@@ -63,6 +63,14 @@ class Node extends TIRDataFlowNode {
6363 */
6464 Variable asVariable ( ) { result = this .( VariableNode ) .getVariable ( ) }
6565
66+ /**
67+ * Gets the expression that is partially defined by this node, if any.
68+ *
69+ * Partial definitions are created for field stores (`x.y = taint();` is a partial
70+ * definition of `x`), and for calls that may change the value of an object (so
71+ * `x.set(taint())` is a partial definition of `x`, and `transfer(&x, taint())` is
72+ * a partial definition of `&x`).
73+ */
6674 Expr asPartialDefinition ( ) {
6775 result = this .( PartialDefinitionNode ) .getInstruction ( ) .getUnconvertedResultExpression ( )
6876 }
@@ -100,6 +108,9 @@ class Node extends TIRDataFlowNode {
100108 string toString ( ) { none ( ) } // overridden by subclasses
101109}
102110
111+ /**
112+ * An instruction, viewed as a node in a data flow graph.
113+ */
103114class InstructionNode extends Node , TInstructionNode {
104115 Instruction instr ;
105116
@@ -146,12 +157,16 @@ class ExprNode extends InstructionNode {
146157 override string toString ( ) { result = this .asConvertedExpr ( ) .toString ( ) }
147158}
148159
160+ /**
161+ * A node representing a `Parameter`. This includes both explicit parameters such
162+ * as `x` in `f(x)` and implicit parameters such as `this` in `x.f()`
163+ */
149164class ParameterNode extends InstructionNode {
150165 /**
151166 * Holds if this node is the parameter of `c` at the specified (zero-based)
152167 * position. The implicit `this` parameter is considered to have index `-1`.
153168 */
154- predicate isParameterOf ( Function f , int i ) { none ( ) }
169+ predicate isParameterOf ( Function f , int i ) { none ( ) } // overriden by subclasses
155170}
156171
157172/**
@@ -163,6 +178,7 @@ private class ExplicitParameterNode extends ParameterNode {
163178
164179 override predicate isParameterOf ( Function f , int i ) { f .getParameter ( i ) = instr .getParameter ( ) }
165180
181+ /** Gets the parameter corresponding to this node. */
166182 Parameter getParameter ( ) { result = instr .getParameter ( ) }
167183
168184 override string toString ( ) { result = instr .getParameter ( ) .toString ( ) }
@@ -216,7 +232,25 @@ abstract class PostUpdateNode extends InstructionNode {
216232 abstract Node getPreUpdateNode ( ) ;
217233}
218234
219- abstract private class PartialDefinitionNode extends PostUpdateNode , TInstructionNode {
235+ /**
236+ * The base class for nodes that perform "partial definitions".
237+ *
238+ * In contrast to a normal "definition", which provides a new value for
239+ * something, a partial definition is an expression that may affect a
240+ * value, but does not necessarily replace it entirely. For example:
241+ * ```
242+ * x.y = 1; // a partial definition of the object `x`.
243+ * x.y.z = 1; // a partial definition of the object `x.y`.
244+ * x.setY(1); // a partial definition of the object `x`.
245+ * setY(&x); // a partial definition of the object `x`.
246+ * ```
247+ */
248+ abstract class PartialDefinitionNode extends PostUpdateNode , TInstructionNode {
249+ /**
250+ * Gets the instruction that partially defines the object. This includes
251+ * both the instruction that partially defines the object, and the chi
252+ * instruction that links up the partial definition to the object.
253+ */
220254 final Instruction getInstructionOrChi ( ) {
221255 exists ( ChiInstruction chi |
222256 not chi .isResultConflated ( ) and
@@ -228,7 +262,7 @@ abstract private class PartialDefinitionNode extends PostUpdateNode, TInstructio
228262 }
229263}
230264
231- class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
265+ private class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
232266 override StoreInstruction instr ;
233267 FieldAddressInstruction field ;
234268
@@ -310,6 +344,10 @@ class VariableNode extends Node, TVariableNode {
310344 */
311345InstructionNode instructionNode ( Instruction instr ) { result .getInstruction ( ) = instr }
312346
347+ /**
348+ * Gets the `Node` corresponding to a definition by reference of the variable
349+ * that is passed as `argument` of a call.
350+ */
313351DefinitionByReferenceNode definitionByReferenceNode ( Expr e ) { result .getArgument ( ) = e }
314352
315353/**
0 commit comments