From ad5ab9f2704f5f686f2a04e8d63777f3b9735d16 Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Wed, 4 Mar 2026 10:56:51 +0100 Subject: [PATCH 1/2] Gaurds: Improve perf of forall in guardDeterminesPhiInput. --- shared/controlflow/codeql/controlflow/Guards.qll | 3 +++ 1 file changed, 3 insertions(+) diff --git a/shared/controlflow/codeql/controlflow/Guards.qll b/shared/controlflow/codeql/controlflow/Guards.qll index 9a4f65bcd532..9d7147a1bcb9 100644 --- a/shared/controlflow/codeql/controlflow/Guards.qll +++ b/shared/controlflow/codeql/controlflow/Guards.qll @@ -641,6 +641,9 @@ module Make< ) { exists(GuardValue dv, SsaExplicitWrite inp | guardControlsPhiBranch(guard, v, phi, inp) and + // The `forall` below implies that there's only one such `inp` guarded by `guard == v`, + // but checking this upfront improves performance of the `forall` check. + 1 = strictcount(SsaDefinition inp0 | guardControlsPhiBranch(guard, v, phi, inp0)) and inp.getValue() = input and dv = v.getDualValue() and forall(SsaDefinition other | phi.hasInputFromBlock(other, _) and other != inp | From 37a8fc85eb9b85940040d138f9c37666798d555d Mon Sep 17 00:00:00 2001 From: Anders Schack-Mulligen Date: Thu, 5 Mar 2026 11:20:24 +0100 Subject: [PATCH 2/2] Guards: Use unique aggregate. --- shared/controlflow/codeql/controlflow/Guards.qll | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/shared/controlflow/codeql/controlflow/Guards.qll b/shared/controlflow/codeql/controlflow/Guards.qll index 9d7147a1bcb9..e12535b4b328 100644 --- a/shared/controlflow/codeql/controlflow/Guards.qll +++ b/shared/controlflow/codeql/controlflow/Guards.qll @@ -640,10 +640,11 @@ module Make< Guard guard, GuardValue v, SsaPhiDefinition phi, Expr input ) { exists(GuardValue dv, SsaExplicitWrite inp | - guardControlsPhiBranch(guard, v, phi, inp) and - // The `forall` below implies that there's only one such `inp` guarded by `guard == v`, - // but checking this upfront improves performance of the `forall` check. - 1 = strictcount(SsaDefinition inp0 | guardControlsPhiBranch(guard, v, phi, inp0)) and + // The `forall` below implies that there's only one `inp` guarded by + // `guard == v`, but checking this upfront using `unique` as opposed to + // merely stating `guardControlsPhiBranch(guard, v, phi, inp)` improves + // performance of the `forall` check. + inp = unique(SsaDefinition inp0 | guardControlsPhiBranch(guard, v, phi, inp0)) and inp.getValue() = input and dv = v.getDualValue() and forall(SsaDefinition other | phi.hasInputFromBlock(other, _) and other != inp | @@ -744,7 +745,7 @@ module Make< possibleValue(v, false, e, k) and not possibleValue(v, true, e, k) and // there's only one expression with the value `k` - 1 = strictcount(Expr e0 | possibleValue(v, _, e0, k)) and + e = unique(Expr e0 | possibleValue(v, _, e0, k)) and // and `v` has at least two possible values 2 <= strictcount(GuardValue k0 | possibleValue(v, _, _, k0)) }