Python: test direct guard specialization semantics

Prove that the query-shaped shared-SSA relation for direct truthiness guards is equivalent to the generic BarrierGuard abstraction on the modification-of-default-value regression corpus. This guards the performance specialization against semantic drift before changing production code.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 07c775e7-cd7c-4e1c-8d97-5194ffd43e1a

Author: yoff

python/ql/test/query-tests/Functions/ModificationOfParameterWithDefault/BarrierGuardSpecialization.expected

@@ -0,0 +1,38 @@
+import python
+import semmle.python.dataflow.new.DataFlow
+private import semmle.python.controlflow.internal.Cfg as Cfg
+private import semmle.python.dataflow.new.internal.SsaImpl as SsaImpl
+
+private predicate truthyGuard(DataFlow::GuardNode guard, Cfg::ControlFlowNode node, boolean branch) {
+  node = guard and branch = true
+}
+
+private predicate falseyGuard(DataFlow::GuardNode guard, Cfg::ControlFlowNode node, boolean branch) {
+  node = guard and branch = false
+}
+
+private predicate genericRelation(DataFlow::ExprNode node, boolean branch) {
+  branch = true and node = DataFlow::BarrierGuard<truthyGuard/3>::getABarrierNode()
+  or
+  branch = false and node = DataFlow::BarrierGuard<falseyGuard/3>::getABarrierNode()
+}
+
+private predicate directRelation(DataFlow::ExprNode node, boolean branch) {
+  exists(
+    DataFlow::GuardNode guard, SsaImpl::EssaDefinition def, Cfg::NameNode checked, Cfg::NameNode use
+  |
+    checked = guard and
+    SsaImpl::AdjacentUses::useOfDef(def, checked) and
+    SsaImpl::AdjacentUses::useOfDef(def, use) and
+    checked != use and
+    guard.controlsBlock(use.getBasicBlock(), branch) and
+    node.asCfgNode() = use
+  )
+}
+
+from DataFlow::ExprNode node, boolean branch
+where
+  directRelation(node, branch) and not genericRelation(node, branch)
+  or
+  genericRelation(node, branch) and not directRelation(node, branch)
+select node, branch