Commit Graph

847 Commits

Author SHA1 Message Date
Tom Hvitved
eabfa31767 Synchronize data flow files 2019-10-07 15:13:48 +02:00
semmle-qlci
fbb7747bd1 Merge pull request #2073 from hvitved/csharp/splitting-joins
Approved by calumgrant
2019-10-07 12:22:57 +01:00
Calum Grant
2706238413 C#: Update queries to use localExprFlow. 2019-10-04 16:53:02 +01:00
Calum Grant
af25536648 C#: Add localExprFlow and localExprTaint, and change notes. 2019-10-04 16:46:02 +01:00
Tom Hvitved
b55e2948be Merge pull request #1986 from calumgrant/cs/switch-cfg
C#: Fix CFG for switch statements where the default case is not the last
2019-10-04 16:54:04 +02:00
Tom Hvitved
9b58d799cb Java/C++/C#: Tweak AccessPathNil::toString()
Move the type annotation outside the brackets, to avoid prefixes such as
`[ : T]`.
2019-10-04 11:09:44 +02:00
Robert Marsh
6e587f3f2a IR: Add VariableInstruction.getASTVariable 2019-10-03 13:12:06 -07:00
Robert Marsh
c1e3821ab0 IR: rename getVariable to getIRVariable 2019-10-03 13:10:49 -07:00
Calum Grant
48dee29620 Merge pull request #2021 from hvitved/csharp/local-not-disposed
C#: Refactor `cs/local-not-disposed` using data flow library
2019-10-03 15:21:06 +01:00
Tom Hvitved
e5380aa6a7 Merge pull request #2038 from aschackmull/java/dataflow-fixes
Java/C++/C#: Misc. dataflow fixes.
2019-10-02 16:39:01 +02:00
Calum Grant
eb893fbc5d Merge pull request #2024 from hvitved/csharp/conversion-unbound
C#: Handle unbound types in conversion library
2019-10-02 15:36:38 +01:00
Tom Hvitved
17085dc05c C#: Fix typo 2019-10-02 16:26:38 +02:00
Tom Hvitved
6ebefbb67d C#: Improve a few join-orders in Splitting.qll 2019-10-02 16:23:08 +02:00
Anders Schack-Mulligen
f87cb4d6ac Java/C++/C#: Address review comments and fix test. 2019-10-02 14:32:17 +02:00
Calum Grant
28c34ad41e C#: Address review comments. 2019-10-02 10:42:06 +01:00
Robert Marsh
d1e2ddcf99 C#: sync unalised_ssa IR stage and add to check 2019-09-30 12:53:00 -07:00
Robert Marsh
ee3b40bd89 C#: sync changes and accept test output 2019-09-30 12:00:55 -07:00
Robert Marsh
9f20cb83c3 C++/C#: Autoformat 2019-09-30 12:00:55 -07:00
Robert Marsh
8649978a43 C++: add indexes for specific side effects 2019-09-30 12:00:53 -07:00
Robert Marsh
49088e7f09 C++: Fix formatting and dropped line 2019-09-30 12:00:53 -07:00
Robert Marsh
3d562243e4 C++: add side effects for outparams 2019-09-30 12:00:52 -07:00
Calum Grant
ad8ae35c82 Merge pull request #1956 from hvitved/csharp/get-an-out-node
C#: Refactor `getAnOutNode()` predicate
2019-09-30 16:58:21 +01:00
Tom Hvitved
b7595ed60e C#: Remove duplicated class 2019-09-30 09:11:47 +02:00
Dave Bartolomeo
420713204a C++, C#: Fix typo 2019-09-29 22:44:17 -07:00
Dave Bartolomeo
043e5f716b C++, C#: Autoformat 2019-09-29 22:39:09 -07:00
Dave Bartolomeo
bcd987cdf1 Merge from master and share value numbering 2019-09-27 17:40:43 -07:00
Dave Bartolomeo
f76334c24a C++, C#: Share unaliased SSA files between languages
Most of the C# diffs are from bringing those files in sync with the latest C++ files.
2019-09-27 13:46:42 -07:00
Dave Bartolomeo
5585ccd509 C#: Fix up after merge 2019-09-27 12:33:33 -07:00
Calum Grant
abdf7ce223 Merge pull request #2045 from AndreiDiaconu1/ircsharp-various-fixes
C# IR: Minor sanity fixes
2019-09-27 15:51:07 +01:00
Calum Grant
09f441a27e Merge pull request #2009 from AndreiDiaconu1/ircsharp-rangeanalysis
C# IR: Add range analysis library
2019-09-27 14:27:41 +01:00
AndreiDiaconu1
c5cd5f489f Autoformat 2019-09-27 13:07:20 +01:00
AndreiDiaconu1
f5b31ae9f5 Static fields
The translation of static fields now uses `VariableAddress` instead of `FieldAddress`. This fixes the logic as well as the "field address without qualifier address" sanity check.
2019-09-27 12:21:47 +01:00
AndreiDiaconu1
21513102f7 Compiler generated constructor
Fixed a problem when the translating the compiler generated constructors that caused some sanity errors (since they have no body, when translating the constructor block fragmentation happened). Fixed this by skipping the translation of the body, if it does not exist (when translating a function).
2019-09-27 12:20:39 +01:00
Dave Bartolomeo
9b8b364c8f Merge from master 2019-09-26 22:15:02 -07:00
Dave Bartolomeo
c8d154e9cc C#: Fix dump of IR types 2019-09-26 15:54:09 -07:00
Dave Bartolomeo
e30e163081 C#: Implement IRType
This commit implements the language-neutral IR type system for C#. It mostly follows the same pattern as C++, modified to fit the C# type system. All object references, pointers, and lvalues are represented as `IRAddress` types. All structs and generic parameters are implemented as `IRBlobType`. Function addresses get a single `IRFunctionAddressType`.

