Repository navigation
SSA: Refactor post-update support in DataFlowIntegration. - #22914
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved post-update SSA defects lose mutation flow and can introduce cross-variable flow, while a missing counter expectation will fail the Rust diagnostic test.
3 open issues
What changed in this PR
Refactors post-update handling in shared SSA, moving logic out of Unified’s data-flow integration and replacing synthetic reads with explicit read-to-update associations.
Changes:
- Adds mappings between variable reads and their post-update control-flow positions.
- Centralizes post-update traversal in shared SSA and adds a consistency check.
- Simplifies Unified’s SSA node mapping and local-flow integration.
| File | Description |
|---|---|
unified/ql/lib/codeql/unified/internal/dataflow/LocalSsa.qll |
Supplies explicit post-update mappings and removes Unified-specific traversal workarounds. |
shared/ssa/codeql/ssa/Ssa.qll |
Implements shared post-update handling across reference traversal, data-flow nodes, and diagnostics. |
Review effort: Max
aschackmull
force-pushed
the
ssa/postupdate
branch
from
October 29, 2026 10:54
1776e21 to
df1793e
Compare
Comment on lines
+1859
to
+1863
| exists(DfInput::Expr e1, BasicBlock bb1, int i1, BasicBlock bb2, int i2 | | ||
| result = TExprNode(e1, v_, false) and | ||
| e1.hasCfgNode(bb1, i1) and | ||
| variableReadWithPostUpdate(bb1, i1, v_, bb2, i2) and | ||
| e.hasCfgNode(bb2, i2) |
Contributor
Author
There was a problem hiding this comment.
Irrelevant. We should get rid of getPreUpdateNode in the SSA output, since from the SSA point of view we actually want to conflate those two post-updates.
aschackmull
force-pushed
the
ssa/postupdate
branch
from
October 29, 2026 13:49
df1793e to
65529af
Compare
aschackmull
force-pushed
the
ssa/postupdate
branch
from
October 29, 2026 14:00
65529af to
51690fd
Compare
aschackmull
marked this pull request as ready for review
October 30, 2026 11:58
asgerf
approved these changes
Oct 30, 2026
asgerf
left a comment
Contributor
There was a problem hiding this comment.
Unified and SSA changes LGTM
Contributor
Author
|
Already discussed the C++ changes with Mathias. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unified added ad-hoc support for post-updates in SSA DataFlowIntegration to occur later in the CFG than the corresponding reads.
This PR refactors this support to make it a more principled inclusion in the various parts of SSA.
Along the way I uncovered a bug: when a read coincides with a write in the CFG then we mistakenly used to add outgoing use-use steps from the read. Fixing this uncovered another bug in C/C++, which had accidentally relied on the faulty use-use steps to get the desired flow steps. With the help of copilot and @MathiasVP, I also added a commit to fix this.