83 lines
2.6 KiB
Markdown
83 lines
2.6 KiB
Markdown
# Optimization pass: demand-driven sink slicing (2026-05-25)
|
|
|
|
## Area map
|
|
|
|
The working backlog is in `docs/internal/perf-audit/optimization-backlog.md`. The first
|
|
implemented slice is **demand-driven sink slicing**: detectors can now tell the
|
|
walker whether a statement subtree contains a detector-relevant sink before the
|
|
walker pays full symbolic encoding cost for pure non-sink expression statements.
|
|
|
|
Safety rule for this slice: still encode declarations, writes, calls, `new`, and
|
|
`delete`, because those can feed later sinks or mutate detector state. Only pure
|
|
non-sink expression statements are skipped.
|
|
|
|
## Implemented
|
|
|
|
- Added `SafetyObserver::shouldEncodeForObserver(const clang::Stmt*)`.
|
|
- Added detector-specific sink-shape recognizers for:
|
|
- null deref: deref/member/subscript/call shapes
|
|
- div-by-zero: `/`, `%`, calls
|
|
- int overflow: signed integer arithmetic, calls
|
|
- oob/uaf: array subscripts and modeled libc/string sinks
|
|
- Added walker-side conservative side-effect guard so slicing is
|
|
precision-neutral for stateful expressions.
|
|
|
|
## Validation
|
|
|
|
```sh
|
|
meson test -C build/release fold:null_deref fold:div_by_zero fold:int_overflow fold:oob_access --print-errorlogs
|
|
meson test -C build/release --print-errorlogs
|
|
git diff --check
|
|
```
|
|
|
|
Results:
|
|
|
|
- Focused detector suite: 4/4 passed.
|
|
- Full suite: 49/49 passed.
|
|
- Whitespace check: passed.
|
|
|
|
## Benchmarks
|
|
|
|
### Synthetic micro: control nesting
|
|
|
|
```sh
|
|
python3 bench/run_micro_opt.py --case control-nesting --size 4 --repeats 5 --out-dir /tmp/fold-micro-slice-r5
|
|
```
|
|
|
|
Result medians:
|
|
|
|
- Findings: unchanged for this gate (`fold.null-deref`: 1 proved finding).
|
|
- `total_wall_ms`: 54 ms.
|
|
- `null-deref.wall_ms`: 46 ms.
|
|
- `null-deref.walker_ms`: 44 ms.
|
|
- `null-deref.control_walk_ms`: 36 ms.
|
|
- `z3_queries`: 1, `z3_timeouts`: 0.
|
|
|
|
### Yams wide20 security preset
|
|
|
|
```sh
|
|
python3 bench/run_security_targets.py --preset yams-wide20-security --repeats 1 --out-dir /tmp/fold-security-slice-smoke
|
|
```
|
|
|
|
Result:
|
|
|
|
- Return code: 0.
|
|
- Findings: 0.
|
|
- External elapsed: 117.1 s.
|
|
- Scan total wall: 117.0 s across 20 TUs / 4,983 functions.
|
|
|
|
### Curl security preset
|
|
|
|
```sh
|
|
python3 bench/run_security_targets.py --preset curl-security --repeats 1 --out-dir /tmp/fold-curl-slice-smoke
|
|
```
|
|
|
|
Result:
|
|
|
|
- Return code: 1.
|
|
- External elapsed: 577.2 s.
|
|
- Scan total wall: 577.1 s across 306 TUs / 2,339 functions.
|
|
- SARIF results: 2,463 total entries (`null-deref`: 2,171, `int-overflow`: 188,
|
|
`oob-access`: 91, `div-by-zero`: 13). This preset counts SARIF notes as well
|
|
as warnings, so use it for trend comparison rather than as a TP/FP number
|
|
without post-processing levels.
|