Merge pull request #5928 from hvitved/python/type-tracker-split

Python: Split up `(small)step` into intra/interprocedural predicates

Author: hvitved

python/ql/src/experimental/typetracking/TypeTracker.qll

@@ -57,29 +57,46 @@ class StepSummary extends TStepSummary {
 module StepSummary {
   /**
    * Gets the summary that corresponds to having taken a forwards
-   * heap and/or inter-procedural step from `nodeFrom` to `nodeTo`.
+   * heap and/or intra-procedural step from `nodeFrom` to `nodeTo`.
+   *
+   * Steps contained in this predicate should _not_ depend on the call graph.
    */
   cached
-  predicate step(LocalSourceNode nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
-    exists(Node mid | nodeFrom.flowsTo(mid) and smallstep(mid, nodeTo, summary))
+  private predicate stepNoCall(LocalSourceNode nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+    exists(Node mid | nodeFrom.flowsTo(mid) and smallstepNoCall(mid, nodeTo, summary))
   }
 
   /**
    * Gets the summary that corresponds to having taken a forwards
-   * local, heap and/or inter-procedural step from `nodeFrom` to `nodeTo`.
+   * inter-procedural step from `nodeFrom` to `nodeTo`.
+   */
+  cached
+  private predicate stepCall(LocalSourceNode nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+    exists(Node mid | nodeFrom.flowsTo(mid) and smallstepCall(mid, nodeTo, summary))
+  }
+
+  /**
+   * Gets the summary that corresponds to having taken a forwards
+   * heap and/or inter-procedural step from `nodeFrom` to `nodeTo`.
    *
-   * Unlike `StepSummary::step`, this predicate does not compress
-   * type-preserving steps.
+   * This predicate is inlined, which enables better join-orders when
+   * the call graph construction and type tracking are mutually recursive.
+   * In such cases, non-linear recursion involving `step` will be limited
+   * to non-linear recursion for the parts of `step` that involve the
+   * call graph.
    */
-  predicate smallstep(Node nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+  pragma[inline]
+  predicate step(LocalSourceNode nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+    stepNoCall(nodeFrom, nodeTo, summary)
+    or
+    stepCall(nodeFrom, nodeTo, summary)
+  }
+
+  pragma[noinline]
+  private predicate smallstepNoCall(Node nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
     jumpStep(nodeFrom, nodeTo) and
     summary = LevelStep()
     or
-    callStep(nodeFrom, nodeTo) and summary = CallStep()
-    or
-    returnStep(nodeFrom, nodeTo) and
-    summary = ReturnStep()
-    or
     exists(string content |
       localSourceStoreStep(nodeFrom, nodeTo, content) and
       summary = StoreStep(content)
@@ -88,6 +105,28 @@ module StepSummary {
     )
   }
 
+  pragma[noinline]
+  private predicate smallstepCall(Node nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+    callStep(nodeFrom, nodeTo) and summary = CallStep()
+    or
+    returnStep(nodeFrom, nodeTo) and
+    summary = ReturnStep()
+  }
+
+  /**
+   * Gets the summary that corresponds to having taken a forwards
+   * local, heap and/or inter-procedural step from `nodeFrom` to `nodeTo`.
+   *
+   * Unlike `StepSummary::step`, this predicate does not compress
+   * type-preserving steps.
+   */
+  pragma[inline]
+  predicate smallstep(Node nodeFrom, LocalSourceNode nodeTo, StepSummary summary) {
+    smallstepNoCall(nodeFrom, nodeTo, summary)
+    or
+    smallstepCall(nodeFrom, nodeTo, summary)
+  }
+
   /**
    * Holds if `nodeFrom` is being written to the `content` content of the object in `nodeTo`.
    *