Pattern cases: support type-flow

smowton · smowton · commit 7dd4030f51a8 · 2023-11-30T11:23:58.000Z
diff --git a/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll b/java/ql/lib/semmle/code/java/dataflow/TypeFlow.qll
@@ -440,6 +440,21 @@ predicate arrayInstanceOfGuarded(ArrayAccess aa, RefType t) {
   )
 }
 
+/**
+ * Holds if `va` is an access to a value that is guarded by `case T t`.
+ */
+private predicate patternCaseGuarded(VarAccess va, RefType t) {
+  exists(PatternCase pc, BaseSsaVariable v |
+      va = v.getAUse() and
+      (
+        pc.getSwitch().getExpr() = v.getAUse() or
+        pc.getSwitchExpr().getExpr() = v.getAUse()
+      ) and
+      pc.getDecl().getBasicBlock().bbDominates(va.getBasicBlock()) and
+      t = pc.getDecl().getType()
+  )
+}
+
 /**
  * Holds if `t` is the type of the `this` value corresponding to the the
  * `SuperAccess`. As the `SuperAccess` expression has the type of the supertype,
@@ -465,7 +480,8 @@ private predicate typeFlowBaseCand(TypeFlowNode n, RefType t) {
     instanceOfGuarded(n.asExpr(), srctype) or
     arrayInstanceOfGuarded(n.asExpr(), srctype) or
     n.asExpr().(FunctionalExpr).getConstructedType() = srctype or
-    superAccess(n.asExpr(), srctype)
+    superAccess(n.asExpr(), srctype) or
+    patternCaseGuarded(n.asExpr(), srctype)
   |
     t = srctype.(BoundedType).getAnUltimateUpperBoundType()
     or
diff --git a/java/ql/test/library-tests/typeflow/UnionTypes.java b/java/ql/test/library-tests/typeflow/UnionTypes.java
@@ -44,6 +44,10 @@ private void next(Sup x) {
     if (x instanceof Inter) {
       x.hashCode();
     }
+    var hashCode = switch (x) {
+      case Inter i -> x.hashCode();
+      default -> 0;
+    };
   }
 
   void m3(Object d) {
diff --git a/java/ql/test/library-tests/typeflow/typeflow.expected b/java/ql/test/library-tests/typeflow/typeflow.expected
@@ -14,3 +14,4 @@
 | A.java:70:23:70:24 | x2 | Integer | false |
 | A.java:92:18:92:18 | n | Integer | false |
 | UnionTypes.java:45:7:45:7 | x | Inter | false |
+| UnionTypes.java:48:23:48:23 | x | Inter | false |
diff --git a/java/ql/test/library-tests/typeflow/uniontypeflow.expected b/java/ql/test/library-tests/typeflow/uniontypeflow.expected
@@ -19,6 +19,11 @@
 | UnionTypes.java:44:9:44:9 | x | 3 | A3 | false |
 | UnionTypes.java:45:7:45:7 | x | 2 | A1 | false |
 | UnionTypes.java:45:7:45:7 | x | 2 | A2 | true |
-| UnionTypes.java:51:7:51:7 | d | 3 | A1 | false |
-| UnionTypes.java:51:7:51:7 | d | 3 | A2 | false |
-| UnionTypes.java:51:7:51:7 | d | 3 | A3 | false |
+| UnionTypes.java:47:28:47:28 | x | 3 | A1 | false |
+| UnionTypes.java:47:28:47:28 | x | 3 | A2 | true |
+| UnionTypes.java:47:28:47:28 | x | 3 | A3 | false |
+| UnionTypes.java:48:23:48:23 | x | 2 | A1 | false |
+| UnionTypes.java:48:23:48:23 | x | 2 | A2 | true |
+| UnionTypes.java:55:7:55:7 | d | 3 | A1 | false |
+| UnionTypes.java:55:7:55:7 | d | 3 | A2 | false |
+| UnionTypes.java:55:7:55:7 | d | 3 | A3 | false |

Original file line number	Diff line number	Diff line change
`@@ -44,6 +44,10 @@ private void next(Sup x) {`
`44`	`44`	`if (x instanceof Inter) {`
`45`	`45`	`x.hashCode();`
`46`	`46`	`}`
	`47`	`+ var hashCode = switch (x) {`
	`48`	`+ case Inter i -> x.hashCode();`
	`49`	`+ default -> 0;`
	`50`	`+ };`
`47`	`51`	`}`
`48`	`52`
`49`	`53`	`void m3(Object d) {`