Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 2k
Expand file tree
/
Copy pathDeadStoreOfProperty.ql
More file actions
309 lines (292 loc) · 10.5 KB
/
Copy pathDeadStoreOfProperty.ql
File metadata and controls
309 lines (292 loc) · 10.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
/**
* @name Useless assignment to property
* @description An assignment to a property whose value is always overwritten has no effect.
* @kind problem
* @problem.severity warning
* @id js/useless-assignment-to-property
* @tags quality
* maintainability
* useless-code
* @precision high
*/
import javascript
import Expressions.DOMProperties
import DeadStore
/**
* Holds if `write` writes to a property of a base, and there is only one base object of `write`.
*/
predicate unambiguousPropWrite(DataFlow::PropWrite write) {
exists(DataFlow::SourceNode base, string name |
write = base.getAPropertyWrite(name) and
not exists(DataFlow::SourceNode otherBase |
otherBase != base and
write = otherBase.getAPropertyWrite(name)
)
)
}
/**
* Holds if `assign1` and `assign2` both assign property `name` of the same object, and `assign2` post-dominates `assign1`.
*/
predicate postDominatedPropWrite(
string name, DataFlow::PropWrite assign1, DataFlow::PropWrite assign2, boolean local
) {
exists(DataFlow::SourceNode base |
assign1 = base.getAPropertyWrite(name) and
assign2 = base.getAPropertyWrite(name)
) and
exists(
ControlFlowNode write1, ControlFlowNode write2, ReachableBasicBlock block1,
ReachableBasicBlock block2
|
write1 = assign1.getWriteNode() and
write2 = assign2.getWriteNode() and
block1 = write1.getBasicBlock() and
block2 = write2.getBasicBlock() and
unambiguousPropWrite(assign1) and
unambiguousPropWrite(assign2) and
(
block2.strictlyPostDominates(block1) and local = false
or
block1 = block2 and
local = true and
getRank(block1, write1, name) < getRank(block2, write2, name)
)
)
}
/**
* Gets the rank for the read/write `ref` of a property `name` inside basicblock `bb`.
*/
int getRank(ReachableBasicBlock bb, ControlFlowNode ref, string name) {
ref =
rank[result](ControlFlowNode e |
isAPropertyWrite(e, name) or
isAPropertyRead(e, name)
|
e order by any(int i | e = bb.getNode(i))
)
}
/**
* Holds if `e` is a property read of a property `name`.
*/
predicate isAPropertyRead(Expr e, string name) {
exists(DataFlow::PropRead read | read.asExpr() = e and read.getPropertyName() = name)
}
/**
* Holds if `e` is a property write of a property `name`.
*/
predicate isAPropertyWrite(ControlFlowNode e, string name) {
exists(DataFlow::PropWrite write | write.getWriteNode() = e and write.getPropertyName() = name)
}
/**
* Holds if `e` may access a property named `name`.
*/
bindingset[name]
predicate maybeAccessesProperty(Expr e, string name) {
isAPropertyRead(e, name)
or
// conservatively reject all side-effects
e.isImpure()
}
/**
* Holds if `assign1` and `assign2` both assign property `name`, but `assign1` is dead because of `assign2`.
*/
predicate isDeadAssignment(string name, DataFlow::PropWrite assign1, DataFlow::PropWrite assign2) {
(
noPropAccessBetweenInsideBasicBlock(name, assign1, assign2) or
noPropAccessBetweenAcrossBasicBlocks(name, assign1, assign2)
) and
not isDomProperty(name)
}
/**
* Holds if `assign1` and `assign2` are in the same basicblock and both assign property `name`, and the assigned property is not accessed between the two assignments.
*/
predicate noPropAccessBetweenInsideBasicBlock(
string name, DataFlow::PropWrite assign1, DataFlow::PropWrite assign2
) {
assign2.getWriteNode() = getANodeWithNoPropAccessBetweenInsideBlock(name, assign1) and
postDominatedPropWrite(name, assign1, assign2, true)
}
/**
* Holds if `assign` assigns a property that may be accessed somewhere else in the same block,
* `after` indicates if the access happens before or after the node for `assign`.
*
* The access can either be a direct property access of the same name,
* or an impure expression where we assume that the expression can access the property.
*/
predicate maybeAssignsAccessedPropInBlock(DataFlow::PropWrite assign, boolean after) {
(
// early pruning - manual magic
after = true and postDominatedPropWrite(_, assign, _, false)
or
after = false and postDominatedPropWrite(_, _, assign, false)
) and
(
// direct property write before/after assign
exists(ReachableBasicBlock block, int i, int j, Expr e, string name |
i = getRank(block, assign.getWriteNode(), name) and
j = getRank(block, e, name) and
isAPropertyRead(e, name)
|
after = true and i < j
or
after = false and j < i
)
or
// impure expression that might access the property before/after assign
exists(ReachableBasicBlock block | assign.getWriteNode().getBasicBlock() = block |
after = true and PurityCheck::isBeforeImpure(assign, block)
or
after = false and PurityCheck::isAfterImpure(assign, block)
)
)
}
/**
* Predicates to check if a property-write comes after/before an impure expression within the same basicblock.
*/
private module PurityCheck {
/**
* Holds if `write` is before an impure expression inside `bb`.
*/
predicate isBeforeImpure(DataFlow::PropWrite write, ReachableBasicBlock bb) {
getANodeAfterWrite(write, bb).(Expr).isImpure()
}
/**
* Gets a ControlFlowNode that comes after `write` inside `bb`.
