Skip to content

Commit d88c498

Browse files
aschackmullaschackmull
authored
Merge pull request #16456 from aschackmull/dataflow/callcontext-grouping
Dataflow: Implement call context grouping to improve performance
2 parents bd6e233 + 51c48c7 commit d88c498

File tree

23 files changed

+933
-421
lines changed

23 files changed

+933
-421
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ private import DataFlowUtil
99
/**
1010
* Gets a function that might be called by `call`.
1111
*/
12-
Function viableCallable(DataFlowCall call) {
12+
DataFlowCallable viableCallable(DataFlowCall call) {
1313
result = call.(Call).getTarget()
1414
or
1515
// If the target of the call does not have a body in the snapshot, it might

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,17 @@ class CastNode extends Node {
242242
CastNode() { none() } // stub implementation
243243
}
244244

245-
class DataFlowCallable = Function;
245+
class DataFlowCallable extends Function {
246+
/** Gets a best-effort total ordering. */
247+
int totalorder() {
248+
this =
249+
rank[result](DataFlowCallable c, string file, int startline, int startcolumn |
250+
c.getLocation().hasLocationInfo(file, startline, startcolumn, _, _)
251+
|
252+
c order by file, startline, startcolumn
253+
)
254+
}
255+
}
246256

247257
class DataFlowExpr = Expr;
248258

@@ -261,10 +271,28 @@ class DataFlowCall extends Expr instanceof Call {
261271
ExprNode getNode() { result.getExpr() = this }
262272

263273
/** Gets the enclosing callable of this call. */
264-
Function getEnclosingCallable() { result = this.getEnclosingFunction() }
274+
DataFlowCallable getEnclosingCallable() { result = this.getEnclosingFunction() }
275+
276+
/** Gets a best-effort total ordering. */
277+
int totalorder() {
278+
this =
279+
rank[result](DataFlowCall c, int startline, int startcolumn |
280+
c.getLocation().hasLocationInfo(_, startline, startcolumn, _, _)
281+
|
282+
c order by startline, startcolumn
283+
)
284+
}
285+
}
286+
287+
class NodeRegion instanceof Unit {
288+
string toString() { result = "NodeRegion" }
289+
290+
predicate contains(Node n) { none() }
291+
292+
int totalOrder() { result = 1 }
265293
}
266294

267-
predicate isUnreachableInCall(Node n, DataFlowCall call) { none() } // stub implementation
295+
predicate isUnreachableInCall(NodeRegion nr, DataFlowCall call) { none() } // stub implementation
268296

269297
/**
270298
* Holds if access paths with `c` at their head always should be tracked at high

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 46 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,6 +1062,16 @@ class DataFlowCallable extends TDataFlowCallable {
10621062
result = this.asSummarizedCallable() or // SummarizedCallable = Function (in CPP)
10631063
result = this.asSourceCallable()
10641064
}
1065+
1066+
/** Gets a best-effort total ordering. */
1067+
int totalorder() {
1068+
this =
1069+
rank[result](DataFlowCallable c, string file, int startline, int startcolumn |
1070+
c.getLocation().hasLocationInfo(file, startline, startcolumn, _, _)
1071+
|
1072+
c order by file, startline, startcolumn
1073+
)
1074+
}
10651075
}
10661076

10671077
/**
@@ -1159,6 +1169,16 @@ class DataFlowCall extends TDataFlowCall {
11591169
* Gets the location of this call.
11601170
*/
11611171
Location getLocation() { none() }
1172+
1173+
/** Gets a best-effort total ordering. */
1174+
int totalorder() {
1175+
this =
1176+
rank[result](DataFlowCall c, int startline, int startcolumn |
1177+
c.getLocation().hasLocationInfo(_, startline, startcolumn, _, _)
1178+
|
1179+
c order by startline, startcolumn
1180+
)
1181+
}
11621182
}
11631183

11641184
/**
@@ -1247,43 +1267,53 @@ module IsUnreachableInCall {
12471267
any(G::IRGuardCondition guard).ensuresLt(left, right, k, block, areEqual)
12481268
}
12491269

