Python: Make a few more expressions point-to the 'unknown' value to improve reachability by about 1%.

markshannon · markshannon · commit c2f918928641 · 2019-08-08T12:01:41.000+01:00
diff --git a/python/ql/src/semmle/python/pointsto/PointsTo.qll b/python/ql/src/semmle/python/pointsto/PointsTo.qll
@@ -1390,6 +1390,14 @@ module Expressions {
         )
     }
 
+    pragma [noinline]
+    private boolean comparesToUnknown(CompareNode comp, PointsToContext context, ControlFlowNode operand, ObjectInternal opvalue) {
+        (comp.operands(operand, _, _) or comp.operands(_, _, operand)) and
+        PointsToInternal::pointsTo(operand, context, opvalue, _) and
+        opvalue = ObjectInternal::unknown() and
+        result = maybe()
+    }
+
     pragma [noinline]
     private predicate equalityTest(CompareNode comp, PointsToContext context, ControlFlowNode operand, ObjectInternal opvalue, ObjectInternal other, boolean sense) {
         exists(ControlFlowNode r |
@@ -1520,6 +1528,8 @@ module Expressions {
         or
         result = containsComparisonEvaluatesTo(expr, context, subexpr, subvalue)
         or
+        result = comparesToUnknown(expr, context, subexpr, subvalue)
+        or
         result = isinstanceEvaluatesTo(expr, context, subexpr, subvalue)
         or
         result = issubclassEvaluatesTo(expr, context, subexpr, subvalue)
diff --git a/python/ql/test/query-tests/analysis/pointsto/Pruned.expected b/python/ql/test/query-tests/analysis/pointsto/Pruned.expected
@@ -1 +1 @@
-| 1189 |
+| 1185 |
