Commit Graph

2357 Commits

Author SHA1 Message Date
Geoffrey White
4df176ae34 CPP: Add test coverage for isModifiedByArithmeticOperation. 2019-07-15 19:42:50 +01:00
Robert Marsh
86a018b0b4 C++: overlapping def/use must share IRVariable 2019-07-15 10:35:57 -07:00
Robert Marsh
20e67eb37a C++: improve performance of overlap computation
This is still quadratic in the number of MemoryLocations for a vvar, but
only for a single pipeline step, which is not materialized. It seems to be
fast enough in practice for the IR.
2019-07-15 10:15:58 -07:00
Geoffrey White
cf194219b9 CPP: Fix FPs. 2019-07-15 14:58:35 +01:00
Geoffrey White
5362fef81c CPP: Additional AllocaInLoop test cases. 2019-07-15 14:50:02 +01:00
Ziemowit Laski
c906560edd Fix up expected IR output after rebase. 2019-07-13 12:57:25 -07:00
Ziemowit Laski
960a41be85 Handle __builtin_addressof. 2019-07-13 12:23:40 -07:00
Ziemowit Laski
175ba7b3b0 Fix up .expected on the IR side. 2019-07-13 12:23:40 -07:00
Ziemowit Laski
2637c22732 Fix up .expected file. 2019-07-13 12:23:40 -07:00
Ziemowit Laski
2459d2ab92 Reformat PrintAST.qll ONLY. 2019-07-13 12:23:40 -07:00
Ziemowit Laski
49b0fc0a57 [CPP-386] A few more QL classes. 2019-07-13 12:23:40 -07:00
Ziemowit Laski
ab82aebbd7 [CPP-386] Add override keyword as needed; annotate a few more classes. 2019-07-13 12:23:40 -07:00
Ziemowit Laski
e5fc07660d [CPP-386] Print QL AST classes next to elements in PrintAST trees. 2019-07-13 12:23:09 -07:00
Ziemowit Laski
ddb0fd90e9 [CPP-386] Provide getCanonicalQLClass() predicate for many AST elements. 2019-07-13 12:19:40 -07:00
Ziemowit Laski
a4affbebbf [CPP-386] Add ElementBase::getCanonicalQLClass(). 2019-07-13 12:19:40 -07:00
Robert Marsh
41e46f6686 Merge pull request #1584 from geoffw0/swap
CPP: Model std::swap
2019-07-12 10:41:14 -07:00
Geoffrey White
a9b953f89a CPP: Flip test output for consistency and easy comparison with the other tests. 2019-07-12 18:18:08 +01:00
Geoffrey White
c2fd2e273e CPP: Model taint flow through std::swap. 2019-07-12 18:00:39 +01:00
Geoffrey White
f132bca06e CPP: Add a taint flow test of 'std::swap'. 2019-07-12 16:37:01 +01:00
semmledocs-ac
e1da6e915c Merge pull request #1515 from geoffw0/continuefalseloop
CPP: Improvements to ContinueInFalseLoop.ql
2019-07-12 08:38:22 +01:00
Dave Bartolomeo
1b38208bab Merge pull request #1567 from jbj/ir-operand-cycles
C++ IR: guard against cycles in operand graph
2019-07-11 13:14:10 -07:00
Dave Bartolomeo
c73b516862 Merge pull request #1541 from jbj/ir-operand-exact
C++ IR: Make instruction operand getters have only exact results
2019-07-11 13:13:20 -07:00
Dave Bartolomeo
00ff2bb6c4 Merge pull request #1554 from jbj/ir-ErrorExpr
