More uses of instanceof in the external/internal AST layer

2026-04-26 01:05:15 +02:00 · 2021-09-24 10:31:31 +02:00
parent 141f5f7605
commit 793368d670
7 changed files with 156 additions and 140 deletions
--- a/ql/lib/codeql/ruby/ast/Call.qll
+++ b/ql/lib/codeql/ruby/ast/Call.qll
@@ -8,7 +8,7 @@ private import codeql.ruby.dataflow.internal.DataFlowImplCommon
 /**
 * A call.
 */
-class Call extends Expr, TCall {
+class Call extends Expr instanceof CallImpl {
  override string getAPrimaryQlClass() { result = "Call" }

  /**
@@ -23,7 +23,7 @@ class Call extends Expr, TCall {
   * yield 0, bar: 1
   * ```
   */
-  final Expr getArgument(int n) { result = this.(CallImpl).getArgumentImpl(n) }
+  final Expr getArgument(int n) { result = super.getArgumentImpl(n) }

  /**
   * Gets an argument of this method call.
@@ -49,7 +49,7 @@ class Call extends Expr, TCall {
  /**
   * Gets the number of arguments of this method call.
   */
-  final int getNumberOfArguments() { result = this.(CallImpl).getNumberOfArgumentsImpl() }
+  final int getNumberOfArguments() { result = super.getNumberOfArgumentsImpl() }

  /** Gets a potential target of this call, if any. */
  final Callable getATarget() {
@@ -59,7 +59,7 @@ class Call extends Expr, TCall {
  }

  override AstNode getAChild(string pred) {
-    result = super.getAChild(pred)
+    result = Expr.super.getAChild(pred)
    or
    pred = "getArgument" and result = this.getArgument(_)
  }
@@ -68,7 +68,7 @@ class Call extends Expr, TCall {
 /**
 * A method call.
 */
-class MethodCall extends Call, TMethodCall {
+class MethodCall extends Call instanceof MethodCallImpl {
  override string getAPrimaryQlClass() { result = "MethodCall" }

  /**
@@ -84,7 +84,7 @@ class MethodCall extends Call, TMethodCall {
   * the call to `qux` is the `Expr` for `Baz`; for the call to `corge` there
   * is no result.
   */
-  final Expr getReceiver() { result = this.(MethodCallImpl).getReceiverImpl() }
+  final Expr getReceiver() { result = super.getReceiverImpl() }

  /**
   * Gets the name of the method being called. For example, in:
@@ -95,7 +95,7 @@ class MethodCall extends Call, TMethodCall {
   *
   * the result is `"bar"`.
   */
-  final string getMethodName() { result = this.(MethodCallImpl).getMethodNameImpl() }
+  final string getMethodName() { result = super.getMethodNameImpl() }

  /**
   * Gets the block of this method call, if any.
