Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 69155cb

Browse files
MathiasVPMathiasVP
authored
Merge pull request #11664 from jketema/alloca-in-loop-fix
C++: Fix `cpp/alloca-in-loop` regressions with use-use dataflow
2 parents b2091e8 + b10ed97 commit 69155cb

2 files changed

Lines changed: 21 additions & 18 deletions

File tree

‎cpp/ql/src/Likely Bugs/Memory Management/AllocaInLoop.ql‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,19 @@ class LoopWithAlloca extends Stmt {
185185
not this.conditionReachesWithoutUpdate(var, this.(Loop).getCondition())
186186
}
187187

188+
/**
189+
* Gets an expression associated with a dataflow node.
190+
*/
191+
private Expr getExpr(DataFlow::Node node) {
192+
result = node.asInstruction().getAst()
193+
or
194+
result = node.asOperand().getUse().getAst()
195+
or
196+
result = node.(DataFlow::RawIndirectInstruction).getInstruction().getAst()
197+
or
198+
result = node.(DataFlow::RawIndirectOperand).getOperand().getUse().getAst()
199+
}
200+
188201
/**
189202
* Gets a definition that may be the most recent definition of the
190203
* controlling variable `var` before this loop.
@@ -194,14 +207,10 @@ class LoopWithAlloca extends Stmt {
194207
va = var.getAnAccess() and
195208
this.conditionRequiresInequality(va, _, _) and
196209
DataFlow::localFlow(result, DataFlow::exprNode(va)) and
210+
// Phi nodes will be preceded by nodes that represent actual definitions
211+
not result instanceof DataFlow::SsaPhiNode and
197212
// A source is outside the loop if it's not inside the loop
198-
not exists(Expr e |
199-
e = result.asExpr()
200-
or
201-
e = result.asDefiningArgument()
202-
|
203-
this = getAnEnclosingLoopOfExpr(e)
204-
)
213+
not exists(Expr e | e = getExpr(result) | this = getAnEnclosingLoopOfExpr(e))
205214
)
206215
}
207216

@@ -211,7 +220,11 @@ class LoopWithAlloca extends Stmt {
211220
*/
212221
private int getAControllingVarInitialValue(Variable var, DataFlow::Node source) {
213222
source = this.getAPrecedingDef(var) and
214-
result = source.asExpr().getValue().toInt()
223+
(
224+
result = getExpr(source).getValue().toInt()
225+
or
226+
result = getExpr(source).(Assignment).getRValue().getValue().toInt()
227+
)
215228
}
216229

217230
/**

‎cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/AllocaInLoop.expected‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,12 @@
77
| AllocaInLoop1ms.cpp:79:19:79:25 | call to _alloca | Stack allocation is inside a $@ loop. | AllocaInLoop1ms.cpp:70:3:87:3 | for(...;...;...) ... | for(...;...;...) ... |
88
| AllocaInLoop2.c:39:30:39:35 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | AllocaInLoop2.c:29:5:48:19 | do (...) ... | do (...) ... |
99
| AllocaInLoop3.cpp:45:23:45:28 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | AllocaInLoop3.cpp:43:2:49:19 | do (...) ... | do (...) ... |
10-
| BoundedLoop.cpp:19:5:19:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:18:3:20:3 | for(...;...;...) ... | for(...;...;...) ... |
1110
| BoundedLoop.cpp:25:5:25:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:24:3:26:3 | for(...;...;...) ... | for(...;...;...) ... |
12-
| BoundedLoop.cpp:32:5:32:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:31:3:33:20 | do (...) ... | do (...) ... |
1311
| BoundedLoop.cpp:38:5:38:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:37:3:39:3 | for(...;...;...) ... | for(...;...;...) ... |
14-
| BoundedLoop.cpp:48:5:48:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:46:3:49:3 | while (...) ... | while (...) ... |
1512
| BoundedLoop.cpp:55:5:55:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:54:3:59:3 | while (...) ... | while (...) ... |
1613
| BoundedLoop.cpp:64:5:64:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:63:3:68:3 | for(...;...;...) ... | for(...;...;...) ... |
1714
| BoundedLoop.cpp:73:5:73:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:72:3:74:3 | for(...;...;...) ... | for(...;...;...) ... |
18-
| BoundedLoop.cpp:85:5:85:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:84:3:86:3 | for(...;...;...) ... | for(...;...;...) ... |
1915
| BoundedLoop.cpp:97:5:97:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:96:3:98:3 | for(...;...;...) ... | for(...;...;...) ... |
2016
| BoundedLoop.cpp:105:5:105:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:104:3:106:3 | for(...;...;...) ... | for(...;...;...) ... |
21-
| BoundedLoop.cpp:112:7:112:12 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:110:3:114:3 | for(...;...;...) ... | for(...;...;...) ... |
22-
| BoundedLoop.cpp:112:7:112:12 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:111:5:113:5 | for(...;...;...) ... | for(...;...;...) ... |
23-
| BoundedLoop.cpp:124:7:124:12 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:120:3:127:3 | for(...;...;...) ... | for(...;...;...) ... |
2417
| BoundedLoop.cpp:138:5:138:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:137:3:139:3 | for(...;...;...) ... | for(...;...;...) ... |
25-
| BoundedLoop.cpp:156:5:156:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:155:3:157:3 | for(...;...;...) ... | for(...;...;...) ... |
26-
| BoundedLoop.cpp:164:5:164:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:163:3:165:3 | while (...) ... | while (...) ... |
27-
| BoundedLoop.cpp:170:5:170:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:169:3:171:3 | for(...;...;...) ... | for(...;...;...) ... |
2818
| BoundedLoop.cpp:176:5:176:10 | call to __builtin_alloca | Stack allocation is inside a $@ loop. | BoundedLoop.cpp:175:3:177:3 | for(...;...;...) ... | for(...;...;...) ... |

0 commit comments

Comments
 (0)