Merge pull request github#14398 from rdmarsh2/rdmarsh2/swift/autoclosure-cfg

Swift: add CFG for normal autoclosures

Author: Robert Marsh

swift/ql/.generated.list

@@ -0,0 +1,5 @@
+---
+category: minorAnalysis
+---
+
+* The contents of autoclosure function parameters are now included in the control flow graph and data flow libraries.

swift/ql/.gitattributes

@@ -4,7 +4,7 @@ cached
 newtype TControlFlowElement =
   TAstElement(AstNode n) or
   TFuncDeclElement(Function func) { func.hasBody() } or
-  TClosureElement(ExplicitClosureExpr clos) or
+  TClosureElement(ClosureExpr clos) { isNormalAutoClosureOrExplicitClosure(clos) } or
   TPropertyGetterElement(Decl accessor, Expr ref) { isPropertyGetterElement(accessor, ref) } or
   TPropertySetterElement(Accessor accessor, AssignExpr assign) {
     isPropertySetterElement(accessor, assign)
@@ -41,6 +41,15 @@ predicate isPropertyGetterElement(PropertyGetterElement pge, Accessor accessor,
   pge = TPropertyGetterElement(accessor, ref)
 }
 
+predicate isNormalAutoClosureOrExplicitClosure(ClosureExpr clos) {
+  // short-circuiting operators have a `BinaryExpr` as the parent of the `AutoClosureExpr`,
+  // so we exclude them by checking for a `CallExpr`.
+  clos instanceof AutoClosureExpr and
+  exists(CallExpr call | call.getAnArgument().getExpr() = clos)
+  or
+  clos instanceof ExplicitClosureExpr
+}
+
 private predicate hasDirectToImplementationSemantics(Expr e) {
   e.(MemberRefExpr).hasDirectToImplementationSemantics()
   or
@@ -194,14 +203,18 @@ class KeyPathElement extends ControlFlowElement, TKeyPathElement {
   override string toString() { result = expr.toString() }
 }
 
+/**
+ * A control flow element representing a closure in its role as a control flow
+ * scope.
+ */
 class ClosureElement extends ControlFlowElement, TClosureElement {
-  ExplicitClosureExpr expr;
+  ClosureExpr expr;
 
   ClosureElement() { this = TClosureElement(expr) }
 
   override Location getLocation() { result = expr.getLocation() }
 
-  ExplicitClosureExpr getAst() { result = expr }
+  ClosureExpr getAst() { result = expr }
 
   override string toString() { result = expr.toString() }
 }

swift/ql/lib/change-notes/2023-10-06-autoclosure-cfg.md

@@ -67,10 +67,13 @@ module CfgScope {
     final override predicate exit(ControlFlowElement last, Completion c) { last(tree, last, c) }
   }
 
-  private class ClosureExprScope extends Range_ instanceof ExplicitClosureExpr {
+  private class ClosureExprScope extends Range_ instanceof ClosureExpr {
     Exprs::ClosureExprTree tree;
 
-    ClosureExprScope() { tree.getAst() = this }
+    ClosureExprScope() {
+      isNormalAutoClosureOrExplicitClosure(this) and
+      tree.getAst() = this
+    }
 
     final override predicate entry(ControlFlowElement first) { first(tree, first) }
 
@@ -1145,12 +1148,16 @@ module Exprs {
     }
   }
 
+  /**
+   * The control flow for an explicit closure or a normal autoclosure in its
+   * role as a control flow scope.
+   */
   class ClosureExprTree extends StandardPreOrderTree, TClosureElement {
-    ExplicitClosureExpr expr;
+    ClosureExpr expr;
 
     ClosureExprTree() { this = TClosureElement(expr) }
 
-    ExplicitClosureExpr getAst() { result = expr }
+    ClosureExpr getAst() { result = expr }
 
     final override ControlFlowElement getChildElement(int i) {
       result.asAstNode() = expr.getParam(i)

