Generalize shared CFG jump targets

Represent labeled and resolved jumps with a common targeted abrupt completion, and let language libraries define resolved jump destinations and additional goto catch boundaries.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: owen-mc

csharp/ql/lib/semmle/code/csharp/controlflow/ControlFlowGraph.qll

@@ -5,6 +5,7 @@
 import csharp
 private import internal.ControlFlowGraph
 private import codeql.controlflow.SuccessorType
+private import codeql.util.Void
 private import semmle.code.csharp.commons.Compilation
 private import semmle.code.csharp.controlflow.internal.NonReturning as NonReturning
 
@@ -137,29 +138,37 @@ private module Input implements InputSig1, InputSig2 {
 
   predicate matchAll(Ast::Case c) { c instanceof DefaultCase or c.(SwitchCaseExpr).matchesAll() }
 
-  private newtype TLabel =
-    TLblGoto(string label) { any(GotoLabelStmt goto).getLabel() = label } or
-    TLblSwitchCase(string value) { any(GotoCaseStmt goto).getLabel() = value } or
-    TLblSwitchDefault()
+  class Label = Void;
 
-  class Label extends TLabel {
-    string toString() {
-      this = TLblGoto(result)
-      or
-      this = TLblSwitchCase(result)
-      or
-      this = TLblSwitchDefault() and result = "default"
-    }
+  class JumpTarget = LabeledStmt;
+
+  private SwitchStmt getEnclosingSwitch(GotoStmt jump) {
+    result.getAChild*() = jump and
+    not exists(SwitchStmt inner |
+      inner != result and
+      result.getAChild*() = inner and
+      inner.getAChild*() = jump
+    )
   }
 
-  predicate hasLabel(Ast::AstNode n, Label l) {
-    l = TLblGoto(n.(GotoLabelStmt).getLabel())
-    or
-    l = TLblSwitchCase(n.(GotoCaseStmt).getLabel())
+  JumpTarget getAGotoTarget(Ast::GotoStmt jump) {
+    result = jump.(GotoLabelStmt).getTarget()
     or
-    l = TLblSwitchDefault() and n instanceof GotoDefaultStmt
-    or
-    l = TLblGoto(n.(LabelStmt).getLabel())
+    exists(SwitchStmt switch | switch = getEnclosingSwitch(jump) |
+      result = switch.getAConstCase() and result.getLabel() = jump.(GotoCaseStmt).getLabel()
+      or
+      result = switch.getDefaultCase() and jump instanceof GotoDefaultStmt
+    )
+  }
+
+  Ast::AstNode getJumpTargetDestination(JumpTarget target) { result = target }
+
+  predicate additionalGotoCatchBoundary(Ast::AstNode completedChild, JumpTarget target) {
+    exists(SwitchStmt switch |
+      completedChild.(Stmt).getParent() = switch and
+      target.getParent() = switch and
+      target instanceof CaseStmt
+    )
   }
 
   class CallableContext = CompilationExt;
@@ -230,21 +239,7 @@ private module Input implements InputSig1, InputSig2 {
   }
 
   predicate endAbruptCompletion(Ast::AstNode ast, PreControlFlowNode n, AbruptCompletion c) {
-    exists(SwitchStmt switch, Label l, Ast::Case case |
-      ast.(Stmt).getParent() = switch and
-      c.getSuccessorType() instanceof GotoSuccessor and
-      c.hasLabel(l) and
-      n.isAfterValue(case, any(MatchingSuccessor t | t.getValue() = true))
-    |
-      exists(string value, ConstCase cc |
-        l = TLblSwitchCase(value) and
-        switch.getAConstCase() = cc and
-        cc.getLabel() = value and
-        cc = case
-      )
-      or
-      l = TLblSwitchDefault() and switch.getDefaultCase() = case
-    )
+    none()
   }
 
   predicate step(PreControlFlowNode n1, PreControlFlowNode n2) {

go/ql/lib/semmle/go/controlflow/ControlFlowGraphImpl.qll

@@ -433,28 +433,34 @@ module CfgImpl {
       string toString() { result = this }
     }
 
