Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow

.git-blame-ignore-revs

@@ -0,0 +1,21 @@
+# .git-blame-ignore-revs
+# Auto-formatted Java
+730eae952139209fe9fdf598541d608f4c0c0c84
+# Auto-formatted C#
+5ad7ed49dd3de03ec6dcfcb6848758a6a987e11c
+# Auto-formatted C/C++
+ef97e539ec1971494d4bba5cafe82e00bc8217ac
+# Auto-formatted Python
+21d5fa836b3a7d020ba45e8b8168b145a9772131
+# Auto-formatted JavaScript
+8d97fe9ed327a9546ff2eaf515cf0f5214deddd9
+# Auto-formatted Ruby
+a5d229903d2f12d45f2c2c38822f1d0e7504ae7f
+# Auto-formatted Go
+08c658e66bf867090033ea096e244a93d46c0aa7
+# Auto-formatted Swift
+711d7057f79fb7d72fc3b35e010bd018f9009169
+# Auto-formatted shared ql packs
+3640b6d3a8ce9edf8e1d3ed106fe8526cf255bc0
+# Auto-formatted taint tracking files
+159d8e978c51959b380838c080d891b66e763b19

CODEOWNERS

@@ -2,9 +2,9 @@
 /csharp/ @github/codeql-csharp
 /go/ @github/codeql-go
 /java/ @github/codeql-java
-/javascript/ @github/codeql-dynamic
-/python/ @github/codeql-dynamic
-/ruby/ @github/codeql-dynamic
+/javascript/ @github/codeql-javascript
+/python/ @github/codeql-python
+/ruby/ @github/codeql-ruby
 /swift/ @github/codeql-swift
 /misc/codegen/ @github/codeql-swift
 /java/kotlin-extractor/ @github/codeql-kotlin

cpp/ql/lib/change-notes/2023-03-03-delete-deps.md

@@ -0,0 +1,12 @@
+---
+category: minorAnalysis
+---
+* Deleted the deprecated `hasGeneratedCopyConstructor` and `hasGeneratedCopyAssignmentOperator` predicates from the `Folder` class.
+* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class.
+* Deleted the deprecated `getMustlockFunction`, `getTrylockFunction`, `getLockFunction`, and `getUnlockFunction` predicates from the `MutexType` class.
+* Deleted the deprecated `getPosInBasicBlock` predicate from the `SubBasicBlock` class.
+* Deleted the deprecated `getExpr` predicate from the `PointerDereferenceExpr` class.
+* Deleted the deprecated `getUseInstruction` and `getDefinitionInstruction` predicates from the `Operand` class.
+* Deleted the deprecated `isInParameter`, `isInParameterPointer`, and `isInQualifier` predicates from the `FunctionInput` class.
+* Deleted the deprecated `isOutParameterPointer`, `isOutQualifier`, `isOutReturnValue`, and `isOutReturnPointer` predicate from the `FunctionOutput` class.
+* Deleted the deprecated 3-argument `isGuardPhi` predicate from the `RangeSsaDefinition` class.

cpp/ql/lib/change-notes/2023-03-13-mergepathgraph.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query.

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisStage.qll

@@ -936,6 +936,15 @@ module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<
     bounded(cast.getOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
   }
 
+  /**
+   * Computes a normal form of `x` where -0.0 has changed to +0.0. This can be
+   * needed on the lesser side of a floating-point comparison or on both sides of
+   * a floating point equality because QL does not follow IEEE in floating-point
+   * comparisons but instead defines -0.0 to be less than and distinct from 0.0.
+   */
+  bindingset[x]
+  private float normalizeFloatUp(float x) { result = x + 0.0 }
+
   /**
    * Holds if `b + delta` is a valid bound for `e`.
    * - `upper = true`  : `e <= b + delta`
@@ -1020,6 +1029,15 @@ module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<
         or
         upper = false and delta = D::fromFloat(D::toFloat(d1).minimum(D::toFloat(d2)))
       )
+      or
+      exists(SemExpr mid, D::Delta d, float f |
+        e.(SemNegateExpr).getOperand() = mid and
+        b instanceof SemZeroBound and
+        bounded(mid, b, d, upper.booleanNot(), fromBackEdge, origdelta, reason) and
+        f = normalizeFloatUp(-D::toFloat(d)) and
+        delta = D::fromFloat(f) and
+        if semPositive(e) then f >= 0 else any()
+      )
     )
   }
 

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/SimpleRangeAnalysis.qll

@@ -0,0 +1,132 @@
+/**
+ * Wrapper for the semantic range analysis library that mimics the
+ * interface of the simple range analysis library.
+ */
+
+private import cpp
+private import semmle.code.cpp.ir.IR
+private import experimental.semmle.code.cpp.semantic.SemanticBound
+private import experimental.semmle.code.cpp.semantic.SemanticExprSpecific
+private import RangeAnalysis
+
+/**
+ * Gets the lower bound of the expression.
+ *
+ * Note: expressions in C/C++ are often implicitly or explicitly cast to a
+ * different result type. Such casts can cause the value of the expression
+ * to overflow or to be truncated. This predicate computes the lower bound
+ * of the expression without including the effect of the casts. To compute
+ * the lower bound of the expression after all the casts have been applied,
+ * call `lowerBound` like this:
+ *
+ *    `lowerBound(expr.getFullyConverted())`
+ */
+float lowerBound(Expr expr) {
+  exists(Instruction i, SemBound b | i.getAst() = expr and b instanceof SemZeroBound |
+    semBounded(getSemanticExpr(i), b, result, false, _)
+  )
+}
+
+/**
+ * Gets the upper bound of the expression.
+ *
+ * Note: expressions in C/C++ are often implicitly or explicitly cast to a
+ * different result type. Such casts can cause the value of the expression
+ * to overflow or to be truncated. This predicate computes the upper bound
+ * of the expression without including the effect of the casts. To compute
+ * the upper bound of the expression after all the casts have been applied,
+ * call `upperBound` like this:
+ *
+ *    `upperBound(expr.getFullyConverted())`
+ */
+float upperBound(Expr expr) {
+  exists(Instruction i, SemBound b | i.getAst() = expr and b instanceof SemZeroBound |
+    semBounded(getSemanticExpr(i), b, result, true, _)
+  )
+}
+
+/**
+ * Holds if the upper bound of `expr` may have been widened. This means the
+ * upper bound is in practice likely to be overly wide.
+ */
+predicate upperBoundMayBeWidened(Expr e) { none() }
+
+/**
+ * Holds if `expr` has a provably empty range. For example:
+ *
+ *   10 < expr and expr < 5
+ *
+ * The range of an expression can only be empty if it can never be
+ * executed. For example:
+ *
+ * ```cpp
+ * if (10 < x) {
+ *   if (x < 5) {
+ *     // Unreachable code
+ *     return x; // x has an empty range: 10 < x && x < 5
+ *   }
+ * }
+ * ```
+ */
+predicate exprWithEmptyRange(Expr expr) { lowerBound(expr) > upperBound(expr) }
+
+/** Holds if the definition might overflow negatively. */
+predicate defMightOverflowNegatively(RangeSsaDefinition def, StackVariable v) { none() }
+
+/** Holds if the definition might overflow positively. */
+predicate defMightOverflowPositively(RangeSsaDefinition def, StackVariable v) { none() }
+
+/**
+ * Holds if the definition might overflow (either positively or
+ * negatively).
+ */
+predicate defMightOverflow(RangeSsaDefinition def, StackVariable v) {
+  defMightOverflowNegatively(def, v) or
+  defMightOverflowPositively(def, v)
+}
+
+/**
+ * Holds if the expression might overflow negatively. This predicate
+ * does not consider the possibility that the expression might overflow
+ * due to a conversion.
+ */
+predicate exprMightOverflowNegatively(Expr expr) { none() }
+
+/**
+ * Holds if the expression might overflow negatively. Conversions
+ * are also taken into account. For example the expression
+ * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
+ * due to the addition.
+ */
+predicate convertedExprMightOverflowNegatively(Expr expr) {
+  exprMightOverflowNegatively(expr) or
+  convertedExprMightOverflowNegatively(expr.getConversion())
+}
+
+/**
+ * Holds if the expression might overflow positively. This predicate
+ * does not consider the possibility that the expression might overflow
+ * due to a conversion.
+ */
+predicate exprMightOverflowPositively(Expr expr) { none() }
+
+/**
+ * Holds if the expression might overflow positively. Conversions
+ * are also taken into account. For example the expression
+ * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
+ * due to the addition.
+ */
+predicate convertedExprMightOverflowPositively(Expr expr) {
+  exprMightOverflowPositively(expr) or
+  convertedExprMightOverflowPositively(expr.getConversion())
+}
+
+/**
+ * Holds if the expression might overflow (either positively or
+ * negatively). The possibility that the expression might overflow
+ * due to an implicit or explicit cast is also considered.
+ */
+predicate convertedExprMightOverflow(Expr expr) {
+  convertedExprMightOverflowNegatively(expr) or
+  convertedExprMightOverflowPositively(expr)
+}

cpp/ql/lib/semmle/code/cpp/Class.qll

@@ -227,18 +227,6 @@ class Class extends UserType {
     result = this.accessOfBaseMember(member.getDeclaringType(), member.getASpecifier())
   }
 
-  /**
-   * DEPRECATED: name changed to `hasImplicitCopyConstructor` to reflect that
-   * `= default` members are no longer included.
-   */
-  deprecated predicate hasGeneratedCopyConstructor() { this.hasImplicitCopyConstructor() }
-
-  /**
-   * DEPRECATED: name changed to `hasImplicitCopyAssignmentOperator` to
-   * reflect that `= default` members are no longer included.
-   */
-  deprecated predicate hasGeneratedCopyAssignmentOperator() { this.hasImplicitCopyConstructor() }
-
   /**
    * Holds if this class, struct or union has an implicitly-declared copy
    * constructor that is not _deleted_. This predicate is more accurate than

cpp/ql/lib/semmle/code/cpp/NameQualifiers.qll

@@ -159,7 +159,8 @@ class NameQualifyingElement extends Element, @namequalifyingelement {
  * A special name-qualifying element. For example: `__super`.
  */
 library class SpecialNameQualifyingElement extends NameQualifyingElement,
-  @specialnamequalifyingelement {
+  @specialnamequalifyingelement
+{
   /** Gets the name of this special qualifying element. */
   override string getName() { specialnamequalifyingelements(underlyingElement(this), result) }
 

cpp/ql/lib/semmle/code/cpp/XML.qll

@@ -108,20 +108,6 @@ class XmlFile extends XmlParent, File {
   /** Gets the name of this XML file. */
   override string getName() { result = File.super.getAbsolutePath() }
 
-  /**
-   * DEPRECATED: Use `getAbsolutePath()` instead.
-   *
-   * Gets the path of this XML file.
-   */
-  deprecated string getPath() { result = this.getAbsolutePath() }
-
-  /**
-   * DEPRECATED: Use `getParentContainer().getAbsolutePath()` instead.
-   *
-   * Gets the path of the folder that contains this XML file.
-   */
-  deprecated string getFolder() { result = this.getParentContainer().getAbsolutePath() }
-
   /** Gets the encoding of this XML file. */
   string getEncoding() { xmlEncoding(this, result) }
 

cpp/ql/lib/semmle/code/cpp/commons/Synchronization.qll

@@ -59,26 +59,6 @@ abstract class MutexType extends Type {
    * Gets a call that unlocks any mutex of this type.
    */
   FunctionCall getUnlockAccess() { this.unlockAccess(result, _) }
-
-  /**
-   * DEPRECATED: use mustlockAccess(fc, arg) instead.
-   */
-  deprecated Function getMustlockFunction() { result = this.getMustlockAccess().getTarget() }
-
-  /**
-   * DEPRECATED: use trylockAccess(fc, arg) instead.
-   */
-  deprecated Function getTrylockFunction() { result = this.getTrylockAccess().getTarget() }
-
-  /**
-   * DEPRECATED: use lockAccess(fc, arg) instead.
-   */
-  deprecated Function getLockFunction() { result = this.getLockAccess().getTarget() }
-
-  /**
-   * DEPRECATED: use unlockAccess(fc, arg) instead.
-   */
-  deprecated Function getUnlockFunction() { result = this.getUnlockAccess().getTarget() }
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll

@@ -75,13 +75,6 @@ class SubBasicBlock extends ControlFlowNodeBase {
     )
   }
 
-  /**
-   * DEPRECATED: use `getRankInBasicBlock` instead. Note that this predicate
-   * returns a 0-based position, while `getRankInBasicBlock` returns a 1-based
-   * position.
-   */
-  deprecated int getPosInBasicBlock(BasicBlock bb) { result = this.getRankInBasicBlock(bb) - 1 }
-
   pragma[noinline]
   private int getIndexInBasicBlock(BasicBlock bb) { this = bb.getNode(result) }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlow.qll

@@ -243,3 +243,111 @@ module MakeWithState<StateConfigSig Config> implements DataFlowSig {
 
   import Impl<C>
 }
+
+signature class PathNodeSig {
+  /** Gets a textual representation of this element. */
+  string toString();
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  );
+
+  /** Gets the underlying `Node`. */
+  Node getNode();
+}
+
+signature module PathGraphSig<PathNodeSig PathNode> {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  predicate edges(PathNode a, PathNode b);
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  predicate nodes(PathNode n, string key, string val);
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out);
+}
+
+/**
+ * Constructs a `PathGraph` from two `PathGraph`s by disjoint union.
+ */
+module MergePathGraph<
+  PathNodeSig PathNode1, PathNodeSig PathNode2, PathGraphSig<PathNode1> Graph1,
+  PathGraphSig<PathNode2> Graph2>
+{
+  private newtype TPathNode =
+    TPathNode1(PathNode1 p) or
+    TPathNode2(PathNode2 p)
+
+  /** A node in a graph of path explanations that is formed by disjoint union of the two given graphs. */
+  class PathNode extends TPathNode {
+    /** Gets this as a projection on the first given `PathGraph`. */
+    PathNode1 asPathNode1() { this = TPathNode1(result) }
+
+    /** Gets this as a projection on the second given `PathGraph`. */
+    PathNode2 asPathNode2() { this = TPathNode2(result) }
+
+    /** Gets a textual representation of this element. */
+    string toString() {
+      result = this.asPathNode1().toString() or
+      result = this.asPathNode2().toString()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.asPathNode1().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) or
+      this.asPathNode2().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    Node getNode() {
+      result = this.asPathNode1().getNode() or
+      result = this.asPathNode2().getNode()
+    }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PathGraph implements PathGraphSig<PathNode> {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PathNode a, PathNode b) {
+      Graph1::edges(a.asPathNode1(), b.asPathNode1()) or
+      Graph2::edges(a.asPathNode2(), b.asPathNode2())
+    }
+
+    /** Holds if `n` is a node in the graph of data flow path explanations. */
+    query predicate nodes(PathNode n, string key, string val) {
+      Graph1::nodes(n.asPathNode1(), key, val) or
+      Graph2::nodes(n.asPathNode2(), key, val)
+    }
+
+    /**
+     * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+     * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+     * `ret -> out` is summarized as the edge `arg -> out`.
+     */
+    query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+      Graph1::subpaths(arg.asPathNode1(), par.asPathNode1(), ret.asPathNode1(), out.asPathNode1()) or
+      Graph2::subpaths(arg.asPathNode2(), par.asPathNode2(), ret.asPathNode2(), out.asPathNode2())
+    }
+  }
+}

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

@@ -3157,7 +3157,7 @@ module Impl<FullStateConfigSig Config> {
   /**
    * Provides the query predicates needed to include a graph in a path-problem query.
    */
-  module PathGraph {
+  module PathGraph implements PathGraphSig<PathNode> {
     /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
     query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll

@@ -75,13 +75,6 @@ class SubBasicBlock extends ControlFlowNodeBase {
     )
   }
 
-  /**
-   * DEPRECATED: use `getRankInBasicBlock` instead. Note that this predicate
-   * returns a 0-based position, while `getRankInBasicBlock` returns a 1-based
-   * position.
-   */
-  deprecated int getPosInBasicBlock(BasicBlock bb) { result = this.getRankInBasicBlock(bb) - 1 }
-
   pragma[noinline]
   private int getIndexInBasicBlock(BasicBlock bb) { this = bb.getNode(result) }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTracking.qll

