IR consistency checks for FieldAddress and this arguments that are not actually addresses.

Exposes failures in existing tests. Also added a small test case for `FieldAddress` on a prvalue.

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRConsistency.qll

@@ -494,4 +494,34 @@ module InstructionConsistency {
       irFunc = getInstructionIRFunction(instr, irFuncText)
     )
   }
+
+  /**
+   * Holds if the object address operand for the given `FieldAddress` instruction does not have an
+   * address type.
+   */
+  query predicate fieldAddressOnNonPointer(
+    FieldAddressInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
+  ) {
+    not instr.getObjectAddressOperand().getIRType() instanceof IRAddressType and
+    message =
+      "FieldAddress instruction '" + instr.toString() +
+        "' has an object address operand that is not an address, in function '$@'." and
+    irFunc = getInstructionIRFunction(instr, irFuncText)
+  }
+
+  /**
+   * Holds if the `this` argument operand for the given `Call` instruction does not have an address
+   * type.
+   */
+  query predicate thisArgumentIsNonPointer(
+    CallInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
+  ) {
+    exists(ThisArgumentOperand thisOperand | thisOperand = instr.getThisArgumentOperand() |
+      not thisOperand.getIRType() instanceof IRAddressType
+    ) and
+    message =
+      "Call instruction '" + instr.toString() +
+        "' has a `this` argument operand that is not an address, in function '$@'." and
+    irFunc = getInstructionIRFunction(instr, irFuncText)
+  }
 }

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRConsistency.qll

@@ -494,4 +494,34 @@ module InstructionConsistency {
       irFunc = getInstructionIRFunction(instr, irFuncText)
     )
   }
+
+  /**
+   * Holds if the object address operand for the given `FieldAddress` instruction does not have an
+   * address type.
+   */
+  query predicate fieldAddressOnNonPointer(
+    FieldAddressInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
+  ) {
+    not instr.getObjectAddressOperand().getIRType() instanceof IRAddressType and
+    message =
+      "FieldAddress instruction '" + instr.toString() +
+        "' has an object address operand that is not an address, in function '$@'." and
+    irFunc = getInstructionIRFunction(instr, irFuncText)
+  }
+
+  /**
+   * Holds if the `this` argument operand for the given `Call` instruction does not have an address
+   * type.
+   */
+  query predicate thisArgumentIsNonPointer(
+    CallInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
+  ) {
+    exists(ThisArgumentOperand thisOperand | thisOperand = instr.getThisArgumentOperand() |
+      not thisOperand.getIRType() instanceof IRAddressType
+    ) and
+    message =
+      "Call instruction '" + instr.toString() +
+        "' has a `this` argument operand that is not an address, in function '$@'." and
+    irFunc = getInstructionIRFunction(instr, irFuncText)
+  }
 }

cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRConsistency.qll

@@ -494,4 +494,34 @@ module InstructionConsistency {
       irFunc = getInstructionIRFunction(instr, irFuncText)
     )
   }
+
+  /**
+   * Holds if the object address operand for the given `FieldAddress` instruction does not have an
+   * address type.
+   */
+  query predicate fieldAddressOnNonPointer(
+    FieldAddressInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
+  ) {
+    not instr.getObjectAddressOperand().getIRType() instanceof IRAddressType and
+    message =
+      "FieldAddress instruction '" + instr.toString() +
+        "' has an object address operand that is not an address, in function '$@'." and
+    irFunc = getInstructionIRFunction(instr, irFuncText)
+  }
+
+  /**
+   * Holds if the `this` argument operand for the given `Call` instruction does not have an address
+   * type.
+   */
+  query predicate thisArgumentIsNonPointer(
+    CallInstruction instr, string message, OptionalIRFunction irFunc, string irFuncText
+  ) {
+    exists(ThisArgumentOperand thisOperand | thisOperand = instr.getThisArgumentOperand() |
+      not thisOperand.getIRType() instanceof IRAddressType
+    ) and
+    message =
+      "Call instruction '" + instr.toString() +
+        "' has a `this` argument operand that is not an address, in function '$@'." and
+    irFunc = getInstructionIRFunction(instr, irFuncText)
+  }
 }

