hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: treat this as a parameter in IR

Browse Source
This commit is contained in:
Robert Marsh
2020-05-22 12:35:19 -07:00
parent b9ecf1a304
commit 8a53dc882d
20 changed files with 1271 additions and 929 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll
View File

@@ -223,6 +223,16 @@ class IREllipsisVariable extends IRTempVariable {
final override string toString() { result = "#ellipsis" }
}
/**
* A temporary variable generated to hold the contents of all arguments passed to the `...` of a
* function that accepts a variable number of arguments.
*/
class IRThisVariable extends IRTempVariable {
IRThisVariable() { tag = ThisTempVar() }
final override string toString() { result = "#this" }
}
/**
* A variable generated to represent the contents of a string literal. This variable acts much like
* a read-only global variable.

2
cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll
View File

@@ -204,7 +204,7 @@ private predicate isArgumentForParameter(CallInstruction ci, Operand operand, In
init.(InitializeParameterInstruction).getParameter() =
f.getParameter(operand.(PositionalArgumentOperand).getIndex())
or
init instanceof InitializeThisInstruction and
init.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable and
init.getEnclosingFunction() = f and
operand instanceof ThisArgumentOperand
) and

4
cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasConfiguration.qll
View File

@@ -5,7 +5,7 @@ private import AliasAnalysis
private newtype TAllocation =
TVariableAllocation(IRVariable var) or
TIndirectParameterAllocation(IRAutomaticUserVariable var) {
TIndirectParameterAllocation(IRVariable var) {
exists(InitializeIndirectionInstruction instr | instr.getIRVariable() = var)
} or
TDynamicAllocation(CallInstruction call) {
@@ -74,7 +74,7 @@ class VariableAllocation extends Allocation, TVariableAllocation {
}
class IndirectParameterAllocation extends Allocation, TIndirectParameterAllocation {
IRAutomaticUserVariable var;
IRVariable var;
IndirectParameterAllocation() { this = TIndirectParameterAllocation(var) }

10
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll
View File

@@ -223,6 +223,16 @@ class IREllipsisVariable extends IRTempVariable {
final override string toString() { result = "#ellipsis" }
}
/**
* A temporary variable generated to hold the contents of all arguments passed to the `...` of a
* function that accepts a variable number of arguments.
*/
class IRThisVariable extends IRTempVariable {
IRThisVariable() { tag = ThisTempVar() }
final override string toString() { result = "#this" }
}
/**
* A variable generated to represent the contents of a string literal. This variable acts much like
* a read-only global variable.

5
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll
View File

@@ -35,6 +35,11 @@ private module Cached {
getTranslatedFunction(func).hasUserVariable(var, type)
}
cached
predicate hasThisVariable(Function func, CppType type) {
type = getTypeForGLValue(getTranslatedFunction(func).getThisType())
}
cached
predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag, CppType type) {
exists(TranslatedElement element |

7
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll
View File

@@ -2,7 +2,10 @@ private import cpp
newtype TInstructionTag =
OnlyInstructionTag() or // Single instruction (not including implicit Load)
InitializeThisAddressTag() or
InitializeThisTag() or
InitializeThisIndirectionAddressTag() or
InitializeThisIndirectionTag() or
InitializerVariableAddressTag() or
InitializerLoadStringTag() or
InitializerStoreTag() or
@@ -70,7 +73,9 @@ newtype TInstructionTag =
VarArgsMoveNextTag() or
VarArgsVAListStoreTag() or
AsmTag() or
AsmInputTag(int elementIndex) { exists(AsmStmt asm | exists(asm.getChild(elementIndex))) }
AsmInputTag(int elementIndex) { exists(AsmStmt asm | exists(asm.getChild(elementIndex))) } or
ThisAddressTag() or
ThisLoadTag()
class InstructionTag extends TInstructionTag {
final string toString() { result = "Tag" }

28
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
View File

@@ -664,31 +664,35 @@ class TranslatedThisExpr extends TranslatedNonConstantExpr {
final override TranslatedElement getChild(int id) { none() }
final override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
tag = OnlyInstructionTag() and
opcode instanceof Opcode::CopyValue and
tag = ThisAddressTag() and
opcode instanceof Opcode::VariableAddress and
resultType = getTypeForGLValue(any(UnknownType t))
or
tag = ThisLoadTag() and
opcode instanceof Opcode::Load and
resultType = getResultType()
}
final override Instruction getResult() { result = getInstruction(OnlyInstructionTag()) }
final override Instruction getResult() { result = getInstruction(ThisLoadTag()) }
final override Instruction getFirstInstruction() { result = getInstruction(OnlyInstructionTag()) }
final override Instruction getFirstInstruction() { result = getInstruction(ThisAddressTag()) }
final override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
kind instanceof GotoEdge and
tag = OnlyInstructionTag() and
tag = ThisAddressTag() and
result = getInstruction(ThisLoadTag())
or
kind instanceof GotoEdge and
tag = ThisLoadTag() and
result = getParent().getChildSuccessor(this)
}
final override Instruction getChildSuccessor(TranslatedElement child) { none() }
final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
tag = OnlyInstructionTag() and
operandTag instanceof UnaryOperandTag and
result = getInitializeThisInstruction()
}
private Instruction getInitializeThisInstruction() {
result = getTranslatedFunction(expr.getEnclosingFunction()).getInitializeThisInstruction()
tag = ThisLoadTag() and
operandTag instanceof AddressOperandTag and
result = getInstruction(ThisAddressTag())
}
}

