Skip to content

Commit 3d96206

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into enable-sound-ir
2 parents 9917c3c + 85968e3 commit 3d96206

File tree

218 files changed

+3605
-3585
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

218 files changed

+3605
-3585
lines changed

‎MODULE.bazel

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ pip.parse(
3131
use_repo(pip, "codegen_deps")
3232

3333
swift_deps = use_extension("//swift/third_party:load.bzl", "swift_deps")
34+
35+
# following list can be kept in sync with `bazel mod tidy`
3436
use_repo(
3537
swift_deps,
3638
"binlog",

‎cpp/ql/lib/qlpack.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ dependencies:
99
codeql/dataflow: ${workspace}
1010
codeql/rangeanalysis: ${workspace}
1111
codeql/ssa: ${workspace}
12+
codeql/typeflow: ${workspace}
1213
codeql/tutorial: ${workspace}
1314
codeql/util: ${workspace}
1415
codeql/xml: ${workspace}

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ private import DataFlowImplCommon as DataFlowImplCommon
66
private import DataFlowUtil
77
private import semmle.code.cpp.models.interfaces.PointerWrapper
88
private import DataFlowPrivate
9+
private import TypeFlow
910
private import semmle.code.cpp.ir.ValueNumbering
1011

1112
/**
@@ -955,11 +956,7 @@ private module Cached {
955956
* Holds if the address computed by `operand` is guaranteed to write
956957
* to a specific address.
957958
*/
958-
private predicate isCertainAddress(Operand operand) {
959-
valueNumberOfOperand(operand).getAnInstruction() instanceof VariableAddressInstruction
960-
or
961-
operand.getType() instanceof Cpp::ReferenceType
962-
}
959+
private predicate isCertainAddress(Operand operand) { isPointerToSingleObject(operand.getDef()) }
963960

964961
/**
965962
* Holds if `address` is a use of an SSA variable rooted at `base`, and the

