Merge remote-tracking branch 'origin/main' into dbartol/phi-escape

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll

@@ -106,8 +106,8 @@ private predicate operandEscapesDomain(Operand operand) {
   not isArgumentForParameter(_, operand, _) and
   not isOnlyEscapesViaReturnArgument(operand) and
   not operand.getUse() instanceof ReturnValueInstruction and
-  not operand.getUse() instanceof ReturnIndirectionInstruction and
+  not operand.getUse() instanceof ReturnIndirectionInstruction// and
-  not operand instanceof PhiInputOperand
+//  not operand instanceof PhiInputOperand
 }
 
 /**
@@ -211,9 +211,9 @@ private predicate operandEscapesNonReturn(Operand operand) {
   )
   or
   isOnlyEscapesViaReturnArgument(operand) and resultEscapesNonReturn(operand.getUse())
-  or
+//  or
-  operand instanceof PhiInputOperand and
+//  operand instanceof PhiInputOperand and
-  resultEscapesNonReturn(operand.getUse())
+//  resultEscapesNonReturn(operand.getUse())
   or
   operandEscapesDomain(operand)
 }
@@ -454,6 +454,9 @@ module Print {
       |
         value, ", "
       )
+    or
+    key = "escapes" and
+    result = strictconcat(string value | operandEscapesNonReturn(operand) and value = "nonreturn" | value, ", ")
   }
 
   string getInstructionProperty(Instruction instr, string key) {

cpp/ql/test/library-tests/ir/escape/escape.cpp

@@ -193,10 +193,11 @@ void Escape()
     int passByRef3;
     CallByReferenceParamEscape(ReturnReference(passByRef3));
 
-    int no_ssa_passByPtr4;
+    int ssa_passByPtr4;
-    int no_ssa_passByPtr5;
+    int ssa_passByPtr5;
     bool no_b2 = false;
-    MaybeReturn(&no_ssa_passByPtr4, &no_ssa_passByPtr5, no_b2);
+    // Treated as escaped because we don't know _which_ address will be returned.
+    MaybeReturn(&ssa_passByPtr4, &ssa_passByPtr5, no_b2);
 
     int passByRef6;
     EscapeAndReturn(passByRef6);
@@ -251,3 +252,19 @@ void Escape()
     CallByPointer(no_condTemp);
 }
 
+bool getBool();
+
+void use(int);
+
+void test_while() {
+  int r;
+  int *no_rP = &r;
+
+  while(getBool()) {
+    int s = 0;
+    *no_rP = s;
+    no_rP = &s;
+  }
+
+  use(r);
+}