@@ -7,7 +7,8 @@ import TaintTrackingParameter::Public
 private import TaintTrackingParameter::Private
 
 private module AddTaintDefaults<DataFlowInternal::FullStateConfigSig Config> implements
-DataFlowInternal::FullStateConfigSig {
+  DataFlowInternal::FullStateConfigSig
+{
   import Config
 
   predicate isBarrier(DataFlow::Node node) {

cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll

@@ -569,7 +569,8 @@ class BuiltInOperationBuiltInAddressOf extends UnaryOperation, BuiltInOperation,
  * ```
  */
 class BuiltInOperationIsTriviallyConstructible extends BuiltInOperation,
-  @istriviallyconstructibleexpr {
+  @istriviallyconstructibleexpr
+{
   override string toString() { result = "__is_trivially_constructible" }
 
   override string getAPrimaryQlClass() { result = "BuiltInOperationIsTriviallyConstructible" }
@@ -619,7 +620,8 @@ class BuiltInOperationIsNothrowDestructible extends BuiltInOperation, @isnothrow
  * bool v = __is_trivially_destructible(MyType);
  * ```
  */
-class BuiltInOperationIsTriviallyDestructible extends BuiltInOperation, @istriviallydestructibleexpr {
+class BuiltInOperationIsTriviallyDestructible extends BuiltInOperation, @istriviallydestructibleexpr
+{
   override string toString() { result = "__is_trivially_destructible" }
 
   override string getAPrimaryQlClass() { result = "BuiltInOperationIsTriviallyDestructible" }
@@ -738,7 +740,8 @@ class BuiltInOperationIsLiteralType extends BuiltInOperation, @isliteraltypeexpr
  * ```
  */
 class BuiltInOperationHasTrivialMoveConstructor extends BuiltInOperation,
-  @hastrivialmoveconstructorexpr {
+  @hastrivialmoveconstructorexpr
+{
   override string toString() { result = "__has_trivial_move_constructor" }
 
   override string getAPrimaryQlClass() { result = "BuiltInOperationHasTrivialMoveConstructor" }
@@ -1034,7 +1037,8 @@ class BuiltInOperationIsAggregate extends BuiltInOperation, @isaggregate {
  * ```
  */
 class BuiltInOperationHasUniqueObjectRepresentations extends BuiltInOperation,
-  @hasuniqueobjectrepresentations {
+  @hasuniqueobjectrepresentations
+{
   override string toString() { result = "__has_unique_object_representations" }
 