73
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll
View File

@@ -117,15 +117,24 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
(
tag = InitializeNonLocalTag() and
if exists(getThisType())
then result = getInstruction(InitializeThisTag())
then result = getInstruction(InitializeThisAddressTag())
else
if exists(getParameter(0))
then result = getParameter(0).getFirstInstruction()
else result = getBody().getFirstInstruction()
)
or
tag = InitializeThisAddressTag() and
result = getInstruction(InitializeThisTag())
or
tag = InitializeThisTag() and
result = getInstruction(InitializeThisIndirectionAddressTag())
or
tag = InitializeThisIndirectionAddressTag() and
result = getInstruction(InitializeThisIndirectionTag())
or
(
tag = InitializeThisTag() and
tag = InitializeThisIndirectionTag() and
if exists(getParameter(0))
then result = getParameter(0).getFirstInstruction()
else result = getConstructorInitList().getFirstInstruction()
@@ -184,10 +193,23 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
opcode instanceof Opcode::InitializeNonLocal and
resultType = getUnknownType()
or
tag = InitializeThisAddressTag() and
opcode instanceof Opcode::VariableAddress and
resultType = getTypeForGLValue(any(UnknownType t)) and
exists(getThisType())
or
tag = InitializeThisTag() and
opcode instanceof Opcode::InitializeThis and
opcode instanceof Opcode::InitializeParameter and
resultType = getTypeForGLValue(getThisType())
or
tag = InitializeThisIndirectionAddressTag() and
opcode instanceof Opcode::Load and
resultType = getTypeForGLValue(getThisType())
or
tag = InitializeThisIndirectionTag() and
opcode instanceof Opcode::InitializeIndirection and
resultType = getTypeForPRValue(getThisType())
or
tag = ReturnValueAddressTag() and
opcode instanceof Opcode::VariableAddress and
resultType = getTypeForGLValue(getReturnType()) and
@@ -228,10 +250,23 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
tag = ReturnTag() and
hasReturnValue() and
(
operandTag instanceof AddressOperandTag and
result = getInstruction(ReturnValueAddressTag())
)
operandTag instanceof AddressOperandTag and
result = getInstruction(ReturnValueAddressTag())
or
tag = InitializeThisTag() and
exists(getThisType()) and
operandTag instanceof AddressOperandTag and
result = getInstruction(InitializeThisAddressTag())
or
tag = InitializeThisIndirectionAddressTag() and
exists(getThisType()) and
operandTag instanceof AddressOperandTag and
result = getInstruction(InitializeThisAddressTag())
or
tag = InitializeThisIndirectionTag() and
exists(getThisType()) and
operandTag instanceof AddressOperandTag and
result = getInstruction(InitializeThisIndirectionAddressTag())
}
final override CppType getInstructionMemoryOperandType(
@@ -245,9 +280,23 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
tag = AliasedUseTag() and
operandTag instanceof SideEffectOperandTag and
result = getUnknownType()
or
tag = InitializeThisIndirectionAddressTag() and
exists(getThisType()) and
operandTag instanceof LoadOperandTag and
result = getTypeForGLValue(getThisType())
}
final override IRVariable getInstructionVariable(InstructionTag tag) {
tag = InitializeThisAddressTag() and
result = getThisVariable()
or
tag = InitializeThisTag() and
result = getThisVariable()
or
tag = InitializeThisIndirectionTag() and
result = getThisVariable()
or
tag = ReturnValueAddressTag() and
result = getReturnVariable()
}
@@ -264,6 +313,9 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
tag = EllipsisTempVar() and
func.isVarargs() and
type = getEllipsisVariablePRValueType()
or
tag = ThisTempVar() and
type = getTypeForGLValue(getThisType())
}
/**
@@ -286,6 +338,13 @@ class TranslatedFunction extends TranslatedElement, TTranslatedFunction {
*/
final IREllipsisVariable getEllipsisVariable() { result.getEnclosingFunction() = func }
/**
* Gets the variable that represents the `this` pointer for this function, if any.
*/
final IRThisVariable getThisVariable() {
result = getIRTempVariable(func, ThisTempVar())
}
/**
* Holds if the function has a non-`void` return type.
*/

10
cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll
View File

@@ -223,6 +223,16 @@ class IREllipsisVariable extends IRTempVariable {
final override string toString() { result = "#ellipsis" }
}
/**
* A temporary variable generated to hold the contents of all arguments passed to the `...` of a
* function that accepts a variable number of arguments.
*/
class IRThisVariable extends IRTempVariable {
IRThisVariable() { tag = ThisTempVar() }
final override string toString() { result = "#this" }
}
/**
* A variable generated to represent the contents of a string literal. This variable acts much like
* a read-only global variable.

2
cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
View File

@@ -204,7 +204,7 @@ private predicate isArgumentForParameter(CallInstruction ci, Operand operand, In
init.(InitializeParameterInstruction).getParameter() =
f.getParameter(operand.(PositionalArgumentOperand).getIndex())
or
init instanceof InitializeThisInstruction and
init.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable and
init.getEnclosingFunction() = f and
operand instanceof ThisArgumentOperand
) and

5
cpp/ql/src/semmle/code/cpp/ir/internal/TempVariableTag.qll
View File

@@ -3,7 +3,8 @@ newtype TTempVariableTag =
ReturnValueTempVar() or
ThrowTempVar() or
LambdaTempVar() or
EllipsisTempVar()
EllipsisTempVar() or
ThisTempVar()
string getTempVariableTagId(TTempVariableTag tag) {
tag = ConditionValueTempVar() and result = "CondVal"
@@ -15,4 +16,6 @@ string getTempVariableTagId(TTempVariableTag tag) {
tag = LambdaTempVar() and result = "Lambda"
or
tag = EllipsisTempVar() and result = "Ellipsis"
or
tag = ThisTempVar() and result = "This"
}

3
cpp/ql/test/library-tests/ir/escape/ssa_escape.expected
View File

@@ -0,0 +1,3 @@
| escape.cpp:211:7:211:7 | c |
| escape.cpp:219:7:219:8 | c3 |
| escape.cpp:223:7:223:8 | c4 |

