[MathiasVP]

The forwarding logic did essentially this:

predicate typeConversion(TypeState s1, TypeState s2) { ... }

predicate fwd(TypeState s) {
  isSource(s)
  or
  exists(TypeState s0 |
    fwd(s0) and
    typeConversion(s0, s)
  )
}

predicate rev(TypeState s) {
  fwd(s) and
  (
    isSink(s)
    or
    exists(TypeState s1 |
      rev(s1) and
      typeConversion(s, s1)
    )
  )
}

but it turns out some of the typeConversion steps are rather large relations. So this PR puts appropriate bindingset annotations on the large relations to prevent a tuple explosion.

Additionally, TypeState consisted of 4 columns (Type, ValueCategory, Boolean, Phase) which were very hard to relate in any way other than through cartesian products. To fix that, this PR also delays construction of the TypeState until after the fwd phase. We can then construct the TypeState IPA based on the tuples that are included in the fwd relation.

Commit-by-commit review recommended.

Since we don't have any non-test forwards models yet I don't think there's a need to run DCA on this PR.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the constructor-forwarding analysis optimization.

No open issues 🎉

What changed in this PR

Optimizes C++ constructor-forwarding analysis to limit intermediate tuple growth during type conversions.

Changes:

• Adds bindingset annotations to constrain large conversion relations.
• Computes forward reachability using separate state components, then constructs TypeState values only for reachable tuples.
• Centralizes conversion transitions in typeStep for use by forward and reverse traversal.

File	Description
cpp/​ql/​lib/​semmle/​code/​cpp/​dataflow/​ExternalFlow.qll	Refactors forwarding-state traversal and constrains conversion relations to improve evaluation performance.

_{Review effort: Max (auto)}