Skip to content

C++: Add dataflow through NSDMI #21611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MathiasVP merged 8 commits into from
Mar 30, 2026
Merged

C++: Add dataflow through NSDMI #21611

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
eb35fa0
C++: Unify 'isSourceParameterOf' for this parameters with the impleme…
MathiasVP Mar 25, 2026
9cb8edb
C++: Change 'Function' to 'Declaration' in a few places to handle enc…
MathiasVP Mar 25, 2026
599b7a6
C++: Handle fields in 'getThisType'.
MathiasVP Mar 25, 2026
503c153
C++: Accept test changes.
MathiasVP Mar 25, 2026
78c0c7c
C++: Exclude flow summaries from 'irTypeBugs'.
MathiasVP Mar 25, 2026
29768bb
Update cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.ql
MathiasVP Mar 30, 2026
9247e6a
C++: Add change note.
MathiasVP Mar 30, 2026
5db069e
C++: Fix more consistency errors.
MathiasVP Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cpp/ql/lib/change-notes/2026-03-30-nsdmi-dataflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Added dataflow through members initialized via non-static data member initialization (NSDMI).
52 changes: 32 additions & 20 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -850,11 +850,6 @@ module Public {
{
ThisParameterInstructionNode() { instr.getIRVariable() instanceof IRThisVariable }

override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
pos.(DirectPosition).getArgumentIndex() = -1 and
instr.getEnclosingFunction() = f
}

override string toStringImpl() { result = "this" }
}

Expand Down Expand Up @@ -1129,7 +1124,7 @@ class IndirectArgumentOutNode extends PostUpdateNodeImpl {
/**
* Gets the `Function` that the call targets, if this is statically known.
*/
Function getStaticCallTarget() { result = this.getCallInstruction().getStaticCallTarget() }
Declaration getStaticCallTarget() { result = this.getCallInstruction().getStaticCallTarget() }

override string toStringImpl() {
exists(string prefix | if indirectionIndex > 0 then prefix = "" else prefix = "pointer to " |
Expand Down Expand Up @@ -1633,7 +1628,7 @@ abstract private class AbstractParameterNode extends Node {
* implicit `this` parameter is considered to have position `-1`, and
* pointer-indirection parameters are at further negative positions.
*/
predicate isSourceParameterOf(Function f, ParameterPosition pos) { none() }
predicate isSourceParameterOf(Declaration f, ParameterPosition pos) { none() }

/**
* Holds if this node is the parameter of `sc` at the specified position. The
Expand All @@ -1659,6 +1654,11 @@ abstract private class AbstractParameterNode extends Node {

/** Gets the `Parameter` associated with this node, if it exists. */
Parameter getParameter() { none() } // overridden by subclasses

/**
* Holds if this node represents an implicit `this` parameter, if it exists.
*/
predicate isThis() { none() } // overridden by subclasses
}

abstract private class AbstractIndirectParameterNode extends AbstractParameterNode {
Expand Down Expand Up @@ -1687,7 +1687,9 @@ private class IndirectInstructionParameterNode extends AbstractIndirectParameter
InitializeParameterInstruction init;

IndirectInstructionParameterNode() {
IndirectInstruction.super.hasInstructionAndIndirectionIndex(init, _)
IndirectInstruction.super.hasInstructionAndIndirectionIndex(init, _) and
// We don't model catch parameters as parameter nodes
not exists(init.getParameter().getCatchBlock())
}

int getArgumentIndex() { init.hasIndex(result) }
Expand All @@ -1701,16 +1703,17 @@ private class IndirectInstructionParameterNode extends AbstractIndirectParameter
)
}

/** Gets the parameter whose indirection is initialized. */
override Parameter getParameter() { result = init.getParameter() }

override predicate isThis() { init.hasIndex(-1) }

override DataFlowCallable getEnclosingCallable() {
result.asSourceCallable() = this.getFunction()
}

override Declaration getFunction() { result = init.getEnclosingFunction() }

override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
override predicate isSourceParameterOf(Declaration f, ParameterPosition pos) {
this.getFunction() = f and
exists(int argumentIndex, int indirectionIndex |
indirectPositionHasArgumentIndexAndIndex(pos, argumentIndex, indirectionIndex) and
Expand Down Expand Up @@ -1738,6 +1741,18 @@ abstract class InstructionDirectParameterNode extends InstructionNode, AbstractD
* Gets the `IRVariable` that this parameter references.
*/
final IRVariable getIRVariable() { result = instr.getIRVariable() }

override predicate isThis() { instr.hasIndex(-1) }

override Parameter getParameter() { result = instr.getParameter() }

override predicate isSourceParameterOf(Declaration f, ParameterPosition pos) {
this.getFunction() = f and
exists(int argumentIndex |
pos.(DirectPosition).getArgumentIndex() = argumentIndex and
instr.hasIndex(argumentIndex)
)
}
}

abstract private class AbstractExplicitParameterNode extends AbstractDirectParameterNode { }
Expand All @@ -1746,15 +1761,12 @@ abstract private class AbstractExplicitParameterNode extends AbstractDirectParam
private class ExplicitParameterInstructionNode extends AbstractExplicitParameterNode,
InstructionDirectParameterNode
{
ExplicitParameterInstructionNode() { exists(instr.getParameter()) }

override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
f.getParameter(pos.(DirectPosition).getArgumentIndex()) = instr.getParameter()
ExplicitParameterInstructionNode() {
// We don't model catch parameters as parameter nodes.
exists(instr.getParameter().getFunction())
}

override string toStringImpl() { result = instr.getParameter().toString() }

override Parameter getParameter() { result = instr.getParameter() }
}

/**
Expand Down Expand Up @@ -1782,9 +1794,9 @@ private class DirectBodyLessParameterNode extends AbstractExplicitParameterNode,
{
DirectBodyLessParameterNode() { indirectionIndex = 0 }

override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
override predicate isSourceParameterOf(Declaration f, ParameterPosition pos) {
this.getFunction() = f and
f.getParameter(pos.(DirectPosition).getArgumentIndex()) = p
f.(Function).getParameter(pos.(DirectPosition).getArgumentIndex()) = p
}

override Parameter getParameter() { result = p }
Expand All @@ -1795,10 +1807,10 @@ private class IndirectBodyLessParameterNode extends AbstractIndirectParameterNod
{
IndirectBodyLessParameterNode() { not this instanceof DirectBodyLessParameterNode }

override predicate isSourceParameterOf(Function f, ParameterPosition pos) {
override predicate isSourceParameterOf(Declaration f, ParameterPosition pos) {
exists(int argumentPosition |
this.getFunction() = f and
f.getParameter(argumentPosition) = p and
f.(Function).getParameter(argumentPosition) = p and
indirectPositionHasArgumentIndexAndIndex(pos, argumentPosition, indirectionIndex)
)
}
Expand Down
6 changes: 3 additions & 3 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1170,7 +1170,7 @@ class DataFlowCall extends TDataFlowCall {
/**
* Gets the `Function` that the call targets, if this is statically known.
*/
Function getStaticCallSourceTarget() { none() }
Declaration getStaticCallSourceTarget() { none() }

/**
* Gets the target of this call. We use the following strategy for deciding
Expand All @@ -1182,7 +1182,7 @@ class DataFlowCall extends TDataFlowCall {
* whether is it manual or generated.
*/
final DataFlowCallable getStaticCallTarget() {
exists(Function target | target = this.getStaticCallSourceTarget() |
exists(Declaration target | target = this.getStaticCallSourceTarget() |
// Don't use the source callable if there is a manual model for the
// target
not exists(SummarizedCallable sc |
Expand Down Expand Up @@ -1242,7 +1242,7 @@ private class NormalCall extends DataFlowCall, TNormalCall {

override CallTargetOperand getCallTargetOperand() { result = call.getCallTargetOperand() }

override Function getStaticCallSourceTarget() { result = call.getStaticCallTarget() }
override Declaration getStaticCallSourceTarget() { result = call.getStaticCallTarget() }

override ArgumentOperand getArgumentOperand(int index) { result = call.getArgumentOperand(index) }

Expand Down
11 changes: 8 additions & 3 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,13 +11,18 @@ private import TypeFlow
private import semmle.code.cpp.ir.ValueNumbering

