Skip to content

C++: IR: Drop the aliased SSA #21407

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
igfoo wants to merge 32 commits into
base: main
Choose a base branch
from
+10,694 −27,590
Open

C++: IR: Drop the aliased SSA #21407

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
a4456eb
C++: IR: Drop the aliased SSA
igfoo Feb 16, 2026
f7ed2c7
C++: Remove aliased SSA tests
igfoo Feb 16, 2026
dea0704
C++: Use unaliased SSA in constant_func.ql test
igfoo Feb 17, 2026
ea2d3fc
C++: Accept changes in constant_func test
igfoo Feb 18, 2026
12faa37
C++: Update ssa_escape.ql test now we don't have aliased SSA
igfoo Feb 18, 2026
9f7a411
C++: Rename aliased_ir.ql to unaliased_ir.ql
igfoo Feb 18, 2026
7f860a7
C++: Update unaliased_ir.ql to use the unaliased IR
igfoo Feb 18, 2026
bf10623
C++: Accept changes in controlflow/Ssa_Lt following removal of aliase…
igfoo Mar 3, 2026
6decc7f
C++: Accept changes in controlflow/guards following removal of aliase…
igfoo Mar 3, 2026
59ed644
C++: Accept changes in controlflow/guards-ir following removal of ali…
igfoo Mar 3, 2026
3618810
C++: Fix dataflow/dataflow-tests following removal of aliased SSA
igfoo Mar 3, 2026
dbf497e
C++: Fix valuenumbering/GlobalValueNumbering following removal of ali…
igfoo Mar 3, 2026
ba5c078
C++: "Fix" ir/points_to test following removal of aliased SSA
igfoo Mar 3, 2026
8bb7a26
C++: Fix ir/range-analysis test following removal of aliased SSA
igfoo Mar 3, 2026
7d7992a
C++: Remove aliased_ssa_* from ir/ir test following removal of aliase…
igfoo Mar 3, 2026
ef7a1a8
C++: Remove aliased_ssa from config/identical-files.json
igfoo Mar 4, 2026
aefab6d
C++: Fix cpp/ql/src/Metrics/Internal/IRConsistency.ql now aliased SSA…
igfoo Mar 4, 2026
56e1ef5
C++: Accept changes in experimental tests after aliased SSA removal
igfoo Mar 4, 2026
953c1d6
C++: Accept changes in experimental query tests following aliased SSA…
igfoo Mar 4, 2026
18f7e48
C++: Rename aliased_ir test to unaliased_ir
igfoo Mar 4, 2026
9c77bb0
C++: Accept changes in unaliased_ir.ql test
igfoo Mar 4, 2026
b5d871e
C++: Accept changes in BadAdditionOverflowCheck test following aliase…
igfoo Mar 4, 2026
70fd130
C++: Accept changes in StrncpyFlippedArgs test following aliased SSA …
igfoo Mar 4, 2026
cc0773b
C++: Accept changes in RedundantNullCheckSimple test following aliase…
igfoo Mar 4, 2026
979f8b4
C++: Accept changes in OverrunWriteProductFlow test following aliased…
igfoo Mar 4, 2026
8f9f4ca
C++: Accept changes in UncontrolledFormatString test following aliase…
igfoo Mar 4, 2026
2e3c0a0
C++: Fix InvalidPointerToDereference test following aliased SSA removal
igfoo Mar 4, 2026
b2b9a74
C++: Accept changes in CleartextFileWrite test following aliased SSA …
igfoo Mar 4, 2026
ca4f70d
C++: Add changelog entry for removal of aliased SSA.
igfoo Mar 4, 2026
ff80211
C++: Fix typo
igfoo Mar 4, 2026
a83d733
C++: Remove GroupedMemoryLocation
igfoo Mar 4, 2026
0c0ac1d
C++: Remove VariableGroup
igfoo Mar 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
91 changes: 21 additions & 70 deletions config/identical-files.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,136 +25,87 @@
],
"IR Instruction": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll"
],
"IR IRBlock": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll"
],
"IR IRVariable": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll"
],
"IR IRFunction": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll"
],
"IR Operand": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll"
],
"IR IR": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll"
],
"IR IRConsistency": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll"
],
"IR PrintIR": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll"
],
"IR SSAConsistency": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConsistency.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConsistency.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll"
],
"C++ IR InstructionImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/InstructionImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll"
],
"C++ IR IRImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRImports.qll"
],
"C++ IR IRBlockImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRBlockImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRBlockImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll"
],
"C++ IR IRConsistencyImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRConsistencyImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRConsistencyImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRConsistencyImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRConsistencyImports.qll"
],
"C++ IR IRFunctionImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRFunctionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRFunctionImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRFunctionImports.qll"
],
"C++ IR IRVariableImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/IRVariableImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/IRVariableImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll"
],
"C++ IR OperandImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/OperandImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/OperandImports.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/OperandImports.qll"
],
"C++ IR PrintIRImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/PrintIRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintIRImports.qll"
],
"C++ SSA SSAConstructionImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstructionImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstructionImports.qll"
],
"SSA AliasAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll"
],
"SSA PrintAliasAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
],
"C++ SSA AliasAnalysisImports": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
],
"IR SSA SSAConstruction": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll"
],
"IR SSA PrintSSA": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintSSA.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintSSA.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll"
],
"IR ValueNumberInternal": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/internal/ValueNumberingInternal.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/internal/ValueNumberingInternal.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/internal/ValueNumberingInternal.qll"
],
"C++ IR ValueNumber": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll"
],
"C++ IR PrintValueNumbering": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/gvn/PrintValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/PrintValueNumbering.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/PrintValueNumbering.qll"
],
"C++ IR ConstantAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll"
],
"C++ IR PrintConstantAnalysis": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
"cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
"cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll"
],
"C++ IR ReachableBlock": [
"cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
Expand Down
4 changes: 4 additions & 0 deletions cpp/ql/lib/change-notes/2026-03-04-remove-aliased-ssa.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: breaking
---
* The aliased SSA was expensive, and had little benefit, so has been removed. The unaliased SSA should be used instead. In most cases it will be imported by default, so no changes will be necessary.
Copy link
Contributor

