CodeQL library for C/C++
codeql/cpp-all 0.12.10 (changelog, source)
Search

Member predicate GuardCondition::controls

Holds if this condition controls controlled, meaning that controlled is only entered if the value of this condition is testIsTrue.

Illustration:

[                    (testIsTrue)                        ]
[             this ----------------succ ---- controlled  ]
[               |                    |                   ]
[ (testIsFalse) |                     ------ ...         ]
[             other                                      ]

The predicate holds if all paths to controlled go via the testIsTrue edge of the control-flow graph. In other words, the testIsTrue edge must dominate controlled. This means that controlled must be dominated by both this and succ (the target of the testIsTrue edge). It also means that any other edge into succ must be a back-edge from a node which is dominated by succ.

The short-circuit boolean operations have slightly surprising behavior here: because the operation itself only dominates one branch (due to being short-circuited) then it will only control blocks dominated by the true (for &&) or false (for ||) branch.

predicate controls(BasicBlock controlled, boolean testIsTrue)