C++ IR: support for translating ErrorExpr
2019-07-11 13:05:04 -07:00
Jonas Jensen
23001d5471 Merge pull request #1566 from rdmarsh2/rdmarsh/cpp/pure-functions-effect-model
C++: alias and side effect info for pure functions
2019-07-11 21:21:54 +02:00
Geoffrey White
ed069fe3cc CPP: Upgrade precision/severity. 2019-07-11 20:00:50 +01:00
Geoffrey White
62fb216102 CPP: Fix false positive. 2019-07-11 20:00:50 +01:00
Geoffrey White
629d127174 CPP: QLDoc comments. 2019-07-11 20:00:50 +01:00
Geoffrey White
e1efdd7d47 CPP: Add a test where continue is used in a switch to exit the loop. 2019-07-11 20:00:50 +01:00
Geoffrey White
3337a859aa CPP: Corrections to qhelp. 2019-07-11 20:00:50 +01:00
Geoffrey White
4c4be2d3c2 CPP: Add (basic) qhelp. 2019-07-11 20:00:50 +01:00
Geoffrey White
8a3f8c5c1d CPP: Add precision/tags and adjust severity. 2019-07-11 20:00:50 +01:00
Geoffrey White
83d4b23ae3 CPP: Fix false positives in while/for loops. 2019-07-11 20:00:50 +01:00
Geoffrey White
136ca72297 CPP: Add a test. 2019-07-11 20:00:49 +01:00
Robert Marsh
c195420ba1 C++: respond to PR comments 2019-07-11 11:00:52 -07:00
Geoffrey White
db6be05a92 Merge pull request #1580 from jbj/inconsistent-loop-direction-perf
C++: Fix inconsistent-loop-direction performance
2019-07-11 16:39:05 +01:00
Jonas Jensen
2324ce77ae C++ IR: Fix soundness of ConstantAnalysis
Now that `PhiInstruction.getAnInput` only has results for congruent
operands, a previous optimization I made to `getConstantValue` is no
longer sound. We have to check that all phi inputs give the same value,
not just the congruent ones. After this change, if there are any
non-congruent operands on a phi instruction, the whole aggregate will
have no result.
2019-07-11 15:51:09 +02:00
Jonas Jensen
7fb43a5a03 C++ IR: getAnyDef -> getDef in RangeUtils.qll
As recommended by Dave in PR review.
2019-07-11 15:35:14 +02:00
ian-semmle
463547f810 Merge pull request #1581 from jbj/revert-noTarget-workaround
Revert "C++: Work around extractor issue CPP-383"
2019-07-11 14:26:15 +01:00
Jonas Jensen
c831c4b58e C++ IR: Fix SignAnalysis after getAnyDef -> getDef
In the `SignAnalysis` abstract interpretation, "unknown sign"
corresponds to the set of _all_ `Sign`, but using `getDef` leads to the
operand having _no_ `Sign`. To fix that, we assign all signs to inexact
operands.
2019-07-11 15:17:55 +02:00
Geoffrey White
59964bd9a4 Merge pull request #1575 from jbj/UncheckedLeapYear-bb
C++: Fix performance of unchecked leap year query
2019-07-11 13:57:07 +01:00
Jonas Jensen
ee5eaef5e4 Revert "C++: Work around extractor issue CPP-383"
The issue is now fixed in the extractor, and I've confirmed that the
workaround is no longer needed for g/an-tao/drogon.