1547
cpp/ql/test/library-tests/ir/ir/raw_ir.expected
View File

File diff suppressed because it is too large Load Diff

123
cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
View File

@@ -1009,29 +1009,35 @@ ssa.cpp:
# 235| void Constructible::Constructible(int)
# 235| Block 0
# 235| v235_1(void) = EnterFunction :
# 235| m235_2(unknown) = AliasedDefinition :
# 235| m235_3(unknown) = InitializeNonLocal :
# 235| m235_4(unknown) = Chi : total:m235_2, partial:m235_3
# 235| r235_5(glval<Constructible>) = InitializeThis :
# 235| r235_6(glval<int>) = VariableAddress[x] :
# 235| m235_7(int) = InitializeParameter[x] : &:r235_6
# 235| v235_8(void) = NoOp :
# 235| v235_9(void) = ReturnVoid :
# 235| v235_10(void) = AliasedUse : m235_3
# 235| v235_11(void) = ExitFunction :
# 235| v235_1(void) = EnterFunction :
# 235| m235_2(unknown) = AliasedDefinition :
# 235| m235_3(unknown) = InitializeNonLocal :
# 235| m235_4(unknown) = Chi : total:m235_2, partial:m235_3
# 235| r235_5(glval<unknown>) = VariableAddress[#this] :
# 235| m235_6(glval<Constructible>) = InitializeParameter[#this] : &:r235_5
# 235| r235_7(glval<Constructible>) = Load : &:r235_5, m235_6
# 235| m235_8(Constructible) = InitializeIndirection[#this] : &:r235_7
# 235| r235_9(glval<int>) = VariableAddress[x] :
# 235| m235_10(int) = InitializeParameter[x] : &:r235_9
# 235| v235_11(void) = NoOp :
# 235| v235_12(void) = ReturnVoid :
# 235| v235_13(void) = AliasedUse : m235_3
# 235| v235_14(void) = ExitFunction :
# 236| void Constructible::g()
# 236| Block 0
# 236| v236_1(void) = EnterFunction :
# 236| m236_2(unknown) = AliasedDefinition :
# 236| m236_3(unknown) = InitializeNonLocal :
# 236| m236_4(unknown) = Chi : total:m236_2, partial:m236_3
# 236| r236_5(glval<Constructible>) = InitializeThis :
# 236| v236_6(void) = NoOp :
# 236| v236_7(void) = ReturnVoid :
# 236| v236_8(void) = AliasedUse : m236_3
# 236| v236_9(void) = ExitFunction :
# 236| v236_1(void) = EnterFunction :
# 236| m236_2(unknown) = AliasedDefinition :
# 236| m236_3(unknown) = InitializeNonLocal :
# 236| m236_4(unknown) = Chi : total:m236_2, partial:m236_3
# 236| r236_5(glval<unknown>) = VariableAddress[#this] :
# 236| m236_6(glval<Constructible>) = InitializeParameter[#this] : &:r236_5
# 236| r236_7(glval<Constructible>) = Load : &:r236_5, m236_6
# 236| m236_8(Constructible) = InitializeIndirection[#this] : &:r236_7
# 236| v236_9(void) = NoOp :
# 236| v236_10(void) = ReturnVoid :
# 236| v236_11(void) = AliasedUse : m236_3
# 236| v236_12(void) = ExitFunction :
# 239| void ExplicitConstructorCalls()
# 239| Block 0
@@ -1290,46 +1296,55 @@ ssa.cpp:
# 286| void A::A(int)
# 286| Block 0
# 286| v286_1(void) = EnterFunction :
# 286| m286_2(unknown) = AliasedDefinition :
# 286| m286_3(unknown) = InitializeNonLocal :
# 286| m286_4(unknown) = Chi : total:m286_2, partial:m286_3
# 286| r286_5(glval<A>) = InitializeThis :
# 286| r286_6(glval<int>) = VariableAddress[x] :
# 286| m286_7(int) = InitializeParameter[x] : &:r286_6
# 286| v286_8(void) = NoOp :
# 286| v286_9(void) = ReturnVoid :
# 286| v286_10(void) = AliasedUse : m286_3
# 286| v286_11(void) = ExitFunction :
# 286| v286_1(void) = EnterFunction :
# 