From 8c06a68835bc43be3d521b4fcb7317d34d8ec79a Mon Sep 17 00:00:00 2001
From: Jonas Jensen <jonas@semmle.com>
Date: Thu, 9 Aug 2018 15:19:04 +0200
Subject: [PATCH] C++ IR: Remove redundant check for same function

The check that an instruction is in the same function as its operands is
hopefully redundant and can be removed. Just to be sure, I've added the
check to a sanity query.

This check turned out to cause bad performance in the alias analysis
because it got inlined into `AliasAnalysis::resultEscapes` and then
pulled out to a loop-invariant predicate that got a bad join order. With
this check removed, the `ssa/AliasAnalysis.qll` file is orders of
magnitude faster.
---
 cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll    | 8 +++++++-
 .../code/cpp/ssa/internal/aliased_ssa/Instruction.qll     | 8 +++++++-
 .../src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll  | 8 +++++++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll
index d00999f894a..241f8cadd46 100644
--- a/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll
@@ -66,6 +66,13 @@ module InstructionSanity {
     count(instr.getOperand(tag)) > 1 and
     not tag instanceof UnmodeledUseOperand
   }
+
+  query predicate operandAcrossFunctions(
+    Instruction op, Instruction operand, OperandTag tag
+  ) {
+    operand = op.getOperand(tag) and
+    operand.getFunctionIR() != op.getFunctionIR()
+  }
 }
 
 /**
@@ -302,7 +309,6 @@ class Instruction extends Construction::TInstruction {
    * an operand with tag `useTag`.
    */
   final predicate hasUse(Instruction useInstruction, OperandTag useTag) {
-    useInstruction.getFunctionIR() = funcIR and
     this = useInstruction.getOperand(useTag)
   }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll
index d00999f894a..241f8cadd46 100644
--- a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll
@@ -66,6 +66,13 @@ module InstructionSanity {
     count(instr.getOperand(tag)) > 1 and
     not tag instanceof UnmodeledUseOperand
   }
+
+  query predicate operandAcrossFunctions(
+    Instruction op, Instruction operand, OperandTag tag
+  ) {
+    operand = op.getOperand(tag) and
+    operand.getFunctionIR() != op.getFunctionIR()
+  }
 }
 
 /**
@@ -302,7 +309,6 @@ class Instruction extends Construction::TInstruction {
    * an operand with tag `useTag`.
    */
   final predicate hasUse(Instruction useInstruction, OperandTag useTag) {
-    useInstruction.getFunctionIR() = funcIR and
     this = useInstruction.getOperand(useTag)
   }
 }
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll
index d00999f894a..241f8cadd46 100644
--- a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll
@@ -66,6 +66,13 @@ module InstructionSanity {
     count(instr.getOperand(tag)) > 1 and
     not tag instanceof UnmodeledUseOperand
   }
+
+  query predicate operandAcrossFunctions(
+    Instruction op, Instruction operand, OperandTag tag
+  ) {
+    operand = op.getOperand(tag) and
+    operand.getFunctionIR() != op.getFunctionIR()
+  }
 }
 
 /**
@@ -302,7 +309,6 @@ class Instruction extends Construction::TInstruction {
    * an operand with tag `useTag`.
    */
   final predicate hasUse(Instruction useInstruction, OperandTag useTag) {
-    useInstruction.getFunctionIR() = funcIR and
     this = useInstruction.getOperand(useTag)
   }
 }