@@ -184,24 +184,46 @@ private class ArrayContent extends Content, TArrayContent {
184184 override string toString ( ) { result = "array" }
185185}
186186
187+ private predicate storeStepNoChi ( Node node1 , Content f , PostUpdateNode node2 ) {
188+ exists ( FieldAddressInstruction fa , StoreInstruction store |
189+ store = node2 .asInstruction ( ) and
190+ store .getDestinationAddress ( ) = fa and
191+ store .getSourceValue ( ) = node1 .asInstruction ( ) and
192+ f .( FieldContent ) .getField ( ) = fa .getField ( )
193+ )
194+ }
195+
196+ private predicate storeStepChi ( Node node1 , Content f , PostUpdateNode node2 ) {
197+ exists ( FieldAddressInstruction fa , StoreInstruction store |
198+ node1 .asInstruction ( ) = store and
199+ store .getDestinationAddress ( ) = fa and
200+ node2 .asInstruction ( ) .( ChiInstruction ) .getPartial ( ) = store and
201+ f .( FieldContent ) .getField ( ) = fa .getField ( )
202+ )
203+ }
204+
187205/**
188206 * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
189207 * Thus, `node2` references an object with a field `f` that contains the
190208 * value of `node1`.
191209 */
192- predicate storeStep ( Node node1 , Content f , StoreStepNode node2 ) {
193- node2 . getStoredValue ( ) = node1 and
194- f . ( FieldContent ) . getField ( ) = node2 . getAField ( )
210+ predicate storeStep ( Node node1 , Content f , PostUpdateNode node2 ) {
211+ storeStepNoChi ( node1 , f , node2 ) or
212+ storeStepChi ( node1 , f , node2 )
195213}
196214
197215/**
198216 * Holds if data can flow from `node1` to `node2` via a read of `f`.
199217 * Thus, `node1` references an object with a field `f` whose value ends up in
200218 * `node2`.
201219 */
202- predicate readStep ( Node node1 , Content f , ReadStepNode node2 ) {
203- node2 .getReadValue ( ) = node1 and
204- f .( FieldContent ) .getField ( ) = node2 .getAField ( )
220+ predicate readStep ( Node node1 , Content f , Node node2 ) {
221+ exists ( FieldAddressInstruction fa , LoadInstruction load |
222+ load .getSourceAddress ( ) = fa and
223+ node1 .asInstruction ( ) = load .getSourceValueOperand ( ) .getAnyDef ( ) and
224+ fa .getField ( ) = f .( FieldContent ) .getField ( ) and
225+ load = node2 .asInstruction ( )
226+ )
205227}
206228
207229/**
0 commit comments