   override string getAPrimaryQlClass() { result = "BuiltInOperationHasUniqueObjectRepresentations" }
@@ -1107,7 +1111,8 @@ class BuiltInOperationIsLayoutCompatible extends BuiltInOperation, @islayoutcomp
  * ```
  */
 class BuiltInOperationIsPointerInterconvertibleBaseOf extends BuiltInOperation,
-  @ispointerinterconvertiblebaseof {
+  @ispointerinterconvertiblebaseof
+{
   override string toString() { result = "__is_pointer_interconvertible_base_of" }
 
   override string getAPrimaryQlClass() {

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -719,13 +719,6 @@ class ReferenceToExpr extends Conversion, @reference_to {
 class PointerDereferenceExpr extends UnaryOperation, @indirect {
   override string getAPrimaryQlClass() { result = "PointerDereferenceExpr" }
 
-  /**
-   * DEPRECATED: Use getOperand() instead.
-   *
-   * Gets the expression that is being dereferenced.
-   */
-  deprecated Expr getExpr() { result = this.getOperand() }
-
   override string getOperator() { result = "*" }
 
   override int getPrecedence() { result = 16 }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlow.qll

@@ -243,3 +243,111 @@ module MakeWithState<StateConfigSig Config> implements DataFlowSig {
 
   import Impl<C>
 }
+
+signature class PathNodeSig {
+  /** Gets a textual representation of this element. */
+  string toString();
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  );
+
+  /** Gets the underlying `Node`. */
+  Node getNode();
+}
+
+signature module PathGraphSig<PathNodeSig PathNode> {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  predicate edges(PathNode a, PathNode b);
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  predicate nodes(PathNode n, string key, string val);
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out);
+}
+
+/**
+ * Constructs a `PathGraph` from two `PathGraph`s by disjoint union.
+ */
+module MergePathGraph<
+  PathNodeSig PathNode1, PathNodeSig PathNode2, PathGraphSig<PathNode1> Graph1,
+  PathGraphSig<PathNode2> Graph2>
+{
+  private newtype TPathNode =
+    TPathNode1(PathNode1 p) or
+    TPathNode2(PathNode2 p)
+
+  /** A node in a graph of path explanations that is formed by disjoint union of the two given graphs. */
+  class PathNode extends TPathNode {
+    /** Gets this as a projection on the first given `PathGraph`. */
+    PathNode1 asPathNode1() { this = TPathNode1(result) }
+
+    /** Gets this as a projection on the second given `PathGraph`. */
+    PathNode2 asPathNode2() { this = TPathNode2(result) }
+
+    /** Gets a textual representation of this element. */
+    string toString() {
+      result = this.asPathNode1().toString() or
+      result = this.asPathNode2().toString()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.asPathNode1().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) or
+      this.asPathNode2().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    Node getNode() {
+      result = this.asPathNode1().getNode() or
+      result = this.asPathNode2().getNode()
+    }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PathGraph implements PathGraphSig<PathNode> {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PathNode a, PathNode b) {
+      Graph1::edges(a.asPathNode1(), b.asPathNode1()) or
+      Graph2::edges(a.asPathNode2(), b.asPathNode2())
+    }
+
+    /** Holds if `n` is a node in the graph of data flow path explanations. */
+    query predicate nodes(PathNode n, string key, string val) {
+      Graph1::nodes(n.asPathNode1(), key, val) or
+      Graph2::nodes(n.asPathNode2(), key, val)
+    }
+
+    /**
+     * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+     * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+     * `ret -> out` is summarized as the edge `arg -> out`.
+     */
+    query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+      Graph1::subpaths(arg.asPathNode1(), par.asPathNode1(), ret.asPathNode1(), out.asPathNode1()) or
+      Graph2::subpaths(arg.asPathNode2(), par.asPathNode2(), ret.asPathNode2(), out.asPathNode2())
+    }
+  }
+}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

@@ -3157,7 +3157,7 @@ module Impl<FullStateConfigSig Config> {
   /**
    * Provides the query predicates needed to include a graph in a path-problem query.
    */
-  module PathGraph {
+  module PathGraph implements PathGraphSig<PathNode> {
     /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
     query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
 

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTracking.qll

@@ -7,7 +7,8 @@ import TaintTrackingParameter::Public
 private import TaintTrackingParameter::Private
 
 private module AddTaintDefaults<DataFlowInternal::FullStateConfigSig Config> implements
-DataFlowInternal::FullStateConfigSig {
+  DataFlowInternal::FullStateConfigSig
+{
   import Config
 
   predicate isBarrier(DataFlow::Node node) {

cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll

@@ -1082,7 +1082,8 @@ module Opcode {
    * See the `CallSideEffectInstruction` documentation for more details.
    */
   class CallSideEffect extends WriteSideEffectOpcode, EscapedWriteOpcode, MayWriteOpcode,
-    ReadSideEffectOpcode, EscapedReadOpcode, MayReadOpcode, TCallSideEffect {
+    ReadSideEffectOpcode, EscapedReadOpcode, MayReadOpcode, TCallSideEffect
+  {
     final override string toString() { result = "CallSideEffect" }
   }
 
@@ -1092,7 +1093,8 @@ module Opcode {
    * See the `CallReadSideEffectInstruction` documentation for more details.
    */
   class CallReadSideEffect extends ReadSideEffectOpcode, EscapedReadOpcode, MayReadOpcode,
-    TCallReadSideEffect {
+    TCallReadSideEffect
+  {
     final override string toString() { result = "CallReadSideEffect" }
   }
 
@@ -1102,7 +1104,8 @@ module Opcode {
    * See the `IndirectReadSideEffectInstruction` documentation for more details.
    */
   class IndirectReadSideEffect extends ReadSideEffectOpcode, IndirectReadOpcode,
-    TIndirectReadSideEffect {
+    TIndirectReadSideEffect
+  {
     final override string toString() { result = "IndirectReadSideEffect" }
   }
 
@@ -1112,7 +1115,8 @@ module Opcode {
    * See the `IndirectMustWriteSideEffectInstruction` documentation for more details.
    */
   class IndirectMustWriteSideEffect extends WriteSideEffectOpcode, IndirectWriteOpcode,
-    TIndirectMustWriteSideEffect {
+    TIndirectMustWriteSideEffect
+  {
     final override string toString() { result = "IndirectMustWriteSideEffect" }
   }
 
@@ -1122,7 +1126,8 @@ module Opcode {
    * See the `IndirectMayWriteSideEffectInstruction` documentation for more details.
    */
   class IndirectMayWriteSideEffect extends WriteSideEffectOpcode, IndirectWriteOpcode,
-    MayWriteOpcode, TIndirectMayWriteSideEffect {
+    MayWriteOpcode, TIndirectMayWriteSideEffect
+  {
     final override string toString() { result = "IndirectMayWriteSideEffect" }
   }
 
@@ -1132,7 +1137,8 @@ module Opcode {
    * See the `BufferReadSideEffectInstruction` documentation for more details.
    */
   class BufferReadSideEffect extends ReadSideEffectOpcode, UnsizedBufferReadOpcode,
-    TBufferReadSideEffect {
+    TBufferReadSideEffect
+  {
     final override string toString() { result = "BufferReadSideEffect" }
   }
 
@@ -1142,7 +1148,8 @@ module Opcode {
    * See the `BufferMustWriteSideEffectInstruction` documentation for more details.
    */
   class BufferMustWriteSideEffect extends WriteSideEffectOpcode, UnsizedBufferWriteOpcode,
-    TBufferMustWriteSideEffect {
+    TBufferMustWriteSideEffect
+  {
     final override string toString() { result = "BufferMustWriteSideEffect" }
   }
 
@@ -1152,7 +1159,8 @@ module Opcode {
    * See the `BufferMayWriteSideEffectInstruction` documentation for more details.
    */
   class BufferMayWriteSideEffect extends WriteSideEffectOpcode, UnsizedBufferWriteOpcode,
-    MayWriteOpcode, TBufferMayWriteSideEffect {
+    MayWriteOpcode, TBufferMayWriteSideEffect
+  {
     final override string toString() { result = "BufferMayWriteSideEffect" }
   }
 
@@ -1162,7 +1170,8 @@ module Opcode {
    * See the `SizedBufferReadSideEffectInstruction` documentation for more details.
    */
   class SizedBufferReadSideEffect extends ReadSideEffectOpcode, SizedBufferReadOpcode,
-    TSizedBufferReadSideEffect {
+    TSizedBufferReadSideEffect
+  {
     final override string toString() { result = "SizedBufferReadSideEffect" }
   }
 
@@ -1172,7 +1181,8 @@ module Opcode {
    * See the `SizedBufferMustWriteSideEffectInstruction` documentation for more details.
    */
   class SizedBufferMustWriteSideEffect extends WriteSideEffectOpcode, SizedBufferWriteOpcode,
-    TSizedBufferMustWriteSideEffect {
+    TSizedBufferMustWriteSideEffect
+  {
     final override string toString() { result = "SizedBufferMustWriteSideEffect" }
   }
 
@@ -1182,7 +1192,8 @@ module Opcode {
    * See the `SizedBufferMayWriteSideEffectInstruction` documentation for more details.
    */
   class SizedBufferMayWriteSideEffect extends WriteSideEffectOpcode, SizedBufferWriteOpcode,
-    MayWriteOpcode, TSizedBufferMayWriteSideEffect {
+    MayWriteOpcode, TSizedBufferMayWriteSideEffect
+  {
     final override string toString() { result = "SizedBufferMayWriteSideEffect" }
   }
 
@@ -1192,7 +1203,8 @@ module Opcode {
    * See the `InitializeDynamicAllocationInstruction` documentation for more details.
    */
   class InitializeDynamicAllocation extends SideEffectOpcode, EntireAllocationWriteOpcode,
-    TInitializeDynamicAllocation {
+    TInitializeDynamicAllocation
+  {
     final override string toString() { result = "InitializeDynamicAllocation" }
   }
 
@@ -1221,7 +1233,8 @@ module Opcode {
    * See the `InlineAsmInstruction` documentation for more details.
    */
   class InlineAsm extends Opcode, EscapedWriteOpcode, MayWriteOpcode, EscapedReadOpcode,
-    MayReadOpcode, TInlineAsm {
+    MayReadOpcode, TInlineAsm
+  {
     final override string toString() { result = "InlineAsm" }
 
     final override predicate hasOperandInternal(OperandTag tag) {

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll

@@ -87,22 +87,6 @@ class Operand extends TStageOperand {
     this.getDefinitionOverlap() instanceof MustExactlyOverlap
   }
 
-  /**
-   * DEPRECATED: renamed to `getUse`.
-   *
-   * Gets the `Instruction` that consumes this operand.
-   */
-  deprecated final Instruction getUseInstruction() { result = this.getUse() }
-
-  /**
-   * DEPRECATED: use `getAnyDef` or `getDef`. The exact replacement for this
-   * predicate is `getAnyDef`, but most uses of this predicate should probably
-   * be replaced with `getDef`.
-   *
-   * Gets the `Instruction` whose result is the value of the operand.
-   */
-  deprecated final Instruction getDefinitionInstruction() { result = this.getAnyDef() }
-
   /**
    * Gets the overlap relationship between the operand's definition and its use.
    */

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

@@ -246,7 +246,8 @@ class VariableMemoryLocation extends TVariableMemoryLocation, AllocationMemoryLo
 }
 
 class EntireAllocationMemoryLocation extends TEntireAllocationMemoryLocation,
-  AllocationMemoryLocation {
+  AllocationMemoryLocation
+{
   EntireAllocationMemoryLocation() { this = TEntireAllocationMemoryLocation(var, isMayAccess) }
 
   final override string toStringInternal() { result = var.toString() }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll

@@ -87,22 +87,6 @@ class Operand extends TStageOperand {
     this.getDefinitionOverlap() instanceof MustExactlyOverlap
   }
 
-  /**
-   * DEPRECATED: renamed to `getUse`.
-   *
-   * Gets the `Instruction` that consumes this operand.
-   */
-  deprecated final Instruction getUseInstruction() { result = this.getUse() }
-
-  /**
-   * DEPRECATED: use `getAnyDef` or `getDef`. The exact replacement for this
-   * predicate is `getAnyDef`, but most uses of this predicate should probably
-   * be replaced with `getDef`.
-   *
-   * Gets the `Instruction` whose result is the value of the operand.
-   */
-  deprecated final Instruction getDefinitionInstruction() { result = this.getAnyDef() }
-
   /**
    * Gets the overlap relationship between the operand's definition and its use.
    */

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll

@@ -511,7 +511,8 @@ abstract class TranslatedArgumentSideEffect extends TranslatedSideEffect {
  * calls other than constructor calls.
  */
 class TranslatedArgumentExprSideEffect extends TranslatedArgumentSideEffect,
-  TTranslatedArgumentExprSideEffect {
+  TTranslatedArgumentExprSideEffect
+{
   Expr arg;
 
   TranslatedArgumentExprSideEffect() {
@@ -546,7 +547,8 @@ class TranslatedArgumentExprSideEffect extends TranslatedArgumentSideEffect,
  * calls to non-static member functions.
  */
 class TranslatedStructorQualifierSideEffect extends TranslatedArgumentSideEffect,
-  TTranslatedStructorQualifierSideEffect {
+  TTranslatedStructorQualifierSideEffect
+{
   TranslatedStructorQualifierSideEffect() {
     this = TTranslatedStructorQualifierSideEffect(call, sideEffectOpcode) and
     index = -1

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCondition.qll

@@ -34,7 +34,8 @@ abstract class TranslatedCondition extends TranslatedElement {
 }
 
 abstract class TranslatedFlexibleCondition extends TranslatedCondition, ConditionContext,
-  TTranslatedFlexibleCondition {
+  TTranslatedFlexibleCondition
+{
   TranslatedFlexibleCondition() { this = TTranslatedFlexibleCondition(expr) }
 
   final override TranslatedElement getChild(int id) { id = 0 and result = getOperand() }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedDeclarationEntry.qll

@@ -75,7 +75,8 @@ abstract class TranslatedLocalVariableDeclaration extends TranslatedVariableInit
  * The IR translation of a local variable declaration within a declaration statement.
  */
 class TranslatedAutoVariableDeclarationEntry extends TranslatedLocalVariableDeclaration,
-  TranslatedDeclarationEntry {
+  TranslatedDeclarationEntry
+{
   StackVariable var;
 
   TranslatedAutoVariableDeclarationEntry() { var = entry.getDeclaration() }
@@ -217,7 +218,8 @@ class TranslatedStaticLocalVariableDeclarationEntry extends TranslatedDeclaratio
  * with a dynamic initializer.
  */
 class TranslatedStaticLocalVariableInitialization extends TranslatedElement,
-  TranslatedLocalVariableDeclaration, TTranslatedStaticLocalVariableInitialization {
+  TranslatedLocalVariableDeclaration, TTranslatedStaticLocalVariableInitialization
+{
   IRVariableDeclarationEntry entry;
   StaticLocalVariable var;
 

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -131,7 +131,8 @@ abstract class TranslatedCoreExpr extends TranslatedExpr {
 }
 
 class TranslatedConditionValue extends TranslatedCoreExpr, ConditionContext,
-  TTranslatedConditionValue {
+  TTranslatedConditionValue
+{
   TranslatedConditionValue() { this = TTranslatedConditionValue(expr) }
 
   override TranslatedElement getChild(int id) { id = 0 and result = this.getCondition() }
@@ -326,7 +327,8 @@ class TranslatedLoad extends TranslatedValueCategoryAdjustment, TTranslatedLoad
  * from the AST.
  */
 class TranslatedSyntheticTemporaryObject extends TranslatedValueCategoryAdjustment,
-  TTranslatedSyntheticTemporaryObject {
+  TTranslatedSyntheticTemporaryObject
+{
   TranslatedSyntheticTemporaryObject() { this = TTranslatedSyntheticTemporaryObject(expr) }
 
   override string toString() { result = "Temporary materialization of " + expr.toString() }
@@ -2302,7 +2304,8 @@ class TranslatedBinaryConditionalExpr extends TranslatedConditionalExpr {
  * its initializer.
  */
 class TranslatedTemporaryObjectExpr extends TranslatedNonConstantExpr,
-  TranslatedVariableInitialization {
+  TranslatedVariableInitialization
+{
   override TemporaryObjectExpr expr;
 
   final override predicate hasTempVariable(TempVariableTag tag, CppType type) {

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedFunction.qll

@@ -566,7 +566,8 @@ private TranslatedConstructorInitList getTranslatedConstructorInitList(Function
  * instances for constructors can actually contain initializers.
  */
 class TranslatedConstructorInitList extends TranslatedElement, InitializationContext,
-  TTranslatedConstructorInitList {
+  TTranslatedConstructorInitList
+{
   Function func;
 
   TranslatedConstructorInitList() { this = TTranslatedConstructorInitList(func) }
@@ -637,7 +638,8 @@ private TranslatedDestructorDestructionList getTranslatedDestructorDestructionLi
  * destructions.
  */
 class TranslatedDestructorDestructionList extends TranslatedElement,
-  TTranslatedDestructorDestructionList {
+  TTranslatedDestructorDestructionList
+{
   Function func;
 
   TranslatedDestructorDestructionList() { this = TTranslatedDestructorDestructionList(func) }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedGlobalVar.qll

@@ -9,7 +9,8 @@ private import InstructionTag
 private import semmle.code.cpp.ir.internal.IRUtilities
 
 class TranslatedGlobalOrNamespaceVarInit extends TranslatedRootElement,
-  TTranslatedGlobalOrNamespaceVarInit, InitializationContext {
+  TTranslatedGlobalOrNamespaceVarInit, InitializationContext
+{
   GlobalOrNamespaceVariable var;
 
   TranslatedGlobalOrNamespaceVarInit() { this = TTranslatedGlobalOrNamespaceVarInit(var) }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -440,7 +440,8 @@ class TranslatedStringLiteralInitialization extends TranslatedDirectInitializati
 }
 
 class TranslatedConstructorInitialization extends TranslatedDirectInitialization,
-  StructorCallContext {
+  StructorCallContext
+{
   override ConstructorCall expr;
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
@@ -528,7 +529,8 @@ abstract class TranslatedFieldInitialization extends TranslatedElement {
  * explicit element in an initializer list.
  */
 class TranslatedExplicitFieldInitialization extends TranslatedFieldInitialization,
-  InitializationContext, TTranslatedExplicitFieldInitialization {
+  InitializationContext, TTranslatedExplicitFieldInitialization
+{
   Expr expr;
 
   TranslatedExplicitFieldInitialization() {
@@ -565,7 +567,8 @@ private string getZeroValue(Type type) {
  * corresponding element in the initializer list.
  */
 class TranslatedFieldValueInitialization extends TranslatedFieldInitialization,
-  TTranslatedFieldValueInitialization {
+  TTranslatedFieldValueInitialization
+{
   TranslatedFieldValueInitialization() { this = TTranslatedFieldValueInitialization(ast, field) }
 
   override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
@@ -700,7 +703,8 @@ abstract class TranslatedElementInitialization extends TranslatedElement {
  * an explicit element in an initializer list.
  */
 class TranslatedExplicitElementInitialization extends TranslatedElementInitialization,
-  TTranslatedExplicitElementInitialization, InitializationContext {
+  TTranslatedExplicitElementInitialization, InitializationContext
+{
   int elementIndex;
 
   TranslatedExplicitElementInitialization() {
@@ -737,7 +741,8 @@ class TranslatedExplicitElementInitialization extends TranslatedElementInitializ
  * elements without corresponding elements in the initializer list.
  */
 class TranslatedElementValueInitialization extends TranslatedElementInitialization,
-  TTranslatedElementValueInitialization {
+  TTranslatedElementValueInitialization
+{
   int elementIndex;
   int elementCount;
 
@@ -881,7 +886,8 @@ abstract class TranslatedBaseStructorCall extends TranslatedStructorCallFromStru
  * Represents a call to a delegating or base class constructor from within a constructor.
  */
 abstract class TranslatedConstructorCallFromConstructor extends TranslatedStructorCallFromStructor,
-  TTranslatedConstructorBaseInit {
+  TTranslatedConstructorBaseInit
+{
   TranslatedConstructorCallFromConstructor() { this = TTranslatedConstructorBaseInit(call) }
 }
 
@@ -917,7 +923,8 @@ class TranslatedConstructorDelegationInit extends TranslatedConstructorCallFromC
  * derived class constructor
  */
 class TranslatedConstructorBaseInit extends TranslatedConstructorCallFromConstructor,
-  TranslatedBaseStructorCall {
+  TranslatedBaseStructorCall
+{
   TranslatedConstructorBaseInit() { not call instanceof ConstructorDelegationInit }
 
   final override string toString() { result = "construct base: " + call.toString() }
@@ -934,7 +941,8 @@ TranslatedDestructorBaseDestruction getTranslatedDestructorBaseDestruction(
  * derived class destructor.
  */
 class TranslatedDestructorBaseDestruction extends TranslatedBaseStructorCall,
-  TTranslatedDestructorBaseDestruction {
+  TTranslatedDestructorBaseDestruction
+{
   TranslatedDestructorBaseDestruction() { this = TTranslatedDestructorBaseDestruction(call) }
 
   final override string toString() { result = "destroy base: " + call.toString() }

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll

@@ -20,7 +20,8 @@ TranslatedMicrosoftTryExceptHandler getTranslatedMicrosoftTryExceptHandler(
 }
 
 class TranslatedMicrosoftTryExceptHandler extends TranslatedElement,
-  TTranslatedMicrosoftTryExceptHandler {
+  TTranslatedMicrosoftTryExceptHandler
+{
   MicrosoftTryExceptStmt tryExcept;
 
   TranslatedMicrosoftTryExceptHandler() { this = TTranslatedMicrosoftTryExceptHandler(tryExcept) }

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll

@@ -87,22 +87,6 @@ class Operand extends TStageOperand {
     this.getDefinitionOverlap() instanceof MustExactlyOverlap
   }
 
-  /**
-   * DEPRECATED: renamed to `getUse`.
-   *
-   * Gets the `Instruction` that consumes this operand.
-   */
-  deprecated final Instruction getUseInstruction() { result = this.getUse() }
-
-  /**
-   * DEPRECATED: use `getAnyDef` or `getDef`. The exact replacement for this
-   * predicate is `getAnyDef`, but most uses of this predicate should probably
-   * be replaced with `getDef`.
-   *
-   * Gets the `Instruction` whose result is the value of the operand.
-   */
-  deprecated final Instruction getDefinitionInstruction() { result = this.getAnyDef() }
-
   /**
    * Gets the overlap relationship between the operand's definition and its use.
    */

cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll

@@ -389,7 +389,8 @@ private class NewArrayAllocationExpr extends AllocationExpr, NewArrayExpr {
 
 private module HeuristicAllocation {
   /** A class that maps an `AllocationExpr` to an `HeuristicAllocationExpr`. */
-  private class HeuristicAllocationModeled extends HeuristicAllocationExpr instanceof AllocationExpr {
+  private class HeuristicAllocationModeled extends HeuristicAllocationExpr instanceof AllocationExpr
+  {
     override Expr getSizeExpr() { result = AllocationExpr.super.getSizeExpr() }
 
     override int getSizeMult() { result = AllocationExpr.super.getSizeMult() }
@@ -406,7 +407,8 @@ private module HeuristicAllocation {
   }
 
   /** A class that maps an `AllocationFunction` to an `HeuristicAllocationFunction`. */
-  private class HeuristicAllocationFunctionModeled extends HeuristicAllocationFunction instanceof AllocationFunction {
+  private class HeuristicAllocationFunctionModeled extends HeuristicAllocationFunction instanceof AllocationFunction
+  {
     override int getSizeArg() { result = AllocationFunction.super.getSizeArg() }
 
     override int getSizeMult() { result = AllocationFunction.super.getSizeMult() }
@@ -430,7 +432,8 @@ private module HeuristicAllocation {
    * 2. The function must return a pointer type
    * 3. There must be a unique parameter of unsigned integral type.
    */
-  private class HeuristicAllocationFunctionByName extends HeuristicAllocationFunction instanceof Function {
+  private class HeuristicAllocationFunctionByName extends HeuristicAllocationFunction instanceof Function
+  {
     int sizeArg;
 
     HeuristicAllocationFunctionByName() {

cpp/ql/lib/semmle/code/cpp/models/implementations/GetDelim.qll

@@ -7,7 +7,8 @@ import semmle.code.cpp.models.interfaces.FlowSource
  * The standard functions `getdelim`, `getwdelim` and the glibc variant `__getdelim`.
  */
 private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectFunction,
-  RemoteFlowSourceFunction {
