Skip to content

Commit 73c4fe0

Browse files
MathiasVPMathiasVP
authored
Merge pull request #15835 from MathiasVP/initial-def-of-addresses
C++: Provide an initial SSA definition of the address of a variable
2 parents 00c2285 + a548316 commit 73c4fe0

File tree

12 files changed

+277
-29
lines changed

12 files changed

+277
-29
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

Lines changed: 49 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ predicate hasRawIndirectInstruction(Instruction instr, int indirectionIndex) {
103103

104104
cached
105105
private newtype TDefOrUseImpl =
106+
TDefAddressImpl(BaseIRVariable v) or
106107
TDefImpl(BaseSourceVariableInstruction base, Operand address, int indirectionIndex) {
107108
isDef(_, _, address, base, _, indirectionIndex)
108109
} or
@@ -256,23 +257,63 @@ private predicate sourceVariableHasBaseAndIndex(SourceVariable v, BaseSourceVari
256257
}
257258

258259
abstract class DefImpl extends DefOrUseImpl {
259-
Operand address;
260260
int ind;
261261

262262
bindingset[ind]
263263
DefImpl() { any() }
264264

265+
override int getIndirectionIndex() { result = ind }
266+
267+
override string toString() { result = "Def of " + this.getSourceVariable() }
268+
265269
abstract int getIndirection();
266270

271+
abstract predicate isCertain();
272+
267273
abstract Node0Impl getValue();
274+
}
268275

269-
abstract predicate isCertain();
276+
/** An initial definition of an `IRVariable`'s address. */
277+
private class DefAddressImpl extends DefImpl, TDefAddressImpl {
278+
BaseIRVariable v;
270279

271-
Operand getAddressOperand() { result = address }
280+
DefAddressImpl() {
281+
this = TDefAddressImpl(v) and
282+
ind = 0
283+
}
272284

273-
override int getIndirectionIndex() { result = ind }
285+
final override int getIndirection() { result = 0 }
274286

275-
override string toString() { result = "Def of " + this.getSourceVariable() }
287+
final override predicate isCertain() { any() }
288+
289+
final override Node0Impl getValue() { none() }
290+
291+
final override predicate hasIndexInBlock(IRBlock block, int index) {
292+
block = v.getIRVariable().getEnclosingIRFunction().getEntryBlock() and
293+
index = 0
294+
}
295+
296+
override Cpp::Location getLocation() { result = v.getIRVariable().getLocation() }
297+
298+
final override SourceVariable getSourceVariable() {
299+
result.getBaseVariable() = v and
300+
result.getIndirection() = 0
301+
}
302+
303+
final override BaseSourceVariableInstruction getBase() { none() }
304+
}
305+
306+
/**
307+
* An SSA definition that has an associated `Operand` representing the address
308+
* that is being written to.
309+
*/
310+
abstract private class OperandBasedDef extends DefImpl {
311+
Operand address;
312+
313+
bindingset[ind]
314+
OperandBasedDef() { any() }
315+
316+
Operand getAddressOperand() { result = address }
276317

277318
override Cpp::Location getLocation() { result = this.getAddressOperand().getUse().getLocation() }
278319

@@ -281,7 +322,7 @@ abstract class DefImpl extends DefOrUseImpl {
281322
}
282323
}
283324

284-
private class DirectDef extends DefImpl, TDefImpl {
325+
private class DirectDef extends OperandBasedDef, TDefImpl {
285326
BaseSourceVariableInstruction base;
286327

287328
DirectDef() { this = TDefImpl(base, address, ind) }
@@ -295,7 +336,7 @@ private class DirectDef extends DefImpl, TDefImpl {
295336
override predicate isCertain() { isDef(true, _, address, base, _, ind) }
296337
}
297338

298-
private class IteratorDef extends DefImpl, TIteratorDef {
339+
private class IteratorDef extends OperandBasedDef, TIteratorDef {
299340
BaseSourceVariableInstruction container;
300341

