-
Notifications
You must be signed in to change notification settings - Fork 1.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
C#: Restrict dataflow node creation to source and source-referenced entities #17483
C#: Restrict dataflow node creation to source and source-referenced entities #17483
Conversation
…tual dispatch targets and referenced callables (e.g., in assigning a delegate)
…ions of generic instantiations, static targets, and methods that have a body even if not flagged fromSource
794a376
to
3e91f0f
Compare
DCA results are very positive -- no alert changes; considerably reduced cost for some projects. Started QA at https://github.com/github/codeql-qa-ops/issues/198 |
QA results are also very positive: positive time changes (a small number of large repositories exhibiting fairly large improvements, similar to DCA), and no alert differences (a small number of repos showing some changes in quality queries, but none reproducible locally, indicating these are cases of nondeterministic database creation). |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Really great work, nice to see how this significantly improves performance on some projects. I only have two minor comments.
csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
Outdated
Show resolved
Hide resolved
csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll
Outdated
Show resolved
Hide resolved
@hvitved changes applied; change note added. |
Confirmed that for the original problem database that sparked this, the predicates taking >=1s are:
Note |
This addresses a problem observed when libraries define a very large number of types with large class hierarchies, for example as part of generated code. Since user code is very unlikely to refer to all or even most of them, by excluding such code from dataflow node generation and therefore from the C# dataflow hooks' idea of a "relevant" type, we can make many of the type predicates defined in DataFlowPrivate.qll very much cheaper.
See discarded variant #17482 for some discussion.