Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d03a4f8

Browse files
author
Dave Bartolomeo
committed
C++/C#: Add AliasedUse instruction to all functions
This new instruction is the dual of the existing `AliasedDefinition` instruction. Whereas that instruction defines the contents of aliased memory before the function was called, `AliasedUse` represents the potential use of all aliased memory after the function returns. This ensures that writes to aliased memory do not appear "dead", even if there are no further reads from aliased memory within the function itself.
1 parent 219fcb7 commit d03a4f8

20 files changed

Lines changed: 315 additions & 186 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ private newtype TOpcode =
5757
TUnmodeledDefinition() or
5858
TUnmodeledUse() or
5959
TAliasedDefinition() or
60+
TAliasedUse() or
6061
TPhi() or
6162
TBuiltIn() or
6263
TVarArgsStart() or
@@ -393,6 +394,10 @@ module Opcode {
393394
final override string toString() { result = "AliasedDefinition" }
394395
}
395396

397+
class AliasedUse extends Opcode, TAliasedUse {
398+
final override string toString() { result = "AliasedUse" }
399+
}
400+
396401
class Phi extends Opcode, TPhi {
397402
final override string toString() { result = "Phi" }
398403
}

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ module InstructionSanity {
4949
(
5050
opcode instanceof ReadSideEffectOpcode or
5151
opcode instanceof Opcode::InlineAsm or
52-
opcode instanceof Opcode::CallSideEffect
52+
opcode instanceof Opcode::CallSideEffect or
53+
opcode instanceof Opcode::AliasedUse
5354
) and
5455
tag instanceof SideEffectOperandTag
5556
)
@@ -260,6 +261,7 @@ module InstructionSanity {
260261
) {
261262
exists(IRBlock useBlock, int useIndex, Instruction defInstr, IRBlock defBlock, int defIndex |
262263
not useOperand.getUse() instanceof UnmodeledUseInstruction and
264+
not defInstr instanceof UnmodeledDefinitionInstruction and
263265
pointOfEvaluation(useOperand, useBlock, useIndex) and
264266
defInstr = useOperand.getAnyDef() and
265267
(
@@ -1423,6 +1425,13 @@ class AliasedDefinitionInstruction extends Instruction {
14231425
final override MemoryAccessKind getResultMemoryAccess() { result instanceof EscapedMemoryAccess }
14241426
}
14251427

1428+
/**
1429+
* An instruction that consumes all escaped memory on exit from the function.
1430+
*/
1431+
class AliasedUseInstruction extends Instruction {
1432+
AliasedUseInstruction() { getOpcode() instanceof Opcode::AliasedUse }
1433+
}
1434+
14261435
class UnmodeledUseInstruction extends Instruction {
14271436
UnmodeledUseInstruction() { getOpcode() instanceof Opcode::UnmodeledUse }
14281437

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,9 @@ class SideEffectOperand extends TypedOperand {
388388
}
389389

390390
override MemoryAccessKind getMemoryAccess() {
391+
useInstr instanceof AliasedUseInstruction and
392+
result instanceof EscapedMayMemoryAccess
393+
or
391394
useInstr instanceof CallSideEffectInstruction and
392395
result instanceof EscapedMayMemoryAccess
393396
or

‎cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ module InstructionSanity {
4949
(
5050
opcode instanceof ReadSideEffectOpcode or
5151
opcode instanceof Opcode::InlineAsm or
52-
opcode instanceof Opcode::CallSideEffect
52+
opcode instanceof Opcode::CallSideEffect or
53+
opcode instanceof Opcode::AliasedUse
5354
) and
5455
tag instanceof SideEffectOperandTag
5556
)
@@ -260,6 +261,7 @@ module InstructionSanity {
260261
) {
261262
exists(IRBlock useBlock, int useIndex, Instruction defInstr, IRBlock defBlock, int defIndex |
262263
not useOperand.getUse() instanceof UnmodeledUseInstruction and
264+
not defInstr instanceof UnmodeledDefinitionInstruction and
263265
pointOfEvaluation(useOperand, useBlock, useIndex) and
264266
defInstr = useOperand.getAnyDef() and
265267
(
@@ -1423,6 +1425,13 @@ class AliasedDefinitionInstruction extends Instruction {
14231425
final override MemoryAccessKind getResultMemoryAccess() { result instanceof EscapedMemoryAccess }
14241426
}
14251427

1428+
/**
1429+
* An instruction that consumes all escaped memory on exit from the function.
1430+
*/
1431+
class AliasedUseInstruction extends Instruction {
1432+
AliasedUseInstruction() { getOpcode() instanceof Opcode::AliasedUse }
1433+
}
1434+
14261435
class UnmodeledUseInstruction extends Instruction {
14271436
UnmodeledUseInstruction() { getOpcode() instanceof Opcode::UnmodeledUse }
14281437