301342
IteratorDef() { this = TIteratorDef(address, container, ind) }
@@ -1178,7 +1219,7 @@ class UseOrPhi extends SsaDefOrUse {
11781219
class Def extends DefOrUse {
11791220
override DefImpl defOrUse;
11801221

1181-
Operand getAddressOperand() { result = defOrUse.getAddressOperand() }
1222+
Operand getAddressOperand() { result = defOrUse.(OperandBasedDef).getAddressOperand() }
11821223

11831224
Instruction getAddress() { result = this.getAddressOperand().getDef() }
11841225

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,8 @@ postWithInFlow
166166
| test.cpp:932:5:932:19 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
167167
| test.cpp:932:6:932:19 | global_pointer [inner post update] | PostUpdateNode should not be the target of local flow. |
168168
| test.cpp:1045:9:1045:11 | ref arg buf | PostUpdateNode should not be the target of local flow. |
169+
| test.cpp:1051:5:1051:11 | content [post update] | PostUpdateNode should not be the target of local flow. |
170+
| test.cpp:1052:9:1052:9 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
169171
viableImplInCallContextTooLarge
170172
uniqueParameterNodeAtPosition
171173
uniqueParameterNodePosition

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.expected

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
| example.c:15:37:15:37 | **b | example.c:15:37:15:37 | **b |
2+
| example.c:15:37:15:37 | **b | example.c:15:37:15:37 | **b |
3+
| example.c:15:37:15:37 | **b | example.c:15:37:15:37 | *b |
4+
| example.c:15:37:15:37 | **b | example.c:19:6:19:6 | *b |
5+
| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | **b |
6+
| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | *b |
7+
| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | *b |
8+
| example.c:15:37:15:37 | *b | example.c:15:37:15:37 | b |
9+
| example.c:15:37:15:37 | *b | example.c:19:6:19:6 | b |
10+
| example.c:15:37:15:37 | b | example.c:15:37:15:37 | *b |
11+
| example.c:15:37:15:37 | b | example.c:15:37:15:37 | b |
12+
| example.c:15:37:15:37 | b | example.c:15:37:15:37 | b |
13+
| example.c:15:37:15:37 | b | example.c:19:6:19:6 | b |
14+
| example.c:15:44:15:46 | pos | example.c:24:24:24:26 | pos |
15+
| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
16+
| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
17+
| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
18+
| example.c:17:11:17:16 | *definition of coords | example.c:17:11:17:16 | *definition of coords |
19+
| example.c:17:11:17:16 | *definition of coords | example.c:24:13:24:18 | *coords |
20+
| example.c:17:11:17:16 | *definition of coords [post update] | example.c:17:11:17:16 | *definition of coords |
21+
| example.c:17:11:17:16 | *definition of coords [post update] | example.c:24:13:24:18 | *coords |
22+
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | *definition of coords |
23+
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
24+
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
25+
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
26+
| example.c:17:11:17:16 | definition of coords | example.c:17:11:17:16 | definition of coords |
27+
| example.c:17:11:17:16 | definition of coords | example.c:24:13:24:18 | coords |
28+
| example.c:17:11:17:16 | definition of coords [post update] | example.c:17:11:17:16 | definition of coords |
29+
| example.c:17:11:17:16 | definition of coords [post update] | example.c:24:13:24:18 | coords |
30+
| example.c:17:19:17:22 | {...} | example.c:17:19:17:22 | {...} |
31+
| example.c:17:21:17:21 | 0 | example.c:17:21:17:21 | 0 |
32+
| example.c:19:6:19:6 | *b | example.c:15:37:15:37 | *b |
33+
| example.c:19:6:19:6 | *b [post update] | example.c:15:37:15:37 | *b |
34+
| example.c:19:6:19:6 | *b [post update] | example.c:19:6:19:6 | *b |
35+
| example.c:19:6:19:6 | b [post update] | example.c:19:6:19:6 | b |
36+
| example.c:24:2:24:7 | *coords | example.c:26:18:26:24 | *& ... |
37+
| example.c:24:2:24:7 | *coords [post update] | example.c:26:18:26:24 | *& ... |
38+
| example.c:24:2:24:7 | coords | example.c:26:18:26:24 | & ... |
39+
| example.c:24:2:24:7 | coords [post update] | example.c:26:18:26:24 | & ... |
40+
| example.c:24:13:24:18 | *coords | example.c:24:2:24:7 | *coords |
41+
| example.c:24:13:24:18 | *coords [post update] | example.c:24:2:24:7 | *coords |
42+
| example.c:24:13:24:18 | coords | example.c:24:2:24:7 | coords |
43+
| example.c:24:13:24:18 | coords [post update] | example.c:24:2:24:7 | coords |
44+
| example.c:24:13:24:30 | ... = ... | example.c:24:2:24:30 | ... = ... |
45+
| example.c:24:20:24:20 | *y | example.c:24:20:24:20 | *y |
46+
| example.c:24:20:24:20 | y | example.c:24:20:24:20 | y |
47+
| example.c:24:20:24:20 | y | example.c:24:20:24:20 | y |
48+
| example.c:24:24:24:26 | pos | example.c:28:14:28:25 | & ... |
49+
| example.c:24:24:24:26 | pos | example.c:28:14:28:25 | *& ... |
50+
| example.c:24:24:24:30 | ... + ... | example.c:24:13:24:30 | ... = ... |
51+
| example.c:26:13:26:16 | call to getX | example.c:26:2:26:25 | ... = ... |
52+
| example.c:26:18:26:24 | & ... | example.c:26:2:26:7 | coords |
53+
| example.c:26:18:26:24 | *& ... | example.c:26:2:26:7 | *coords |
54+
| example.c:26:18:26:24 | getX output argument | example.c:26:2:26:7 | *coords |
55+
| example.c:26:18:26:24 | pointer to getX output argument | example.c:26:2:26:7 | coords |
56+
| example.c:26:19:26:24 | *coords | example.c:26:18:26:24 | *& ... |
57+
| example.c:26:19:26:24 | coords | example.c:26:18:26:24 | & ... |
58+
| example.c:28:22:28:25 | & ... | example.c:28:14:28:25 | & ... |
59+
| example.c:28:22:28:25 | *& ... | example.c:28:14:28:25 | *& ... |
60+
| example.c:28:23:28:25 | *pos | example.c:28:22:28:25 | *& ... |
61+
| example.c:28:23:28:25 | pos | example.c:28:22:28:25 | & ... |
62+
| test.cpp:6:12:6:17 | call to source | test.cpp:6:12:6:17 | call to source |
63+
| test.cpp:6:12:6:17 | call to source | test.cpp:7:8:7:9 | t1 |
64+
| test.cpp:7:8:7:9 | t1 | test.cpp:8:8:8:9 | t1 |
65+
| test.cpp:7:8:7:9 | t1 | test.cpp:8:8:8:9 | t1 |
66+
| test.cpp:8:3:8:9 | ... = ... | test.cpp:10:8:10:9 | t2 |
67+
| test.cpp:8:8:8:9 | t1 | test.cpp:8:3:8:9 | ... = ... |
68+
| test.cpp:8:8:8:9 | t1 | test.cpp:9:8:9:9 | t1 |
69+
| test.cpp:8:8:8:9 | t1 | test.cpp:9:8:9:9 | t1 |
