Conversation
hvitved
left a comment
hvitved
left a comment
There was a problem hiding this comment.
Seems fine to me; with the usual caveat that this is in internal code, so no guarantees about API stability. @aschackmull : Do you have any concerns?
| predicate fwdFlow(Nd node); | ||
|
|
||
| predicate fwdFlow(Nd node, Ap ap); |
There was a problem hiding this comment.
No need for the binary fwdFlow, right? It's only there for revFlow because this section of the signature is implicitly extending/including the StageSig signature, and we're not adding fwdFlow to that.
For the same reason, the unary fwdFlow signature should be moved a couple of lines up, so it's above the // begin StageSig comment.
(We don't yet have the proper QL language feature to do this kind of signature sharing, so there's just a comment bracketing the StageSig part).
| predicate fwdFlow(Nd node, Ap ap) { | ||
| Stage1::fwdFlow(node) and | ||
| exists(ap) | ||
| } |
|
|
||
| predicate fwdFlow(Nd node) { Stage1::fwdFlow(node.getNodeEx()) } | ||
|
|
||
| predicate fwdFlow(Nd node, Ap ap) { Stage1::fwdFlow(node.getNodeEx()) and exists(ap) } |
Only a few minor points as noted. |
3 participants
For some exploratory AI work we're doing (which combines CodeQL and AI) it's super useful to give the AI a set of nodes that are reachable from a given source node without locking down to a specific sink. Having access to stage 1's
fwdFlowpredicate would allow me to do just that.I'm well aware of the precision implications of only running (half of) stage 1, but this seems to work out very well in practice.