Shared: add test case for stateful outBarrier bug

Author: asgerf

java/ql/test/library-tests/dataflow/inoutbarriers/A.java

@@ -1,10 +1,17 @@
 class A {
   static String fsrc = "";
+  String fsink = "";
 
   String src(String s) { return s; }
 
   void sink(String s) { }
 
+  static String flowThroughSink(String s) {
+    A obj = new A();
+    obj.fsink = s;
+    return obj.fsink;
+  }
+
   void foo() {
     String s = fsrc;
     sink(fsrc);
@@ -13,5 +20,9 @@ void foo() {
     sink(s);
 
     sink(s);
+
+    s = fsrc;
+    s = flowThroughSink(s);
+    sink(s);
   }
 }

java/ql/test/library-tests/dataflow/inoutbarriers/test.expected

@@ -1,7 +1,11 @@
 inconsistentFlow
+| A.java:24:9:24:12 | fsrc | A.java:26:10:26:10 | s | spurious state-flow in configuration both |
+| A.java:24:9:24:12 | fsrc | A.java:26:10:26:10 | s | spurious state-flow in configuration sinkbarrier |
 #select
-| A.java:9:16:9:19 | fsrc | A.java:13:10:13:10 | s | nobarrier, sinkbarrier |
-| A.java:9:16:9:19 | fsrc | A.java:15:10:15:10 | s | nobarrier |
-| A.java:10:10:10:13 | fsrc | A.java:10:10:10:13 | fsrc | both, nobarrier, sinkbarrier, srcbarrier |
-| A.java:12:9:12:14 | src(...) | A.java:13:10:13:10 | s | both, nobarrier, sinkbarrier, srcbarrier |
-| A.java:12:9:12:14 | src(...) | A.java:15:10:15:10 | s | nobarrier, srcbarrier |
+| A.java:16:16:16:19 | fsrc | A.java:20:10:20:10 | s | nobarrier, sinkbarrier |
+| A.java:16:16:16:19 | fsrc | A.java:22:10:22:10 | s | nobarrier |
+| A.java:17:10:17:13 | fsrc | A.java:17:10:17:13 | fsrc | both, nobarrier, sinkbarrier, srcbarrier |
+| A.java:19:9:19:14 | src(...) | A.java:20:10:20:10 | s | both, nobarrier, sinkbarrier, srcbarrier |
+| A.java:19:9:19:14 | src(...) | A.java:22:10:22:10 | s | nobarrier, srcbarrier |
+| A.java:24:9:24:12 | fsrc | A.java:11:17:11:17 | s | both, nobarrier, sinkbarrier, srcbarrier |
+| A.java:24:9:24:12 | fsrc | A.java:26:10:26:10 | s | nobarrier, srcbarrier |

java/ql/test/library-tests/dataflow/inoutbarriers/test.ql

@@ -12,6 +12,11 @@ predicate sink0(Node n) {
     sink.getMethod().hasName("sink") and
     sink.getAnArgument() = n.asExpr()
   )
+  or
+  exists(AssignExpr assign |
+    assign.getDest().(FieldAccess).getField().hasName("fsink") and
+    n.asExpr() = assign.getSource()
+  )
 }
 
 module Conf1 implements ConfigSig {