70+
| test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
71+
| test.cpp:9:8:9:9 | t1 | test.cpp:11:7:11:8 | t1 |
72+
| test.cpp:10:8:10:9 | t2 | test.cpp:13:10:13:11 | t2 |
73+
| test.cpp:10:8:10:9 | t2 | test.cpp:15:3:15:6 | Phi |
74+
| test.cpp:10:8:10:9 | t2 | test.cpp:15:3:15:6 | Phi |
75+
| test.cpp:11:7:11:8 | t1 | test.cpp:21:8:21:9 | t1 |
76+
| test.cpp:12:5:12:10 | ... = ... | test.cpp:13:10:13:11 | t2 |
77+
| test.cpp:12:10:12:10 | 0 | test.cpp:12:5:12:10 | ... = ... |
78+
| test.cpp:13:10:13:11 | t2 | test.cpp:15:3:15:6 | Phi |
79+
| test.cpp:13:10:13:11 | t2 | test.cpp:15:3:15:6 | Phi |
80+
| test.cpp:15:3:15:6 | Phi | test.cpp:15:8:15:9 | t2 |
81+
| test.cpp:15:3:15:6 | Phi | test.cpp:15:8:15:9 | t2 |
82+
| test.cpp:15:8:15:9 | t2 | test.cpp:23:19:23:19 | Phi |
83+
| test.cpp:15:8:15:9 | t2 | test.cpp:23:19:23:19 | Phi |
84+
| test.cpp:17:3:17:8 | ... = ... | test.cpp:21:8:21:9 | t1 |
85+
| test.cpp:17:8:17:8 | 0 | test.cpp:17:3:17:8 | ... = ... |
86+
| test.cpp:21:8:21:9 | t1 | test.cpp:23:19:23:19 | Phi |
87+
| test.cpp:21:8:21:9 | t1 | test.cpp:23:19:23:19 | Phi |
88+
| test.cpp:23:15:23:16 | 0 | test.cpp:23:15:23:16 | 0 |
89+
| test.cpp:23:15:23:16 | 0 | test.cpp:23:19:23:19 | Phi |
90+
| test.cpp:23:19:23:19 | Phi | test.cpp:23:19:23:19 | i |
91+
| test.cpp:23:19:23:19 | Phi | test.cpp:23:19:23:19 | i |
92+
| test.cpp:23:19:23:19 | Phi | test.cpp:23:23:23:24 | t1 |
93+
| test.cpp:23:19:23:19 | Phi | test.cpp:23:23:23:24 | t1 |
94+
| test.cpp:23:19:23:19 | Phi | test.cpp:24:10:24:11 | t2 |
95+
| test.cpp:23:19:23:19 | Phi | test.cpp:24:10:24:11 | t2 |
96+
| test.cpp:23:19:23:19 | i | test.cpp:23:27:23:27 | i |
97+
| test.cpp:23:19:23:19 | i | test.cpp:23:27:23:27 | i |
98+
| test.cpp:23:23:23:24 | t1 | test.cpp:23:19:23:19 | Phi |
99+
| test.cpp:23:23:23:24 | t1 | test.cpp:26:8:26:9 | t1 |
100+
| test.cpp:23:23:23:24 | t1 | test.cpp:26:8:26:9 | t1 |
101+
| test.cpp:23:27:23:27 | *i | test.cpp:23:27:23:27 | *i |
102+
| test.cpp:23:27:23:27 | *i | test.cpp:23:27:23:27 | i |
103+
| test.cpp:23:27:23:27 | i | test.cpp:23:19:23:19 | Phi |
104+
| test.cpp:23:27:23:27 | i | test.cpp:23:27:23:27 | i |
105+
| test.cpp:23:27:23:27 | i | test.cpp:23:27:23:27 | i |
106+
| test.cpp:23:27:23:29 | ... ++ | test.cpp:23:19:23:19 | Phi |
107+
| test.cpp:23:27:23:29 | ... ++ | test.cpp:23:27:23:29 | ... ++ |
108+
| test.cpp:24:5:24:11 | ... = ... | test.cpp:23:19:23:19 | Phi |
109+
| test.cpp:24:10:24:11 | t2 | test.cpp:23:19:23:19 | Phi |
110+
| test.cpp:24:10:24:11 | t2 | test.cpp:23:19:23:19 | Phi |
111+
| test.cpp:24:10:24:11 | t2 | test.cpp:24:5:24:11 | ... = ... |
112+
| test.cpp:382:48:382:54 | source1 | test.cpp:384:16:384:23 | *& ... |
113+
| test.cpp:383:12:383:13 | 0 | test.cpp:383:12:383:13 | 0 |
114+
| test.cpp:383:12:383:13 | 0 | test.cpp:384:10:384:13 | *& ... |
115+
| test.cpp:384:10:384:13 | & ... | test.cpp:384:3:384:8 | call to memcpy |
116+
| test.cpp:384:10:384:13 | & ... | test.cpp:384:10:384:13 | & ... |
117+
| test.cpp:384:10:384:13 | & ... | test.cpp:385:8:385:10 | tmp |
118+
| test.cpp:384:10:384:13 | *& ... | test.cpp:384:10:384:13 | *& ... |
