C++: Implement MaD support for flow through perfect-forwarding functions by MathiasVP · Pull Request #22532 · github/codeql

MathiasVP · 2026-09-09T10:00:59Z

This PR implements the necessary library changes to support MaD summaries for functions such as vector::emplace_back or make_unique. These functions receive a list of arguments and then forwards them to a constructor call.

@hvitved had a super cool implementation idea. Given:

struct Foo {
  Foo(int);
};

std::vector<Foo> v;

we model a call such as v.emplace_back(42) as:

v.emplace_back(42, &Foo)

and give emplace_back two summaries:

Argument[0] -> Argument[1].Parameter[0]
Argument[1].Parameter[this] -> Argument[this].Element

The first summary states that 42 goes into the 0'th parameter of the Foo constructor, and the second summary states that the this parameter of the constructed object goes into the this argument of v with an Element content.

(A few lines I told in the above paragraph:

You cannot take the address of a constructor in C++. But that doesn't mean we cannot use it as an implementation detail!
We don't actually use the last argument as the argument position of the synthetic function pointer for the constructor. This PR adds a new argument position which we name forward in MaD. I'm happy to change this name to something else if anyone has any strong opinions about this.)

In order to know which constructor to forward to we need to know what type is being constructed. For example:

std::vector<Foo> v;
v.emplace_back(42); // calls `Foo(42)`
v.emplace(v.begin(), 42); // calls `Foo(42)`
std::make_unique<Foo> p(42); // calls `Foo(42)`

To know which type is constructed we add a new extensible called forwardsModel with rows very much like what we have for MaD summaries. For example, I've added this as row as a test:

["", "Container<T>", True, "emplace<Args>", "(Args &&)", "", "0", "T", "manual"]

this says that a call to Container<T>::emplace(args0, ..., argsN) forwards its arguments to a call to T(args0, ..., argsN). The 0 specifies an offset so we can support cases like v.emplace(v.begin(), 42) where we need to ignore the first argument.

This PR doesn't actually add any non-test MaD summaries. I'll delay that to a future PR.

In the upcoming commits we will add a new extensional predicate which allows us to model that a function forwards it arguments to the constructor of a given type. This initial commit adds the test YAML models for this new extensional predicate.

signature to implement the forwardsModel. So instead of recursing on the number of elements in the signature we will recurse on the number of elements in the type (or name) columns. For well-formed models this will be equivalent.

Copilot

Copilot review overview

🟡 Changes recommended

Constructor arity, overload resolution, and positional-argument counting can currently produce missing or spurious flow targets.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 6 · 2

New issues introduced by this change (8)

Severity	Finding
	`cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll` — Make the concrete-type fallback exclusive. When `constructorType` names a template placeholder such…
	`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll` — Constrain `numberOfForwardedArguments` to the constructor's accepted arity. As written, a…
	`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll` — Removing references and requiring type equality does not reproduce constructor overload resolution.…
	`cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll` — Count positional operands rather than their defining instructions. QL deduplicates equal result…
	`cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll` — Count positional operands rather than their defining instructions. QL deduplicates equal result…
	`cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll` — Count positional operands rather than their defining instructions. QL deduplicates equal result…
	`cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll` — Document the semantics of the three new forwarding-specific columns. The schema lists `start`,…
	`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll` — Use “never mind” as two words in this parenthetical phrase.

What changed in this PR

Adds MaD support for modeling data flow through perfect-forwarding C++ functions into constructors.

Changes:

Introduces forwardsModel and synthetic constructor argument positions.
Adds positional-argument and value-category indirection helpers.
Adds forwarding and default-argument test coverage.

File	Description
`cpp/ql/test/library-tests/dataflow/external-models/test.cpp`	Adds forwarding scenarios.
`cpp/ql/test/library-tests/dataflow/external-models/sources.expected`	Updates expected sources.
`cpp/ql/test/library-tests/dataflow/external-models/sinks.expected`	Updates expected sinks.
`cpp/ql/test/library-tests/dataflow/external-models/flow.ext.yml`	Defines test forwarding models.
`cpp/ql/test/library-tests/dataflow/external-models/flow.expected`	Updates expected flow graph.
`cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll`	Adds positional-argument helpers.
`cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll`	Adds positional-argument helpers.
`cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll`	Adds positional-argument helpers.
`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll`	Separates glvalue/prvalue indirections.
`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll`	Resolves synthetic constructor calls.
`cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowNodes.qll`	Adds forwarding data-flow nodes.
`cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll`	Decodes forwarding positions.
`cpp/ql/lib/semmle/code/cpp/dataflow/internal/ExternalFlowExtensions.qll`	Declares `forwardsModel`.
`cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll`	Interprets forwarding models and summaries.
`cpp/ql/lib/ext/empty.model.yml`	Initializes the new extensible predicate.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

MathiasVP · 2026-09-09T10:23:28Z

+      i < numberOfForwardedArguments and
+      stripReferences(call.getPositionalArgument(start + i).getResultType()) =
+        stripReferences(constructor.getParameter(i).getUnspecifiedType())


Yeah, I'm not going to implement full C++ overload resolution in this PR. So I'll just leave this as-is for now.

C++: Accept Copilot suggestion Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

… many parameters as the number of forwarded arguments.

MathiasVP · 2026-09-09T11:10:19Z

@hvitved I'm finally done responding to Copilot's (really excellent!) review comments. It should be all good now 🤞

MathiasVP added 7 commits September 9, 2026 09:01

C++: Add tests with missing flow.

1b41bae

In the upcoming commits we will add a new extensional predicate which allows us to model that a function forwards it arguments to the constructor of a given type. This initial commit adds the test YAML models for this new extensional predicate.

C++: Add a missing utility predicate on Call instructions.

0169e18

C++: Sync identical files.

3777020

C++: Small refactor.

77bb230

C++: Add MaD support for models that specify argument forwarding.

48de4cb

C++: Accept test changes.

4f2fc96

MathiasVP mentioned this pull request Sep 9, 2026

C++: Implement MaD support for flow through perfect-forwarding functions #22525

Closed

github-advanced-security Bot found potential problems Sep 9, 2026

View reviewed changes

Comment thread cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll Dismissed

MathiasVP added no-change-note-required This PR does not need a change note C++ labels Sep 9, 2026

MathiasVP marked this pull request as ready for review September 9, 2026 10:08

MathiasVP requested a review from a team as a code owner September 9, 2026 10:08

Copilot AI balanced review requested due to automatic review settings September 9, 2026 10:08

Copilot started reviewing on behalf of MathiasVP September 9, 2026 10:09 View session

Copilot AI reviewed Sep 9, 2026

View reviewed changes

MathiasVP and others added 6 commits September 9, 2026 11:26

Apply batched suggestions from code review

db2a462

C++: Accept Copilot suggestion Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

C++: Respond to Copilot comments.

908e32b

C++: Autoformat after Copilot suggestions.

10981ae

C++: Fix spelling.

1511488

C++: Add false positive from lack of overload handling.

cca9f3f

C++: Fix FP by ensuring that the targeted constructor has at least as…

246c486

… many parameters as the number of forwarded arguments.

Navigation Menu

Uh oh!

C++: Implement MaD support for flow through perfect-forwarding functions - #22532

C++: Implement MaD support for flow through perfect-forwarding functions#22532
MathiasVP wants to merge 13 commits into
github:mainfrom
MathiasVP:flow-through-forwards-using-callbacks-3

MathiasVP commented Sep 9, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

MathiasVP Sep 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MathiasVP commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

MathiasVP commented Sep 9, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

MathiasVP Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MathiasVP commented Sep 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants