Commit Graph

10678 Commits

Author SHA1 Message Date
Jonas Jensen
6b2fd17f03 C++: IR: faster definitionReachesRank
On Wireshark with 6GB RAM, I've observed `definitionReachesRank` to be
the slowest predicate in the IR. It seems that the implementation was
slow because the optimizer failed to eliminate the common
`reachesRank - 1` subexpression. This led to context being pushed into
the `not`, which got implemented as `MATERIALIZE`. That wouldn't
normally be a disaster, but this is one of the largest predicates in the
IR SSA construction, and iteration 2 was very slow.

Before:

    (1505s) Starting to evaluate predicate SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta/4[1]@93f592 (iteration 1)
    (1535s) Tuple counts for SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta:
    130670697 ~0%     {4} r1 = SCAN project#SSAConstruction::DefUse::hasDefinitionAtRank#fffff AS I OUTPUT I.<0>, I.<1>, I.<2>, (I.<2> + 1)
    130670697 ~6%     {5} r2 = JOIN r1 WITH SSAConstruction::DefUse::exitRank#fff AS R ON FIRST 2 OUTPUT r1.<0>, r1.<1>, r1.<2>, r1.<3>, R.<2>
    130670697 ~6%     {5} r3 = SELECT r2 ON r2.<3> <= r2.<4>
    130670697 ~0%     {4} r4 = SCAN r3 OUTPUT r3.<0>, r3.<1>, r3.<2>, r3.<3>
                      return r4
    (1535s) 			 - SSAConstruction::DefUse::definitionReachesRank#ffff_delta has 130670697 rows (order for disjuncts: delta=<standard>).

    (1535s) Starting to evaluate predicate SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta/4[2]@866c14 (iteration 2)
    (1626s) Tuple counts for SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta:
    261341394 ~107%     {4} r1 = JOIN SSAConstruction::DefUse::definitionReachesRank#ffff#prev_delta AS L WITH SSAConstruction::DefUse::definitionReachesRank#ffff#join_rhs AS R ON FIRST 3 OUTPUT R.<0>, R.<1>, R.<2>, (1 + L.<3>)
    261341394 ~107%     {4} r2 = r1 AND NOT SSAConstruction::DefUse::definitionReachesRank#ffff#prev AS R(r1.<0>, r1.<1>, r1.<2>, r1.<3>)
    130670697 ~0%       {5} r3 = SCAN r2 OUTPUT r2.<0>, r2.<1>, (r2.<3> - 1), r2.<2>, r2.<3>
    106034590 ~1%       {4} r4 = JOIN r3 WITH project#SSAConstruction::DefUse::hasDefinitionAtRank#fffff AS R ON FIRST 3 OUTPUT r3.<0>, r3.<1>, r3.<3>, r3.<4>
    106034590           {4} r5 = MATERIALIZE r4 AS antijoin_rhs
    24636107  ~3%       {4} r6 = r2 AND NOT r5(r2.<0>, r2.<1>, r2.<2>, r2.<3>)
    24636107  ~0%       {5} r7 = JOIN r6 WITH SSAConstruction::DefUse::exitRank#fff AS R ON FIRST 2 OUTPUT r6.<0>, r6.<1>, r6.<2>, r6.<3>, R.<2>
    2749441   ~0%       {5} r8 = SELECT r7 ON r7.<3> <= r7.<4>
    2749441   ~4%       {4} r9 = SCAN r8 OUTPUT r8.<0>, r8.<1>, r8.<2>, r8.<3>
                        return r9
    (1626s) 			 - SSAConstruction::DefUse::definitionReachesRank#ffff_delta has 2749441 rows (order for disjuncts: delta=<standard>).

After:

