Module IR
Provides classes that describe the Intermediate Representation (IR) of the program.
The IR is a representation of the semantics of the program, with very little dependence on the
syntax that was used to write the program. For example, in C++, the statements i += 1;
, i++
,
and ++i
all have the same semantic effect, but appear in the AST as three different types of
Expr
node. In the IR, all three statements are broken down into a sequence of fundamental
operations similar to:
r1(int*) = VariableAddress[i] // Compute the address of variable `i`
r2(int) = Load &:r1, m0 // Load the value of `i`
r3(int) = Constant[1] // An integer constant with the value `1`
r4(int) = Add r2, r3 // Add `1` to the value of `i`
r5(int) = Store &r1, r4 // Store the new value back into the variable `i`
This allows IR-based analysis to focus on the fundamental operations, rather than having to be concerned with the various ways of expressing those operations in source code.
The key classes in the IR are:
IRFunction
- Contains the IR for an entire function definition, including all of that function’sInstruction
s,IRBlock
s, andIRVariables
.Instruction
- A single operation in the IR. An instruction specifies the operation to be performed, the operands that produce the inputs to that operation, and the type of the result of the operation. Control flows from anInstruction
to one of a set of successorInstruction
s.Operand
- An input value of anInstruction
. All inputs of anInstruction
are explicitly represented asOperand
s, even if the input was implicit in the source code. AnOperand
has a link to theInstruction
that consumes its value (its “use”) and a link to theInstruction
that produces its value (its “definition”).IRVariable
- A variable accessed by the IR for a particular function. AnIRVariable
is created for each variable directly accessed by the function. In addition,IRVariable
s are created to represent certain temporary storage locations that do not have explicitly declared variables in the source code, such as the return value of the function.IRBlock
- A “basic block” in the control flow graph of a function. AnIRBlock
contains a sequence of instructions such that control flow can only enter the block at the first instruction, and can only leave the block from the last instruction.IRType
- The type of a value accessed in the IR. Unlike theType
class in the AST,IRType
is language-neutral. For example, in C++,unsigned int
,char32_t
, andwchar_t
might all be represented as theIRType
uint4
, a four-byte unsigned integer.
Import path
import semmle.code.cpp.ir.IR
Classes
AddInstruction | An instruction that computes the sum of two numeric operands. |
AddressOperand | The address operand of an instruction that loads or stores a value from memory (e.g. |
AliasedDefinitionInstruction | An instruction that initializes all escaped memory. |
AliasedUseInstruction | An instruction that consumes all escaped memory on exit from the function. |
ArgumentOperand | An operand representing an argument to a function call. This includes both positional arguments (represented by |
ArithmeticInstruction | An instruction that computes the result of an arithmetic operation. |
ArithmeticOpcode | The |
BinaryArithmeticInstruction | An instruction that performs an arithmetic operation on two numeric operands. |
BinaryArithmeticOpcode | The |
BinaryBitwiseInstruction | An instruction that performs a bitwise operation on two integer operands. |
BinaryBitwiseOpcode | The |
BinaryInstruction | An instruction whose result is computed from two operands. |
BinaryOpcode | The |
BitAndInstruction | An instruction that computes the bitwise “and” of two integer operands. |
BitComplementInstruction | An instruction that computes the bitwise complement of its operand. |
BitOrInstruction | An instruction that computes the bitwise “or” of two integer operands. |
BitXorInstruction | An instruction that computes the bitwise “xor” of two integer operands. |
BitwiseInstruction | An instruction that computes the result of a bitwise operation. |
BitwiseOpcode | The |
BufferAccessOpcode | An opcode that accesses a memory buffer. |
BufferMayWriteSideEffectInstruction | An instruction representing the write of an indirect buffer parameter within a function call. |
BufferMemoryAccess | The operand or result accesses memory starting at the address specified by the |
BufferMustWriteSideEffectInstruction | An instruction representing the write of an indirect buffer parameter within a function call. The entire buffer is overwritten. |
BufferReadSideEffectInstruction | An instruction representing the read of an indirect buffer parameter within a function call. |
BufferSizeOperand | The buffer size operand of an instruction that represents a read or write of a buffer. |
BuiltInInstruction | An instruction representing a built-in operation that does not have a specific opcode. The actual operation is specified by the |
BuiltInOperationInstruction | An instruction representing a built-in operation. |
BuiltInOperationOpcode | The |
