Add shared basic block library #18497

paldepind · 2025-01-15T14:03:14Z

Adds a shared basic block library in the controlflow pack and modifies the basic block implementation of Swift, Ruby, C#, and Rust to use it.

A few notes:

There's two ways to use the basic block library. Either through the new codeql.controlflow.BasicBlock or through the existing codeql.controlflow.Cfg. The former is suitable for languages that don't use the control graph library and the latter for those that do. In this PR all languages use the latter, but I've tried instantiating codeql.controlflow.BasicBlock for Go and that seems to work fine as well.
The BasicBlock class for C# now has both the current getASuccessorByType/1 method and a new getASuccessor/1 method that it inherits from the basic block library and which is the name used in Ruby, Rust, and Swift. We could consider deprecating getASuccessorByType/1 in order to not have two methods doing the same and to increase consistency between language libraries.
For the BasicBlock subclasses in Cfg.qll I've changed the current names a bit, such that they are all consistently of the form ${name}BasicBlock. For instance JoinBlock is instead JoinBasicBlock. For the existing language-level basic block libraries I've kept the current names for backwards compatibility, so only Rust use the new names.

csharp/ql/lib/semmle/code/csharp/controlflow/BasicBlocks.qll

ruby/ql/lib/codeql/ruby/controlflow/BasicBlocks.qll

ruby/ql/test/library-tests/controlflow/graph/BasicBlocks.ql

rust/ql/test/library-tests/controlflow/BasicBlocks.ql

shared/controlflow/codeql/controlflow/Cfg.qll

shared/controlflow/codeql/controlflow/BasicBlock.qll

hvitved · 2025-01-17T10:03:47Z

We could consider deprecating getASuccessorByType/1 in order to not have two methods doing the same and to increase consistency between language libraries.

I think we should do that.

hvitved

Very nice work, great to see even more shared code 🎉

shared/controlflow/codeql/controlflow/BasicBlock.qll

shared/controlflow/codeql/controlflow/Cfg.qll

ruby/ql/lib/codeql/ruby/controlflow/BasicBlocks.qll

swift/ql/lib/codeql/swift/controlflow/BasicBlocks.qll

shared/controlflow/change-notes/2025-01-16-basic-block.md

paldepind · 2025-01-17T12:14:56Z

Thanks for the review and comments. I've addressed all but one.

paldepind · 2025-01-17T12:16:26Z

shared/controlflow/codeql/controlflow/Cfg.qll

+   * Gets an `id` of `node`. This is used to order the predecessors of a join
+   * basic block.
+   */
+  bindingset[node]


Is the bindingset here appropriate? My thinking was that we don't need IDs of all nodes, only the few that end up as the first in a basic block prior to a join block.

I don't think the actual equivalenceRelation based hacks will be able to benefit, so we can remove it.

I think, no. I don't think there's any way to implement a numbering scheme that can make use of a pre-bound node. So you're only risking inlining and recomputation.

Suggested change

bindingset[node]

paldepind · 2025-01-17T12:17:08Z

We could consider deprecating getASuccessorByType/1 in order to not have two methods doing the same and to increase consistency between language libraries.

I think we should do that.

I'll do that in a follow up PR 👍

paldepind · 2025-01-17T12:36:34Z

actions/ql/lib/codeql/actions/controlflow/internal/Cfg.qll

@@ -134,6 +134,10 @@ private module Implementation implements CfgShared::InputSig<Location> {
  SuccessorType getAMatchingSuccessorType(Completion c) { result = c.getAMatchingSuccessorType() }

  predicate isAbnormalExitType(SuccessorType t) { none() }
+
+  int idOfAstNode(AstNode node) { none() }


Note that getJoinBlockPredecessor isn't implemented in the Actions basic block library, so this instantiation is actually fine. And we could move Actions to the shared BB library in a future PR.

shared/controlflow/codeql/controlflow/BasicBlock.qll

hvitved · 2025-01-17T13:05:20Z

shared/controlflow/codeql/controlflow/BasicBlock.qll

@@ -64,6 +80,7 @@ module Make<InputSig Input> {
    BasicBlock getAPredecessor(SuccessorType t) { result.getASuccessor(t) = this }

    /** Gets the control flow node at a specific (zero-indexed) position in this basic block. */
+    cached


It needs to be defined inside the Cached module, and then just referenced here.