    (12s) Tuple counts for SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta:
    130670697 ~0%     {4} r1 = SCAN project#SSAConstruction::DefUse::hasDefinitionAtRank#fffff AS I OUTPUT I.<0>, I.<1>, I.<2>, (I.<2> + 1)
                      return r1
    (12s) 			 - SSAConstruction::DefUse::definitionReachesRank#ffff_delta has 130670697 rows (order for disjuncts: delta=<standard>).
    (12s) Starting to evaluate predicate SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta/4[2]@fff64c (iteration 2)
    (34s) Tuple counts for SSAConstruction::DefUse::definitionReachesRank#ffff#cur_delta:
    108784031 ~0%     {4} r1 = SSAConstruction::DefUse::definitionReachesRank#ffff#prev_delta AS L AND NOT SSAConstruction::DefUse::exitRank#fff AS R(L.<0>, L.<1>, L.<3>)
    2749441   ~5%     {4} r2 = r1 AND NOT project#SSAConstruction::DefUse::hasDefinitionAtRank#fffff AS R(r1.<0>, r1.<1>, r1.<3>)
    2749441   ~4%     {4} r3 = SCAN r2 OUTPUT r2.<0>, r2.<1>, r2.<2>, (r2.<3> + 1)
    2749441   ~4%     {4} r4 = r3 AND NOT SSAConstruction::DefUse::definitionReachesRank#ffff#prev AS R(r3.<0>, r3.<1>, r3.<2>, r3.<3>)
                      return r4
    (34s) 			 - SSAConstruction::DefUse::definitionReachesRank#ffff_delta has 2749441 rows (order for disjuncts: delta=<standard>).

