Brodes/seh flow overhaul2

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

@@ -10,6 +10,7 @@
 private import TranslatedExpr
 private import TranslatedFunction
 private import DefaultOptions as DefaultOptions
+private import EdgeKind
 
 /**
  * Gets the `CallInstruction` from the `TranslatedCallExpr` for the specified expression.
@@ -84,30 +85,28 @@
           this.getEnclosingFunction().getFunction() = instr.getEnclosingFunction()
         )
     else
-      exists(boolean isSEH |
-        isSEH = true and kind.(ExceptionEdge).isSEH()
-        or
-        isSEH = false and not kind.(ExceptionEdge).isSEH()
-      |
+      exists(boolean isSEH | kind = exceptionEdge(isSEH) |
         // Call throw behavior is resolved from most restricted to least restricted in order
         // if there are conflicting throwing specificaitons for a function.
         // Enumerating all scenarios to be explicit.
         (
           // If the call is known to never throw, regardless of other defined throwing behavior,
           // do not generate any exception edges, only an ordinary successor
           if this.(TranslatedCallExpr).neverRaiseException(isSEH)
-          then result = this.getParent().getChildSuccessor(this, kind)
+          then result = this.getParent().getChildSuccessor(this, any(GotoEdge edge))
           else
             // If the call is known to always throw, regardless of other defined throwing behavior,
             // only generate an exception edge.
             if this.(TranslatedCallExpr).alwaysRaiseException(isSEH)
-            then result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), isSEH)
+            then
+              result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), isSEH)
             else
               if this.(TranslatedCallExpr).mayRaiseException(isSEH)
               then (
                 // if the call is known to conditionally throw, generate both an exception edge and an
                 // ordinary successor
-                result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), isSEH)
+                result =
+                  this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), isSEH)
                 or
                 result = this.getParent().getChildSuccessor(this, kind)
               ) else
@@ -146,7 +145,7 @@
    * and `neverRaiseException` may conflict (e.g., all hold for a given target).
    * Conflicting results are resolved during IR generation.
    */
   abstract predicate alwaysRaiseException(boolean isSEH);
 
   /**
    * The call target is known to conditionally raise an exception.
@@ -154,15 +153,15 @@
    * and `neverRaiseException` may conflict (e.g., all hold for a given target).
    * Conflicting results are resolved during IR generation.
    */
   abstract predicate mayRaiseException(boolean isSEH);
 
   /**
    * The call target is known to never raise an exception.
    * Note that `alwaysRaiseException`, `mayRaiseException`,
    * and `neverRaiseException` may conflict (e.g., all hold for a given target).
    * Conflicting results are resolved during IR generation.
    */
   abstract predicate neverRaiseException(boolean isSEH);
 
   /**
    * Gets the result type of the call.
@@ -363,7 +362,7 @@
     tag = CallTargetTag() and result = expr.getTarget()
   }
 
   override predicate alwaysRaiseException(boolean isSEH) {
     exists(ThrowingFunction f | f = expr.getTarget() |
       f.alwaysRaisesException() and f.isSEH() and isSEH = true
       or
@@ -371,7 +370,7 @@
     )
   }
 
   override predicate mayRaiseException(boolean isSEH) {
     exists(ThrowingFunction f | f = expr.getTarget() |
       f.mayRaiseException() and f.isSEH() and isSEH = true
       or
@@ -379,7 +378,7 @@
     )
   }
 
   override predicate neverRaiseException(boolean isSEH) {
     exists(NonThrowingFunction f | f = expr.getTarget() |
       f.isSEH() and isSEH = true
       or
@@ -398,7 +397,7 @@
     result = getTranslatedExpr(expr.getExpr().getFullyConverted())
   }
 
   override predicate alwaysRaiseException(boolean isSEH) {
     // We assume that a call to a function pointer will not throw a CXX exception.
     // This is not sound in general, but this will greatly reduce the number of
     // exceptional edges.
@@ -410,7 +409,7 @@
     )
   }
 
   override predicate mayRaiseException(boolean isSEH) {
     // We assume that a call to a function pointer will not throw a CXX exception.
     // This is not sound in general, but this will greatly reduce the number of
     // exceptional edges.
@@ -425,16 +424,14 @@
     isSEH = true
   }
 
   override predicate neverRaiseException(boolean isSEH) {
     // We assume that a call to a function pointer will not throw a CXX exception.
     // This is not sound in general, but this will greatly reduce the number of
     // exceptional edges.
     // For SEH exceptions, use the defined ThrowingFunction behavior and
     // if no throwing function is found, assume a conditional SEH exception
     // see `mayRaiseException`
-    exists(NonThrowingFunction f | f = expr.getTarget() |
-      f.isSEH() and isSEH = true
-    )
+    exists(NonThrowingFunction f | f = expr.getTarget() | f.isSEH() and isSEH = true)
   }
 }
 

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll

@@ -168,10 +168,6 @@ class TranslatedStaticLocalVariableDeclarationEntry extends TranslatedDeclaratio
     (
       kind instanceof GotoEdge and
       result = this.getInstruction(DynamicInitializationConditionalBranchTag())
-      or
-      // All load instructions may throw an SEH exception
-      kind.(ExceptionEdge).isSEH() and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true)
     )
     or
     tag = DynamicInitializationConditionalBranchTag() and
@@ -188,12 +184,7 @@ class TranslatedStaticLocalVariableDeclarationEntry extends TranslatedDeclaratio
     result = this.getInstruction(DynamicInitializationFlagStoreTag())
     or
     tag = DynamicInitializationFlagStoreTag() and
-    (
-      result = this.getParent().getChildSuccessor(this, kind)
-      or
-      // All store instructions may throw an SEH exception
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and kind.(ExceptionEdge).isSEH()
-    )
+    result = this.getParent().getChildSuccessor(this, kind)
   }
 
   final override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -15,6 +15,7 @@
 private import TranslatedStmt
 private import TranslatedGlobalVar
 private import IRConstruction
+private import EdgeKind
 import TranslatedCall
 
