Merge pull request #8038 from michaelnebel/csharp/gvn-cfecomparison

C#: Refactor Structural Comparison for Control Flow Elements.

Author: michaelnebel

csharp/ql/lib/semmle/code/csharp/commons/StructuralComparison.qll

@@ -5,6 +5,36 @@
 
 import csharp
 
+abstract private class GvnKind extends TGvnKind {
+  abstract string toString();
+}
+
+private class GvnKindExpr extends GvnKind, TGvnKindExpr {
+  private int kind;
+
+  GvnKindExpr() { this = TGvnKindExpr(kind) }
+
+  override string toString() { result = "Expr(" + kind + ")" }
+}
+
+private class GvnKindStmt extends GvnKind, TGvnKindStmt {
+  private int kind;
+
+  GvnKindStmt() { this = TGvnKindStmt(kind) }
+
+  override string toString() { result = "Stmt(" + kind + ")" }
+}
+
+private class GvnKindDeclaration extends GvnKind, TGvnKindDeclaration {
+  private int kind;
+  private boolean isTargetThis;
+  private Declaration d;
+
+  GvnKindDeclaration() { this = TGvnKindDeclaration(kind, isTargetThis, d) }
+
+  override string toString() { result = "Expr(" + kind + ")," + isTargetThis + "," + d }
+}
+
 /** Gets the declaration referenced by the expression `e`, if any. */
 private Declaration referenceAttribute(Expr e) {
   result = e.(MethodCall).getTarget()
@@ -14,17 +44,156 @@ private Declaration referenceAttribute(Expr e) {
   result = e.(Access).getTarget()
 }
 
-/** Gets the AST node kind element `e`. */
-private int elementKind(ControlFlowElement e) {
-  expressions(e, result, _)
+/** Gets a Boolean indicating whether the target of the expression `e` is `this`. */
+private boolean isTargetThis(Expr e) {
+  result = true and e.(MemberAccess).targetIsThisInstance()
   or
-  exists(int k | statements(e, k) | result = -k)
+  result = false and not e.(MemberAccess).targetIsThisInstance()
+}
+
+/**
+ * A global value number (GVN) for a control flow element.
+ *
+ * GVNs are used to map control flow elements to a representation that
+ * omits location information, that is, two elements that are structurally
+ * equal will be mapped to the same GVN.
+ */
+class Gvn extends TGvn {
+  /** Gets the string representation of this global value number. */
+  string toString() { none() }
+}
+
+private class ConstantGvn extends Gvn, TConstantGvn {
+  override string toString() { this = TConstantGvn(result) }
+}
+
+private class GvnNil extends Gvn, TGvnNil {
+  private GvnKind kind;
+
+  GvnNil() { this = TGvnNil(kind) }
+
+  override string toString() { result = "(kind:" + kind + ")" }
+}
+
+private class GvnCons extends Gvn, TGvnCons {
+  private Gvn head;
+  private Gvn tail;
+
+  GvnCons() { this = TGvnCons(head, tail) }
+
+  override string toString() { result = "(" + head + " :: " + tail + ")" }
 }
 