286| m286_2(unknown) = AliasedDefinition :
# 286| m286_3(unknown) = InitializeNonLocal :
# 286| m286_4(unknown) = Chi : total:m286_2, partial:m286_3
# 286| r286_5(glval<unknown>) = VariableAddress[#this] :
# 286| m286_6(glval<A>) = InitializeParameter[#this] : &:r286_5
# 286| r286_7(glval<A>) = Load : &:r286_5, m286_6
# 286| m286_8(A) = InitializeIndirection[#this] : &:r286_7
# 286| r286_9(glval<int>) = VariableAddress[x] :
# 286| m286_10(int) = InitializeParameter[x] : &:r286_9
# 286| v286_11(void) = NoOp :
# 286| v286_12(void) = ReturnVoid :
# 286| v286_13(void) = AliasedUse : m286_3
# 286| v286_14(void) = ExitFunction :
# 287| void A::A(A*)
# 287| Block 0
# 287| v287_1(void) = EnterFunction :
# 287| m287_2(unknown) = AliasedDefinition :
# 287| m287_3(unknown) = InitializeNonLocal :
# 287| m287_4(unknown) = Chi : total:m287_2, partial:m287_3
# 287| r287_5(glval<A>) = InitializeThis :
# 287| r287_6(glval<A *>) = VariableAddress[p#0] :
# 287| m287_7(A *) = InitializeParameter[p#0] : &:r287_6
# 287| r287_8(A *) = Load : &:r287_6, m287_7
# 287| m287_9(unknown) = InitializeIndirection[p#0] : &:r287_8
# 287| v287_10(void) = NoOp :
# 287| v287_11(void) = ReturnIndirection[p#0] : &:r287_8, m287_9
# 287| v287_12(void) = ReturnVoid :
# 287| v287_13(void) = AliasedUse : m287_3
# 287| v287_14(void) = ExitFunction :
# 287| v287_1(void) = EnterFunction :
# 287| m287_2(unknown) = AliasedDefinition :
# 287| m287_3(unknown) = InitializeNonLocal :
# 287| m287_4(unknown) = Chi : total:m287_2, partial:m287_3
# 287| r287_5(glval<unknown>) = VariableAddress[#this] :
# 287| m287_6(glval<A>) = InitializeParameter[#this] : &:r287_5
# 287| r287_7(glval<A>) = Load : &:r287_5, m287_6
# 287| m287_8(A) = InitializeIndirection[#this] : &:r287_7
# 287| r287_9(glval<A *>) = VariableAddress[p#0] :
# 287| m287_10(A *) = InitializeParameter[p#0] : &:r287_9
# 287| r287_11(A *) = Load : &:r287_9, m287_10
# 287| m287_12(unknown) = InitializeIndirection[p#0] : &:r287_11
# 287| v287_13(void) = NoOp :
# 287| v287_14(void) = ReturnIndirection[p#0] : &:r287_11, m287_12
# 287| v287_15(void) = ReturnVoid :
# 287| v287_16(void) = AliasedUse : m287_3
# 287| v287_17(void) = ExitFunction :
# 288| void A::A()
# 288| Block 0
# 288| v288_1(void) = EnterFunction :
# 288| m288_2(unknown) = AliasedDefinition :
# 288| m288_3(unknown) = InitializeNonLocal :
# 288| m288_4(unknown) = Chi : total:m288_2, partial:m288_3
# 288| r288_5(glval<A>) = InitializeThis :
# 288| v288_6(void) = NoOp :
# 288| v288_7(void) = ReturnVoid :
# 288| v288_8(void) = AliasedUse : m288_3
# 288| v288_9(void) = ExitFunction :
# 288| v288_1(void) = EnterFunction :
# 288| m288_2(unknown) = AliasedDefinition :
# 288| m288_3(unknown) = InitializeNonLocal :
# 288| m288_4(unknown) = Chi : total:m288_2, partial:m288_3
# 288| r288_5(glval<unknown>) = VariableAddress[#this] :
# 288| m288_6(glval<A>) = InitializeParameter[#this] : &:r288_5
# 288| r288_7(glval<A>) = Load : &:r288_5, m288_6
# 288| m288_8(A) = InitializeIndirection[#this] : &:r288_7
# 288| v288_9(void) = NoOp :
# 288| v288_10(void) = ReturnVoid :
# 288| v288_11(void) = AliasedUse : m288_3
# 288| v288_12(void) = ExitFunction :
# 291| Point* NewAliasing(int)
# 291| Block 0

