Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fbef146

Browse files
MathiasVPMathiasVP
committed
C++: Remove PositionalArgumentWithoutWriteSideEffectNode (since not all arguments need a PostUpdateNode). Also generalized the added flow rule in simpleLocalFlowStep since there isn't always a ChiInstruction - for instance of it's a write to a struct that only has a single field.
1 parent f92dd3c commit fbef146

2 files changed

Lines changed: 50 additions & 21 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 15 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,17 @@ abstract class PostUpdateNode extends InstructionNode {
218218
override string toString() { result = getPreUpdateNode().toString() + " [post update]" }
219219
}
220220

221-
abstract class PartialDefinitionNode extends PostUpdateNode, TInstructionNode { }
221+
abstract private class PartialDefinitionNode extends PostUpdateNode, TInstructionNode {
222+
final Instruction getInstructionOrChi() {
223+
exists(ChiInstruction chi |
224+
// TODO: This should be a non-conflated ChiInstruction once #3123 is merged
225+
chi.getPartial() = getInstruction() and
226+
result = chi
227+
)
228+
or
229+
result = getInstruction()
230+
}
231+
}
222232

223233
class ExplicitFieldStoreQualifierNode extends PartialDefinitionNode {
224234
override StoreInstruction instr;
@@ -268,22 +278,6 @@ class DefinitionByReferenceNode extends PartialDefinitionNode {
268278
override string toString() { result = "ref arg " + getPreUpdateNode().toString() }
269279
}
270280

271-
class PositionalArgumentWithoutWriteSideEffectNode extends PartialDefinitionNode {
272-
override CallInstruction instr;
273-
PositionalArgumentOperand op;
274-
275-
PositionalArgumentWithoutWriteSideEffectNode() {
276-
instr.getAnOperand() = op and
277-
not exists(WriteSideEffectInstruction write |
278-
write.getIndex() = op.getIndex() and write.getPrimaryInstruction() = instr
279-
)
280-
}
281-
282-
override Node getPreUpdateNode() { result.asInstruction() = op.getDef() }
283-
284-
override string toString() { result = "no change to " + op.toString() }
285-
}
286-
287281
/**
288282
* A `Node` corresponding to a variable in the program, as opposed to the
289283
* value of that variable at some particular point. This can be used for
@@ -365,10 +359,10 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) { simpleLocalFlowStep(nodeFr
365359
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
366360
simpleInstructionLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asInstruction())
367361
or
368-
exists(ChiInstruction chi, LoadInstruction load |
369-
chi.getPartial() = nodeFrom.(PartialDefinitionNode).getInstruction() and
370-
// TODO: This can probably be getSourceValue() after #3112 is merged
371-
load.getSourceValueOperand().getAnyDef() = chi and
362+
exists(LoadInstruction load |
363+
// TODO: These can probably be getSourceValue() after #3112 is merged
364+
load.getSourceValueOperand().getAnyDef() =
365+
nodeFrom.(PartialDefinitionNode).getInstructionOrChi() and
372366
nodeTo.asInstruction() = load.getSourceAddress().(FieldAddressInstruction).getObjectAddress()
373367
)
374368
}

