Skip to content

Commit f257c7a

Browse files
aschackmullaschackmull
committed
Guards: Align the SSA signature with the one from shared SSA.
1 parent f6cddc9 commit f257c7a

File tree

4 files changed

+56
-50
lines changed

4 files changed

+56
-50
lines changed

‎cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -380,18 +380,20 @@ private module LogicInput_v1 implements GuardsImpl::LogicInputSig {
380380
GuardsInput::Expr getARead() { result = this.getAUse().getDef() }
381381
}
382382

383-
class SsaWriteDefinition extends SsaDefinition instanceof ExplicitDefinition {
384-
GuardsInput::Expr getDefinition() { result = super.getAssignedInstruction() }
383+
class SsaExplicitWrite extends SsaDefinition instanceof ExplicitDefinition {
384+
GuardsInput::Expr getValue() { result = super.getAssignedInstruction() }
385385
}
386386

387-
class SsaPhiNode extends SsaDefinition instanceof PhiNode {
387+
class SsaPhiDefinition extends SsaDefinition instanceof PhiNode {
388388
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
389389
super.hasInputFromBlock(inp, bb)
390390
}
391391
}
392392

393-
predicate parameterDefinition(GuardsInput::Parameter p, SsaDefinition def) {
394-
def.isParameterDefinition(p)
393+
class SsaParameterInit extends SsaDefinition {
394+
SsaParameterInit() { this.isParameterDefinition(_) }
395+
396+
GuardsInput::Parameter getParameter() { this.isParameterDefinition(result) }
395397
}
396398

397399
predicate additionalImpliesStep(

‎csharp/ql/lib/semmle/code/csharp/controlflow/Guards.qll‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -207,18 +207,18 @@ private module LogicInput implements GuardsImpl::LogicInputSig {
207207
Expr getARead() { super.getARead() = result }
208208
}
209209

210-
class SsaWriteDefinition extends SsaDefinition instanceof Ssa::ExplicitDefinition {
211-
Expr getDefinition() { result = super.getADefinition().getSource() }
210+
class SsaExplicitWrite extends SsaDefinition instanceof Ssa::ExplicitDefinition {
211+
Expr getValue() { result = super.getADefinition().getSource() }
212212
}
213213

214-
class SsaPhiNode extends SsaDefinition instanceof Ssa::PhiNode {
214+
class SsaPhiDefinition extends SsaDefinition instanceof Ssa::PhiNode {
215215
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
216216
super.hasInputFromBlock(inp, bb)
217217
}
218218
}
219219

220-
predicate parameterDefinition(Parameter p, SsaDefinition def) {
221-
def.(Ssa::ImplicitParameterDefinition).getParameter() = p
220+
class SsaParameterInit extends SsaDefinition instanceof Ssa::ImplicitParameterDefinition {
221+
Parameter getParameter() { result = super.getParameter() }
222222
}
223223

224224
predicate additionalNullCheck(GuardsImpl::PreGuard guard, GuardValue val, Expr e, boolean isNull) {

‎java/ql/lib/semmle/code/java/controlflow/Guards.qll‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -415,21 +415,21 @@ private module LogicInput_v1 implements GuardsImpl::LogicInputSig {
415415
GuardsInput::Expr getARead() { result = this.getAUse() }
416416
}
417417

418-
class SsaWriteDefinition extends SsaDefinition instanceof BaseSsaUpdate {
419-
GuardsInput::Expr getDefinition() {
418+
class SsaExplicitWrite extends SsaDefinition instanceof BaseSsaUpdate {
419+
GuardsInput::Expr getValue() {
420420
super.getDefiningExpr().(VariableAssign).getSource() = result or
421421
super.getDefiningExpr().(AssignOp) = result
422422
}
423423
}
424424

425-
class SsaPhiNode extends SsaDefinition instanceof BaseSsaPhiNode {
425+
class SsaPhiDefinition extends SsaDefinition instanceof BaseSsaPhiNode {
426426
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
427427
super.hasInputFromBlock(inp, bb)
428428
}
429429
}
430430