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -10941,14 +10941,27 @@ ir.cpp:
 # 1398|           expr: [FunctionCall] call to returnValue
 # 1398|               Type = [Class] copy_constructor
 # 1398|               ValueCategory = prvalue
-# 1400|     7: [ExprStmt] ExprStmt
-# 1400|       0: [TemporaryObjectExpr] temporary object
-# 1400|           Type = [Class] copy_constructor
-# 1400|           ValueCategory = prvalue(load)
-# 1400|         expr: [FunctionCall] call to defaultConstruct
-# 1400|             Type = [Class] copy_constructor
-# 1400|             ValueCategory = prvalue
-# 1401|     8: [ReturnStmt] return ...
+# 1399|     7: [ExprStmt] ExprStmt
+# 1399|       0: [TemporaryObjectExpr] temporary object
+# 1399|           Type = [Class] copy_constructor
+# 1399|           ValueCategory = prvalue(load)
+# 1399|         expr: [FunctionCall] call to defaultConstruct
+# 1399|             Type = [Class] copy_constructor
+# 1399|             ValueCategory = prvalue
+# 1401|     8: [DeclStmt] declaration
+# 1401|       0: [VariableDeclarationEntry] definition of y
+# 1401|           Type = [IntType] int
+# 1401|         init: [Initializer] initializer for y
+# 1401|           expr: [ValueFieldAccess] y
+# 1401|               Type = [IntType] int
+# 1401|               ValueCategory = prvalue
+# 1401|             -1: [TemporaryObjectExpr] temporary object
+# 1401|                 Type = [Class] copy_constructor
+# 1401|                 ValueCategory = prvalue(load)
+# 1401|               expr: [FunctionCall] call to returnValue
+# 1401|                   Type = [Class] copy_constructor
+# 1401|                   ValueCategory = prvalue
+# 1402|     9: [ReturnStmt] return ...
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   params: 

cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency.expected

@@ -21,6 +21,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+| ir.cpp:1401:45:1401:45 | FieldAddress: y | FieldAddress instruction 'FieldAddress: y' has an object address operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+thisArgumentIsNonPointer
+| ir.cpp:1373:14:1373:18 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1374:27:1374:31 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1385:23:1385:28 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1386:36:1386:41 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1397:24:1397:29 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+| ir.cpp:1398:37:1398:42 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ir/aliased_ssa_consistency_unsound.expected

@@ -21,6 +21,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+| ir.cpp:1401:45:1401:45 | FieldAddress: y | FieldAddress instruction 'FieldAddress: y' has an object address operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+thisArgumentIsNonPointer
+| ir.cpp:1373:14:1373:18 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1374:27:1374:31 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1385:23:1385:28 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1386:36:1386:41 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1397:24:1397:29 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+| ir.cpp:1398:37:1398:42 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -1328,7 +1328,7 @@ T defaultConstruct() {
 }
 
 class constructor_only {
-private:
+public:
     int x;
 
 public:
@@ -1336,7 +1336,7 @@ public:
 };
 
 class copy_constructor {
-private:
+public:
     int y;
 
 public:
@@ -1396,8 +1396,9 @@ void temporary_copy_constructor() {
     acceptValue(d);
     copy_constructor().method();
     returnValue<copy_constructor>().method();
-
     defaultConstruct<copy_constructor>();
+
+    int y = returnValue<copy_constructor>().y;
 }
 
 // semmle-extractor-options: -std=c++17 --clang

cpp/ql/test/library-tests/ir/ir/raw_consistency.expected

@@ -21,6 +21,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+| ir.cpp:1401:45:1401:45 | FieldAddress: y | FieldAddress instruction 'FieldAddress: y' has an object address operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+thisArgumentIsNonPointer
+| ir.cpp:1373:14:1373:18 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1374:27:1374:31 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1385:23:1385:28 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1386:36:1386:41 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1397:24:1397:29 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+| ir.cpp:1398:37:1398:42 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ir/raw_ir.expected

