Skip to content

Commit 6b37d20

Browse files
authored
Merge branch 'main' into criemen/js-bazel
2 parents 9c8e232 + 512c6a5 commit 6b37d20

File tree

128 files changed

+7800
-702
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

128 files changed

+7800
-702
lines changed

cpp/ql/lib/semmle/code/cpp/ir/dataflow/MustFlow.qll

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ abstract class MustFlowConfiguration extends string {
3131
*/
3232
abstract predicate isSink(Operand sink);
3333

34+
/**
35+
* Holds if data flow through `instr` is prohibited.
36+
*/
37+
predicate isBarrier(Instruction instr) { none() }
38+
3439
/**
3540
* Holds if the additional flow step from `node1` to `node2` must be taken
3641
* into account in the analysis.
@@ -48,18 +53,21 @@ abstract class MustFlowConfiguration extends string {
4853
*/
4954
final predicate hasFlowPath(MustFlowPathNode source, MustFlowPathSink sink) {
5055
this.isSource(source.getInstruction()) and
51-
source.getASuccessor+() = sink
56+
source.getASuccessor*() = sink
5257
}
5358
}
5459

5560
/** Holds if `node` flows from a source. */
5661
pragma[nomagic]
5762
private predicate flowsFromSource(Instruction node, MustFlowConfiguration config) {
58-
config.isSource(node)
59-
or
60-
exists(Instruction mid |
61-
step(mid, node, config) and
62-
flowsFromSource(mid, pragma[only_bind_into](config))
63+
not config.isBarrier(node) and
64+
(
65+
config.isSource(node)
66+
or
67+
exists(Instruction mid |
68+
step(mid, node, config) and
69+
flowsFromSource(mid, pragma[only_bind_into](config))
70+
)
6371
)
6472
}
6573

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/RangeAnalysis.qll

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,7 @@ private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
1717
* `upper` is true, and can be traced back to a guard represented by `reason`.
1818
*/
1919
predicate bounded(Expr e, Bound b, float delta, boolean upper, Reason reason) {
20-
exists(SemanticExprConfig::Expr semExpr |
21-
semExpr.getUnconverted().getUnconvertedResultExpression() = e
22-
|
20+
exists(SemanticExprConfig::Expr semExpr | semExpr.getUnconvertedResultExpression() = e |
2321
semBounded(semExpr, b, delta, upper, reason)
2422
)
2523
}
@@ -30,9 +28,7 @@ predicate bounded(Expr e, Bound b, float delta, boolean upper, Reason reason) {
3028
* The `Expr` may be a conversion.
3129
*/
3230
predicate convertedBounded(Expr e, Bound b, float delta, boolean upper, Reason reason) {
33-
exists(SemanticExprConfig::Expr semExpr |
34-
semExpr.getConverted().getConvertedResultExpression() = e
35-
|
31+
exists(SemanticExprConfig::Expr semExpr | semExpr.getConvertedResultExpression() = e |
3632
semBounded(semExpr, b, delta, upper, reason)
3733
)
3834
}

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/SimpleRangeAnalysis.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ predicate exprMightOverflowNegatively(Expr expr) {
100100
lowerBound(expr) < exprMinVal(expr)
101101
or
102102
exists(SemanticExprConfig::Expr semExpr |
103-
semExpr.getUnconverted().getAst() = expr and
103+
semExpr.getAst() = expr and
104104
ConstantStage::potentiallyOverflowingExpr(false, semExpr) and
105105
not ConstantStage::initialBounded(semExpr, _, _, false, _, _, _)
106106
)
@@ -126,7 +126,7 @@ predicate exprMightOverflowPositively(Expr expr) {
126126
upperBound(expr) > exprMaxVal(expr)
127127
or
128128
exists(SemanticExprConfig::Expr semExpr |
129-
semExpr.getUnconverted().getAst() = expr and
129+
semExpr.getAst() = expr and
130130
ConstantStage::potentiallyOverflowingExpr(true, semExpr) and
131131
not ConstantStage::initialBounded(semExpr, _, _, true, _, _, _)
132132
)

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticCFG.qll

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ class SemBasicBlock extends Specific::BasicBlock {
1212
/** Holds if this block (transitively) dominates `otherblock`. */
1313
final predicate bbDominates(SemBasicBlock otherBlock) { Specific::bbDominates(this, otherBlock) }
1414

15-
/** Holds if this block has dominance information. */
16-
final predicate hasDominanceInformation() { Specific::hasDominanceInformation(this) }
17-
1815
/** Gets an expression that is evaluated in this basic block. */
1916
final SemExpr getAnExpr() { result.getBasicBlock() = this }
2017

