Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
58d9d9e
C++: IR: Drop the aliased SSA
igfoo Feb 16, 2026
1fb8ab5
C++: Remove aliased SSA tests
igfoo Feb 16, 2026
01eaf6d
C++: Use unaliased SSA in constant_func.ql test
igfoo Feb 17, 2026
ab8e5ab
C++: Accept changes in constant_func test
igfoo Feb 18, 2026
e15106a
C++: Update ssa_escape.ql test now we don't have aliased SSA
igfoo Feb 18, 2026
0bb6003
C++: Rename aliased_ir.ql to unaliased_ir.ql
igfoo Feb 18, 2026
1b850b2
C++: Update unaliased_ir.ql to use the unaliased IR
igfoo Feb 18, 2026
eb20617
C++: Accept changes in controlflow/Ssa_Lt following removal of aliase…
igfoo Mar 3, 2026
45ac0a3
C++: Accept changes in controlflow/guards following removal of aliase…
igfoo Mar 3, 2026
f880729
C++: Accept changes in controlflow/guards-ir following removal of ali…
igfoo Mar 3, 2026
f3bf981
C++: Fix dataflow/dataflow-tests following removal of aliased SSA
igfoo Mar 3, 2026
ce461da
C++: Fix valuenumbering/GlobalValueNumbering following removal of ali…
igfoo Mar 3, 2026
77c50be
C++: "Fix" ir/points_to test following removal of aliased SSA
igfoo Mar 3, 2026
7cc77c2
C++: Fix ir/range-analysis test following removal of aliased SSA
igfoo Mar 3, 2026
dcafe0f
C++: Remove aliased_ssa_* from ir/ir test following removal of aliase…
igfoo Mar 3, 2026
abbb838
C++: Remove aliased_ssa from config/identical-files.json
igfoo Mar 4, 2026
fcbb3fa
C++: Fix cpp/ql/src/Metrics/Internal/IRConsistency.ql now aliased SSA…
igfoo Mar 4, 2026
3d28c56
C++: Accept changes in experimental tests after aliased SSA removal
igfoo Mar 4, 2026
9cb31fb
C++: Accept changes in experimental query tests following aliased SSA…
igfoo Mar 4, 2026
50a1deb
C++: Rename aliased_ir test to unaliased_ir
igfoo Mar 4, 2026
f4e062e
C++: Accept changes in unaliased_ir.ql test
igfoo Mar 4, 2026
a7c5728
C++: Accept changes in BadAdditionOverflowCheck test following aliase…
igfoo Mar 4, 2026
0b90d4d
C++: Accept changes in StrncpyFlippedArgs test following aliased SSA …
igfoo Mar 4, 2026
f2ceabf
C++: Accept changes in RedundantNullCheckSimple test following aliase…
igfoo Mar 4, 2026
beb819b
C++: Accept changes in OverrunWriteProductFlow test following aliased…
igfoo Mar 4, 2026
043a55a
C++: Accept changes in UncontrolledFormatString test following aliase…
igfoo Mar 4, 2026
937b2c5
C++: Fix InvalidPointerToDereference test following aliased SSA removal
igfoo Mar 4, 2026
4ddd7e5
C++: Accept changes in CleartextFileWrite test following aliased SSA …
igfoo Mar 4, 2026
adf3eba
C++: Add changelog entry for removal of aliased SSA.
igfoo Mar 4, 2026
78e05c6
C++: Fix typo
igfoo Mar 4, 2026
c21d5a8
C++: Remove GroupedMemoryLocation
igfoo Mar 4, 2026
13ec60f
C++: Remove VariableGroup
igfoo Mar 4, 2026
f10a597
C++ Remove remains of UninitializedGroup and GroupedMemoryAccess
igfoo Mar 5, 2026
1120093
C++: Remove hasIncompleteSsa and isBusyDef
igfoo Mar 5, 2026
79fd018
C++: Remove unused MemoryLocation0
igfoo Mar 5, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 21 additions & 70 deletions config/identical-files.json
Original file line number Diff line number Diff line change
Expand Up @@ -25,136 +25,87 @@
],
"IR Instruction": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll"
],
"IR IRBlock": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll"
],
"IR IRVariable": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll"
],
"IR IRFunction": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll"
],
"IR Operand": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll"
],
"IR IR": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll"
],
"IR IRConsistency": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll"
],
"IR PrintIR": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll"
],
"IR SSAConsistency": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll"
],
"C++ IR InstructionImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll"
],
"C++ IR IRImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll"
],
"C++ IR IRBlockImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll"
],
"C++ IR IRConsistencyImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConsistencyImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRConsistencyImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRConsistencyImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRConsistencyImports.qll"
],
"C++ IR IRFunctionImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll"
],
"C++ IR IRVariableImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll"
],
"C++ IR OperandImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll"
],
"C++ IR PrintIRImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
],
"C++ SSA SSAConstructionImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
],
"SSA AliasAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll"
],
"SSA PrintAliasAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
],
"C++ SSA AliasAnalysisImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
],
"IR SSA SSAConstruction": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll"
],
"IR SSA PrintSSA": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll"
],
"IR ValueNumberInternal": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll"
],
"C++ IR ValueNumber": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
],
"C++ IR PrintValueNumbering": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll"
],
"C++ IR ConstantAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll"
],
"C++ IR PrintConstantAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll"
],
"C++ IR ReachableBlock": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
Expand Down
4 changes: 4 additions & 0 deletions cpp/ql/lib/change-notes/2026-03-04-remove-aliased-ssa.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: breaking
---
* The aliased SSA was expensive, and had little benefit, so has been removed. The unaliased SSA should be used instead. In most cases it will be imported by default, so no changes will be necessary.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aliased SSA vs unaliased SSA was always an internal name that we never communicated outwards. I'd prefer if we phrased this as something like this:

  • The C/C++ intermediate representation (IR) has been simplified to perform a more lightweight alias analysis. As a result, end-to-end analysis time is dramatically improved.