123
cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
View File

@@ -1002,29 +1002,35 @@ ssa.cpp:
# 235| void Constructible::Constructible(int)
# 235| Block 0
# 235| v235_1(void) = EnterFunction :
# 235| m235_2(unknown) = AliasedDefinition :
# 235| m235_3(unknown) = InitializeNonLocal :
# 235| m235_4(unknown) = Chi : total:m235_2, partial:m235_3
# 235| r235_5(glval<Constructible>) = InitializeThis :
# 235| r235_6(glval<int>) = VariableAddress[x] :
# 235| m235_7(int) = InitializeParameter[x] : &:r235_6
# 235| v235_8(void) = NoOp :
# 235| v235_9(void) = ReturnVoid :
# 235| v235_10(void) = AliasedUse : m235_3
# 235| v235_11(void) = ExitFunction :
# 235| v235_1(void) = EnterFunction :
# 235| m235_2(unknown) = AliasedDefinition :
# 235| m235_3(unknown) = InitializeNonLocal :
# 235| m235_4(unknown) = Chi : total:m235_2, partial:m235_3
# 235| r235_5(glval<unknown>) = VariableAddress[#this] :
# 235| m235_6(glval<Constructible>) = InitializeParameter[#this] : &:r235_5
# 235| r235_7(glval<Constructible>) = Load : &:r235_5, m235_6
# 235| m235_8(Constructible) = InitializeIndirection[#this] : &:r235_7
# 235| r235_9(glval<int>) = VariableAddress[x] :
# 235| m235_10(int) = InitializeParameter[x] : &:r235_9
# 235| v235_11(void) = NoOp :
# 235| v235_12(void) = ReturnVoid :
# 235| v235_13(void) = AliasedUse : m235_3
# 235| v235_14(void) = ExitFunction :
# 236| void Constructible::g()
# 236| Block 0
# 236| v236_1(void) = EnterFunction :
# 236| m236_2(unknown) = AliasedDefinition :
# 236| m236_3(unknown) = InitializeNonLocal :
# 236| m236_4(unknown) = Chi : total:m236_2, partial:m236_3
# 236| r236_5(glval<Constructible>) = InitializeThis :
# 236| v236_6(void) = NoOp :
# 236| v236_7(void) = ReturnVoid :
# 236| v236_8(void) = AliasedUse : m236_3
# 236| v236_9(void) = ExitFunction :
# 236| v236_1(void) = EnterFunction :
# 236| m236_2(unknown) = AliasedDefinition :
# 236| m236_3(unknown) = InitializeNonLocal :
# 236| m236_4(unknown) = Chi : total:m236_2, partial:m236_3
# 236| r236_5(glval<unknown>) = VariableAddress[#this] :
# 236| m236_6(glval<Constructible>) = InitializeParameter[#this] : &:r236_5
# 236| r236_7(glval<Constructible>) = Load : &:r236_5, m236_6
# 236| m236_8(Constructible) = InitializeIndirection[#this] : &:r236_7
# 236| v236_9(void) = NoOp :
# 236| v236_10(void) = ReturnVoid :
# 236| v236_11(void) = AliasedUse : m236_3
# 236| v236_12(void) = ExitFunction :
# 239| void ExplicitConstructorCalls()
# 239| Block 0
@@ -1278,46 +1284,55 @@ ssa.cpp:
# 286| void A::A(int)
# 286| Block 0
# 286| v286_1(void) = EnterFunction :
# 286| m286_2(unknown) = AliasedDefinition :
# 286| m286_3(unknown) = InitializeNonLocal :
# 286| m286_4(unknown) = Chi : total:m286_2, partial:m286_3
# 286| r286_5(glval<A>) = InitializeThis :
# 286| r286_6(glval<int>) = VariableAddress[x] :
# 286| m286_7(int) = InitializeParameter[x] : &:r286_6
# 286| v286_8(void) = NoOp :
# 286| v286_9(void) = ReturnVoid :
# 286| v286_10(void) = AliasedUse : m286_3
# 286| v286_11(void) = ExitFunction :
# 286| v286_1(void) = EnterFunction :
# 286| m286_2(unknown) = AliasedDefinition :
# 286| m286_3(unknown) = InitializeNonLocal :
# 286| m286_4(unknown) = Chi : total:m286_2, partial:m286_3
# 286| r286_5(glval<unknown>) = VariableAddress[#this] :
# 286| m286_6(glval<A>) = InitializeParameter[#this] : &:r286_5
# 286| r286_7(glval<A>) = Load : &:r286_5, m286_6
# 286| m286_8(A) = InitializeIndirection[#this] : &:r286_7
# 286| r286_9(glval<int>) = VariableAddress[x] :
# 286| m286_10(int) = InitializeParameter[x] : &:r286_9
# 286| v286_11(void) = NoOp :
# 286| v286_12(void) = ReturnVoid :
# 286| v286_13(void) = AliasedUse : m286_3
# 286| v286_14(void) = ExitFunction :
# 287| void A::A(A*)
# 287| Block 0
# 287| v287_1(void) = EnterFunction :
# 287| m287_2(unknown) = AliasedDefinition :
# 287| m287_3(unknown) = InitializeNonLocal :
# 287| m287_4(unknown) = Chi : total:m287_2, partial:m287_3
# 287| r287_5(glval<A>) = InitializeThis :
# 287| r287_6(glval<A *>) = VariableAddress[p#0] :
# 287| m287_7(A *) = InitializeParameter[p#0] : &:r287_6
# 287| r287_8(A *) = Load : &:r287_6, m287_7
# 287| m287_9(unknown) = InitializeIndirection[p#0] : &:r287_8
# 287| v287_10(void) = NoOp :
# 287| v287_11(void) = ReturnIndirection[p#0] : &:r287_8, m287_9
# 287| v287_12(void) = ReturnVoid :
# 287| v287_13(void) = AliasedUse : m287_3
# 287| v287_14(void) = ExitFunction :
# 287| v287_1(void) = EnterFunction :
# 287| m287_2(unknown) = AliasedDefinition :
# 287| m287_3(unknown) = InitializeNonLocal :
# 287| m287_4(unknown) = Chi : total:m287_2, partial:m287_3
# 287| r287_5(glval<unknown>) = VariableAddress[#this] :
# 287| m287_6(glval<A>) = InitializeParameter[#this] : &:r287_5
# 287| r287_7(glval<A>) = Load : &:r287_5, m287_6
# 287| m287_8(A) = InitializeIndirection[#this] : &:r287_7
# 287| r287_9(glval<A *>) = VariableAddress[p#0] :
# 287| m287_10(A *) = InitializeParameter[p#0] : &:r287_9
# 287| r287_11(A *) = Load : &:r287_9, m287_10
# 287| m287_12(unknown) = InitializeIndirection[p#0] : &:r287_11
# 287| v287_13(void) = NoOp :
# 287| v287_14(void) = ReturnIndirection[p#0] : &:r287_11, m287_12
# 287| v287_15(void) = ReturnVoid :
# 287| v287_16(void) = AliasedUse : m287_3
# 287| v287_17(void) = ExitFunction :
# 288| void A::A()
# 288| Block 0
# 288| v288_1(void) = EnterFunction :
# 288| m288_2(unknown) = AliasedDefinition :
# 288| m288_3(unknown) = InitializeNonLocal :
# 288| m288_4(unknown) = Chi : total:m288_2, partial:m288_3
# 288| r288_5(glval<A>) = InitializeThis :
# 288| v288_6(void) = NoOp :
# 288| v288_7(void) = ReturnVoid :
# 288| v288_8(void) = AliasedUse : m288_3
# 288| v288_9(void) = ExitFunction :
# 288| v288_1(void) = EnterFunction :
# 288| m288_2(unknown) = AliasedDefinition :
# 288| m288_3(unknown) = InitializeNonLocal :
# 288| m288_4(unknown) = Chi : total:m288_2, partial:m288_3
# 288| r288_5(glval<unknown>) = VariableAddress[#this] :
# 288| m288_6(glval<A>) = InitializeParameter[#this] : &:r288_5
# 288| r288_7(glval<A>) = Load : &:r288_5, m288_6
# 288| m288_8(A) = InitializeIndirection[#this] : &:r288_7
# 288| v288_9(void) = NoOp :
# 288| v288_10(void) = ReturnVoid :
# 288| v288_11(void) = AliasedUse : m288_3
# 288| v288_12(void) = ExitFunction :
# 291| Point* NewAliasing(int)
# 291| Block 0