+  RemoteFlowSourceFunction
+{
   GetDelimFunction() { this.hasGlobalName(["getdelim", "getwdelim", "__getdelim"]) }
 
   override predicate hasTaintFlow(FunctionInput i, FunctionOutput o) {

cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll

@@ -14,7 +14,8 @@ import semmle.code.cpp.models.interfaces.FlowSource
  * The standard functions `fgets` and `fgetws`.
  */
 private class FgetsFunction extends DataFlowFunction, TaintFunction, ArrayFunction, AliasFunction,
-  SideEffectFunction, RemoteFlowSourceFunction {
+  SideEffectFunction, RemoteFlowSourceFunction
+{
   FgetsFunction() {
     // fgets(str, num, stream)
     // fgetws(wstr, num, stream)
@@ -69,7 +70,8 @@ private class FgetsFunction extends DataFlowFunction, TaintFunction, ArrayFuncti
  * The standard functions `gets`.
  */
 private class GetsFunction extends DataFlowFunction, ArrayFunction, AliasFunction,
-  SideEffectFunction, LocalFlowSourceFunction {
+  SideEffectFunction, LocalFlowSourceFunction
+{
   GetsFunction() {
     // gets(str)
     this.hasGlobalOrStdOrBslName("gets")

cpp/ql/lib/semmle/code/cpp/models/implementations/IdentityFunction.qll

@@ -7,7 +7,8 @@ import semmle.code.cpp.models.interfaces.SideEffect
  * The standard function templates `std::move` and `std::forward`.
  */
 private class IdentityFunction extends DataFlowFunction, SideEffectFunction, AliasFunction,
-  FunctionTemplateInstantiation {
+  FunctionTemplateInstantiation
+{
   IdentityFunction() { this.hasQualifiedName("std", ["move", "forward"]) }
 
   override predicate hasOnlySpecificReadSideEffects() { any() }

cpp/ql/lib/semmle/code/cpp/models/implementations/Iterator.qll

@@ -121,7 +121,8 @@ class IteratorCrementNonMemberOperator extends Operator {
 }
 
 private class IteratorCrementNonMemberOperatorModel extends IteratorCrementNonMemberOperator,
-  DataFlowFunction {
+  DataFlowFunction
+{
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input = getIteratorArgumentInput(this, 0) and
     output.isReturnValue()
@@ -143,7 +144,8 @@ class IteratorCrementMemberOperator extends MemberFunction {
 }
 
 private class IteratorCrementMemberOperatorModel extends IteratorCrementMemberOperator,
-  DataFlowFunction, TaintFunction {
+  DataFlowFunction, TaintFunction
+{
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierAddress() and
     output.isReturnValue()
@@ -204,7 +206,8 @@ class IteratorBinaryArithmeticMemberOperator extends MemberFunction {
 }
 
 private class IteratorBinaryArithmeticMemberOperatorModel extends IteratorBinaryArithmeticMemberOperator,
-  TaintFunction {
+  TaintFunction
+{
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierObject() and
     output.isReturnValue()
@@ -258,7 +261,8 @@ class IteratorAssignArithmeticNonMemberOperator extends Operator {
 }
 
 private class IteratorAssignArithmeticNonMemberOperatorModel extends IteratorAssignArithmeticNonMemberOperator,
-  DataFlowFunction, TaintFunction {
+  DataFlowFunction, TaintFunction
+{
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isParameter(0) and
     output.isReturnValue()
@@ -289,7 +293,8 @@ class IteratorAssignArithmeticMemberOperator extends MemberFunction {
 }
 
 private class IteratorAssignArithmeticMemberOperatorModel extends IteratorAssignArithmeticMemberOperator,
-  DataFlowFunction, TaintFunction {
+  DataFlowFunction, TaintFunction
+{
   override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
     input.isQualifierAddress() and
     output.isReturnValue()
@@ -325,7 +330,8 @@ class IteratorAssignArithmeticOperator extends Function {
  * non-member and member versions, use `IteratorPointerDereferenceOperator`.
  */
 class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunction,
-  IteratorReferenceFunction {
+  IteratorReferenceFunction
+{
   IteratorPointerDereferenceMemberOperator() {
     this.getClassAndName("operator*") instanceof Iterator
   }
@@ -353,7 +359,8 @@ class IteratorPointerDereferenceNonMemberOperator extends Operator, IteratorRefe
 }
 
 private class IteratorPointerDereferenceNonMemberOperatorModel extends IteratorPointerDereferenceNonMemberOperator,
-  TaintFunction {
+  TaintFunction
+{
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input = getIteratorArgumentInput(this, 0) and
     output.isReturnValue()
@@ -389,7 +396,8 @@ private class IteratorFieldMemberOperator extends Operator, TaintFunction {
  * An `operator[]` member function of an iterator class.
  */
 private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
-  IteratorReferenceFunction {
+  IteratorReferenceFunction
+{
   IteratorArrayMemberOperator() { this.getClassAndName("operator[]") instanceof Iterator }
 
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -418,7 +426,8 @@ class IteratorAssignmentMemberOperator extends MemberFunction {
  * `operator*` and use their own `operator=` to assign to the container.
  */
 private class IteratorAssignmentMemberOperatorModel extends IteratorAssignmentMemberOperator,
-  TaintFunction {
+  TaintFunction
+{
   override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
     input.isParameterDeref(0) and
     output.isQualifierObject()

cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll

@@ -15,7 +15,8 @@ import semmle.code.cpp.models.interfaces.Taint
  * `__builtin___memcpy_chk`.
  */
 private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
-  AliasFunction {
+  AliasFunction
+{
   MemcpyFunction() {
     // memcpy(dest, src, num)
     // memmove(dest, src, num)

cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll

@@ -13,7 +13,8 @@ import semmle.code.cpp.models.interfaces.SideEffect
  * The standard function `memset` and its assorted variants
  */
 private class MemsetFunction extends ArrayFunction, DataFlowFunction, AliasFunction,
-  SideEffectFunction {
+  SideEffectFunction
+{
   MemsetFunction() {
     this.hasGlobalOrStdOrBslName("memset")
     or

cpp/ql/lib/semmle/code/cpp/models/implementations/Pure.qll

@@ -8,7 +8,8 @@ import semmle.code.cpp.models.interfaces.SideEffect
  * guaranteed to be side-effect free.
  */
 private class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction,
-  SideEffectFunction {
+  SideEffectFunction
+{
   PureStrFunction() {
     this.hasGlobalOrStdOrBslName([
         atoi(), "strcasestr", "strchnul", "strchr", "strchrnul", "strstr", "strpbrk", "strrchr",
@@ -153,7 +154,8 @@ private class PureFunction extends TaintFunction, SideEffectFunction {
  * evaluation is guaranteed to be side-effect free.
  */
 private class PureMemFunction extends AliasFunction, ArrayFunction, TaintFunction,
-  SideEffectFunction {
+  SideEffectFunction
+{
   PureMemFunction() {
     this.hasGlobalOrStdOrBslName([
         "memchr", "__builtin_memchr", "memrchr", "rawmemchr", "memcmp", "__builtin_memcmp", "memmem"

cpp/ql/lib/semmle/code/cpp/models/implementations/Recv.qll

@@ -11,7 +11,8 @@ import semmle.code.cpp.models.interfaces.SideEffect
 
 /** The function `recv` and its assorted variants */
 private class Recv extends AliasFunction, ArrayFunction, SideEffectFunction,
-  RemoteFlowSourceFunction {
+  RemoteFlowSourceFunction
+{
   Recv() {
     this.hasGlobalName([
         "recv", // recv(socket, dest, len, flags)

cpp/ql/lib/semmle/code/cpp/models/implementations/Scanf.qll

@@ -15,7 +15,8 @@ import semmle.code.cpp.models.interfaces.FlowSource
  * The `scanf` family of functions.
  */
 abstract private class ScanfFunctionModel extends ArrayFunction, TaintFunction, AliasFunction,
-  SideEffectFunction {
+  SideEffectFunction
+{
   override predicate hasArrayWithNullTerminator(int bufParam) {
     bufParam = this.(ScanfFunction).getFormatParameterIndex()
   }

cpp/ql/lib/semmle/code/cpp/models/implementations/SmartPointer.qll

@@ -31,7 +31,8 @@ private class SmartPtr extends Class, PointerWrapper {
  * - `std::weak_ptr<T>::operator*()`
  */
 private class PointerUnwrapperFunction extends MemberFunction, TaintFunction, DataFlowFunction,
-  SideEffectFunction, AliasFunction {
+  SideEffectFunction, AliasFunction
+{
   PointerUnwrapperFunction() {
     exists(PointerWrapper wrapper | wrapper.getAnUnwrapperFunction() = this)
   }

cpp/ql/lib/semmle/code/cpp/models/implementations/Strset.qll

@@ -13,7 +13,8 @@ import semmle.code.cpp.models.interfaces.SideEffect
  * The standard function `strset` and its assorted variants
  */
 private class StrsetFunction extends ArrayFunction, DataFlowFunction, AliasFunction,
-  SideEffectFunction {
+  SideEffectFunction
+{
   StrsetFunction() {
     hasGlobalName([
         "strset", "_strset", "_strset_l", "_wcsset", "_wcsset_l", "_mbsset", "_mbsset_l",

cpp/ql/lib/semmle/code/cpp/models/implementations/System.qll

@@ -7,7 +7,8 @@ import semmle.code.cpp.models.interfaces.CommandExecution
  * A function for running a command using a command interpreter.
  */
 private class SystemFunction extends CommandExecutionFunction, ArrayFunction, AliasFunction,
-  SideEffectFunction {
+  SideEffectFunction
+{
   SystemFunction() {
     hasGlobalOrStdName("system") or // system(command)
     hasGlobalName("popen") or // popen(command, mode)

cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll

@@ -40,12 +40,6 @@ class FunctionInput extends TFunctionInput {
    */
   predicate isParameter(ParameterIndex index) { none() }
 
-  /**
-   * Holds if this is the input value of the parameter with index `index`.
-   * DEPRECATED: Use `isParameter(index)` instead.
-   */
-  deprecated final predicate isInParameter(ParameterIndex index) { this.isParameter(index) }
-
   /**
    * Holds if this is the input value pointed to (through `ind` number of indirections) by a
    * pointer parameter to a function, or the input value referred to by a reference parameter
@@ -84,16 +78,6 @@ class FunctionInput extends TFunctionInput {
    */
   predicate isParameterDeref(ParameterIndex index) { this.isParameterDeref(index, 1) }
 
-  /**
-   * Holds if this is the input value pointed to by a pointer parameter to a function, or the input
-   * value referred to by a reference parameter to a function, where the parameter has index
-   * `index`.
-   * DEPRECATED: Use `isParameterDeref(index)` instead.
-   */
-  deprecated final predicate isInParameterPointer(ParameterIndex index) {
-    this.isParameterDeref(index)
-  }
-
   /**
    * Holds if this is the input value pointed to by the `this` pointer of an instance member
    * function.
@@ -124,13 +108,6 @@ class FunctionInput extends TFunctionInput {
    */
   predicate isQualifierObject() { this.isQualifierObject(1) }
 
-  /**
-   * Holds if this is the input value pointed to by the `this` pointer of an instance member
-   * function.
-   * DEPRECATED: Use `isQualifierObject()` instead.
-   */
-  deprecated final predicate isInQualifier() { this.isQualifierObject() }
-
   /**
    * Holds if this is the input value of the `this` pointer of an instance member function.
    *
@@ -396,16 +373,6 @@ class FunctionOutput extends TFunctionOutput {
    */
   predicate isParameterDeref(ParameterIndex i, int ind) { ind = 1 and this.isParameterDeref(i) }
 
-  /**
-   * Holds if this is the output value pointed to by a pointer parameter to a function, or the
-   * output value referred to by a reference parameter to a function, where the parameter has
-   * index `index`.
-   * DEPRECATED: Use `isParameterDeref(index)` instead.
-   */
-  deprecated final predicate isOutParameterPointer(ParameterIndex index) {
-    this.isParameterDeref(index)
-  }
-
   /**
    * Holds if this is the output value pointed to by the `this` pointer of an instance member
    *   function.
@@ -436,13 +403,6 @@ class FunctionOutput extends TFunctionOutput {
    */
   predicate isQualifierObject(int ind) { ind = 1 and this.isQualifierObject() }
 
-  /**
-   * Holds if this is the output value pointed to by the `this` pointer of an instance member
-   * function.
-   * DEPRECATED: Use `isQualifierObject()` instead.
-   */
-  deprecated final predicate isOutQualifier() { this.isQualifierObject() }
-
   /**
    * Holds if this is the value returned by a function.
    *
@@ -462,12 +422,6 @@ class FunctionOutput extends TFunctionOutput {
    */
   predicate isReturnValue() { none() }
 
-  /**
-   * Holds if this is the value returned by a function.
-   * DEPRECATED: Use `isReturnValue()` instead.
-   */
-  deprecated final predicate isOutReturnValue() { this.isReturnValue() }
-
   /**
    * Holds if this is the output value pointed to by the return value of a function, if the function
    * returns a pointer, or the output value referred to by the return value of a function, if the
@@ -508,14 +462,6 @@ class FunctionOutput extends TFunctionOutput {
    */
   predicate isReturnValueDeref(int ind) { ind = 1 and this.isReturnValueDeref() }
 
-  /**
-   * Holds if this is the output value pointed to by the return value of a function, if the function
-   * returns a pointer, or the output value referred to by the return value of a function, if the
-   * function returns a reference.
-   * DEPRECATED: Use `isReturnValueDeref()` instead.
-   */
-  deprecated final predicate isOutReturnPointer() { this.isReturnValueDeref() }
-
   /**
    * Holds if `i >= 0` and `isParameterDeref(i, ind)` holds for this is the value, or
    * if `i = -1` and `isQualifierObject(ind)` holds for this value.

cpp/ql/lib/semmle/code/cpp/rangeanalysis/RangeSSA.qll

@@ -96,15 +96,6 @@ class RangeSsaDefinition extends ControlFlowNodeBase {
   /** Whether this definition is a phi node for variable `v`. */
   predicate isPhiNode(StackVariable v) { exists(RangeSsa x | x.phi_node(v, this)) }
 
-  /**
-   * DEPRECATED: Use isGuardPhi/4 instead
-   * If this definition is a phi node corresponding to a guard,
-   * then return the variable access and the guard.
-   */
-  deprecated predicate isGuardPhi(VariableAccess va, Expr guard, boolean branch) {
-    guard_defn(va, guard, this, branch)
-  }
-
   /**
    * If this definition is a phi node corresponding to a guard,
    * then return the variable guarded, the variable access and the guard.

cpp/ql/lib/semmle/code/cpp/security/TaintTrackingImpl.qll

@@ -591,7 +591,8 @@ deprecated library class DataSensitiveExprCall extends DataSensitiveCallExpr, Ex
 
 /** Call to a virtual function. */
 deprecated library class DataSensitiveOverriddenFunctionCall extends DataSensitiveCallExpr,
-  FunctionCall {
+  FunctionCall
+{
   DataSensitiveOverriddenFunctionCall() {
     exists(getTarget().(VirtualFunction).getAnOverridingFunction())
   }

cpp/ql/test/library-tests/declarationEntry/more/declarationEntry.expected

@@ -61,14 +61,14 @@
 | test.cpp:57:7:57:26 | definition of tmplClassProtoAndDef<T> |
 | test.cpp:59:19:59:19 | definition of T |
 | test.cpp:60:6:60:29 | declaration of tmplInstantiatedFunction |
-| test.cpp:60:33:60:33 | definition of t |
-| test.cpp:60:33:60:33 | definition of t |
 | test.cpp:61:19:61:19 | definition of T |
 | test.cpp:62:6:62:6 | definition of tmplInstantiatedFunction |
 | test.cpp:62:6:62:6 | definition of tmplInstantiatedFunction |
 | test.cpp:62:6:62:29 | definition of tmplInstantiatedFunction |
 | test.cpp:62:33:62:33 | declaration of t |
 | test.cpp:62:33:62:33 | definition of t |
+| test.cpp:62:33:62:33 | definition of t |
+| test.cpp:62:33:62:33 | definition of t |
 | test.cpp:64:19:64:19 | definition of T |
 | test.cpp:65:7:65:27 | declaration of tmplInstantiatedClass<T> |
 | test.cpp:66:19:66:19 | definition of T |

cpp/ql/test/library-tests/ir/range-analysis/SimpleRangeAnalysis_tests.cpp

@@ -231,8 +231,8 @@ int test_unary(int a) {
     int b = +a;
     range(b); // $ range=<=11 range=>=3
     int c = -a;
-    range(c);
-    range(b+c); // $ range=<=10 range="<=+ ...:a-1" range=">=- ...+1"
+    range(c); // $ range=<=-3 range=>=-11
+    range(b+c); // $ range=<=10 range="<=+ ...:a-1" range=">=- ...+1" range=>=-10
     total += b+c;
     range(total);
   }
@@ -241,8 +241,8 @@ int test_unary(int a) {
     int b = +a;
     range(b); // $ range=<=11 range=>=0
     int c = -a;
-    range(c);
-    range(b+c); // $ range=<=11 range="<=+ ...:a+0" range=">=- ...+0"
+    range(c); // $ range=<=0 range=>=-11
+    range(b+c); // $ range=<=11 range="<=+ ...:a+0" range=">=- ...+0" range=>=-11
     total += b+c;
     range(total);
   }
@@ -251,7 +251,7 @@ int test_unary(int a) {
     int b = +a;
     range(b); // $ range=<=11 range=>=-7
     int c = -a;
-    range(c);
+    range(c); // $ range=<=7 range=>=-11
     range(b+c);
     total += b+c;
     range(total);
@@ -261,7 +261,7 @@ int test_unary(int a) {
     int b = +a;
     range(b); // $ range=<=1 range=>=-7
     int c = -a;
-    range(c);
+    range(c); // $ range=<=7 range=>=-1
     range(b+c);
     total += b+c;
     range(total);
@@ -271,8 +271,8 @@ int test_unary(int a) {
     int b = +a;
     range(b); // $ range=<=0 range=>=-7
     int c = -a;
-    range(c);
-    range(b+c); // $ range="<=- ...+0" range=">=+ ...:a+0" range=>=-7
+    range(c); // $ range=<=7 range=>=0
+    range(b+c); // $ range="<=- ...+0" range=">=+ ...:a+0" range=>=-7 range=<=7
     total += b+c;
     range(total);
   }
@@ -281,8 +281,8 @@ int test_unary(int a) {
     int b = +a;
     range(b); // $ range=<=-2 range=>=-7
     int c = -a;
-    range(c);
-    range(b+c); // $ range="<=- ...-1" range=">=+ ...:a+1" range=>=-6
+    range(c); // $ range=<=7 range=>=2
+    range(b+c); // $ range="<=- ...-1" range=">=+ ...:a+1" range=>=-6 range=<=6
     total += b+c;
     range(total);
   }
@@ -552,7 +552,7 @@ int test16(int x) {
       range(x); // $ range=<=-1 range=>=0
       return 1;
     }
-    range(d); // $ range===3
+    range(d); // $ range=<=0 range=>=3 // Unreachable code
     range(x); // $ range=<=-1 range=>=0
   }
   range(x); // $ range=>=0
@@ -997,3 +997,15 @@ void test_overflow() {
     range(x + y); // $ range===-2147483393
   }
 }
+
+void test_negate_unsigned(unsigned u) {
+  if(10 < u && u < 20) {
+    range<unsigned>(-u); // underflows
+  }
+}
+
+void test_negate_signed(int s) {
+  if(10 < s && s < 20) {
+    range<int>(-s); // $ range=<=-11 range=>=-19
+  }
+}

cpp/ql/test/library-tests/templates/isfromtemplateinstantiation/isfromtemplateinstantiation.expected

@@ -112,8 +112,6 @@
 | isfromtemplateinstantiation.cpp:93:54:93:55 | { ... } | isfromtemplateinstantiation.cpp:93:7:93:7 | AnotherTemplateClass<int>::myMethod1(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:93:55:93:55 | return ... | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
 | isfromtemplateinstantiation.cpp:93:55:93:55 | return ... | isfromtemplateinstantiation.cpp:93:7:93:7 | AnotherTemplateClass<int>::myMethod1(MyClassEnum) |
-| isfromtemplateinstantiation.cpp:94:29:94:32 | definition of mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
-| isfromtemplateinstantiation.cpp:94:29:94:32 | definition of mce2 | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:94:36:94:51 | MyClassEnumConst | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
 | isfromtemplateinstantiation.cpp:94:36:94:51 | MyClassEnumConst | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
@@ -121,6 +119,8 @@
 | isfromtemplateinstantiation.cpp:97:52:97:52 | definition of myMethod2 | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | MyClassEnum mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | MyClassEnum mce2 | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
+| isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
+| isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:98:1:99:1 | { ... } | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |
 | isfromtemplateinstantiation.cpp:98:1:99:1 | { ... } | isfromtemplateinstantiation.cpp:97:52:97:52 | AnotherTemplateClass<int>::myMethod2(MyClassEnum) |
 | isfromtemplateinstantiation.cpp:99:1:99:1 | return ... | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<int> |

cpp/ql/test/library-tests/templates/isfromtemplateinstantiation/isfromuninstantiatedtemplate.expected

@@ -95,9 +95,6 @@ isFromUninstantiatedTemplate
 | isfromtemplateinstantiation.cpp:94:7:94:15 | declaration of myMethod2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
 | isfromtemplateinstantiation.cpp:94:7:94:15 | declaration of myMethod2 | isfromtemplateinstantiation.cpp:97:25:97:60 | myMethod2 |
 | isfromtemplateinstantiation.cpp:94:7:94:15 | declaration of myMethod2 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 |
-| isfromtemplateinstantiation.cpp:94:29:94:32 | declaration of mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
-| isfromtemplateinstantiation.cpp:94:29:94:32 | declaration of mce2 | isfromtemplateinstantiation.cpp:97:25:97:60 | myMethod2 |
-| isfromtemplateinstantiation.cpp:94:29:94:32 | declaration of mce2 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 |
 | isfromtemplateinstantiation.cpp:97:25:97:60 | definition of myMethod2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
 | isfromtemplateinstantiation.cpp:97:25:97:60 | definition of myMethod2 | isfromtemplateinstantiation.cpp:97:25:97:60 | myMethod2 |
 | isfromtemplateinstantiation.cpp:97:25:97:60 | definition of myMethod2 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 |
@@ -110,6 +107,9 @@ isFromUninstantiatedTemplate
 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 | isfromtemplateinstantiation.cpp:97:25:97:60 | myMethod2 |
 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 |
+| isfromtemplateinstantiation.cpp:97:74:97:77 | declaration of mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
+| isfromtemplateinstantiation.cpp:97:74:97:77 | declaration of mce2 | isfromtemplateinstantiation.cpp:97:25:97:60 | myMethod2 |
+| isfromtemplateinstantiation.cpp:97:74:97:77 | declaration of mce2 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 | isfromtemplateinstantiation.cpp:77:26:77:45 | AnotherTemplateClass<T> |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 | isfromtemplateinstantiation.cpp:97:25:97:60 | myMethod2 |
@@ -433,6 +433,7 @@ isFromUninstantiatedTemplate
 | isfromtemplateinstantiation.cpp:97:52:97:52 | myMethod2 | I |  | Declaration |  |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 |  | T | Definition |  |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 |  | T | Definition |  |
+| isfromtemplateinstantiation.cpp:97:74:97:77 | definition of mce2 | I |  | Definition |  |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | mce2 |  | T | Declaration |  |
 | isfromtemplateinstantiation.cpp:97:74:97:77 | mce2 | I |  | Declaration |  |
 | isfromtemplateinstantiation.cpp:98:1:99:1 | { ... } |  | T | Stmt |  |

csharp/ql/lib/change-notes/2023-03-03-delete-deps.md

@@ -0,0 +1,6 @@
+---
+category: minorAnalysis
+---
+* Deleted the deprecated `getPath` and `getFolder` predicates from the `XmlFile` class.
+* Deleted the deprecated `getAssertionIndex`, and `getAssertedParameter` predicates from the `AssertMethod` class.
+* Deleted the deprecated `OverridableMethod` and `OverridableAccessor` classes.

csharp/ql/lib/change-notes/2023-03-13-mergepathgraph.md

@@ -0,0 +1,4 @@
+---
+category: feature
+---
+* Added support for merging two `PathGraph`s via disjoint union to allow results from multiple data flow computations in a single `path-problem` query.

csharp/ql/lib/semmle/code/cil/Method.qll

@@ -67,7 +67,8 @@ class MethodImplementation extends EntryPoint, @cil_method_implementation {
  * destructors, operators, accessors and so on.
  */
 class Method extends DotNet::Callable, Element, Member, TypeContainer, DataFlowNode,
-  CustomModifierReceiver, Parameterizable, @cil_method {
+  CustomModifierReceiver, Parameterizable, @cil_method
+{
   /**
    * Gets a method implementation, if any. Note that there can
    * be several implementations in different assemblies.

csharp/ql/lib/semmle/code/cil/Types.qll

@@ -302,7 +302,8 @@ class SystemType extends ValueOrRefType {
  * ```
  */
 class FunctionPointerType extends Type, CustomModifierReceiver, Parameterizable,
-  @cil_function_pointer_type {
+  @cil_function_pointer_type
+{
   /** Gets the return type of this function pointer. */
   Type getReturnType() { cil_function_pointer_return_type(this, result) }
 

