CPP - fields of classes inside namespaces are not parsed correctly in the AST

[Da5hes]

During a modeling of an issue I've encountered a bug:

a.cpp:

#include "b.h"

int gaga_name_map::B::pv(int log, int PCWSTR, int rq)

{
    bool a = mbo;
    return a;
}



int main()
{
    return 0;
}

b.h:

#pragma once

namespace gaga_name_map {
    class B  {
    public:
        static
            int
            g(int log, int PCWSTR, int rq);

    public:
        bool mbo;

    private:
       int pv(int  log, int PCWSTR, int rq);
    };
}

expected result:
the bool 'mbo' is parsed as a filed and/or as a definition in the AST

actual result:
the bool 'mbo' definition in b.h is getting parsed as a MoveAssignmentOp in the AST as can be seen in the photo

this reproduces in small and big codebases with both the latest CLI as well as older versions

[bdrodes]

As an anecdote, I have seen code bases where CodeQL is reporting over 200 thousand assignment operators function exist, which I have assumed is bogus, and this seems to be related if so.

[jketema]

Hi @Da5hes. Thanks for your report. The AST viewer only displays functions and not type definitions such as a class definition. In this particular case the compiler frontend we're using will generate copy and move assignment operators per the rules for implicitly declared ones that can be found, e.g., here and here. And, you will see these in the AST.

Note that compiler generated operators/functions can be excluded from your queries using Function::isCompilerGenerated():

codeql/cpp/ql/lib/semmle/code/cpp/Function.qll

Lines 79 to 80 in a520de3

	/** Holds if this function is generated by the compiler. */
	predicate isCompilerGenerated() { compgenerated(underlyingElement(this)) }

[Da5hes]

Hi @jketema.

Thanks for clarifying on the copy and move operators.
My issue is not solely in the AST viewer per say but with the fact that i am unable to select this boolean definition in any query
for instance, I would expect to be able to catch it with something like:

from Field f
where f.hasdefinition() and not f.hasInitializer()
select f

or with something like a Declaration,
in any case - it seems impossible to select this boolean thus making it impossible to perform any further analysis i.e flow or taint in such cases - or am I missing something?

[jketema]

Running a slight variant of your query:

from Field f
where f.hasDefinition() and not f.hasInitializer() and exists(f.getFile().getRelativePath())
select f

I get:

#	f
1	mbo

So this works for me. Would you be willing to share the database you created and the build-tracer.log file, to help diagnose this further?

[github-actions]

This issue is stale because it has been open 14 days with no activity. Comment or remove the Stale label in order to avoid having this issue closed in 7 days.

[github-actions]

This issue was closed because it has been inactive for 7 days.