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticExpr.qll

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
private import Semantic
66
private import SemanticExprSpecific::SemanticExprConfig as Specific
7+
private import SemanticType
78

89
/**
910
* An language-neutral expression.
@@ -241,8 +242,21 @@ class SemConvertExpr extends SemUnaryExpr {
241242
SemConvertExpr() { opcode instanceof Opcode::Convert }
242243
}
243244

245+
private import semmle.code.cpp.ir.IR as IR
246+
247+
/** A conversion instruction which is guaranteed to not overflow. */
248+
private class SafeConversion extends IR::ConvertInstruction {
249+
SafeConversion() {
250+
exists(SemType tFrom, SemType tTo |
251+
tFrom = getSemanticType(super.getUnary().getResultIRType()) and
252+
tTo = getSemanticType(super.getResultIRType()) and
253+
conversionCannotOverflow(tFrom, tTo)
254+
)
255+
}
256+
}
257+
244258
class SemCopyValueExpr extends SemUnaryExpr {
245-
SemCopyValueExpr() { opcode instanceof Opcode::CopyValue }
259+
SemCopyValueExpr() { opcode instanceof Opcode::CopyValue or this instanceof SafeConversion }
246260
}
247261

248262
class SemNegateExpr extends SemUnaryExpr {

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticExprSpecific.qll

Lines changed: 12 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -12,87 +12,10 @@ private import semmle.code.cpp.ir.ValueNumbering
1212
module SemanticExprConfig {
1313
class Location = Cpp::Location;
1414

15-
/** A `ConvertInstruction` or a `CopyValueInstruction`. */
16-
private class Conversion extends IR::UnaryInstruction {
17-
Conversion() {
18-
this instanceof IR::CopyValueInstruction
19-
or
20-
this instanceof IR::ConvertInstruction
21-
}
22-
23-
/** Holds if this instruction converts a value of type `tFrom` to a value of type `tTo`. */
24-
predicate converts(SemType tFrom, SemType tTo) {
25-
tFrom = getSemanticType(this.getUnary().getResultIRType()) and
26-
tTo = getSemanticType(this.getResultIRType())
27-
}
28-
}
29-
30-
/**
31-
* Gets a conversion-like instruction that consumes `op`, and
32-
* which is guaranteed to not overflow.
33-
*/
34-
private IR::Instruction safeConversion(IR::Operand op) {
35-
exists(Conversion conv, SemType tFrom, SemType tTo |
36-
conv.converts(tFrom, tTo) and
37-
conversionCannotOverflow(tFrom, tTo) and
38-
conv.getUnaryOperand() = op and
39-
result = conv
40-
)
41-
}
42-
43-
/** Holds if `i1 = i2` or if `i2` is a safe conversion that consumes `i1`. */
44-
private predicate idOrSafeConversion(IR::Instruction i1, IR::Instruction i2) {
45-
not i1.getResultIRType() instanceof IR::IRVoidType and
46-
(
47-
i1 = i2
48-
or
49-
i2 = safeConversion(i1.getAUse()) and
50-
i1.getBlock() = i2.getBlock()
51-
)
52-
}
53-
54-
module Equiv = QlBuiltins::EquivalenceRelation<IR::Instruction, idOrSafeConversion/2>;
55-
5615
/**
5716
* The expressions on which we perform range analysis.
5817
*/
59-
class Expr extends Equiv::EquivalenceClass {
60-
/** Gets the n'th instruction in this equivalence class. */
61-
private IR::Instruction getInstruction(int n) {
62-
result =
63-
rank[n + 1](IR::Instruction instr, int i, IR::IRBlock block |
64-
this = Equiv::getEquivalenceClass(instr) and block.getInstruction(i) = instr
65-
|
66-
instr order by i
67-
)
68-
}
69-
70-
/** Gets a textual representation of this element. */
71-
string toString() { result = this.getUnconverted().toString() }
72-
73-
/** Gets the basic block of this expression. */
74-
IR::IRBlock getBlock() { result = this.getUnconverted().getBlock() }
75-
76-
/** Gets the unconverted instruction associated with this expression. */
77-
IR::Instruction getUnconverted() { result = this.getInstruction(0) }
78-
79-
/**
80-
* Gets the final instruction associated with this expression. This
81-
* represents the result after applying all the safe conversions.
82-
*/
83-
IR::Instruction getConverted() {
84-
exists(int n |
85-
result = this.getInstruction(n) and
86-
not exists(this.getInstruction(n + 1))
87-
)
88-
}
89-
90-
/** Gets the type of the result produced by this instruction. */
91-
IR::IRType getResultIRType() { result = this.getConverted().getResultIRType() }
92-
93-
/** Gets the location of the source code for this expression. */
94-
Location getLocation() { result = this.getUnconverted().getLocation() }
95-
}
18+
class Expr = IR::Instruction;
9619