@@ -103,12 +103,12 @@ class MethodCall extends Call, TMethodCall {
   * foo.each { |x| puts x }
   * ```
   */
-  Block getBlock() { none() }
+  final Block getBlock() { result = super.getBlockImpl() }

  override string toString() { result = "call to " + this.getMethodName() }

  override AstNode getAChild(string pred) {
-    result = super.getAChild(pred)
+    result = Call.super.getAChild(pred)
    or
    pred = "getReceiver" and result = this.getReceiver()
    or
@@ -135,7 +135,7 @@ class SetterMethodCall extends MethodCall {
 * a[0]
 * ```
 */
-class ElementReference extends MethodCall, TElementReference {
+class ElementReference extends MethodCall instanceof ElementReferenceImpl {
  final override string getAPrimaryQlClass() { result = "ElementReference" }

  final override string toString() { result = "...[...]" }
@@ -147,11 +147,7 @@ class ElementReference extends MethodCall, TElementReference {
 * yield x, y
 * ```
 */
-class YieldCall extends Call, TYieldCall {
-  Ruby::Yield g;
-
-  YieldCall() { this = TYieldCall(g) }
-
+class YieldCall extends Call instanceof YieldCallImpl {
  final override string getAPrimaryQlClass() { result = "YieldCall" }

  final override string toString() { result = "yield ..." }
@@ -167,7 +163,7 @@ class YieldCall extends Call, TYieldCall {
 * end
 * ```
 */
-class SuperCall extends MethodCall, TSuperCall {
+class SuperCall extends MethodCall instanceof SuperCallImpl {
  final override string getAPrimaryQlClass() { result = "SuperCall" }
 }

--- a/ql/lib/codeql/ruby/ast/Variable.qll
+++ b/ql/lib/codeql/ruby/ast/Variable.qll
@@ -7,9 +7,9 @@ private import internal.TreeSitter
 private import internal.Variable

 /** A variable declared in a scope. */
-class Variable extends TVariable {
+class Variable instanceof VariableImpl {
  /** Gets the name of this variable. */
-  string getName() { none() }
+  final string getName() { result = super.getNameImpl() }

  /** Holds if the name of this variable is `name`. */
  final predicate hasName(string name) { this.getName() = name }
@@ -18,10 +18,12 @@ class Variable extends TVariable {
  final string toString() { result = this.getName() }

  /** Gets the location of this variable. */
-  Location getLocation() { none() }
+  final Location getLocation() { result = super.getLocationImpl() }

  /** Gets the scope this variable is declared in. */
-  Scope getDeclaringScope() { none() }
+  final Scope getDeclaringScope() {
+    toGenerated(result) = this.(VariableReal).getDeclaringScopeImpl()
+  }

  /** Gets an access to this variable. */
  VariableAccess getAnAccess() { result.getVariable() = this }
@@ -29,10 +31,10 @@ class Variable extends TVariable {

 /** A local variable. */
 class LocalVariable extends Variable, TLocalVariable {
-  override LocalVariableAccess getAnAccess() { none() }
+  override LocalVariableAccess getAnAccess() { result.getVariable() = this }

  /** Gets the access where this local variable is first introduced. */
-  VariableAccess getDefiningAccess() { none() }
+  VariableAccess getDefiningAccess() { result = this.(LocalVariableReal).getDefiningAccessImpl() }

  /**
   * Holds if this variable is captured. For example in
@@ -52,12 +54,12 @@ class LocalVariable extends Variable, TLocalVariable {
 }

 /** A global variable. */
-class GlobalVariable extends VariableReal, TGlobalVariable instanceof GlobalVariable::Range {
+class GlobalVariable extends Variable instanceof GlobalVariableImpl {
  final override GlobalVariableAccess getAnAccess() { result.getVariable() = this }
 }

 /** An instance variable. */
-class InstanceVariable extends VariableReal, TInstanceVariable instanceof InstanceVariable::Range {
+class InstanceVariable extends Variable instanceof InstanceVariableImpl {
  /** Holds is this variable is a class instance variable. */
  final predicate isClassInstanceVariable() { super.isClassInstanceVariable() }

@@ -65,14 +67,14 @@ class InstanceVariable extends VariableReal, TInstanceVariable instanceof Instan
 }

 /** A class variable. */
-class ClassVariable extends VariableReal, TClassVariable instanceof ClassVariable::Range {
+class ClassVariable extends Variable instanceof ClassVariableImpl {
  final override ClassVariableAccess getAnAccess() { result.getVariable() = this }
 }

 /** An access to a variable. */
-class VariableAccess extends Expr, TVariableAccess {
+class VariableAccess extends Expr instanceof VariableAccessImpl {
  /** Gets the variable this identifier refers to. */
-  final Variable getVariable() { result = this.(VariableAccessImpl).getVariableImpl() }
+  final Variable getVariable() { result = super.getVariableImpl() }

  /**
   * Holds if this access is a write access belonging to the explicit
@@ -106,6 +108,8 @@ class VariableAccess extends Expr, TVariableAccess {
   * as is the first access to `e`.
