Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit f30a42c

Browse files
hvitvedhvitved
committed
Data flow: Fix bad join-order in TPathNodeSink
Avoids a Cartesian product on nodes: ``` [2020-02-07 11:01:22] (432s) Tuple counts for dom#DataFlowImpl::TPathNodeSink#ff: 0 ~0% {2} r1 = JOIN DataFlowImpl::Configuration::isSource_dispred#ff AS L WITH DataFlowImpl::Configuration::isSink_dispred#ff AS R ON FIRST 2 OUTPUT R.<1>, R.<0> 101611 ~0% {2} r2 = SCAN DataFlowImpl::PathNodeMid#class#ffffff AS I OUTPUT I.<5>, I.<0> 3534537047 ~3% {3} r3 = JOIN r2 WITH DataFlowImpl::Configuration::isSink_dispred#ff AS R ON FIRST 1 OUTPUT r2.<1>, R.<1>, R.<0> 251 ~41% {3} r4 = JOIN r3 WITH project#DataFlowImpl::pathStep#fffff AS R ON FIRST 2 OUTPUT R.<2>, r3.<2>, r3.<1> 251 ~50% {2} r5 = JOIN r4 WITH DataFlowImpl::TNil#ff_1#join_rhs AS R ON FIRST 1 OUTPUT r4.<2>, r4.<1> 251 ~50% {2} r6 = r1 \/ r5 323 ~67% {3} r7 = JOIN r6 WITH DataFlowImpl::flow#ff AS R ON FIRST 1 OUTPUT r6.<1>, r6.<0>, R.<1> 288 ~58% {3} r8 = SELECT r7 ON r7.<2> >= r7.<0> 251 ~53% {3} r9 = SELECT r8 ON r8.<2> <= r8.<0> 251 ~50% {2} r10 = SCAN r9 OUTPUT r9.<1>, r9.<0> ```
1 parent b3af3ad commit f30a42c

19 files changed

Lines changed: 171 additions & 76 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2076,13 +2076,18 @@ private newtype TPathNode =
20762076
config.isSource(node)
20772077
or
20782078
// ... or a sink that can be reached from a source
2079-
exists(PathNodeMid mid |
2080-
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2081-
config = mid.getConfiguration()
2082-
)
2079+
pathStepNil(node, config)
20832080
)
20842081
}
20852082

2083+
pragma[nomagic]
2084+
private predicate pathStepNil(Node node, Configuration config) {
2085+
exists(PathNodeMid mid |
2086+
pathStep(mid, node, _, _, any(AccessPathNil nil)) and
2087+
config = mid.getConfiguration()
2088+
)
2089+
}
2090+
20862091
/**
20872092
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
20882093
* Only those `PathNode`s that are reachable from a source are generated.

0 commit comments

Comments
 (0)