It should be possible to reference them with the BasicBlocks:: prefix?

Yes, that works. I didn't think of that 🙈

hvitved · 2025-01-17T13:07:17Z

shared/controlflow/codeql/controlflow/Cfg.qll

+     * arbitrary order.
+     */
+    cached
+    JoinPredecessorBasicBlock getJoinBlockPredecessor(JoinBasicBlock jb, int i) {


It should be possible to reference them with the BasicBlocks:: prefix?

aschackmull · 2025-01-17T13:11:37Z

shared/controlflow/codeql/controlflow/BasicBlock.qll

+    // if x or y
+    //     foo
+    // else
+    //     bar
+    // ```
+    //
+    // we have a CFG that looks like
+    //
+    // x --false--> [false] x or y --false--> bar
+    // \                    |
+    //  --true--> y --false--
+    //            \
+    //             --true--> [true] x or y --true--> foo


This CFG is for x and y - the true/false edges are mixed up. The easiest fix is probably just to replace x or y with x and y.

aschackmull · 2025-01-17T13:16:03Z

shared/controlflow/codeql/controlflow/BasicBlock.qll

+  private predicate bbIndex(Node bbStart, Node cfn, int i) =
+    shortestDistances(startsBB/1, intraBBSucc/2)(bbStart, cfn, i)


As I mentioned the other day, I don't think shortestDistances is optimal. IIRC it can be beat with a QL recursion, but it's something that'll need fresh measurements on some large examples. I expect the C++ implementation to be in the lead in terms of performance on this particular predicate, and C++ uses a straightforward QL recursion.

Since that requires some benchmarking I'd prefer to leave that for a future PR.

aschackmull · 2025-01-17T13:18:45Z

shared/controlflow/codeql/controlflow/Cfg.qll

+   * Gets an `id` of `scope`. This is used to order the predecessors of a join
+   * basic block.
+   */
+  bindingset[scope]


Suggested change

bindingset[scope]

aschackmull · 2025-01-17T13:20:47Z

shared/controlflow/codeql/controlflow/Cfg.qll

+        if this instanceof EntryBasicBlock
+        then result = this.getFirstNode().getScope()
+        else result = this.getAPredecessor().getScope()


Why is this recursive and not just the following?

Suggested change

if this instanceof EntryBasicBlock

then result = this.getFirstNode().getScope()

else result = this.getAPredecessor().getScope()

result = this.getFirstNode().getScope()

I have been wondering the same, it's hard to imagine how they would not be equivalent for correct implementations of getScope and EntryBasicBlock, but I simply reproduced the existing code (which used overloading but was otherwise the same) thinking that probably was some reason 😅

aschackmull · 2025-01-17T13:32:42Z

shared/controlflow/codeql/controlflow/Cfg.qll

+    final class BasicBlock extends BasicBlockImpl::BasicBlock {
+      // We extend `BasicBlockImpl::BasicBlock` to add the `getScope`.
+      /** Gets the scope of this basic block. */
+      CfgScope getScope() {


Thoughts on putting Node.getScope through the BasicBlock input, such that getScope could be added to BasicBlock directly in its definition inside shared/controlflow/codeql/controlflow/BasicBlock.qll? That way this could just be an alias rather than having to copy all the member predicates.

It would definitely save some boiler plate, but could make the BasicBlock module less flexible for instantiations that don't want a getScope.

aschackmull · 2025-01-17T13:46:48Z

shared/controlflow/codeql/controlflow/Cfg.qll

+      predicate immediatelyControls(BasicBlock succ, SuccessorType s) {
+        succ = this.getASuccessor(s) and
+        forall(BasicBlock pred | pred = succ.getAPredecessor() and pred != this |
+          succ.dominates(pred)
+        )
+      }


In Java, this predicate is called dominatingEdge and it includes bbIDominates(this, succ) as an additional conjunct. I think that ought to be semantically identical, but it might offer a better join-order since immediate dominance joined with the successor relation yields a much stronger context for the forall.
Also, in this general library, it's probably worth it to expand the qldoc a bit on the relationship between the concept of controls and dominance. In short: controls equals edge dominance. See also the qldoc for dominatingEdge in Java.

