@@ -184,24 +184,46 @@ private class ArrayContent extends Content, TArrayContent {
184
184
override string toString ( ) { result = "array" }
185
185
}
186
186
187
+ private predicate storeStepNoChi ( Node node1 , Content f , PostUpdateNode node2 ) {
188
+ exists ( FieldAddressInstruction fa , StoreInstruction store |
189
+ store = node2 .asInstruction ( ) and
190
+ store .getDestinationAddress ( ) = fa and
191
+ store .getSourceValue ( ) = node1 .asInstruction ( ) and
192
+ f .( FieldContent ) .getField ( ) = fa .getField ( )
193
+ )
194
+ }
195
+
196
+ private predicate storeStepChi ( Node node1 , Content f , PostUpdateNode node2 ) {
197
+ exists ( FieldAddressInstruction fa , StoreInstruction store |
198
+ node1 .asInstruction ( ) = store and
199
+ store .getDestinationAddress ( ) = fa and
200
+ node2 .asInstruction ( ) .( ChiInstruction ) .getPartial ( ) = store and
201
+ f .( FieldContent ) .getField ( ) = fa .getField ( )
202
+ )
203
+ }
204
+
187
205
/**
188
206
* Holds if data can flow from `node1` to `node2` via an assignment to `f`.
189
207
* Thus, `node2` references an object with a field `f` that contains the
190
208
* value of `node1`.
191
209
*/
192
- predicate storeStep ( Node node1 , Content f , StoreStepNode node2 ) {
193
- node2 . getStoredValue ( ) = node1 and
194
- f . ( FieldContent ) . getField ( ) = node2 . getAField ( )
210
+ predicate storeStep ( Node node1 , Content f , PostUpdateNode node2 ) {
211
+ storeStepNoChi ( node1 , f , node2 ) or
212
+ storeStepChi ( node1 , f , node2 )
195
213
}
196
214
197
215
/**
198
216
* Holds if data can flow from `node1` to `node2` via a read of `f`.
199
217
* Thus, `node1` references an object with a field `f` whose value ends up in
200
218
* `node2`.
201
219
*/
202
- predicate readStep ( Node node1 , Content f , ReadStepNode node2 ) {
203
- node2 .getReadValue ( ) = node1 and
204
- f .( FieldContent ) .getField ( ) = node2 .getAField ( )
220
+ predicate readStep ( Node node1 , Content f , Node node2 ) {
221
+ exists ( FieldAddressInstruction fa , LoadInstruction load |
222
+ load .getSourceAddress ( ) = fa and
223
+ node1 .asInstruction ( ) = load .getSourceValueOperand ( ) .getAnyDef ( ) and
224
+ fa .getField ( ) = f .( FieldContent ) .getField ( ) and
225
+ load = node2 .asInstruction ( )
226
+ )
205
227
}
206
228
207
229
/**
0 commit comments