swift/ql/lib/codeql/swift/controlflow/internal/ControlFlowElements.qll

@@ -4,7 +4,8 @@ private import codeql.swift.elements.expr.Expr
 
 /**
  * A Swift autoclosure expression, that is, a closure automatically generated
- * around an argument when the parameter has the `@autoclosure` attribute. For
+ * around an argument when the parameter has the `@autoclosure` attribute or
+ * for the right-hand operand of short-circuiting logical operations. For
  * example, there is an `AutoClosureExpr` around the value `0` in:
  * ```
  * func myFunction(_ expr: @autoclosure () -> Int) {

swift/ql/lib/codeql/swift/controlflow/internal/ControlFlowGraphImpl.qll

@@ -1,4 +1,8 @@
-// generated by codegen/codegen.py, remove this comment if you wish to edit this file
 private import codeql.swift.generated.expr.ExplicitClosureExpr
 
+/**
+ * A Swift explicit closure expr, that is, a closure written using
+ * `{ ... -> ... in ... }` syntax rather than automatically generated by the
+ * compiler.
+ */
 class ExplicitClosureExpr extends Generated::ExplicitClosureExpr { }

swift/ql/lib/codeql/swift/elements/expr/AutoClosureExpr.qll

@@ -3366,6 +3366,24 @@ cfg.swift:
 #  545|       getElse(): [BraceStmt] { ... }
 #  546|         getElement(0): [ReturnStmt] return ...
 #  546|           getResult(): [IntegerLiteralExpr] 0
+#  550| [NamedFunction] usesAutoclosure(_:)
+#  550|     InterfaceType = (@autoclosure () -> Int) -> Int
+#  550|   getParam(0): [ParamDecl] expr
+#  550|       Type = () -> Int
+#  550|   getBody(): [BraceStmt] { ... }
+#  551|     getElement(0): [ReturnStmt] return ...
+#  551|       getResult(): [CallExpr] call to ...
+#  551|         getFunction(): [DeclRefExpr] expr
+#  554| [NamedFunction] autoclosureTest()
+#  554|     InterfaceType = () -> ()
+#  554|   getBody(): [BraceStmt] { ... }
+#  555|     getElement(0): [CallExpr] call to usesAutoclosure(_:)
+#  555|       getFunction(): [DeclRefExpr] usesAutoclosure(_:)
+#  555|       getArgument(0): [Argument] : { ... }
+#  555|         getExpr(): [AutoClosureExpr] { ... }
+#  555|           getBody(): [BraceStmt] { ... }
+#  555|             getElement(0): [ReturnStmt] return ...
+#  555|               getResult(): [IntegerLiteralExpr] 1
 declarations.swift:
 #    1| [StructDecl] Foo
 #    2|   getMember(0): [PatternBindingDecl] var ... = ...

swift/ql/lib/codeql/swift/elements/expr/ExplicitClosureExpr.qll

@@ -546,3 +546,11 @@ func testNilCoalescing2(x: Bool?) -> Int {
     return 0
   }
 }
+
+func usesAutoclosure(_ expr: @autoclosure () -> Int) -> Int {
+  return expr()
+}
+
+func autoclosureTest() {
+  usesAutoclosure(1)
+}

swift/ql/test/library-tests/ast/PrintAst.expected

@@ -6317,3 +6317,63 @@ cfg.swift:
 
 #  546| 0
 #-----|  -> return ...
+
+#  550| enter usesAutoclosure(_:)
+#-----|  -> usesAutoclosure(_:)
+
+#  550| exit usesAutoclosure(_:)
+
+#  550| exit usesAutoclosure(_:) (normal)
+#-----|  -> exit usesAutoclosure(_:)
+
+#  550| usesAutoclosure(_:)
+#-----|  -> expr
+
+#  550| expr
+#-----|  -> expr
+
+#  551| return ...
+#-----| return -> exit usesAutoclosure(_:) (normal)
+
+#  551| expr
+#-----|  -> call to ...
+
+#  551| call to ...
+#-----|  -> return ...
+
+#  554| autoclosureTest()
+#-----|  -> usesAutoclosure(_:)
+
+#  554| enter autoclosureTest()
+#-----|  -> autoclosureTest()
+
+#  554| exit autoclosureTest()
+
+#  554| exit autoclosureTest() (normal)
+#-----|  -> exit autoclosureTest()
+
+#  555| usesAutoclosure(_:)
+#-----|  -> { ... }
+
+#  555| call to usesAutoclosure(_:)
+#-----|  -> exit autoclosureTest() (normal)
+
+#  555| 1
+#-----|  -> return ...
+
+#  555| enter { ... }
+#-----|  -> { ... }
+
+#  555| exit { ... }
+
+#  555| exit { ... } (normal)
+#-----|  -> exit { ... }
+
+#  555| return ...
+#-----|  -> exit { ... } (normal)
+
+#  555| { ... }
+#-----|  -> 1
+
+#  555| { ... }
+#-----|  -> call to usesAutoclosure(_:)