 /**
@@ -280,13 +281,7 @@
     )
     or
     tag = ConditionValueResultLoadTag() and
-    (
-      result = this.getParent().getChildSuccessor(this, kind)
-      or
-      // All load instructions could throw an SEH exception
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
-      kind.(ExceptionEdge).isSEH()
-    )
+    result = this.getParent().getChildSuccessor(this, kind)
   }
 
   override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
@@ -943,13 +938,7 @@
     result = this.getInstruction(ThisLoadTag())
     or
     tag = ThisLoadTag() and
-    (
-      result = this.getParent().getChildSuccessor(this, kind)
-      or
-      // All load instructions could throw an SEH exception
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
-      kind.(ExceptionEdge).isSEH()
-    )
+    result = this.getParent().getChildSuccessor(this, kind)
   }
 
   final override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {
@@ -2404,16 +2393,16 @@
         result = getTranslatedExpr(expr.getAllocatorCall().getArgument(index).getFullyConverted())
   }
 
   final override predicate mayRaiseException(boolean isSEH) {
     // We assume that a call to `new` or `new[]` will never throw. This is not
     // sound in general, but this will greatly reduce the number of exceptional
     // edges.
     none()
   }
 
   final override predicate alwaysRaiseException(boolean isSEH) { none() }
 
   final override predicate neverRaiseException(boolean isSEH) { none() }
 }
 
 TranslatedAllocatorCall getTranslatedAllocatorCall(NewOrNewArrayExpr newExpr) {
@@ -2479,16 +2468,16 @@
     result = getTranslatedExpr(expr.getExprWithReuse().getFullyConverted())
   }
 
   final override predicate mayRaiseException(boolean isSEH) {
     // We assume that a call to `delete` or `delete[]` will never throw. This is not
     // sound in general, but this will greatly reduce the number of exceptional
     // edges.
     none()
   }
 
   final override predicate alwaysRaiseException(boolean isSEH) { none() }
 
   final override predicate neverRaiseException(boolean isSEH) { none() }
 }
 
 TranslatedDeleteOrDeleteArrayExpr getTranslatedDeleteOrDeleteArray(DeleteOrDeleteArrayExpr newExpr) {
@@ -2681,11 +2670,6 @@
         result = this.getInstruction(ConditionValueResultTempAddressTag())
       )
       or
-      // All load instructions could throw an SEH exception
-      (tag = ConditionValueTrueStoreTag() or tag = ConditionValueFalseStoreTag()) and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
-      kind.(ExceptionEdge).isSEH()
-      or
       not this.elseIsVoid() and
       kind instanceof GotoEdge and
       (
@@ -2712,13 +2696,7 @@
       or
       (not expr.hasLValueToRValueConversion() or not isExtractorFrontendVersion65OrHigher()) and
       tag = ConditionValueResultLoadTag() and
-      (
-        result = this.getParent().getChildSuccessor(this, kind)
-        or
-        // All load instructions could throw an SEH exception
-        result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
-        kind.(ExceptionEdge).isSEH()
-      )
+      result = this.getParent().getChildSuccessor(this, kind)
     )
   }
 
@@ -3084,8 +3062,8 @@
       // And otherwise, exit this element with an exceptional edge
       not exists(this.getChild(id + 1)) and
       kind instanceof ExceptionEdge and
-      not kind.(ExceptionEdge).isSEH() and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), true)
+      kind = exceptionEdge(false) and
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), false)
     )
   }
 
@@ -3124,8 +3102,8 @@
       or
       not exists(this.getDestructors()) and
       kind instanceof ExceptionEdge and
-      not kind.(ExceptionEdge).isSEH() and
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), true)
+      kind = exceptionEdge(false) and
+      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge edge), false)
     )
   }
 
@@ -3413,13 +3391,7 @@
     result = this.getVAList().getFirstInstruction(kind)
     or
     tag = VarArgsVAListStoreTag() and
-    (
-      result = this.getParent().getChildSuccessor(this, kind)
-      or
-      // All store instructions could throw an SEH exception
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
-      kind.(ExceptionEdge).isSEH()
-    )
+    result = this.getParent().getChildSuccessor(this, kind)
   }
 
   final override Instruction getChildSuccessorInternal(TranslatedElement child, EdgeKind kind) {
@@ -3489,13 +3461,7 @@
 
   final override Instruction getInstructionSuccessorInternal(InstructionTag tag, EdgeKind kind) {
     tag = VarArgsVAListLoadTag() and
-    (
-      kind instanceof GotoEdge and result = this.getInstruction(VarArgsArgAddressTag())
-      or
-      // All load instructions could throw an SEH exception
-      result = this.getParent().getExceptionSuccessorInstruction(any(GotoEdge e), true) and
-      kind.(ExceptionEdge).isSEH()
-    )
+    (kind instanceof GotoEdge and result = this.getInstruction(VarArgsArgAddressTag()))
     or
     tag = VarArgsArgAddressTag() and
     kind instanceof GotoEdge and

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll

@@ -228,10 +228,10 @@
     )
   }
 
   final override Instruction getExceptionSuccessorInstruction(EdgeKind kind, boolean isSEH) {
     // only unwind for C++ exceptions since SEH exceptions are too verbose
-    // and would generate unwind for all functions. 
-    isSEH = false and 
+    // and would generate unwind for all functions.
+    isSEH = false and
     result = this.getInstruction(UnwindTag()) and
     kind instanceof GotoEdge
   }