@MathiasVP MathiasVP Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Aliased SSA vs unaliased SSA was always an internal name that we never communicated outwards. I'd prefer if we phrased this as something like this:

  • The C/C++ intermediate representation (IR) has been simplified to perform a more lightweight alias analysis. As a result, end-to-end analysis time is dramatically improved.

    A libraries that relied on the expensive IR alias analysis will now be less precise. In particular, the value numbering library (semmle.code.cpp.valuenumbering.GlobalValueNumbering) will identify fewer expressions, and the guards and barrier guards libraries (semmle.code.cpp.controlflow.Guards) will recognize fewer guards.

I would probably also add something to the effect of "We plan to address these in the future" if you actually believe that to be the case. Personally, I would really like the regressions in the guards and barrier guards libraries fixed in the future

Copy link
Member Author

@igfoo igfoo Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it worth including "aliased" in there somewhere so people with custom queries that import it and break can find this changenote, or will that not be an issue?

Copy link
Contributor

@MathiasVP MathiasVP Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm. I guess it couldn't hurt if you can find a good way to phrase it 😂 I think it would be the first mention of "aliased IR" in a change note, though.

4 changes: 1 addition & 3 deletions cpp/ql/lib/semmle/code/cpp/ir/IR.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,4 @@
* be represented as the `IRType` `uint4`, a four-byte unsigned integer.
*/

// Most queries should operate on the aliased SSA IR, so that's what we expose
// publicly as the "IR".
import implementation.aliased_ssa.IR
import implementation.unaliased_ssa.IR
Copy link

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By switching the public semmle.code.cpp.ir.IR to import the unaliased SSA implementation, the documentation check now flags missing QLDoc in the unaliased SSA libraries (e.g. IRBlock::IRCfg module and gvn/ValueNumbering file + public member predicates like getDebugString, getKind, getLocation, toString). Please add the required QLDoc blocks in those unaliased SSA files so CI passes (even if it wasn’t previously enforced for the aliased SSA copies).

Copilot uses AI. Check for mistakes.
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/IRConsistency.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@
* @id cpp/ir-consistency-check
*/

import implementation.aliased_ssa.IRConsistency
import implementation.unaliased_ssa.IRConsistency
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/PrintIR.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@
* @kind graph
*/

import implementation.aliased_ssa.PrintIR
import implementation.unaliased_ssa.PrintIR
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/PrintIR.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@
* to dump.
*/

import implementation.aliased_ssa.PrintIR
import implementation.unaliased_ssa.PrintIR
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/ir/ValueNumbering.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
import implementation.aliased_ssa.gvn.ValueNumbering
import implementation.unaliased_ssa.gvn.ValueNumbering
3 changes: 1 addition & 2 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,7 @@ predicate ignoreInstruction(Instruction instr) {
instr instanceof AliasedDefinitionInstruction or
instr instanceof AliasedUseInstruction or
instr instanceof InitializeNonLocalInstruction or
instr instanceof ReturnIndirectionInstruction or
instr instanceof UninitializedGroupInstruction
instr instanceof ReturnIndirectionInstruction
)
}

Expand Down
11 changes: 0 additions & 11 deletions cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1250,17 +1250,6 @@ module Opcode {
}
}

/**
* The `Opcode` for a `UninitializedGroup`.
*
* See the `UninitializedGroupInstruction` documentation for more details.
*/
class UninitializedGroup extends Opcode, TUninitializedGroup {
final override string toString() { result = "UninitializedGroup" }

override GroupedMemoryAccess getWriteMemoryAccess() { any() }
}

/**
* The `Opcode` for an `InlineAsmInstruction`.
*
Expand Down
92 changes: 0 additions & 92 deletions cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll
View file
Open in desktop

This file was deleted.

Loading