C++: Do not generate this parameters and read/write side effects from static member functions

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

@@ -324,6 +324,16 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall {
   override predicate hasWriteSideEffect() {
     not expr.getTarget().(SideEffectFunction).hasOnlySpecificWriteSideEffects()
   }
+
+  override Instruction getQualifierResult() {
+    hasQualifier() and
+    result = getQualifier().getResult()
+  }
+
+  override predicate hasQualifier() {
+    exists(getQualifier()) and
+    not exists(MemberFunction func | expr.getTarget() = func and func.isStatic())
+  }
 }
 
 /**

cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll

@@ -463,7 +463,9 @@ newtype TTranslatedElement =
       expr = call.getArgument(n).getFullyConverted()
       or
       expr = call.getQualifier().getFullyConverted() and
-      n = -1
+      n = -1 and
+      // Exclude calls to static member functions. They don't modify the qualifier
+      not exists(MemberFunction func | func = call.getTarget() and func.isStatic())
     ) and
     (
       call.getTarget().(SideEffectFunction).hasSpecificReadSideEffect(n, _) and

cpp/ql/test/library-tests/ir/ir/PrintAST.expected

@@ -4048,6 +4048,27 @@ ir.cpp:
 #-----|         Type = [RValueReferenceType] C &&
 #  628| [Destructor] void C::~C()
 #  628|   params: 
+#-----|   body: [Block] { ... }
+#-----|     0: [ReturnStmt] return ...
+#  628|   destructions: 
+#  628|     0: [DestructorFieldDestruction] destructor field destruction of m_f
+#  628|         Type = [Struct] String
+#  628|         ValueCategory = prvalue
+#  628|       0: [DestructorCall] call to ~String
+#  628|           Type = [VoidType] void
+#  628|           ValueCategory = prvalue
+#  628|         -1: [ImplicitThisFieldAccess] m_f
+#  628|             Type = [Struct] String
+#  628|             ValueCategory = lvalue
+#  628|     1: [DestructorFieldDestruction] destructor field destruction of m_b
+#  628|         Type = [Struct] String
+#  628|         ValueCategory = prvalue
+#  628|       0: [DestructorCall] call to ~String
+#  628|           Type = [VoidType] void
+#  628|           ValueCategory = prvalue
+#  628|         -1: [ImplicitThisFieldAccess] m_b
+#  628|             Type = [Struct] String
+#  628|             ValueCategory = lvalue
 #  630| [MemberFunction] int C::StaticMemberFunction(int)
 #  630|   params: 
 #  630|     0: [Parameter] x
@@ -8545,6 +8566,190 @@ ir.cpp:
 # 1255|               Type = [CharPointerType] char *
 # 1255|               ValueCategory = prvalue(load)
 # 1256|     3: [ReturnStmt] return ...
+# 1258| [CopyAssignmentOperator] A& A::operator=(A const&)
+# 1258|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [LValueReferenceType] const A &
+# 1258| [MoveAssignmentOperator] A& A::operator=(A&&)
+# 1258|   params: 
+#-----|     0: [Parameter] p#0
+#-----|         Type = [RValueReferenceType] A &&
+# 1261| [MemberFunction] void A::static_member(A*, int)
+# 1261|   params: 
+# 1261|     0: [Parameter] a
+# 1261|         Type = [PointerType] A *
+# 1261|     1: [Parameter] x
+# 1261|         Type = [IntType] int
+# 1261|   body: [Block] { ... }
+# 1262|     0: [ExprStmt] ExprStmt
+# 1262|       0: [AssignExpr] ... = ...
+# 1262|           Type = [IntType] int
+# 1262|           ValueCategory = lvalue
+# 1262|         0: [PointerFieldAccess] member
+# 1262|             Type = [IntType] int
+# 1262|             ValueCategory = lvalue
+# 1262|           -1: [VariableAccess] a
+# 1262|               Type = [PointerType] A *
+# 1262|               ValueCategory = prvalue(load)
+# 1262|         1: [VariableAccess] x
+# 1262|             Type = [IntType] int
+# 1262|             ValueCategory = prvalue(load)
+# 1263|     1: [ReturnStmt] return ...
+# 1265| [MemberFunction] void A::static_member_without_def()