113
cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
View File

@@ -937,27 +937,33 @@ ssa.cpp:
# 235| void Constructible::Constructible(int)
# 235| Block 0
# 235| v235_1(void) = EnterFunction :
# 235| mu235_2(unknown) = AliasedDefinition :
# 235| mu235_3(unknown) = InitializeNonLocal :
# 235| r235_4(glval<Constructible>) = InitializeThis :
# 235| r235_5(glval<int>) = VariableAddress[x] :
# 235| m235_6(int) = InitializeParameter[x] : &:r235_5
# 235| v235_7(void) = NoOp :
# 235| v235_8(void) = ReturnVoid :
# 235| v235_9(void) = AliasedUse : ~m?
# 235| v235_10(void) = ExitFunction :
# 235| v235_1(void) = EnterFunction :
# 235| mu235_2(unknown) = AliasedDefinition :
# 235| mu235_3(unknown) = InitializeNonLocal :
# 235| r235_4(glval<unknown>) = VariableAddress[#this] :
# 235| m235_5(glval<Constructible>) = InitializeParameter[#this] : &:r235_4
# 235| r235_6(glval<Constructible>) = Load : &:r235_4, m235_5
# 235| mu235_7(Constructible) = InitializeIndirection[#this] : &:r235_6
# 235| r235_8(glval<int>) = VariableAddress[x] :
# 235| m235_9(int) = InitializeParameter[x] : &:r235_8
# 235| v235_10(void) = NoOp :
# 235| v235_11(void) = ReturnVoid :
# 235| v235_12(void) = AliasedUse : ~m?
# 235| v235_13(void) = ExitFunction :
# 236| void Constructible::g()
# 236| Block 0
# 236| v236_1(void) = EnterFunction :
# 236| mu236_2(unknown) = AliasedDefinition :
# 236| mu236_3(unknown) = InitializeNonLocal :
# 236| r236_4(glval<Constructible>) = InitializeThis :
# 236| v236_5(void) = NoOp :
# 236| v236_6(void) = ReturnVoid :
# 236| v236_7(void) = AliasedUse : ~m?
# 236| v236_8(void) = ExitFunction :
# 236| v236_1(void) = EnterFunction :
# 236| mu236_2(unknown) = AliasedDefinition :
# 236| mu236_3(unknown) = InitializeNonLocal :
# 236| r236_4(glval<unknown>) = VariableAddress[#this] :
# 236| m236_5(glval<Constructible>) = InitializeParameter[#this] : &:r236_4
# 236| r236_6(glval<Constructible>) = Load : &:r236_4, m236_5
# 236| mu236_7(Constructible) = InitializeIndirection[#this] : &:r236_6
# 236| v236_8(void) = NoOp :
# 236| v236_9(void) = ReturnVoid :
# 236| v236_10(void) = AliasedUse : ~m?
# 236| v236_11(void) = ExitFunction :
# 239| void ExplicitConstructorCalls()
# 239| Block 0
@@ -1182,43 +1188,52 @@ ssa.cpp:
# 286| void A::A(int)
# 286| Block 0
# 286| v286_1(void) = EnterFunction :
# 286| mu286_2(unknown) = AliasedDefinition :
# 286| mu286_3(unknown) = InitializeNonLocal :
# 286| r286_4(glval<A>) = InitializeThis :
# 286| r286_5(glval<int>) = VariableAddress[x] :
# 286| m286_6(int) = InitializeParameter[x] : &:r286_5
# 286| v286_7(void) = NoOp :
# 286| v286_8(void) = ReturnVoid :
# 286| v286_9(void) = AliasedUse : ~m?
# 286| v286_10(void) = ExitFunction :
# 286| v286_1(void) = EnterFunction :
# 286| mu286_2(unknown) = AliasedDefinition :
# 286| mu286_3(unknown) = InitializeNonLocal :
# 286| r286_4(glval<unknown>) = VariableAddress[#this] :
# 286| m286_5(glval<A>) = InitializeParameter[#this] : &:r286_4
# 286| r286_6(glval<A>) = Load : &:r286_4, m286_5
# 286| mu286_7(A) = InitializeIndirection[#this] : &:r286_6
# 286| r286_8(glval<int>) = VariableAddress[x] :
# 286| m286_9(int) = InitializeParameter[x] : &:r286_8
# 286| v286_10(void) = NoOp :
# 286| v286_11(void) = ReturnVoid :
# 286| v286_12(void) = AliasedUse : ~m?
# 286| v286_13(void) = ExitFunction :
# 287| void A::A(A*)
# 287| Block 0
# 287| v287_1(void) = EnterFunction :
# 287| mu287_2(unknown) = AliasedDefinition :
# 287| mu287_3(unknown) = InitializeNonLocal :
# 287| r287_4(glval<A>) = InitializeThis :
# 287| r287_5(glval<A *>) = VariableAddress[p#0] :
# 287| m287_6(A *) = InitializeParameter[p#0] : &:r287_5
# 287| r287_7(A *) = Load : &:r287_5, m287_6
# 287| mu287_8(unknown) = InitializeIndirection[p#0] : &:r287_7
# 287| v287_9(void) = NoOp :
# 287| v287_10(void) = ReturnIndirection[p#0] : &:r287_7, ~m?
# 287| v287_11(void) = ReturnVoid :
# 287| v287_12(void) = AliasedUse : ~m?
# 287| v287_13(void) = ExitFunction :
# 287| v287_1(void) = EnterFunction :
# 287| mu287_2(unknown) = AliasedDefinition :
# 287| mu287_3(unknown) = InitializeNonLocal :
# 287| r287_4(glval<unknown>) = VariableAddress[#this] :
# 287| m287_5(glval<A>) = InitializeParameter[#this] : &:r287_4
# 287| r287_6(glval<A>) = Load : &:r287_4, m287_5
# 287| mu287_7(A) = InitializeIndirection[#this] : &:r287_6
# 287| r287_8(glval<A *>) = VariableAddress[p#0] :
# 287| m287_9(A *) = InitializeParameter[p#0] : &:r287_8
# 287| r287_10(A *) = Load : &:r287_8, m287_9
# 287| mu287_11(unknown) = InitializeIndirection[p#0] : &:r287_10
# 287| v287_12(void) = NoOp :
# 287| v287_13(void) = ReturnIndirection[p#0] : &:r287_10, ~m?
# 287| v287_14(void) = ReturnVoid :
# 287| v287_15(void) = AliasedUse : ~m?
# 287| v287_16(void) = ExitFunction :
# 288| void A::A()
# 288| Block 0
# 288| v288_1(void) = EnterFunction :
# 288| mu288_2(unknown) = AliasedDefinition :
# 288| mu288_3(unknown) = InitializeNonLocal :
# 288| r288_4(glval<A>) = InitializeThis :
# 288| v288_5(void) = NoOp :
# 288| v288_6(void) = ReturnVoid :
# 288| v288_7(void) = AliasedUse : ~m?
# 288| v288_8(void) = ExitFunction :
# 288| v288_1(void) = EnterFunction :
# 288| mu288_2(unknown) = AliasedDefinition :
# 288| mu288_3(unknown) = InitializeNonLocal :
# 288| r288_4(glval<unknown>) = VariableAddress[#this] :
# 288| m288_5(glval<A>) = InitializeParameter[#this] : &:r288_4
# 288| r288_6(glval<A>) = Load : &:r288_4, m288_5
# 288| mu288_7(A) = InitializeIndirection[#this] : &:r288_6
# 288| v288_8(void) = NoOp :
# 288| v288_9(void) = ReturnVoid :
# 288| v288_10(void) = AliasedUse : ~m?
# 288| v288_11(void) = ExitFunction :
# 291| Point* NewAliasing(int)
# 291| Block 0