Note that the row counts are exactly the same before and after.
2020-03-04 15:00:47 +01:00
Jonas Jensen
88c74b2a4b Merge pull request #2917 from MathiasVP/inexact-is-chi-for-all-aliased-memory
C++: `isChiForAllAliasedMemory` recursion through inexact Phi operands
2020-03-03 14:25:49 +01:00
Jonas Jensen
4f23acf080 Merge pull request #2957 from MathiasVP/dataflow-dispatch-same-num-args
C++: Only return functions that match arguments in DataFlowDispatch::viableCallable
2020-03-03 14:19:26 +01:00
semmle-qlci
57b3e6addf Merge pull request #2958 from erik-krogh/InnerPrefix
Approved by asgerf
2020-03-03 11:10:44 +00:00
semmle-qlci
7f3f629d39 Merge pull request #2913 from asger-semmle/js/prototype-pollution-path
Approved by erik-krogh
2020-03-03 10:29:47 +00:00
semmle-qlci
b3cbf8baa8 Merge pull request #2960 from erik-krogh/OverloadsWithThis
Approved by asgerf
2020-03-03 10:10:00 +00:00
semmle-qlci
e1c5449885 Merge pull request #2867 from erik-krogh/UselessCat
Approved by esbena
2020-03-03 09:10:25 +00:00
Erik Krogh Kristensen
d2d5af42bf add IndirectInclusionTest and IndirectEndsWith 2020-03-02 21:42:08 +01:00
Taus
f3b62e106d Merge pull request #2840 from BekaValentine/python-objectapi-to-valueapi-useofapply
Python: ObjectAPI to ValueAPI: UseofApply
2020-03-02 21:40:35 +01:00
Erik Krogh Kristensen
97c16929ca implement getPolarity and forward to inner StartsWith 2020-03-02 21:38:22 +01:00
Robert Marsh
0b74d56ed1 Merge pull request #2959 from jbj/getCanonicalQLClass-Variable
C++: Add getCanonicalQLClass overrides in Variable
2020-03-02 12:16:48 -08:00
Erik Krogh Kristensen
46a645c47b Merge pull request #2956 from asger-semmle/js/autoformat-again
JS: Really autoformat everything
2020-03-02 21:16:07 +01:00
Erik Krogh Kristensen
68fb8c52e9 check the type of the this-type, instead of the AST-node 2020-03-02 16:35:16 +01:00
Erik Krogh Kristensen
e0fcc4af6a handle this parameters when finding unreachable overloads 2020-03-02 16:26:00 +01:00
Mathias Vorreiter Pedersen
0b082a4089 C++: Only do argument check for 2020-03-02 16:22:05 +01:00
Jonas Jensen
76066afe6a C++: Add getCanonicalQLClass overrides in Variable 2020-03-02 13:49:12 +01:00
Erik Krogh Kristensen
019266e537 change name of Useless cat 2020-03-02 13:06:08 +01:00
Erik Krogh Kristensen
26fd17bf39 recognize utility functions implementing a StartsWith check 2020-03-02 13:00:58 +01:00
Mathias Vorreiter Pedersen
9df7a7a87e Merge branch 'master' into inexact-is-chi-for-all-aliased-memory 2020-03-02 12:34:24 +01:00
Erik Krogh Kristensen
391b6a833c add link to The Useless Use of Cat Award 2020-03-02 12:28:51 +01:00
Mathias Vorreiter Pedersen
20529b4436 C++/C#: Sync identical files 2020-03-02 12:15:54 +01:00
Mathias Vorreiter Pedersen
14d836ba59 C++: should only match those functions that has the same number of parameters as the call has arguments. 2020-03-02 12:15:28 +01:00
Asger Feldthaus
e405a9769c JS: Really autoformat everything 2020-03-02 10:48:33 +00:00
semmle-qlci
228bd73bd2 Merge pull request #2944 from erik-krogh/YetAnotherPrefix
Approved by esbena
2020-03-02 10:07:47 +00:00
Mathias Vorreiter Pedersen
3a3aa75121 Merge pull request #2935 from jbj/MissingEnumCaseInSwitch-perf
C++: Optimize EnumSwitch.getAMissingCase
2020-03-02 10:32:44 +01:00
Anders Schack-Mulligen
b210009eec Merge pull request #2923 from yo-h/java-customizations
Java: add `Customizations.qll`
2020-03-02 09:58:34 +01:00
Jonas Jensen
dab6691eb0 Merge pull request #2900 from dbartol/dbartol/void-buffer
C++: Better fix for `void` type on buffer access
2020-03-02 09:00:15 +01:00
Jonas Jensen
ec85f9f1a1 Merge pull request #2797 from rdmarsh2/rdmarsh/cpp/malloc-alias-locations
C++: Support dynamic memory allocations in IR alias analysis
2020-03-02 08:49:59 +01:00
Jonas Jensen
30b5db3b7f C++: autoformat fixup 2020-03-02 08:48:54 +01:00
Robert Marsh
28ee756c6a Merge pull request #2934 from geoffw0/add_tests
C++: Test and typos.
2020-02-28 15:12:32 -08:00
Geoffrey White
c6b0d4bbda C#: Sync identical files. 2020-02-28 17:55:59 +00:00
Geoffrey White
82191102d9 Merge pull request #2930 from jbj/getUnconverted
C++: Add Expr.getUnconverted predicate
2020-02-28 14:25:36 +00:00
Erik Krogh Kristensen
71ff32e930 recognize another prefix check for js/path-injection 2020-02-28 14:55:41 +01:00
Geoffrey White
4ca57db553 Merge pull request #2929 from Semmle/rc/1.23
Merge rc/1.23 into master
2020-02-28 09:30:20 +00:00
Erik Krogh Kristensen
5e0ae7b4d0 add end </p> tag 2020-02-28 10:23:03 +01:00
Jonas Jensen
0be13e45f2 Merge remote-tracking branch 'upstream/master' into MissingEnumCaseInSwitch-perf 2020-02-28 09:57:29 +01:00
Erik Krogh Kristensen
ce9cd53bf1 Merge remote-tracking branch 'upstream/master' into UselessCat 2020-02-28 09:56:23 +01:00
Erik Krogh Kristensen
d8a96dd771 change name to suggestion from previous code review 2020-02-28 09:55:15 +01:00
Erik Krogh Kristensen
922779e049 remove double a/an and adjust line lenghts 2020-02-28 09:48:07 +01:00
Erik Krogh Kristensen
17f1974e05 Apply suggestions from code review
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
2020-02-28 09:43:32 +01:00
semmle-qlci
ec90627a64 Merge pull request #2909 from yo-h/experimental
Approved by aschackmull, jbj, max-schaefer, tausbn
2020-02-28 03:15:58 +00:00
yo-h
f8bf055fe1 Merge pull request #2927 from aschackmull/java/taintgettersetter-tests
Java: Add some more taint-getter-setter tests.
2020-02-27 22:12:25 -05:00
yo-h
7dc5f9446a Merge pull request #2920 from aschackmull/java/typeflow-irrelevant-pruning
Java: Remove some irrelevant bounds from TypeFlow.
2020-02-27 22:10:32 -05:00
Rebecca Valentine
d19957f09d Puts use_of_apply example back into expressions_test to avoid messing up other tests 2020-02-27 10:44:46 -08:00
Dave Bartolomeo
b0fb16c068 C++/C#: Fix formatting 2020-02-27 13:44:02 -05:00
Robert Marsh
ac517b7428 Merge branch 'master' into rdmarsh/cpp/malloc-alias-locations 2020-02-27 08:55:20 -08:00
Geoffrey White
729c310eb9 C++: More typos. 2020-02-27 15:49:59 +00:00
Jonas Jensen
d686347315 C++: Optimize EnumSwitch.getAMissingCase
The `cpp/missing-case-in-switch` performed badly on some snapshots, to
the extent where it was as slow as the most expensive IR stages
(example: ChakraCore). This commit makes it faster, removing a
`pragma[noopt]` along the way.