‎cpp/ql/test/library-tests/dataflow/fields/ir-flow.expected‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,48 @@ edges
1515
| aliasing.cpp:26:19:26:20 | ref arg (reference to) [m1] : void | aliasing.cpp:30:8:30:9 | s2 [m1] : void |
1616
| aliasing.cpp:29:8:29:9 | s1 [m1] : void | aliasing.cpp:29:11:29:12 | m1 |
1717
| aliasing.cpp:30:8:30:9 | s2 [m1] : void | aliasing.cpp:30:11:30:12 | m1 |
18+
| aliasing.cpp:37:3:37:24 | (reference dereference) [post update] : void | aliasing.cpp:37:3:37:24 | (reference dereference) [post update] [m1] : void |
1819
| aliasing.cpp:37:3:37:24 | (reference dereference) [post update] : void | aliasing.cpp:38:11:38:12 | m1 |
20+
| aliasing.cpp:37:3:37:24 | (reference dereference) [post update] [m1] : void | aliasing.cpp:38:8:38:9 | s1 [m1] : void |
1921
| aliasing.cpp:37:13:37:22 | call to user_input : void | aliasing.cpp:37:3:37:24 | (reference dereference) [post update] : void |
2022
| aliasing.cpp:37:13:37:22 | call to user_input : void | aliasing.cpp:38:11:38:12 | m1 |
23+
| aliasing.cpp:38:8:38:9 | s1 [m1] : void | aliasing.cpp:38:11:38:12 | m1 |
24+
| aliasing.cpp:42:3:42:22 | s2 [post update] : void | aliasing.cpp:42:3:42:22 | s2 [post update] [m1] : void |
2125
| aliasing.cpp:42:3:42:22 | s2 [post update] : void | aliasing.cpp:43:13:43:14 | m1 |
26+
| aliasing.cpp:42:3:42:22 | s2 [post update] [m1] : void | aliasing.cpp:43:8:43:11 | (reference dereference) [m1] : void |
2227
| aliasing.cpp:42:11:42:20 | call to user_input : void | aliasing.cpp:42:3:42:22 | s2 [post update] : void |
2328
| aliasing.cpp:42:11:42:20 | call to user_input : void | aliasing.cpp:43:13:43:14 | m1 |
29+
| aliasing.cpp:43:8:43:11 | (reference dereference) [m1] : void | aliasing.cpp:43:13:43:14 | m1 |
30+
| aliasing.cpp:79:3:79:22 | s [post update] : void | aliasing.cpp:79:3:79:22 | s [post update] [m1] : void |
2431
| aliasing.cpp:79:3:79:22 | s [post update] : void | aliasing.cpp:80:12:80:13 | m1 |
32+
| aliasing.cpp:79:3:79:22 | s [post update] [m1] : void | aliasing.cpp:80:10:80:10 | s [m1] : void |
2533
| aliasing.cpp:79:11:79:20 | call to user_input : void | aliasing.cpp:79:3:79:22 | s [post update] : void |
2634
| aliasing.cpp:79:11:79:20 | call to user_input : void | aliasing.cpp:80:12:80:13 | m1 |
35+
| aliasing.cpp:80:10:80:10 | s [m1] : void | aliasing.cpp:80:12:80:13 | m1 |
36+
| aliasing.cpp:86:3:86:21 | (reference dereference) [post update] : void | aliasing.cpp:86:3:86:21 | (reference dereference) [post update] [m1] : void |
2737
| aliasing.cpp:86:3:86:21 | (reference dereference) [post update] : void | aliasing.cpp:87:12:87:13 | m1 |
38+
| aliasing.cpp:86:3:86:21 | (reference dereference) [post update] [m1] : void | aliasing.cpp:87:10:87:10 | s [m1] : void |
2839
| aliasing.cpp:86:10:86:19 | call to user_input : void | aliasing.cpp:86:3:86:21 | (reference dereference) [post update] : void |
2940
| aliasing.cpp:86:10:86:19 | call to user_input : void | aliasing.cpp:87:12:87:13 | m1 |
41+
| aliasing.cpp:87:10:87:10 | s [m1] : void | aliasing.cpp:87:12:87:13 | m1 |
42+
| aliasing.cpp:92:3:92:23 | s [post update] : void | aliasing.cpp:92:3:92:23 | s [post update] [m1] : void |
3043
| aliasing.cpp:92:3:92:23 | s [post update] : void | aliasing.cpp:93:12:93:13 | m1 |
44+
| aliasing.cpp:92:3:92:23 | s [post update] [m1] : void | aliasing.cpp:93:10:93:10 | s [m1] : void |
3145
| aliasing.cpp:92:12:92:21 | call to user_input : void | aliasing.cpp:92:3:92:23 | s [post update] : void |
3246
| aliasing.cpp:92:12:92:21 | call to user_input : void | aliasing.cpp:93:12:93:13 | m1 |
47+
| aliasing.cpp:93:10:93:10 | s [m1] : void | aliasing.cpp:93:12:93:13 | m1 |
48+
| struct_init.c:20:20:20:29 | VariableAddress [post update] : void | struct_init.c:20:20:20:29 | VariableAddress [post update] [a] : void |
3349
| struct_init.c:20:20:20:29 | VariableAddress [post update] : void | struct_init.c:22:11:22:11 | a |
50+
| struct_init.c:20:20:20:29 | VariableAddress [post update] [a] : void | struct_init.c:22:8:22:9 | ab [a] : void |
3451
| struct_init.c:20:20:20:29 | call to user_input : void | struct_init.c:20:20:20:29 | VariableAddress [post update] : void |
3552
| struct_init.c:20:20:20:29 | call to user_input : void | struct_init.c:22:11:22:11 | a |
53+
| struct_init.c:22:8:22:9 | ab [a] : void | struct_init.c:22:11:22:11 | a |
54+
| struct_init.c:27:7:27:16 | FieldAddress [post update] : void | struct_init.c:27:7:27:16 | FieldAddress [post update] [a] : void |
3655
| struct_init.c:27:7:27:16 | FieldAddress [post update] : void | struct_init.c:31:23:31:23 | a |