+# 1265|   params: 
+# 1268| [TopLevelFunction] A* getAnInstanceOfA()
+# 1268|   params: 
+# 1270| [TopLevelFunction] void test_static_member_functions(int, A*)
+# 1270|   params: 
+# 1270|     0: [Parameter] int_arg
+# 1270|         Type = [IntType] int
+# 1270|     1: [Parameter] a_arg
+# 1270|         Type = [PointerType] A *
+# 1270|   body: [Block] { ... }
+# 1271|     0: [DeclStmt] declaration
+# 1271|       0: [VariableDeclarationEntry] definition of c
+# 1271|           Type = [Class] C
+# 1271|         init: [Initializer] initializer for c
+# 1271|           expr: [ConstructorCall] call to C
+# 1271|               Type = [VoidType] void
+# 1271|               ValueCategory = prvalue
+# 1272|     1: [ExprStmt] ExprStmt
+# 1272|       0: [FunctionCall] call to StaticMemberFunction
+# 1272|           Type = [IntType] int
+# 1272|           ValueCategory = prvalue
+# 1272|         -1: [VariableAccess] c
+# 1272|             Type = [Class] C
+# 1272|             ValueCategory = lvalue
+# 1272|         0: [Literal] 10
+# 1272|             Type = [IntType] int
+# 1272|             Value = [Literal] 10
+# 1272|             ValueCategory = prvalue
+# 1273|     2: [ExprStmt] ExprStmt
+# 1273|       0: [FunctionCall] call to StaticMemberFunction
+# 1273|           Type = [IntType] int
+# 1273|           ValueCategory = prvalue
+# 1273|         0: [Literal] 10
+# 1273|             Type = [IntType] int
+# 1273|             Value = [Literal] 10
+# 1273|             ValueCategory = prvalue
+# 1275|     3: [DeclStmt] declaration
+# 1275|       0: [VariableDeclarationEntry] definition of a
+# 1275|           Type = [Struct] A
+# 1276|     4: [ExprStmt] ExprStmt
+# 1276|       0: [FunctionCall] call to static_member
+# 1276|           Type = [VoidType] void
+# 1276|           ValueCategory = prvalue
+# 1276|         -1: [VariableAccess] a
+# 1276|             Type = [Struct] A
+# 1276|             ValueCategory = lvalue
+# 1276|         0: [AddressOfExpr] & ...
+# 1276|             Type = [PointerType] A *
+# 1276|             ValueCategory = prvalue
+# 1276|           0: [VariableAccess] a
+# 1276|               Type = [Struct] A
+# 1276|               ValueCategory = lvalue
+# 1276|         1: [VariableAccess] int_arg
+# 1276|             Type = [IntType] int
+# 1276|             ValueCategory = prvalue(load)
+# 1277|     5: [ExprStmt] ExprStmt
+# 1277|       0: [FunctionCall] call to static_member
+# 1277|           Type = [VoidType] void
+# 1277|           ValueCategory = prvalue
+# 1277|         0: [AddressOfExpr] & ...
+# 1277|             Type = [PointerType] A *
+# 1277|             ValueCategory = prvalue
+# 1277|           0: [VariableAccess] a
+# 1277|               Type = [Struct] A
+# 1277|               ValueCategory = lvalue
+# 1277|         1: [VariableAccess] int_arg
+# 1277|             Type = [IntType] int
+# 1277|             ValueCategory = prvalue(load)
+# 1279|     6: [ExprStmt] ExprStmt
+# 1279|       0: [FunctionCall] call to static_member
+# 1279|           Type = [VoidType] void
+# 1279|           ValueCategory = prvalue
+# 1279|         -1: [ParenthesisExpr] (...)
+# 1279|             Type = [PointerType] A *
+# 1279|             ValueCategory = prvalue
+# 1279|           expr: [AddressOfExpr] & ...
+# 1279|               Type = [PointerType] A *
+# 1279|               ValueCategory = prvalue
+# 1279|             0: [VariableAccess] a
+# 1279|                 Type = [Struct] A
+# 1279|                 ValueCategory = lvalue
+# 1279|         0: [VariableAccess] a_arg
+# 1279|             Type = [PointerType] A *
+# 1279|             ValueCategory = prvalue(load)
+# 1279|         1: [AddExpr] ... + ...
+# 1279|             Type = [IntType] int
+# 1279|             ValueCategory = prvalue
+# 1279|           0: [VariableAccess] int_arg
+# 1279|               Type = [IntType] int