9720
SemBasicBlock getExprBasicBlock(Expr e) { result = getSemanticBasicBlock(e.getBlock()) }
9821

@@ -139,12 +62,12 @@ module SemanticExprConfig {
13962

14063
predicate stringLiteral(Expr expr, SemType type, string value) {
14164
anyConstantExpr(expr, type, value) and
142-
expr.getUnconverted() instanceof IR::StringConstantInstruction
65+
expr instanceof IR::StringConstantInstruction
14366
}
14467

14568
predicate binaryExpr(Expr expr, Opcode opcode, SemType type, Expr leftOperand, Expr rightOperand) {
14669
exists(IR::BinaryInstruction instr |
147-
instr = expr.getUnconverted() and
70+
instr = expr and
14871
type = getSemanticType(instr.getResultIRType()) and
14972
leftOperand = getSemanticExpr(instr.getLeft()) and
15073
rightOperand = getSemanticExpr(instr.getRight()) and
@@ -154,14 +77,14 @@ module SemanticExprConfig {
15477
}
15578

15679
predicate unaryExpr(Expr expr, Opcode opcode, SemType type, Expr operand) {
157-
exists(IR::UnaryInstruction instr | instr = expr.getUnconverted() |
80+
exists(IR::UnaryInstruction instr | instr = expr |
15881
type = getSemanticType(instr.getResultIRType()) and
15982
operand = getSemanticExpr(instr.getUnary()) and
16083
// REVIEW: Merge the two operand types.
16184
opcode.toString() = instr.getOpcode().toString()
16285
)
16386
or
164-
exists(IR::StoreInstruction instr | instr = expr.getUnconverted() |
87+
exists(IR::StoreInstruction instr | instr = expr |
16588
type = getSemanticType(instr.getResultIRType()) and
16689
operand = getSemanticExpr(instr.getSourceValue()) and
16790
opcode instanceof Opcode::Store
@@ -170,13 +93,13 @@ module SemanticExprConfig {
17093

17194
predicate nullaryExpr(Expr expr, Opcode opcode, SemType type) {
17295
exists(IR::LoadInstruction load |
173-
load = expr.getUnconverted() and
96+
load = expr and
17497
type = getSemanticType(load.getResultIRType()) and
17598
opcode instanceof Opcode::Load
17699
)
177100
or
178101
exists(IR::InitializeParameterInstruction init |
179-
init = expr.getUnconverted() and
102+
init = expr and
180103
type = getSemanticType(init.getResultIRType()) and
181104
opcode instanceof Opcode::InitializeParameter
182105
)
@@ -199,8 +122,6 @@ module SemanticExprConfig {
199122
dominator.dominates(dominated)
200123
}
201124

202-
predicate hasDominanceInformation(BasicBlock block) { any() }
203-
204125
private predicate id(Cpp::Locatable x, Cpp::Locatable y) { x = y }
205126

206127
private predicate idOf(Cpp::Locatable x, int y) = equivalenceRelation(id/2)(x, y)
@@ -209,17 +130,7 @@ module SemanticExprConfig {
209130

210131
newtype TSsaVariable =
211132
TSsaInstruction(IR::Instruction instr) { instr.hasMemoryResult() } or
212-
TSsaOperand(IR::Operand op) { op.isDefinitionInexact() } or
213-
TSsaPointerArithmeticGuard(ValueNumber instr) {
214-
exists(Guard g, IR::Operand use |
215-
use = instr.getAUse() and use.getIRType() instanceof IR::IRAddressType
216-
|
217-
g.comparesLt(use, _, _, _, _) or
218-
g.comparesLt(_, use, _, _, _) or
219-
g.comparesEq(use, _, _, _, _) or
220-
g.comparesEq(_, use, _, _, _)
221-
)
222-
}
133+
TSsaOperand(IR::Operand op) { op.isDefinitionInexact() }
223134

224135
class SsaVariable extends TSsaVariable {
225136
string toString() { none() }
@@ -228,8 +139,6 @@ module SemanticExprConfig {
228139

229140
IR::Instruction asInstruction() { none() }
230141

231-
ValueNumber asPointerArithGuard() { none() }
232-
233142
IR::Operand asOperand() { none() }
234143
}
235144

@@ -245,18 +154,6 @@ module SemanticExprConfig {
245154
final override IR::Instruction asInstruction() { result = instr }
246155
}
247156

