Merge pull request #414 from aschackmull/java/unreachable-ssa

yh-semmle · web-flow · commit 49fbc410a1c4 · 2018-11-07T18:30:46.000-05:00
Java: Don't construct nonsense SSA for unreachable code.
diff --git a/java/ql/src/semmle/code/java/dataflow/SSA.qll b/java/ql/src/semmle/code/java/dataflow/SSA.qll
@@ -225,7 +225,8 @@ private module SsaImpl {
   cached
   predicate certainVariableUpdate(TrackedVar v, ControlFlowNode n, BasicBlock b, int i) {
     exists(VariableUpdate a | a = n | getDestVar(a) = v) and
-    b.getNode(i) = n
+    b.getNode(i) = n and
+    hasDominanceInformation(b)
     or
     certainVariableUpdate(v.getQualifier(), n, b, i)
   }
@@ -559,7 +560,8 @@ private module SsaImpl {
   cached
   predicate uncertainVariableUpdate(TrackedVar v, ControlFlowNode n, BasicBlock b, int i) {
     exists(Call c | c = n | updatesNamedField(c, v, _)) and
-    b.getNode(i) = n
+    b.getNode(i) = n and
+    hasDominanceInformation(b)
     or
     uncertainVariableUpdate(v.getQualifier(), n, b, i)
   }
diff --git a/java/ql/src/semmle/code/java/dataflow/internal/BaseSSA.qll b/java/ql/src/semmle/code/java/dataflow/internal/BaseSSA.qll
@@ -72,7 +72,8 @@ private module SsaImpl {
   cached
   predicate variableUpdate(BaseSsaSourceVariable v, ControlFlowNode n, BasicBlock b, int i) {
     exists(VariableUpdate a | a = n | getDestVar(a) = v) and
-    b.getNode(i) = n
+    b.getNode(i) = n and
+    hasDominanceInformation(b)
   }
 
   /** Gets the definition point of a nested class in the parent scope. */

Original file line number	Diff line number	Diff line change
`@@ -72,7 +72,8 @@ private module SsaImpl {`
`72`	`72`	`cached`
`73`	`73`	`predicate variableUpdate(BaseSsaSourceVariable v, ControlFlowNode n, BasicBlock b, int i) {`
`74`	`74`	`exists(VariableUpdate a \| a = n \| getDestVar(a) = v) and`
`75`		`- b.getNode(i) = n`
	`75`	`+ b.getNode(i) = n and`
	`76`	`+ hasDominanceInformation(b)`
`76`	`77`	`}`
`77`	`78`
`78`	`79`	`/** Gets the definition point of a nested class in the parent scope. */`