CallInstruction | An instruction that calls a function. |
CallReadSideEffectInstruction | An instruction representing the side effect of a function call on any memory that might be read by that call. |
CallSideEffectInstruction | An instruction representing the side effect of a function call on any memory that might be accessed by that call. |
CallTargetOperand | The operand representing the target function of an |
CaseEdge | A “case” edge, representing the successor of a |
CatchAnyInstruction | An instruction that catches any exception. |
CatchByTypeInstruction | An instruction that catches an exception of a specific type. |
CatchInstruction | An instruction that starts a |
CatchOpcode | The |
CheckedConvertOrNullInstruction | An instruction that converts the address of a polymorphic object to the address of a different subobject of the same polymorphic object, returning a null address if the dynamic type of the object is not compatible with the result type. |
CheckedConvertOrThrowInstruction | An instruction that converts the address of a polymorphic object to the address of a different subobject of the same polymorphic object, throwing an exception if the dynamic type of the object is not compatible with the result type. |
ChiInstruction | An instruction representing the effect that a write to a memory may have on potential aliases of that memory. |
ChiPartialMemoryAccess | The operand is a ChiPartial operand, which accesses the same memory as its definition. |
ChiPartialOperand | The partial operand of a Chi node, representing the value being written to part of the memory. |
ChiTotalMemoryAccess | The operand is a ChiTotal operand, which accesses the same memory as its definition. |
ChiTotalOperand | The total operand of a Chi node, representing the previous value of the memory. |
CompareEQInstruction | An instruction that returns a |
CompareGEInstruction | An instruction that returns a |
CompareGTInstruction | An instruction that returns a |
CompareInstruction | An instruction that compares two numeric operands. |
CompareLEInstruction | An instruction that returns a |
CompareLTInstruction | An instruction that returns a |
CompareNEInstruction | An instruction that returns a |
CompareOpcode | The |
CompleteObjectAddressInstruction | An instruction that returns the address of the complete object that contains the subobject pointed to by its operand. |
ConditionOperand | The condition operand of a |
ConditionalBranchInstruction | An instruction that branches to one of two successor instructions based on the value of a Boolean operand. |
ConstantInstruction | An instruction whose result is a constant value. |
ConstantValueInstruction | An instruction whose result is a compile-time constant value. |
ConvertInstruction | An instruction that converts the value of its operand to a value of a different type. |
ConvertToBaseInstruction | An instruction that converts from the address of a derived class to the address of a base class. |
ConvertToBaseOpcode | The |
ConvertToDerivedInstruction | An instruction that converts from the address of a base class to the address of a direct non-virtual derived class. |
ConvertToNonVirtualBaseInstruction | An instruction that converts from the address of a derived class to the address of a direct non-virtual base class. |
ConvertToVirtualBaseInstruction | An instruction that converts from the address of a derived class to the address of a virtual base class. |
CopyInstruction | An instruction that returns a copy of its operand. |
CopyOpcode | The |
CopyValueInstruction | An instruction that returns a register result containing a copy of its register operand. |
DefaultEdge | A “default” edge, representing the successor of a |
DivInstruction | An instruction that computes the quotient of two numeric operands. |
EdgeKind | Represents the kind of an edge in the IR control flow graph. Each |
ElementsAddressInstruction | An instruction that computes the address of the first element of a managed array. |
EnterFunctionInstruction | An instruction representing the entry point to a function. |
EntireAllocationAccessOpcode | An opcode that access an entire memory allocation. |
EntireAllocationMemoryAccess | The operand or results accesses all memory in the contiguous allocation that contains the address specified by the |
EntireAllocationReadOpcode | An opcode that reads from an entire memory allocation. |
EntireAllocationWriteOpcode | An opcode that write to an entire memory allocation. |
ErrorInstruction | An instruction that produces a well-defined but unknown result and has unknown side effects, including side effects that are not conservatively modeled in the SSA graph. |
EscapedMemoryAccess | The operand or result accesses all memory whose address has escaped. |
EscapedReadOpcode | An opcode that might read from any escaped memory location. |
EscapedWriteOpcode | An opcode that might write to any escaped memory location. |
ExceptionEdge | An “exception” edge, representing the successor of an instruction when that instruction’s evaluation throws an exception. |
