Anders Fugmann f8f1472641 Kotlin: span assignment-desugared setter calls through the assigned value
An assignment to a property, delegated property or `@JvmStatic` property
(`lhs = rhs`) desugars to a setter call. The two frontends anchor that
synthesised call differently:

  - K1 records the call (and its synthetic implicit-`this` receiver and any
    synthetic reflection arguments) at the assignment's left-hand side only
    (`varResource0 = 3` -> `37:9:37:20`, `curValue = value` -> `29:17:29:24`).
  - K2 spans the whole assignment, through the assigned value
    (`37:9:37:24`, `29:17:29:32`).

The setter call *is* the desugaring of the whole assignment, so K2's
whole-assignment span is the more intuitive, information-preserving one: it keeps
the call on the source construct it represents rather than dropping the
right-hand side. This matches the existing array-`set` EQ-origin widening
precedent, which already widens K1 onto the whole-assignment span.

We converge K1 onto the K2 span with a scoped offset remap set only while
extracting the setter call, keyed on the call's exact offset pair. Because the
compiler gives the synthetic implicit-`this` receiver and the synthetic
reflection arguments the same offsets as the call, the single remap widens them
along with the `MethodCall` node, while real source arguments (the assigned
value itself, e.g. the `2` / `3` / `value`) keep their own offsets and are
unaffected. The remap fires only for an `IrStatementOrigin.EQ` call whose last
value argument (the assigned value) ends past the call's own end offset, so it is
a no-op under K2 (where the call already spans the assigned value) and for every
non-assignment call.

Tradeoff: the direction is fixed (K1 -> K2) because K1 cannot, from its raw IR,
recover the whole-assignment span for these synthetic children; K2 produces it
natively. That is acceptable here because the whole-assignment span is the more
correct one on the merits and is already the established convention for array
`set`.

Expected updates (K1 only; K2 already emitted these):
  - library-tests/exprs/exprs.expected (delegated + direct property setters)
  - library-tests/generic-instance-methods/test.expected (setStored)
  - library-tests/jvmstatic-annotation/test.expected (@JvmStatic setters)

Both suites relearned; all tests pass. Divergence 798 -> 758 rows.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 86bfc022-3ecc-4746-ba23-3b76c4e4c3e4
2026-07-14 22:35:07 +02:00
2022-10-20 08:21:02 -04:00
2026-05-27 17:41:44 +02:00
2026-07-09 03:03:43 +00:00
2026-06-29 12:05:42 +02:00
2026-02-10 13:44:04 +01:00
2018-09-23 16:24:31 -07:00
2025-09-25 14:03:39 +01:00
2026-05-12 11:24:35 +00:00
2026-05-08 13:41:45 +00:00
2022-04-12 12:40:59 +02:00
2024-05-07 13:09:08 +01:00

CodeQL

This open source repository contains the standard CodeQL libraries and queries that power GitHub Advanced Security and the other application security products that GitHub makes available to its customers worldwide.

How do I learn CodeQL and run queries?

There is extensive documentation about the CodeQL language, writing CodeQL using the CodeQL extension for Visual Studio Code and using the CodeQL CLI.

Contributing

We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our contributing guidelines. You can also consult our style guides to learn how to format your code for consistency and clarity, how to write query metadata, and how to write query help documentation for your query.

For information on contributing to CodeQL documentation, see the "contributing guide" for docs.

License

The code in this repository is licensed under the MIT License by GitHub.

The CodeQL CLI (including the CodeQL engine) is hosted in a different repository and is licensed separately. If you'd like to use the CodeQL CLI to analyze closed-source code, you will need a separate commercial license; please contact us for further help.

Visual Studio Code integration

If you use Visual Studio Code to work in this repository, there are a few integration features to make development easier.

CodeQL for Visual Studio Code

You can install the CodeQL for Visual Studio Code extension to get syntax highlighting, IntelliSense, and code navigation for the QL language, as well as unit test support for testing CodeQL libraries and queries.

Tasks

The .vscode/tasks.json file defines custom tasks specific to working in this repository. To invoke one of these tasks, select the Terminal | Run Task... menu option, and then select the desired task from the dropdown. You can also invoke the Tasks: Run Task command from the command palette.

Description
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
Readme MIT 21 GiB
Languages
CodeQL 32.2%
Kotlin 27.1%
C# 16.9%
Java 7.6%
Python 4.6%
Other 11.4%