   */
  predicate isImplicitWrite() { implicitWriteAccess(toGenerated(this)) }
+
+  final override string toString() { result = VariableAccessImpl.super.toString() }
 }

 /** An access to a variable where the value is updated. */
@@ -122,7 +126,7 @@ class VariableReadAccess extends VariableAccess {
 }

 /** An access to a local variable. */
-class LocalVariableAccess extends VariableAccess, TLocalVariableAccess {
+class LocalVariableAccess extends VariableAccess instanceof LocalVariableAccessImpl {
  final override string getAPrimaryQlClass() { result = "LocalVariableAccess" }

  /**
@@ -150,7 +154,7 @@ class LocalVariableWriteAccess extends LocalVariableAccess, VariableWriteAccess
 class LocalVariableReadAccess extends LocalVariableAccess, VariableReadAccess { }

 /** An access to a global variable. */
-class GlobalVariableAccess extends VariableAccess, TGlobalVariableAccess {
+class GlobalVariableAccess extends VariableAccess instanceof GlobalVariableAccessImpl {
  final override string getAPrimaryQlClass() { result = "GlobalVariableAccess" }
 }

@@ -161,7 +165,7 @@ class GlobalVariableWriteAccess extends GlobalVariableAccess, VariableWriteAcces
 class GlobalVariableReadAccess extends GlobalVariableAccess, VariableReadAccess { }

 /** An access to an instance variable. */
-class InstanceVariableAccess extends VariableAccess, TInstanceVariableAccess {
+class InstanceVariableAccess extends VariableAccess instanceof InstanceVariableAccessImpl {
  final override string getAPrimaryQlClass() { result = "InstanceVariableAccess" }
 }

@@ -172,7 +176,7 @@ class InstanceVariableWriteAccess extends InstanceVariableAccess, VariableWriteA
 class InstanceVariableReadAccess extends InstanceVariableAccess, VariableReadAccess { }

 /** An access to a class variable. */
-class ClassVariableAccess extends VariableAccess, TClassVariableAccess {
+class ClassVariableAccess extends VariableAccess instanceof ClassVariableAccessRealImpl {
  final override string getAPrimaryQlClass() { result = "ClassVariableAccess" }
 }

--- a/ql/lib/codeql/ruby/ast/internal/Call.qll
+++ b/ql/lib/codeql/ruby/ast/internal/Call.qll
@@ -12,7 +12,7 @@ predicate isScopeResolutionMethodCall(Ruby::ScopeResolution g, Ruby::Identifier
  not exists(Ruby::Call c | c.getMethod() = g)
 }

-abstract class CallImpl extends Call {
+abstract class CallImpl extends Expr, TCall {
  abstract AstNode getArgumentImpl(int n);

  /**
@@ -27,10 +27,12 @@ abstract class CallImpl extends Call {
  abstract int getNumberOfArgumentsImpl();
 }

-abstract class MethodCallImpl extends CallImpl, MethodCall {
+abstract class MethodCallImpl extends CallImpl, TMethodCall {
  abstract AstNode getReceiverImpl();

  abstract string getMethodNameImpl();
+
+  abstract Block getBlockImpl();
 }

 class MethodCallSynth extends MethodCallImpl, TMethodCallSynth {
@@ -47,6 +49,8 @@ class MethodCallSynth extends MethodCallImpl, TMethodCallSynth {
  final override AstNode getArgumentImpl(int n) { synthChild(this, n + 1, result) and n >= 0 }

  final override int getNumberOfArgumentsImpl() { this = TMethodCallSynth(_, _, _, _, result) }
+
+  final override Block getBlockImpl() { none() }
 }

 class IdentifierMethodCall extends MethodCallImpl, TIdentifierMethodCall {
@@ -61,6 +65,8 @@ class IdentifierMethodCall extends MethodCallImpl, TIdentifierMethodCall {
  final override Expr getArgumentImpl(int n) { none() }

  final override int getNumberOfArgumentsImpl() { result = 0 }
+
+  final override Block getBlockImpl() { none() }
 }

 class ScopeResolutionMethodCall extends MethodCallImpl, TScopeResolutionMethodCall {
@@ -76,6 +82,8 @@ class ScopeResolutionMethodCall extends MethodCallImpl, TScopeResolutionMethodCa
  final override Expr getArgumentImpl(int n) { none() }

  final override int getNumberOfArgumentsImpl() { result = 0 }
+
+  final override Block getBlockImpl() { none() }
 }

 class RegularMethodCall extends MethodCallImpl, TRegularMethodCall {
@@ -114,7 +122,7 @@ class RegularMethodCall extends MethodCallImpl, TRegularMethodCall {
      count(g.getArguments().getChild(_)) + count(g.getMethod().(Ruby::ArgumentList).getChild(_))
  }

-  final override Block getBlock() { toGenerated(result) = g.getBlock() }
+  final override Block getBlockImpl() { toGenerated(result) = g.getBlock() }
 }

 class ElementReferenceImpl extends MethodCallImpl, TElementReference {
@@ -129,9 +137,13 @@ class ElementReferenceImpl extends MethodCallImpl, TElementReference {
  final override int getNumberOfArgumentsImpl() { result = count(g.getChild(_)) }

  final override string getMethodNameImpl() { result = "[]" }
+
+  final override Block getBlockImpl() { none() }
 }

-class TokenSuperCall extends SuperCall, MethodCallImpl, TTokenSuperCall {
+abstract class SuperCallImpl extends MethodCallImpl, TSuperCall { }
+
+class TokenSuperCall extends SuperCallImpl, TTokenSuperCall {
  private Ruby::Super g;

  TokenSuperCall() { this = TTokenSuperCall(g) }
@@ -143,9 +155,11 @@ class TokenSuperCall extends SuperCall, MethodCallImpl, TTokenSuperCall {
  final override Expr getArgumentImpl(int n) { none() }

  final override int getNumberOfArgumentsImpl() { result = 0 }
+
+  final override Block getBlockImpl() { none() }
 }

-class RegularSuperCall extends SuperCall, MethodCallImpl, TRegularSuperCall {
+class RegularSuperCall extends SuperCallImpl, TRegularSuperCall {
  private Ruby::Call g;

  RegularSuperCall() { this = TRegularSuperCall(g) }
@@ -158,10 +172,14 @@ class RegularSuperCall extends SuperCall, MethodCallImpl, TRegularSuperCall {

  final override int getNumberOfArgumentsImpl() { result = count(g.getArguments().getChild(_)) }

-  final override Block getBlock() { toGenerated(result) = g.getBlock() }
+  final override Block getBlockImpl() { toGenerated(result) = g.getBlock() }
 }

-class YieldCallImpl extends CallImpl, YieldCall {
+class YieldCallImpl extends CallImpl, TYieldCall {
+  Ruby::Yield g;
+
+  YieldCallImpl() { this = TYieldCall(g) }
+
  final override Expr getArgumentImpl(int n) { toGenerated(result) = g.getChild().getChild(n) }

  final override int getNumberOfArgumentsImpl() { result = count(g.getChild().getChild(_)) }
--- a/ql/lib/codeql/ruby/ast/internal/Module.qll
+++ b/ql/lib/codeql/ruby/ast/internal/Module.qll
@@ -220,7 +220,7 @@ private string resolveScopeExpr(ConstantReadAccess c, int priority) {
  )
 }

-pragma[noinline]
+pragma[nomagic]
 private string resolveScopeExprConstantReadAccess(ConstantReadAccess c, int priority, string name) {
  result = resolveScopeExpr(c.getScopeExpr(), priority) and