119+
| test.cpp:384:10:384:13 | memcpy output argument | test.cpp:385:8:385:10 | tmp |
120+
| test.cpp:384:10:384:13 | pointer to memcpy output argument | test.cpp:385:8:385:10 | tmp |
121+
| test.cpp:384:11:384:13 | *tmp | test.cpp:384:10:384:13 | *& ... |
122+
| test.cpp:384:11:384:13 | tmp | test.cpp:384:10:384:13 | & ... |
123+
| test.cpp:384:16:384:23 | & ... | test.cpp:384:16:384:23 | & ... |
124+
| test.cpp:384:16:384:23 | *& ... | test.cpp:384:3:384:8 | **call to memcpy |
125+
| test.cpp:384:16:384:23 | *& ... | test.cpp:384:3:384:8 | *call to memcpy |
126+
| test.cpp:384:16:384:23 | *& ... | test.cpp:384:10:384:13 | memcpy output argument |
127+
| test.cpp:384:16:384:23 | *& ... | test.cpp:384:16:384:23 | *& ... |
128+
| test.cpp:384:16:384:23 | **(const void *)... | test.cpp:384:3:384:8 | **call to memcpy |
129+
| test.cpp:384:16:384:23 | **(const void *)... | test.cpp:384:10:384:13 | memcpy output argument |
130+
| test.cpp:384:17:384:23 | *source1 | test.cpp:384:16:384:23 | *& ... |
131+
| test.cpp:384:17:384:23 | source1 | test.cpp:384:16:384:23 | & ... |
132+
| test.cpp:388:53:388:59 | source1 | test.cpp:391:16:391:23 | *& ... |
133+
| test.cpp:388:66:388:66 | b | test.cpp:393:7:393:7 | b |
134+
| test.cpp:389:12:389:13 | 0 | test.cpp:389:12:389:13 | 0 |
135+
| test.cpp:389:12:389:13 | 0 | test.cpp:390:18:390:21 | *& ... |
136+
| test.cpp:390:18:390:21 | & ... | test.cpp:390:18:390:21 | & ... |
137+
| test.cpp:390:18:390:21 | & ... | test.cpp:391:10:391:13 | & ... |
138+
| test.cpp:390:18:390:21 | *& ... | test.cpp:390:18:390:21 | *& ... |
139+
| test.cpp:390:18:390:21 | *& ... | test.cpp:391:10:391:13 | *& ... |
140+
| test.cpp:390:19:390:21 | *tmp | test.cpp:390:18:390:21 | *& ... |
141+
| test.cpp:390:19:390:21 | tmp | test.cpp:390:18:390:21 | & ... |
142+
| test.cpp:391:10:391:13 | & ... | test.cpp:391:3:391:8 | call to memcpy |
143+
| test.cpp:391:10:391:13 | & ... | test.cpp:391:10:391:13 | & ... |
144+
| test.cpp:391:10:391:13 | & ... | test.cpp:392:8:392:10 | tmp |
145+
| test.cpp:391:10:391:13 | *& ... | test.cpp:391:10:391:13 | *& ... |
146+
| test.cpp:391:10:391:13 | memcpy output argument | test.cpp:392:8:392:10 | tmp |
147+
| test.cpp:391:10:391:13 | pointer to memcpy output argument | test.cpp:392:8:392:10 | tmp |
148+
| test.cpp:391:11:391:13 | *tmp | test.cpp:391:10:391:13 | *& ... |
149+
| test.cpp:391:11:391:13 | tmp | test.cpp:391:10:391:13 | & ... |
150+
| test.cpp:391:16:391:23 | & ... | test.cpp:391:16:391:23 | & ... |
151+
| test.cpp:391:16:391:23 | *& ... | test.cpp:391:3:391:8 | **call to memcpy |
152+
| test.cpp:391:16:391:23 | *& ... | test.cpp:391:3:391:8 | *call to memcpy |
153+
| test.cpp:391:16:391:23 | *& ... | test.cpp:391:10:391:13 | memcpy output argument |
154+
| test.cpp:391:16:391:23 | *& ... | test.cpp:391:16:391:23 | *& ... |
155+
| test.cpp:391:16:391:23 | **(const void *)... | test.cpp:391:3:391:8 | **call to memcpy |
156+
| test.cpp:391:16:391:23 | **(const void *)... | test.cpp:391:10:391:13 | memcpy output argument |
157+
| test.cpp:391:17:391:23 | *source1 | test.cpp:391:16:391:23 | *& ... |
158+
