Move Branching EOG Edges and needed DF Edge from CF Nodes to their condition by konradweiss · Pull Request #2749 · Fraunhofer-AISEC/cpg

konradweiss · 2026-05-11T20:32:39Z

Removing DF Edge from branching condition to CFG Nodes in an attempt to solve the issue arising with them being expressions. This also requires to move the branching eog edges from the CF node to the condition, to continue capturing indirect data flows. We will change: Do, While, IfElse, For, ForEach, Conditional, Switch and Synchronized

The IfElse will no longer be evaluated as follows:

but will look like this:

In the case of a while loop it will no longer look like this:

instead it will look like this:

…to solve the issue arrising with them being expressions

codecov · 2026-05-11T20:34:12Z

Codecov Report

❌ Patch coverage is 89.13043% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.83%. Comparing base (5b2b6f1) to head (359eedf).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
.../fraunhofer/aisec/cpg/passes/UnreachableEOGPass.kt	88.88%	1 Missing and 2 partials ⚠️
...fer/aisec/cpg/passes/ControlDependenceGraphPass.kt	75.00%	0 Missing and 1 partial ⚠️
...hofer/aisec/cpg/passes/EvaluationOrderGraphPass.kt	88.88%	1 Missing ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
...ec/cpg/analysis/abstracteval/value/IntegerValue.kt	`39.44% <100.00%> (ø)`
...fraunhofer/aisec/cpg/graph/EvaluationExtensions.kt	`50.00% <100.00%> (+3.84%)`	⬆️
...ain/kotlin/de/fraunhofer/aisec/cpg/helpers/Util.kt	`56.14% <ø> (-2.62%)`	⬇️
...ec/cpg/helpers/functional/BasicLatticesRedesign.kt	`67.56% <100.00%> (ø)`
...n/kotlin/de/fraunhofer/aisec/cpg/passes/DFGPass.kt	`72.99% <ø> (-1.50%)`	⬇️
...main/kotlin/de/fraunhofer/aisec/cpg/passes/Pass.kt	`76.50% <100.00%> (+0.28%)`	⬆️
...fer/aisec/cpg/passes/ControlDependenceGraphPass.kt	`70.55% <75.00%> (-9.58%)`	⬇️
...hofer/aisec/cpg/passes/EvaluationOrderGraphPass.kt	`88.98% <88.88%> (+0.29%)`	⬆️
.../fraunhofer/aisec/cpg/passes/UnreachableEOGPass.kt	`83.33% <88.88%> (-0.27%)`	⬇️

... and 6 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…ad of the cf node itself

…ngle node to start the eog

Copilot

Pull request overview

This PR updates the Evaluation Order Graph (EOG) model for branching constructs by moving branching EOG edges (and previously-added DFG edges) away from control-flow (CF) nodes and onto their actual branching sub-nodes (conditions / selector / foreach variable), to avoid issues when branching statements are represented as expressions and to better preserve indirect data-flow behavior.

Changes:

Adjust EOG construction for branching constructs (If/Conditional/Loops/Switch/Synchronized) so branching happens at the condition/selector/variable node and merge happens at the parent node.
Remove DFG edges from branching parent nodes to their conditions/selectors that were previously added for “mutually exclusive branching expressions”.
Update control-dependence, unreachability analysis, abstract evaluation utilities, docs, and tests to match the new EOG shape.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
docs/docs/CPG/specs/eog.md	Updates EOG specification diagrams for affected branching constructs.
cpg-language-java/src/test/kotlin/de/fraunhofer/aisec/cpg/enhancements/EOGTest.kt	Adjusts Java EOG tests to assert branching at condition nodes and merge at parent.
cpg-language-cxx/src/test/resources/c/switch_eog.c	Minor test resource comment formatting update.
cpg-language-cxx/src/test/kotlin/de/fraunhofer/aisec/cpg/StronglyConnectedComponentTest.kt	Updates SCC assertions to use loop condition nodes as branching points.
cpg-language-cxx/src/test/kotlin/de/fraunhofer/aisec/cpg/enhancements/EOGTest.kt	Adjusts C++ EOG tests to the new branching/merge locations.
cpg-core/src/test/kotlin/de/fraunhofer/aisec/cpg/passes/EvaluationOrderGraphPassTest.kt	Updates pass-level EOG tests for loops/foreach semantics under the new model.
cpg-core/src/test/kotlin/de/fraunhofer/aisec/cpg/passes/ControlDependenceGraphPassTest.kt	Updates CDG expectations to depend on condition/foreach-variable rather than parent CF node.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/passes/Pass.kt	Adds per-pass execution print statements during sequential pass execution.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/passes/EvaluationOrderGraphPass.kt	Core change: moves attach/branching logic so branching edges originate from condition/selector/variable nodes.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/passes/DFGPass.kt	Removes calls that added DFG edges from branching parents to their conditions/selectors.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/passes/ControlDependenceGraphPass.kt	Updates conditional-branch detection to align with branching-at-condition representation.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/helpers/Util.kt	Removes the helper for adding DFG edges for mutually exclusive branching expressions.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/helpers/functional/BasicLatticesRedesign.kt	Updates loop-branch detection to use the new “branch node” identification.
cpg-core/src/main/kotlin/de/fraunhofer/aisec/cpg/graph/EvaluationExtensions.kt	Adds `Node.branchOf(...)` helper for detecting branching nodes.
cpg-analysis/src/test/kotlin/de/fraunhofer/aisec/cpg/passes/UnreachableEOGPassTest.kt	Updates unreachability tests to look at outgoing edges of condition nodes.
cpg-analysis/src/main/kotlin/de/fraunhofer/aisec/cpg/passes/UnreachableEOGPass.kt	Switches unreachability propagation to branch from condition nodes rather than parent nodes.
cpg-analysis/src/main/kotlin/de/fraunhofer/aisec/cpg/analysis/abstracteval/value/IntegerValue.kt	Adapts interval refinement to treat the condition node as the branch point.

        // Execute it
+        println("Executing: ${pass.simpleName}")
        executePass(pass, ctx, result, executedFrontends)
-
+        println("Finished: ${pass.simpleName}")


+  child1 --EOG:false--> parent(["While"])
+  child1 --EOG:true--> child3["statement"]
  child3 --EOG--> child1
+  parent --> next:::outer


@@ -1073,20 +1071,20 @@ open class EvaluationOrderGraphPass(ctx: TranslationContext) : TranslationUnitPa
        handleEOG(node.elseExpression)
        openBranchNodes.addAll(currentPredecessors)
        setCurrentEOGs(openBranchNodes)


        node.elseStatement?.let { handleEOG(it) }
        handleContainedBreaksAndContinues(node)
        nextEdgeBranch = false


@@ -1178,7 +1174,6 @@ open class EvaluationOrderGraphPass(ctx: TranslationContext) : TranslationUnitPa
        handleEOG(node.conditionDeclaration)
        handleEOG(node.condition)

-        attachToEOG(node) // To have semantic information after the condition evaluation
        nextEdgeBranch = true
        val tmpEOGNodes = currentPredecessors.toMutableList()

@@ -1192,6 +1187,7 @@ open class EvaluationOrderGraphPass(ctx: TranslationContext) : TranslationUnitPa
        node.elseStatement?.let { handleEOG(it) }
        handleContainedBreaksAndContinues(node)
        nextEdgeBranch = false
+        attachToEOG(node)
    }


@@ -1200,7 +1196,6 @@ open class EvaluationOrderGraphPass(ctx: TranslationContext) : TranslationUnitPa
        handleEOG(node.initializerStatement)
        handleEOG(node.conditionDeclaration)
        handleEOG(node.condition)
-        attachToEOG(node) // To have semantic information after the condition evaluation
        val openConditionEOGs = currentPredecessors.toMutableList()
        nextEdgeBranch = true
        handleEOG(node.thenStatement)
@@ -1214,6 +1209,7 @@ open class EvaluationOrderGraphPass(ctx: TranslationContext) : TranslationUnitPa
            openBranchNodes.addAll(openConditionEOGs)
        }
        setCurrentEOGs(openBranchNodes)
+        attachToEOG(node)
    }


    /**
     * Adds the DFG edge from [For.condition] or [For.conditionDeclaration] to the [For] to show the
     * dependence between data and the branching node. Usage of one or the other in the statement is
     * mutually exclusive.
     */
    protected fun handleFor(node: For) {
-        Util.addDFGEdgesForMutuallyExclusiveBranchingExpression(
-            node,
-            node.condition,
-            node.conditionDeclaration,
-        )
+
        if (node.usedAsExpression) {
            node.statement?.let { node.prevDFGEdges += it }
            node.elseStatement?.let { node.prevDFGEdges += it }
        }
        handleBreakableNodesAsExpressions(node)
    }