+    class JumpTarget = Go::LabeledStmt;
+
+    JumpTarget getAGotoTarget(Ast::GotoStmt jump) {
+      result.getEnclosingFunction() = jump.getEnclosingFunction() and
+      result.getLabel() = jump.getLabel()
+    }
+
+    Ast::AstNode getJumpTargetDestination(JumpTarget target) { result = target }
+
+    predicate additionalGotoCatchBoundary(Ast::AstNode completedChild, JumpTarget target) {
+      exists(Go::FuncDef fd |
+        completedChild = fd.getBody() and
+        target = fd.getBody().getAStmt()
+      )
+      or
+      completedChild = target.getStmt()
+    }
+
     predicate hasLabel(Ast::AstNode n, Label l) {
-      // A statement carries the label of every `LabeledStmt` that wraps it.
-      // This is recursive because Go allows stacked labels (`L1: L2: stmt`),
-      // which the extractor represents as nested `LabeledStmt`s, so a single
-      // statement may have several labels.
+      // Loops and selects carry the label of every `LabeledStmt` that wraps
+      // them, for matching labeled break and continue statements.
       exists(Go::LabeledStmt ls | n = ls.getStmt() | l = ls.getLabel() or hasLabel(ls, l))
       or
-      // The `LabeledStmt` wrapper itself also carries its label. Blocks contain
-      // the wrapper (not the inner statement) as a direct child, so the shared
-      // library's block-level `goto` target resolution -- which looks for a
-      // labelled statement that is a direct child of a block -- matches on the
-      // wrapper.
       l = n.(Go::LabeledStmt).getLabel()
       or
       l = n.(Go::BreakStmt).getLabel()
       or
       l = n.(Go::ContinueStmt).getLabel()
-      or
-      // A `goto` statement carries its target label, so that the shared
-      // library's `beginAbruptCompletion` produces a *labelled* goto completion
-      // (matching the target label) rather than an unlabelled one.
-      l = n.(Go::GotoStmt).getLabel()
     }
 
     predicate preOrderExpr(Ast::Expr e) {
@@ -835,28 +841,6 @@ module CfgImpl {
         exists(fd.getResultVar(0)) and
         n.isAdditional(fd.getBody(), "result-read:0")
       )
-      or
-      // Handle goto targets that the shared block logic cannot see: top-level
-      // statements of function bodies and labels enclosing the current node.
-      exists(Go::Stmt target, Label l |
-        (
-          exists(Go::FuncDef fd |
-            ast = fd.getBody() and
-            target = fd.getBody().getAStmt() and
-            hasLabel(target, l)
-          )
-          or
-          exists(Go::LabeledStmt lbl |
-            ast = lbl.getStmt() and
-            target = lbl and
-            l = lbl.getLabel()
-          )
-        ) and
-        not target instanceof Go::GotoStmt and
-        n.isBefore(target) and
-        c.getSuccessorType() instanceof GotoSuccessor and
-        c.hasLabel(l)
-      )
     }
 
     /** Holds if `ast` or one of its CFG children may panic. */

java/ql/lib/semmle/code/java/ControlFlowGraph.qll

@@ -543,6 +543,8 @@ private module Input implements InputSig1, InputSig2 {
     }
   }
 
+  class JumpTarget = Void;
+
   private Label getLabelOfLoop(Stmt s) {
     exists(LabeledStmt l | s = l.getStmt() |
       result = TJavaLabel(l.getLabel()) or

python/ql/lib/semmle/python/controlflow/internal/AstNodeImpl.qll

@@ -1618,6 +1618,8 @@ private module Input implements InputSig1, InputSig2 {
     string toString() { result = "label" }
   }
 
+  class JumpTarget = Void;
+
   class CallableContext = Void;
 
   predicate inConditionalContext(Ast::AstNode n, ConditionKind kind) {

ruby/ql/lib/codeql/ruby/controlflow/ControlFlowGraph.qll

@@ -465,6 +465,8 @@ private module Input implements InputSig1, InputSig2 {
 
   class Label = Void;
 
+  class JumpTarget = Void;
+
   predicate preOrderExpr(Ast::Expr e) {
     e instanceof R::Ast::StmtSequence or
     e instanceof R::Ast::RescueClause or