C++: Add more classes supporting transformed types

Author: jketema

cpp/ql/lib/cpp.qll

@@ -26,6 +26,7 @@ import semmle.code.cpp.Include
 import semmle.code.cpp.Macro
 import semmle.code.cpp.Type
 import semmle.code.cpp.TypedefType
+import semmle.code.cpp.TransformedType
 import semmle.code.cpp.Class
 import semmle.code.cpp.Struct
 import semmle.code.cpp.Union

cpp/ql/lib/semmle/code/cpp/TransformedType.qll

@@ -0,0 +1,95 @@
+/**
+ * Provides classes for modeling types obtained by applying type transforming
+ * intrinsics or the C23 `typeof` operator to a type.
+ */
+
+import semmle.code.cpp.Type
+
+/**
+ * A type obtained by applying a type transforming intrinsic or the C23 `typeof`
+ * operator to a type. For example:
+ * ```
+ * __make_unsigned(int) x;
+ * typeof_unqual(const int) y;
+ * ```
+ */
+class TransformedType extends Type, @type_operator {
+  override string getAPrimaryQlClass() { result = "TransformedType" }
+
+  /**
+   * Gets the type immediately yielded by this transformation.
+   */
+  Type getBaseType() { type_operators(underlyingElement(this), _, _, unresolveElement(result)) }
+
+  /**
+   * Gets the type that is transformed.
+   */
+  Type getTransformedType() {
+    type_operators(underlyingElement(this), unresolveElement(result), _, _)
+  }
+
+  override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
+
+  override Type stripTopLevelSpecifiers() { result = this.getBaseType().stripTopLevelSpecifiers() }
+
+  override Type stripType() { result = this.getBaseType().stripType() }
+
+  override Type resolveTypedefs() { result = this.getBaseType().resolveTypedefs() }
+
+  override string getName() { none() }
+
+  override int getSize() { result = this.getBaseType().getSize() }
+
+  override int getAlignment() { result = this.getBaseType().getAlignment() }
+
+  override int getPointerIndirectionLevel() {
+    result = this.getBaseType().getPointerIndirectionLevel()
+  }
+
+  override string explain() {
+    result = "type transformation resulting in {" + this.getBaseType().explain() + "}"
+  }
+
+  override predicate involvesReference() { this.getBaseType().involvesReference() }
+
+  override predicate involvesTemplateParameter() { this.getBaseType().involvesTemplateParameter() }
+
+  override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() }
+
+  override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConstBelow() }
+
+  override Specifier internal_getAnAdditionalSpecifier() {
+    result = this.getBaseType().getASpecifier()
+  }
+}
+
+/**
+ * A type obtained by C23 `typeof` or `typeof_unqual` operator taking a type as its
+ * argument. For example:
+ * ```
+ * typeof_unqual(const int) b;
+ * ```
+ */
+class TypeofTypeType extends TransformedType, TypeofType {
+  TypeofTypeType() { type_operators(underlyingElement(this), _, 0, _) }
+
+  override string getAPrimaryQlClass() { result = "TypeofTypeType" }
+
+  override string toString() { result = "typeof(...)" }
+
+  override Type getBaseType() { result = this.(TransformedType).getBaseType() }
+}
+
+/**
+ * A type obtained by applying a type transforming intrinsic. For example:
+ * ```
+ * __make_unsigned(int) x;
+ * ```
+ */
+class IntrinsicTransformedType extends TransformedType {
+  IntrinsicTransformedType() { type_operators(underlyingElement(this), _, [1 .. 19], _) }
+
+  override string getAPrimaryQlClass() { result = "IntrinsicTransformedType" }
+
+  override string toString() { result = "__...(...)" }
+}