@@ -7733,13 +7733,22 @@ ir.cpp:
 # 1398|     mu1398_9(unknown)                  = ^CallSideEffect                   : ~m?
 # 1398|     v1398_10(void)                     = ^BufferReadSideEffect[-1]         : &:r1398_6, ~m?
 # 1398|     mu1398_11(copy_constructor)        = ^IndirectMayWriteSideEffect[-1]   : &:r1398_6
-# 1400|     r1400_1(glval<copy_constructor>)   = VariableAddress[#temp1400:5]      : 
-# 1400|     r1400_2(glval<unknown>)            = FunctionAddress[defaultConstruct] : 
-# 1400|     r1400_3(copy_constructor)          = Call[defaultConstruct]            : func:r1400_2
-# 1400|     mu1400_4(unknown)                  = ^CallSideEffect                   : ~m?
-# 1400|     mu1400_5(copy_constructor)         = Store[#temp1400:5]                : &:r1400_1, r1400_3
-# 1400|     r1400_6(copy_constructor)          = Load[#temp1400:5]                 : &:r1400_1, ~m?
-# 1401|     v1401_1(void)                      = NoOp                              : 
+# 1399|     r1399_1(glval<copy_constructor>)   = VariableAddress[#temp1399:5]      : 
+# 1399|     r1399_2(glval<unknown>)            = FunctionAddress[defaultConstruct] : 
+# 1399|     r1399_3(copy_constructor)          = Call[defaultConstruct]            : func:r1399_2
+# 1399|     mu1399_4(unknown)                  = ^CallSideEffect                   : ~m?
+# 1399|     mu1399_5(copy_constructor)         = Store[#temp1399:5]                : &:r1399_1, r1399_3
+# 1399|     r1399_6(copy_constructor)          = Load[#temp1399:5]                 : &:r1399_1, ~m?
+# 1401|     r1401_1(glval<int>)                = VariableAddress[y]                : 
+# 1401|     r1401_2(glval<copy_constructor>)   = VariableAddress[#temp1401:13]     : 
+# 1401|     r1401_3(glval<unknown>)            = FunctionAddress[returnValue]      : 
+# 1401|     r1401_4(copy_constructor)          = Call[returnValue]                 : func:r1401_3
+# 1401|     mu1401_5(unknown)                  = ^CallSideEffect                   : ~m?
+# 1401|     mu1401_6(copy_constructor)         = Store[#temp1401:13]               : &:r1401_2, r1401_4
+# 1401|     r1401_7(copy_constructor)          = Load[#temp1401:13]                : &:r1401_2, ~m?
+# 1401|     r1401_8(glval<int>)                = FieldAddress[y]                   : r1401_7
+# 1401|     mu1401_9(int)                      = Store[y]                          : &:r1401_1, r1401_8
+# 1402|     v1402_1(void)                      = NoOp                              : 
 # 1391|     v1391_4(void)                      = ReturnVoid                        : 
 # 1391|     v1391_5(void)                      = AliasedUse                        : ~m?
 # 1391|     v1391_6(void)                      = ExitFunction                      : 

cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency.expected

@@ -21,6 +21,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+| ir.cpp:1401:45:1401:45 | FieldAddress: y | FieldAddress instruction 'FieldAddress: y' has an object address operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+thisArgumentIsNonPointer
+| ir.cpp:1373:14:1373:18 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1374:27:1374:31 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1385:23:1385:28 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1386:36:1386:41 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1397:24:1397:29 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+| ir.cpp:1398:37:1398:42 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ir/unaliased_ssa_consistency_unsound.expected

@@ -21,6 +21,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+| ir.cpp:1401:45:1401:45 | FieldAddress: y | FieldAddress instruction 'FieldAddress: y' has an object address operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+thisArgumentIsNonPointer
+| ir.cpp:1373:14:1373:18 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1374:27:1374:31 | Call: call to c_str | Call instruction 'Call: call to c_str' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1365:6:1365:21 | void temporary_string() | void temporary_string() |
+| ir.cpp:1385:23:1385:28 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1386:36:1386:41 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1379:6:1379:30 | void temporary_destructor_only() | void temporary_destructor_only() |
+| ir.cpp:1397:24:1397:29 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
+| ir.cpp:1398:37:1398:42 | Call: call to method | Call instruction 'Call: call to method' has a `this` argument operand that is not an address, in function '$@'. | ir.cpp:1391:6:1391:31 | void temporary_copy_constructor() | void temporary_copy_constructor() |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency.expected

