C++: Handle template variable specializations

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -253,7 +253,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
    */
   override Location getADeclarationLocation() { result = this.getADeclarationEntry().getLocation() }
 
-  /** Holds if this Function is a Template specialization. */
+  /** Holds if this function is a template specialization. */
   predicate isSpecialization() {
     exists(FunctionDeclarationEntry fde |
       fun_decls(unresolveElement(fde), underlyingElement(this), _, _, _) and
@@ -665,7 +665,7 @@ class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
   /** Holds if this declaration is also a definition of its function. */
   override predicate isDefinition() { fun_def(underlyingElement(this)) }
 
-  /** Holds if this declaration is a Template specialization. */
+  /** Holds if this declaration is a template specialization. */
   predicate isSpecialization() { fun_specialized(underlyingElement(this)) }
 
   /**

cpp/ql/lib/semmle/code/cpp/Variable.qll

@@ -187,6 +187,14 @@ class Variable extends Declaration, @variable {
    *    `for (char c : str) { ... }`
    */
   predicate isCompilerGenerated() { compgenerated(underlyingElement(this)) }
+
+  /** Holds if this variable is a template specialization. */
+  predicate isSpecialization() {
+    exists(VariableDeclarationEntry vde |
+      var_decls(unresolveElement(vde), underlyingElement(this), _, _, _) and
+      vde.isSpecialization()
+    )
+  }
 }
 
 /**
@@ -267,6 +275,9 @@ class VariableDeclarationEntry extends DeclarationEntry, @var_decl {
   override predicate isDefinition() { var_def(underlyingElement(this)) }
 
   override string getASpecifier() { var_decl_specifiers(underlyingElement(this), result) }
+
+  /** Holds if this declaration is a template specialization. */
+  predicate isSpecialization() { var_specialized(underlyingElement(this)) }
 }
 
 /**
@@ -594,7 +605,10 @@ class TemplateVariable extends Variable {
   /**
    * Gets an instantiation of this variable template.
    */
-  Variable getAnInstantiation() { result.isConstructedFrom(this) }
+  Variable getAnInstantiation() {
+    result.isConstructedFrom(this) and
+    not result.isSpecialization()
+  }
 }
 
 /**
@@ -624,6 +638,21 @@ class VariableTemplateInstantiation extends Variable {
   TemplateVariable getTemplate() { result = tv }
 }
 
+/**
+ * An explicit specialization of a C++ variable template.
+ */
+class VariableTemplateSpecialization extends Variable {
+  VariableTemplateSpecialization() { this.isSpecialization() }
+
+  override string getAPrimaryQlClass() { result = "VariableTemplateSpecialization" }
+
+  /**
+   * Gets the primary template for the specialization (the function template
+   * this specializes).
+   */
+  TemplateVariable getPrimaryTemplate() { this.isConstructedFrom(result) }
+}
+
 /**
  * A non-static local variable or parameter that is not part of an
  * uninstantiated template. Uninstantiated templates are purely syntax, and

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -495,6 +495,7 @@ var_decls(
     int location: @location_default ref
 );
 var_def(unique int id: @var_decl ref);
+var_specialized(int id: @var_decl ref);
 var_decl_specifiers(
     int id: @var_decl ref,
     string name: string ref