113
cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
View File

@@ -937,27 +937,33 @@ ssa.cpp:
# 235| void Constructible::Constructible(int)
# 235| Block 0
# 235| v235_1(void) = EnterFunction :
# 235| mu235_2(unknown) = AliasedDefinition :
# 235| mu235_3(unknown) = InitializeNonLocal :
# 235| r235_4(glval<Constructible>) = InitializeThis :
# 235| r235_5(glval<int>) = VariableAddress[x] :
# 235| m235_6(int) = InitializeParameter[x] : &:r235_5
# 235| v235_7(void) = NoOp :
# 235| v235_8(void) = ReturnVoid :
# 235| v235_9(void) = AliasedUse : ~m?
# 235| v235_10(void) = ExitFunction :
# 235| v235_1(void) = EnterFunction :
# 235| mu235_2(unknown) = AliasedDefinition :
# 235| mu235_3(unknown) = InitializeNonLocal :
# 235| r235_4(glval<unknown>) = VariableAddress[#this] :
# 235| m235_5(glval<Constructible>) = InitializeParameter[#this] : &:r235_4
# 235| r235_6(glval<Constructible>) = Load : &:r235_4, m235_5
# 235| mu235_7(Constructible) = InitializeIndirection[#this] : &:r235_6
# 235| r235_8(glval<int>) = VariableAddress[x] :
# 235| m235_9(int) = InitializeParameter[x] : &:r235_8
# 235| v235_10(void) = NoOp :
# 235| v235_11(void) = ReturnVoid :
# 235| v235_12(void) = AliasedUse : ~m?
# 235| v235_13(void) = ExitFunction :
# 236| void Constructible::g()
# 236| Block 0
# 236| v236_1(void) = EnterFunction :
# 236| mu236_2(unknown) = AliasedDefinition :
# 236| mu236_3(unknown) = InitializeNonLocal :
# 236| r236_4(glval<Constructible>) = InitializeThis :
# 236| v236_5(void) = NoOp :
# 236| v236_6(void) = ReturnVoid :
# 236| v236_7(void) = AliasedUse : ~m?
# 236| v236_8(void) = ExitFunction :
# 236| v236_1(void) = EnterFunction :
# 236| mu236_2(unknown) = AliasedDefinition :
# 236| mu236_3(unknown) = InitializeNonLocal :
# 236| r236_4(glval<unknown>) = VariableAddress[#this] :
# 236| m236_5(glval<Constructible>) = InitializeParameter[#this] : &:r236_4
# 236| r236_6(glval<Constructible>) = Load : &:r236_4, m236_5
# 236| mu236_7(Constructible) = InitializeIndirection[#this] : &:r236_6
# 236| v236_8(void) = NoOp :
# 236| v236_9(void) = ReturnVoid :
# 236| v236_10(void) = AliasedUse : ~m?
# 236| v236_11(void) = ExitFunction :
# 239| void ExplicitConstructorCalls()
# 239| Block 0
@@ -1182,43 +1188,52 @@ ssa.cpp:
# 286| void A::A(int)
# 286| Block 0
# 286| v286_1(void) = EnterFunction :
# 286| mu286_2(unknown) = AliasedDefinition :
# 286| mu286_3(unknown) = InitializeNonLocal :
# 286| r286_4(glval<A>) = InitializeThis :
# 286| r286_5(glval<int>) = VariableAddress[x] :
# 286| m286_6(int) = InitializeParameter[x] : &:r286_5
# 286| v286_7(void) = NoOp :
# 286| v286_8(void) = ReturnVoid :
# 286| v286_9(void) = AliasedUse : ~m?
# 286| v286_10(void) = ExitFunction :
# 286| v286_1(void) = EnterFunction :
# 286| mu286_2(unknown) = AliasedDefinition :
# 286| mu286_3(unknown) = InitializeNonLocal :
# 286| r286_4(glval<unknown>) = VariableAddress[#this] :
# 286| m286_5(glval<A>) = InitializeParameter[#this] : &:r286_4
# 286| r286_6(glval<A>) = Load : &:r286_4, m286_5
# 286| mu286_7(A) = InitializeIndirection[#this] : &:r286_6
# 286| r286_8(glval<int>) = VariableAddress[x] :
# 286| m286_9(int) = InitializeParameter[x] : &:r286_8
# 286| v286_10(void) = NoOp :
# 286| v286_11(void) = ReturnVoid :
# 286| v286_12(void) = AliasedUse : ~m?
# 286| v286_13(void) = ExitFunction :
# 287| void A::A(A*)
# 287| Block 0
# 287| v287_1(void) = EnterFunction :
# 287| mu287_2(unknown) = AliasedDefinition :
# 287| mu287_3(unknown) = InitializeNonLocal :
# 287| r287_4(glval<A>) = InitializeThis :
# 287| r287_5(glval<A *>) = VariableAddress[p#0] :
# 287| m287_6(A *) = InitializeParameter[p#0] : &:r287_5
# 287| r287_7(A *) = Load : &:r287_5, m287_6
# 287| mu287_8(unknown) = InitializeIndirection[p#0] : &:r287_7
# 287| v287_9(void) = NoOp :
# 287| v287_10(void) = ReturnIndirection[p#0] : &:r287_7, ~m?