@@ -21,6 +21,8 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+thisArgumentIsNonPointer
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ssa/aliased_ssa_consistency_unsound.expected

@@ -21,6 +21,8 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+thisArgumentIsNonPointer
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency.expected

@@ -21,6 +21,8 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+thisArgumentIsNonPointer
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_consistency_unsound.expected

@@ -21,6 +21,8 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+thisArgumentIsNonPointer
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_consistency.expected

@@ -94,6 +94,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+thisArgumentIsNonPointer
+| conditional_destructors.cpp:30:15:30:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:33:15:33:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:39:15:39:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| conditional_destructors.cpp:42:15:42:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| pmcallexpr.cpp:8:2:8:15 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| pointer_to_member.cpp:23:5:23:54 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
+| pointer_to_member.cpp:24:5:24:49 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/syntax-zoo/raw_consistency.expected

@@ -149,6 +149,21 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+| misc.c:220:9:223:3 | FieldAddress: {...} | FieldAddress instruction 'FieldAddress: {...}' has an object address operand that is not an address, in function '$@'. | misc.c:219:5:219:26 | int assign_designated_init(someStruct*) | int assign_designated_init(someStruct*) |
+| misc.c:220:9:223:3 | FieldAddress: {...} | FieldAddress instruction 'FieldAddress: {...}' has an object address operand that is not an address, in function '$@'. | misc.c:219:5:219:26 | int assign_designated_init(someStruct*) | int assign_designated_init(someStruct*) |
+thisArgumentIsNonPointer
+| condition_decls.cpp:16:15:16:15 | Call: call to operator int | Call instruction 'Call: call to operator int' has a `this` argument operand that is not an address, in function '$@'. | condition_decls.cpp:15:6:15:17 | void if_decl_bind(int) | void if_decl_bind(int) |
+| condition_decls.cpp:26:19:26:19 | Call: call to operator int | Call instruction 'Call: call to operator int' has a `this` argument operand that is not an address, in function '$@'. | condition_decls.cpp:25:6:25:21 | void switch_decl_bind(int) | void switch_decl_bind(int) |
+| condition_decls.cpp:41:18:41:18 | Call: call to operator int | Call instruction 'Call: call to operator int' has a `this` argument operand that is not an address, in function '$@'. | condition_decls.cpp:40:6:40:20 | void while_decl_bind(int) | void while_decl_bind(int) |
+| condition_decls.cpp:48:48:48:48 | Call: call to operator int | Call instruction 'Call: call to operator int' has a `this` argument operand that is not an address, in function '$@'. | condition_decls.cpp:47:6:47:18 | void for_decl_bind(int) | void for_decl_bind(int) |
+| conditional_destructors.cpp:30:15:30:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:33:15:33:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:39:15:39:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| conditional_destructors.cpp:42:15:42:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| pmcallexpr.cpp:8:2:8:15 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| pointer_to_member.cpp:23:5:23:54 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
+| pointer_to_member.cpp:24:5:24:49 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType

cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_consistency.expected

@@ -94,6 +94,15 @@ notMarkedAsConflated
 wronglyMarkedAsConflated
 invalidOverlap
 nonUniqueEnclosingIRFunction
+fieldAddressOnNonPointer
+thisArgumentIsNonPointer
+| conditional_destructors.cpp:30:15:30:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:33:15:33:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:29:6:29:7 | void f1() | void f1() |
+| conditional_destructors.cpp:39:15:39:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| conditional_destructors.cpp:42:15:42:15 | Call: call to operator== | Call instruction 'Call: call to operator==' has a `this` argument operand that is not an address, in function '$@'. | conditional_destructors.cpp:38:6:38:7 | void f2() | void f2() |
+| pmcallexpr.cpp:8:2:8:15 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | array_delete.cpp:5:6:5:6 | void f() | void f() |
+| pointer_to_member.cpp:23:5:23:54 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
+| pointer_to_member.cpp:24:5:24:49 | Call: call to expression | Call instruction 'Call: call to expression' has a `this` argument operand that is not an address, in function '$@'. | pointer_to_member.cpp:14:5:14:9 | int usePM(int PM::*) | int usePM(int PM::*) |
 missingCanonicalLanguageType
 multipleCanonicalLanguageTypes
 missingIRType