431-
predicate parameterDefinition(Parameter p, SsaDefinition def) {
432-
def.(BaseSsaImplicitInit).isParameterDefinition(p)
431+
class SsaParameterInit extends SsaDefinition instanceof BaseSsaImplicitInit {
432+
Parameter getParameter() { super.isParameterDefinition(result) }
433433
}
434434

435435
predicate additionalNullCheck = LogicInputCommon::additionalNullCheck/4;
@@ -446,21 +446,21 @@ private module LogicInput_v2 implements GuardsImpl::LogicInputSig {
446446
GuardsInput::Expr getARead() { result = this.getAUse() }
447447
}
448448

449-
class SsaWriteDefinition extends SsaDefinition instanceof SSA::SsaExplicitUpdate {
450-
GuardsInput::Expr getDefinition() {
449+
class SsaExplicitWrite extends SsaDefinition instanceof SSA::SsaExplicitUpdate {
450+
GuardsInput::Expr getValue() {
451451
super.getDefiningExpr().(VariableAssign).getSource() = result or
452452
super.getDefiningExpr().(AssignOp) = result
453453
}
454454
}
455455

456-
class SsaPhiNode extends SsaDefinition instanceof SSA::SsaPhiNode {
456+
class SsaPhiDefinition extends SsaDefinition instanceof SSA::SsaPhiNode {
457457
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb) {
458458
super.hasInputFromBlock(inp, bb)
459459
}
460460
}
461461

462-
predicate parameterDefinition(Parameter p, SsaDefinition def) {
463-
def.(SSA::SsaImplicitInit).isParameterDefinition(p)
462+
class SsaParameterInit extends SsaDefinition instanceof SSA::SsaImplicitInit {
463+
Parameter getParameter() { super.isParameterDefinition(result) }
464464
}
465465

466466
predicate additionalNullCheck = LogicInputCommon::additionalNullCheck/4;

‎shared/controlflow/codeql/controlflow/Guards.qll‎

Lines changed: 34 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -536,16 +536,18 @@ module Make<
536536
Location getLocation();
537537
}
538538

539-
class SsaWriteDefinition extends SsaDefinition {
540-
Expr getDefinition();
539+
class SsaExplicitWrite extends SsaDefinition {
540+
Expr getValue();
541541
}
542542

543-
class SsaPhiNode extends SsaDefinition {
543+
class SsaPhiDefinition extends SsaDefinition {
544544
/** Holds if `inp` is an input to the phi node along the edge originating in `bb`. */
545545
predicate hasInputFromBlock(SsaDefinition inp, BasicBlock bb);
546546
}
547547

548-
predicate parameterDefinition(Parameter p, SsaDefinition def);
548+
class SsaParameterInit extends SsaDefinition {
549+
Parameter getParameter();
550+
}
549551

550552
/**
551553
* Holds if `guard` evaluating to `val` ensures that:
@@ -594,7 +596,7 @@ module Make<
594596
* logical inferences from `phi` to `guard` trivial and irrelevant.
595597
*/
596598
private predicate guardControlsPhiBranch(
597-
Guard guard, GuardValue v, SsaPhiNode phi, SsaDefinition inp
599+
Guard guard, GuardValue v, SsaPhiDefinition phi, SsaDefinition inp
598600
) {
599601
exists(BasicBlock bbPhi |
600602
phi.hasInputFromBlock(inp, _) and
@@ -615,10 +617,12 @@ module Make<
615617
*
616618
* This makes `phi` similar to the conditional `phi = guard==v ? input : ...`.
617619
*/
618-
private predicate guardDeterminesPhiInput(Guard guard, GuardValue v, SsaPhiNode phi, Expr input) {
619-
exists(GuardValue dv, SsaWriteDefinition inp |
620+
private predicate guardDeterminesPhiInput(
621+
Guard guard, GuardValue v, SsaPhiDefinition phi, Expr input
622+
) {
623+
exists(GuardValue dv, SsaExplicitWrite inp |
620624
guardControlsPhiBranch(guard, v, phi, inp) and
621-
inp.getDefinition() = input and
625+
inp.getValue() = input and
622626
dv = v.getDualValue() and
623627
forall(SsaDefinition other | phi.hasInputFromBlock(other, _) and other != inp |
624628
guardControlsPhiBranch(guard, dv, phi, other)
@@ -644,7 +648,7 @@ module Make<
644648
)
645649
or
646650
// An expression `x = ...` can be considered as a read of `x`.
647-
guard.(IdExpr).getEqualChildExpr() = def.(SsaWriteDefinition).getDefinition()
651+
guard.(IdExpr).getEqualChildExpr() = def.(SsaExplicitWrite).getValue()
648652
}
649653