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TypeFlow.qll

Lines changed: 278 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
private import cpp
2+
private import semmle.code.cpp.ir.IR
3+
private import codeql.typeflow.TypeFlow
4+
5+
private module Input implements TypeFlowInput<Location> {
6+
/** Holds if `alloc` dynamically allocates a single object. */
7+
private predicate isSingleObjectAllocation(AllocationExpr alloc) {
8+
// i.e., `new int`;
9+
alloc instanceof NewExpr
10+
or
11+
// i.e., `malloc(sizeof(int))`
12+
exists(SizeofTypeOperator sizeOf | sizeOf = alloc.getSizeExpr() |
13+
not sizeOf.getTypeOperand().getUnspecifiedType() instanceof ArrayType
14+
)
15+
}
16+
17+
/**
18+
* Holds if `i` is the result of a dynamic allocation.
19+
*
20+
* `isObject` is `true` if the allocation allocated a single object,
21+
* and `false` otherwise.
22+
*/
23+
private predicate isAllocation(Instruction i, boolean isObject) {
24+
exists(AllocationExpr alloc | alloc = i.getUnconvertedResultExpression() |
25+
if isSingleObjectAllocation(alloc) then isObject = true else isObject = false
26+
)
27+
}
28+
29+
private predicate hasExactSingleType(Instruction i) {
30+
// The address of a variable is always a single object
31+
i instanceof VariableAddressInstruction
32+
or
33+
// A reference always points to a single object
34+
i.getResultLanguageType().hasUnspecifiedType(any(ReferenceType rt), false)
35+
or
36+
// `this` is never an array
37+
i instanceof InitializeThisInstruction
38+
or
39+
// An allocation of a non-array object
40+
isAllocation(i, true)
41+
}
42+
43+
private predicate hasExactBufferType(Instruction i) {
44+
// Anything with an array type is a buffer
45+
i.getResultLanguageType().hasUnspecifiedType(any(ArrayType at), false)
46+
or
47+
// An allocation expression that we couldn't conclude allocated a single
48+
// expression is assigned a buffer type.
49+
isAllocation(i, false)
50+
}
51+
52+
private newtype TTypeFlowNode =
53+
TInstructionNode(Instruction i) or
54+
TFunctionNode(IRFunction func)
55+
56+
abstract class TypeFlowNode extends TTypeFlowNode {
57+
/** Gets a textual representation of this node. */
58+
abstract string toString();
59+
60+
/**
61+
* Gets the type of this node. This type may not be the most precise
62+
* possible type, but will be used as a starting point of the analysis.
63+
*/
64+
abstract Type getType();
65+
66+
/** Gets the location of this node. */
67+
abstract Location getLocation();
68+
69+
/** Gets the underlying `Instruction` of this node, if any. */
70+
Instruction asInstruction() { none() }
71+
72+
/** Gets the underlying `IRFunction` of this node, if any. */
73+
IRFunction asFunction() { none() }
74+
75+
/** Holds if the value of this node is always null. */
76+
abstract predicate isNullValue();
77+
}
78+
79+
private class InstructionNode extends TypeFlowNode, TInstructionNode {
80+
Instruction instr;
81+
82+
InstructionNode() { this = TInstructionNode(instr) }
83+
84+
override string toString() { result = instr.toString() }
85+
86+
override Type getType() {
87+
if hasExactSingleType(instr) then result.isSingle() else result.isBuffer()
88+
}
89+
90+
override Location getLocation() { result = instr.getLocation() }
91+
92+
override Instruction asInstruction() { result = instr }
93+
94+
override predicate isNullValue() {
95+
instr.(ConstantInstruction).getValue() = "0" and
96+
instr.getResultIRType() instanceof IRAddressType
97+
}
98+
}
99+
100+
/** Gets the `TypeFlowNode` corresponding to `i`. */
101+
additional InstructionNode instructionNode(Instruction i) { result.asInstruction() = i }
102+
103+
private class FunctionNode extends TypeFlowNode, TFunctionNode {
104+
IRFunction func;
105+
106+
FunctionNode() { this = TFunctionNode(func) }
107+
108+
override string toString() { result = func.toString() }
109+
110+
Instruction getReturnValueInstruction() {
111+
result = func.getReturnInstruction().(ReturnValueInstruction).getReturnValue()
112+
}
113+
114+
override Type getType() { result = instructionNode(this.getReturnValueInstruction()).getType() }
115+
116+
override Location getLocation() { result = func.getLocation() }
117+
118+
override IRFunction asFunction() { result = func }
119+
120+
override predicate isNullValue() {
121+
instructionNode(this.getReturnValueInstruction()).isNullValue()
122+
}
123+
}
124+
125+
/**
126+
* Gets an ultimiate definition of `phi`. That is, an input to `phi` that is
127+
* not itself a `PhiInstruction`.
128+
*/
129+
private Instruction getAnUltimateLocalDefinition(PhiInstruction phi) {
130+
result = phi.getAnInput*() and not result instanceof PhiInstruction
131+
}
132+
133+
/**
134+
* Holds if this function is private (i.e., cannot be accessed outside its
135+
* compilation unit). This means we can use a closed-world assumption about
136+
* calls to this function.
137+
*/
138+
private predicate isPrivate(Function func) {
139+
// static functions have internal linkage