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -93,7 +93,7 @@ class Type extends Locatable, @type {
    * Gets this type after typedefs have been resolved.
    *
    * The result of this predicate will be the type itself, except in the case of a TypedefType, a Decltype,
-   * or a TypeofExprType, in which case the result will be type which results from (possibly recursively)
+   * or a TypeofType, in which case the result will be type which results from (possibly recursively)
    * resolving typedefs.
    */
   pragma[nomagic]
@@ -1111,6 +1111,20 @@ class DerivedType extends Type, @derivedtype {
   override Type stripType() { result = this.getBaseType().stripType() }
 }
 
+/**
+ * An instance of the C23 `typeof` operator. For example:
+ * ```
+ * int a;
+ * typeof(a) b;
+ * ```
+ */
+abstract class TypeofType extends Type {
+  /**
+   * Gets the type immediately yielded by this typeof.
+   */
+  abstract Type getBaseType();
+}
+
 /**
  * An instance of the C++11 `decltype` operator.  For example:
  * ```
@@ -1187,14 +1201,14 @@ class Decltype extends Type, @decltype {
 }
 
 /**
- * An instance of the C23 `typeof` operator taking an expression as its argument.
- * For example:
+ * An instance of the C23 `typeof` or `typeof_unqual` operator taking an expression
+ * as its argument. For example:
  * ```
  * int a;
  * typeof(a) b;
  * ```
  */
-class TypeofExprType extends Type, @decltype {
+class TypeofExprType extends TypeofType, @decltype {
   TypeofExprType() { decltypes(underlyingElement(this), _, 1, _, _) }
 
   override string getAPrimaryQlClass() { result = "TypeofExprType" }
@@ -1204,10 +1218,7 @@ class TypeofExprType extends Type, @decltype {
    */
   Expr getExpr() { decltypes(underlyingElement(this), unresolveElement(result), _, _, _) }
 
-  /**
-   * Gets the type immediately yielded by this typeof.
-   */
-  Type getBaseType() { decltypes(underlyingElement(this), _, _, unresolveElement(result), _) }
+  override Type getBaseType() { decltypes(underlyingElement(this), _, _, unresolveElement(result), _) }
 
   override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
 
@@ -1248,65 +1259,6 @@ class TypeofExprType extends Type, @decltype {
   }
 }
 
-/**
- * A type obtained by applying a type transforming intrinsic or the C23 `typeof`
- * operator to a type.
- * For example:
- * ```
- * __make_unsigned(int) x;
- * typeof_unqual(const int) y;
- * ```
- */
-class TransformedType extends Type, @type_operator {
-  override string getAPrimaryQlClass() { result = "TransformedType" }
-
-  /**
-   * Gets the type immediately yielded by this transformation.
-   */
-  Type getBaseType() { type_operators(underlyingElement(this), _, _, unresolveElement(result)) }
-
-  /**
-   * Gets the type that is transformed.
-   */
-  Type getTransformedType() {
-    type_operators(underlyingElement(this), unresolveElement(result), _, _)
-  }
-
-  override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
-
-  override Type stripTopLevelSpecifiers() { result = this.getBaseType().stripTopLevelSpecifiers() }
-
-  override Type stripType() { result = this.getBaseType().stripType() }
-
-  override Type resolveTypedefs() { result = this.getBaseType().resolveTypedefs() }
-
-  override string getName() { none() }
-
-  override int getSize() { result = this.getBaseType().getSize() }
-
-  override int getAlignment() { result = this.getBaseType().getAlignment() }
-
-  override int getPointerIndirectionLevel() {
-    result = this.getBaseType().getPointerIndirectionLevel()
-  }
-
-  override string explain() {
-    result = "type transformation resulting in {" + this.getBaseType().explain() + "}"
-  }
-
-  override predicate involvesReference() { this.getBaseType().involvesReference() }
-
-  override predicate involvesTemplateParameter() { this.getBaseType().involvesTemplateParameter() }
-
-  override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() }
-
-  override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConstBelow() }
-
-  override Specifier internal_getAnAdditionalSpecifier() {
-    result = this.getBaseType().getASpecifier()
-  }
-}
-
 /**
  * A C/C++ pointer type. See 4.9.1.
  * ```