| test.cpp:391:17:391:23 | source1 | test.cpp:391:16:391:23 | & ... |
159+
| test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
160+
| test.cpp:392:8:392:10 | tmp | test.cpp:394:10:394:12 | tmp |
161+
| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | **s |
162+
| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | **s |
163+
| test.cpp:487:67:487:67 | **s | test.cpp:487:67:487:67 | *s |
164+
| test.cpp:487:67:487:67 | **s | test.cpp:488:21:488:21 | *s |
165+
| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | **s |
166+
| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | *s |
167+
| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | *s |
168+
| test.cpp:487:67:487:67 | *s | test.cpp:487:67:487:67 | s |
169+
| test.cpp:487:67:487:67 | *s | test.cpp:488:21:488:21 | s |
170+
| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | *s |
171+
| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | s |
172+
| test.cpp:487:67:487:67 | s | test.cpp:487:67:487:67 | s |
173+
| test.cpp:487:67:487:67 | s | test.cpp:488:21:488:21 | s |
174+
| test.cpp:488:21:488:21 | *s | test.cpp:489:20:489:20 | *s |
175+
| test.cpp:488:21:488:21 | *s [post update] | test.cpp:489:20:489:20 | *s |
176+
| test.cpp:488:21:488:21 | s | test.cpp:489:20:489:20 | s |
177+
| test.cpp:488:21:488:21 | s | test.cpp:489:20:489:20 | s |
178+
| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
179+
| test.cpp:488:24:488:30 | *content | test.cpp:488:21:488:30 | *content |
180+
| test.cpp:488:24:488:30 | content | test.cpp:488:21:488:30 | content |
181+
| test.cpp:489:20:489:20 | *s | test.cpp:487:67:487:67 | *s |
182+
| test.cpp:489:20:489:20 | *s [post update] | test.cpp:487:67:487:67 | *s |
183+
| test.cpp:489:20:489:20 | *s [post update] | test.cpp:489:20:489:20 | *s |
184+
| test.cpp:489:20:489:20 | s [post update] | test.cpp:489:20:489:20 | s |
185+
| test.cpp:489:23:489:29 | *content | test.cpp:489:23:489:29 | *content |
186+
| test.cpp:489:23:489:29 | *content | test.cpp:490:8:490:17 | * ... |
187+
| test.cpp:489:23:489:29 | content | test.cpp:489:23:489:29 | content |
188+
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
189+
| test.cpp:1050:12:1050:12 | definition of a | test.cpp:1051:3:1051:3 | *a |
190+
| test.cpp:1051:3:1051:3 | *a | test.cpp:1052:8:1052:9 | *& ... |
191+
| test.cpp:1051:3:1051:3 | *a [post update] | test.cpp:1052:8:1052:9 | *& ... |
192+
| test.cpp:1051:3:1051:3 | a | test.cpp:1052:8:1052:9 | & ... |
193+
| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:8:1052:9 | & ... |
194+
| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
195+
| test.cpp:1051:15:1051:21 | *0 | test.cpp:1051:3:1051:21 | *... = ... |
196+
| test.cpp:1052:9:1052:9 | *a | test.cpp:1052:8:1052:9 | *& ... |
197+
| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow-ir.ql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
import cpp
2+
import semmle.code.cpp.dataflow.new.DataFlow
3+
4+
from DataFlow::Node nodeFrom, DataFlow::Node nodeTo
5+
where
6+
DataFlow::localFlowStep(nodeFrom, nodeTo) and
7+
nodeFrom.getFunction().getName().matches("%\\_with\\_local\\_flow")
8+
select nodeFrom, nodeTo

