Skip to content

Commit 161e5a4

Browse files
author
Robert Marsh
committed
Merge branch 'main' into rdmarsh2/swift/keypath-write-flow
2 parents 1082b1d + 109bd90 commit 161e5a4

73 files changed

Lines changed: 1186 additions & 342 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@
1111
<ItemGroup>
1212
<PackageReference Include="System.IO.FileSystem" Version="4.3.0" />
1313
<PackageReference Include="System.IO.FileSystem.Primitives" Version="4.3.0" />
14-
<PackageReference Include="xunit" Version="2.5.0" />
15-
<PackageReference Include="xunit.runner.visualstudio" Version="2.5.0">
14+
<PackageReference Include="xunit" Version="2.4.2" />
15+
<PackageReference Include="xunit.runner.visualstudio" Version="2.4.5">
1616
<PrivateAssets>all</PrivateAssets>
1717
<IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
1818
</PackageReference>
19-
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.7.1" />
19+
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.4.0" />
2020
</ItemGroup>
2121

2222
<ItemGroup>

‎cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
</ItemGroup>
1818

1919
<ItemGroup>
20-
<PackageReference Include="Microsoft.Build" Version="17.7.2" />
20+
<PackageReference Include="Microsoft.Build" Version="17.3.2" />
2121
</ItemGroup>
2222

2323
<ItemGroup>

‎cpp/ql/lib/change-notes/2023-09-06-as-defining-argument-off-by-one-fix.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `DataFlow::asDefiningArgument` predicate now takes its argument from the range starting at `1` instead of `2`. Queries that depend on the single-parameter version of `DataFlow::asDefiningArgument` should have their arguments updated accordingly.

‎cpp/ql/lib/change-notes/2023-09-07-return-from-end.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Treat functions that reach the end of the function as returning in the IR.
5+
They used to be treated as unreachable but it is allowed in C.

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -254,9 +254,7 @@ class Node extends TIRDataFlowNode {
254254
* after the `f` has returned.
255255
*/
256256
Expr asDefiningArgument(int index) {
257-
// Subtract one because `DefinitionByReferenceNode` is defined to be in
258-
// the range `[0 ... n - 1]` for some `n` instead of `[1 ... n]`.
259-
this.(DefinitionByReferenceNode).getIndirectionIndex() = index - 1 and
257+
this.(DefinitionByReferenceNode).getIndirectionIndex() = index and
260258
result = this.(DefinitionByReferenceNode).getArgument()
261259
}
262260

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConstruction.qll‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -405,9 +405,6 @@ predicate hasUnreachedInstruction(IRFunction func) {
405405
exists(Call c |
406406
c.getEnclosingFunction() = func.getFunction() and
407407
any(Options opt).exits(c.getTarget())
408-
) and
409-
not exists(TranslatedUnreachableReturnStmt return |
410-
return.getEnclosingFunction().getFunction() = func.getFunction()
411408
)
412409
}
413410

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll‎

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -442,29 +442,26 @@ class TranslatedReturnVoidStmt extends TranslatedReturnStmt {
442442

443443
/**
444444
* The IR translation of an implicit `return` statement generated by the extractor to handle control
445-
* flow that reaches the end of a non-`void`-returning function body. Since such control flow
446-
* produces undefined behavior, we simply generate an `Unreached` instruction to prevent that flow
447-
* from continuing on to pollute other analysis. The assumption is that the developer is certain
448-
* that the implicit `return` is unreachable, even if the compiler cannot prove it.
445+
* flow that reaches the end of a non-`void`-returning function body. Such control flow
446+
* produces undefined behavior in C++ but not in C. However even in C using the return value is
447+
* undefined behaviour. We make it return uninitialized memory to get as much flow as possible.
449448
*/
450-
class TranslatedUnreachableReturnStmt extends TranslatedReturnStmt {
451-
TranslatedUnreachableReturnStmt() {
449+
class TranslatedNoValueReturnStmt extends TranslatedReturnStmt, TranslatedVariableInitialization {
450+
TranslatedNoValueReturnStmt() {
452451
not stmt.hasExpr() and hasReturnValue(stmt.getEnclosingFunction())
453452
}
454453

455-
override TranslatedElement getChild(int id) { none() }
456-
457-
override Instruction getFirstInstruction() { result = this.getInstruction(OnlyInstructionTag()) }
458-
459-
override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
460-
tag = OnlyInstructionTag() and
461-
opcode instanceof Opcode::Unreached and
462-
resultType = getVoidType()
454+
final override Instruction getInitializationSuccessor() {
455+
result = this.getEnclosingFunction().getReturnSuccessorInstruction()
463456
}
464457