ExitFunctionInstruction | An instruction representing the exit point of a function. |
FalseEdge | A “false” edge, representing the successor of a conditional branch when the condition is zero. |
FieldAddressInstruction | An instruction that computes the address of a non-static field of an object. |
FieldInstruction | An instruction that refers to a field of a class, struct, or union. |
FloatConstantInstruction | An instruction whose result is a constant value of floating-point type. |
FunctionAddressInstruction | An instruction that returns the address of a function. |
FunctionInstruction | An instruction that refers to a function. |
GotoEdge | A “goto” edge, representing the unconditional successor of an |
GroupedMemoryAccess | The result of an |
IRAddressType | An address type, representing the memory address of data. Used to represent pointers, references, and lvalues, include those that are garbage collected. |
IRAutomaticUserVariable | A user-declared variable that is allocated on the stack. This includes all parameters and non-static local variables. |
IRAutomaticVariable | A variable (user-declared or temporary) that is allocated on the stack. This includes all parameters, non-static local variables, and temporary variables. |
IRBlock | A basic block with additional information about its predecessor and successor edges. Each edge corresponds to the control flow between the last instruction of one block and the first instruction of another block. |
IRBlockBase | A basic block in the IR. A basic block consists of a sequence of |
IRBooleanType | A Boolean type, which can hold the values |
IRDynamicInitializationFlag | A variable generated to track whether a specific non-stack variable has been initialized. This is used to model the runtime initialization of static local variables in C++, as well as static fields in C#. |
IREllipsisVariable | A temporary variable generated to hold the contents of all arguments passed to the |
IRErrorType | An error type. Used when an error in the source code prevents the extractor from determining the proper type. |
IRFloatingPointType | A floating-point type. |
IRFunction | The IR for a function. |
IRFunctionAddressType | An address type, representing the memory address of code. Used to represent function pointers, function references, and the target of a direct function call. |
IRFunctionBase | The IR for a function. This base class contains only the predicates that are the same between all phases of the IR. Each instantiation of |
IRGeneratedVariable | A variable that is not user-declared. This includes temporary variables generated as part of IR construction, as well as string literals. |
IRIntegerType | An integer type. This includes |
IRNumericType | A numeric type. This includes |
IROpaqueType | A type with known size that does not fit any of the other kinds of type. Used to represent classes, structs, unions, fixed-size arrays, pointers-to-member, and more. |
IRParameter | An IR variable which acts like a function parameter, including positional parameters and the temporary variables generated for |
IRPositionalParameter | An IR variable representing a positional parameter. |
IRPropertyProvider | A class that provides additional properties to be dumped for IR instructions and blocks when using the PrintIR module. Libraries that compute additional facts about IR elements can extend the single instance of this class to specify the additional properties computed by the library. |
IRReturnVariable | A temporary variable generated to hold the return value of a function. |
IRSignedIntegerType | A signed two’s-complement integer. Also used to represent enums whose underlying type is a signed integer, as well as character types whose representation is signed. |
IRStaticUserVariable | A user-declared variable that is not allocated on the stack. This includes all global variables, namespace-scope variables, static fields, and static local variables. |
IRStringLiteral | A variable generated to represent the contents of a string literal. This variable acts much like a read-only global variable. |
IRTempVariable | A temporary variable introduced by IR construction. The most common examples are the variable generated to hold the return value of a function, or the variable generated to hold the result of a condition operator ( |
IRThisVariable | A temporary variable generated to hold the |
IRThrowVariable | A temporary variable generated to hold the exception thrown by a |
IRType | The language-neutral type of an IR |
IRUnknownType | An unknown type. Generally used to represent results and operands that access an unknown set of memory locations, such as the side effects of a function call. |
IRUnsignedIntegerType | An unsigned two’s-complement integer. Also used to represent enums whose underlying type is an unsigned integer, as well as character types whose representation is unsigned. |
IRUserVariable | A user-declared variable referenced by the IR for a function. |