  name = c.getName()
--- a/ql/lib/codeql/ruby/ast/internal/Operation.qll
+++ b/ql/lib/codeql/ruby/ast/internal/Operation.qll
@@ -21,6 +21,8 @@ abstract class UnaryOperationImpl extends OperationImpl, MethodCallImpl, TUnaryO
  final override Expr getArgumentImpl(int n) { none() }

  final override int getNumberOfArgumentsImpl() { result = 0 }
+
+  final override Block getBlockImpl() { none() }
 }

 class UnaryOperationGenerated extends UnaryOperationImpl {
@@ -77,6 +79,8 @@ abstract class BinaryOperationImpl extends OperationImpl, MethodCallImpl, TBinar
  final override Expr getArgumentImpl(int n) { n = 0 and result = this.getRightOperandImpl() }

  final override int getNumberOfArgumentsImpl() { result = 1 }
+
+  final override Block getBlockImpl() { none() }
 }

 class BinaryOperationReal extends BinaryOperationImpl {
--- a/ql/lib/codeql/ruby/ast/internal/Variable.qll
+++ b/ql/lib/codeql/ruby/ast/internal/Variable.qll
@@ -282,13 +282,13 @@ private module Cached {
  }

  cached
-  predicate access(Ruby::Identifier access, VariableReal::Range variable) {
+  predicate access(Ruby::Identifier access, VariableReal variable) {
    exists(string name |
-      variable.getName() = name and
+      variable.getNameImpl() = name and
      name = access.getValue()
    |
-      variable.getDeclaringScope() = scopeOf(access) and
-      not access.getLocation().strictlyBefore(variable.getLocation()) and
+      variable.getDeclaringScopeImpl() = scopeOf(access) and
+      not access.getLocation().strictlyBefore(variable.getLocationImpl()) and
      // In case of overlapping parameter names, later parameters should not
      // be considered accesses to the first parameter
      if parameterAssignment(_, _, access)
@@ -296,7 +296,7 @@ private module Cached {
      else any()
      or
      exists(Scope::Range declScope |
-        variable.getDeclaringScope() = declScope and
+        variable.getDeclaringScopeImpl() = declScope and
        inherits(scopeOf(access), name, declScope)
      )
    )
@@ -366,126 +366,117 @@ private predicate inherits(Scope::Range scope, string name, Scope::Range outer)
  )
 }

-class TVariableReal = TGlobalVariable or TClassVariable or TInstanceVariable or TLocalVariableReal;
+abstract class VariableImpl extends TVariable {
+  abstract string getNameImpl();

-module VariableReal {
-  class Range extends TVariableReal {
-    abstract string getName();
+  final string toString() { result = this.getNameImpl() }

-    string toString() { result = this.getName() }
-
-    abstract Location getLocation();
-
-    abstract Scope::Range getDeclaringScope();
-  }
+  abstract Location getLocationImpl();
 }

+class TVariableReal = TGlobalVariable or TClassVariable or TInstanceVariable or TLocalVariableReal;
+
 class TLocalVariable = TLocalVariableReal or TLocalVariableSynth;

-module LocalVariable {
-  class Range extends VariableReal::Range, TLocalVariableReal {
-    private Scope::Range scope;
-    private string name;
-    private Ruby::Identifier i;
+/**
+ * This class only exists to avoid negative recursion warnings. Ideally,
+ * we would use `VariableImpl` directly, but that results in incorrect
+ * negative recursion warnings. Adding new root-defs for the predicates
+ * below works around this.