-private int getNumberOfActualChildren(ControlFlowElement e) {
-  if e.(MemberAccess).targetIsThisInstance()
-  then result = e.getNumberOfChildren() - 1
-  else result = e.getNumberOfChildren()
+pragma[noinline]
+private predicate gvnKindDeclaration(Expr e, int kind, boolean isTargetThis, Declaration d) {
+  isTargetThis = isTargetThis(e) and
+  d = referenceAttribute(e) and
+  expressions(e, kind, _)
+}
+
+/**
+ * Gets the `GvnKind` of the element `cfe`.
+ *
+ * In case `cfe` is a reference attribute, we encode the entire declaration and whether
+ * the target is semantically equivalent to `this`.
+ */
+private GvnKind getGvnKind(ControlFlowElement cfe) {
+  exists(int kind, boolean isTargetThis, Declaration d |
+    gvnKindDeclaration(cfe, kind, isTargetThis, d) and
+    result = TGvnKindDeclaration(kind, isTargetThis, d)
+  )
+  or
+  exists(int kind |
+    not exists(referenceAttribute(cfe)) and
+    expressions(cfe, kind, _) and
+    result = TGvnKindExpr(kind)
+    or
+    statements(cfe, kind) and
+    result = TGvnKindStmt(kind)
+  )
+}
+
+private Gvn toGvn(ControlFlowElement cfe, GvnKind kind, int index) {
+  kind = getGvnKind(cfe) and
+  result = TGvnNil(kind) and
+  index = -1
+  or
+  exists(Gvn head, Gvn tail |
+    toGvnCons(cfe, kind, index, head, tail) and
+    result = TGvnCons(head, tail)
+  )
+}
+
+private int getNumberOfActualChildren(ControlFlowElement cfe) {
+  if cfe.(MemberAccess).targetIsThisInstance()
+  then result = cfe.getNumberOfChildren() - 1
+  else result = cfe.getNumberOfChildren()
+}
+
+private ControlFlowElement getRankedChild(ControlFlowElement cfe, int rnk) {
+  result =
+    rank[rnk + 1](ControlFlowElement child, int j |
+      child = cfe.getChild(j) and
+      (
+        j >= 0
+        or
+        j = -1 and not cfe.(MemberAccess).targetIsThisInstance()
+      )
+    |
+      child order by j
+    )
+}
+
+pragma[noinline]
+private Gvn toGvnChild(ControlFlowElement cfe, int index) {
+  result = toGvn(getRankedChild(cfe, index))
+}
+
+pragma[noinline]
+private predicate toGvnCons(ControlFlowElement cfe, GvnKind kind, int index, Gvn head, Gvn tail) {
+  tail = toGvn(cfe, kind, index - 1) and
+  head = toGvnChild(cfe, index)
+}
+
+cached
+private module Cached {
+  cached
+  newtype TGvnKind =
+    TGvnKindExpr(int kind) { expressions(_, kind, _) } or
+    TGvnKindStmt(int kind) { statements(_, kind) } or
+    TGvnKindDeclaration(int kind, boolean thisTarget, Declaration d) {
+      exists(Expr e |
+        d = referenceAttribute(e) and thisTarget = isTargetThis(e) and expressions(e, kind, _)
+      )
+    }
+
+  cached
+  newtype TGvn =
+    TConstantGvn(string s) { s = any(Expr e).getValue() } or
+    TGvnNil(GvnKind gkind) or
+    TGvnCons(Gvn head, Gvn tail) { toGvnCons(_, _, _, head, tail) }
+
+  /** Gets the global value number of the element `cfe`. */
+  cached
+  Gvn toGvnCached(ControlFlowElement cfe) {
+    result = TConstantGvn(cfe.(Expr).getValue())
+    or
+    not exists(cfe.(Expr).getValue()) and
+    exists(GvnKind kind, int index |
+      result = toGvn(cfe, kind, index - 1) and
+      index = getNumberOfActualChildren(cfe)
+    )
+  }
+}
+
+private import Cached
+
+predicate toGvn = toGvnCached/1;
+
+pragma[inline]
+private predicate sameGvn(ControlFlowElement x, ControlFlowElement y) {
+  pragma[only_bind_into](toGvn(pragma[only_bind_out](x))) =
+    pragma[only_bind_into](toGvn(pragma[only_bind_out](y)))
 }
 
 /**
@@ -57,87 +226,12 @@ abstract class StructuralComparisonConfiguration extends string {
    */
   abstract predicate candidate(ControlFlowElement x, ControlFlowElement y);
 
-  private predicate candidateInternal(ControlFlowElement x, ControlFlowElement y) {
-    candidate(x, y)
-    or
-    exists(ControlFlowElement xParent, ControlFlowElement yParent, int i |
-      candidateInternalChild(xParent, i, x, yParent)
-    |
-      y = yParent.getChild(i)
-    )
-  }
-
-  pragma[noinline]
-  private predicate candidateInternalChild(
-    ControlFlowElement x, int i, ControlFlowElement xChild, ControlFlowElement y
-  ) {
-    candidateInternal(x, y) and
-    xChild = x.getChild(i)
-  }
-
-  private predicate sameByValue(Expr x, Expr y) { sameByValueAux(x, y, y.getValue()) }
-
-  pragma[nomagic]
-  private predicate sameByValueAux(Expr x, Expr y, string value) {
-    candidateInternal(x, y) and
-    value = x.getValue()
-  }
-
-  private ControlFlowElement getRankedChild(ControlFlowElement cfe, int rnk, int i) {
-    (candidateInternal(cfe, _) or candidateInternal(_, cfe)) and
-    i =
-      rank[rnk](int j |
-        exists(ControlFlowElement child | child = cfe.getChild(j) |
-          not (j = -1 and cfe.(MemberAccess).targetIsThisInstance())
-        )
-      ) and
-    result = cfe.getChild(i)
-  }
-
-  pragma[nomagic]
-  private predicate sameByStructure0(
-    ControlFlowElement x, ControlFlowElement y, int elementKind, int children
-  ) {
-    candidateInternal(x, y) and
-    elementKind = elementKind(x) and
-    children = getNumberOfActualChildren(x) and
-    not (x.(Expr).hasValue() and y.(Expr).hasValue())
-  }
-
-  pragma[nomagic]
-  private predicate sameByStructure(ControlFlowElement x, ControlFlowElement y, int i) {
-    i = 0 and
-    // At least one of `x` and `y` must not have a value, they must have
-    // the same kind, and the same number of children
-    sameByStructure0(x, y, elementKind(y), getNumberOfActualChildren(y)) and
-    // If one of them has a reference attribute, they should both reference
-    // the same node
-    (exists(referenceAttribute(x)) implies referenceAttribute(x) = referenceAttribute(y)) and
-    // x is a member access on `this` iff y is
-    (x.(MemberAccess).targetIsThisInstance() implies y.(MemberAccess).targetIsThisInstance()) and
-    (y.(MemberAccess).targetIsThisInstance() implies x.(MemberAccess).targetIsThisInstance())
-    or
-    exists(int j | sameByStructure(x, y, i - 1) |
-      sameInternal(getRankedChild(x, i, j), getRankedChild(y, i, j))
-    )
-  }
-
-  pragma[nomagic]
-  private predicate sameInternal(ControlFlowElement x, ControlFlowElement y) {
-    sameByValue(x, y)
-    or
-    sameByStructure(x, y, getNumberOfActualChildren(x))
-  }
-
   /**
    * Holds if elements `x` and `y` structurally equal. `x` and `y` must be
    * flagged as candidates for structural equality, that is,
    * `candidate(x, y)` must hold.
    */
-  predicate same(ControlFlowElement x, ControlFlowElement y) {
-    candidate(x, y) and
-    sameInternal(x, y)
-  }
+  predicate same(ControlFlowElement x, ControlFlowElement y) { candidate(x, y) and sameGvn(x, y) }
 }
 