    A libraries that relied on the expensive IR alias analysis will now be less precise. In particular, the value numbering library (semmle.code.cpp.valuenumbering.GlobalValueNumbering) will identify fewer expressions, and the guards and barrier guards libraries (semmle.code.cpp.controlflow.Guards) will recognize fewer guards.

I would probably also add something to the effect of "We plan to address these in the future" if you actually believe that to be the case. Personally, I would really like the regressions in the guards and barrier guards libraries fixed in the future

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth including "aliased" in there somewhere so people with custom queries that import it and break can find this changenote, or will that not be an issue?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm. I guess it couldn't hurt if you can find a good way to phrase it 😂 I think it would be the first mention of "aliased IR" in a change note, though.

4 changes: 1 addition & 3 deletions cpp/ql/lib/semmle/code/cpp/ir/IR.qll
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,4 @@
* be represented as the `IRType` `uint4`, a four-byte unsigned integer.
*/

// Most queries should operate on the aliased SSA IR, so that's what we expose
// publicly as the "IR".
import implementation.aliased_ssa.IR
import implementation.unaliased_ssa.IR
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By switching the public semmle.code.cpp.ir.IR to import the unaliased SSA implementation, the documentation check now flags missing QLDoc in the unaliased SSA libraries (e.g. IRBlock::IRCfg module and gvn/ValueNumbering file + public member predicates like getDebugString, getKind, getLocation, toString). Please add the required QLDoc blocks in those unaliased SSA files so CI passes (even if it wasn’t previously enforced for the aliased SSA copies).

Copilot uses AI. Check for mistakes.
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/IRConsistency.ql
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@
* @id cpp/ir-consistency-check
*/

import implementation.aliased_ssa.IRConsistency
import implementation.unaliased_ssa.IRConsistency
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/PrintIR.ql
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@
* @kind graph
*/

import implementation.aliased_ssa.PrintIR
import implementation.unaliased_ssa.PrintIR
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/PrintIR.qll
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@
* to dump.
*/

import implementation.aliased_ssa.PrintIR
import implementation.unaliased_ssa.PrintIR
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/ValueNumbering.qll
Original file line number Diff line number Diff line change
@@ -1 +1 @@
import implementation.aliased_ssa.gvn.ValueNumbering
import implementation.unaliased_ssa.gvn.ValueNumbering
Original file line number Diff line number Diff line change
Expand Up @@ -546,8 +546,7 @@ private module Cached {
instr instanceof AliasedDefinitionInstruction or
instr instanceof AliasedUseInstruction or
instr instanceof InitializeNonLocalInstruction or
instr instanceof ReturnIndirectionInstruction or
instr instanceof UninitializedGroupInstruction
instr instanceof ReturnIndirectionInstruction
)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,7 @@ private newtype TMemoryAccessKind =
TPhiMemoryAccess() or
TUnmodeledMemoryAccess() or
TChiTotalMemoryAccess() or
TChiPartialMemoryAccess() or
TGroupedMemoryAccess()
TChiPartialMemoryAccess()

/**
* Describes the set of memory locations memory accessed by a memory operand or
Expand Down Expand Up @@ -100,11 +99,3 @@ class ChiTotalMemoryAccess extends MemoryAccessKind, TChiTotalMemoryAccess {
class ChiPartialMemoryAccess extends MemoryAccessKind, TChiPartialMemoryAccess {
override string toString() { result = "chi(partial)" }
}

/**
* The result of an `UninitializedGroup` instruction, which initializes a set of
* allocations that are each assigned the same virtual variable.
*/
class GroupedMemoryAccess extends MemoryAccessKind, TGroupedMemoryAccess {
override string toString() { result = "group" }
}
12 changes: 0 additions & 12 deletions cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,6 @@ private newtype TOpcode =
TSizedBufferMayWriteSideEffect() or
TInitializeDynamicAllocation() or
TChi() or
TUninitializedGroup() or
TInlineAsm() or
TUnreached() or
TNewObj() or
Expand Down Expand Up @@ -1250,17 +1249,6 @@ module Opcode {
}
}

/**
* The `Opcode` for a `UninitializedGroup`.
*
* See the `UninitializedGroupInstruction` documentation for more details.
*/
class UninitializedGroup extends Opcode, TUninitializedGroup {
final override string toString() { result = "UninitializedGroup" }

override GroupedMemoryAccess getWriteMemoryAccess() { any() }
}

/**
* The `Opcode` for an `InlineAsmInstruction`.
*
Expand Down
92 changes: 0 additions & 92 deletions cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll

This file was deleted.

Loading