Unified: Add flow through calls (static calls only) by asgerf · Pull Request #22611 · github/codeql

asgerf · 2026-09-17T15:42:42Z

Enables flow through calls, using a basic call graph derived from static name resolution.

Most of the work is wiring up argument/parameter positions and post-update nodes correctly. The actual call graph is fairly trivial so far.

The PR also performs a few drive-by fixes:

The AST mapping now expands a lone parameter name p: Int into one with an external name and a pattern p p: Int. This mirrors how JS desugars short-hand properties { p } into { p: p }. In my experience with JS, that desugaring has proven useful and has never caused any issues so I decided to do the same here.
There was an issue with way we use a synthetic read to model post-updates in SSA; SSA use-use chains now properly skips over the synthetic read (previously it would break the use-use chain). Ideally we should move more of this logic into SSA proper, but I wanted to avoid further scope creep.

A parameter with only one name has that name as its internal and external parameter name.

The previous commit resulted in data-flow consistency errors due to having local flow into a post-update node (for good reason). We now skip over the synthetic read node in use-use flow, so the use-use flow is not seen as a mutation of a variable.

This changes the type from Expr -> AstNode and renames the column. This should just be an arbitrary representative for the access; it does not have to be an Expr.

Note that some of them are failing because 'self.store()' is not resolved by static name binding.

This should be taken from the CFG node instead of the AST node

This fixes a data flow consistency error due to ArgumentNodes for constructor patterns missing their PostUpdateNode.

Copilot

Copilot review overview

🟡 Changes recommended

Call flow currently misses implicit returns, trailing closures, variadics, and high-arity calls, while diagnostics miscount excluded calls.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 3 · 4

Open (7)

Restrict candidates to DataFlowCall expressions · New
Handle implicit returns in single-expression functions · New
Derive positional domain from extracted arguments and parameters · New
Fix grammar in class description · New
Fix article and conjunction in class description · New
Correct “arbitary” typo · New
Replace “one or most” with “one or more” · New

What changed in this PR

Adds static-call interprocedural data flow to the unified analysis.

Changes:

Models arguments, parameters, returns, receivers, and post-call updates.
Adds call-graph diagnostics and quality metrics.
Normalizes Swift parameter labels and expands data-flow tests.

File	Description
`unified/ql/test/library-tests/dataflow/test.swift`	Updates baseline data-flow tests.
`unified/ql/test/library-tests/dataflow/test.expected`	Regenerated data-flow expectations.
`unified/ql/test/library-tests/dataflow/implicit-self.swift`	Tests implicit receiver flow.
`unified/ql/test/library-tests/dataflow/calls.swift`	Adds interprocedural call tests.
`unified/ql/test/library-tests/BasicTest/test.expected`	Updates generated identifier expectations.
`unified/ql/src/diagnostic/ExtractorInformation.ql`	Reports call-graph statistics.
`unified/ql/src/diagnostic/CallGraph.ql`	Adds call-graph diagnostics.
`unified/ql/lib/codeql/unified/internal/LocalNameBinding.qll`	Exposes implicit receiver variables.
`unified/ql/lib/codeql/unified/internal/FacadeAst.qll`	Adds argument and parameter positions.
`unified/ql/lib/codeql/unified/internal/dataflow/ParameterPositions.qll`	Defines call-position matching.
`unified/ql/lib/codeql/unified/internal/dataflow/LocalSsa.qll`	Handles synthetic post-update reads.
`unified/ql/lib/codeql/unified/internal/dataflow/DataFlowNode.qll`	Adds receiver and control-flow nodes.
`unified/ql/lib/codeql/unified/internal/dataflow/DataFlowInstantiation.qll`	Connects interprocedural nodes.
`unified/ql/lib/codeql/unified/internal/dataflow/DataFlowGraph.qll`	Adds receiver-flow edges.
`unified/ql/lib/codeql/unified/internal/dataflow/DataFlowCallable.qll`	Models callable entities.
`unified/ql/lib/codeql/unified/internal/dataflow/DataFlowCall.qll`	Models explicit call sites.
`unified/ql/lib/codeql/unified/internal/dataflow/CallGraph.qll`	Resolves static call targets.
`unified/ql/lib/codeql/unified/internal/dataflow/AllDataFlow.qll`	Re-exports new data-flow modules.
`unified/ql/lib/codeql/unified/internal/AnalysisQuality.qll`	Adds call-graph quality metrics.
`unified/ql/consistency-queries/DataFlowConsistency.ql`	Excludes unreachable argument nodes.
`unified/extractor/tests/corpus/swift/types/class-with-initializer.output`	Regenerated initializer AST output.
`unified/extractor/tests/corpus/swift/functions/function-with-default-parameter-value.output`	Regenerated parameter AST output.
`unified/extractor/src/languages/swift/swift.rs`	Duplicates single Swift parameter names as labels.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

asgerf · 2026-09-21T08:22:26Z

  class ReturnNode extends Node {
-    ReturnNode() { none() } // TODO
+    ReturnNode() { this.asExpr() = any(ReturnExpr r).getValue() }


Adding a TODO for now

asgerf · 2026-09-21T08:20:29Z

+
+private newtype TParameterPosition =
+  TReceiverParameter() or
+  TPositionalParameter(int n) { n = [0 .. 20] } or


Deliberately not implementing the accurate charpred yet. It will inevitably have to reference MaD models as possibly tuple arity and will result in time wasted on debugging if not updated at the right point in time.

