|
13 | 13 |
|
14 | 14 | import cpp |
15 | 15 | import codingstandards.c.misra |
16 | | -import codingstandards.cpp.rules.memoryoperationsnotsequencedappropriately.MemoryOperationsNotSequencedAppropriately |
| 16 | +import codingstandards.c.Ordering |
| 17 | +import codingstandards.cpp.SideEffects |
17 | 18 |
|
18 | | -class UnsequencedSideEffectsQuery extends MemoryOperationsNotSequencedAppropriatelySharedQuery { |
19 | | - UnsequencedSideEffectsQuery() { this = SideEffects3Package::unsequencedSideEffectsQuery() } |
| 19 | +class VariableEffectOrAccess extends Expr { |
| 20 | + VariableEffectOrAccess() { |
| 21 | + this instanceof VariableEffect or |
| 22 | + this instanceof VariableAccess |
| 23 | + } |
20 | 24 | } |
| 25 | + |
| 26 | +pragma[noinline] |
| 27 | +predicate partOfFullExpr(VariableEffectOrAccess e, FullExpr fe) { |
| 28 | + ( |
| 29 | + exists(VariableEffect ve | e = ve and ve.getAnAccess() = fe.getAChild+() and not ve.isPartial()) |
| 30 | + or |
| 31 | + e.(VariableAccess) = fe.getAChild+() |
| 32 | + ) |
| 33 | +} |
| 34 | + |
| 35 | +class ConstituentExprOrdering extends Ordering::Configuration { |
| 36 | + ConstituentExprOrdering() { this = "ConstituentExprOrdering" } |
| 37 | + |
| 38 | + override predicate isCandidate(Expr e1, Expr e2) { |
| 39 | + exists(FullExpr fe | |
| 40 | + partOfFullExpr(e1, fe) and |
| 41 | + partOfFullExpr(e2, fe) |
| 42 | + ) |
| 43 | + } |
| 44 | +} |
| 45 | + |
| 46 | +predicate sameFullExpr(FullExpr fe, VariableAccess va1, VariableAccess va2) { |
| 47 | + partOfFullExpr(va1, fe) and |
| 48 | + partOfFullExpr(va2, fe) and |
| 49 | + va1 != va2 and |
| 50 | + exists(Variable v1, Variable v2 | |
| 51 | + // Use `pragma[only_bind_into]` to prevent CP between variable accesses. |
| 52 | + va1.getTarget() = pragma[only_bind_into](v1) and va2.getTarget() = pragma[only_bind_into](v2) |
| 53 | + | |
| 54 | + v1.isVolatile() and v2.isVolatile() |
| 55 | + or |
| 56 | + not (v1.isVolatile() and v2.isVolatile()) and |
| 57 | + v1 = v2 |
| 58 | + ) |
| 59 | +} |
| 60 | + |
| 61 | +int getLeafCount(LeftRightOperation bop) { |
| 62 | + if |
| 63 | + not bop.getLeftOperand() instanceof BinaryOperation and |
| 64 | + not bop.getRightOperand() instanceof BinaryOperation |
| 65 | + then result = 2 |
| 66 | + else |
| 67 | + if |
| 68 | + bop.getLeftOperand() instanceof BinaryOperation and |
| 69 | + not bop.getRightOperand() instanceof BinaryOperation |
| 70 | + then result = 1 + getLeafCount(bop.getLeftOperand()) |
| 71 | + else |
| 72 | + if |
| 73 | + not bop.getLeftOperand() instanceof BinaryOperation and |
| 74 | + bop.getRightOperand() instanceof BinaryOperation |
| 75 | + then result = 1 + getLeafCount(bop.getRightOperand()) |
| 76 | + else result = getLeafCount(bop.getLeftOperand()) + getLeafCount(bop.getRightOperand()) |
| 77 | +} |
| 78 | + |
| 79 | +class LeftRightOperation extends Expr { |
| 80 | + LeftRightOperation() { |
| 81 | + this instanceof BinaryOperation or |
| 82 | + this instanceof AssignOperation or |
| 83 | + this instanceof AssignExpr |
| 84 | + } |
| 85 | + |
| 86 | + Expr getLeftOperand() { |
| 87 | + result = this.(BinaryOperation).getLeftOperand() |
| 88 | + or |
| 89 | + result = this.(AssignOperation).getLValue() |
| 90 | + or |
| 91 | + result = this.(AssignExpr).getLValue() |
| 92 | + } |
| 93 | + |
| 94 | + Expr getRightOperand() { |
| 95 | + result = this.(BinaryOperation).getRightOperand() |
| 96 | + or |
| 97 | + result = this.(AssignOperation).getRValue() |
| 98 | + or |
| 99 | + result = this.(AssignExpr).getRValue() |
| 100 | + } |
| 101 | + |