+ */
+abstract class VariableReal extends TVariableReal {
+  abstract string getNameImpl();

-    Range() { this = TLocalVariableReal(scope, name, i) }
+  abstract Location getLocationImpl();

-    final override string getName() { result = name }
+  abstract Scope::Range getDeclaringScopeImpl();

-    final override Location getLocation() { result = i.getLocation() }
-
-    final override Scope::Range getDeclaringScope() { result = scope }
-
-    final VariableAccess getDefiningAccess() { toGenerated(result) = i }
-  }
+  final string toString() { result = this.getNameImpl() }
 }

-class VariableReal extends Variable, TVariableReal instanceof VariableReal::Range {
-  final override string getName() { result = VariableReal::Range.super.getName() }
+// Convert extensions of `VariableReal` into extensions of `VariableImpl`
+private class VariableRealAdapter extends VariableImpl, TVariableReal instanceof VariableReal {
+  final override string getNameImpl() { result = VariableReal.super.getNameImpl() }

-  final override Location getLocation() { result = VariableReal::Range.super.getLocation() }
-
-  final override Scope getDeclaringScope() {
-    toGenerated(result) = VariableReal::Range.super.getDeclaringScope()
-  }
+  final override Location getLocationImpl() { result = VariableReal.super.getLocationImpl() }
 }

-class LocalVariableReal extends VariableReal, LocalVariable, TLocalVariableReal instanceof LocalVariable::Range {
-  final override LocalVariableAccessReal getAnAccess() { result.getVariable() = this }
+class LocalVariableReal extends VariableReal, TLocalVariableReal {
+  private Scope::Range scope;
+  private string name;
+  private Ruby::Identifier i;

-  final override VariableAccess getDefiningAccess() {
-    result = LocalVariable::Range.super.getDefiningAccess()
-  }
+  LocalVariableReal() { this = TLocalVariableReal(scope, name, i) }
+
+  final override string getNameImpl() { result = name }
+
+  final override Location getLocationImpl() { result = i.getLocation() }
+
+  final override Scope::Range getDeclaringScopeImpl() { result = scope }
+
+  final VariableAccess getDefiningAccessImpl() { toGenerated(result) = i }
 }

-class LocalVariableSynth extends LocalVariable, TLocalVariableSynth {
+class LocalVariableSynth extends VariableImpl, TLocalVariableSynth {
  private AstNode n;
  private int i;

  LocalVariableSynth() { this = TLocalVariableSynth(n, i) }

-  final override string getName() {
+  final override string getNameImpl() {
    exists(int level | level = desugarLevel(n) |
      if level > 0 then result = "__synth__" + i + "__" + level else result = "__synth__" + i
    )
  }

-  final override Location getLocation() { result = n.getLocation() }
-
-  final override Scope getDeclaringScope() { none() } // not relevant for synthesized variables
+  final override Location getLocationImpl() { result = n.getLocation() }
 }

-module GlobalVariable {
-  class Range extends VariableReal::Range, TGlobalVariable {
-    private string name;
+class GlobalVariableImpl extends VariableReal, TGlobalVariable {
+  private string name;

-    Range() { this = TGlobalVariable(name) }
+  GlobalVariableImpl() { this = TGlobalVariable(name) }

-    final override string getName() { result = name }
+  final override string getNameImpl() { result = name }

-    final override Location getLocation() { none() }
+  final override Location getLocationImpl() { none() }

-    final override Scope::Range getDeclaringScope() { none() }
-  }
+  final override Scope::Range getDeclaringScopeImpl() { none() }
 }

-module InstanceVariable {
-  class Range extends VariableReal::Range, TInstanceVariable {