Also, the concept of dominating edge aka immediatelyControls might very well be applicable beyond ConditionBasicBlocks, so it should possibly be available as a top-level predicate between basic blocks.

In particular, this concept can be put into BasicBlocks.qll as it's independent of .isCondition().

github-actions bot added C# Ruby Rust Pull requests that update Rust code Swift labels Jan 15, 2025

github-advanced-security bot found potential problems Jan 15, 2025

View reviewed changes

Rust, Ruby: Add basic block test

ce5c886

paldepind force-pushed the shared-basic-block-library branch from 1c9e7cc to 5bfeff6 Compare January 15, 2025 14:26

github-advanced-security bot found potential problems Jan 15, 2025

View reviewed changes

shared/controlflow/codeql/controlflow/BasicBlock.qll Fixed Show fixed Hide fixed

paldepind force-pushed the shared-basic-block-library branch 5 times, most recently from 7112872 to b313a48 Compare January 16, 2025 15:03

paldepind added 2 commits January 16, 2025 16:36

Shared: Add shared basic block library

c051eec

Shared: Add change note for basic block addition

8b20b0d

paldepind force-pushed the shared-basic-block-library branch from b313a48 to 8b20b0d Compare January 16, 2025 15:37

github-actions bot added the documentation label Jan 16, 2025

paldepind marked this pull request as ready for review January 16, 2025 15:45

paldepind requested review from a team as code owners January 16, 2025 15:45

hvitved requested changes Jan 17, 2025

View reviewed changes

Shared: Address review comments for shared basic block library

4d05b6a

paldepind commented Jan 17, 2025

View reviewed changes

Actions: Implement added predicates in CFG instantiation

53b63be

paldepind requested a review from a team as a code owner January 17, 2025 12:32

github-actions bot added the Actions Analysis of GitHub Actions label Jan 17, 2025

paldepind commented Jan 17, 2025

View reviewed changes

aschackmull reviewed Jan 17, 2025

View reviewed changes

shared/controlflow/codeql/controlflow/BasicBlock.qll Outdated Show resolved Hide resolved

hvitved reviewed Jan 17, 2025

View reviewed changes

aschackmull reviewed Jan 17, 2025

View reviewed changes

Shared: Address review comments for basic block library

e382ffc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add shared basic block library #18497

Add shared basic block library #18497

paldepind commented Jan 15, 2025 •

edited

Loading

hvitved commented Jan 17, 2025

hvitved left a comment

paldepind commented Jan 17, 2025

paldepind Jan 17, 2025

hvitved Jan 17, 2025

aschackmull Jan 17, 2025

paldepind commented Jan 17, 2025 •

edited

Loading

paldepind Jan 17, 2025

hvitved Jan 17, 2025

paldepind Jan 17, 2025

hvitved Jan 17, 2025

aschackmull Jan 17, 2025

aschackmull Jan 17, 2025

paldepind Jan 17, 2025

aschackmull Jan 17, 2025

aschackmull Jan 17, 2025

paldepind Jan 17, 2025

aschackmull Jan 17, 2025

paldepind Jan 17, 2025

aschackmull Jan 17, 2025

aschackmull Jan 17, 2025

aschackmull Jan 17, 2025

		private predicate bbIndex(Node bbStart, Node cfn, int i) =
		shortestDistances(startsBB/1, intraBBSucc/2)(bbStart, cfn, i)

Add shared basic block library #18497

Are you sure you want to change the base?

Add shared basic block library #18497

Conversation

paldepind commented Jan 15, 2025 • edited Loading

hvitved commented Jan 17, 2025

hvitved left a comment

Choose a reason for hiding this comment

paldepind commented Jan 17, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paldepind commented Jan 17, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paldepind commented Jan 15, 2025 •

edited

Loading

paldepind commented Jan 17, 2025 •

edited

Loading