From a3b33812268179fe72db296aa02f9703af07b925 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan <owen-mc@github.com>
Date: Thu, 9 Jul 2026 15:24:59 +0100
Subject: [PATCH] Only make implicit varargs slice node for reachable calls

---
 go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll b/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
index 7069cf36bd0..98f674d46ed 100644
--- a/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
+++ b/go/ql/lib/semmle/go/dataflow/internal/DataFlowNodes.qll
@@ -13,7 +13,10 @@ private newtype TNode =
   MkInstructionNode(IR::Instruction insn) or
   MkSsaNode(SsaDefinition ssa) or
   MkGlobalFunctionNode(Function f) or
-  MkImplicitVarargsSlice(CallExpr c) { c.hasImplicitVarargs() } or
+  MkImplicitVarargsSlice(IR::EvalInstruction ins) {
+    // We only use CallExprs with an EvalInstruction to guarantee reachability.
+    ins.getExpr().(CallExpr).hasImplicitVarargs()
+  } or
   MkSliceElementNode(SliceExpr se) or
   MkFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn) or
   MkDefaultPostUpdateNode(IR::Instruction insn) { insnHasPostUpdateNode(insn) }
@@ -430,7 +433,7 @@ module Public {
   class ImplicitVarargsSlice extends Node, MkImplicitVarargsSlice {
     CallNode call;
 
-    ImplicitVarargsSlice() { this = MkImplicitVarargsSlice(call.getCall()) }
+    ImplicitVarargsSlice() { this = MkImplicitVarargsSlice(call.asInstruction()) }
 
     override ControlFlow::Root getRoot() { result = call.getRoot() }