# 287| v287_11(void) = ReturnVoid :
# 287| v287_12(void) = AliasedUse : ~m?
# 287| v287_13(void) = ExitFunction :
# 287| v287_1(void) = EnterFunction :
# 287| mu287_2(unknown) = AliasedDefinition :
# 287| mu287_3(unknown) = InitializeNonLocal :
# 287| r287_4(glval<unknown>) = VariableAddress[#this] :
# 287| m287_5(glval<A>) = InitializeParameter[#this] : &:r287_4
# 287| r287_6(glval<A>) = Load : &:r287_4, m287_5
# 287| mu287_7(A) = InitializeIndirection[#this] : &:r287_6
# 287| r287_8(glval<A *>) = VariableAddress[p#0] :
# 287| m287_9(A *) = InitializeParameter[p#0] : &:r287_8
# 287| r287_10(A *) = Load : &:r287_8, m287_9
# 287| mu287_11(unknown) = InitializeIndirection[p#0] : &:r287_10
# 287| v287_12(void) = NoOp :
# 287| v287_13(void) = ReturnIndirection[p#0] : &:r287_10, ~m?
# 287| v287_14(void) = ReturnVoid :
# 287| v287_15(void) = AliasedUse : ~m?
# 287| v287_16(void) = ExitFunction :
# 288| void A::A()
# 288| Block 0
# 288| v288_1(void) = EnterFunction :
# 288| mu288_2(unknown) = AliasedDefinition :
# 288| mu288_3(unknown) = InitializeNonLocal :
# 288| r288_4(glval<A>) = InitializeThis :
# 288| v288_5(void) = NoOp :
# 288| v288_6(void) = ReturnVoid :
# 288| v288_7(void) = AliasedUse : ~m?
# 288| v288_8(void) = ExitFunction :
# 288| v288_1(void) = EnterFunction :
# 288| mu288_2(unknown) = AliasedDefinition :
# 288| mu288_3(unknown) = InitializeNonLocal :
# 288| r288_4(glval<unknown>) = VariableAddress[#this] :
# 288| m288_5(glval<A>) = InitializeParameter[#this] : &:r288_4
# 288| r288_6(glval<A>) = Load : &:r288_4, m288_5
# 288| mu288_7(A) = InitializeIndirection[#this] : &:r288_6
# 288| v288_8(void) = NoOp :
# 288| v288_9(void) = ReturnVoid :
# 288| v288_10(void) = AliasedUse : ~m?
# 288| v288_11(void) = ExitFunction :
# 291| Point* NewAliasing(int)
# 291| Block 0

10
csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll
View File

@@ -223,6 +223,16 @@ class IREllipsisVariable extends IRTempVariable {
final override string toString() { result = "#ellipsis" }
}
/**
* A temporary variable generated to hold the contents of all arguments passed to the `...` of a
* function that accepts a variable number of arguments.
*/
class IRThisVariable extends IRTempVariable {
IRThisVariable() { tag = ThisTempVar() }
final override string toString() { result = "#this" }
}
/**
* A variable generated to represent the contents of a string literal. This variable acts much like
* a read-only global variable.

10
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll
View File

@@ -223,6 +223,16 @@ class IREllipsisVariable extends IRTempVariable {
final override string toString() { result = "#ellipsis" }
}
/**
* A temporary variable generated to hold the contents of all arguments passed to the `...` of a
* function that accepts a variable number of arguments.
*/
class IRThisVariable extends IRTempVariable {
IRThisVariable() { tag = ThisTempVar() }
final override string toString() { result = "#this" }
}
/**
* A variable generated to represent the contents of a string literal. This variable acts much like
* a read-only global variable.

2
csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
View File

@@ -204,7 +204,7 @@ private predicate isArgumentForParameter(CallInstruction ci, Operand operand, In
init.(InitializeParameterInstruction).getParameter() =
f.getParameter(operand.(PositionalArgumentOperand).getIndex())
or
init instanceof InitializeThisInstruction and
init.(InitializeParameterInstruction).getIRVariable() instanceof IRThisVariable and
init.getEnclosingFunction() = f and
operand instanceof ThisArgumentOperand
) and