 | + /** |
| 18 | + * Gets the lower bound of the expression. |
| 19 | + * |
| 20 | + * Implementations of this predicate should use |
| 21 | + * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for |
| 22 | + * recursive calls to get the bounds of their children. |
| 23 | + */ |
| 24 | + abstract float getLowerBounds(); |
| 25 | + |
| 26 | + /** |
| 27 | + * Gets the upper bound of the expression. |
| 28 | + * |
| 29 | + * Implementations of this predicate should use |
| 30 | + * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for |
| 31 | + * recursive calls to get the bounds of their children. |
| 32 | + */ |
| 33 | + abstract float getUpperBounds(); |
| 34 | + |
| 35 | + /** |
| 36 | + * Holds if the range this expression depends on the definition `srcDef` for |
| 37 | + * StackVariable `srcVar`. |
| 38 | + * |
| 39 | + * Because this predicate cannot be recursive, most implementations should |
| 40 | + * override `dependsOnChild` instead. |
| 41 | + */ |
| 42 | + predicate dependsOnDef(RangeSsaDefinition srcDef, StackVariable srcVar) { none() } |
| 43 | + |
| 44 | + /** |
| 45 | + * Holds if this expression depends on the range of its unconverted |
| 46 | + * subexpression `child`. This information is used to inform the range |
| 47 | + * analysis about cyclic dependencies. Without this information, range |
| 48 | + * analysis might work for simple cases but will go into infinite loops on |
| 49 | + * complex code. |
| 50 | + * |
| 51 | + * For example, when modeling a function call whose return value depends on |
| 52 | + * all of its arguments, implement this predicate as |
| 53 | + * `child = this.getAnArgument()`. |
| 54 | + */ |
| 55 | + abstract predicate dependsOnChild(Expr child); |
| 56 | +} |
| 57 | + |
| 58 | +import SimpleRangeAnalysisInternal |
| 59 | + |
| 60 | +/** |
| 61 | + * This class exists to prevent the QL front end from emitting compile errors |
| 62 | + * inside `SimpleRangeAnalysis.qll` about certain conjuncts being empty |
| 63 | + * because the overrides of `SimpleRangeAnalysisExpr` that happen to be in |
| 64 | + * scope do not make use of every feature it offers. |
| 65 | + */ |
| 66 | +private class Empty extends SimpleRangeAnalysisExpr { |
| 67 | + Empty() { |
| 68 | + // This predicate is complicated enough that the QL type checker doesn't |
| 69 | + // see it as empty but simple enough that the optimizer should. |
| 70 | + this = this and none() |
| 71 | + } |
| 72 | + |
| 73 | + override float getLowerBounds() { none() } |
| 74 | + |
| 75 | + override float getUpperBounds() { none() } |
| 76 | + |
| 77 | + override predicate dependsOnChild(Expr child) { none() } |
| 78 | +} |
0 commit comments