C++: class and test for clang's __builtin_addressof

cpp/ql/src/semmle/code/cpp/exprs/BuiltInOperations.qll

@@ -202,6 +202,20 @@ class BuiltInOperationBuiltInShuffleVector extends BuiltInOperation, @builtinshu
   override string toString() { result = "__builtin_shufflevector" }
 }
 
+/**
+ * A clang `__builtin_addressof` expression (can be used to implement C++'s std::addressof).
+ */
+class BuiltInOperationBuiltInAddressOf extends UnaryOperation, BuiltInOperation, @builtinaddressof {
+  /** Gets the function or variable whose address is taken. */
+  Declaration getAddressable() {
+       result = this.getOperand().(Access).getTarget()
+       // this handles the case where we are taking the address of a reference variable
+    or result = this.getOperand().(ReferenceDereferenceExpr).getChild(0).(Access).getTarget()
+  }
+
+  override string getOperator() { result = "__builtin_addressof" }
+}
+
 /**
  * The `__is_trivially_constructible` type trait.
  */

cpp/ql/test/library-tests/clang_builtin_macros/addressof.c

@@ -0,0 +1,8 @@
+// semmle-extractor-options: --edg --clang
+
+int x = 0;
+
+int* f(void) {
+  int* x_addr = __builtin_addressof(x);
+  return x_addr;
+}

cpp/ql/test/library-tests/clang_builtin_macros/addressof.expected

@@ -0,0 +1 @@
+| addressof.c:6:17:6:38 | __builtin_addressof ... | addressof.c:6:37:6:37 | x |

cpp/ql/test/library-tests/clang_builtin_macros/addressof.ql

@@ -0,0 +1,4 @@
+import cpp
+
+from BuiltInOperationBuiltInAddressOf op
+select op, op.getOperand()

cpp/ql/test/library-tests/clang_builtin_macros/values.expected

@@ -1,7 +1,9 @@
-|  | fp_offset | <no initialiser value> |
-|  | gp_offset | <no initialiser value> |
-|  | overflow_arg_area | <no initialiser value> |
-|  | reg_save_area | <no initialiser value> |
+|  | fp_offset | <no initialiser expr> |
+|  | gp_offset | <no initialiser expr> |
+|  | overflow_arg_area | <no initialiser expr> |
+|  | reg_save_area | <no initialiser expr> |
+| addressof.c | x | 0 |
+| addressof.c | x_addr | __builtin_addressof ... |
 | extended.cpp | has_nullptr_e | 1 |
 | extended.cpp | has_nullptr_f | 1 |
 | gcc492.c | has_include | 1 |

cpp/ql/test/library-tests/clang_builtin_macros/values.ql

@@ -1,9 +1,9 @@
 import cpp
 
 string varInit(Variable v) {
-    if exists(v.getInitializer().getExpr().getValue())
-    then result = v.getInitializer().getExpr().getValue().toString()
-    else result = "<no initialiser value>"
+    if exists(v.getInitializer().getExpr())
+    then result = v.getInitializer().getExpr().toString()
+    else result = "<no initialiser expr>"
 }
 
 from Variable v