This reverts commit 48a3385809.
2019-07-11 14:18:29 +02:00
Jonas Jensen
e523f93d91 C++: Fix inconsistent-loop-direction performance
This query seems to have been de-optimized by recent optimizer or stats
changes. On libretro/libretro-uae, the query took 1 second on a warm
cache with dist 89ad5f1 but took 9979 seconds with dist a3b9b6eb9.

The slowness was due to a Cartesian product in
`illDefined{Decr,Incr}ForStmt` between all the definitions and all the
uses of `Variable v`. This would be no problem with the right join
order, but that has apparently been lost. This commit factors out a pair
of `pragma[noinline]` helper predicates to make sure the definitions
(`v.getAnAssignedValue()`) and the uses (`v.getAnAccess()`) are queried
and filtered in separate predicates.

The performance problem can be seen in the tuple counts of this pipeline
I interrupted during evaluation of
`inconsistentLoopDirection::illDefinedDecrForStmt#ffff#shared`:

    89716     ~3%     {2} r1 = SCAN Variable::Variable::getAnAssignedValue_dispred#ff OUTPUT FIELDS {Variable::Variable::getAnAssignedValue_dispred#ff.<1>,Variable::Variable::getAnAssignedValue_dispred#ff.<0>}
    89716     ~0%     {3} r2 = JOIN r1 WITH DataFlowUtil::TExprNode#ff@staged_ext ON r1.<0>=DataFlowUtil::TExprNode#ff@staged_ext.<0> OUTPUT FIELDS {r1.<1>,DataFlowUtil::TExprNode#ff@staged_ext.<0>,DataFlowUtil::TExprNode#ff@staged_ext.<1>}
    502539405 ~0%     {4} r3 = JOIN r2 WITH Variable::Variable::getAnAccess_dispred#fb ON r2.<0>=Variable::Variable::getAnAccess_dispred#fb.<0> OUTPUT FIELDS {Variable::Variable::getAnAccess_dispred#fb.<1>,r2.<1>,r2.<2>,r2.<0>}
                      return r3
2019-07-11 12:09:17 +02:00
Robert Marsh
72f9addd0b C++: move strstr back into main pure str model 2019-07-10 12:27:04 -07:00
Jonas Jensen
52cfbffb95 C++ IR: Fix calls to non-existent predicates
The last commit introduced calls to two predicates that did not exist. I
created `Instruction.getResultAddress` so it now exists and changed the
other call back to use the predicate that does exist.
2019-07-10 15:18:17 +02:00
Jonas Jensen
6d87c05155 Apply suggestions from code review
Co-Authored-By: Dave Bartolomeo <42150477+dave-bartolomeo@users.noreply.github.com>
2019-07-10 15:07:44 +02:00
Jonas Jensen
70f81badcb C++ IR: Move ErrorExpr filter to TranslatedElement
The convention in the IR translation is to handle all ignored
expressions in this central place.
2019-07-10 14:20:09 +02:00
Jonas Jensen
21c6340180 C++: Fix performance of unchecked leap year query
This query used `getASuccessor()` on the CFG, which worked in many cases
but became quadratic on certain projects including PostgreSQL and
MySQL. The problem was that there was just enough context for magic to
apply to the transitive closure, but the use of magic meant that the
fast transitive closure algorithm wasn't used. In projects where the
magic had little effect, that led to the
`#ControlFlowGraph::ControlFlowNode::getASuccessor_dispred#bfPlus`
predicate taking quadratic time and space.

This commit changes the query to use basic blocks to find successors,
which is much faster because (1) there are many more `ControlFlowNode`s
than `BasicBlocks`, and (2) the optimizer does not apply magic but uses
fast transitive closure instead.

Behavior changes slightly in the `isUsedInCorrectLeapYearCheck` case: we
now accept a `yfacheck` that comes _before_ `yfa` if they are in the
same basic block. I don't think that matters in practice.
2019-07-10 13:20:32 +02:00
Dave Bartolomeo
e087b6c82a Merge pull request #1571 from jbj/ir-operand-cached
C++ IR: Make TOperand cached
2019-07-09 16:14:58 -07:00
Robert Marsh
3804c1fbcf C++: model returns of strstr and strpbrk 2019-07-09 11:45:27 -07:00
Jonas Jensen
523fc9c1ce C++ IR: make isInCycle fast
Without this `pragma[noopt]`, `isInCycle` gets compiled into RA that
unpacks every tuple of the fast TC:

                      0          ~0%     {2} r1 = SELECT #Operand::getNonPhiOperandDef#3#ffPlus ON FIELDS #Operand::getNonPhiOperandDef#3#ffPlus.<0>=#Operand::getNonPhiOperandDef#3#ffPlus.<1>
                      0          ~0%     {1} r2 = SCAN r1 OUTPUT FIELDS {r1.<0>}
                                         return r2

With this change, it just becomes one lookup in the fast TC data
structure per instruction.
2019-07-09 16:28:55 +02:00