I had to fix a couple places in the original IR type system where I didn't realize I was still depending on language-specific types. As part of this, `CSharpType` and `CppType` now have a `hasUnspecifiedType()` predicate, which is equivalent to `hasType()`, except that it holds only for the unspecified version of the type. This predicate can go away once we remove the IR's references to the underlying `Type` objects.

All C# IR tests pass without modification, but only because this commit continues to print the name of `IRUnknownType` as `null`, and `IRFunctionAddressType` as `glval<null>`. These will be fixed separately in a subsequent commit in this PR.
2019-09-26 15:47:52 -07:00
AndreiDiaconu1
a7a5eaa23f Address PR comments 2019-09-26 16:49:18 +01:00
Anders Schack-Mulligen
f97958296d Java/C++/C#: Sync. 2019-09-26 17:12:08 +02:00
AndreiDiaconu1
0999780d82 Address PR comments 2019-09-26 11:51:54 +01:00
AndreiDiaconu1
3a5140c0f5 Indexers and events
Added test for indexers.
Added support for event accesses and added test.
2019-09-26 11:46:16 +01:00
AndreiDiaconu1
16d8d2efa1 Remove useless translation 2019-09-26 11:46:16 +01:00
Tom Hvitved
3da438bb84 C#: Handle unbound types in conversion library
A constructed type, `C<T>`, where `T` is the type parameter of `C`, is represented
in the database as the corresponding unbound generict type `C<>`. Consequently, the
type conversion library, which only considers `ConstructedType`s, does not handle
all implicit conversions. For example, in

```
interface I<in T1, T2> where T1 : C
```