* Stops after finding the first impure expression.
*
* This predicate is used as a helper to check if one of the successors to `write` inside `bb` is impure (see `isBeforeImpure`).
*/
private ControlFlowNode getANodeAfterWrite(DataFlow::PropWrite write, ReachableBasicBlock bb) {
// base case
result.getBasicBlock() = bb and
postDominatedPropWrite(_, write, _, false) and // early pruning - manual magic
result = write.getWriteNode().getASuccessor()
or
// recursive case
exists(ControlFlowNode prev | prev = getANodeAfterWrite(write, bb) |
not result instanceof BasicBlock and
not prev.(Expr).isImpure() and
result = prev.getASuccessor()
)
}
/**
* Holds if `write` is after an impure expression inside `bb`.
*/
predicate isAfterImpure(DataFlow::PropWrite write, ReachableBasicBlock bb) {
getANodeBeforeWrite(write, bb).(Expr).isImpure()
}
/**
* Gets a ControlFlowNode that comes before `write` inside `bb`.
* Stops after finding the first impure expression.
*
* This predicate is used as a helper to check if one of the predecessors to `write` inside `bb` is impure (see `isAfterImpure`).
*/
private ControlFlowNode getANodeBeforeWrite(DataFlow::PropWrite write, ReachableBasicBlock bb) {
// base case
result.getBasicBlock() = bb and
postDominatedPropWrite(_, _, write, false) and // early pruning - manual magic
result = write.getWriteNode().getAPredecessor()
or
// recursive case
exists(ControlFlowNode prev | prev = getANodeBeforeWrite(write, bb) |
not prev instanceof BasicBlock and
not prev.(Expr).isImpure() and
result = prev.getAPredecessor()
)
}
}
/**
* Holds if `write` and `result` are inside the same basicblock, and `write` assigns property `name`, and `result` is a (transitive) successor of `write`, and `name` is not accessed between `write` and `result`.
*
* The predicate is computed recursively by computing transitive successors of `write` while removing the successors that could access `name`.
* Stops at the first write to `name` that occours after `write`.
*/
ControlFlowNode getANodeWithNoPropAccessBetweenInsideBlock(string name, DataFlow::PropWrite write) {
(
// base case.
result = write.getWriteNode().getASuccessor() and
postDominatedPropWrite(name, write, _, true) // manual magic - cheap check that there might exist a result we are interrested in,
or
// recursive case
result = getANodeWithNoPropAccessBetweenInsideBlock(name, write).getASuccessor()
) and
// stop at basic-block boundaries
not result instanceof BasicBlock and
// stop at reads of `name` and at impure expressions (except writes to `name`)
not (
maybeAccessesProperty(result, name) and
not isAPropertyWrite(result, name)
) and
// stop at the first write to `name` that comes after `write`.
(
not isAPropertyWrite(result.getAPredecessor(), name)
or
result.getAPredecessor() = write.getWriteNode()
)
}
/**
* Holds if `assign1` and `assign2` are in different basicblocks and both assign property `name`, and the assigned property is not accessed between the two assignments.
*/
pragma[nomagic]
predicate noPropAccessBetweenAcrossBasicBlocks(
string name, DataFlow::PropWrite assign1, DataFlow::PropWrite assign2
) {
exists(
ControlFlowNode write1, ControlFlowNode write2, ReachableBasicBlock block1,
ReachableBasicBlock block2
|
postDominatedPropWrite(name, assign1, assign2, false) and // manual magic - early pruning
write1 = assign1.getWriteNode() and
not maybeAssignsAccessedPropInBlock(assign1, true) and
write2 = assign2.getWriteNode() and
not maybeAssignsAccessedPropInBlock(assign2, false) and
write1.getBasicBlock() = block1 and
write2.getBasicBlock() = block2 and
not block1 = block2 and
// check for an access between the two write blocks
not exists(ReachableBasicBlock mid |
block1.getASuccessor+() = mid and
mid.getASuccessor+() = block2
|
maybeAccessesProperty(mid.getANode(), name)
)
)
}
from string name, DataFlow::PropWrite assign1, DataFlow::PropWrite assign2
where
isDeadAssignment(name, assign1, assign2) and
// whitelist
not (
// Google Closure Compiler pattern: `o.p = o['p'] = v`
exists(PropAccess p1, PropAccess p2 |
p1 = assign1.getAstNode() and
p2 = assign2.getAstNode()
|
p1 instanceof DotExpr and p2 instanceof IndexExpr
or
p2 instanceof DotExpr and p1 instanceof IndexExpr
)
or
// don't flag overwrites for default values
isDefaultInit(assign1.getRhs().asExpr().getUnderlyingValue())
or
// don't flag assignments in externs
assign1.getAstNode().inExternsFile()
or
// exclude result from js/overwritten-property
assign2.getBase() instanceof DataFlow::ObjectLiteralNode
or
// exclude result from accessor declarations
assign1.getWriteNode() instanceof AccessorMethodDeclaration
) and
// exclude results from non-value definitions from `Object.defineProperty`
(
assign1 instanceof CallToObjectDefineProperty
implies
assign1.(CallToObjectDefineProperty).hasPropertyAttributeWrite("value", _)
) and
// ignore Angular templates
not assign1.getTopLevel() instanceof Angular2::TemplateTopLevel
select assign1.getWriteNode(),
"This write to property '" + name + "' is useless, since $@ always overrides it.",
assign2.getWriteNode(), "another property write"
You can’t perform that action at this time.