JS: move default parameter values to the DefUse graph

Author: Esben Sparre Andreasen

javascript/ql/src/semmle/javascript/DefUse.qll

@@ -12,6 +12,7 @@ import javascript
  * <tr><td><code>x = y</code><td><code>x = y</code><td><code>x</code><td><code>y</code></tr>
  * <tr><td><code>var a = b</code><td><code>var a = b</code><td><code>a</code><td><code>b</code></tr>
  * <tr><td><code>function f { ... }</code><td><code>f</code><td><code>f</code><td><code>function f { ... }</code></tr>
+ * <tr><td><code>function f ( x = y ){ ... }</code><td><code>x</code><td><code>x</code><td><code>y</code></tr>
  * <tr><td><code>class C { ... }</code><td><code>C</code><td><code>C</code><td><code>class C { ... }</code></tr>
  * <tr><td><code>namespace N { ... }</code><td><code>N</code><td><code>N</code><td><code>namespace N { ... }</code></tr>
  * <tr><td><code>enum E { ... }</code><td><code>E</code><td><code>E</code><td><code>enum E { ... }</code></tr>
@@ -42,6 +43,8 @@ private predicate defn(ControlFlowNode def, Expr lhs, AST::ValueNode rhs) {
   exists(EnumMember member | def = member.getIdentifier() |
     lhs = def and rhs = member.getInitializer()
   )
+  or
+  lhs = def and def.(Parameter).getDefault() = rhs
 }
 
 /**

javascript/ql/src/semmle/javascript/RangeAnalysis.qll

@@ -104,7 +104,12 @@ module RangeAnalysis {
   pragma[noinline]
   private predicate hasUniquePredecessor(DataFlow::Node node) {
     isRelevant(node) and
-    strictcount(node.getAPredecessor()) = 1
+    strictcount(node.getAPredecessor()) = 1 and
+    // exclude parameters with default values
+    not exists (Parameter p |
+      DataFlow::parameterNode(p) = node and
+      exists(p.getDefault())
+    )
   }
 
   /**

javascript/ql/src/semmle/javascript/dataflow/internal/VariableTypeInference.qll

@@ -143,7 +143,7 @@ private class AnalyzedParameter extends AnalyzedVarDef, @vardecl {
 
   override DataFlow::AnalyzedNode getRhs() {
     getFunction().argumentPassing(this, result.asExpr()) or
-    result = this.(Parameter).getDefault().analyze()
+    result = AnalyzedVarDef.super.getRhs()
   }
 
   override AbstractValue getAnRhsValue() {

javascript/ql/test/library-tests/DefUse/VarDefSource.expected

@@ -29,4 +29,4 @@
 | tst.js:11:11:11:11 | g | tst.js:11:2:15:1 | functio ... rn x;\\n} |
 | tst.js:12:2:12:7 | x = 42 | tst.js:12:6:12:7 | 42 |
 | tst.js:19:11:19:11 | x | tst.js:19:2:19:16 | function x() {} |
-| tst.js:23:6:23:23 | {a = b, c = d} = e | tst.js:23:23:23:23 | e |
+| tst.js:26:11:26:11 | a | tst.js:26:15:26:15 | b |

javascript/ql/test/query-tests/Statements/UselessComparisonTest/UselessComparisonTest.expected

@@ -1,5 +1,5 @@
 | constant.js:2:7:2:11 | 1 > 2 | The condition '1 > 2' is always false. |
 | constant.js:3:7:3:11 | 1 > 0 | The condition '1 > 0' is always true. |
 | example.js:8:7:8:13 | i < end | The condition 'i < end' is always false. |
-| tst.js:8:23:8:33 | i == 100000 | The condition 'i == 100000' is always false. |
+| tst.js:8:22:8:32 | i == 100000 | The condition 'i == 100000' is always false. |
 | tst.js:9:23:9:33 | i == 100000 | The condition 'i == 100000' is always false. |

javascript/ql/test/query-tests/Statements/UselessConditional/UselessConditional.expected

@@ -33,5 +33,3 @@
 | UselessConditionalGood.js:69:12:69:13 | xy | This use of variable 'xy' always evaluates to false. |
 | UselessConditionalGood.js:85:12:85:13 | xy | This use of variable 'xy' always evaluates to false. |
 | UselessConditionalGood.js:97:12:97:13 | xy | This use of variable 'xy' always evaluates to false. |
-| UselessConditionalGood.js:114:8:114:8 | p | This use of variable 'p' always evaluates to false. |
-| UselessConditionalGood.js:122:8:122:8 | p | This use of variable 'p' always evaluates to false. |