From 65615a79a81ebde5a2a7682bb3e6350491343925 Mon Sep 17 00:00:00 2001
From: Mathias Vorreiter Pedersen <mathiasvp@github.com>
Date: Fri, 4 Sep 2026 13:34:55 +0100
Subject: [PATCH] C++: Fix join in virtual dispatch's 'returnStep' predicate.

---
 .../ir/dataflow/internal/DataFlowDispatch.qll | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
index bce936552768..03a565ef946d 100644
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll
@@ -131,6 +131,15 @@ private predicate qualifierSourceImpl(RelevantNode n, Class c) {
   )
 }
 
+pragma[nomagic]
+private predicate hasKindAndEnclosingCallable(
+  DataFlowPrivate::DataFlowCallable callable, DataFlowPrivate::ReturnKind kind,
+  DataFlowPrivate::ReturnNode return
+) {
+  return.getEnclosingCallable() = callable and
+  return.getKind() = kind
+}
+
 private module TrackVirtualDispatch<methodDispatchSig/1 virtualDispatch0> {
   /**
    * Gets a possible runtime target of `c` using both static call-target
@@ -197,11 +206,21 @@ private module TrackVirtualDispatch<methodDispatchSig/1 virtualDispatch0> {
       )
     }
 
+    pragma[nomagic]
+    private predicate hasDispatchWithKind(
+      DataFlowPrivate::DataFlowCallable callable, DataFlowPrivate::ReturnKind kind,
+      LocalSourceNode n2
+    ) {
+      exists(DataFlowPrivate::DataFlowCall call |
+        n2 = DataFlowPrivate::getAnOutNode(call, kind) and
+        callable = dispatch(call)
+      )
+    }
+
     predicate returnStep(Node n1, LocalSourceNode n2) {
-      exists(DataFlowPrivate::DataFlowCallable callable, DataFlowPrivate::DataFlowCall call |
-        n1.(DataFlowPrivate::ReturnNode).getEnclosingCallable() = callable and
-        callable = dispatch(call) and
-        n2 = DataFlowPrivate::getAnOutNode(call, n1.(DataFlowPrivate::ReturnNode).getKind())
+      exists(DataFlowPrivate::DataFlowCallable callable, DataFlowPrivate::ReturnKind kind |
+        hasKindAndEnclosingCallable(callable, kind, n1) and
+        hasDispatchWithKind(callable, kind, n2)
       )
     }