fix: preserve BDE conversion bodies and assignment aliases

Address the two P2 findings from the independent review of PR #22581. Restrict scalar emplacement summaries to arithmetic or pointer inputs so user-defined conversions retain body analysis. Model copy/move assignment results as aliases of the receiver. Add positive and negative conversion regressions and write-through tests for both assignment forms and wrappers. Wrapper flow tests and model validation pass.

Author: kumarak

cpp/ql/lib/ext/bdlb.values.model.yml

@@ -11,15 +11,19 @@ extensions:
       - ["BloombergLP::bdlb", "NullableValue", False, "NullableValue", "(const NullableValue &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(const NullableValue &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(const NullableValue &)", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
+      - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(const NullableValue &)", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
       - ["BloombergLP::bdlb", "NullableValue", False, "NullableValue", "(NullableValue &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(NullableValue &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(NullableValue &&)", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
+      - ["BloombergLP::bdlb", "NullableValue", False, "operator=", "(NullableValue &&)", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "the", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "the", "", "", "ReturnValue[*]", "Argument[-1].Element[]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "the", "", "", "ReturnValue[**]", "Argument[-1].Element[*]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "VariantImp", "(const VariantImp &,bslma::Allocator *)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(const VariantImp &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(const VariantImp &)", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
+      - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(const VariantImp &)", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "VariantImp", "(VariantImp &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(VariantImp &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
       - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(VariantImp &&)", "", "Argument[*0].Element[@]", "ReturnValue[*].Element[@]", "value", "manual"]
+      - ["BloombergLP::bdlb", "VariantImp", False, "operator=", "(VariantImp &&)", "", "Argument[-1]", "ReturnValue[*]", "value", "manual"]

cpp/ql/lib/semmle/code/cpp/models/implementations/BdlbValues.qll

@@ -76,7 +76,12 @@ private class ScalarEmplacement extends SummarizedCallable {
       this.getDeclaringType().hasQualifiedName("BloombergLP::bdlb", "VariantImp")
     ) and
     this.getNumberOfParameters() = 1 and
-    this.getParameter(0).getUnspecifiedType() instanceof ReferenceType and
+    // Class inputs may invoke user-defined conversions even when the stored type is scalar.
+    exists(Type inputType |
+      inputType =
+        this.getParameter(0).getUnspecifiedType().(ReferenceType).getBaseType().getUnspecifiedType() and
+      (inputType instanceof ArithmeticType or inputType instanceof PointerType)
+    ) and
     exists(Type t |
       t = this.getType().getUnspecifiedType().(ReferenceType).getBaseType().getUnspecifiedType() and
       (t instanceof ArithmeticType or t instanceof PointerType)

cpp/ql/test/library-tests/dataflow/bdlb-values/emplacement.cpp

@@ -44,3 +44,36 @@ void ignoredArgumentVariant() {
   v.createInPlace<Constructed>(source(), 0);
   sink(v.the<Constructed>().value);
 }
+
+// Scalar destinations can still require a user-defined input conversion.
+struct ConvertedNumber {
+  int payload;
+  operator int() const { return payload; }
+};
+struct IgnoredNumber {
+  int payload;
+  operator int() const { return 0; }
+};
+void nullableScalarConversion() {
+  ConvertedNumber input = {source()};
+  sink(static_cast<int>(input)); // $ ir
+  BloombergLP::bdlb::NullableValue<int> n;
+  n.makeValueInplace(input);
+  sink(n.value()); // $ ir
+}
+void variantScalarConversion() {
+  ConvertedNumber input = {source()};
+  sink(static_cast<int>(input)); // $ ir
+  BloombergLP::bdlb::Variant<int> v;
+  v.createInPlace<int>(input);
+  sink(v.the<int>()); // $ ir
+}
+void ignoredScalarConversions() {
+  IgnoredNumber input = {source()};
+  BloombergLP::bdlb::NullableValue<int> n;
+  n.makeValueInplace(input);
+  sink(n.value());
+  BloombergLP::bdlb::Variant<int> v;
+  v.createInPlace<int>(input);
+  sink(v.the<int>());
+}

cpp/ql/test/library-tests/dataflow/bdlb-values/returned-references.cpp

@@ -36,3 +36,31 @@ void variantEmplaceReference() {
   v.createInPlace<int>(0) = source();
   sink(v.the<int>()); // $ ir
 }
+
+void nullableCopyResultWrite() {
+  NullableValue<int> a, b;
+  b.makeValue(0);
+  (a = static_cast<const NullableValue<int>&>(b)).value() = source();
+  sink(a.value()); // $ ir
+}
+
+void nullableMoveResultWrite() {
+  NullableValue<int> a, b;
+  b.makeValue(0);
+  (a = static_cast<NullableValue<int>&&>(b)).value() = source();
+  sink(a.value()); // $ ir
+}
+
+void variantCopyResultWrite() {
+  VariantImp<Types<int>> a, b;
+  b.assign(0);
+  (a = static_cast<const VariantImp<Types<int>>&>(b)).the<int>() = source();
+  sink(a.the<int>()); // $ ir
+}
+
+void variantMoveResultWrite() {
+  VariantImp<Types<int>> a, b;
+  b.assign(0);
+  (a = static_cast<VariantImp<Types<int>>&&>(b)).the<int>() = source();
+  sink(a.the<int>()); // $ ir
+}