C++: support for clang __builtin_addressof and GNU vector fill operations

cpp/ql/src/semmle/code/cpp/exprs/BuiltInOperations.qll

@@ -202,6 +202,20 @@ class BuiltInOperationBuiltInShuffleVector extends BuiltInOperation, @builtinshu
   override string toString() { result = "__builtin_shufflevector" }
 }
 
+/**
+ * A clang `__builtin_addressof` expression (can be used to implement C++'s std::addressof).
+ */
+class BuiltInOperationBuiltInAddressOf extends UnaryOperation, BuiltInOperation, @builtinaddressof {
+  /** Gets the function or variable whose address is taken. */
+  Declaration getAddressable() {
+       result = this.getOperand().(Access).getTarget()
+       // this handles the case where we are taking the address of a reference variable
+    or result = this.getOperand().(ReferenceDereferenceExpr).getChild(0).(Access).getTarget()
+  }
+
+  override string getOperator() { result = "__builtin_addressof" }
+}
+
 /**
  * The `__is_trivially_constructible` type trait.
  */
@@ -369,3 +383,10 @@ class BuiltInOperationIsFinal extends BuiltInOperation, @isfinalexpr {
 class BuiltInChooseExpr extends BuiltInOperation, @builtinchooseexpr {
   override string toString() { result = "__builtin_choose_expr" }
 }
+
+/**
+ * Fill operation on a GNU vector.
+ */
+class VectorFillOperation extends UnaryOperation, @vec_fill {
+  override string getOperator() { result = "(vector fill)" }
+}

cpp/ql/src/semmlecode.cpp.dbscheme

@@ -1429,6 +1429,8 @@ case @expr.kind of
 | 319 = @noexceptexpr
 | 320 = @builtinshufflevector
 | 321 = @builtinchooseexpr
+| 322 = @builtinaddressof
+| 323 = @vec_fill
 ;
 
 new_allocated_type(