465-
override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) { none() }
458+
final override Type getTargetType() { result = this.getEnclosingFunction().getReturnType() }
466459

467-
override Instruction getChildSuccessor(TranslatedElement child) { none() }
460+
final override TranslatedInitialization getInitialization() { none() }
461+
462+
final override IRVariable getIRVariable() {
463+
result = this.getEnclosingFunction().getReturnVariable()
464+
}
468465
}
469466

470467
/**

‎cpp/ql/test/library-tests/ir/ir/operand_locations.expected‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6207,10 +6207,12 @@
62076207
| ir.cpp:1286:25:1286:49 | ChiPartial | partial:m1286_7 |
62086208
| ir.cpp:1286:25:1286:49 | ChiTotal | total:m1286_4 |
62096209
| ir.cpp:1286:25:1286:49 | SideEffect | ~m1286_4 |
6210-
| ir.cpp:1289:5:1289:22 | Address | &:r1289_9 |
6210+
| ir.cpp:1289:5:1289:22 | Address | &:r1289_10 |
62116211
| ir.cpp:1289:5:1289:22 | ChiPartial | partial:m1289_3 |
62126212
| ir.cpp:1289:5:1289:22 | ChiTotal | total:m1289_2 |
6213-
| ir.cpp:1289:5:1289:22 | Load | m1291_4 |
6213+
| ir.cpp:1289:5:1289:22 | Load | m1289_9 |
6214+
| ir.cpp:1289:5:1289:22 | Phi | from 2:m1291_4 |
6215+
| ir.cpp:1289:5:1289:22 | Phi | from 3:m1293_2 |
62146216
| ir.cpp:1289:5:1289:22 | SideEffect | m1289_3 |
62156217
| ir.cpp:1289:29:1289:29 | Address | &:r1289_5 |
62166218
| ir.cpp:1289:36:1289:36 | Address | &:r1289_7 |
@@ -6221,6 +6223,7 @@
62216223
| ir.cpp:1291:16:1291:16 | Address | &:r1291_2 |
62226224
| ir.cpp:1291:16:1291:16 | Load | m1289_8 |
62236225
| ir.cpp:1291:16:1291:16 | StoreValue | r1291_3 |
6226+
| ir.cpp:1293:1:1293:1 | Address | &:r1293_1 |
62246227
| ir.cpp:1295:6:1295:15 | ChiPartial | partial:m1295_3 |
62256228
| ir.cpp:1295:6:1295:15 | ChiTotal | total:m1295_2 |
62266229
| ir.cpp:1295:6:1295:15 | SideEffect | ~m1296_8 |
@@ -8393,16 +8396,23 @@
83938396
| ir.cpp:1747:39:1747:39 | ChiTotal | total:m1747_20 |
83948397
| ir.cpp:1747:39:1747:39 | SideEffect | ~m1747_4 |
83958398
| ir.cpp:1747:39:1747:39 | SideEffect | ~m1747_15 |
8399+
| ir.cpp:1750:5:1750:34 | Address | &:r1750_5 |
83968400
| ir.cpp:1750:5:1750:34 | ChiPartial | partial:m1750_3 |
83978401
| ir.cpp:1750:5:1750:34 | ChiTotal | total:m1750_2 |
8402+
| ir.cpp:1750:5:1750:34 | Load | m1755_2 |
8403+
| ir.cpp:1750:5:1750:34 | SideEffect | ~m1754_10 |
83988404
| ir.cpp:1751:51:1751:51 | Address | &:r1751_1 |
83998405
| ir.cpp:1751:51:1751:51 | Address | &:r1751_1 |
84008406
| ir.cpp:1751:51:1751:51 | Address | &:r1751_3 |
8407+
| ir.cpp:1751:51:1751:51 | Address | &:r1751_3 |
84018408
| ir.cpp:1751:51:1751:51 | Load | m1751_2 |
8409+
| ir.cpp:1751:51:1751:51 | SideEffect | m1751_4 |
84028410
| ir.cpp:1752:48:1752:48 | Address | &:r1752_1 |
84038411
| ir.cpp:1752:48:1752:48 | Address | &:r1752_1 |
84048412
| ir.cpp:1752:48:1752:48 | Address | &:r1752_3 |
8413+
| ir.cpp:1752:48:1752:48 | Address | &:r1752_3 |
84058414
| ir.cpp:1752:48:1752:48 | Load | m1752_2 |
8415+
| ir.cpp:1752:48:1752:48 | SideEffect | m1752_4 |
84068416
| ir.cpp:1753:40:1753:41 | Address | &:r1753_1 |
84078417
| ir.cpp:1753:40:1753:41 | Address | &:r1753_1 |
84088418
| ir.cpp:1753:40:1753:41 | Arg(this) | this:r1753_1 |
@@ -8435,6 +8445,7 @@
84358445
| ir.cpp:1754:42:1754:42 | SideEffect | ~m1752_4 |
84368446
| ir.cpp:1754:42:1754:42 | Unary | r1754_5 |
84378447
| ir.cpp:1754:42:1754:42 | Unary | r1754_6 |
8448+
| ir.cpp:1755:1:1755:1 | Address | &:r1755_1 |
84388449
| ir.cpp:1757:6:1757:22 | ChiPartial | partial:m1757_3 |
84398450
| ir.cpp:1757:6:1757:22 | ChiTotal | total:m1757_2 |
