JS: Combine phi reads and ssa input nodes into SynthReadNode class.

Author: aschackmull

javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowNode.qll

@@ -34,10 +34,8 @@ private module Cached {
     TSsaDefNode(SsaDefinition d) or
     /** Use of a variable or 'this', with flow from a post-update node (from an earlier use) */
     TSsaUseNode(ControlFlowNode use) { use = any(Ssa2::SsaConfig::SourceVariable v).getAUse() } or
-    /** Phi-read node (new SSA library). Ordinary phi nodes are represented by TSsaDefNode. */
-    TSsaPhiReadNode(Ssa2::PhiReadNode phi) or
-    /** Input to a phi node (new SSA library) */
-    TSsaInputNode(Ssa2::SsaInputNode input) or
+    /** A synthesized variable read (new SSA library). Definitions are represented by TSsaDefNode. */
+    TSsaSynthReadNode(Ssa2::SsaSynthReadNode read) or
     TCapturedVariableNode(LocalVariable v) { v.isCaptured() } or
     TPropNode(@property p) or
     TRestPatternNode(DestructuringPattern dp, Expr rest) { rest = dp.getRest() } or

javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll

@@ -35,38 +35,21 @@ class SsaUseNode extends DataFlow::Node, TSsaUseNode {
   override Location getLocation() { result = expr.getLocation() }
 }
 
-class SsaPhiReadNode extends DataFlow::Node, TSsaPhiReadNode {
-  private Ssa2::PhiReadNode phi;
+class SsaSynthReadNode extends DataFlow::Node, TSsaSynthReadNode {
+  private Ssa2::SsaSynthReadNode read;
 
-  SsaPhiReadNode() { this = TSsaPhiReadNode(phi) }
+  SsaSynthReadNode() { this = TSsaSynthReadNode(read) }
 
   cached
-  override string toString() { result = "[ssa-phi-read] " + phi.getSourceVariable().getName() }
-
-  cached
-  override StmtContainer getContainer() { result = phi.getSourceVariable().getDeclaringContainer() }
-
-  cached
-  override Location getLocation() { result = phi.getLocation() }
-}
-
-class SsaInputNode extends DataFlow::Node, TSsaInputNode {
-  private Ssa2::SsaInputNode input;
-
-  SsaInputNode() { this = TSsaInputNode(input) }
-
-  cached
-  override string toString() {
-    result = "[ssa-input] " + input.getDefinitionExt().getSourceVariable().getName()
-  }
+  override string toString() { result = "[ssa-synth-read] " + read.getSourceVariable().getName() }
 
   cached
   override StmtContainer getContainer() {
-    result = input.getDefinitionExt().getSourceVariable().getDeclaringContainer()
+    result = read.getSourceVariable().getDeclaringContainer()
   }
 
   cached
-  override Location getLocation() { result = input.getLocation() }
+  override Location getLocation() { result = read.getLocation() }
 }
 
 class FlowSummaryNode extends DataFlow::Node, TFlowSummaryNode {
@@ -675,9 +658,7 @@ predicate nodeIsHidden(Node node) {
   or
   node instanceof SsaUseNode
   or
-  node instanceof SsaPhiReadNode
-  or
-  node instanceof SsaInputNode
+  node instanceof SsaSynthReadNode
 }
 
 predicate neverSkipInPathGraph(Node node) {
@@ -1258,12 +1239,10 @@ Node getNodeFromSsa2(Ssa2::Node node) {
     result = TImplicitThisUse(use, true)
   )
   or
-  result = TSsaPhiReadNode(node.(Ssa2::SsaDefinitionExtNode).getDefinitionExt())
-  or
-  result = TSsaInputNode(node.(Ssa2::SsaInputNode))
+  result = TSsaSynthReadNode(node)
   or
   exists(SsaPhiNode legacyPhi, Ssa2::PhiNode ssaPhi |
-    node.(Ssa2::SsaDefinitionExtNode).getDefinitionExt() = ssaPhi and
+    node.(Ssa2::SsaDefinitionNode).getDefinition() = ssaPhi and
     samePhi(legacyPhi, ssaPhi) and
     result = TSsaDefNode(legacyPhi)
   )

shared/ssa/codeql/ssa/Ssa.qll

@@ -1688,6 +1688,13 @@ module Make<LocationSig Location, InputSig<Location> Input> {
 
     final class SsaDefinitionNode = SsaDefinitionNodeImpl;
 
+    final class SsaSynthReadNode extends SsaNode {
+      SsaSynthReadNode() {
+        this.(SsaDefinitionExtNodeImpl).getDefinitionExt() instanceof PhiReadNode or
+        this instanceof SsaInputNodeImpl
+      }
+    }
+
     /**
      * A node that represents an input to an SSA phi (read) definition.
      *