csharp/ql/lib/semmle/code/csharp/Property.qll

@@ -15,7 +15,8 @@ private import TypeRef
  * (`Property`), or an indexer (`Indexer`).
  */
 class DeclarationWithAccessors extends AssignableMember, Virtualizable, Attributable,
-  @declaration_with_accessors {
+  @declaration_with_accessors
+{
   /** Gets an accessor of this declaration. */
   Accessor getAnAccessor() { result.getDeclaration() = this }
 
@@ -49,7 +50,8 @@ class DeclarationWithAccessors extends AssignableMember, Virtualizable, Attribut
  * property (`Property`) or an indexer (`Indexer`).
  */
 class DeclarationWithGetSetAccessors extends DeclarationWithAccessors, TopLevelExprParent,
-  @assignable_with_accessors {
+  @assignable_with_accessors
+{
   /** Gets the `get` accessor of this declaration, if any. */
   Getter getGetter() { result = this.getAnAccessor() }
 

csharp/ql/lib/semmle/code/csharp/Variable.qll

@@ -90,7 +90,8 @@ class LocalScopeVariable extends Variable, @local_scope_variable {
  * ```
  */
 class Parameter extends DotNet::Parameter, LocalScopeVariable, Attributable, TopLevelExprParent,
-  @parameter {
+  @parameter
+{
   /**
    * Gets the position of this parameter. For example, the position of `x` is
    * 0 and the position of `y` is 1 in
@@ -376,7 +377,8 @@ class LocalConstant extends LocalVariable, @local_constant {
  * ```
  */
 class Field extends Variable, AssignableMember, Attributable, TopLevelExprParent, DotNet::Field,
-  @field {
+  @field
+{
   /**
    * Gets the initial value of this field, if any. For example, the initial
    * value of `F` on line 2 is `20` in

csharp/ql/lib/semmle/code/csharp/XML.qll

@@ -108,20 +108,6 @@ class XmlFile extends XmlParent, File {
   /** Gets the name of this XML file. */
   override string getName() { result = File.super.getAbsolutePath() }
 
-  /**
-   * DEPRECATED: Use `getAbsolutePath()` instead.
-   *
-   * Gets the path of this XML file.
-   */
-  deprecated string getPath() { result = this.getAbsolutePath() }
-
-  /**
-   * DEPRECATED: Use `getParentContainer().getAbsolutePath()` instead.
-   *
-   * Gets the path of the folder that contains this XML file.
-   */
-  deprecated string getFolder() { result = this.getParentContainer().getAbsolutePath() }
-
   /** Gets the encoding of this XML file. */
   string getEncoding() { xmlEncoding(this, result) }
 

csharp/ql/lib/semmle/code/csharp/commons/Assertions.qll

@@ -37,26 +37,6 @@ abstract class AssertMethod extends Method {
   /** Gets the index of a parameter being asserted. */
   abstract int getAnAssertionIndex();
 
-  /**
-   * DEPRECATED: Use `getAnAssertionIndex()` instead.
-   *
-   * Gets the index of a parameter being asserted.
-   */
-  deprecated final int getAssertionIndex() { result = this.getAnAssertionIndex() }
-
-  /** Gets the parameter at position `i` being asserted. */
-  final Parameter getAssertedParameter(int i) {
-    result = this.getParameter(i) and
-    i = this.getAnAssertionIndex()
-  }
-
-  /**
-   * DEPRECATED: Use `getAssertedParameter(_)` instead.
-   *
-   * Gets a parameter being asserted.
-   */
-  deprecated final Parameter getAssertedParameter() { result = this.getAssertedParameter(_) }
-
   /** Gets the failure type if the assertion fails for argument `i`, if any. */
   abstract AssertionFailure getAssertionFailure(int i);
 }
@@ -172,7 +152,8 @@ private predicate isDoesNotReturnIfAttributeParameter(Parameter p, boolean value
  * A method with a parameter that is annotated with
  * `System.Diagnostics.CodeAnalysis.DoesNotReturnIfAttribute(false)`.
  */
-class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertTrueMethod extends BooleanAssertMethod {
+class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertTrueMethod extends BooleanAssertMethod
+{
   private int i_;
 
   SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertTrueMethod() {
@@ -190,7 +171,8 @@ class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertTrueMethod exte
  * A method with a parameter that is annotated with
  * `System.Diagnostics.CodeAnalysis.DoesNotReturnIfAttribute(true)`.
  */
-class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertFalseMethod extends BooleanAssertMethod {
+class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertFalseMethod extends BooleanAssertMethod
+{
   private int i_;
 
   SystemDiagnosticsCodeAnalysisDoesNotReturnIfAnnotatedAssertFalseMethod() {

csharp/ql/lib/semmle/code/csharp/dataflow/FlowSummary.qll

@@ -143,7 +143,8 @@ private class RecordConstructorFlow extends SummarizedCallable {
 
 class RequiredSummaryComponentStack = Impl::Public::RequiredSummaryComponentStack;
 
-private class RecordConstructorFlowRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+private class RecordConstructorFlowRequiredSummaryComponentStack extends RequiredSummaryComponentStack
+{
   override predicate required(SummaryComponent head, SummaryComponentStack tail) {
     exists(Property p |
       recordConstructorFlow(_, _, p) and

csharp/ql/lib/semmle/code/csharp/dataflow/SSA.qll

@@ -110,7 +110,8 @@ module Ssa {
 
     /** A plain field or property. */
     class PlainFieldOrPropSourceVariable extends FieldOrPropSourceVariable,
-      SsaImpl::TPlainFieldOrProp {
+      SsaImpl::TPlainFieldOrProp
+    {
       override Callable getEnclosingCallable() { this = SsaImpl::TPlainFieldOrProp(result, _) }
 
       override string toString() {
@@ -127,7 +128,8 @@ module Ssa {
 
     /** A qualified field or property. */
     class QualifiedFieldOrPropSourceVariable extends FieldOrPropSourceVariable,
-      SsaImpl::TQualifiedFieldOrProp {
+      SsaImpl::TQualifiedFieldOrProp
+    {
       override Callable getEnclosingCallable() {
         this = SsaImpl::TQualifiedFieldOrProp(result, _, _)
       }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlow.qll

@@ -243,3 +243,111 @@ module MakeWithState<StateConfigSig Config> implements DataFlowSig {
 
   import Impl<C>
 }
+
+signature class PathNodeSig {
+  /** Gets a textual representation of this element. */
+  string toString();
+
+  /**
+   * Holds if this element is at the specified location.
+   * The location spans column `startcolumn` of line `startline` to
+   * column `endcolumn` of line `endline` in file `filepath`.
+   * For more information, see
+   * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+   */
+  predicate hasLocationInfo(
+    string filepath, int startline, int startcolumn, int endline, int endcolumn
+  );
+
+  /** Gets the underlying `Node`. */
+  Node getNode();
+}
+
+signature module PathGraphSig<PathNodeSig PathNode> {
+  /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+  predicate edges(PathNode a, PathNode b);
+
+  /** Holds if `n` is a node in the graph of data flow path explanations. */
+  predicate nodes(PathNode n, string key, string val);
+
+  /**
+   * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+   * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+   * `ret -> out` is summarized as the edge `arg -> out`.
+   */
+  predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out);
+}
+
+/**
+ * Constructs a `PathGraph` from two `PathGraph`s by disjoint union.
+ */
+module MergePathGraph<
+  PathNodeSig PathNode1, PathNodeSig PathNode2, PathGraphSig<PathNode1> Graph1,
+  PathGraphSig<PathNode2> Graph2>
+{
+  private newtype TPathNode =
+    TPathNode1(PathNode1 p) or
+    TPathNode2(PathNode2 p)
+
+  /** A node in a graph of path explanations that is formed by disjoint union of the two given graphs. */
+  class PathNode extends TPathNode {
+    /** Gets this as a projection on the first given `PathGraph`. */
+    PathNode1 asPathNode1() { this = TPathNode1(result) }
+
+    /** Gets this as a projection on the second given `PathGraph`. */
+    PathNode2 asPathNode2() { this = TPathNode2(result) }
+
+    /** Gets a textual representation of this element. */
+    string toString() {
+      result = this.asPathNode1().toString() or
+      result = this.asPathNode2().toString()
+    }
+
+    /**
+     * Holds if this element is at the specified location.
+     * The location spans column `startcolumn` of line `startline` to
+     * column `endcolumn` of line `endline` in file `filepath`.
+     * For more information, see
+     * [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
+     */
+    predicate hasLocationInfo(
+      string filepath, int startline, int startcolumn, int endline, int endcolumn
+    ) {
+      this.asPathNode1().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn) or
+      this.asPathNode2().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+    }
+
+    /** Gets the underlying `Node`. */
+    Node getNode() {
+      result = this.asPathNode1().getNode() or
+      result = this.asPathNode2().getNode()
+    }
+  }
+
+  /**
+   * Provides the query predicates needed to include a graph in a path-problem query.
+   */
+  module PathGraph implements PathGraphSig<PathNode> {
+    /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+    query predicate edges(PathNode a, PathNode b) {
+      Graph1::edges(a.asPathNode1(), b.asPathNode1()) or
+      Graph2::edges(a.asPathNode2(), b.asPathNode2())
+    }
+
+    /** Holds if `n` is a node in the graph of data flow path explanations. */
+    query predicate nodes(PathNode n, string key, string val) {
+      Graph1::nodes(n.asPathNode1(), key, val) or
+      Graph2::nodes(n.asPathNode2(), key, val)
+    }
+
+    /**
+     * Holds if `(arg, par, ret, out)` forms a subpath-tuple, that is, flow through
+     * a subpath between `par` and `ret` with the connecting edges `arg -> par` and
+     * `ret -> out` is summarized as the edge `arg -> out`.
+     */
+    query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
+      Graph1::subpaths(arg.asPathNode1(), par.asPathNode1(), ret.asPathNode1(), out.asPathNode1()) or
+      Graph2::subpaths(arg.asPathNode2(), par.asPathNode2(), ret.asPathNode2(), out.asPathNode2())
+    }
+  }
+}

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll

@@ -3157,7 +3157,7 @@ module Impl<FullStateConfigSig Config> {
   /**
    * Provides the query predicates needed to include a graph in a path-problem query.
    */
-  module PathGraph {
+  module PathGraph implements PathGraphSig<PathNode> {
     /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
     query predicate edges(PathNode a, PathNode b) { a.getASuccessor() = b }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll

@@ -1215,7 +1215,8 @@ private module ArgumentNodes {
    * ```
    */
   class ImplicitCapturedArgumentNode extends ArgumentNodeImpl, NodeImpl,
-    TImplicitCapturedArgumentNode {
+    TImplicitCapturedArgumentNode
+  {
     private LocalScopeVariable v;
     private ControlFlow::Nodes::ElementNode cfn;
 
@@ -2034,7 +2035,8 @@ private module PostUpdateNodes {
    * a pre-update node for the `ObjectCreationNode`.
    */
   class ObjectInitializerNode extends PostUpdateNode, NodeImpl, ArgumentNodeImpl,
-    TObjectInitializerNode {
+    TObjectInitializerNode
+  {
     private ObjectCreation oc;
     private ControlFlow::Nodes::ElementNode cfn;
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

@@ -301,8 +301,8 @@ module Private {
     TWithoutContentSummaryComponent(ContentSet c) or
     TWithContentSummaryComponent(ContentSet c)
 
