Swift: Dataflow through Phi nodes

Author: Robert Marsh

swift/ql/lib/codeql/swift/dataflow/Ssa.qll

@@ -72,4 +72,22 @@ module Ssa {
       )
     }
   }
+
+  cached class PhiDefinition extends Definition, SsaImplCommon::PhiNode {
+    cached
+    override Location getLocation() {
+      exists(BasicBlock bb, int i |
+        this.definesAt(_, bb, i) and
+        result = bb.getLocation()
+      )
+    }
+
+    cached Definition getPhiInput(BasicBlock bb) {
+      SsaImplCommon::phiHasInputFromBlock(this, result, bb)
+    }
+
+    cached Definition getAPhiInput() {
+      result = this.getPhiInput(_)
+    }
+  }
 }

swift/ql/lib/codeql/swift/dataflow/internal/DataFlowPrivate.qll

@@ -4,6 +4,7 @@ private import DataFlowDispatch
 private import codeql.swift.controlflow.CfgNodes
 private import codeql.swift.dataflow.Ssa
 private import codeql.swift.controlflow.BasicBlocks
+private import codeql.swift.dataflow.internal.SsaImplCommon as SsaImpl
 
 /** Gets the callable in which this node occurs. */
 DataFlowCallable nodeGetEnclosingCallable(NodeImpl n) { result = n.getEnclosingCallable() }
@@ -46,6 +47,13 @@ private class SsaDefinitionNodeImpl extends SsaDefinitionNode, NodeImpl {
   }
 }
 
+private predicate localFlowSsaInput(Node nodeFrom, Ssa::Definition def, Ssa::Definition next) {
+  exists(BasicBlock bb, int i | SsaImpl::lastRefRedef(def, bb, i, next) |
+    def.definesAt(_, bb, i) and
+    def = nodeFrom.asDefinition()
+  )
+}
+
 /** A collection of cached types and predicates to be evaluated in the same stage. */
 cached
 private module Cached {
@@ -66,6 +74,9 @@ private module Cached {
       or
       // use-use flow
       def.adjacentReadPair(nodeFrom.getCfgNode(), nodeTo.getCfgNode())
+      // step from previous read to Phi node
+      or
+      localFlowSsaInput(nodeFrom, def, nodeTo.asDefinition())
     )
   }
 

swift/ql/test/library-tests/dataflow/dataflow/DataFlow.expected

@@ -11,6 +11,7 @@ edges
 | test.swift:29:26:29:29 | ParamDecl :  | test.swift:31:15:31:15 | DeclRefExpr |
 | test.swift:29:26:29:29 | WriteDef :  | test.swift:31:15:31:15 | DeclRefExpr |
 | test.swift:35:12:35:19 | CallExpr :  | test.swift:39:15:39:29 | CallExpr |
+| test.swift:43:19:43:26 | CallExpr :  | test.swift:50:15:50:15 | DeclRefExpr |
 nodes
 | test.swift:6:19:6:26 | CallExpr :  | semmle.label | CallExpr :  |
 | test.swift:7:15:7:15 | DeclRefExpr | semmle.label | DeclRefExpr |
@@ -30,6 +31,8 @@ nodes
 | test.swift:31:15:31:15 | DeclRefExpr | semmle.label | DeclRefExpr |
 | test.swift:35:12:35:19 | CallExpr :  | semmle.label | CallExpr :  |
 | test.swift:39:15:39:29 | CallExpr | semmle.label | CallExpr |
+| test.swift:43:19:43:26 | CallExpr :  | semmle.label | CallExpr :  |
+| test.swift:50:15:50:15 | DeclRefExpr | semmle.label | DeclRefExpr |
 subpaths
 #select
 | test.swift:6:19:6:26 | CallExpr :  | test.swift:7:15:7:15 | DeclRefExpr |
@@ -38,3 +41,4 @@ subpaths
 | test.swift:25:20:25:27 | CallExpr :  | test.swift:30:15:30:15 | DeclRefExpr |
 | test.swift:26:26:26:33 | CallExpr :  | test.swift:31:15:31:15 | DeclRefExpr |
 | test.swift:35:12:35:19 | CallExpr :  | test.swift:39:15:39:29 | CallExpr |
+| test.swift:43:19:43:26 | CallExpr :  | test.swift:50:15:50:15 | DeclRefExpr |

