JavaScript: add flow steps through partial function application

[asger-semmle]

Adds flow steps from the arguments of Function.prototype.bind into the parameters of the target function, and similar for _.partial and friends.

For example:

function foo(x, y) {
  sink(x);
}
array.forEach(foo.bind(null, taint()));

Pending evaluation as we're a bit low on worker machines at the moment.

[ghost]

Bold addition. How did the evaluation turn out?

I have a few comments and suggestions.

[ghost]

Did you deliberately avoid array.flowsTo(getArgument(1))?

[asger-semmle]

Seems safe enough, I'll change it and give it a go.

[ghost]

You can save the pseudo-cast by declaring callback with the type AnalyzedNode

[ghost]

This can be private

[asger-semmle]

The entire library is internal and privately imported anyway, but sure.

[asger-semmle]

Evaluation on big-apps. No new results and a bit of a slow-down.

I'll investigate the slow-downs while we wait for @max to get back.

[ghost]

LGTM, except for performance, I have approved and tagged with WIP.

[xiemaisi]

LGTM.

Optionally, I would support pulling out the logic for preventing cross-file global calls shared by calls and partiallyCalls into an auxiliary predicate (with an appropriate bindingset to enforce inlining if necessary).

[asger-semmle]

Optionally, I would support pulling out the logic for preventing cross-file global calls shared by calls and partiallyCalls into an auxiliary predicate (with an appropriate bindingset to enforce inlining if necessary).

Makes sense. I'll get that in after working out the perf differences.

[asger-semmle]

Optionally, I would support pulling out the logic for preventing cross-file global calls shared by calls and partiallyCalls into an auxiliary predicate (with an appropriate bindingset to enforce inlining if necessary).

After this bugfix the two aren't easy to unify anymore. invk.isIndefinite relies on the cached predicate getACalleeValue which we can't use here. Rewriting it turned out to be very costly, so I'd rather leave it like this.

[asger-semmle]

The slowdown was caused by callInputStep being optimized differently, and me trying to cache AdditionalPartialInvokeNode which was a bad idea.

I've run Xss on big-apps and performance now looks better.

[asger-semmle]

@max are you happy with the perf evaluation or should I start a larger run?

[xiemaisi]

No, I think that's fine. @esben-semmle, what's your take?

[ghost]

This still LGTM.