1250-
predicate isUnreachableInCall(Node n, DataFlowCall call) {
1270+
class NodeRegion instanceof IRBlock {
1271+
string toString() { result = "NodeRegion" }
1272+
1273+
predicate contains(Node n) { this = n.getBasicBlock() }
1274+
1275+
int totalOrder() {
1276+
this =
1277+
rank[result](IRBlock b, int startline, int startcolumn |
1278+
b.getLocation().hasLocationInfo(_, startline, startcolumn, _, _)
1279+
|
1280+
b order by startline, startcolumn
1281+
)
1282+
}
1283+
}
1284+
1285+
predicate isUnreachableInCall(NodeRegion block, DataFlowCall call) {
12511286
exists(
12521287
InstructionDirectParameterNode paramNode, ConstantIntegralTypeArgumentNode arg,
1253-
IntegerConstantInstruction constant, int k, Operand left, Operand right, IRBlock block
1288+
IntegerConstantInstruction constant, int k, Operand left, Operand right, int argval
12541289
|
12551290
// arg flows into `paramNode`
1256-
DataFlowImplCommon::viableParamArg(call, paramNode, arg) and
1291+
DataFlowImplCommon::viableParamArg(call, pragma[only_bind_into](paramNode),
1292+
pragma[only_bind_into](arg)) and
12571293
left = constant.getAUse() and
12581294
right = valueNumber(paramNode.getInstruction()).getAUse() and
1259-
block = n.getBasicBlock()
1295+
argval = arg.getValue()
12601296
|
12611297
// and there's a guard condition which ensures that the result of `left == right + k` is `areEqual`
1262-
exists(boolean areEqual |
1263-
ensuresEq(pragma[only_bind_into](left), pragma[only_bind_into](right),
1264-
pragma[only_bind_into](k), pragma[only_bind_into](block), areEqual)
1265-
|
1298+
exists(boolean areEqual | ensuresEq(left, right, k, block, areEqual) |
12661299
// this block ensures that left = right + k, but it holds that `left != right + k`
12671300
areEqual = true and
1268-
constant.getValue().toInt() != arg.getValue() + k
1301+
constant.getValue().toInt() != argval + k
12691302
or
12701303
// this block ensures that or `left != right + k`, but it holds that `left = right + k`
12711304
areEqual = false and
1272-
constant.getValue().toInt() = arg.getValue() + k
1305+
constant.getValue().toInt() = argval + k
12731306
)
12741307
or
12751308
// or there's a guard condition which ensures that the result of `left < right + k` is `isLessThan`
1276-
exists(boolean isLessThan |
1277-
ensuresLt(pragma[only_bind_into](left), pragma[only_bind_into](right),
1278-
pragma[only_bind_into](k), pragma[only_bind_into](block), isLessThan)
1279-
|
1309+
exists(boolean isLessThan | ensuresLt(left, right, k, block, isLessThan) |
12801310
isLessThan = true and
12811311
// this block ensures that `left < right + k`, but it holds that `left >= right + k`
1282-
constant.getValue().toInt() >= arg.getValue() + k
1312+
constant.getValue().toInt() >= argval + k
12831313
or
12841314
// this block ensures that `left >= right + k`, but it holds that `left < right + k`
12851315
isLessThan = false and
1286-
constant.getValue().toInt() < arg.getValue() + k
1316+
constant.getValue().toInt() < argval + k
12871317
)
12881318
)
12891319
}

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@ edges
6161
| test.cpp:289:19:289:25 | buffer3 | test.cpp:277:35:277:35 | p | provenance | |
6262
| test.cpp:289:19:289:25 | buffer3 | test.cpp:289:19:289:25 | buffer3 | provenance | |
6363
| test.cpp:292:25:292:27 | arr | test.cpp:299:16:299:21 | access to array | provenance | Config |
64-
| test.cpp:292:25:292:27 | arr | test.cpp:299:16:299:21 | access to array | provenance | Config |
6564
| test.cpp:306:20:306:23 | arr1 | test.cpp:292:25:292:27 | arr | provenance | |
6665
| test.cpp:306:20:306:23 | arr1 | test.cpp:306:20:306:23 | arr1 | provenance | |
6766
| test.cpp:309:20:309:23 | arr2 | test.cpp:292:25:292:27 | arr | provenance | |
@@ -159,7 +158,6 @@ nodes
159158
| test.cpp:289:19:289:25 | buffer3 | semmle.label | buffer3 |
160159
| test.cpp:289:19:289:25 | buffer3 | semmle.label | buffer3 |
161160
| test.cpp:292:25:292:27 | arr | semmle.label | arr |
162-
| test.cpp:292:25:292:27 | arr | semmle.label | arr |
163161
| test.cpp:299:16:299:21 | access to array | semmle.label | access to array |
164162
| test.cpp:306:20:306:23 | arr1 | semmle.label | arr1 |
165163
| test.cpp:306:20:306:23 | arr1 | semmle.label | arr1 |