84408451
| ir.cpp:1757:6:1757:22 | SideEffect | m1757_3 |
@@ -9588,22 +9599,27 @@
95889599
| ir.cpp:2021:23:2021:40 | SideEffect | ~m2021_27 |
95899600
| ir.cpp:2021:23:2021:40 | Unary | r2021_20 |
95909601
| ir.cpp:2021:23:2021:40 | Unary | r2021_28 |
9602+
| ir.cpp:2026:14:2026:22 | Address | &:r2026_7 |
95919603
| ir.cpp:2026:14:2026:22 | ChiPartial | partial:m2026_3 |
95929604
| ir.cpp:2026:14:2026:22 | ChiTotal | total:m2026_2 |
9605+
| ir.cpp:2026:14:2026:22 | Load | m2031_2 |
9606+
| ir.cpp:2026:14:2026:22 | SideEffect | ~m2028_6 |
95939607
| ir.cpp:2026:37:2026:37 | Address | &:r2026_5 |
95949608
| ir.cpp:2027:16:2027:16 | Address | &:r2027_1 |
9595-
| ir.cpp:2028:3:2028:3 | Address | &:r2028_9 |
9609+
| ir.cpp:2028:3:2028:3 | Address | &:r2028_10 |
95969610
| ir.cpp:2028:7:2028:7 | Address | &:r2028_1 |
95979611
| ir.cpp:2028:7:2028:7 | Left | r2028_2 |
95989612
| ir.cpp:2028:7:2028:7 | Load | m2026_6 |
95999613
| ir.cpp:2028:7:2028:13 | Condition | r2028_4 |
9600-
| ir.cpp:2028:7:2030:28 | Address | &:r2028_7 |
9601-
| ir.cpp:2028:7:2030:28 | Address | &:r2028_11 |
9602-
| ir.cpp:2028:7:2030:28 | Address | &:r2028_13 |
9603-
| ir.cpp:2028:7:2030:28 | Load | m2028_6 |
9604-
| ir.cpp:2028:7:2030:28 | Phi | from 2:m2028_12 |
9605-
| ir.cpp:2028:7:2030:28 | Phi | from 3:m2028_14 |
9606-
| ir.cpp:2028:7:2030:28 | StoreValue | r2028_8 |
9614+
| ir.cpp:2028:7:2030:28 | Address | &:r2028_8 |
9615+
| ir.cpp:2028:7:2030:28 | Address | &:r2028_12 |
9616+
| ir.cpp:2028:7:2030:28 | Address | &:r2028_14 |
9617+
| ir.cpp:2028:7:2030:28 | Load | m2028_7 |
9618+
| ir.cpp:2028:7:2030:28 | Phi | from 2:m2028_13 |
9619+
| ir.cpp:2028:7:2030:28 | Phi | from 2:~m2029_6 |
9620+
| ir.cpp:2028:7:2030:28 | Phi | from 3:m2028_15 |
9621+
| ir.cpp:2028:7:2030:28 | Phi | from 3:~m2030_6 |
9622+
| ir.cpp:2028:7:2030:28 | StoreValue | r2028_9 |
96079623
| ir.cpp:2028:11:2028:13 | Right | r2028_3 |
96089624
| ir.cpp:2029:6:2029:20 | CallTarget | func:r2029_1 |
96099625
| ir.cpp:2029:6:2029:20 | ChiPartial | partial:m2029_5 |
@@ -9626,6 +9642,7 @@
96269642
| ir.cpp:2030:22:2030:22 | Arg(0) | 0:r2030_3 |
96279643
| ir.cpp:2030:22:2030:22 | Load | m2026_6 |
96289644
| ir.cpp:2030:26:2030:27 | Unary | r2030_7 |
9645+
| ir.cpp:2031:1:2031:1 | Address | &:r2031_1 |
96299646
| ir.cpp:2033:6:2033:17 | ChiPartial | partial:m2033_3 |
96309647
| ir.cpp:2033:6:2033:17 | ChiTotal | total:m2033_2 |
96319648
| ir.cpp:2033:6:2033:17 | SideEffect | ~m2036_6 |
@@ -9721,8 +9738,11 @@
97219738
| ir.cpp:2051:32:2051:32 | Address | &:r2051_7 |
97229739
| ir.cpp:2051:32:2051:32 | Load | m2051_6 |
97239740
| ir.cpp:2051:32:2051:32 | SideEffect | m2051_8 |
9741+
| ir.cpp:2056:5:2056:18 | Address | &:r2056_5 |
97249742
| ir.cpp:2056:5:2056:18 | ChiPartial | partial:m2056_3 |
97259743
| ir.cpp:2056:5:2056:18 | ChiTotal | total:m2056_2 |
9744+
| ir.cpp:2056:5:2056:18 | Load | m2066_2 |
9745+
| ir.cpp:2056:5:2056:18 | SideEffect | ~m2065_6 |
97269746
| ir.cpp:2058:12:2058:13 | Address | &:r2058_1 |
97279747
| ir.cpp:2058:17:2058:27 | Address | &:r2058_4 |
97289748
| ir.cpp:2058:17:2058:27 | Address | &:r2058_8 |
@@ -9796,6 +9816,7 @@
97969816
| ir.cpp:2065:12:2065:12 | Address | &:r2065_2 |
97979817
| ir.cpp:2065:12:2065:12 | Arg(0) | 0:r2065_3 |
97989818
| ir.cpp:2065:12:2065:12 | Load | m2064_15 |
9819+
| ir.cpp:2066:1:2066:1 | Address | &:r2066_1 |
97999820
| ir.cpp:2070:6:2070:26 | ChiPartial | partial:m2070_3 |
98009821
| ir.cpp:2070:6:2070:26 | ChiTotal | total:m2070_2 |
98019822
| ir.cpp:2070:6:2070:26 | SideEffect | ~m2072_5 |

