C++: Add an 'hasIncompleteSsa' predicate to check whether a function has correctly modelled SSA information.

Author: MathiasVP

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll

@@ -58,4 +58,12 @@ class IRFunction extends IRFunctionBase {
    * Gets all blocks in this function.
    */
   final IRBlock getABlock() { result.getEnclosingIRFunction() = this }
+
+  /**
+   * Holds if this function may have incomplete def-use information.
+   *
+   * Def-use information may be omitted for a function when it is too expensive
+   * to compute.
+   */
+  final predicate hasIncompleteSsa() { Construction::hasIncompleteSsa(this) }
 }

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll

@@ -1319,6 +1319,18 @@ predicate canReuseSsaForMemoryResult(Instruction instruction) {
   // We don't support reusing SSA for any location that could create a `Chi` instruction.
 }
 
+/**
+ * Holds if the def-use information for `f` may have been omitted because it
+ * was too expensive to compute. This happens if one of the memory allocations
+ * in `f` is a busy definition (i.e., it has many different overlapping uses).
+ */
+predicate hasIncompleteSsa(IRFunction f) {
+  exists(Alias::MemoryLocation0 defLocation |
+    Alias::isBusyDef(defLocation) and
+    defLocation.getIRFunction() = f
+  )
+}
+
 /**
  * Expose some of the internal predicates to PrintSSA.qll. We do this by publicly importing those modules in the
  * `DebugSsa` module, which is then imported by PrintSSA.

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRFunction.qll

@@ -58,4 +58,12 @@ class IRFunction extends IRFunctionBase {
    * Gets all blocks in this function.
    */
   final IRBlock getABlock() { result.getEnclosingIRFunction() = this }
+
+  /**
+   * Holds if this function may have incomplete def-use information.
+   *
+   * Def-use information may be omitted for a function when it is too expensive
+   * to compute.
+   */
+  final predicate hasIncompleteSsa() { Construction::hasIncompleteSsa(this) }
 }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll

@@ -220,6 +220,8 @@ Instruction getMemoryOperandDefinition(
   none()
 }
 
+predicate hasIncompleteSsa(IRFunction f) { none() }
+
 /**
  * Holds if the operand totally overlaps with its definition and consumes the
  * bit range `[startBitOffset, endBitOffset)`.

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll

@@ -58,4 +58,12 @@ class IRFunction extends IRFunctionBase {
    * Gets all blocks in this function.
    */
   final IRBlock getABlock() { result.getEnclosingIRFunction() = this }
+
+  /**
+   * Holds if this function may have incomplete def-use information.
+   *
+   * Def-use information may be omitted for a function when it is too expensive
+   * to compute.
+   */
+  final predicate hasIncompleteSsa() { Construction::hasIncompleteSsa(this) }
 }

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll

@@ -1319,6 +1319,18 @@ predicate canReuseSsaForMemoryResult(Instruction instruction) {
   // We don't support reusing SSA for any location that could create a `Chi` instruction.
 }
 
+/**
+ * Holds if the def-use information for `f` may have been omitted because it
+ * was too expensive to compute. This happens if one of the memory allocations
+ * in `f` is a busy definition (i.e., it has many different overlapping uses).
+ */
+predicate hasIncompleteSsa(IRFunction f) {
+  exists(Alias::MemoryLocation0 defLocation |
+    Alias::isBusyDef(defLocation) and
+    defLocation.getIRFunction() = f
+  )
+}
+
 /**
  * Expose some of the internal predicates to PrintSSA.qll. We do this by publicly importing those modules in the
  * `DebugSsa` module, which is then imported by PrintSSA.