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowDispatch.qll‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,16 @@ class DataFlowCallable extends TDataFlowCallable {
191191
or
192192
result = this.asCapturedVariable().getLocation()
193193
}
194+
195+
/** Gets a best-effort total ordering. */
196+
int totalorder() {
197+
this =
198+
rank[result](DataFlowCallable c, string file, int startline, int startcolumn |
199+
c.getLocation().hasLocationInfo(file, startline, startcolumn, _, _)
200+
|
201+
c order by file, startline, startcolumn
202+
)
203+
}
194204
}
195205

196206
/** A call relevant for data flow. */
@@ -234,6 +244,16 @@ abstract class DataFlowCall extends TDataFlowCall {
234244
) {
235245
this.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
236246
}
247+
248+
/** Gets a best-effort total ordering. */
249+
int totalorder() {
250+
this =
251+
rank[result](DataFlowCall c, int startline, int startcolumn |
252+
c.hasLocationInfo(_, startline, startcolumn, _, _)
253+
|
254+
c order by startline, startcolumn
255+
)
256+
}
237257
}
238258

239259
/** A non-delegate C# call relevant for data flow. */

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2380,16 +2380,31 @@ predicate expectsContent(Node n, ContentSet c) {
23802380
n.asExpr() instanceof SpreadElementExpr and c instanceof ElementContent
23812381
}
23822382

2383+
class NodeRegion instanceof ControlFlow::BasicBlock {
2384+
string toString() { result = "NodeRegion" }
2385+
2386+
predicate contains(Node n) { this = n.getControlFlowNode().getBasicBlock() }
2387+
2388+
int totalOrder() {
2389+
this =
2390+
rank[result](ControlFlow::BasicBlock b, int startline, int startcolumn |
2391+
b.getLocation().hasLocationInfo(_, startline, startcolumn, _, _)
2392+
|
2393+
b order by startline, startcolumn
2394+
)
2395+
}
2396+
}
2397+
23832398
/**
2384-
* Holds if the node `n` is unreachable when the call context is `call`.
2399+
* Holds if the nodes in `nr` are unreachable when the call context is `call`.
23852400
*/
2386-
predicate isUnreachableInCall(Node n, DataFlowCall call) {
2401+
predicate isUnreachableInCall(NodeRegion nr, DataFlowCall call) {
23872402
exists(
23882403
ExplicitParameterNode paramNode, Guard guard, ControlFlow::SuccessorTypes::BooleanSuccessor bs
23892404
|
23902405
viableConstantBooleanParamArg(paramNode, bs.getValue().booleanNot(), call) and
23912406
paramNode.getSsaDefinition().getARead() = guard and
2392-
guard.controlsBlock(n.getControlFlowNode().getBasicBlock(), bs, _)
2407+
guard.controlsBlock(nr, bs, _)
23932408
)
23942409
}
23952410

