C++: Per-variable overrides

jbj · jbj · commit 8065bf15ad86 · 2020-09-22T15:53:22.000+02:00
Without these changes, there was no way to tell which variables were
overridden by a given instance of `SimpleRangeAnalysisDefinition`. All
four overrides are needed because they fit into different mutual
recursions of the `SimpleRangeAnalysis` implementation.
diff --git a/cpp/ql/src/experimental/semmle/code/cpp/models/interfaces/SimpleRangeAnalysisDefinition.qll b/cpp/ql/src/experimental/semmle/code/cpp/models/interfaces/SimpleRangeAnalysisDefinition.qll
@@ -10,25 +10,54 @@ import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
 /**
  * EXPERIMENTAL: The API of this class may change without notice.
  *
- * An SSA definition for which a range can be deduced. Extend this class to add
- * functionality to the range analysis library.
+ * An SSA definition for which a range can be deduced. As with
+ * `RangeSsaDefinition` and `SsaDefinition`, instances of this class
+ * correspond to points in the program where one or more variables are defined
+ * or have their value constrained in some way.
+ *
+ * Extend this class to add functionality to the range analysis library.
  */
 abstract class SimpleRangeAnalysisDefinition extends RangeSsaDefinition {
-    /**
-   * Gets the lower bound of the defomotopn.
+  /**
+   * Holds if this `SimpleRangeAnalysisDefinition` adds range information for
+   * `v`. Because a `SimpleRangeAnalysisDefinition` is just a point in the
+   * program, it's possible that more than one variable might be defined at
+   * this point. This predicate clarifies which variable(s) should get range
+   * information from `this`.
+   *
+   * This predicate **must be overridden** to hold for any `v` that can show
+   * up in the other members of `SimpleRangeAnalysisDefinition`. Conversely,
+   * the other members **must be accurate** for any `v` in this predicate.
+   */
+  abstract predicate hasRangeInformationFor(StackVariable v);
+
+  /**
+   * Holds if `(this, v)` depends on the range of the unconverted expression
+   * `e`. This information is used to inform the range analysis about cyclic
+   * dependencies. Without this information, range analysis might work for
+   * simple cases but will go into infinite loops on complex code.
+   *
+   * For example, when modelling the definition by reference in a call to an
+   * overloaded `operator=`, written as `v = e`, the definition of `(this, v)`
+   * depends on `e`.
+   */
+  abstract predicate dependsOnExpr(StackVariable v, Expr e);
+
+  /**
+   * Gets the lower bound of the variable `v` defined by this definition.
    *
    * Implementations of this predicate should use
    * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
-   * recursive calls to get the bounds of their children.
+   * recursive calls to get the bounds of their dependencies.
    */
-  abstract float getLowerBounds();
+  abstract float getLowerBounds(StackVariable v);
 
   /**
-   * Gets the upper bound of the definition.
+   * Gets the upper bound of the variable `v` defined by this definition.
    *
    * Implementations of this predicate should use
    * `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
-   * recursive calls to get the bounds of their children.
+   * recursive calls to get the bounds of their dependencies.
    */
-  abstract float getUpperBounds();
-}
+  abstract float getUpperBounds(StackVariable v);
+}
diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -336,6 +336,11 @@ private predicate defDependsOnDef(
   or
   // Phi nodes.
   phiDependsOnDef(def, v, srcDef, srcVar)
+  or
+  // Extensions
+  exists(Expr expr | def.(SimpleRangeAnalysisDefinition).dependsOnExpr(v, expr) |
+    exprDependsOnDef(expr, srcDef, srcVar)
+  )
 }
 
 /**
@@ -495,7 +500,7 @@ private predicate analyzableDef(RangeSsaDefinition def, StackVariable v) {
   phiDependsOnDef(def, v, _, _)
   or
   // A modeled def for range analysis
-  def.(SimpleRangeAnalysisDefinition).getAVariable() =v
+  def.(SimpleRangeAnalysisDefinition).hasRangeInformationFor(v)
 }
 
 /**
@@ -1220,7 +1225,7 @@ private float getDefLowerBoundsImpl(RangeSsaDefinition def, StackVariable v) {
   result = getPhiLowerBounds(v, def)
   or
   // A modeled def for range analysis
-  result = def.(SimpleRangeAnalysisDefinition).getLowerBounds()
+  result = def.(SimpleRangeAnalysisDefinition).getLowerBounds(v)
   or
   // Unanalyzable definitions.
   unanalyzableDefBounds(def, v, result, _)
@@ -1256,7 +1261,7 @@ private float getDefUpperBoundsImpl(RangeSsaDefinition def, StackVariable v) {
   result = getPhiUpperBounds(v, def)
   or
   // A modeled def for range analysis
-  result = def.(SimpleRangeAnalysisDefinition).getUpperBounds()
+  result = def.(SimpleRangeAnalysisDefinition).getUpperBounds(v)
   or
   // Unanalyzable definitions.
   unanalyzableDefBounds(def, v, _, result)
