Skip to content

Commit b959c56

Browse files
committed
C++: Fix barrier guards.
1 parent 0451014 commit b959c56

File tree

1 file changed

+22
-12
lines changed
  • cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal

1 file changed

+22
-12
lines changed

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImpl.qll

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1002,15 +1002,15 @@ private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationI
10021002
result instanceof FalseEdge
10031003
}
10041004

1005-
class GuardValue = Boolean;
1005+
class GuardValue = IRGuards::GuardValue;
10061006

10071007
class Guard instanceof IRGuards::IRGuardCondition {
10081008
string toString() { result = super.toString() }
10091009

10101010
predicate hasValueBranchEdge(IRCfg::BasicBlock bb1, IRCfg::BasicBlock bb2, GuardValue branch) {
10111011
exists(EdgeKind kind |
10121012
super.getBlock() = bb1 and
1013-
kind = getConditionalEdge(branch) and
1013+
kind = getConditionalEdge(branch.asBooleanValue()) and
10141014
bb1.getSuccessor(kind) = bb2
10151015
)
10161016
}
@@ -1023,7 +1023,7 @@ private module DataFlowIntegrationInput implements SsaImpl::DataFlowIntegrationI
10231023
}
10241024

10251025
predicate guardDirectlyControlsBlock(Guard guard, IRCfg::BasicBlock bb, GuardValue branch) {
1026-
guard.(IRGuards::IRGuardCondition).controls(bb, branch)
1026+
guard.(IRGuards::IRGuardCondition).valueControls(bb, branch)
10271027
}
10281028

10291029
predicate keepAllPhiInputBackEdges() { any() }
@@ -1050,25 +1050,35 @@ module BarrierGuardWithIntParam<guardChecksNodeSig/4 guardChecksNode> {
10501050
)
10511051
}
10521052

1053-
private predicate guardChecks(
1054-
DataFlowIntegrationInput::Guard g, SsaImpl::Definition def,
1055-
DataFlowIntegrationInput::GuardValue branch, int indirectionIndex
1053+
private predicate guardChecksInstr(
1054+
IRGuards::Guards_v1::Guard g, IRGuards::GuardsInput::Expr instr, boolean branch,
1055+
int indirectionIndex
10561056
) {
1057-
exists(UseImpl use |
1058-
guardChecksNode(g, use.getNode(), branch, indirectionIndex) and
1059-
ssaDefReachesCertainUse(def, use)
1057+
exists(Node node |
1058+
nodeHasInstruction(node, instr, indirectionIndex) and
1059+
guardChecksNode(g, node, branch, indirectionIndex)
10601060
)
10611061
}
10621062

1063+
private predicate guardChecksWithWrappers(
1064+
DataFlowIntegrationInput::Guard g, SsaImpl::Definition def, IRGuards::GuardValue val,
1065+
int indirectionIndex
1066+
) {
1067+
IRGuards::Guards_v1::ValidationWrapperWithState<int, guardChecksInstr/4>::guardChecksDef(g, def,
1068+
val, indirectionIndex)
1069+
}
1070+
10631071
Node getABarrierNode(int indirectionIndex) {
10641072
// Only get the SynthNodes from the shared implementation, as the ExprNodes cannot
10651073
// be matched on SourceVariable.
10661074
result.(SsaSynthNode).getSynthNode() =
1067-
DataFlowIntegrationImpl::BarrierGuardDefWithState<int, guardChecks/4>::getABarrierNode(indirectionIndex)
1075+
DataFlowIntegrationImpl::BarrierGuardDefWithState<int, guardChecksWithWrappers/4>::getABarrierNode(indirectionIndex)
10681076
or
10691077
// Calculate the guarded UseImpls corresponding to ExprNodes directly.
1070-
exists(DataFlowIntegrationInput::Guard g, boolean branch, Definition def, IRBlock bb |
1071-
guardChecks(g, def, branch, indirectionIndex) and
1078+
exists(
1079+
DataFlowIntegrationInput::Guard g, IRGuards::GuardValue branch, Definition def, IRBlock bb
1080+
|
1081+
guardChecksWithWrappers(g, def, branch, indirectionIndex) and
10721082
exists(UseImpl use |
10731083
ssaDefReachesCertainUse(def, use) and
10741084
use.getBlock() = bb and

0 commit comments

Comments
 (0)