C++: Also suppress destructor calls on throwing ternary expressions.

MathiasVP · MathiasVP · commit 73602dca9217 · 2024-04-04T14:51:11.000+01:00
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -257,11 +257,26 @@ private predicate usedAsCondition(Expr expr) {
   )
 }
 
+private predicate hasThrowingChild(Expr e) {
+  e = any(ThrowExpr throw).getFullyConverted()
+  or
+  exists(Expr child |
+    e = getRealParent(child) and
+    hasThrowingChild(child)
+  )
+}
+
 private predicate isInConditionalEvaluation(Expr e) {
   exists(ConditionalExpr cond |
     e = cond.getThen().getFullyConverted() and not cond.isTwoOperand()
     or
     e = cond.getElse().getFullyConverted()
+    or
+    // If one of the operands throws then the temporaries constructed in either
+    // branch will also be attached to the ternary expression. We suppress
+    // those destructor calls as well.
+    hasThrowingChild([cond.getThen(), cond.getElse()]) and
+    e = cond.getFullyConverted()
   )
   or
   isInConditionalEvaluation(getRealParent(e))
