From fa9eeea302a6fa77b25149bcf59ee4e5d72dd10f Mon Sep 17 00:00:00 2001
From: Robert Marsh <rdmarsh@semmle.com>
Date: Wed, 29 Aug 2018 12:33:50 -0700
Subject: [PATCH] C++: remove implicit this handling in HashCons

---
 .../code/cpp/valuenumbering/HashCons.qll      | 55 ++++++-------------
 1 file changed, 16 insertions(+), 39 deletions(-)

diff --git a/cpp/ql/src/semmle/code/cpp/valuenumbering/HashCons.qll b/cpp/ql/src/semmle/code/cpp/valuenumbering/HashCons.qll
index d3542bcafe7..82d757c5aca 100644
--- a/cpp/ql/src/semmle/code/cpp/valuenumbering/HashCons.qll
+++ b/cpp/ql/src/semmle/code/cpp/valuenumbering/HashCons.qll
@@ -56,20 +56,23 @@ private cached newtype HCBase =
   }
   or
   HC_FieldAccess(HashCons s, Field f) {
-    mk_DotFieldAccess(s,f,_) or
-    mk_PointerFieldAccess_with_deref(s,f,_) or
-    mk_ImplicitThisFieldAccess_with_deref(s,f,_)
+    mk_DotFieldAccess(s,f,_)
   }
   or
   HC_Deref(HashCons p) {
-    mk_Deref(p,_) or
-    mk_PointerFieldAccess(p,_,_) or
-    mk_ImplicitThisFieldAccess_with_qualifier(p,_,_)
+    mk_Deref(p,_)
+  }
+  or
+  HC_PointerFieldAccess(HashCons qual, Field target) {
+    mk_PointerFieldAccess(qual, target, _)
   }
   or
   HC_ThisExpr(Function fcn) {
-    mk_ThisExpr(fcn,_) or
-    mk_ImplicitThisFieldAccess(fcn,_,_)
+    mk_ThisExpr(fcn,_)
+  }
+  or
+  HC_ImplicitThisFieldAccess (Function fcn, Field target){
+    mk_ImplicitThisFieldAccess(fcn, target, _)
   }
   or
   HC_Conversion(Type t, HashCons child) { mk_Conversion(t, child, _) }
@@ -368,17 +371,6 @@ private predicate mk_PointerFieldAccess(
   qualifier = hashCons(access.getQualifier().getFullyConverted())
 }
 
-/*
- * `obj->field` is equivalent to `(*obj).field`, so we need to wrap an
- * extra `HC_Deref` around the qualifier.
- */
-private predicate mk_PointerFieldAccess_with_deref (HashCons new_qualifier, Field target,
-  PointerFieldAccess access) {
-  exists (HashCons qualifier
-  | mk_PointerFieldAccess(qualifier, target, access) and
-    new_qualifier = HC_Deref(qualifier))
-}
-
 private predicate analyzableImplicitThisFieldAccess(ImplicitThisFieldAccess access) {
   strictcount (access.getTarget()) = 1 and
   strictcount (access.getEnclosingFunction()) = 1
@@ -391,21 +383,6 @@ private predicate mk_ImplicitThisFieldAccess(Function fcn, Field target,
   fcn = access.getEnclosingFunction()
 }
 
-private predicate mk_ImplicitThisFieldAccess_with_qualifier( HashCons qualifier, Field target,
-  ImplicitThisFieldAccess access) {
-  exists (Function fcn
-  | mk_ImplicitThisFieldAccess(fcn, target, access) and
-    qualifier = HC_ThisExpr(fcn))
-}
-
-private predicate mk_ImplicitThisFieldAccess_with_deref(HashCons new_qualifier, Field target,
-  ImplicitThisFieldAccess access) {
-  exists (HashCons qualifier
-  | mk_ImplicitThisFieldAccess_with_qualifier(
-      qualifier, target, access) and
-    new_qualifier = HC_Deref(qualifier))
-}
-
 private predicate analyzableVariable(VariableAccess access) {
   not (access instanceof FieldAccess) and
   strictcount (access.getTarget()) = 1
@@ -976,12 +953,12 @@ cached HashCons hashCons(Expr e) {
     result = HC_FieldAccess(qualifier, target))
   or
   exists (HashCons qualifier, Field target
-  | mk_PointerFieldAccess_with_deref(qualifier, target, e) and
-    result = HC_FieldAccess(qualifier, target))
+  | mk_PointerFieldAccess(qualifier, target, e) and
+    result = HC_PointerFieldAccess(qualifier, target))
   or
-  exists (HashCons qualifier, Field target
-  | mk_ImplicitThisFieldAccess_with_deref(qualifier, target, e) and
-    result = HC_FieldAccess(qualifier, target))
+  exists (Function fcn, Field target
+  | mk_ImplicitThisFieldAccess(fcn, target, e) and
+    result = HC_ImplicitThisFieldAccess(fcn, target))
   or
   exists (Function fcn
   | mk_ThisExpr(fcn, e) and