Shared CFG: check abrupt completion origins

shared/controlflow/codeql/controlflow/ControlFlowGraph.qll

@@ -2257,6 +2257,12 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
             query = "missingInNodeForPostOrInOrder" and
             results = strictcount(AstNode ast | missingInNodeForPostOrInOrder(ast))
             or
+            query = "invalidAbruptCompletionOrigin" and
+            results =
+              strictcount(AstNode ast, PreControlFlowNode node |
+                invalidAbruptCompletionOrigin(ast, node)
+              )
+            or
             query = "multipleSuccessors" and
             results =
               strictcount(ControlFlowNode node, SuccessorType t, ControlFlowNode successor |
@@ -2341,6 +2347,16 @@ module Make0<LocationSig Location, AstSig<Location> Ast> {
             1 < strictcount(NormalSuccessor t | additionalNode(n, tag, t))
           }
 
+          /**
+           * Holds if the language-specific CFG input supplies an abrupt completion for `ast` whose
+           * origin `node` does not belong to `ast`.
+           */
+          query predicate invalidAbruptCompletionOrigin(AstNode ast, PreControlFlowNode node) {
+            Input2::beginAbruptCompletion(ast, node, _, _) and
+            not node.isIn(ast) and
+            not node.isAdditional(ast, _)
+          }
+
           /**
            * Holds if the "in" node is unreachable for a post-or-in-order AST node.
            *