‎cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,9 @@ class SideEffectOperand extends TypedOperand {
388388
}
389389

390390
override MemoryAccessKind getMemoryAccess() {
391+
useInstr instanceof AliasedUseInstruction and
392+
result instanceof EscapedMayMemoryAccess
393+
or
391394
useInstr instanceof CallSideEffectInstruction and
392395
result instanceof EscapedMayMemoryAccess
393396
or

‎cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ newtype TInstructionTag =
2626
UnmodeledDefinitionTag() or
2727
UnmodeledUseTag() or
2828
AliasedDefinitionTag() or
29+
AliasedUseTag() or
2930
SwitchBranchTag() or
3031
CallTargetTag() or
3132
CallTag() or
@@ -118,6 +119,8 @@ string getInstructionTagId(TInstructionTag tag) {
118119
or
119120
tag = AliasedDefinitionTag() and result = "AliasedDef"
120121
or
122+
tag = AliasedUseTag() and result = "AliasedUse"
123+
or
121124
tag = SwitchBranchTag() and result = "SwitchBranch"
122125
or
123126
tag = CallTargetTag() and result = "CallTarget"

‎cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,9 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
9595
result = getInstruction(UnmodeledUseTag())
9696
or
9797
tag = UnmodeledUseTag() and
98+
result = getInstruction(AliasedUseTag())
99+
or
100+
tag = AliasedUseTag() and
98101
result = getInstruction(ExitFunctionTag())
99102
)
100103
}
@@ -176,6 +179,11 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
176179
resultType instanceof VoidType and
177180
isGLValue = false
178181
or
182+
tag = AliasedUseTag() and
183+
opcode instanceof Opcode::AliasedUse and
184+
resultType instanceof VoidType and
185+
isGLValue = false
186+
or
179187
tag = ExitFunctionTag() and
180188
opcode instanceof Opcode::ExitFunction and
181189
resultType instanceof VoidType and
@@ -197,6 +205,10 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
197205
operandTag instanceof UnmodeledUseOperandTag and
198206
result = getUnmodeledDefinitionInstruction()
199207
or
208+
tag = AliasedUseTag() and
209+
operandTag instanceof SideEffectOperandTag and
210+
result = getUnmodeledDefinitionInstruction()
211+
or
200212
tag = ReturnTag() and
201213
not getReturnType() instanceof VoidType and
202214
(
@@ -213,6 +225,10 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
213225
not getReturnType() instanceof VoidType and
214226
operandTag instanceof LoadOperandTag and
215227
result = getReturnType()
228+
or
229+
tag = AliasedUseTag() and
230+
operandTag instanceof SideEffectOperandTag and
231+
result instanceof UnknownType
216232
}
217233

218234
final override IRVariable getInstructionVariable(InstructionTag tag) {

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ module InstructionSanity {
4949
(
5050
opcode instanceof ReadSideEffectOpcode or
5151
opcode instanceof Opcode::InlineAsm or
52-
opcode instanceof Opcode::CallSideEffect
52+
opcode instanceof Opcode::CallSideEffect or
53+
opcode instanceof Opcode::AliasedUse
5354
) and
5455
tag instanceof SideEffectOperandTag
5556
)
@@ -260,6 +261,7 @@ module InstructionSanity {
260261
) {
261262
exists(IRBlock useBlock, int useIndex, Instruction defInstr, IRBlock defBlock, int defIndex |
262263
not useOperand.getUse() instanceof UnmodeledUseInstruction and
264+
not defInstr instanceof UnmodeledDefinitionInstruction and
263265
pointOfEvaluation(useOperand, useBlock, useIndex) and
264266
defInstr = useOperand.getAnyDef() and
265267
(
@@ -1423,6 +1425,13 @@ class AliasedDefinitionInstruction extends Instruction {
14231425
final override MemoryAccessKind getResultMemoryAccess() { result instanceof EscapedMemoryAccess }
14241426
}
14251427

1428+
/**
1429+
* An instruction that consumes all escaped memory on exit from the function.
1430+
*/
1431+
class AliasedUseInstruction extends Instruction {
1432+
AliasedUseInstruction() { getOpcode() instanceof Opcode::AliasedUse }
1433+
}
1434+
14261435
class UnmodeledUseInstruction extends Instruction {
14271436
UnmodeledUseInstruction() { getOpcode() instanceof Opcode::UnmodeledUse }
14281437

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,6 +388,9 @@ class SideEffectOperand extends TypedOperand {
388388
}
389389

390390
override MemoryAccessKind getMemoryAccess() {
391+
useInstr instanceof AliasedUseInstruction and
392+
result instanceof EscapedMayMemoryAccess
393+
or
391394
useInstr instanceof CallSideEffectInstruction and
392395
result instanceof EscapedMayMemoryAccess
393396
or

0 commit comments

Comments
 (0)