Swift: defaultImplicitTaintRead performance improvement

[geoffw0]

Performance Improvement motivated by a discovery on a nightly run.

Despite the bindingset[node] annotation, the evaluator was attempting to bind node using the internal logic of the predicate before applying the externally derived binding (which comes from TaintTrackingImpl.qll's allowImplicitRead), causing an explosion of computation. Forcing the issue with pragma[only_bind_out] appears to entirely solve the issue.

Locally I'm seeing something like a 30s improvement on multiple queries. A DCA run should confirm...

[MathiasVP]

Despite the bindingset[node] annotation, the evaluator was attempting to bind node using the internal logic of the predicate before applying the externally derived binding (which comes from TaintTrackingImpl.qll's allowImplicitRead)

It sounds like the right fix for this is to also add pragma[inline_late] to the predicate. If so, I think that's a solution that's much easier to understand: it tells the compiler (and the programmer) that node should be bound before evaluating the predicate.

[geoffw0]

Locally:

• using neither solution is bad
• pragma[only_bind_out] only is good
• pragma[inline_late] alongside pragma[only_bind_out] is good
• pragma[inline_late] only is good

I can't discriminate based on performance, so I've switched to just inline_late.

[MathiasVP]

LGTM once DCA comes back happy!

[geoffw0]

DCA shows a 20% analysis time reduction (1720s to 1376s), which is exactly what I was hoping for / cautiously expecting! 🎉

(we're also seeing "database run-queries" wobbles, but that's been true in recently nightly DCA runs as well - I've created a discussion on one of those)