-    private ModuleBase::Range scope;
-    private boolean instance;
-    private string name;
-    private Ruby::AstNode decl;
+class InstanceVariableImpl extends VariableReal, TInstanceVariable {
+  private ModuleBase::Range scope;
+  private boolean instance;
+  private string name;
+  private Ruby::AstNode decl;

-    Range() { this = TInstanceVariable(scope, name, instance, decl) }
+  InstanceVariableImpl() { this = TInstanceVariable(scope, name, instance, decl) }

-    final override string getName() { result = name }
+  final override string getNameImpl() { result = name }

-    final predicate isClassInstanceVariable() { instance = false }
+  final predicate isClassInstanceVariable() { instance = false }

-    final override Location getLocation() { result = decl.getLocation() }
+  final override Location getLocationImpl() { result = decl.getLocation() }

-    final override Scope::Range getDeclaringScope() { result = scope }
-  }
+  final override Scope::Range getDeclaringScopeImpl() { result = scope }
 }

-module ClassVariable {
-  class Range extends VariableReal::Range, TClassVariable {
-    private ModuleBase::Range scope;
-    private string name;
-    private Ruby::AstNode decl;
+class ClassVariableImpl extends VariableReal, TClassVariable {
+  private ModuleBase::Range scope;
+  private string name;
+  private Ruby::AstNode decl;

-    Range() { this = TClassVariable(scope, name, decl) }
+  ClassVariableImpl() { this = TClassVariable(scope, name, decl) }

-    final override string getName() { result = name }
+  final override string getNameImpl() { result = name }

-    final override Location getLocation() { result = decl.getLocation() }
+  final override Location getLocationImpl() { result = decl.getLocation() }

-    final override Scope::Range getDeclaringScope() { result = scope }
-  }
+  final override Scope::Range getDeclaringScopeImpl() { result = scope }
 }

-abstract class VariableAccessImpl extends VariableAccess {
-  abstract Variable getVariableImpl();
+abstract class VariableAccessImpl extends Expr, TVariableAccess {
+  abstract VariableImpl getVariableImpl();
 }

 module LocalVariableAccess {
@@ -505,8 +496,9 @@ class TVariableAccessReal =
  TLocalVariableAccessReal or TGlobalVariableAccess or TInstanceVariableAccess or
      TClassVariableAccess;

-private class LocalVariableAccessReal extends VariableAccessImpl, LocalVariableAccess,
-  TLocalVariableAccessReal {
+abstract class LocalVariableAccessImpl extends VariableAccessImpl, TLocalVariableAccess { }
+
+private class LocalVariableAccessReal extends LocalVariableAccessImpl, TLocalVariableAccessReal {
  private Ruby::Identifier g;
  private LocalVariable v;

@@ -517,8 +509,7 @@ private class LocalVariableAccessReal extends VariableAccessImpl, LocalVariableA
  final override string toString() { result = g.getValue() }
 }

-private class LocalVariableAccessSynth extends VariableAccessImpl, LocalVariableAccess,
-  TLocalVariableAccessSynth {
+private class LocalVariableAccessSynth extends LocalVariableAccessImpl, TLocalVariableAccessSynth {
  private LocalVariable v;

  LocalVariableAccessSynth() { this = TLocalVariableAccessSynth(_, _, v) }
@@ -529,11 +520,12 @@ private class LocalVariableAccessSynth extends VariableAccessImpl, LocalVariable
 }

 module GlobalVariableAccess {
-  predicate range(Ruby::GlobalVariable n, GlobalVariable v) { n.getValue() = v.getName() }
+  predicate range(Ruby::GlobalVariable n, GlobalVariableImpl v) { n.getValue() = v.getNameImpl() }
 }

-private class GlobalVariableAccessReal extends GlobalVariableAccess, VariableAccessImpl,
-  TGlobalVariableAccessReal {