‎csharp/ql/test/library-tests/dataflow/call-sensitivity/CallSensitivityFlow.expected‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
edges
22
| CallSensitivityFlow.cs:7:38:7:38 | o : Object | CallSensitivityFlow.cs:11:20:11:20 | access to parameter o : Object | provenance | |
3-
| CallSensitivityFlow.cs:7:38:7:38 | o : Object | CallSensitivityFlow.cs:11:20:11:20 | access to parameter o : Object | provenance | |
43
| CallSensitivityFlow.cs:19:39:19:39 | o : Object | CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | provenance | |
54
| CallSensitivityFlow.cs:27:40:27:40 | o : Object | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | provenance | |
6-
| CallSensitivityFlow.cs:27:40:27:40 | o : Object | CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | provenance | |
75
| CallSensitivityFlow.cs:35:41:35:41 | o : Object | CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | provenance | |
86
| CallSensitivityFlow.cs:43:45:43:45 | o : Object | CallSensitivityFlow.cs:45:16:45:17 | access to local variable o1 : Object | provenance | |
97
| CallSensitivityFlow.cs:45:16:45:17 | access to local variable o1 : Object | CallSensitivityFlow.cs:49:20:49:22 | access to local variable tmp : Object | provenance | |
@@ -13,23 +11,18 @@ edges
1311
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | provenance | |
1412
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | provenance | |
1513
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | provenance | |
16-
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | provenance | |
17-
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | provenance | |
1814
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | provenance | |
1915
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | provenance | |
2016
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | provenance | |
2117
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | provenance | |
2218
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | provenance | |
2319
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | provenance | |
24-
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | provenance | |
25-
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | provenance | |
2620
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | provenance | |
2721
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | provenance | |
2822
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | provenance | |
2923
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | provenance | |
3024
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | provenance | |
3125
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | provenance | |
32-
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | provenance | |
3326
| CallSensitivityFlow.cs:78:24:78:35 | object creation of type Object : Object | CallSensitivityFlow.cs:19:39:19:39 | o : Object | provenance | |
3427
| CallSensitivityFlow.cs:79:25:79:36 | object creation of type Object : Object | CallSensitivityFlow.cs:27:40:27:40 | o : Object | provenance | |
3528
| CallSensitivityFlow.cs:80:26:80:37 | object creation of type Object : Object | CallSensitivityFlow.cs:35:41:35:41 | o : Object | provenance | |
@@ -68,13 +61,10 @@ edges
6861
| CallSensitivityFlow.cs:205:40:205:40 | o : Object | CallSensitivityFlow.cs:208:18:208:18 | access to parameter o | provenance | |
6962
nodes
7063
| CallSensitivityFlow.cs:7:38:7:38 | o : Object | semmle.label | o : Object |
71-
| CallSensitivityFlow.cs:7:38:7:38 | o : Object | semmle.label | o : Object |
72-
| CallSensitivityFlow.cs:11:20:11:20 | access to parameter o : Object | semmle.label | access to parameter o : Object |
7364
| CallSensitivityFlow.cs:11:20:11:20 | access to parameter o : Object | semmle.label | access to parameter o : Object |
7465
| CallSensitivityFlow.cs:19:39:19:39 | o : Object | semmle.label | o : Object |
7566
| CallSensitivityFlow.cs:23:18:23:18 | access to parameter o | semmle.label | access to parameter o |
7667
| CallSensitivityFlow.cs:27:40:27:40 | o : Object | semmle.label | o : Object |
77-
| CallSensitivityFlow.cs:27:40:27:40 | o : Object | semmle.label | o : Object |
7868
| CallSensitivityFlow.cs:31:18:31:18 | access to parameter o | semmle.label | access to parameter o |
7969
| CallSensitivityFlow.cs:35:41:35:41 | o : Object | semmle.label | o : Object |
8070
| CallSensitivityFlow.cs:39:18:39:18 | [cond (line 35): true] access to parameter o | semmle.label | [cond (line 35): true] access to parameter o |
@@ -87,23 +77,18 @@ nodes
8777
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | semmle.label | o : Object |
8878
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | semmle.label | o : Object |
8979
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | semmle.label | o : Object |
90-
| CallSensitivityFlow.cs:56:46:56:46 | o : Object | semmle.label | o : Object |
91-
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
9280
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
9381
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
9482
| CallSensitivityFlow.cs:58:16:58:17 | access to local variable o1 : Object | semmle.label | access to local variable o1 : Object |
9583
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | semmle.label | access to local variable tmp : Object |
9684
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | semmle.label | access to local variable tmp : Object |
9785
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | semmle.label | access to local variable tmp : Object |
98-
| CallSensitivityFlow.cs:62:20:62:22 | access to local variable tmp : Object | semmle.label | access to local variable tmp : Object |
99-
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
10086
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
10187
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
10288
| CallSensitivityFlow.cs:63:13:63:14 | access to local variable o2 : Object | semmle.label | access to local variable o2 : Object |
10389
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | semmle.label | access to local variable o3 : Object |
10490
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | semmle.label | access to local variable o3 : Object |
10591
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | semmle.label | access to local variable o3 : Object |
106-
| CallSensitivityFlow.cs:65:16:65:17 | access to local variable o3 : Object | semmle.label | access to local variable o3 : Object |
10792
| CallSensitivityFlow.cs:66:14:66:15 | access to local variable o3 | semmle.label | access to local variable o3 |
10893
| CallSensitivityFlow.cs:78:24:78:35 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |
10994
| CallSensitivityFlow.cs:79:25:79:36 | object creation of type Object : Object | semmle.label | object creation of type Object : Object |

0 commit comments

Comments
 (0)