there should be an implicit conversion from `I<C, T2>` to `I<T1, T2>` (=`I<>`).
2019-09-25 16:24:38 +02:00
Tom Hvitved
5a198a39df C#: Autoformat 2019-09-25 11:52:19 +02:00
Tom Hvitved
afdb788333 C#: Refactor cs/local-not-disposed using data flow library 2019-09-25 09:33:39 +02:00
AndreiDiaconu1
d6e4a2afef Autoformat 2019-09-24 17:26:13 +01:00
AndreiDiaconu1
1b47f80a7a C# implementation 2019-09-24 14:53:12 +01:00
AndreiDiaconu1
f25602bf1c Initial, C++ implementation 2019-09-24 14:53:12 +01:00
AndreiDiaconu1
9228cf83fa Address PR comments 2019-09-24 14:49:09 +01:00
Dave Bartolomeo
300e580874 C++: Implement language-neutral IR type system
The C++ IR currently has a very clunky way of specifying the type of an IR entity (`Instruction`, `Operand`, `IRVariable`, etc.). There are three separate predicates: `getType()`, `isGLValue()`, and `getSize()`. All three are necessary, rather than just having a `getType()` predicate, because some IR entities have types that are not represented via an existing `Type` object in the AST. Examples include the type for an lvalue returned from a `VariableAddress` instruction, the type for an array slice being zero-initialized in a variable initializer, and several others. It is very easy for QL code to just check the `getType()` predicate, while forgetting to use `isGLValue()` to determine if that type is the actual type of the entity (the prvalue case) or the type referred to by a glvalue entity. Furthermore, the C++ type system creates potentially many different `Type` objects for the same underlying type (e.g. typedefs, using declarations, `const`/`volatile` qualifiers, etc.), making it more difficult to tell when two entities have semantically equivalent types.

In addition, other languages for which we want to enable the IR have somewhat different type systems. The various language type systems differ in their structure, although they tend to share the basic building blocks necessary for the IR.

To address all of the above problems, I've introduced a new class hierarchy, rooted at the class `IRType`, that represents a bare-bones type system that is independent of source language (at least across C/C++/C#/Java). A type's identity is based on its kind (signed integer, unsigned integer, floating-point, Boolean, blob, etc.), size and in the case of blob types, a "tag" to differentiate between different classes and structs. No distinction is made between, say `signed int` and plain `int`, or between different language integer types that have the same signedness and size (e.g. `unsigned int` vs. `wchar_t` on Linux). `IRType` is intended for use by language-agnostic IR-based analyses, including range analysis, dataflow, SSA construction, and alias analysis. The set of available `IRType`s is determined by predicate provided by the language library implementation (e.g. `hasSignedIntegerType(int byteSize)`.

In addition to `IRType`, each language now defines a type alias named `LanguageType`, representing the type of an IR entity in more language-specific terms. The only predicate requried on `LanguageType` is `getIRType()`, which returns the single `IRType` object for the language-neutral representation of that `LanguageType`. All other predicates on and subclasses of `LanguageType` are language-specific. There may be many instances of `LanguageType` that map to a given `IRType`, to allow for typedefs, etc.

Most of the changes are mechanical changes in the IR construction code, to return the correct type for each IR entity. SSA construction has also been updated to avoid dependencies on language-specific types.

I have not yet removed the original `getType()` predicates that just return `Type`. These can be removed once we move the remaining existing libraries to use `IRType`.

Test results are, by design, pretty much unchanged. Once case changed for inline asm, because the previously IR generation for it played a little fast and loose with the input/output expressions. The test case now includes both input and output variables. The generated IR for `Conditional_LValue` is now more correct, because we now have a way to represent an lvalue of an lvalue. `syntax-zoo` is still a hot mess. Most of the changed outputs are due to wobble from having multiple functions with the same name, but with a slightly different order of evaluation due to the type changes. Others are wobble from already-invalid IR. A couple non-wobbly places have improved slightly, though.

The C# part of this change is waiting for #2005 to be merged, since that has some of the necessary C# implementation.
2019-09-23 16:14:00 -07:00
AndreiDiaconu1
a86a15d280 Fix problem with IsExpr
The translation of `IsExpr` created a sanity check to fail since it generated
a Phi node that had only one source: if a variable was declared as part of the `IsExpr`, a conditional branch was generated, and the variable was defined only in the true successor; this has been changes so that the declaration happens before the conditional branch, and the variable is uninitialized (this removed the need for the `isInitializedByElement` predicate from `TranslatedDeclarationBase`, so that has been removed) and only the assignment happens in the true successor block (so now the two inputs of the Phi node are the result of the `Uninitialized` instruction and the `Store` instruction from the true successor block).
2019-09-23 17:37:50 +01:00