IRVariable | A variable referenced by the IR for a function. |
IRVoidType | A void type, which has no values. Used to represent the result type of an instruction that does not produce a result. |
IndexedInstruction | An instruction that refers to an argument of a |
IndirectMayWriteSideEffectInstruction | An instruction representing the potential write of an indirect parameter within a function call. |
IndirectMemoryAccess | The operand or result accesses memory at the address specified by the |
IndirectMemoryAccessOpcode | An opcode that accesses a single memory location via an |
IndirectMustWriteSideEffectInstruction | An instruction representing the write of an indirect parameter within a function call. |
IndirectReadOpcode | An opcode that reads from a single memory location via an |
IndirectReadSideEffectInstruction | An instruction representing the read of an indirect parameter within a function call. |
IndirectWriteOpcode | An opcode that writes to a single memory location via an |
InheritanceConversionInstruction | An instruction that converts the address of an object to the address of a different subobject of the same object, without any type checking at runtime. |
InitializeDynamicAllocationInstruction | An instruction representing the initial value of newly allocated memory, such as the result of a call to |
InitializeIndirectionInstruction | An instruction that initializes the memory pointed to by a parameter of the enclosing function with the value of that memory on entry to the function. |
InitializeNonLocalInstruction | An instruction that initializes all memory that existed before this function was called. |
InitializeParameterInstruction | An instruction that initializes a parameter of the enclosing function with the value of the corresponding argument passed by the caller. |
InitializeThisInstruction | An instruction that initializes the |
InlineAsmInstruction | An instruction representing a GNU or MSVC inline assembly statement. |
Instruction | A single instruction in the IR. |
IntegerConstantInstruction | An instruction whose result is a constant value of integer or Boolean type. |
LeftOperand | The left operand of a binary instruction (e.g. |
LoadInstruction | An instruction that returns a register result containing a copy of its memory operand. |
LoadOperand | The source value operand of an instruction that loads a value from memory (e.g. |
LogicalNotInstruction | An instruction that computes the logical complement of its operand. |
MayReadOpcode | An opcode whose read memory access is a |
MayWriteOpcode | An opcode whose write memory access is a |
MemoryAccessKind | Describes the set of memory locations memory accessed by a memory operand or memory result. |
MemoryOperand | An operand that consumes a memory result (e.g. the |
MulInstruction | An instruction that computes the product of two numeric operands. |
NegateInstruction | An instruction that negates a single numeric operand. |
NewObjInstruction | An instruction that allocates a new object on the managed heap. |
NextVarArgInstruction | An instruction that modifies a |
NoOpInstruction | An instruction that has no effect. |
NonLocalMemoryAccess | The operand or result access all memory whose address has escaped, other than data on the stack frame of the current function. |
NonPhiMemoryOperand | A memory operand other than the operand of a |
NonPhiOperand | An operand that is not an operand of a |
Opcode | An opcode that specifies the operation performed by an |
OpcodeWithLoad | An opcode that reads a value from memory. |
Operand | An operand of an |
PhiInputOperand | An operand of a |
PhiInstruction | An instruction representing the choice of one of multiple input values based on control flow. |
PhiMemoryAccess | The operand is a Phi operand, which accesses the same memory as its definition. |
PointerAddInstruction | An instruction that adds an integer offset to a pointer. |
PointerArithmeticInstruction | An instruction that performs a binary arithmetic operation involving at least one pointer operand. |
PointerArithmeticOpcode | The |
PointerConstantInstruction | An instruction whose result is a constant value of a pointer type. |
PointerDiffInstruction | An instruction that computes the difference between two pointers. |
PointerOffsetInstruction | An instruction that adds or subtracts an integer offset from a pointer. |
PointerOffsetOpcode | The |
PointerSubInstruction | An instruction that subtracts an integer offset from a pointer. |
PositionalArgumentOperand | An operand representing an argument to a function call. |
ReThrowInstruction | An instruction that re-throws the current exception. |
ReadSideEffectInstruction | An instruction representing a read side effect of a function call on a specific parameter. |
ReadSideEffectOpcode | The |
RegisterOperand | An operand that consumes a register (non-memory) result. |
RelationalInstruction | An instruction that does a relative comparison of two values, such as |
RelationalOpcode | The |
RemInstruction | An instruction that computes the remainder of two integer operands. |
