[Java] Why doesn's a method that returns void also have a DataFlow::Node associated with it?

[JLLeitschuh]

This query will only return results for MethodAccess with the name "render" that return some object.

predicate testQuery2(MethodAccess ma, Expr qualifier, DataFlow::Node node1) {
  ma.getMethod().hasName("render") and
  ma.getQualifier() = quaifier and
  node1.asExpr() = qualifier
}

This query will only return results for MethodAccess with the name "render" that return some object, but not void.

predicate testQuery2(MethodAccess ma, Expr qualifier, DataFlow::Node node1) {
  ma.getMethod().hasName("render") and
  ma.getQualifier() = qualifier and
  node1.asExpr() = ma
}

Why is it that CodeQL doesn't generate DataFlow::Node for methods that have a void return type? This behaviour prevents the creation of data flow graphs that terminate at the method call site. They can only terminate at the call to the qualifier.

---

For what it's worth, this took me an hour and a half to root cause 🤕. I thought I was crazy or had some fundemental misunderstading of how qualifiers worked in CodeQL.

[smowton]

Dataflow nodes represent data flowing into or out of an instruction, and the dataflow node associated with a MethodAccess represents that method's result. When it is void-typed there is no result and so no Node to represent it.

If you're looking to trace dataflow to a callsite, you're looking for something flowing into either the qualifier or to some argument. Looking for a qualifier node or for an argument node is correct in this case.