Java: Bugfix for samevar in useReaches.

aschackmull · hvitved · commit e955f58eb136 · 2025-02-11T10:06:49.000+01:00
diff --git a/java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll b/java/ql/lib/semmle/code/java/dataflow/internal/SsaImpl.qll
@@ -619,13 +619,12 @@ private module Cached {
         useReaches(use, mid, sameVarMid) and
         DataFlowIntegration::localFlowStep(_, mid, node, _)
       |
-        // flow into phi input node
-        mid instanceof DataFlowIntegration::SsaInputNode and
-        sameVar = false
-        or
-        // flow into definition
         exists(Impl::DefinitionExt def |
+          // flow into definition
           def = mid.(DataFlowIntegration::SsaDefinitionExtNode).getDefinitionExt()
+          or
+          // flow into phi input node
+          def = mid.(DataFlowIntegration::SsaInputNode).getDefinitionExt()
         |
           if def instanceof Impl::PhiReadNode then sameVar = sameVarMid else sameVar = false
         )

Original file line number	Diff line number	Diff line change
`@@ -619,13 +619,12 @@ private module Cached {`
`619`	`619`	`useReaches(use, mid, sameVarMid) and`
`620`	`620`	`DataFlowIntegration::localFlowStep(_, mid, node, _)`
`621`	`621`	`\|`
`622`		`- // flow into phi input node`
`623`		`- mid instanceof DataFlowIntegration::SsaInputNode and`
`624`		`- sameVar = false`
`625`		`- or`
`626`		`- // flow into definition`
`627`	`622`	`exists(Impl::DefinitionExt def \|`
	`623`	`+ // flow into definition`
`628`	`624`	`def = mid.(DataFlowIntegration::SsaDefinitionExtNode).getDefinitionExt()`
	`625`	`+ or`
	`626`	`+ // flow into phi input node`
	`627`	`+ def = mid.(DataFlowIntegration::SsaInputNode).getDefinitionExt()`
`629`	`628`	`\|`
`630`	`629`	`if def instanceof Impl::PhiReadNode then sameVar = sameVarMid else sameVar = false`
`631`	`630`	`)`