-  private TParameterSummaryComponent thisParam() {
-    result = TParameterSummaryComponent(instanceParameterPosition())
+  private TParameterSummaryComponent callbackSelfParam() {
+    result = TParameterSummaryComponent(callbackSelfParameterPosition())
   }
 
   newtype TSummaryComponentStack =
@@ -311,7 +311,7 @@ module Private {
       any(RequiredSummaryComponentStack x).required(head, tail)
       or
       any(RequiredSummaryComponentStack x).required(TParameterSummaryComponent(_), tail) and
-      head = thisParam()
+      head = callbackSelfParam()
       or
       derivedFluentFlowPush(_, _, _, head, tail, _)
     }
@@ -336,7 +336,7 @@ module Private {
       callbackRef = s.drop(_) and
       (isCallbackParameter(callbackRef) or callbackRef.head() = TReturnSummaryComponent(_)) and
       input = callbackRef.tail() and
-      output = TConsSummaryComponentStack(thisParam(), input) and
+      output = TConsSummaryComponentStack(callbackSelfParam(), input) and
       preservesValue = true
     )
     or
@@ -439,6 +439,9 @@ module Private {
       out.head() = TParameterSummaryComponent(_) and
       s = out.tail()
     )
+    or
+    // Add the post-update node corresponding to the requested argument node
+    outputState(c, s) and isCallbackParameter(s)
   }
 
   private newtype TSummaryNodeState =
@@ -1012,7 +1015,7 @@ module Private {
       private predicate relevantSummaryElementGenerated(
         AccessPath inSpec, AccessPath outSpec, string kind
       ) {
-        summaryElement(this, inSpec, outSpec, kind, "generated") and
+        summaryElement(this, inSpec, outSpec, kind, ["generated", "ai-generated"]) and
         not summaryElement(this, _, _, _, "manual")
       }
 

csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImplSpecific.qll

@@ -22,7 +22,7 @@ class SummarizedCallableBase extends Callable {
 DataFlowCallable inject(SummarizedCallable c) { result.asSummarizedCallable() = c }
 
 /** Gets the parameter position of the instance parameter. */
-ArgumentPosition instanceParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
+ArgumentPosition callbackSelfParameterPosition() { none() } // disables implicit summary flow to `this` for callbacks
 
 /** Gets the synthesized summary data-flow node for the given values. */
 Node summaryNode(SummarizedCallable c, SummaryNodeState state) { result = TSummaryNode(c, state) }

csharp/ql/lib/semmle/code/csharp/dataflow/internal/tainttracking1/TaintTracking.qll

@@ -7,7 +7,8 @@ import TaintTrackingParameter::Public
 private import TaintTrackingParameter::Private
 
 private module AddTaintDefaults<DataFlowInternal::FullStateConfigSig Config> implements
-DataFlowInternal::FullStateConfigSig {
+  DataFlowInternal::FullStateConfigSig
+{
   import Config
 
   predicate isBarrier(DataFlow::Node node) {

csharp/ql/lib/semmle/code/csharp/dispatch/Dispatch.qll

@@ -1115,7 +1115,8 @@ private module Internal {
 
   /** A call using reflection. */
   private class DispatchReflectionCall extends DispatchReflectionOrDynamicCall,
-    TDispatchReflectionCall {
+    TDispatchReflectionCall
+  {
     override MethodCall getCall() { this = TDispatchReflectionCall(result, _, _, _, _) }
 
     override string getName() { this = TDispatchReflectionCall(_, result, _, _, _) }
@@ -1163,7 +1164,8 @@ private module Internal {
 
   /** A method call using dynamic types. */
   private class DispatchDynamicMethodCall extends DispatchReflectionOrDynamicCall,
-    TDispatchDynamicMethodCall {
+    TDispatchDynamicMethodCall
+  {
     override DynamicMethodCall getCall() { this = TDispatchDynamicMethodCall(result) }
 
     override string getName() { result = this.getCall().getLateBoundTargetName() }
@@ -1184,7 +1186,8 @@ private module Internal {
 
   /** An operator call using dynamic types. */
   private class DispatchDynamicOperatorCall extends DispatchReflectionOrDynamicCall,
-    TDispatchDynamicOperatorCall {
+    TDispatchDynamicOperatorCall
+  {
     override DynamicOperatorCall getCall() { this = TDispatchDynamicOperatorCall(result) }
 
     override string getName() {
@@ -1201,7 +1204,8 @@ private module Internal {
 
   /** A (potential) call to a property accessor using dynamic types. */
   private class DispatchDynamicMemberAccess extends DispatchReflectionOrDynamicCall,
-    TDispatchDynamicMemberAccess {
+    TDispatchDynamicMemberAccess
+  {
     override DynamicMemberAccess getCall() { this = TDispatchDynamicMemberAccess(result) }
 
     override string getName() {
@@ -1225,7 +1229,8 @@ private module Internal {
 
   /** A (potential) call to an indexer accessor using dynamic types. */
   private class DispatchDynamicElementAccess extends DispatchReflectionOrDynamicCall,
-    TDispatchDynamicElementAccess {
+    TDispatchDynamicElementAccess
+  {
     override DynamicElementAccess getCall() { this = TDispatchDynamicElementAccess(result) }
 
     override string getName() {
@@ -1251,7 +1256,8 @@ private module Internal {
 
   /** A (potential) call to an event accessor using dynamic types. */
   private class DispatchDynamicEventAccess extends DispatchReflectionOrDynamicCall,
-    TDispatchDynamicEventAccess {
+    TDispatchDynamicEventAccess
+  {
     override AssignArithmeticOperation getCall() {
       this = TDispatchDynamicEventAccess(result, _, _)
     }
@@ -1268,7 +1274,8 @@ private module Internal {
 
   /** A call to a constructor using dynamic types. */
   private class DispatchDynamicObjectCreation extends DispatchReflectionOrDynamicCall,
-    TDispatchDynamicObjectCreation {
+    TDispatchDynamicObjectCreation
+  {
     override DynamicObjectCreation getCall() { this = TDispatchDynamicObjectCreation(result) }
 
     override string getName() { none() }

csharp/ql/lib/semmle/code/csharp/dispatch/OverridableCallable.qll

@@ -162,12 +162,6 @@ class OverridableCallable extends Callable, Overridable {
   }
 }
 
-/** An overridable method. */
-deprecated class OverridableMethod extends Method, OverridableCallable { }
-
-/** An overridable accessor. */
-deprecated class OverridableAccessor extends Accessor, OverridableCallable { }
-
 /** An unbound type. */
 class UnboundDeclarationType extends Type {
   UnboundDeclarationType() { this.isUnboundDeclaration() }

csharp/ql/lib/semmle/code/csharp/exprs/Dynamic.qll

@@ -190,7 +190,8 @@ class DynamicAccess extends DynamicExpr {
  * property, or an event).
  */
 class DynamicMemberAccess extends DynamicAccess, MemberAccess, AssignableAccess,
-  @dynamic_member_access_expr {
+  @dynamic_member_access_expr
+{
   override string toString() {
     result = "dynamic access to member " + this.getLateBoundTargetName()
   }

csharp/ql/lib/semmle/code/csharp/frameworks/EntityFramework.qll

@@ -432,7 +432,8 @@ module EntityFramework {
     }
   }
 
-  private class DbContextSaveChangesRequiredSummaryComponentStack extends RequiredSummaryComponentStack {
+  private class DbContextSaveChangesRequiredSummaryComponentStack extends RequiredSummaryComponentStack
+  {
     override predicate required(SummaryComponent head, SummaryComponentStack tail) {
       exists(Content c | head = SummaryComponent::content(c) |
         any(DbContextClass cls).requiresComponentStackIn(c, _, tail, _)

csharp/ql/lib/semmle/code/csharp/frameworks/system/Diagnostics.qll

@@ -74,7 +74,8 @@ class SystemDiagnosticsProcessClass extends SystemDiagnosticsClass {
 }
 
 /** The `System.Diagnostics.CodeAnalysis.DoesNotReturnIfAttribute` class. */
-class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAttributeClass extends SystemDiagnosticsCodeAnalysisClass {
+class SystemDiagnosticsCodeAnalysisDoesNotReturnIfAttributeClass extends SystemDiagnosticsCodeAnalysisClass
+{
   SystemDiagnosticsCodeAnalysisDoesNotReturnIfAttributeClass() {
     this.hasName("DoesNotReturnIfAttribute")
   }

csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Generic.qll

@@ -33,7 +33,8 @@ class SystemCollectionsGenericUnboundGenericStruct extends UnboundGenericStruct
 }
 
 /** The `System.Collections.Generic.IComparer<>` interface. */
-class SystemCollectionsGenericIComparerTInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIComparerTInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIComparerTInterface() { this.hasName("IComparer<>") }
 
   /** Gets the `int Compare(T, T)` method. */
@@ -48,7 +49,8 @@ class SystemCollectionsGenericIComparerTInterface extends SystemCollectionsGener
 }
 
 /** The `System.Collections.Generic.IEqualityComparer<>` interface. */
-class SystemCollectionsGenericIEqualityComparerTInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIEqualityComparerTInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIEqualityComparerTInterface() { this.hasName("IEqualityComparer<>") }
 
   /** Gets the `bool Equals(T, T)` method. */
@@ -63,7 +65,8 @@ class SystemCollectionsGenericIEqualityComparerTInterface extends SystemCollecti
 }
 
 /** The `System.Collections.Generic.IEnumerable<>` interface. */
-class SystemCollectionsGenericIEnumerableTInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIEnumerableTInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIEnumerableTInterface() {
     this.hasName("IEnumerable<>") and
     this.getNumberOfTypeParameters() = 1
@@ -71,7 +74,8 @@ class SystemCollectionsGenericIEnumerableTInterface extends SystemCollectionsGen
 }
 
 /** The `System.Collections.Generic.IEnumerator<>` interface. */
-class SystemCollectionsGenericIEnumeratorInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIEnumeratorInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIEnumeratorInterface() {
     this.hasName("IEnumerator<>") and
     this.getNumberOfTypeParameters() = 1
@@ -86,7 +90,8 @@ class SystemCollectionsGenericIEnumeratorInterface extends SystemCollectionsGene
 }
 
 /** The `System.Collections.Generic.IList<>` interface. */
-class SystemCollectionsGenericIListTInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIListTInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIListTInterface() {
     this.hasName("IList<>") and
     this.getNumberOfTypeParameters() = 1
@@ -102,7 +107,8 @@ class SystemCollectionsGenericListClass extends SystemCollectionsGenericUnboundG
 }
 
 /** The `System.Collections.Generic.KeyValuePair<,>` structure. */
-class SystemCollectionsGenericKeyValuePairStruct extends SystemCollectionsGenericUnboundGenericStruct {
+class SystemCollectionsGenericKeyValuePairStruct extends SystemCollectionsGenericUnboundGenericStruct
+{
   SystemCollectionsGenericKeyValuePairStruct() {
     this.hasName("KeyValuePair<,>") and
     this.getNumberOfTypeParameters() = 2
@@ -124,7 +130,8 @@ class SystemCollectionsGenericKeyValuePairStruct extends SystemCollectionsGeneri
 }
 
 /** The `System.Collections.Generic.ICollection<>` interface. */
-class SystemCollectionsGenericICollectionInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericICollectionInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericICollectionInterface() { this.hasName("ICollection<>") }
 
   /** Gets the `Count` property. */
@@ -138,12 +145,14 @@ class SystemCollectionsGenericICollectionInterface extends SystemCollectionsGene
 }
 
 /** The `System.Collections.Generic.IList<>` interface. */
-class SystemCollectionsGenericIListInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIListInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIListInterface() { this.hasName("IList<>") }
 }
 
 /** The `System.Collections.Generic.IDictionary<>` interface. */
-class SystemCollectionsGenericIDictionaryInterface extends SystemCollectionsGenericUnboundGenericInterface {
+class SystemCollectionsGenericIDictionaryInterface extends SystemCollectionsGenericUnboundGenericInterface
+{
   SystemCollectionsGenericIDictionaryInterface() {
     this.hasName("IDictionary<,>") and
     this.getNumberOfTypeParameters() = 2

csharp/ql/lib/semmle/code/csharp/frameworks/system/collections/Specialized.qll

@@ -19,6 +19,7 @@ class SystemCollectionsSpecializedClass extends Class {
 }
 
 /** The `System.Collections.Specialized.NameValueCollection` class. */
-class SystemCollectionsSpecializedNameValueCollectionClass extends SystemCollectionsSpecializedClass {
+class SystemCollectionsSpecializedNameValueCollectionClass extends SystemCollectionsSpecializedClass
+{
   SystemCollectionsSpecializedNameValueCollectionClass() { this.hasName("NameValueCollection") }
 }

csharp/ql/lib/semmle/code/csharp/frameworks/system/runtime/CompilerServices.qll

@@ -20,7 +20,8 @@ class SystemRuntimeCompilerServicesNamespaceUnboundGenericStruct extends Unbound
 }
 
 /** The `System.Runtime.CompilerServices.TaskAwaiter<>` struct. */
-class SystemRuntimeCompilerServicesTaskAwaiterStruct extends SystemRuntimeCompilerServicesNamespaceUnboundGenericStruct {
+class SystemRuntimeCompilerServicesTaskAwaiterStruct extends SystemRuntimeCompilerServicesNamespaceUnboundGenericStruct
+{
   SystemRuntimeCompilerServicesTaskAwaiterStruct() { this.hasName("TaskAwaiter<>") }
 
   /** Gets the `GetResult` method. */
@@ -31,7 +32,8 @@ class SystemRuntimeCompilerServicesTaskAwaiterStruct extends SystemRuntimeCompil
 }
 
 /** The `System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>` struct. */
-class SystemRuntimeCompilerServicesConfiguredTaskAwaitableTStruct extends SystemRuntimeCompilerServicesNamespaceUnboundGenericStruct {
+class SystemRuntimeCompilerServicesConfiguredTaskAwaitableTStruct extends SystemRuntimeCompilerServicesNamespaceUnboundGenericStruct
+{
   SystemRuntimeCompilerServicesConfiguredTaskAwaitableTStruct() {
     this.hasName("ConfiguredTaskAwaitable<>")
   }
@@ -55,7 +57,8 @@ private class SyntheticConfiguredTaskAwaiterField extends SyntheticField {
 }
 
 /** The `System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>.ConfiguredTaskAwaiter` struct. */
-class SystemRuntimeCompilerServicesConfiguredTaskAwaitableTConfiguredTaskAwaiterStruct extends Struct {
+class SystemRuntimeCompilerServicesConfiguredTaskAwaitableTConfiguredTaskAwaiterStruct extends Struct
+{
   SystemRuntimeCompilerServicesConfiguredTaskAwaitableTConfiguredTaskAwaiterStruct() {
     this = any(SystemRuntimeCompilerServicesConfiguredTaskAwaitableTStruct n).getANestedType() and
     this.hasName("ConfiguredTaskAwaiter")

csharp/ql/lib/semmle/code/csharp/frameworks/system/security/cryptography/X509Certificates.qll

@@ -22,7 +22,8 @@ class SystemSecurityCryptographyX509CertificatesClass extends Class {
  * The `X509Certificate` or `X509Certificate2` class in the namespace
  * `System.Security.Cryptography.X509Certificates`.
  */
-class SystemSecurityCryptographyX509CertificatesX509CertificateClass extends SystemSecurityCryptographyX509CertificatesClass {
+class SystemSecurityCryptographyX509CertificatesX509CertificateClass extends SystemSecurityCryptographyX509CertificatesClass
+{
   SystemSecurityCryptographyX509CertificatesX509CertificateClass() {
     this.hasName("X509Certificate") or
     this.hasName("X509Certificate2")

csharp/ql/lib/semmle/code/csharp/security/dataflow/UnsafeDeserializationQuery.qll

@@ -299,7 +299,8 @@ private predicate isDataContractJsonSerializerCall(MethodCall mc, Method m) {
 
 abstract private class DataContractJsonSerializerSink extends InstanceMethodSink { }
 
-private class DataContractJsonSerializerDeserializeMethodSink extends DataContractJsonSerializerSink {
+private class DataContractJsonSerializerDeserializeMethodSink extends DataContractJsonSerializerSink
+{
   DataContractJsonSerializerDeserializeMethodSink() {
     exists(MethodCall mc |
       isDataContractJsonSerializerCall(mc, _) and
@@ -308,7 +309,8 @@ private class DataContractJsonSerializerDeserializeMethodSink extends DataContra
   }
 }
 
-private class DataContractJsonSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig {
+private class DataContractJsonSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig
+{
   DataContractJsonSafeConstructorTrackingConfiguration() {
     this = "DataContractJsonSafeConstructorTrackingConfiguration"
   }
@@ -357,7 +359,8 @@ private class JavaScriptSerializerDeserializeMethodSink extends JavaScriptSerial
   }
 }
 
