codeql
codeql copied to clipboard
Dataflow: update fieldFlowBranchLimit semantics
trafficstars
This makes two changes to the fieldFlowBranchLimit interpretation:
- The count is adjusted to properly count virtual dispatch instead of nodes. This will block less flow and hence result in more computation and more alerts - hopefully fixing some FNs.
- The blocking condition on return edges is changed to only care about virtual dispatch count and not the number of call sites. This will block more flow and hopefully reduce FPs and performance problems based on uncertain dispatch. This has anecdotally been identified as the core issue in a couple of poorly performing cases.
For the return edge condition, special care is taken to still follow call edges that are determined by the call context.
All qltests are also updated to use the default fieldFlowBranchLimit instead of an inflated value to better reflect what's actually used in queries.