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/localFlow.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,3 +81,10 @@ WARNING: Module DataFlow has been deprecated and may be removed in future (local
8181
| test.cpp:488:21:488:21 | s [post update] | test.cpp:489:20:489:20 | s |
8282
| test.cpp:488:24:488:30 | ref arg content | test.cpp:489:23:489:29 | content |
8383
| test.cpp:489:23:489:29 | content | test.cpp:490:9:490:17 | p_content |
84+
| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
85+
| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |
86+
| test.cpp:1051:3:1051:3 | a [post update] | test.cpp:1052:9:1052:9 | a |
87+
| test.cpp:1051:3:1051:21 | ... = ... | test.cpp:1051:5:1051:11 | content [post update] |
88+
| test.cpp:1051:15:1051:21 | 0 | test.cpp:1051:3:1051:21 | ... = ... |
89+
| test.cpp:1052:8:1052:9 | ref arg & ... | test.cpp:1052:9:1052:9 | a [inner post update] |
90+
| test.cpp:1052:9:1052:9 | a | test.cpp:1052:8:1052:9 | & ... |

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@ astFlow
123123
| test.cpp:842:11:842:16 | call to source | test.cpp:844:8:844:8 | y |
124124
| test.cpp:846:13:846:27 | call to indirect_source | test.cpp:848:23:848:25 | rpx |
125125
| test.cpp:860:54:860:59 | call to source | test.cpp:861:10:861:37 | static_local_pointer_dynamic |
126+
| test.cpp:1050:12:1050:12 | a | test.cpp:1052:8:1052:9 | & ... |
126127
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
127128
| true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x |
128129
| true_upon_entry.cpp:33:11:33:16 | call to source | true_upon_entry.cpp:39:8:39:8 | x |

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1044,4 +1044,10 @@ void* memset(void*, int, size_t);
10441044
void memset_test(char* buf) { // $ ast-def=buf ir-def=*buf
10451045
memset(buf, source(), 10);
10461046
sink(*buf); // $ ir MISSING: ast
1047+
}
1048+
1049+
void flow_out_of_address_with_local_flow() {
1050+
MyStruct a;
1051+
a.content = nullptr;
1052+
sink(&a); // $ SPURIOUS: ast
10471053
}

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/uninitialized.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,5 @@
5454
| test.cpp:796:12:796:12 | a | test.cpp:797:20:797:20 | a |
5555
| test.cpp:796:12:796:12 | a | test.cpp:797:31:797:31 | a |
5656
| test.cpp:796:12:796:12 | a | test.cpp:798:17:798:17 | a |
57+
| test.cpp:1050:12:1050:12 | a | test.cpp:1051:3:1051:3 | a |
58+
| test.cpp:1050:12:1050:12 | a | test.cpp:1052:9:1052:9 | a |

0 commit comments

Comments
 (0)