Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 6d09a9b

Browse files
jbjjbj
committed
C++: Enable range analysis for irreducible CFGs
This adds one new test result (`i >= 0` on line 130).
1 parent bb7369e commit 6d09a9b

3 files changed

Lines changed: 40 additions & 58 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeAnalysis.qll‎

Lines changed: 39 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -559,47 +559,44 @@ private predicate boundedCastExpr(
559559
private predicate boundedInstruction(
560560
Instruction i, Bound b, int delta, boolean upper, boolean fromBackEdge, int origdelta, Reason reason
561561
) {
562-
isReducibleCFG(i.getFunction()) and
563-
(
564-
i instanceof PhiInstruction and
565-
forex(PhiOperand op | op = i.getAnOperand() |
566-
boundedPhiCandValidForEdge(i, b, delta, upper, fromBackEdge, origdelta, reason, op)
567-
)
568-
or
569-
i = b.getInstruction(delta) and
570-
(upper = true or upper = false) and
571-
fromBackEdge = false and
572-
origdelta = delta and
573-
reason = TNoReason()
574-
or
575-
exists(Operand mid, int d1, int d2 |
576-
boundFlowStep(i, mid, d1, upper) and
577-
boundedNonPhiOperand(mid, b, d2, upper, fromBackEdge, origdelta, reason) and
578-
delta = d1 + d2 and
579-
not exists(getValue(getConstantValue(i)))
580-
)
581-
or
582-
exists(Operand mid, int factor, int d |
583-
boundFlowStepMul(i, mid, factor) and
584-
boundedNonPhiOperand(mid, b, d, upper, fromBackEdge, origdelta, reason) and
585-
b instanceof ZeroBound and
586-
delta = d*factor and
587-
not exists(getValue(getConstantValue(i)))
588-
)
589-
or
590-
exists(Operand mid, int factor, int d |
591-
boundFlowStepDiv(i, mid, factor) and
592-
boundedNonPhiOperand(mid, b, d, upper, fromBackEdge, origdelta, reason) and
593-
d >= 0 and
594-
b instanceof ZeroBound and
595-
delta = d / factor and
596-
not exists(getValue(getConstantValue(i)))
597-
)
598-
or
599-
exists(NarrowingCastInstruction cast |
600-
cast = i and
601-
safeNarrowingCast(cast, upper.booleanNot()) and
602-
boundedCastExpr(cast, b, delta, upper, fromBackEdge, origdelta, reason)
603-
)
562+
i instanceof PhiInstruction and
563+
forex(PhiOperand op | op = i.getAnOperand() |
564+
boundedPhiCandValidForEdge(i, b, delta, upper, fromBackEdge, origdelta, reason, op)
565+
)
566+
or
567+
i = b.getInstruction(delta) and
568+
(upper = true or upper = false) and
569+
fromBackEdge = false and
570+
origdelta = delta and
571+
reason = TNoReason()
572+
or
573+
exists(Operand mid, int d1, int d2 |
574+
boundFlowStep(i, mid, d1, upper) and
575+
boundedNonPhiOperand(mid, b, d2, upper, fromBackEdge, origdelta, reason) and
576+
delta = d1 + d2 and
577+
not exists(getValue(getConstantValue(i)))
578+
)
579+
or
580+
exists(Operand mid, int factor, int d |
581+
boundFlowStepMul(i, mid, factor) and
582+
boundedNonPhiOperand(mid, b, d, upper, fromBackEdge, origdelta, reason) and
583+
b instanceof ZeroBound and
584+
delta = d*factor and
585+
not exists(getValue(getConstantValue(i)))
586+
)
587+
or
588+
exists(Operand mid, int factor, int d |
589+
boundFlowStepDiv(i, mid, factor) and
590+
boundedNonPhiOperand(mid, b, d, upper, fromBackEdge, origdelta, reason) and
591+
d >= 0 and
592+
b instanceof ZeroBound and
593+
delta = d / factor and
594+
not exists(getValue(getConstantValue(i)))
595+
)
596+
or
597+
exists(NarrowingCastInstruction cast |
598+
cast = i and
599+
safeNarrowingCast(cast, upper.booleanNot()) and
600+
boundedCastExpr(cast, b, delta, upper, fromBackEdge, origdelta, reason)
604601
)
605602
}

‎cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeUtils.qll‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -63,22 +63,6 @@ predicate valueFlowStep(Instruction i, Operand op, int delta) {
6363
)
6464
}
6565

66-
predicate isReducibleCFG(Function f) {
67-
not exists(LabelStmt l, GotoStmt goto |
68-
goto.getTarget() = l and
69-
l.getLocation().isBefore(goto.getLocation()) and
70-
l.getEnclosingFunction() = f
71-
) and
72-
not exists(LabelStmt ls, Loop l |
73-
ls.getParent*() = l and
74-
l.getEnclosingFunction() = f
75-
) and
76-
not exists(SwitchCase cs |
77-
cs.getSwitchStmt().getStmt() != cs.getParentStmt() and
78-
cs.getEnclosingFunction() = f
79-
)
80-
}
81-
8266
predicate backEdge(PhiInstruction phi, PhiOperand op) {
8367
phi.getAnOperand() = op and
8468
phi.getBlock() = op.getPredecessorBlock().getBackEdgeSuccessor(_)

‎cpp/ql/test/library-tests/rangeanalysis/rangeanalysis/RangeAnalysis.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
| test.cpp:100:10:100:10 | Load: x | file://:0:0:0:0 | 0 | 1 | true | CompareLE: ... <= ... | test.cpp:99:7:99:12 | test.cpp:99:7:99:12 |
3737
| test.cpp:102:10:102:10 | Load: x | file://:0:0:0:0 | 0 | 2 | false | CompareLE: ... <= ... | test.cpp:99:7:99:12 | test.cpp:99:7:99:12 |
3838
| test.cpp:107:5:107:10 | Phi: test10 | test.cpp:114:3:114:6 | Phi: call to sink | -1 | true | CompareLT: ... < ... | test.cpp:115:18:115:22 | test.cpp:115:18:115:22 |
39+
| test.cpp:130:10:130:10 | Load: i | file://:0:0:0:0 | 0 | 0 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
3940
| test.cpp:140:10:140:10 | Store: i | file://:0:0:0:0 | 0 | 1 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |
4041
| test.cpp:140:10:140:10 | Store: i | test.cpp:135:16:135:16 | InitializeParameter: x | 0 | false | CompareLT: ... < ... | test.cpp:139:11:139:15 | test.cpp:139:11:139:15 |
4142
| test.cpp:140:10:140:10 | Store: i | test.cpp:138:5:138:5 | Phi: i | 1 | false | NoReason | file://:0:0:0:0 | file://:0:0:0:0 |

0 commit comments

Comments
 (0)