‎cpp/ql/test/library-tests/ir/ir/raw_consistency.expected‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,15 @@ unnecessaryPhiInstruction
1212
memoryOperandDefinitionIsUnmodeled
1313
operandAcrossFunctions
1414
instructionWithoutUniqueBlock
15+
missingCanonicalLanguageType
16+
multipleCanonicalLanguageTypes
1517
containsLoopOfForwardEdges
18+
missingIRType
19+
multipleIRTypes
1620
lostReachability
1721
backEdgeCountMismatch
1822
useNotDominatedByDefinition
1923
| ir.cpp:1486:8:1486:8 | Unary | Operand 'Unary' is not dominated by its definition in function '$@'. | ir.cpp:1486:8:1486:8 | void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct() | void StructuredBindingDataMemberStruct::StructuredBindingDataMemberStruct() |
20-
| ir.cpp:1751:51:1751:51 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | ir.cpp:1750:5:1750:34 | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) |
21-
| ir.cpp:1752:48:1752:48 | Address | Operand 'Address' is not dominated by its definition in function '$@'. | ir.cpp:1750:5:1750:34 | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) | int implicit_copy_constructor_test(CopyConstructorTestNonVirtualClass const&, CopyConstructorTestVirtualClass const&) |
2224
| try_except.c:13:13:13:13 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | try_except.c:6:6:6:6 | void f() | void f() |
2325
| try_except.c:13:13:13:13 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | try_except.c:6:6:6:6 | void f() | void f() |
2426
| try_except.c:39:15:39:15 | Left | Operand 'Left' is not dominated by its definition in function '$@'. | try_except.c:32:6:32:6 | void h(int) | void h(int) |
@@ -35,8 +37,4 @@ nonUniqueEnclosingIRFunction
3537
fieldAddressOnNonPointer
3638
thisArgumentIsNonPointer
3739
nonUniqueIRVariable
38-
missingCanonicalLanguageType
39-
multipleCanonicalLanguageTypes
40-
missingIRType
41-
multipleIRTypes
4240
missingCppType

0 commit comments

Comments
 (0)