 /**
@@ -183,86 +277,11 @@ module Internal {
      */
     abstract predicate candidate(ControlFlowElement x, ControlFlowElement y);
 
-    private predicate candidateInternal(ControlFlowElement x, ControlFlowElement y) {
-      candidate(x, y)
-      or
-      exists(ControlFlowElement xParent, ControlFlowElement yParent, int i |
-        candidateInternalChild(xParent, i, x, yParent)
-      |
-        y = yParent.getChild(i)
-      )
-    }
-
-    pragma[noinline]
-    private predicate candidateInternalChild(
-      ControlFlowElement x, int i, ControlFlowElement xChild, ControlFlowElement y
-    ) {
-      candidateInternal(x, y) and
-      xChild = x.getChild(i)
-    }
-
-    private predicate sameByValue(Expr x, Expr y) { sameByValueAux(x, y, y.getValue()) }
-
-    pragma[nomagic]
-    private predicate sameByValueAux(Expr x, Expr y, string value) {
-      candidateInternal(x, y) and
-      value = x.getValue()
-    }
-
-    private ControlFlowElement getRankedChild(ControlFlowElement cfe, int rnk, int i) {
-      (candidateInternal(cfe, _) or candidateInternal(_, cfe)) and
-      i =
-        rank[rnk](int j |
-          exists(ControlFlowElement child | child = cfe.getChild(j) |
-            not (j = -1 and cfe.(MemberAccess).targetIsThisInstance())
-          )
-        ) and
-      result = cfe.getChild(i)
-    }
-
-    pragma[nomagic]
-    private predicate sameByStructure0(
-      ControlFlowElement x, ControlFlowElement y, int elementKind, int children
-    ) {
-      candidateInternal(x, y) and
-      elementKind = elementKind(x) and
-      children = getNumberOfActualChildren(x) and
-      not (x.(Expr).hasValue() and y.(Expr).hasValue())
-    }
-
-    pragma[nomagic]
-    private predicate sameByStructure(ControlFlowElement x, ControlFlowElement y, int i) {
-      i = 0 and
-      // At least one of `x` and `y` must not have a value, they must have
-      // the same kind, and the same number of children
-      sameByStructure0(x, y, elementKind(y), getNumberOfActualChildren(y)) and
-      // If one of them has a reference attribute, they should both reference
-      // the same node
-      (exists(referenceAttribute(x)) implies referenceAttribute(x) = referenceAttribute(y)) and
-      // x is a member access on `this` iff y is
-      (x.(MemberAccess).targetIsThisInstance() implies y.(MemberAccess).targetIsThisInstance()) and
-      (y.(MemberAccess).targetIsThisInstance() implies x.(MemberAccess).targetIsThisInstance())
-      or
-      exists(int j | sameByStructure(x, y, i - 1) |
-        sameInternal(getRankedChild(x, i, j), getRankedChild(y, i, j))
-      )
-    }
-
-    pragma[nomagic]
-    private predicate sameInternal(ControlFlowElement x, ControlFlowElement y) {
-      sameByValue(x, y)
-      or
-      sameByStructure(x, y, getNumberOfActualChildren(x))
-    }
-
     /**
      * Holds if elements `x` and `y` structurally equal. `x` and `y` must be
      * flagged as candidates for structural equality, that is,
      * `candidate(x, y)` must hold.
      */
-    predicate same(ControlFlowElement x, ControlFlowElement y) {
-      candidate(x, y) and
-      sameInternal(x, y)
-    }
+    predicate same(ControlFlowElement x, ControlFlowElement y) { candidate(x, y) and sameGvn(x, y) }
   }
 }