140+
func.isStatic()
141+
or
142+
// anonymous namespaces have internal linkage
143+
func.getNamespace().getParentNamespace*().isAnonymous()
144+
or
145+
// private member functions are only called internally from inside the class
146+
func.(MemberFunction).isPrivate()
147+
}
148+
149+
/**
150+
* Holds if `arg` is an argument for the parameter `p` in a private callable.
151+
*/
152+
pragma[nomagic]
153+
private predicate privateParamArg(InitializeParameterInstruction p, Instruction arg) {
154+
exists(CallInstruction call, int i, Function func |
155+
call.getArgument(pragma[only_bind_into](i)) = arg and
156+
func = call.getStaticCallTarget() and
157+
func.getParameter(pragma[only_bind_into](i)) = p.getParameter() and
158+
isPrivate(func)
159+
)
160+
}
161+
162+
predicate joinStep(TypeFlowNode n1, TypeFlowNode n2) {
163+
// instruction -> phi
164+
getAnUltimateLocalDefinition(n2.asInstruction()) = n1.asInstruction()
165+
or
166+
// return value -> function
167+
n2.(FunctionNode).getReturnValueInstruction() = n1.asInstruction()
168+
or
169+
// function -> call
170+
exists(Function func | func = n1.asFunction().getFunction() |
171+
not func.isVirtual() and
172+
n2.asInstruction().(CallInstruction).getStaticCallTarget() = func
173+
)
174+
or
175+
// Argument -> parameter where the parameter's enclosing function
176+
// is "private".
177+
exists(Instruction arg, Instruction p |
178+
privateParamArg(p, arg) and
179+
n1.asInstruction() = arg and
180+
n2.asInstruction() = p
181+
)
182+
}
183+
184+
/**
185+
* Holds if knowing whether `i1` points to a single object or buffer implies
186+
* knowing whether `i2` points to a single object or buffer.
187+
*/
188+
private predicate instructionStep(Instruction i1, Instruction i2) {
189+
i2.(CopyInstruction).getSourceValue() = i1
190+
or
191+
i2.(CopyValueInstruction).getSourceValue() = i1
192+
or
193+
i2.(ConvertInstruction).getUnary() = i1
194+
or
195+
i2.(CheckedConvertOrNullInstruction).getUnary() = i1
196+
or
197+
i2.(InheritanceConversionInstruction).getUnary() = i1
198+
or
199+
i2.(PointerArithmeticInstruction).getLeft() = i1
200+
}
201+
202+
predicate step(TypeFlowNode n1, TypeFlowNode n2) {
203+
instructionStep(n1.asInstruction(), n2.asInstruction())
204+
}
205+
206+
predicate isNullValue(TypeFlowNode n) { n.isNullValue() }
207+
208+
private newtype TType =
209+
TSingle() or
210+
TBuffer()
211+
212+
class Type extends TType {
213+
string toString() {
214+
this.isSingle() and
215+
result = "Single"
216+
or
217+
this.isBuffer() and
218+
result = "Buffer"
219+
}
220+
221+
/** Holds if this type is the type that represents a single object. */
222+
predicate isSingle() { this = TSingle() }
223+
224+
/** Holds if this type is the type that represents a buffer. */
225+
predicate isBuffer() { this = TBuffer() }
226+
227+
/**
228+
* Gets a super type of this type, if any.
229+
*
230+
* The type relation is `Single <: Buffer`.
231+
*/
232+
Type getASupertype() {
233+
this.isSingle() and
234+
result.isBuffer()
235+
}
236+
}
237+
238+
predicate exactTypeBase(TypeFlowNode n, Type t) {
239+
exists(Instruction instr | instr = n.asInstruction() |
240+
hasExactSingleType(instr) and t.isSingle()
241+
or
242+
hasExactBufferType(instr) and t.isBuffer()
243+
)
244+
}
245+
246+
pragma[nomagic]
247+
private predicate upcastCand(TypeFlowNode n, Type t1, Type t2) {
248+
exists(TypeFlowNode next |
249+
step(n, next)
250+
or
251+
joinStep(n, next)
252+
|
253+
n.getType() = t1 and
254+
next.getType() = t2 and
255+
t1 != t2
256+
)
257+
}
258+
259+
private predicate upcast(TypeFlowNode n, Type t1) {
260+
exists(Type t2 | upcastCand(n, t1, t2) |
261+
// No need for transitive closure since the subtyping relation is just `Single <: Buffer`
262+
t1.getASupertype() = t2
263+
)
264+
}
265+
266+
predicate typeFlowBaseCand(TypeFlowNode n, Type t) { upcast(n, t) }
267+
}
268+
269+
private module TypeFlow = Make<Location, Input>;
270+
271+
/**
272+
* Holds if `i` is an instruction that computes an address that points to a
273+
* single object (as opposed to pointing into a buffer).
274+
*/
275+
pragma[nomagic]
276+
predicate isPointerToSingleObject(Instruction i) {
277+
TypeFlow::bestTypeFlow(Input::instructionNode(i), any(Input::Type t | t.isSingle()), _)
278+
}

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -506,8 +506,7 @@ private module IRDeclarationEntries {
506506
* An entity that represents a declaration entry in the database.
507507
*
508508
* This class exists to work around the fact that `DeclStmt`s in some cases
509-
* do not have `DeclarationEntry`s. Currently, this is the case for:
510-
* - `DeclStmt`s in template instantiations.
509+
* do not have `DeclarationEntry`s in older databases.
511510
*
512511
* So instead, the IR works with `IRDeclarationEntry`s that synthesize missing
513512
* `DeclarationEntry`s when there is no result for `DeclStmt::getDeclarationEntry`.

0 commit comments

Comments
 (0)