Model `defer`ed calls so the call runs at function exit rather than inline
at the `defer` statement, reproducing the previous control-flow semantics:
- Add a per-defer "defer-invoke" node for the deferred call.
- deferExitStep wires normal-exit predecessors (return nodes and body
fall-through) through the active deferred-call invocations in
last-in-first-out order, then on to the normal exit target (the
result-read epilogue for named results, or the normal exit node).
- The chain is reachability-gated using the defer-free successor relation
(succIgnoringDeferExit / isInOrderNode), so only deferred calls that were
actually registered on a path are run on that path.
- overridesCallableBodyExit / overridesCallableEndAbruptCompletion suppress
the default body-exit and return routing for functions containing
`defer`, so the epilogue is interposed instead.
The standard-library structured logger `log/slog` (Go 1.21+) was not
modeled, so `go/log-injection` and `go/clear-text-logging` were blind to
any code that logs through it.
Model its logging functions and `*slog.Logger` methods — `Debug`, `Info`,
`Warn`, `Error`, their `Context` variants, and `Log`/`LogAttrs` — as
`log-injection` sinks (the kind that feeds `LoggerCall`, powering both
queries). Adds `log/slog` cases to the `LoggerCall` library test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Extend synthetic uncertain reads to function exits of any function
that writes a captured variable, not just the declaring function.
This ensures writes to captured variables inside closures remain
live (matching the old `v.isCaptured()` liveness shortcut).
- Uncomment toString overrides for SsaExplicitDefinition, SsaVariableCapture,
SsaPhiNode, and SsaVariable to restore original output formats.
- Revert test expected files to pre-test-changes state matching the
correct toString formats and capture variable results.
Agent-Logs-Url: https://github.com/github/codeql/sessions/6dbf9d42-b2e2-42a2-984b-8ea31df4e633
Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
It was the number of result declarations, which is
different from the number of results when one
result declaration declares more than one
variable, as in `x, y int`.
