C++: Construct a CFG with QL

cpp/ql/src/Likely Bugs/InconsistentCheckReturnNull.ql

@@ -60,7 +60,7 @@ predicate nullCheckInCondition(Expr e, Variable v, Declaration qualifier) {
     or exists(NotExpr exp | exp = e and nullCheckInCondition(exp.getAnOperand(), v, qualifier))
     or exists(FunctionCall c | c = e and nullCheckInCondition(c.getAnArgument(), v, qualifier) and
                                          c.getTarget().getName() = "__builtin_expect")
-    or exists(ConditionDeclExpr d | d = e and nullCheckInCondition(d.getExpr(), v, qualifier))
+    or exists(ConditionDeclExpr d | d = e and nullCheckInCondition(d.getVariableAccess(), v, qualifier))
 }
 
 predicate hasNullCheck(Function enclosing, Variable v, Declaration qualifier) {

cpp/ql/src/semmle/code/cpp/Variable.qll

@@ -283,7 +283,11 @@ deprecated class StackVariable extends Variable {
 
 /**
  * A C/C++ local variable. In other words, any variable that has block
- * scope [N4140 3.3.3], but is not a function parameter.
+ * scope [N4140 3.3.3], but is not a parameter of a `Function` or `CatchBlock`.
+ * Local variables can be static; use the `isStatic` member predicate to detect
+ * those.
+ *
+ * A local variable can be declared by a `DeclStmt` or a `ConditionDeclExpr`.
  */
 class LocalVariable extends LocalScopeVariable, @localvariable {
   override string getName() { localvariables(underlyingElement(this),_,result) }