56+
| struct_init.c:27:7:27:16 | FieldAddress [post update] [a] : void | struct_init.c:31:14:31:21 | nestedAB [a] : void |
3757
| struct_init.c:27:7:27:16 | call to user_input : void | struct_init.c:27:7:27:16 | FieldAddress [post update] : void |
3858
| struct_init.c:27:7:27:16 | call to user_input : void | struct_init.c:31:23:31:23 | a |
59+
| struct_init.c:31:14:31:21 | nestedAB [a] : void | struct_init.c:31:23:31:23 | a |
3960
nodes
4061
| A.cpp:126:5:126:5 | ref arg b [c] : void | semmle.label | ref arg b [c] : void |
4162
| A.cpp:126:12:126:18 | new : void | semmle.label | new : void |
@@ -57,25 +78,39 @@ nodes
5778
| aliasing.cpp:30:8:30:9 | s2 [m1] : void | semmle.label | s2 [m1] : void |
5879
| aliasing.cpp:30:11:30:12 | m1 | semmle.label | m1 |
5980
| aliasing.cpp:37:3:37:24 | (reference dereference) [post update] : void | semmle.label | (reference dereference) [post update] : void |
81+
| aliasing.cpp:37:3:37:24 | (reference dereference) [post update] [m1] : void | semmle.label | (reference dereference) [post update] [m1] : void |
6082
| aliasing.cpp:37:13:37:22 | call to user_input : void | semmle.label | call to user_input : void |
83+
| aliasing.cpp:38:8:38:9 | s1 [m1] : void | semmle.label | s1 [m1] : void |
6184
| aliasing.cpp:38:11:38:12 | m1 | semmle.label | m1 |
6285
| aliasing.cpp:42:3:42:22 | s2 [post update] : void | semmle.label | s2 [post update] : void |
86+
| aliasing.cpp:42:3:42:22 | s2 [post update] [m1] : void | semmle.label | s2 [post update] [m1] : void |
6387
| aliasing.cpp:42:11:42:20 | call to user_input : void | semmle.label | call to user_input : void |
88+
| aliasing.cpp:43:8:43:11 | (reference dereference) [m1] : void | semmle.label | (reference dereference) [m1] : void |
6489
| aliasing.cpp:43:13:43:14 | m1 | semmle.label | m1 |
6590
| aliasing.cpp:79:3:79:22 | s [post update] : void | semmle.label | s [post update] : void |
91+
| aliasing.cpp:79:3:79:22 | s [post update] [m1] : void | semmle.label | s [post update] [m1] : void |
6692
| aliasing.cpp:79:11:79:20 | call to user_input : void | semmle.label | call to user_input : void |
93+
| aliasing.cpp:80:10:80:10 | s [m1] : void | semmle.label | s [m1] : void |
6794
| aliasing.cpp:80:12:80:13 | m1 | semmle.label | m1 |
6895
| aliasing.cpp:86:3:86:21 | (reference dereference) [post update] : void | semmle.label | (reference dereference) [post update] : void |
96+
| aliasing.cpp:86:3:86:21 | (reference dereference) [post update] [m1] : void | semmle.label | (reference dereference) [post update] [m1] : void |
6997
| aliasing.cpp:86:10:86:19 | call to user_input : void | semmle.label | call to user_input : void |
98+
| aliasing.cpp:87:10:87:10 | s [m1] : void | semmle.label | s [m1] : void |
7099
| aliasing.cpp:87:12:87:13 | m1 | semmle.label | m1 |
71100
| aliasing.cpp:92:3:92:23 | s [post update] : void | semmle.label | s [post update] : void |
101+
| aliasing.cpp:92:3:92:23 | s [post update] [m1] : void | semmle.label | s [post update] [m1] : void |
72102
| aliasing.cpp:92:12:92:21 | call to user_input : void | semmle.label | call to user_input : void |
103+
| aliasing.cpp:93:10:93:10 | s [m1] : void | semmle.label | s [m1] : void |
73104
| aliasing.cpp:93:12:93:13 | m1 | semmle.label | m1 |
74105
| struct_init.c:20:20:20:29 | VariableAddress [post update] : void | semmle.label | VariableAddress [post update] : void |
106+
| struct_init.c:20:20:20:29 | VariableAddress [post update] [a] : void | semmle.label | VariableAddress [post update] [a] : void |
75107
| struct_init.c:20:20:20:29 | call to user_input : void | semmle.label | call to user_input : void |
108+
| struct_init.c:22:8:22:9 | ab [a] : void | semmle.label | ab [a] : void |
76109
| struct_init.c:22:11:22:11 | a | semmle.label | a |
77110
| struct_init.c:27:7:27:16 | FieldAddress [post update] : void | semmle.label | FieldAddress [post update] : void |
111+
| struct_init.c:27:7:27:16 | FieldAddress [post update] [a] : void | semmle.label | FieldAddress [post update] [a] : void |
78112
| struct_init.c:27:7:27:16 | call to user_input : void | semmle.label | call to user_input : void |
113+
| struct_init.c:31:14:31:21 | nestedAB [a] : void | semmle.label | nestedAB [a] : void |
79114
| struct_init.c:31:23:31:23 | a | semmle.label | a |
80115
#select
81116
| A.cpp:132:10:132:13 | (void *)... | A.cpp:126:12:126:18 | new : void | A.cpp:132:10:132:13 | (void *)... | (void *)... flows from $@ | A.cpp:126:12:126:18 | new : void | new : void |

0 commit comments

Comments
 (0)