codeql icon indicating copy to clipboard operation
codeql copied to clipboard

Data flow: Store/load matching in pruning stage 3

Open hvitved opened this issue 1 year ago • 1 comments

Example tuple counts

C#: HardCodedCredentials.ql on mono

Before
# n stage nodes fields conscand states tuples calledges tfnodes tftuples
1 10 1 Fwd 3,498,701 41,634 -1 1 4,985,909 -1 -1 -1
2 15 1 Rev 1,988,816 32,443 -1 1 3,015,751 1,927,923 -1 -1
3 20 2 Fwd 1,227,365 14,291 17,410 1 2,377,149 999,216 0 0
4 25 2 Rev 816,624 9,731 11,168 1 1,155,022 368,049 0 0
5 30 3 Fwd 445,018 6,897 26,750 1 3,140,440 293,820 44,062 471,082
6 35 3 Rev 984 45 55 1 1,231 1,194 617 634
7 40 4 Fwd 95 4 5 1 105 30 0 0
8 45 4 Rev 95 4 5 1 99 30 0 0
9 50 5 Fwd 95 4 5 1 143 30 0 0
10 55 5 Rev 95 4 5 1 129 30 0 0
11 60 6 Fwd 95 4 5 1 136 30 0 0
12 65 6 Rev 95 4 5 1 129 30 0 0
After
# n stage nodes fields conscand states tuples calledges tfnodes tftuples
1 10 1 Fwd 3,498,701 41,634 -1 1 4,985,909 -1 -1 -1
2 15 1 Rev 1,988,816 32,443 -1 1 3,015,751 1,927,923 -1 -1
3 20 2 Fwd 1,227,365 14,291 17,410 1 2,377,149 999,216 0 0
4 25 2 Rev 816,624 9,731 11,168 1 1,155,022 368,049 0 0
5 30 3 Fwd 365,688 4,669 14,873 1 1,781,588 246,743 40,080 312,192
6 35 3 Rev 507 17 24 1 609 168 491 500
7 40 4 Fwd 95 4 5 1 105 30 0 0
8 45 4 Rev 95 4 5 1 99 30 0 0
9 50 5 Fwd 95 4 5 1 143 30 0 0
10 55 5 Rev 95 4 5 1 129 30 0 0
11 60 6 Fwd 95 4 5 1 136 30 0 0
12 65 6 Rev 95 4 5 1 129 30 0 0

Javascript: InsecureRandomness.ql on microsoft_vscode

Before
# n stage nodes fields conscand states tuples calledges tfnodes tftuples
1 10 1 Fwd 862,069 11,800 -1 1 1,116,618 -1 -1 -1
2 15 1 Rev 351,604 9,837 -1 1 476,835 77,147 -1 -1
3 20 2 Fwd 132,188 3,784 5,140 1 278,795 35,111 0 0
4 25 2 Rev 96,795 3,001 4,099 1 158,086 25,646 0 0
5 30 3 Fwd 86,505 2,789 5,741 1 319,508 24,224 84 1,179
6 35 3 Rev 80,912 2,649 3,987 1 164,567 22,598 76 1,024
7 40 4 Fwd 68,557 1,808 147,485 1 147,992,833 20,336 74 1,108
8 45 4 Rev 52,732 1,472 96,188 1 27,297,733 15,697 66 904
9 50 5 Fwd 2,218 37 65 1 3,365 962 4 12
10 55 5 Rev 96 2 2 1 96 61 0 0
11 60 6 Fwd 96 2 3 1 116 -1 -1 -1
12 65 6 Rev 84 2 3 1 84 -1 -1 -1
After
# n stage nodes fields conscand states tuples calledges tfnodes tftuples
1 10 1 Fwd 862,069 11,800 -1 1 1,116,618 -1 -1 -1
2 15 1 Rev 351,604 9,837 -1 1 476,835 77,147 -1 -1
3 20 2 Fwd 132,188 3,784 5,140 1 278,795 35,111 0 0
4 25 2 Rev 96,795 3,001 4,099 1 158,086 25,646 0 0
5 30 3 Fwd 21,495 373 568 1 42,953 6,513 48 116
6 35 3 Rev 7,315 197 259 1 9,942 2,426 26 64
7 40 4 Fwd 4,475 114 366 1 11,854 1,469 12 32
8 45 4 Rev 4,026 106 190 1 6,632 1,297 12 32
9 50 5 Fwd 351 16 18 1 421 120 0 0
10 55 5 Rev 96 2 2 1 96 61 0 0
11 60 6 Fwd 96 2 3 1 116 -1 -1 -1
12 65 6 Rev 84 2 3 1 84 -1 -1 -1

hvitved avatar Jun 12 '24 14:06 hvitved

This looks very promising for the JS data flow migration. 🎉 It fixes the four largest regressions we had so far. See DCA run showing the effects of cherry-picking this PR on top of the JS data flow migration branch.

asgerf avatar Aug 05 '24 13:08 asgerf