C++: Flow out of writes to iterators#12050
Merged
MathiasVP merged 6 commits intoFeb 3, 2023
Merged
Conversation
MathiasVP
force-pushed
the
flow-out-of-iterators-3
branch
from
5314c88 to
eb31160
Compare
…w-out-of-iterators-3
jketema
reviewed
Feb 3, 2023
Contributor
jketema
left a comment
jketema
left a comment
There was a problem hiding this comment.
Initial comments.
I'm still trying to wrap my head around isChiAfterIteratorArgument.
| it += source(); | ||
| sink(*it); // $ ast,ir | ||
| sink(vs[1]); | ||
| sink(vs[1]); // $ SPURIOUS: ir |
Contributor
Author
There was a problem hiding this comment.
This one is super annoying. What happens is:
- There's a write to the iterator at
it += source(); - This write propagates to
iton the next line atsink(*it); - There's a taint step from
itto*it - The
*itis seen as a use ofvs(because of the lineit = vs.begin();) - There's use-use flow from
*it(which is a use ofvs) tovson the line atsink(vs[1]); - There's a taint step from
vstovs[1]
Individually all of these steps make sense, but the final result is that we have taint flow from the write to the iterator to the use of the underlying container 😭. This only happens in taint configurations, though (since it requires a taint step to go from it to *it).
Contributor
There was a problem hiding this comment.
Thanks for the explanation. I think this would warrant a comment in the test that briefly describes why this is happening.
jketema
reviewed
Feb 3, 2023
jketema
approved these changes
Feb 3, 2023
MathiasVP
merged commit 77250af
into
github:mathiasvp/replace-ast-with-ir-use-usedataflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ideally, this PR would just be adding the one disjunct to
isIteratorUsethat I've added in 88338bd, but theisIteratorUsecode was assuming that we had theOperandthat represented the actual dereference when using the iterator (i.e., the operand representing*itfor some iteratorit). This is obviously not true if the iterator is passed to a function (which then writes to the iterator), so I had to shuffle things around inisChiBeforeIteratorUseand extendindirectConversionFlowStepto treat dereferences as conversions (when the indirection index is changed accordingly).The change to
indirectConversionFlowSteplooks like this is giving us a bunch of new good results on Samate 🎉 (and AFAICT, it's also responsible for the small changes to path explanations).