+# 1279|               ValueCategory = prvalue(load)
+# 1279|           1: [Literal] 2
+# 1279|               Type = [IntType] int
+# 1279|               Value = [Literal] 2
+# 1279|               ValueCategory = prvalue
+# 1280|     7: [ExprStmt] ExprStmt
+# 1280|       0: [FunctionCall] call to static_member
+# 1280|           Type = [VoidType] void
+# 1280|           ValueCategory = prvalue
+# 1280|         -1: [ParenthesisExpr] (...)
+# 1280|             Type = [Struct] A
+# 1280|             ValueCategory = lvalue
+# 1280|           expr: [PointerDereferenceExpr] * ...
+# 1280|               Type = [Struct] A
+# 1280|               ValueCategory = lvalue
+# 1280|             0: [VariableAccess] a_arg
+# 1280|                 Type = [PointerType] A *
+# 1280|                 ValueCategory = prvalue(load)
+# 1280|         0: [AddressOfExpr] & ...
+# 1280|             Type = [PointerType] A *
+# 1280|             ValueCategory = prvalue
+# 1280|           0: [VariableAccess] a
+# 1280|               Type = [Struct] A
+# 1280|               ValueCategory = lvalue
+# 1280|         1: [Literal] 99
+# 1280|             Type = [IntType] int
+# 1280|             Value = [Literal] 99
+# 1280|             ValueCategory = prvalue
+# 1281|     8: [ExprStmt] ExprStmt
+# 1281|       0: [FunctionCall] call to static_member
+# 1281|           Type = [VoidType] void
+# 1281|           ValueCategory = prvalue
+# 1281|         -1: [VariableAccess] a_arg
+# 1281|             Type = [PointerType] A *
+# 1281|             ValueCategory = prvalue(load)
+# 1281|         0: [VariableAccess] a_arg
+# 1281|             Type = [PointerType] A *
+# 1281|             ValueCategory = prvalue(load)
+# 1281|         1: [UnaryMinusExpr] - ...
+# 1281|             Type = [IntType] int
+# 1281|             Value = [UnaryMinusExpr] -1
+# 1281|             ValueCategory = prvalue
+# 1281|           0: [Literal] 1
+# 1281|               Type = [IntType] int
+# 1281|               Value = [Literal] 1
+# 1281|               ValueCategory = prvalue
+# 1283|     9: [ExprStmt] ExprStmt
+# 1283|       0: [FunctionCall] call to static_member_without_def
+# 1283|           Type = [VoidType] void
+# 1283|           ValueCategory = prvalue
+# 1283|         -1: [VariableAccess] a
+# 1283|             Type = [Struct] A
+# 1283|             ValueCategory = lvalue
+# 1284|     10: [ExprStmt] ExprStmt
+# 1284|       0: [FunctionCall] call to static_member_without_def
+# 1284|           Type = [VoidType] void
+# 1284|           ValueCategory = prvalue
+# 1286|     11: [ExprStmt] ExprStmt
+# 1286|       0: [FunctionCall] call to static_member_without_def
+# 1286|           Type = [VoidType] void
+# 1286|           ValueCategory = prvalue
+# 1286|         -1: [FunctionCall] call to getAnInstanceOfA
+# 1286|             Type = [PointerType] A *
+# 1286|             ValueCategory = prvalue
+# 1287|     12: [ReturnStmt] return ...
 perf-regression.cpp:
 #    4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
 #    4|   params: 

cpp/ql/test/library-tests/ir/ir/ir.cpp

@@ -1255,4 +1255,35 @@ void test_strings(char *s1, char *s2) {
 	strcat(buffer, s2);
 }
 
+struct A {
+    int member;
+
+    static void static_member(A* a, int x) {
+        a->member = x;
+    }
+
+    static void static_member_without_def();
+};
+
+A* getAnInstanceOfA();
+
+void test_static_member_functions(int int_arg, A* a_arg) {
+    C c;
+    c.StaticMemberFunction(10);
+    C::StaticMemberFunction(10);
+
+    A a;
+    a.static_member(&a, int_arg);
+    A::static_member(&a, int_arg);
+
+    (&a)->static_member(a_arg, int_arg + 2);
+    (*a_arg).static_member(&a, 99);
+    a_arg->static_member(a_arg, -1);
+
+    a.static_member_without_def();
+    A::static_member_without_def();
+
+    getAnInstanceOfA()->static_member_without_def();
+}
+
 // semmle-extractor-options: -std=c++17 --clang