/**
* Gets the C++ type of `this` in the member function `f`.
* Gets the C++ type of `this` in an `IRFunction` generated from `f`.
* The result is a glvalue if `isGLValue` is true, and
* a prvalue if `isGLValue` is false.
*/
bindingset[isGLValue]
private CppType getThisType(Cpp::MemberFunction f, boolean isGLValue) {
result.hasType(f.getTypeOfThis(), isGLValue)
private CppType getThisType(Cpp::Declaration f, boolean isGLValue) {
result.hasType(f.(Cpp::MemberFunction).getTypeOfThis(), isGLValue)
or
exists(Cpp::PointerType pt |
pt.getBaseType() = f.(Cpp::Field).getDeclaringType() and
result.hasType(pt, isGLValue)
)
}

/**
Expand Down
1 change: 1 addition & 0 deletions cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,6 +391,7 @@ irFlow
| test.cpp:1308:7:1308:12 | call to source | test.cpp:1309:8:1309:16 | ... ++ |
| test.cpp:1312:7:1312:12 | call to source | test.cpp:1313:8:1313:24 | ... ? ... : ... |
| test.cpp:1312:7:1312:12 | call to source | test.cpp:1314:8:1314:8 | x |
| test.cpp:1318:13:1318:18 | call to source | test.cpp:1327:10:1327:10 | i |
| test.cpp:1329:11:1329:16 | call to source | test.cpp:1330:10:1330:10 | i |
| true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x |
| true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x |
Expand Down
2 changes: 1 addition & 1 deletion cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1324,7 +1324,7 @@ struct nsdmi {

void nsdmi_test() {
nsdmi x;
sink(x.i); // $ MISSING: ir ast
sink(x.i); // $ ir MISSING: ast

nsdmi y(source());
sink(y.i); // $ ir ast
Expand Down
42 changes: 0 additions & 42 deletions cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,47 +1,5 @@
astTypeBugs
irTypeBugs
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary param] *0 in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary param] this in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[****] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[***] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[**] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[*] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[****] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[***] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[**] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[*] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary param] *0 in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary param] this in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[****] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[***] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[**] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[*] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[****] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[***] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[**] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[*] in iterator |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary param] this in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] read: Argument[this].Element in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] read: Argument[this].Element[*] in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] to write: ReturnValue[**] in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] to write: ReturnValue[*] in operator* |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary param] this in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] read: Argument[this].Element in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] read: Argument[this].Element[*] in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] to write: ReturnValue[**] in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] to write: ReturnValue[*] in operator-> |
| test.cpp:356:7:356:11 | test.cpp:356:7:356:11 | test.cpp:356:7:356:11 | field |
| test.cpp:356:7:356:11 | test.cpp:356:7:356:11 | test.cpp:356:7:356:11 | field |
| test.cpp:356:7:356:11 | test.cpp:356:7:356:11 | test.cpp:356:7:356:11 | field |
| test.cpp:1318:9:1318:9 | test.cpp:1318:9:1318:9 | test.cpp:1318:9:1318:9 | i |
| test.cpp:1318:9:1318:9 | test.cpp:1318:9:1318:9 | test.cpp:1318:9:1318:9 | i |
| test.cpp:1318:9:1318:9 | test.cpp:1318:9:1318:9 | test.cpp:1318:9:1318:9 | i |
incorrectBaseType
| clang.cpp:22:8:22:20 | *& ... | Expected 'Node.getType()' to be int, but it was int * |
| clang.cpp:23:17:23:29 | *& ... | Expected 'Node.getType()' to be int, but it was int * |
Expand Down
4 changes: 4 additions & 0 deletions cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,13 @@ import AstTest

module IrTest {
private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
private import semmle.code.cpp.ir.dataflow.internal.DataFlowNodes

query predicate irTypeBugs(Location location, Node node) {
exists(int n |
// Flow summary nodes don't have a type since we don't necessarily have
// the source code in the database.
not node instanceof FlowSummaryNode and
n = count(node.getType()) and
location = node.getLocation() and
n != 1
Expand Down
2 changes: 1 addition & 1 deletion cpp/ql/test/library-tests/dataflow/fields/C.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ class C
void func()
{
sink(s1); // $ ast,ir
sink(s2); // $ MISSING: ast,ir
sink(s2); // $ ir MISSING: ast
sink(s3); // $ ast,ir
sink(s4); // $ MISSING: ast,ir
}
Expand Down
Loading
Loading