The intermediate tuple counts on a customer codebase drop from 84M to
3M, while the content hash of `getAMissingCase` is the same.

Before:

    (124s) Tuple counts for Stmt::EnumSwitch::getAMissingCase#ff#antijoin_rhs:
    20867789 ~0%       {3} r1 = JOIN Stmt::SwitchStmt::getASwitchCase_dispred#ff AS L WITH Stmt::EnumSwitch::getAMissingCase#ff#shared AS R ON FIRST 1 OUTPUT L.<1>, R.<0>, R.<1>
    20122830 ~0%       {3} r2 = JOIN r1 WITH Stmt::SwitchCase::getExpr_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<2>
    20122830 ~0%       {3} r3 = JOIN r2 WITH Expr::Expr::getValue_dispred#ff AS R ON FIRST 1 OUTPUT r2.<2>, r2.<1>, R.<1>
    83961918 ~0%       {4} r4 = JOIN r3 WITH Enum::EnumConstant::getInitializer_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r3.<1>, r3.<0>, r3.<2>
    83961918 ~0%       {4} r5 = JOIN r4 WITH initialisers AS R ON FIRST 1 OUTPUT R.<2>, r4.<3>, r4.<1>, r4.<2>
    234348   ~185%     {2} r6 = JOIN r5 WITH Expr::Expr::getValue_dispred#ff AS R ON FIRST 2 OUTPUT r5.<2>, r5.<3>
                       return r6
    ...
    (124s) Tuple counts for Stmt::EnumSwitch::getAMissingCase#ff:
    663127 ~4%     {2} r1 = Stmt::EnumSwitch::getAMissingCase#ff#shared AS L AND NOT Stmt::EnumSwitch::getAMissingCase#ff#antijoin_rhs AS R(L.<0>, L.<1>)
                   return r1
    (124s) Registering Stmt::EnumSwitch::getAMissingCase#ff + [] with content 2060ff326cvhihcsvoph6k9divuv4
    (124s)  >>> Wrote relation Stmt::EnumSwitch::getAMissingCase#ff with 663127 rows and 2 columns.

After:

    (5s) Tuple counts for Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs:
    746029   ~0%       {2} r1 = JOIN Stmt::EnumSwitch::getAMissingCase_dispred#ff#shared AS L WITH Enum::Enum::getAnEnumConstant_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, L.<1>
    3116197  ~2%       {3} r2 = JOIN r1 WITH Enum::EnumConstant::getInitializer_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<0>
    3116197  ~0%       {3} r3 = JOIN r2 WITH initialisers AS R ON FIRST 1 OUTPUT R.<2>, r2.<1>, r2.<2>
    3116197  ~311%     {3} r4 = JOIN r3 WITH Expr::Expr::getValue_dispred#ff AS R ON FIRST 1 OUTPUT r3.<1>, R.<1>, r3.<2>
    234348   ~185%     {2} r5 = JOIN r4 WITH Stmt::EnumSwitch::matchesValue#ff AS R ON FIRST 2 OUTPUT r4.<0>, r4.<2>
                       return r5
    (5s) Registering Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs + [] with content 173483d71508vl534mvlr1g0ehi12
    (5s)  >>> Wrote relation Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs with 82902 rows and 2 columns.
    (5s) Starting to evaluate predicate Stmt::EnumSwitch::getAMissingCase_dispred#ff/2@ae4c0b
    (5s) Tuple counts for Stmt::EnumSwitch::getAMissingCase_dispred#ff:
    746029 ~2%     {2} r1 = JOIN Stmt::EnumSwitch::getAMissingCase_dispred#ff#shared AS L WITH Enum::Enum::getAnEnumConstant_dispred#ff AS R ON FIRST 1 OUTPUT L.<1>, R.<1>
    663127 ~4%     {2} r2 = r1 AND NOT Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs AS R(r1.<0>, r1.<1>)
                   return r2
    (5s) Registering Stmt::EnumSwitch::getAMissingCase_dispred#ff + [] with content 2060ff326cvhihcsvoph6k9divuv4
    (5s)  >>> Wrote relation Stmt::EnumSwitch::getAMissingCase_dispred#ff with 663127 rows and 2 columns.
2020-02-27 16:27:52 +01:00
Geoffrey White
f8a61ffc4c C++: Expand the test as described in ODASA-640. 2020-02-27 15:26:53 +00:00
Geoffrey White
0a7d9db335 C++: Add example described in ODASA-640. 2020-02-27 15:23:16 +00:00