    /**
     * Adds the DFG edge from [IfElse.condition] or [IfElse.conditionDeclaration] to the [IfElse] to
     * show the dependence between data and the branching node. Usage of one or the other in the
     * statement is mutually exclusive.
     */
    protected fun handleIfElse(node: IfElse) {
-        Util.addDFGEdgesForMutuallyExclusiveBranchingExpression(
-            node,
-            node.condition,
-            node.conditionDeclaration,
-        )

        if (node.usedAsExpression) {
            node.thenStatement?.let { node.prevDFGEdges += it }
            node.elseStatement?.let { node.prevDFGEdges += it }
        }
    }

    /**
     * Adds the DFG edge from [Switch.selector] or [Switch.selectorDeclaration] to the [Switch] to
     * show the dependence between data and the branching node. Usage of one or the other in the
     * statement is mutually exclusive.
     */
    protected fun handleSwitch(node: Switch) {
-        Util.addDFGEdgesForMutuallyExclusiveBranchingExpression(
-            node,
-            node.selector,
-            node.selectorDeclaration,
-        )
        if (node.usedAsExpression) {
            node.statement?.let {
                node.prevDFGEdges += it
                it.usedAsExpression = true
            }
        }
        handleBreakableNodesAsExpressions(node)
    }

    /**
     * Adds the DFG edge from [While.condition] or [While.conditionDeclaration] to the [While] to
     * show the dependence between data and the branching node. Usage of one or the other in the
     * statement is mutually exclusive.
     */
    protected fun handleWhile(node: While) {
-        Util.addDFGEdgesForMutuallyExclusiveBranchingExpression(
-            node,
-            node.condition,
-            node.conditionDeclaration,
-        )

        if (node.usedAsExpression) {


    @Test
    fun testIfFalse() {
        val method = tu.functions["ifFalse"]
        assertNotNull(method)

        val ifStatement = method.ifs.firstOrNull()
        assertNotNull(ifStatement)

-        assertFalse(ifStatement.nextEOGEdges[1].unreachable)
-        assertTrue(ifStatement.nextEOGEdges[0].unreachable)
+        ifStatement.condition?.let {
+            assertFalse(it.nextEOGEdges[1].unreachable)
+            assertTrue(it.nextEOGEdges[0].unreachable)
+        }


Removing DF Edge from branchign condition to CFG Nodes in an attempt …

205a00a

…to solve the issue arrising with them being expressions

konradweiss added 6 commits May 11, 2026 23:12

Fixes

328e0ab

Add whitelisting file

75e14f7

Merge branch 'fix/allow-esbuild-scripts' into fix/dfg-to-cfnodes

e54942c

Moving branching nodes to conditions, variables, selectors etc. inste…

f719b01

…ad of the cf node itself

Fixes

282623e

More testfixes

00980ac

konradweiss changed the title ~~Remove DF Edges from condition to CF Nodes~~ Move Branching EOG Edges and needed DF Edge from CF Nodes to their condition May 19, 2026

konradweiss added 11 commits May 19, 2026 09:16

Adapting basic lattic redesign and UnreachableEOGPass

488f4f7

Adapting IntegerEvaluator

40f752c

Fixing condition in Unreachable EOGPass

797c332

Fixing EOG tests in the java frontend

344b482

Formatting

ca1d9c1

Adapting tests and correcting special case for switch

d24722f

Adapting eog for catch in try to follow the new structure

24d9da7

reverting last change as catch clauses are eog starters and need a si…

a1dfa03

…ngle node to start the eog

Adapt specification for EOG

cbcb793

More specification changes

febd501

Merge branch 'main' into fix/dfg-to-cfnodes

359eedf

konradweiss marked this pull request as ready for review May 19, 2026 16:02

konradweiss requested review from KuechA, fwendland, oxisto and peckto as code owners May 19, 2026 16:02

oxisto requested a review from Copilot May 20, 2026 17:40

Copilot started reviewing on behalf of oxisto May 20, 2026 17:40 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move Branching EOG Edges and needed DF Edge from CF Nodes to their condition#2749

Move Branching EOG Edges and needed DF Edge from CF Nodes to their condition#2749
konradweiss wants to merge 18 commits into
mainfrom
fix/dfg-to-cfnodes

konradweiss commented May 11, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

konradweiss commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

konradweiss commented May 11, 2026 •

edited

Loading

codecov Bot commented May 11, 2026 •

edited

Loading