Shared CFG: check abrupt completion origins

[yoff]

Summary

• add invalidAbruptCompletionOrigin to the shared CFG consistency checks;
• validate only language-supplied Input2::beginAbruptCompletion origins, requiring each origin to be either node.isIn(ast) or node.isAdditional(ast, _);
• register the check in consistencyOverview, which is compiled and run by the existing consistency-query harnesses for every current consumer: Java, C#, and Python.

This intentionally does not inspect the shared library's combined private beginAbruptCompletion, whose unmatched final catch-clause completion legitimately originates at isAfterValue.

Motivation

This follows the consistency-check suggestion from review of #22380: #22380 (comment). The change is independent of #22380 and contains no Python-specific CFG behavior change.

Validation

• codeql test run --search-path=. --consistency-queries java/ql/consistency-queries -- java/ql/test/library-tests/controlflow/basic — 27 tests passed
• codeql test run --search-path=. --consistency-queries csharp/ql/consistency-queries -- csharp/ql/test/library-tests/controlflow/graph — 12 tests passed
• codeql test run --search-path=. --consistency-queries python/ql/consistency-queries -- python/ql/test/library-tests/ControlFlow/successors — 6 tests passed

No invalid abrupt-completion origins or unrelated expected-output churn were found in the three consuming languages.

[Copilot]

Pull request overview

Adds shared CFG validation ensuring language-supplied abrupt completions originate from their associated in/additional node.

Changes:

• Registers invalidAbruptCompletionOrigin in CFG consistency checks.
• Adds generated regression coverage for Java, C#, and Python consumers.

Show a summary per file

File	Description
shared/controlflow/codeql/controlflow/ControlFlowGraph.qll	Implements and registers the consistency check.
python/ql/test/library-tests/ControlFlow/successors/InvalidAbruptCompletionOrigin.ql	Adds Python validation.
python/ql/test/library-tests/ControlFlow/successors/InvalidAbruptCompletionOrigin.expected	Records expected Python results.
java/ql/test/library-tests/controlflow/basic/InvalidAbruptCompletionOrigin.ql	Adds Java validation.
java/ql/test/library-tests/controlflow/basic/InvalidAbruptCompletionOrigin.expected	Records expected Java results.
csharp/ql/test/library-tests/controlflow/graph/InvalidAbruptCompletionOrigin.ql	Adds C# validation.
csharp/ql/test/library-tests/controlflow/graph/InvalidAbruptCompletionOrigin.expected	Records expected C# results.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Balanced

[aschackmull]

All of the added qltests and corresponding expected files are unnecessary, since this is a consistency query.

[yoff]

Sorry, this was meant to be a draft. It is currently completely copilot, so I need to look it over.

[yoff]

Addressed: removed the standalone qltests and generated expected files. The existing Java, C#, and Python consistency-query harnesses compile and run the new check; their targeted suites pass 27/27, 12/12, and 6/6 respectively.

[aschackmull]

Small nit: Can we keep the disjunct ordering the same in this predicate as the query predicate ordering below? I.e. for instance move this newly added disjunct up above query = "missingInNodeForPostOrInOrder" since that's where it's at below.