Minimize language-specific code for sign analysis

Author: Dave Bartolomeo

java/ql/lib/semmle/code/java/semantic/SemanticCFG.qll

@@ -21,7 +21,7 @@ class SemBasicBlock extends TSemBasicBlock {
     block.bbDominates(getJavaBasicBlock(otherBlock))
   }
 
-  final SemExpr getAnExpr() { result = getSemanticExpr(block.getANode()) }
+  final SemExpr getAnExpr() { SemanticExprConfig::getExprBasicBlock(result) = this }
 }
 
 SemBasicBlock getSemanticBasicBlock(BasicBlock block) { result = MkSemBasicBlock(block) }

java/ql/lib/semmle/code/java/semantic/SemanticExpr.qll

@@ -9,6 +9,7 @@ private import SemanticType
 private import SemanticExprSpecific::SemanticExprConfig as Specific
 
 private newtype TOpcode =
+  TInitializeParameter() or
   TCopyValue() or
   TLoad() or
   TStore() or
@@ -40,8 +41,6 @@ private newtype TOpcode =
   TStringConstant() or
   TAddOne() or // TODO: Combine with `TAdd`
   TSubOne() or // TODO: Combine with `TSub`
-  TPostInc() or // TODO: Reconnect result to merge with `TPreInc`
-  TPostDec() or // TODO: Reconnect result to merge with `TPreDec`
   TConditional() or // TODO: Represent as flow
   TCall() or
   TUnknown()
@@ -51,6 +50,10 @@ class Opcode extends TOpcode {
 }
 
 module Opcode {
+  class InitializeParameter extends Opcode, TInitializeParameter {
+    override string toString() { result = "InitializeParameter" }
+  }
+
   class CopyValue extends Opcode, TCopyValue {
     override string toString() { result = "CopyValue" }
   }
@@ -155,14 +158,6 @@ module Opcode {
     override string toString() { result = "SubOne" }
   }
 
-  class PostInc extends Opcode, TPostInc {
-    override string toString() { result = "PostInc" }
-  }
-
-  class PostDec extends Opcode, TPostDec {
-    override string toString() { result = "PostDec" }
-  }
-
   class Conditional extends Opcode, TConditional {
     override string toString() { result = "Conditional" }
   }
@@ -378,10 +373,26 @@ class SemSubOneExpr extends SemUnaryExpr {
   SemSubOneExpr() { opcode instanceof Opcode::SubOne }
 }
 
-class SemLoadExpr extends SemKnownExpr {
-  SemLoadExpr() { opcode instanceof Opcode::Load and Specific::loadExpr(this, type) }
+private class SemNullaryExpr extends SemKnownExpr {
+  SemNullaryExpr() { Specific::nullaryExpr(this, opcode, type) }
+}
+
+class SemInitializeParameterExpr extends SemNullaryExpr {
+  SemInitializeParameterExpr() { opcode instanceof Opcode::InitializeParameter }
+}
+
+class SemLoadExpr extends SemNullaryExpr {
+  SemLoadExpr() { opcode instanceof Opcode::Load }
+
+  final SemSsaVariable getDef() { result.getAUse() = this }
+}
+
+class SemSsaLoadExpr extends SemLoadExpr {
+  SemSsaLoadExpr() { exists(getDef()) }
+}
 
-  final SemSsaVariable getDef() { result = Specific::getLoadDef(this) }
+class SemNonSsaLoadExpr extends SemLoadExpr {
+  SemNonSsaLoadExpr() { not exists(getDef()) }
 }
 
 class SemConditionalExpr extends SemKnownExpr {

java/ql/lib/semmle/code/java/semantic/SemanticExprSpecific.qll

@@ -10,6 +10,10 @@ private module Impl {
     TPrimaryExpr(J::Expr e) or
     TPostUpdateExpr(J::UnaryAssignExpr e) {
       e instanceof J::PostIncExpr or e instanceof J::PostDecExpr
+    } or
+    TEnhancedForInit(J::EnhancedForStmt for) or
+    TParameterInit(SSA::SsaImplicitInit init, J::Parameter param) {
+      init.isParameterDefinition(param)
     }
 
   TExpr getResultExpr(J::Expr e) { result = TPrimaryExpr(e) }
@@ -22,6 +26,8 @@ module SemanticExprConfig {
     string toString() { none() }
 
     J::Location getLocation() { none() }
+
+    J::BasicBlock getBasicBlock() { none() }
   }
 
   private class PrimaryExpr extends Expr, TPrimaryExpr {
@@ -33,6 +39,8 @@ module SemanticExprConfig {
 
     override J::Location getLocation() { result = e.getLocation() }
 
+    override J::BasicBlock getBasicBlock() { result = e.getBasicBlock() }
+
     J::Expr getExpr() { result = e }
   }
 
@@ -45,14 +53,43 @@ module SemanticExprConfig {
 
     override J::Location getLocation() { result = e.getLocation() }
 
+    override J::BasicBlock getBasicBlock() { result = e.getBasicBlock() }
+
     J::UnaryAssignExpr getExpr() { result = e }
   }
 