ReturnIndirectionInstruction | An instruction that represents the use of the value pointed to by a parameter of the function after the function returns control to its caller. |
ReturnInstruction | An instruction that returns control to the caller of the function. |
ReturnOpcode | The |
ReturnValueInstruction | An instruction that returns control to the caller of the function, including a return value. |
ReturnVoidInstruction | An instruction that returns control to the caller of the function, without returning a value. |
RightOperand | The right operand of a binary instruction (e.g. |
ShiftLeftInstruction | An instruction that shifts its left operand to the left by the number of bits specified by its right operand. |
ShiftRightInstruction | An instruction that shifts its left operand to the right by the number of bits specified by its right operand. |
SideEffectInstruction | An instruction representing a side effect of a function call. |
SideEffectOpcode | The |
SideEffectOperand | An operand representing memory read as a side effect of evaluating another instruction. |
SizedBufferAccessOpcode | An opcode that accesses a memory buffer whose size is determined by a |
SizedBufferMayWriteSideEffectInstruction | An instruction representing the write of an indirect buffer parameter within a function call. |
SizedBufferMustWriteSideEffectInstruction | An instruction representing the write of an indirect buffer parameter within a function call. The entire buffer is overwritten. |
SizedBufferReadOpcode | An opcode that reads from a memory buffer whose size is determined by a |
SizedBufferReadSideEffectInstruction | An instruction representing the read of an indirect buffer parameter within a function call. |
SizedBufferWriteOpcode | An opcode that writes to a memory buffer whose size is determined by a |
StoreInstruction | An instruction that returns a memory result containing a copy of its register operand. |
StoreValueOperand | The source value operand of a |
StringConstantInstruction | An instruction whose result is the address of a string literal. |
SubInstruction | An instruction that computes the difference of two numeric operands. |
SwitchInstruction | An instruction that branches to one of multiple successor instructions based on the value of an integer operand. |
TempVariableTag | A reason that a particular IR temporary variable was generated. For example, it could be generated to hold the return value of a function, or to hold the result of a |
ThisArgumentOperand | An operand representing the implicit |
ThrowInstruction | An instruction that throws an exception. |
ThrowOpcode | The |
ThrowValueInstruction | An instruction that throws a new exception. |
TrueEdge | A “true” edge, representing the successor of a conditional branch when the condition is non-zero. |
TypedOperand | A memory operand whose type may be different from the type of the result of its definition. |
UnaryArithmeticInstruction | An instruction whose result is computed by performing an arithmetic operation on a single numeric operand. |
UnaryArithmeticOpcode | The |
UnaryBitwiseInstruction | An instruction that performs a bitwise operation on a single integer operand. |
UnaryBitwiseOpcode | The |
UnaryInstruction | An instruction whose result is computed from a single operand. |
UnaryOpcode | The |
UnaryOperand | The sole operand of a unary instruction (e.g. |
UninitializedGroupInstruction | An instruction that initializes a set of allocations that are each assigned the same “virtual variable”. |
UninitializedInstruction | An instruction that returns an uninitialized value. |
UnreachedInstruction | An instruction representing unreachable code. |
UnsignedShiftRightInstruction | An instruction that shifts its left operand to the right by the number of bits specified by its right operand. |
UnsizedBufferAccessOpcode | An opcode that accesses a memory buffer of unknown size. |
UnsizedBufferReadOpcode | An opcode that reads from a memory buffer of unknown size. |
UnsizedBufferWriteOpcode | An opcode that writes to a memory buffer of unknown size. |
UnwindInstruction | An instruction that exits the current function by propagating an exception. |
VarArgInstruction | An instruction that returns the address of the argument currently pointed to by a |
VarArgsEndInstruction | An instruction that cleans up a |
VarArgsStartInstruction | An instruction that returns a |
VariableAddressInstruction | An instruction that returns the address of a variable. |
VariableInstruction | An instruction that refers to a variable. |
VirtualDeleteFunctionAddressInstruction | An instruction that returns the address of a “virtual” delete function. |
WriteSideEffectInstruction | An instruction representing a write side effect of a function call on a specific parameter. |
WriteSideEffectOpcode | The |
Modules
EdgeKind | Predicates to access the single instance of each |
IRTypeConsistency | INTERNAL: Do not use. Query predicates used to check invariants that should hold for all |
Opcode | Provides |