+abstract class GlobalVariableAccessImpl extends VariableAccessImpl, TGlobalVariableAccess { }
+
+private class GlobalVariableAccessReal extends GlobalVariableAccessImpl, TGlobalVariableAccessReal {
  private Ruby::GlobalVariable g;
  private GlobalVariable v;

@@ -544,8 +536,7 @@ private class GlobalVariableAccessReal extends GlobalVariableAccess, VariableAcc
  final override string toString() { result = g.getValue() }
 }

-private class GlobalVariableAccessSynth extends GlobalVariableAccess, VariableAccessImpl,
-  TGlobalVariableAccessSynth {
+private class GlobalVariableAccessSynth extends GlobalVariableAccessImpl, TGlobalVariableAccessSynth {
  private GlobalVariable v;

  GlobalVariableAccessSynth() { this = TGlobalVariableAccessSynth(_, _, v) }
@@ -559,7 +550,9 @@ module InstanceVariableAccess {
  predicate range(Ruby::InstanceVariable n, InstanceVariable v) { instanceVariableAccess(n, v) }
 }

-private class InstanceVariableAccessReal extends InstanceVariableAccess, VariableAccessImpl,
+abstract class InstanceVariableAccessImpl extends VariableAccessImpl, TInstanceVariableAccess { }
+
+private class InstanceVariableAccessReal extends InstanceVariableAccessImpl,
  TInstanceVariableAccessReal {
  private Ruby::InstanceVariable g;
  private InstanceVariable v;
@@ -571,7 +564,7 @@ private class InstanceVariableAccessReal extends InstanceVariableAccess, Variabl
  final override string toString() { result = g.getValue() }
 }

-private class InstanceVariableAccessSynth extends InstanceVariableAccess, VariableAccessImpl,
+private class InstanceVariableAccessSynth extends InstanceVariableAccessImpl,
  TInstanceVariableAccessSynth {
  private InstanceVariable v;

@@ -586,8 +579,9 @@ module ClassVariableAccess {
  predicate range(Ruby::ClassVariable n, ClassVariable v) { classVariableAccess(n, v) }
 }

-private class ClassVariableAccessReal extends ClassVariableAccess, VariableAccessImpl,
-  TClassVariableAccessReal {
+abstract class ClassVariableAccessRealImpl extends VariableAccessImpl, TClassVariableAccess { }
+
+private class ClassVariableAccessReal extends ClassVariableAccessRealImpl, TClassVariableAccessReal {
  private Ruby::ClassVariable g;
  private ClassVariable v;

@@ -598,7 +592,7 @@ private class ClassVariableAccessReal extends ClassVariableAccess, VariableAcces
  final override string toString() { result = g.getValue() }
 }

-private class ClassVariableAccessSynth extends ClassVariableAccess, VariableAccessImpl,
+private class ClassVariableAccessSynth extends ClassVariableAccessRealImpl,
  TClassVariableAccessSynth {
  private ClassVariable v;

--- a/ql/test/library-tests/controlflow/graph/Cfg.expected
+++ b/ql/test/library-tests/controlflow/graph/Cfg.expected
@@ -41,8 +41,8 @@ break_ensure.rb:
 #-----|  -> do ...

 #    3| ... > ...
-#-----| true -> break
 #-----| raise -> for ... in ...
+#-----| true -> break
 #-----| false -> if ...

 #    3| element
@@ -580,12 +580,12 @@ cfg.html.erb:
 #   12| self
 #-----|  -> call to a

-#   12| :id
-#-----|  -> "a"
-
 #   12| Pair
 #-----|  -> call to link_to

+#   12| :id
+#-----|  -> "a"
+
 #   12| "a"
 #-----|  -> Pair

@@ -1493,12 +1493,12 @@ cfg.rb:
 #   97| "d"
 #-----|  -> Pair

-#   97| :e
-#-----|  -> "f"
-
 #   97| Pair
 #-----|  -> {...}

+#   97| :e
+#-----|  -> "f"
+
 #   97| "f"
 #-----|  -> Pair

@@ -1826,6 +1826,9 @@ cfg.rb:
 #  134| EmptyModule
 #-----|  -> ... rescue ...

+#  136| ... rescue ...
+#-----|  -> 1
+
 #  136| ... / ...
 #-----| raise -> self
 #-----|  -> __synth__0
@@ -1833,9 +1836,6 @@ cfg.rb:
 #  136| 1
 #-----|  -> 0

-#  136| ... rescue ...
-#-----|  -> 1
-
 #  136| 0
 #-----|  -> ... / ...