Refactor prototype reference retrieval in ClassNode and update expected test output

Author: Napalys

javascript/ql/lib/semmle/javascript/dataflow/Nodes.qll

@@ -1233,7 +1233,7 @@ module ClassNode {
   private DataFlow::SourceNode getAFunctionValueWithPrototype(AbstractValue func) {
     exists(result.getAPropertyReference("prototype")) and
     result.analyze().getAValue() = pragma[only_bind_into](func) and
-    func instanceof AbstractFunction // the join-order goes bad if `func` has type `AbstractFunction`.
+    func instanceof AbstractCallable // the join-order goes bad if `func` has type `AbstractFunction`.
   }
 
   /**
@@ -1413,22 +1413,26 @@ module ClassNode {
      * Only applies to function-style classes.
      */
     DataFlow::SourceNode getAPrototypeReference() {
-      (
-        exists(DataFlow::SourceNode base | base = getAFunctionValueWithPrototype(function) |
-          result = base.getAPropertyRead("prototype")
-          or
-          result = base.getAPropertySource("prototype")
-        )
+      exists(DataFlow::SourceNode base | base = getAFunctionValueWithPrototype(function) |
+        result = base.getAPropertyRead("prototype")
         or
-        exists(string name |
-          this = AccessPath::getAnAssignmentTo(name) and
-          result = getAPrototypeReferenceInFile(name, this.getFile())
-        )
-        or
-        exists(ExtendCall call |
-          call.getDestinationOperand() = this.getAPrototypeReference() and
-          result = call.getASourceOperand()
-        )
+        result = base.getAPropertySource("prototype")
+      )
+      or
+      exists(string name |
+        this = AccessPath::getAnAssignmentTo(name) and
+        result = getAPrototypeReferenceInFile(name, this.getFile())
+      )
+      or
+      exists(string name, DataFlow::SourceNode root |
+        result =
+          AccessPath::getAReferenceOrAssignmentTo(root, name + ".prototype").getALocalSource() and
+        this = AccessPath::getAnAssignmentTo(root, name)
+      )
+      or
+      exists(ExtendCall call |
+        call.getDestinationOperand() = this.getAPrototypeReference() and
+        result = call.getASourceOperand()
       )
     }
 

javascript/ql/test/library-tests/CallGraphs/AnnotatedTest/Test.expected

@@ -2,8 +2,6 @@ spuriousCallee
 missingCallee
 | constructor-field.ts:40:5:40:14 | f3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | calls |
 | constructor-field.ts:71:1:71:11 | bf3.build() | constructor-field.ts:13:3:13:12 | build() {} | -1 | calls |
-| prototypes.js:96:5:96:15 | this.read() | prototypes.js:104:27:104:39 | function() {} | -1 | calls |
-| prototypes.js:96:5:96:15 | this.read() | prototypes.js:109:27:109:39 | function() {} | -1 | calls |
 badAnnotation
 accessorCall
 | accessors.js:12:1:12:5 | obj.f | accessors.js:5:8:5:12 | () {} |

javascript/ql/test/library-tests/ClassNode/tests.expected

@@ -15,6 +15,7 @@ getAReceiverNode
 | tst.js:3:1:10:1 | class A ... () {}\\n} | tst.js:4:17:4:16 | this |
 | tst.js:3:1:10:1 | class A ... () {}\\n} | tst.js:7:6:7:5 | this |
 | tst.js:3:1:10:1 | class A ... () {}\\n} | tst.js:9:10:9:9 | this |
+| tst.js:3:9:3:8 | () {} | tst.js:3:9:3:8 | this |
 | tst.js:13:1:13:21 | class A ... ds A {} | tst.js:13:20:13:19 | this |
 | tst.js:15:1:15:15 | function B() {} | tst.js:15:1:15:0 | this |
 | tst.js:15:1:15:15 | function B() {} | tst.js:17:19:17:18 | this |