Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JavaScript: Add flow tracking through nested properties. #90

Closed
wants to merge 3 commits into from

Conversation

xiemaisi
Copy link

The technical meat is in the first commit, the second one is a (somewhat performance-motivated) refactoring, the third is a pure performance refactoring.

No new alerts on the default benchmarks, and only moderate performance cost, except on esprima (11s = 6%), goojs (67s = 9%) and expressCart (12s = 12.5%); full numbers here (internal link).

There is no particular rush to get this in now (or even at all), I just wanted to put it up since I had a branch anyway and the performance more or less works out.

Max Schaefer added 3 commits August 22, 2018 15:00
@xiemaisi xiemaisi added the JS label Aug 22, 2018
@xiemaisi xiemaisi requested a review from a team as a code owner August 22, 2018 14:07
Copy link
Contributor

@asger-semmle asger-semmle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have some initial comments and questions, but I'm not all the way through yet.

I was a little surprised to see loadLoadPair in there. It seems awfully expensive (see my comment below). I'd much rather have flow through access paths and avoid building the expensive all-pairs relation.

* let base = root.innerProp;
* base.outerProp = rhs;
* let succ = root.innerProp;
* ```
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... such that the path from rhs to succ is summarized by summary.

This part was a bit confusing (in the otherwise light and enjoyable prose).

If I understand it correctly now, this predicate "defines" that there is an edge from rhs to succ, is that right? The "such that" seems to imply a condition that must be satisfied for the predicate to hold, but it's really the other way around; the edge is there because this predicate says so.

I think it would clarify things to talk separately about the edge defined by the predicate, and those it uses to generate it.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right; this needs to be documented better.

/**
* Holds if `load` is a read of some property `innerProp` from which we can reach a read `succ` of the same
* property `innerProp` under configuration `cfg`, and the concatenation of `oldSummary` with the summary
* of that path is `summary`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was quite confusing for the same reason as the above, because in the example nothing appears to be reachable from load.

reachableFromLoadBase(innerProp, load, nd, cfg, newSummary) and
loadStep(nd, succ, innerProp) and
summary = oldSummary.append(newSummary)
)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand why we have two PathSummary arguments. oldSummary is almost not bound at all; it's just anything that can be prefixed onto newSummary to yield summary.

It seems like the summary of this edge is a pair of input/output summaries, instead of just being a summary. I mean that's what PathSummary is for, right?

Apart from that, is it correctly understood that we would get N^2 load-load pairs for code like this?

elm.style.color = X;
elm.style.backgroundColor = X;
elm.style.border = X;
elm.style.padding = X;
...

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's a bad case with the current implementation.

Adding oldSummary as an argument to this predicate is mostly done to enable a better join order in nestedPropFlow.

@xiemaisi xiemaisi added the WIP This is a work-in-progress, do not merge yet! label Aug 23, 2018
@xiemaisi
Copy link
Author

Thanks for your initial comments. As you rightly point out, the approach taken in this PR, while simple, is prone to blow-up in certain cases. I think we should try out the access path-based approach you outlined before for comparison.

Anyway, I've marked this as WIP for now to prevent a premature merge.

@xiemaisi xiemaisi closed this Feb 25, 2019
smowton pushed a commit to smowton/codeql that referenced this pull request Dec 6, 2021
Kotlin: Add TrapWriter.writeComment
dbartol pushed a commit that referenced this pull request Dec 18, 2024
Add new sources and summary steps
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
JS WIP This is a work-in-progress, do not merge yet!
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants