C++: Flow through uncertain writes

[MathiasVP]

Previously, we weren't getting flow in the following example on the use-use feature branch:

char xs[2];
xs[0] = source();
xs[1] = 0;
sink(xs[0]);

because the assignment to xs[1] was seen as overwriting the contents of xs, and thus the assignment xs[0] = source(); was dead according to SSA.

This PR fixes this by recognizing that some writes are "uncertain" (i.e., we don't know if they completely overwrite a piece of memory), and ensures that we have flow from uncertain definition's prior definition to the variable being defined.

I was actually planning on putting up this PR after #11626 had been merged, but seeing as there are some performance issues with that PR I might as well put this on up now (as this PR is largely unrelated to iterators).

[aschackmull]

This seems like a weird use of SSA to me. I'd expect the char xs[2] to be the only write to the xs pointer, and then the subsequent mentions of xs to be reads (the pointer isn't modified). The writes that occur along the way are then store steps in data flow, so nothing is marked as dead by SSA, and there should be no need for uncertain SSA writes.

[MathiasVP]

This seems like a weird use of SSA to me. I'd expect the char xs[2] to be the only write to the xs pointer, and then the subsequent mentions of xs to be reads (the pointer isn't modified). The writes that occur along the way are then store steps in data flow, so nothing is marked as dead by SSA, and there should be no need for uncertain SSA writes.

But we don't model writes to x[1] as a store step. We model them as an assignment to an allocation which is tracked by SSA. So the situation is basically:

char xs[2]; // xs_allocation = uninitialized
xs[0] = source(); // xs_allocation = source();
xs[1] = 0; // xs_allocation = 0;
sink(xs[0]); // sink(xs_allocation);

[rdmarsh2]

Just to check - this is the only place where we're making a decision based on whether the write is certain, and the rest of the changes are just pushing certainty information through?

[MathiasVP]

Yeah, exactly.

[MathiasVP]

Or rather: We make the decision on whether a write is certain in isDefImpl. And we then consume this information in this predicate.