C++: add isReachableFromFunctionEntry

Robert Marsh · Robert Marsh · commit cc97cf929721 · 2018-09-20T10:06:19.000-07:00
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/IRGuards.qll b/cpp/ql/src/semmle/code/cpp/controlflow/IRGuards.qll
@@ -310,7 +310,7 @@ class IRGuardCondition extends Instruction {
             succ.dominates(controlled) and
             forall(IRBlock pred
             | pred.getASuccessor() = succ
-            | pred = thisblock or succ.dominates(pred)))) // removed reachability condition - is that OK?
+            | pred = thisblock or succ.dominates(pred) or not pred.isReachableFromFunctionEntry())))
     }
 }
 
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll
@@ -89,4 +89,12 @@ class IRBlock extends TIRBlock {
     dominates(result.getAPredecessor()) and
     not strictlyDominates(result)
   }
+  
+  /**
+   * Holds if this block is reachable from the entry point of its function
+   */
+  final predicate isReachableFromFunctionEntry() {
+    this = getFunctionIR().getEntryBlock() or
+    getAPredecessor().isReachableFromFunctionEntry()
+  }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll
@@ -89,4 +89,12 @@ class IRBlock extends TIRBlock {
     dominates(result.getAPredecessor()) and
     not strictlyDominates(result)
   }
+  
+  /**
+   * Holds if this block is reachable from the entry point of its function
+   */
+  final predicate isReachableFromFunctionEntry() {
+    this = getFunctionIR().getEntryBlock() or
+    getAPredecessor().isReachableFromFunctionEntry()
+  }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll
@@ -89,4 +89,12 @@ class IRBlock extends TIRBlock {
     dominates(result.getAPredecessor()) and
     not strictlyDominates(result)
   }
+  
+  /**
+   * Holds if this block is reachable from the entry point of its function
+   */
+  final predicate isReachableFromFunctionEntry() {
+    this = getFunctionIR().getEntryBlock() or
+    getAPredecessor().isReachableFromFunctionEntry()
+  }
 }
diff --git a/cpp/ql/test/library-tests/controlflow/guards-ir/ASTGuardsControl.expected b/cpp/ql/test/library-tests/controlflow/guards-ir/ASTGuardsControl.expected
@@ -87,4 +87,5 @@
 | test.cpp:31:7:31:13 | ... == ... | false | 34 | 34 |
 | test.cpp:31:7:31:13 | ... == ... | true | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | true | 31 | 32 |
+| test.cpp:42:13:42:20 | call to getABool | false | 53 | 53 |
 | test.cpp:42:13:42:20 | call to getABool | true | 43 | 45 |
diff --git a/cpp/ql/test/library-tests/controlflow/guards-ir/IRGuardsControl.expected b/cpp/ql/test/library-tests/controlflow/guards-ir/IRGuardsControl.expected
@@ -82,4 +82,5 @@
 | test.cpp:31:7:31:13 | ... == ... | false | 34 | 34 |
 | test.cpp:31:7:31:13 | ... == ... | true | 30 | 30 |
 | test.cpp:31:7:31:13 | ... == ... | true | 32 | 32 |
+| test.cpp:42:13:42:20 | call to getABool | false | 53 | 53 |
 | test.cpp:42:13:42:20 | call to getABool | true | 44 | 44 |

Original file line number	Diff line number	Diff line change
`@@ -310,7 +310,7 @@ class IRGuardCondition extends Instruction {`
`310`	`310`	`succ.dominates(controlled) and`
`311`	`311`	`forall(IRBlock pred`
`312`	`312`	`\| pred.getASuccessor() = succ`
`313`		`- \| pred = thisblock or succ.dominates(pred)))) // removed reachability condition - is that OK?`
	`313`	`+ \| pred = thisblock or succ.dominates(pred) or not pred.isReachableFromFunctionEntry())))`
`314`	`314`	`}`
`315`	`315`	`}`
`316`	`316`
Original file line number	Diff line number	Diff line change
`@@ -89,4 +89,12 @@ class IRBlock extends TIRBlock {`
`89`	`89`	`dominates(result.getAPredecessor()) and`
`90`	`90`	`not strictlyDominates(result)`
`91`	`91`	`}`
	`92`	`+`
	`93`	`+ /**`
	`94`	`+ * Holds if this block is reachable from the entry point of its function`
	`95`	`+ */`
	`96`	`+ final predicate isReachableFromFunctionEntry() {`
	`97`	`+ this = getFunctionIR().getEntryBlock() or`
	`98`	`+ getAPredecessor().isReachableFromFunctionEntry()`
	`99`	`+ }`
`92`	`100`	`}`