Some typos and exclude constructor patterns from call graph stats Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

hvitved

Looks great 💪 Minor comments only.

hvitved · 2026-09-21T11:25:52Z

+    or
+    result = this.asPositional().toString()
+    or
+    result = "\"" + this.asNamed() + "\""


Why the quotes?

To avoid a potentially confusing name clash with receiver. But come to think of it, suffixing with a colon would be more aligned with MaD so I'll switch to that.

hvitved · 2026-09-21T11:27:01Z

+  /** Gets the `CallExpr` wrapped by this dataflow call, if any. */
+  CallExpr asExplicitCall() { this = TExplicitCall(result) }
+
+  /** Gets a string representation of this call. */


string -> textual

hvitved · 2026-09-21T11:42:08Z

  predicate isBindingSite() { this instanceof NameBinding }
 }
+
+/** Gets implicitly-declared variable through which the given callable refers to its receiver. */


hvitved · 2026-09-21T11:50:28Z

Did you run DCA?

asgerf · 2026-09-21T11:56:35Z

Latest DCA run should still be accurate but I'll run kick off another one.

github-advanced-security Bot found potential problems Sep 17, 2026

View reviewed changes

Comment thread unified/ql/lib/codeql/unified/internal/dataflow/DataFlowNode.qll Fixed

Comment thread unified/ql/lib/codeql/unified/internal/dev/debugDataFlowGraph.ql Fixed

asgerf force-pushed the unified/call-graph-static branch 4 times, most recently from e9da755 to a916e8b Compare September 18, 2026 12:02

asgerf changed the title ~~Unified: Static calls~~ Unified: Add flow through calls (static calls only) Sep 18, 2026

asgerf force-pushed the unified/call-graph-static branch from 0f11ca1 to 032b47b Compare September 19, 2026 08:11

asgerf added 23 commits September 19, 2026 10:17

unified: Make data flow tests valid

043701d

unified: Add some basic call graph tests

ec82b66

unified: Add ParameterPosition

11c7858

unified: Add DataFlowCall and DataFlowCallable

724807f

unified: ParameterNode, ArgumentNode, OutNode

80f557a

unified: Add basic call graph

0395232

unified: Fix CFG node associated with parameter assignment

9da74ef

unified: Populate external name when parameter has only one name

f098a84

A parameter with only one name has that name as its internal and external parameter name.

unified: Update data flow test output

43aa59f

unified: Update BasicTest output after duplicating parameter name

6aca722

unified: Insert post-updates for call arguments

76c39b6

unified: Add call graph stats

4ebd5f7

unified: Add canonical receiver parameter

a9340a8

unified: Also add getEnclosingCallableEx

e1326fd

unified: Add receiver argument node

82ed701

unified: Link up receiver argument/parameter

25baa0b

unified: Refactor first column in performsVariableAccess

8f2b812

This changes the type from Expr -> AstNode and renames the column. This should just be an arbitrary representative for the access; it does not have to be an Expr.

unified: Store the receiver in 'self'

2e3081e

unified: Wire up call receiver

6acf683

unified: Ensure implicit 'self' has a post-update

29499de

unified: Add test

1175f84

unified: Add 8 combinations of implicit/explicit self

10bcc25

Note that some of them are failing because 'self.store()' is not resolved by static name binding.

asgerf added 4 commits September 19, 2026 10:20

unified: Move some variables into fields

414c86c

unified: Fix getEnclosingCallable for LocalVariableRef

9494c90

This should be taken from the CFG node instead of the AST node

unified: Exclude calls in pattern context

f144d38

This fixes a data flow consistency error due to ArgumentNodes for constructor patterns missing their PostUpdateNode.

unified: Tolerate missing post-updates in unreachable code

832dfb4

asgerf force-pushed the unified/call-graph-static branch from 032b47b to 832dfb4 Compare September 19, 2026 08:20

asgerf added the no-change-note-required This PR does not need a change note label Sep 21, 2026

asgerf requested a balanced review from Copilot September 21, 2026 08:09

Copilot started reviewing on behalf of asgerf September 21, 2026 08:09 View session

Copilot AI reviewed Sep 21, 2026

View reviewed changes

asgerf and others added 2 commits September 21, 2026 10:16

Accept Copilot suggestions

ed3b85c

Some typos and exclude constructor patterns from call graph stats Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

unified: Add TODO for short-hand returns

f7aeeb6

asgerf marked this pull request as ready for review September 21, 2026 08:28

asgerf requested review from a team as code owners September 21, 2026 08:28

asgerf requested a review from hvitved September 21, 2026 08:28

hvitved reviewed Sep 21, 2026

View reviewed changes

asgerf added 2 commits September 21, 2026 14:00

unified: Suffix parameter positions with a colon

fc00d79

unified: Fix some typos in comments

fd90099

Navigation Menu

Unified: Add flow through calls (static calls only) - #22611

Unified: Add flow through calls (static calls only)#22611
asgerf wants to merge 31 commits into
github:mainfrom
asgerf:unified/call-graph-static

asgerf commented Sep 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

asgerf Sep 21, 2026

Uh oh!

asgerf Sep 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hvitved left a comment

Uh oh!

hvitved Sep 21, 2026

Uh oh!

asgerf Sep 21, 2026

Uh oh!

hvitved Sep 21, 2026

Uh oh!

hvitved Sep 21, 2026

Uh oh!

hvitved commented Sep 21, 2026

Uh oh!

asgerf commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

asgerf commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

asgerf Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

asgerf Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hvitved left a comment

Choose a reason for hiding this comment

Uh oh!

hvitved Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

asgerf Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

hvitved commented Sep 21, 2026

Uh oh!

asgerf commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

asgerf commented Sep 17, 2026 •

edited

Loading