-private class JavaScriptSerializerSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig {
+private class JavaScriptSerializerSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig
+{
   JavaScriptSerializerSafeConstructorTrackingConfiguration() {
     this = "JavaScriptSerializerSafeConstructorTrackingConfiguration"
   }
@@ -400,7 +403,8 @@ private class XmlObjectSerializerDeserializeMethodSink extends XmlObjectSerializ
   }
 }
 
-private class XmlObjectSerializerDerivedConstructorTrackingConfiguration extends SafeConstructorTrackingConfig {
+private class XmlObjectSerializerDerivedConstructorTrackingConfiguration extends SafeConstructorTrackingConfig
+{
   XmlObjectSerializerDerivedConstructorTrackingConfiguration() {
     this = "XmlObjectSerializerDerivedConstructorTrackingConfiguration"
   }
@@ -445,7 +449,8 @@ private class XmlSerializerDeserializeMethodSink extends XmlSerializerSink {
   }
 }
 
-private class XmlSerializerSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig {
+private class XmlSerializerSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig
+{
   XmlSerializerSafeConstructorTrackingConfiguration() {
     this = "XmlSerializerSafeConstructorTrackingConfiguration"
   }
@@ -492,7 +497,8 @@ private class DataContractSerializerDeserializeMethodSink extends DataContractSe
   }
 }
 
-private class DataContractSerializerSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig {
+private class DataContractSerializerSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig
+{
   DataContractSerializerSafeConstructorTrackingConfiguration() {
     this = "DataContractSerializerSafeConstructorTrackingConfiguration"
   }
@@ -535,7 +541,8 @@ private class XmlMessageFormatterDeserializeMethodSink extends XmlMessageFormatt
   }
 }
 
-private class XmlMessageFormatterSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig {
+private class XmlMessageFormatterSafeConstructorTrackingConfiguration extends SafeConstructorTrackingConfig
+{
   XmlMessageFormatterSafeConstructorTrackingConfiguration() {
     this = "XmlMessageFormatterSafeConstructorTrackingConfiguration"
   }
@@ -717,7 +724,8 @@ private class SweetJaysonDeserializeMethodSink extends SweetJaysonSink {
 /** ServiceStack.Text.JsonSerializer */
 abstract private class ServiceStackTextJsonSerializerSink extends ConstructorOrStaticMethodSink { }
 
-private class ServiceStackTextJsonSerializerDeserializeMethodSink extends ServiceStackTextJsonSerializerSink {
+private class ServiceStackTextJsonSerializerDeserializeMethodSink extends ServiceStackTextJsonSerializerSink
+{
   ServiceStackTextJsonSerializerDeserializeMethodSink() {
     exists(MethodCall mc, Method m |
       m = mc.getTarget() and
@@ -741,7 +749,8 @@ private class ServiceStackTextJsonSerializerDeserializeMethodSink extends Servic
 /** ServiceStack.Text.TypeSerializer */
 abstract private class ServiceStackTextTypeSerializerSink extends ConstructorOrStaticMethodSink { }
 
-private class ServiceStackTextTypeSerializerDeserializeMethodSink extends ServiceStackTextTypeSerializerSink {
+private class ServiceStackTextTypeSerializerDeserializeMethodSink extends ServiceStackTextTypeSerializerSink
+{
   ServiceStackTextTypeSerializerDeserializeMethodSink() {
     exists(MethodCall mc, Method m |
       m = mc.getTarget() and
@@ -765,7 +774,8 @@ private class ServiceStackTextTypeSerializerDeserializeMethodSink extends Servic
 /** ServiceStack.Text.CsvSerializer */
 abstract private class ServiceStackTextCsvSerializerSink extends ConstructorOrStaticMethodSink { }
 
-private class ServiceStackTextCsvSerializerDeserializeMethodSink extends ServiceStackTextCsvSerializerSink {
+private class ServiceStackTextCsvSerializerDeserializeMethodSink extends ServiceStackTextCsvSerializerSink
+{
   ServiceStackTextCsvSerializerDeserializeMethodSink() {
     exists(MethodCall mc, Method m |
       m = mc.getTarget() and
@@ -789,7 +799,8 @@ private class ServiceStackTextCsvSerializerDeserializeMethodSink extends Service
 /** ServiceStack.Text.XmlSerializer */
 abstract private class ServiceStackTextXmlSerializerSink extends ConstructorOrStaticMethodSink { }
 
-private class ServiceStackTextXmlSerializerDeserializeMethodSink extends ServiceStackTextXmlSerializerSink {
+private class ServiceStackTextXmlSerializerDeserializeMethodSink extends ServiceStackTextXmlSerializerSink
+{
   ServiceStackTextXmlSerializerDeserializeMethodSink() {
     exists(MethodCall mc, Method m |
       m = mc.getTarget() and

csharp/ql/lib/semmle/code/csharp/security/dataflow/flowsources/Remote.qll

@@ -75,7 +75,8 @@ class AspNetQueryStringRemoteFlowSource extends AspNetRemoteFlowSource, DataFlow
 
 /** A data flow source of remote user input (ASP.NET unvalidated request data). */
 class AspNetUnvalidatedQueryStringRemoteFlowSource extends AspNetRemoteFlowSource,
-  DataFlow::ExprNode {
+  DataFlow::ExprNode
+{
   AspNetUnvalidatedQueryStringRemoteFlowSource() {
     this.getExpr() = any(SystemWebUnvalidatedRequestValues c).getAProperty().getGetter().getACall() or
     this.getExpr() =

csharp/ql/src/experimental/Security Features/JsonWebTokenHandler/JsonWebTokenHandlerLib.qll

@@ -21,7 +21,8 @@ class TokenValidationParametersPropertySensitiveValidation extends Property {
 /**
  * A dataflow from a `false` value to a write sensitive property for `TokenValidationParameters`.
  */
-class FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation extends DataFlow::Configuration {
+class FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation extends DataFlow::Configuration
+{
   FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation() {
     this = "FalseValueFlowsToTokenValidationParametersPropertyWriteToBypassValidation"
   }
@@ -219,7 +220,8 @@ class CallableAlwaysReturnsParameter0 extends CallableReturnsStringAndArg0IsStri
 /**
  * A Callable that always return the 1st argument, both of `string` type. Higher precision
  */
-class CallableAlwaysReturnsParameter0MayThrowExceptions extends CallableReturnsStringAndArg0IsString {
+class CallableAlwaysReturnsParameter0MayThrowExceptions extends CallableReturnsStringAndArg0IsString
+{
   CallableAlwaysReturnsParameter0MayThrowExceptions() {
     forex(Expr ret | this.canReturn(ret) |
       ret = this.getParameter(0).getAnAccess()

csharp/ql/src/experimental/Security Features/backdoor/PotentialTimeBomb.ql

@@ -80,7 +80,8 @@ class DateTimeStruct extends Struct {
 /**
  * Dataflow configuration to find flow from a GetLastWriteTime source to a DateTime arithmetic operation
  */
-private class FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable extends TaintTracking::Configuration {
+private class FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable extends TaintTracking::Configuration
+{
   FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable() {
     this = "FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable"
   }
@@ -103,7 +104,8 @@ private class FlowsFromGetLastWriteTimeConfigToTimeSpanArithmeticCallable extend
 /**
  * Dataflow configuration to find flow from a DateTime arithmetic operation to a DateTime comparison operation
  */
-private class FlowsFromTimeSpanArithmeticToTimeComparisonCallable extends TaintTracking::Configuration {
+private class FlowsFromTimeSpanArithmeticToTimeComparisonCallable extends TaintTracking::Configuration
+{
   FlowsFromTimeSpanArithmeticToTimeComparisonCallable() {
     this = "FlowsFromTimeSpanArithmeticToTimeComparisonCallable"
   }
@@ -125,7 +127,8 @@ private class FlowsFromTimeSpanArithmeticToTimeComparisonCallable extends TaintT
 /**
  * Dataflow configuration to find flow from a DateTime comparison operation to a Selection Statement (such as an If)
  */
-private class FlowsFromTimeComparisonCallableToSelectionStatementCondition extends TaintTracking::Configuration {
+private class FlowsFromTimeComparisonCallableToSelectionStatementCondition extends TaintTracking::Configuration
+{
   FlowsFromTimeComparisonCallableToSelectionStatementCondition() {
     this = "FlowsFromTimeComparisonCallableToSelectionStatementCondition"
   }

csharp/ql/src/experimental/ir/implementation/Opcode.qll

@@ -1082,7 +1082,8 @@ module Opcode {
    * See the `CallSideEffectInstruction` documentation for more details.
    */
   class CallSideEffect extends WriteSideEffectOpcode, EscapedWriteOpcode, MayWriteOpcode,
-    ReadSideEffectOpcode, EscapedReadOpcode, MayReadOpcode, TCallSideEffect {
+    ReadSideEffectOpcode, EscapedReadOpcode, MayReadOpcode, TCallSideEffect
+  {
     final override string toString() { result = "CallSideEffect" }
   }
 
@@ -1092,7 +1093,8 @@ module Opcode {
    * See the `CallReadSideEffectInstruction` documentation for more details.
    */
   class CallReadSideEffect extends ReadSideEffectOpcode, EscapedReadOpcode, MayReadOpcode,
-    TCallReadSideEffect {
+    TCallReadSideEffect
+  {
     final override string toString() { result = "CallReadSideEffect" }
   }
 
@@ -1102,7 +1104,8 @@ module Opcode {
    * See the `IndirectReadSideEffectInstruction` documentation for more details.
    */
   class IndirectReadSideEffect extends ReadSideEffectOpcode, IndirectReadOpcode,
-    TIndirectReadSideEffect {
+    TIndirectReadSideEffect
+  {
     final override string toString() { result = "IndirectReadSideEffect" }
   }
 
@@ -1112,7 +1115,8 @@ module Opcode {
    * See the `IndirectMustWriteSideEffectInstruction` documentation for more details.
    */
   class IndirectMustWriteSideEffect extends WriteSideEffectOpcode, IndirectWriteOpcode,
-    TIndirectMustWriteSideEffect {
+    TIndirectMustWriteSideEffect
+  {
     final override string toString() { result = "IndirectMustWriteSideEffect" }
   }
 
@@ -1122,7 +1126,8 @@ module Opcode {
    * See the `IndirectMayWriteSideEffectInstruction` documentation for more details.
    */
   class IndirectMayWriteSideEffect extends WriteSideEffectOpcode, IndirectWriteOpcode,
-    MayWriteOpcode, TIndirectMayWriteSideEffect {
+    MayWriteOpcode, TIndirectMayWriteSideEffect
+  {
     final override string toString() { result = "IndirectMayWriteSideEffect" }
   }
 
@@ -1132,7 +1137,8 @@ module Opcode {
    * See the `BufferReadSideEffectInstruction` documentation for more details.
    */
   class BufferReadSideEffect extends ReadSideEffectOpcode, UnsizedBufferReadOpcode,
-    TBufferReadSideEffect {
+    TBufferReadSideEffect
+  {
     final override string toString() { result = "BufferReadSideEffect" }
   }
 
@@ -1142,7 +1148,8 @@ module Opcode {
    * See the `BufferMustWriteSideEffectInstruction` documentation for more details.
    */
   class BufferMustWriteSideEffect extends WriteSideEffectOpcode, UnsizedBufferWriteOpcode,
-    TBufferMustWriteSideEffect {
+    TBufferMustWriteSideEffect
+  {
     final override string toString() { result = "BufferMustWriteSideEffect" }
   }
 
@@ -1152,7 +1159,8 @@ module Opcode {
    * See the `BufferMayWriteSideEffectInstruction` documentation for more details.
    */
   class BufferMayWriteSideEffect extends WriteSideEffectOpcode, UnsizedBufferWriteOpcode,
-    MayWriteOpcode, TBufferMayWriteSideEffect {
+    MayWriteOpcode, TBufferMayWriteSideEffect
+  {
     final override string toString() { result = "BufferMayWriteSideEffect" }
   }
 
@@ -1162,7 +1170,8 @@ module Opcode {
    * See the `SizedBufferReadSideEffectInstruction` documentation for more details.
    */
   class SizedBufferReadSideEffect extends ReadSideEffectOpcode, SizedBufferReadOpcode,
-    TSizedBufferReadSideEffect {
+    TSizedBufferReadSideEffect
+  {
     final override string toString() { result = "SizedBufferReadSideEffect" }
   }
 
@@ -1172,7 +1181,8 @@ module Opcode {
    * See the `SizedBufferMustWriteSideEffectInstruction` documentation for more details.
    */
   class SizedBufferMustWriteSideEffect extends WriteSideEffectOpcode, SizedBufferWriteOpcode,
-    TSizedBufferMustWriteSideEffect {
+    TSizedBufferMustWriteSideEffect
+  {
     final override string toString() { result = "SizedBufferMustWriteSideEffect" }
   }
 
@@ -1182,7 +1192,8 @@ module Opcode {
    * See the `SizedBufferMayWriteSideEffectInstruction` documentation for more details.
    */
   class SizedBufferMayWriteSideEffect extends WriteSideEffectOpcode, SizedBufferWriteOpcode,
-    MayWriteOpcode, TSizedBufferMayWriteSideEffect {
+    MayWriteOpcode, TSizedBufferMayWriteSideEffect
+  {
     final override string toString() { result = "SizedBufferMayWriteSideEffect" }
   }
 
@@ -1192,7 +1203,8 @@ module Opcode {
    * See the `InitializeDynamicAllocationInstruction` documentation for more details.
    */
   class InitializeDynamicAllocation extends SideEffectOpcode, EntireAllocationWriteOpcode,
-    TInitializeDynamicAllocation {
+    TInitializeDynamicAllocation
+  {
     final override string toString() { result = "InitializeDynamicAllocation" }
   }
 
@@ -1221,7 +1233,8 @@ module Opcode {
    * See the `InlineAsmInstruction` documentation for more details.
    */
   class InlineAsm extends Opcode, EscapedWriteOpcode, MayWriteOpcode, EscapedReadOpcode,
-    MayReadOpcode, TInlineAsm {
+    MayReadOpcode, TInlineAsm
+  {
     final override string toString() { result = "InlineAsm" }
 
     final override predicate hasOperandInternal(OperandTag tag) {

csharp/ql/src/experimental/ir/implementation/raw/Operand.qll

@@ -87,22 +87,6 @@ class Operand extends TStageOperand {
     this.getDefinitionOverlap() instanceof MustExactlyOverlap
   }
 
-  /**
-   * DEPRECATED: renamed to `getUse`.
-   *
-   * Gets the `Instruction` that consumes this operand.
-   */
-  deprecated final Instruction getUseInstruction() { result = this.getUse() }
-
-  /**
-   * DEPRECATED: use `getAnyDef` or `getDef`. The exact replacement for this
-   * predicate is `getAnyDef`, but most uses of this predicate should probably
-   * be replaced with `getDef`.
-   *
-   * Gets the `Instruction` whose result is the value of the operand.
-   */
-  deprecated final Instruction getDefinitionInstruction() { result = this.getAnyDef() }
-
   /**
    * Gets the overlap relationship between the operand's definition and its use.
    */

csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedCondition.qll

@@ -28,7 +28,8 @@ abstract class TranslatedCondition extends ConditionBase {
 }
 
 abstract class TranslatedFlexibleCondition extends TranslatedCondition, ConditionContext,
-  TTranslatedFlexibleCondition {
+  TTranslatedFlexibleCondition
+{
   TranslatedFlexibleCondition() { this = TTranslatedFlexibleCondition(expr) }
 
   final override TranslatedElement getChild(int id) { id = 0 and result = this.getOperand() }
@@ -156,7 +157,8 @@ class TranslatedLogicalOrExpr extends TranslatedBinaryLogicalOperation {
 }
 
 class TranslatedValueCondition extends TranslatedCondition, ValueConditionBase,
-  TTranslatedValueCondition {
+  TTranslatedValueCondition
+{
   TranslatedValueCondition() { this = TTranslatedValueCondition(expr) }
 
   override TranslatedExpr getValueExpr() { result = getTranslatedExpr(expr) }

csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedDeclaration.qll

@@ -40,7 +40,8 @@ abstract class TranslatedLocalDeclaration extends TranslatedElement, TTranslated
  * including its initialization, if any.
  */
 class TranslatedLocalVariableDeclaration extends TranslatedLocalDeclaration,
-  LocalVariableDeclarationBase, InitializationContext {
+  LocalVariableDeclarationBase, InitializationContext
+{
   LocalVariable var;
 
