From 04ce4057e1534d651be88f2c2fa7f7ac3c9b413f Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Thu, 25 Sep 2025 12:43:57 +0100
Subject: [PATCH] C++: Add more comments to describe the constant expression
 hack.

---
 cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll b/cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
index b7ad7e56d2a..91b6334922d 100644
--- a/cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
+++ b/cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
@@ -97,9 +97,14 @@ module GuardsInput implements SharedGuards::InputSig<Cpp::Location, Instruction,
       this.(ConstantInstruction).getValue().toInt() = value and
       this.getResultIRType() instanceof IRIntegerType
       or
-      // In order to have an "integer constant" for a switch case
+      // In order to have an integer constant for a switch case
       // we misuse the first instruction (which is always a NoOp instruction)
       // as a constant with the switch case's value.
+      // Even worse, since we need a case range to generate an `TIntRange`
+      // guard value we must ensure that there exists `ConstantExpr`s whose
+      // integer value is the end-points. So we let this constant expression
+      // have both end-point values. Luckily, these `NoOp` instructions do not
+      // interact with SSA in any way. So this should not break anything.
       exists(CaseEdge edge | this = any(SwitchInstruction switch).getSuccessor(edge) |
         value = edge.getMaxValue().toInt()
         or