swift/ql/test/library-tests/dataflow/dataflow/LocalFlow.expected

@@ -1,6 +1,3 @@
-| file://:0:0:0:0 | Phi | test.swift:15:15:15:15 | DeclRefExpr |
-| file://:0:0:0:0 | Phi | test.swift:21:15:21:15 | DeclRefExpr |
-| file://:0:0:0:0 | Phi | test.swift:50:15:50:15 | DeclRefExpr |
 | test.swift:6:9:6:13 | WriteDef | test.swift:7:15:7:15 | DeclRefExpr |
 | test.swift:6:19:6:26 | CallExpr | test.swift:6:9:6:13 | WriteDef |
 | test.swift:7:15:7:15 | DeclRefExpr | test.swift:8:10:8:10 | DeclRefExpr |
@@ -10,8 +7,13 @@
 | test.swift:9:15:9:15 | DeclRefExpr | test.swift:11:8:11:8 | DeclRefExpr |
 | test.swift:12:9:12:14 | WriteDef | test.swift:13:19:13:19 | DeclRefExpr |
 | test.swift:12:14:12:14 | IntegerLiteralExpr | test.swift:12:9:12:14 | WriteDef |
+| test.swift:15:5:15:5 | Phi | test.swift:15:15:15:15 | DeclRefExpr |
 | test.swift:15:15:15:15 | DeclRefExpr | test.swift:19:14:19:14 | DeclRefExpr |
+| test.swift:17:5:17:10 | WriteDef | test.swift:18:11:18:11 | Phi |
 | test.swift:17:10:17:10 | IntegerLiteralExpr | test.swift:17:5:17:10 | WriteDef |
+| test.swift:18:11:18:11 | Phi | test.swift:19:9:19:14 | WriteDef |
+| test.swift:18:11:18:11 | Phi | test.swift:21:15:21:15 | DeclRefExpr |
+| test.swift:19:9:19:14 | WriteDef | test.swift:18:11:18:11 | Phi |
 | test.swift:19:14:19:14 | DeclRefExpr | test.swift:19:9:19:14 | WriteDef |
 | test.swift:19:14:19:14 | DeclRefExpr | test.swift:19:14:19:14 | DeclRefExpr |
 | test.swift:29:18:29:21 | ParamDecl | test.swift:30:15:30:15 | DeclRefExpr |
@@ -22,8 +24,11 @@
 | test.swift:42:16:42:19 | WriteDef | test.swift:45:8:45:8 | DeclRefExpr |
 | test.swift:43:9:43:13 | WriteDef | test.swift:46:13:46:13 | DeclRefExpr |
 | test.swift:43:19:43:26 | CallExpr | test.swift:43:9:43:13 | WriteDef |
+| test.swift:46:9:46:13 | WriteDef | test.swift:50:5:50:5 | Phi |
 | test.swift:46:13:46:13 | DeclRefExpr | test.swift:46:9:46:13 | WriteDef |
+| test.swift:48:9:48:13 | WriteDef | test.swift:50:5:50:5 | Phi |
 | test.swift:48:13:48:13 | IntegerLiteralExpr | test.swift:48:9:48:13 | WriteDef |
+| test.swift:50:5:50:5 | Phi | test.swift:50:15:50:15 | DeclRefExpr |
 | test.swift:58:9:58:12 | WriteDef | test.swift:59:15:59:15 | DeclRefExpr |
 | test.swift:58:18:58:18 | IntegerLiteralExpr | test.swift:58:9:58:12 | WriteDef |
 | test.swift:59:15:59:15 | DeclRefExpr | test.swift:60:23:60:23 | DeclRefExpr |