Rust: Adjust SSA write node for (compound) assignments#20443
Rust: Adjust SSA write node for (compound) assignments#20443hvitved merged 2 commits intogithub:mainfrom
Conversation
926006e to
7cac226
Compare
geoffw0
left a comment
There was a problem hiding this comment.
Looks plausible, fixes my issue, I'd like to see the results of the DCA run before merging...
geoffw0
left a comment
There was a problem hiding this comment.
DCA LGTM. We can ignore the RequestForgery.ql test failure, that is unrelated and has been fixed on main.
There was a problem hiding this comment.
Pull Request Overview
This PR adjusts SSA write node handling for assignments to use the control-flow node of the assignment expression itself rather than the control-flow node of the left-hand side variable. This change ensures proper ordering when the assignee appears in both the left-hand side and right-hand side of an assignment (e.g., x = x + 1).
Key changes:
- Modified SSA write node tracking to use assignment expression CFG nodes instead of left-hand side variable CFG nodes
- Added test case for self-assignment (
x2 = x2) to verify the fix - Updated several library functions to support the new write node structure
Reviewed Changes
Copilot reviewed 10 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| rust/ql/test/library-tests/variables/main.rs | Added test case for self-assignment to verify SSA ordering |
| rust/ql/test/library-tests/variables/variables.expected | Updated expected test results with new SSA node numbering |
| rust/ql/test/library-tests/variables/CONSISTENCY/PathResolutionConsistency.expected | Updated line number references due to test additions |
| rust/ql/src/queries/unusedentities/UnusedValue.ql | Updated to use new variableWrite predicate signature |
| rust/ql/lib/codeql/rust/elements/internal/VariableImpl.qll | Enhanced VariableWriteAccess to track the assignment expression |
| rust/ql/lib/codeql/rust/dataflow/internal/SsaImpl.qll | Modified variableWrite predicate to separate write node from access node |
| rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll | Updated to use getWriteAccess instead of getControlFlowNode |
| rust/ql/lib/codeql/rust/dataflow/Ssa.qll | Enhanced WriteDefinition to properly handle assignment expressions |
| rust/ql/lib/codeql/rust/controlflow/internal/CfgNodes.qll | Added AssignmentExprChildMapping for proper CFG node handling |
| rust/ql/lib/codeql/rust/controlflow/CfgNodes.qll | Added new CFG node classes for variable accesses and assignments |
Before this PR, SSA assignment definitions like
x = ywould use the control-flow node ofxas the point where the assignment happens. This works most of the time, except when the assignee also occurs in the RHS, e.g.x = x + 1, because we evaluate assignments left-to-right.This PR changes the above to instead use the control-flow node for the assignment itself (which comes after
xandyin the control flow graph; all expressions are post-order).