650654
private predicate valueStep(Expr e1, Expr e2) {
@@ -669,10 +673,10 @@ module Make<
669673
* through a back edge.
670674
*/
671675
private SsaDefinition getAnUltimateDefinition(SsaDefinition v, boolean fromBackEdge) {
672-
result = v and not v instanceof SsaPhiNode and fromBackEdge = false
676+
result = v and not v instanceof SsaPhiDefinition and fromBackEdge = false
673677
or
674678
exists(SsaDefinition inp, BasicBlock bb, boolean fbe |
675-
v.(SsaPhiNode).hasInputFromBlock(inp, bb) and
679+
v.(SsaPhiDefinition).hasInputFromBlock(inp, bb) and
676680
result = getAnUltimateDefinition(inp, fbe) and
677681
(if v.getBasicBlock().dominates(bb) then fromBackEdge = true else fromBackEdge = fbe)
678682
)
@@ -683,9 +687,9 @@ module Make<
683687
*/
684688
private predicate hasPossibleUnknownValue(SsaDefinition v) {
685689
exists(SsaDefinition def | def = getAnUltimateDefinition(v, _) |
686-
not exists(def.(SsaWriteDefinition).getDefinition())
690+
not exists(def.(SsaExplicitWrite).getValue())
687691
or
688-
exists(Expr e | e = possibleValue(def.(SsaWriteDefinition).getDefinition()) |
692+
exists(Expr e | e = possibleValue(def.(SsaExplicitWrite).getValue()) |
689693
not constantHasValue(e, _)
690694
)
691695
)
@@ -701,17 +705,17 @@ module Make<
701705
*/
702706
private predicate possibleValue(SsaDefinition v, boolean fromBackEdge, Expr e, GuardValue k) {
703707
not hasPossibleUnknownValue(v) and
704-
exists(SsaWriteDefinition def |
708+
exists(SsaExplicitWrite def |
705709
def = getAnUltimateDefinition(v, fromBackEdge) and
706-
e = possibleValue(def.getDefinition()) and
710+
e = possibleValue(def.getValue()) and
707711
constantHasValue(e, k)
708712
)
709713
}
710714

711715
/**
712716
* Holds if `e` equals `k` and may be assigned to `v` without going through
713717
* back edges, and all other possible ultimate definitions of `v` are different
714-
* from `k`. The trivial case where `v` is an `SsaWriteDefinition` with `e` as
718+
* from `k`. The trivial case where `v` is an `SsaExplicitWrite` with `e` as
715719
* the only possible value is excluded.
716720
*/
717721
private predicate uniqueValue(SsaDefinition v, Expr e, GuardValue k) {
@@ -727,14 +731,14 @@ module Make<
727731
* Holds if `phi` has exactly two inputs, `def1` and `e2`, and that `def1`
728732
* does not come from a back-edge into `phi`.
729733
*/
730-
private predicate phiWithTwoInputs(SsaPhiNode phi, SsaDefinition def1, Expr e2) {
731-
exists(SsaWriteDefinition def2, BasicBlock bb1 |
734+
private predicate phiWithTwoInputs(SsaPhiDefinition phi, SsaDefinition def1, Expr e2) {
735+
exists(SsaExplicitWrite def2, BasicBlock bb1 |
732736
2 = strictcount(SsaDefinition inp, BasicBlock bb | phi.hasInputFromBlock(inp, bb)) and
733737
phi.hasInputFromBlock(def1, bb1) and
734738
phi.hasInputFromBlock(def2, _) and
735739
def1 != def2 and
736740
not phi.getBasicBlock().dominates(bb1) and
737-
def2.getDefinition() = e2
741+
def2.getValue() = e2
738742
)
739743
}
740744