| 102 | + Expr getAnOperand() { |
| 103 | + result = getLeftOperand() or |
| 104 | + result = getRightOperand() |
| 105 | + } |
| 106 | +} |
| 107 | + |
| 108 | +int getOperandIndexIn(FullExpr fullExpr, Expr operand) { |
| 109 | + result = getOperandIndex(fullExpr, operand) |
| 110 | + or |
| 111 | + fullExpr.(Call).getArgument(result).getAChild*() = operand |
| 112 | +} |
| 113 | + |
| 114 | +int getOperandIndex(LeftRightOperation binop, Expr operand) { |
| 115 | + if operand = binop.getAnOperand() |
| 116 | + then |
| 117 | + operand = binop.getLeftOperand() and |
| 118 | + result = 0 |
| 119 | + or |
| 120 | + operand = binop.getRightOperand() and |
| 121 | + result = getLeafCount(binop.getLeftOperand()) + 1 |
| 122 | + or |
| 123 | + operand = binop.getRightOperand() and |
| 124 | + not binop.getLeftOperand() instanceof LeftRightOperation and |
| 125 | + result = 1 |
| 126 | + else ( |
| 127 | + // Child of left operand that is a binary operation. |
| 128 | + result = getOperandIndex(binop.getLeftOperand(), operand) |
| 129 | + or |
| 130 | + // Child of left operand that is not a binary operation. |
| 131 | + result = 0 and |
| 132 | + not binop.getLeftOperand() instanceof LeftRightOperation and |
| 133 | + binop.getLeftOperand().getAChild+() = operand |
| 134 | + or |
| 135 | + // Child of right operand and both left and right operands are binary operations. |
| 136 | + result = |
| 137 | + getLeafCount(binop.getLeftOperand()) + getOperandIndex(binop.getRightOperand(), operand) |
| 138 | + or |
| 139 | + // Child of right operand and left operand is not a binary operation. |
| 140 | + result = 1 + getOperandIndex(binop.getRightOperand(), operand) and |
| 141 | + not binop.getLeftOperand() instanceof LeftRightOperation |
| 142 | + or |
| 143 | + // Child of right operand that is not a binary operation and the left operand is a binary operation. |
| 144 | + result = getLeafCount(binop.getLeftOperand()) + 1 and |
| 145 | + binop.getRightOperand().getAChild+() = operand and |
| 146 | + not binop.getRightOperand() instanceof LeftRightOperation |
| 147 | + or |
| 148 | + // Child of right operand that is not a binary operation and the left operand is not a binary operation. |
| 149 | + result = 1 and |
| 150 | + not binop.getLeftOperand() instanceof LeftRightOperation and |
| 151 | + not binop.getRightOperand() instanceof LeftRightOperation and |
| 152 | + binop.getRightOperand().getAChild+() = operand |
| 153 | + ) |
| 154 | +} |
| 155 | + |
| 156 | +predicate inConditionalThen(ConditionalExpr ce, Expr e) { |
| 157 | + e = ce.getThen() |
| 158 | + or |
| 159 | + exists(Expr parent | |
| 160 | + inConditionalThen(ce, parent) and |
| 161 | + parent.getAChild() = e |
| 162 | + ) |
| 163 | +} |
| 164 | + |
| 165 | +predicate inConditionalElse(ConditionalExpr ce, Expr e) { |
| 166 | + e = ce.getElse() |
| 167 | + or |
| 168 | + exists(Expr parent | |
| 169 | + inConditionalElse(ce, parent) and |
| 170 | + parent.getAChild() = e |
| 171 | + ) |
| 172 | +} |
| 173 | + |
| 174 | +predicate isUnsequencedEffect( |
| 175 | + ConstituentExprOrdering orderingConfig, FullExpr fullExpr, VariableEffect variableEffect1, |
| 176 | + VariableAccess va1, VariableAccess va2, Locatable placeHolder, string label |
| 177 | +) { |
| 178 | + // The two access are scoped to the same full expression. |
| 179 | + sameFullExpr(fullExpr, va1, va2) and |
| 180 | + // We are only interested in effects that change an object, |
| 181 | + // i.e., exclude patterns suchs as `b->data[b->cursor++]` where `b` is considered modified and read or `foo.bar = 1` where `=` modifies to both `foo` and `bar`. |
| 182 | + not variableEffect1.isPartial() and |
| 183 | + variableEffect1.getAnAccess() = va1 and |
| 184 | + ( |
| 185 | + exists(VariableEffect variableEffect2 | |
| 186 | + not variableEffect2.isPartial() and |
| 187 | + variableEffect2.getAnAccess() = va2 and |
| 188 | + // If the effect is not local (happens in a different function) we use the call with the access as a proxy. |
| 189 | + ( |
| 190 | + va1.getEnclosingStmt() = variableEffect1.getEnclosingStmt() and |
| 191 | + va2.getEnclosingStmt() = variableEffect2.getEnclosingStmt() and |
| 192 | + orderingConfig.isUnsequenced(variableEffect1, variableEffect2) |
| 193 | + or |
| 194 | + va1.getEnclosingStmt() = variableEffect1.getEnclosingStmt() and |
| 195 | + not va2.getEnclosingStmt() = variableEffect2.getEnclosingStmt() and |
| 196 | + exists(Call call | |
| 197 | + call.getAnArgument() = va2 and call.getEnclosingStmt() = va1.getEnclosingStmt() |
| 198 | + | |
| 199 | + orderingConfig.isUnsequenced(variableEffect1, call) |
| 200 | + ) |
| 201 | + or |
| 202 | + not va1.getEnclosingStmt() = variableEffect1.getEnclosingStmt() and |
| 203 | + va2.getEnclosingStmt() = variableEffect2.getEnclosingStmt() and |
| 204 | + exists(Call call | |
| 205 | + call.getAnArgument() = va1 and call.getEnclosingStmt() = va2.getEnclosingStmt() |
| 206 | + | |
| 207 | + orderingConfig.isUnsequenced(call, variableEffect2) |
| 208 | + ) |
| 209 | + ) and |
| 210 | + // Break the symmetry of the ordering relation by requiring that the first expression is located before the second. |
| 211 | + // This builds upon the assumption that the expressions are part of the same full expression as specified in the ordering configuration. |
| 212 | + getOperandIndexIn(fullExpr, va1) < getOperandIndexIn(fullExpr, va2) and |
| 213 | + placeHolder = variableEffect2 and |
| 214 | + label = "side effect" |
| 215 | + ) |
| 216 | + or |
| 217 | + placeHolder = va2 and |
| 218 | + label = "read" and |
| 219 | + not exists(VariableEffect variableEffect2 | variableEffect1 != variableEffect2 | |
| 220 | + variableEffect2.getAnAccess() = va2 |
| 221 | + ) and |
| 222 | + ( |
| 223 | + va1.getEnclosingStmt() = variableEffect1.getEnclosingStmt() and |
| 224 | + orderingConfig.isUnsequenced(variableEffect1, va2) |
| 225 | + or |
| 226 | + not va1.getEnclosingStmt() = variableEffect1.getEnclosingStmt() and |
| 227 | + exists(Call call | |
| 228 | + call.getAnArgument() = va1 and call.getEnclosingStmt() = va2.getEnclosingStmt() |
| 229 | + | |
| 230 | + orderingConfig.isUnsequenced(call, va2) |
| 231 | + ) |
| 232 | + ) and |
| 233 | + // The read is not used to compute the effect on the variable. |
| 234 | + // E.g., exclude x = x + 1 |
| 235 | + not variableEffect1.getAChild+() = va2 |
| 236 | + ) and |
| 237 | + // Both are evaluated |
| 238 | + not exists(ConditionalExpr ce | inConditionalThen(ce, va1) and inConditionalElse(ce, va2)) |
| 239 | +} |
| 240 | + |
| 241 | +from |
| 242 | + ConstituentExprOrdering orderingConfig, FullExpr fullExpr, VariableEffect variableEffect1, |
| 243 | + VariableAccess va1, VariableAccess va2, Locatable placeHolder, string label |
| 244 | +where |
| 245 | + not isExcluded(fullExpr, SideEffects3Package::unsequencedSideEffectsQuery()) and |
| 246 | + isUnsequencedEffect(orderingConfig, fullExpr, variableEffect1, va1, va2, placeHolder, label) |
| 247 | +select fullExpr, "The expression contains unsequenced $@ to $@ and $@ to $@.", variableEffect1, |
| 248 | + "side effect", va1, va1.getTarget().getName(), placeHolder, label, va2, va2.getTarget().getName() |
0 commit comments