+  private class EnhancedForInitExpr extends Expr, TEnhancedForInit {
+    J::EnhancedForStmt for;
+
+    EnhancedForInitExpr() { this = TEnhancedForInit(for) }
+
+    override string toString() { result = "init of " + for.getVariable().toString() }
+
+    override J::Location getLocation() { result = for.getVariable().getLocation() }
+
+    override J::BasicBlock getBasicBlock() { result = for.getVariable().getBasicBlock() }
+  }
+
+  private class ParameterInitExpr extends Expr, TParameterInit {
+    SSA::SsaImplicitInit init;
+    J::Parameter param;
+
+    ParameterInitExpr() { this = TParameterInit(init, param) }
+
+    override string toString() { result = "param init: " + init.toString() }
+
+    override J::Location getLocation() { result = init.getLocation() }
+
+    override J::BasicBlock getBasicBlock() { result = init.getBasicBlock() }
+
+    final J::Parameter getParameter() { result = param }
+  }
+
   string exprToString(Expr e) { result = e.toString() }
 
   J::Location getExprLocation(Expr e) { result = e.getLocation() }
 
-  SemBasicBlock getExprBasicBlock(Expr e) { result.getAnExpr() = e }
+  SemBasicBlock getExprBasicBlock(Expr e) { result = getSemanticBasicBlock(e.getBasicBlock()) }
 
   predicate integerLiteral(Expr expr, SemIntegerType type, int value) {
     exists(J::Expr javaExpr | javaExpr = expr.(PrimaryExpr).getExpr() |
@@ -172,7 +209,8 @@ module SemanticExprConfig {
             assignOp instanceof J::AssignRShiftExpr and opcode instanceof Opcode::ShiftRight
             or
             // TODO: Add new opcode or add an implicit conversion
-            assignOp instanceof J::AssignURShiftExpr and opcode instanceof Opcode::ShiftRightUnsigned
+            assignOp instanceof J::AssignURShiftExpr and
+            opcode instanceof Opcode::ShiftRightUnsigned
           )
         )
       )
@@ -237,13 +275,15 @@ module SemanticExprConfig {
     )
   }
 
-  predicate loadExpr(Expr expr, SemType type) {
-    type = getSemanticType(expr.(PrimaryExpr).getExpr().(J::RValue).getType())
-  }
-
-  SemSsaVariable getLoadDef(Expr expr) {
-    exists(SSA::SsaVariable var | expr.(PrimaryExpr).getExpr() = var.getAUse() |
-      result = getSemanticSsaVariable(var)
+  predicate nullaryExpr(Expr expr, Opcode opcode, SemType type) {
+    exists(ParameterInitExpr paramInit | paramInit = expr |
+      opcode instanceof Opcode::InitializeParameter and
+      type = getSemanticType(paramInit.getParameter().getType())
+    )
+    or
+    exists(J::RValue rval | rval = expr.(PrimaryExpr).getExpr() |
+      type = getSemanticType(rval.getType()) and
+      opcode instanceof Opcode::Load
     )
   }
 
@@ -260,6 +300,10 @@ module SemanticExprConfig {
 
   SemType getUnknownExprType(Expr expr) {
     result = getSemanticType(expr.(PrimaryExpr).getExpr().getType())
+    or
+    exists(J::EnhancedForStmt for | expr = TEnhancedForInit(for) |
+      result = getSemanticType(for.getVariable().getType())
+    )
   }
 }
 
@@ -282,5 +326,12 @@ SemExpr getUpdateExpr(SSA::SsaExplicitUpdate update) {
     or
     (expr instanceof J::PostIncExpr or expr instanceof J::PostDecExpr) and
     result = TPostUpdateExpr(expr)
+    or
+    exists(J::EnhancedForStmt for |
+      for.getVariable() = expr and
+      result = TEnhancedForInit(for)
+    )
   )
 }
+
+SemExpr getEnhancedForInitExpr(J::EnhancedForStmt for) { result = TEnhancedForInit(for) }

java/ql/lib/semmle/code/java/semantic/SemanticSSA.qll

@@ -19,7 +19,9 @@ class SemSsaVariable extends TSemSsaVariable {
 
   final string toString() { result = var.toString() }
 
-  final SemExpr getAUse() { result = getSemanticExpr(var.getAUse()) }
+  final Location getLocation() { result = var.getLocation() }
+
+  final SemLoadExpr getAUse() { result = getSemanticExpr(var.getAUse()) }
 
   final SemSsaSourceVariable getSourceVariable() {
     result = getSemanticSsaSourceVariable(var.getSourceVariable())

java/ql/lib/semmle/code/java/semantic/analysis/Sign.qll

@@ -246,6 +246,8 @@ class Sign extends TSign {
 
   /** Perform `op` on this sign. */
   Sign applyUnaryOp(Opcode op) {
+    op instanceof Opcode::CopyValue and result = this
+    or
     op instanceof Opcode::AddOne and result = inc()
     or
     op instanceof Opcode::SubOne and result = dec()