@@ -795,8 +799,8 @@ module Make<
795799
baseSsaValueCheck(def, v, g, gv)
796800
)
797801
or
798-
exists(SsaWriteDefinition def |
799-
exprHasValue(def.getDefinition(), v) and
802+
exists(SsaExplicitWrite def |
803+
exprHasValue(def.getValue(), v) and
800804
e = def.getARead()
801805
)
802806
}
@@ -841,7 +845,7 @@ module Make<
841845
bindingset[def1, v1]
842846
pragma[inline_late]
843847
private predicate impliesStepSsaGuard(SsaDefinition def1, GuardValue v1, Guard g2, GuardValue v2) {
844-
def1.(SsaWriteDefinition).getDefinition() = g2 and
848+
def1.(SsaExplicitWrite).getValue() = g2 and
845849
v1 = v2 and
846850
not exprHasValue(g2, v2) // disregard trivial guard
847851
or
@@ -1032,9 +1036,9 @@ module Make<
10321036
private predicate validReturnInCustomGuard(
10331037
ReturnExpr ret, ParameterPosition ppos, GuardValue retval, GuardValue val
10341038
) {
1035-
exists(NonOverridableMethod m, SsaDefinition param |
1039+
exists(NonOverridableMethod m, SsaParameterInit param |
10361040
m.getAReturnExpr() = ret and
1037-
parameterDefinition(m.getParameter(ppos), param)
1041+
param.getParameter() = m.getParameter(ppos)
10381042
|
10391043
exists(Guard g0, GuardValue v0 |
10401044
directlyControlsReturn(g0, v0, ret) and
@@ -1071,8 +1075,8 @@ module Make<
10711075
validReturnInCustomGuard(ret, ppos, retval, val)
10721076
)
10731077
or
1074-
exists(SsaDefinition param, Guard g0, GuardValue v0 |
1075-
parameterDefinition(result.getParameter(ppos), param) and
1078+
exists(SsaParameterInit param, Guard g0, GuardValue v0 |
1079+
param.getParameter() = result.getParameter(ppos) and
10761080
guardDirectlyControlsExit(g0, v0) and
10771081
retval = TException(false) and
10781082
BranchImplies::ssaControls(param, val, g0, v0)
@@ -1141,9 +1145,9 @@ module Make<
11411145
private predicate validReturnInValidationWrapper(
11421146
ReturnExpr ret, ParameterPosition ppos, GuardValue retval, State state
11431147
) {
1144-
exists(NonOverridableMethod m, SsaDefinition param, Guard guard, GuardValue val |
1148+
exists(NonOverridableMethod m, SsaParameterInit param, Guard guard, GuardValue val |
11451149
m.getAReturnExpr() = ret and
1146-
parameterDefinition(m.getParameter(ppos), param) and
1150+
param.getParameter() = m.getParameter(ppos) and
11471151
guardChecksDef(guard, param, val, state)
11481152
|
11491153
guard.valueControls(ret.getBasicBlock(), val) and
@@ -1171,8 +1175,8 @@ module Make<
11711175
validReturnInValidationWrapper(ret, ppos, retval, state)
11721176
)
11731177
or
1174-
exists(SsaDefinition param, BasicBlock bb, Guard guard, GuardValue val |
1175-
parameterDefinition(result.getParameter(ppos), param) and
1178+
exists(SsaParameterInit param, BasicBlock bb, Guard guard, GuardValue val |
1179+
param.getParameter() = result.getParameter(ppos) and
11761180
guardChecksDef(guard, param, val, state) and
11771181
guard.valueControls(bb, val) and
11781182
normalExitBlock(bb) and

0 commit comments

Comments
 (0)