248-
class SsaPointerArithmeticGuard extends SsaVariable, TSsaPointerArithmeticGuard {
249-
ValueNumber vn;
250-
251-
SsaPointerArithmeticGuard() { this = TSsaPointerArithmeticGuard(vn) }
252-
253-
final override string toString() { result = vn.toString() }
254-
255-
final override Location getLocation() { result = vn.getLocation() }
256-
257-
final override ValueNumber asPointerArithGuard() { result = vn }
258-
}
259-
260157
class SsaOperand extends SsaVariable, TSsaOperand {
261158
IR::Operand op;
262159

@@ -289,11 +186,7 @@ module SemanticExprConfig {
289186
)
290187
}
291188

292-
Expr getAUse(SsaVariable v) {
293-
result.getUnconverted().(IR::LoadInstruction).getSourceValue() = v.asInstruction()
294-
or
295-
result.getUnconverted() = v.asPointerArithGuard().getAnInstruction()
296-
}
189+
Expr getAUse(SsaVariable v) { result.(IR::LoadInstruction).getSourceValue() = v.asInstruction() }
297190

298191
SemType getSsaVariableType(SsaVariable v) {
299192
result = getSemanticType(v.asInstruction().getResultIRType())
@@ -332,10 +225,7 @@ module SemanticExprConfig {
332225
final override Location getLocation() { result = block.getLocation() }
333226

334227
final override predicate hasRead(SsaVariable v) {
335-
exists(IR::Operand operand |
336-
operand.getDef() = v.asInstruction() or
337-
operand.getDef() = v.asPointerArithGuard().getAnInstruction()
338-
|
228+
exists(IR::Operand operand | operand.getDef() = v.asInstruction() |
339229
not operand instanceof IR::PhiInputOperand and
340230
operand.getUse().getBlock() = block
341231
)
@@ -353,10 +243,7 @@ module SemanticExprConfig {
353243
final override Location getLocation() { result = succ.getLocation() }
354244

355245
final override predicate hasRead(SsaVariable v) {
356-
exists(IR::PhiInputOperand operand |
357-
operand.getDef() = v.asInstruction() or
358-
operand.getDef() = v.asPointerArithGuard().getAnInstruction()
359-
|
246+
exists(IR::PhiInputOperand operand | operand.getDef() = v.asInstruction() |
360247
operand.getPredecessorBlock() = pred and
361248
operand.getUse().getBlock() = succ
362249
)
@@ -433,7 +320,7 @@ module SemanticExprConfig {
433320
}
434321

435322
/** Gets the expression associated with `instr`. */
436-
SemExpr getSemanticExpr(IR::Instruction instr) { result = Equiv::getEquivalenceClass(instr) }
323+
SemExpr getSemanticExpr(IR::Instruction instr) { result = instr }
437324
}
438325

439326
predicate getSemanticExpr = SemanticExprConfig::getSemanticExpr/1;

cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticGuard.qll

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -35,32 +35,4 @@ predicate semImplies_v2(SemGuard g1, boolean b1, SemGuard g2, boolean b2) {
3535
Specific::implies_v2(g1, b1, g2, b2)
3636
}
3737

38-
/**
39-
* Holds if `guard` directly controls the position `controlled` with the
40-
* value `testIsTrue`.
41-
*/
42-
pragma[nomagic]
43-
predicate semGuardDirectlyControlsSsaRead(
44-
SemGuard guard, SemSsaReadPosition controlled, boolean testIsTrue
45-
) {
46-
guard.directlyControls(controlled.(SemSsaReadPositionBlock).getBlock(), testIsTrue)
47-
or
48-
exists(SemSsaReadPositionPhiInputEdge controlledEdge | controlledEdge = controlled |
49-
guard.directlyControls(controlledEdge.getOrigBlock(), testIsTrue) or
50-
guard.hasBranchEdge(controlledEdge.getOrigBlock(), controlledEdge.getPhiBlock(), testIsTrue)
51-
)
52-
}
53-
54-
/**
55-
* Holds if `guard` controls the position `controlled` with the value `testIsTrue`.
56-
*/
57-
predicate semGuardControlsSsaRead(SemGuard guard, SemSsaReadPosition controlled, boolean testIsTrue) {
58-
semGuardDirectlyControlsSsaRead(guard, controlled, testIsTrue)
59-
or
60-
exists(SemGuard guard0, boolean testIsTrue0 |
61-
semImplies_v2(guard0, testIsTrue0, guard, testIsTrue) and
62-
semGuardControlsSsaRead(guard0, controlled, testIsTrue0)
63-
)
64-
}
65-
6638
SemGuard semGetComparisonGuard(SemRelationalExpr e) { result = Specific::comparisonGuard(e) }

0 commit comments

Comments
 (0)