C++: Improvements to IRGuards

[MathiasVP]

This PR adds another inference rule to the IRGuards logic: When we have something like:

if((a == 42) != 0) {
 // ...
}

the truth value of the != determines the truth value of ==, which in turn determines whether a == 42 can be established inside // ...

One needs to be careful regarding conversions in the code above: a == 42 is of Boolean type, but because the right-hand side of != is an integer there's an bool-to-int conversion on a == 42 which needs to be skipped before it makes sense to call the guard logic recursively. So e6cd27a adds a backwards-forwards pruned step relation to skip such bool-to-int conversions.

DCA looks good. We remove exactly the four FPs that appeared after we merged #20145 🎉

[Copilot]

Pull Request Overview

This PR improves the C++ IRGuards logic by adding a new inference rule for nested comparisons like if((a == 42) != 0). The enhancement allows the system to recognize that the truth value of the outer inequality determines the truth value of the inner equality, which in turn establishes whether a == 42 holds.

Key changes include:

• Implementation of a backwards-forwards pruned step relation to skip bool-to-int conversions when applying guard logic recursively
• Addition of inference rules that handle comparisons of boolean expressions against zero
• Extension of the guard logic to work through __builtin_expect calls and type conversions

Reviewed Changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll	Core implementation of improved IRGuards logic with new BooleanInstruction module and enhanced comparison handling
cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp	Updated test comments removing FALSE POSITIVE annotations, now correctly handled
cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.c	New test case for likely macro with sscanf validation
cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.expected	Updated expected results removing previous false positives
cpp/ql/test/library-tests/controlflow/guards/test.cpp	New test cases for comparison implications with binary and unary operations
cpp/ql/test/library-tests/controlflow/guards/test.c	New test case for likely macro usage
cpp/ql/test/library-tests/controlflow/guards/GuardsEnsure.ql	Simplified query output format removing location ranges
cpp/ql/test/library-tests/controlflow/guards/GuardsControl.ql	Simplified query output format removing location ranges
cpp/ql/test/library-tests/controlflow/guards/GuardsControl.expected	Updated expected results with new format and additional test coverage
cpp/ql/test/library-tests/controlflow/guards/GuardsCompare.ql	Simplified query output format
cpp/ql/test/library-tests/controlflow/guards/Guards.expected	Updated expected results with additional guard conditions

---

_{You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}