   TranslatedLocalVariableDeclaration() { var = expr.getVariable() }

csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedExpr.qll

@@ -119,7 +119,8 @@ abstract class TranslatedCoreExpr extends TranslatedExpr {
 }
 
 class TranslatedConditionValue extends TranslatedCoreExpr, ConditionContext,
-  TTranslatedConditionValue {
+  TTranslatedConditionValue
+{
   TranslatedConditionValue() { this = TTranslatedConditionValue(expr) }
 
   override TranslatedElement getChild(int id) { id = 0 and result = this.getCondition() }
@@ -1950,7 +1951,8 @@ class TranslatedDelegateCall extends TranslatedNonConstantExpr {
  * object is allocated, which is then initialized by the constructor.
  */
 abstract class TranslatedCreation extends TranslatedCoreExpr, TTranslatedCreationExpr,
-  ConstructorCallContext {
+  ConstructorCallContext
+{
   TranslatedCreation() { this = TTranslatedCreationExpr(expr) }
 
   override TranslatedElement getChild(int id) {

csharp/ql/src/experimental/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -276,7 +276,8 @@ abstract class TranslatedElementInitialization extends TranslatedElement {
  * an explicit element in an initializer list.
  */
 class TranslatedExplicitElementInitialization extends TranslatedElementInitialization,
-  TTranslatedExplicitElementInitialization, InitializationContext {
+  TTranslatedExplicitElementInitialization, InitializationContext
+{
   int elementIndex;
 
   TranslatedExplicitElementInitialization() {
@@ -312,7 +313,8 @@ class TranslatedExplicitElementInitialization extends TranslatedElementInitializ
 
 // TODO: Possibly refactor into something simpler
 abstract class TranslatedConstructorCallFromConstructor extends TranslatedElement,
-  ConstructorCallContext {
+  ConstructorCallContext
+{
   Call call;
 
   final override Language::AST getAst() { result = call }
@@ -344,7 +346,8 @@ TranslatedConstructorInitializer getTranslatedConstructorInitializer(Constructor
  */
 // Review: do we need the conversion instructions in C#?
 class TranslatedConstructorInitializer extends TranslatedConstructorCallFromConstructor,
-  TTranslatedConstructorInitializer {
+  TTranslatedConstructorInitializer
+{
   TranslatedConstructorInitializer() { this = TTranslatedConstructorInitializer(call) }
 
   override string toString() { result = "constructor init: " + call.toString() }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Common.qll

@@ -126,7 +126,8 @@ abstract class TranslatedCompilerGeneratedBlock extends TranslatedCompilerGenera
  * the body of the `then` and the body of the `else`.
  */
 abstract class TranslatedCompilerGeneratedIfStmt extends TranslatedCompilerGeneratedStmt,
-  ConditionContext {
+  ConditionContext
+{
   override Instruction getFirstInstruction() { result = getCondition().getFirstInstruction() }
 
   override TranslatedElement getChild(int id) {

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Delegate.qll

@@ -45,7 +45,8 @@ module DelegateElements {
  * The translation of the constructor call that happens as part of the delegate creation.
  */
 private class TranslatedDelegateConstructorCall extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override DelegateCreation generatedBy;
 
   TranslatedDelegateConstructorCall() { this = TTranslatedCompilerGeneratedElement(generatedBy, 0) }
@@ -80,7 +81,8 @@ private class TranslatedDelegateConstructorCall extends TranslatedCompilerGenera
  * The translation of the invoke call that happens as part of the desugaring of the delegate call.
  */
 private class TranslatedDelegateInvokeCall extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override DelegateCall generatedBy;
 
   TranslatedDelegateInvokeCall() { this = TTranslatedCompilerGeneratedElement(generatedBy, 1) }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Foreach.qll

@@ -64,7 +64,8 @@ module ForeachElements {
 }
 
 private class TranslatedForeachTry extends TranslatedCompilerGeneratedTry,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachTry() { this = TTranslatedCompilerGeneratedElement(generatedBy, 0) }
@@ -88,7 +89,8 @@ private class TranslatedForeachTry extends TranslatedCompilerGeneratedTry,
  * The translation of the finally block.
  */
 private class TranslatedForeachFinally extends TranslatedCompilerGeneratedBlock,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachFinally() { this = TTranslatedCompilerGeneratedElement(generatedBy, 1) }
@@ -108,7 +110,8 @@ private class TranslatedForeachFinally extends TranslatedCompilerGeneratedBlock,
  * to correctly mark which edges should be back edges.
  */
 class TranslatedForeachWhile extends TranslatedCompilerGeneratedStmt, ConditionContext,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachWhile() { this = TTranslatedCompilerGeneratedElement(generatedBy, 2) }
@@ -164,7 +167,8 @@ class TranslatedForeachWhile extends TranslatedCompilerGeneratedStmt, ConditionC
  * The translation of the call to the `MoveNext` method, used as a condition for the while.
  */
 private class TranslatedForeachMoveNext extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachMoveNext() { this = TTranslatedCompilerGeneratedElement(generatedBy, 3) }
@@ -192,7 +196,8 @@ private class TranslatedForeachMoveNext extends TranslatedCompilerGeneratedCall,
  * The translation of the call to retrieve the enumerator.
  */
 private class TranslatedForeachGetEnumerator extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachGetEnumerator() { this = TTranslatedCompilerGeneratedElement(generatedBy, 4) }
@@ -219,7 +224,8 @@ private class TranslatedForeachGetEnumerator extends TranslatedCompilerGenerated
  * The translation of the call to the getter method of the `Current` property of the enumerator.
  */
 private class TranslatedForeachCurrent extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachCurrent() { this = TTranslatedCompilerGeneratedElement(generatedBy, 5) }
@@ -247,7 +253,8 @@ private class TranslatedForeachCurrent extends TranslatedCompilerGeneratedCall,
  * The translation of the call to dispose (inside the finally block)
  */
 private class TranslatedForeachDispose extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachDispose() { this = TTranslatedCompilerGeneratedElement(generatedBy, 6) }
@@ -275,7 +282,8 @@ private class TranslatedForeachDispose extends TranslatedCompilerGeneratedCall,
  * The condition for the while, ie. a call to MoveNext.
  */
 private class TranslatedForeachWhileCondition extends TranslatedCompilerGeneratedValueCondition,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachWhileCondition() { this = TTranslatedCompilerGeneratedElement(generatedBy, 7) }
@@ -295,7 +303,8 @@ private class TranslatedForeachWhileCondition extends TranslatedCompilerGenerate
  * declaration of the `temporary` enumerator variable)
  */
 private class TranslatedForeachEnumerator extends TranslatedCompilerGeneratedDeclaration,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachEnumerator() { this = TTranslatedCompilerGeneratedElement(generatedBy, 8) }
@@ -323,7 +332,8 @@ private class TranslatedForeachEnumerator extends TranslatedCompilerGeneratedDec
  * Class that represents that translation of the declaration that's happening inside the body of the while.
  */
 private class TranslatedForeachIterVar extends TranslatedCompilerGeneratedDeclaration,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachIterVar() { this = TTranslatedCompilerGeneratedElement(generatedBy, 9) }
@@ -352,7 +362,8 @@ private class TranslatedForeachIterVar extends TranslatedCompilerGeneratedDeclar
  * for the call to `MoveNext`.
  */
 private class TranslatedMoveNextEnumAcc extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override ForeachStmt generatedBy;
 
   TranslatedMoveNextEnumAcc() { this = TTranslatedCompilerGeneratedElement(generatedBy, 10) }
@@ -384,7 +395,8 @@ private class TranslatedMoveNextEnumAcc extends TTranslatedCompilerGeneratedElem
  * for the call to the getter of the property `Current`.
  */
 private class TranslatedForeachCurrentEnumAcc extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachCurrentEnumAcc() { this = TTranslatedCompilerGeneratedElement(generatedBy, 11) }
@@ -416,7 +428,8 @@ private class TranslatedForeachCurrentEnumAcc extends TTranslatedCompilerGenerat
  * for the call to `Dispose`.
  */
 private class TranslatedForeachDisposeEnumAcc extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override ForeachStmt generatedBy;
 
   TranslatedForeachDisposeEnumAcc() { this = TTranslatedCompilerGeneratedElement(generatedBy, 12) }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/Lock.qll

@@ -57,7 +57,8 @@ module LockElements {
  * The translation of the `try` stmt.
  */
 private class TranslatedLockTry extends TranslatedCompilerGeneratedTry,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedLockTry() { this = TTranslatedCompilerGeneratedElement(generatedBy, 0) }
@@ -81,7 +82,8 @@ private class TranslatedLockTry extends TranslatedCompilerGeneratedTry,
  * The translation of the `lock` stmt's body.
  */
 private class TranslatedLockTryBody extends TranslatedCompilerGeneratedBlock,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedLockTryBody() { this = TTranslatedCompilerGeneratedElement(generatedBy, 1) }
@@ -102,7 +104,8 @@ private class TranslatedLockTryBody extends TranslatedCompilerGeneratedBlock,
  * The translation of the finally block.
  */
 private class TranslatedLockFinally extends TranslatedCompilerGeneratedBlock,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedLockFinally() { this = TTranslatedCompilerGeneratedElement(generatedBy, 2) }
@@ -120,7 +123,8 @@ private class TranslatedLockFinally extends TranslatedCompilerGeneratedBlock,
  * The translation of the call to dispose (inside the finally block)
  */
 private class TranslatedMonitorExit extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedMonitorExit() { this = TTranslatedCompilerGeneratedElement(generatedBy, 3) }
@@ -152,7 +156,8 @@ private class TranslatedMonitorExit extends TranslatedCompilerGeneratedCall,
  * The translation of the call to dispose (inside the finally block)
  */
 private class TranslatedMonitorEnter extends TranslatedCompilerGeneratedCall,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedMonitorEnter() { this = TTranslatedCompilerGeneratedElement(generatedBy, 4) }
@@ -190,7 +195,8 @@ private class TranslatedMonitorEnter extends TranslatedCompilerGeneratedCall,
  * The translation of the condition of the `if` present in the `finally` clause.
  */
 private class TranslatedIfCondition extends TranslatedCompilerGeneratedValueCondition,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedIfCondition() { this = TTranslatedCompilerGeneratedElement(generatedBy, 5) }
@@ -209,7 +215,8 @@ private class TranslatedIfCondition extends TranslatedCompilerGeneratedValueCond
  * The translation of the `if` stmt present in the `finally` clause.
  */
 private class TranslatedFinallyIf extends TranslatedCompilerGeneratedIfStmt,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedFinallyIf() { this = TTranslatedCompilerGeneratedElement(generatedBy, 6) }
@@ -236,7 +243,8 @@ private class TranslatedFinallyIf extends TranslatedCompilerGeneratedIfStmt,
  * bool temp variable.
  */
 private class TranslatedWasTakenConst extends TranslatedCompilerGeneratedConstant,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedWasTakenConst() { this = TTranslatedCompilerGeneratedElement(generatedBy, 7) }
@@ -255,7 +263,8 @@ private class TranslatedWasTakenConst extends TranslatedCompilerGeneratedConstan
  * Represents the translation of the `lockWasTaken` temp variable declaration.
  */
 private class TranslatedLockWasTakenDecl extends TranslatedCompilerGeneratedDeclaration,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedLockWasTakenDecl() { this = TTranslatedCompilerGeneratedElement(generatedBy, 8) }
@@ -286,7 +295,8 @@ private class TranslatedLockWasTakenDecl extends TranslatedCompilerGeneratedDecl
  * expression being locked.
  */
 private class TranslatedLockedVarDecl extends TranslatedCompilerGeneratedDeclaration,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   override LockStmt generatedBy;
 
   TranslatedLockedVarDecl() { this = TTranslatedCompilerGeneratedElement(generatedBy, 9) }
@@ -315,7 +325,8 @@ private class TranslatedLockedVarDecl extends TranslatedCompilerGeneratedDeclara
  * Used as an argument for the `MonitorEnter` call.
  */
 private class TranslatedMonitorEnterVarAcc extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override LockStmt generatedBy;
 
   TranslatedMonitorEnterVarAcc() { this = TTranslatedCompilerGeneratedElement(generatedBy, 10) }
@@ -341,7 +352,8 @@ private class TranslatedMonitorEnterVarAcc extends TTranslatedCompilerGeneratedE
  * Used as an argument for the `MonitorExit` call.
  */
 private class TranslatedMonitorExitVarAcc extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override LockStmt generatedBy;
 
   TranslatedMonitorExitVarAcc() { this = TTranslatedCompilerGeneratedElement(generatedBy, 11) }
@@ -366,7 +378,8 @@ private class TranslatedMonitorExitVarAcc extends TTranslatedCompilerGeneratedEl
  * Used as an argument for the `MonitorEnter` call.
  */
 private class TranslatedLockWasTakenCondVarAcc extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override LockStmt generatedBy;
 
   TranslatedLockWasTakenCondVarAcc() { this = TTranslatedCompilerGeneratedElement(generatedBy, 12) }
@@ -391,7 +404,8 @@ private class TranslatedLockWasTakenCondVarAcc extends TTranslatedCompilerGenera
  * as the `if` condition in the finally clause.
  */
 private class TranslatedLockWasTakenRefArg extends TTranslatedCompilerGeneratedElement,
-  TranslatedCompilerGeneratedVariableAccess {
+  TranslatedCompilerGeneratedVariableAccess
+{
   override LockStmt generatedBy;
 
   TranslatedLockWasTakenRefArg() { this = TTranslatedCompilerGeneratedElement(generatedBy, 13) }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/internal/TranslatedCompilerGeneratedCall.qll

@@ -10,7 +10,8 @@ private import TranslatedCompilerGeneratedElement
 private import experimental.ir.internal.IRCSharpLanguage as Language
 
 abstract class TranslatedCompilerGeneratedCall extends TranslatedCallBase,
-  TranslatedCompilerGeneratedElement {
+  TranslatedCompilerGeneratedElement
+{
   final override string toString() {
     result = "compiler generated call (" + generatedBy.toString() + ")"
   }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/internal/TranslatedCompilerGeneratedCondition.qll

@@ -9,7 +9,8 @@ private import TranslatedCompilerGeneratedElement
 private import experimental.ir.internal.IRCSharpLanguage as Language
 
 abstract class TranslatedCompilerGeneratedValueCondition extends TranslatedCompilerGeneratedElement,
-  ValueConditionBase {
+  ValueConditionBase
+{
   final override string toString() {
     result = "compiler generated condition (" + generatedBy.toString() + ")"
   }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/internal/TranslatedCompilerGeneratedDeclaration.qll

@@ -16,7 +16,8 @@ private import experimental.ir.internal.CSharpType
 private import experimental.ir.internal.IRCSharpLanguage as Language
 
 abstract class TranslatedCompilerGeneratedDeclaration extends LocalVariableDeclarationBase,
-  TranslatedCompilerGeneratedElement {
+  TranslatedCompilerGeneratedElement
+{
   final override string toString() {
     result = "compiler generated declaration (" + generatedBy.toString() + ")"
   }

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/internal/TranslatedCompilerGeneratedElement.qll

@@ -7,7 +7,8 @@ private import experimental.ir.implementation.raw.internal.TranslatedElement
 private import experimental.ir.internal.IRCSharpLanguage as Language
 
 abstract class TranslatedCompilerGeneratedElement extends TranslatedElement,
-  TTranslatedCompilerGeneratedElement {
+  TTranslatedCompilerGeneratedElement
+{
   // The element that generates generated the compiler element can
   // only be a stmt or an expr
   ControlFlowElement generatedBy;

csharp/ql/src/experimental/ir/implementation/raw/internal/desugar/internal/TranslatedCompilerGeneratedExpr.qll

@@ -10,7 +10,8 @@ private import experimental.ir.implementation.raw.internal.common.TranslatedExpr
 private import experimental.ir.internal.IRCSharpLanguage as Language
 
 abstract class TranslatedCompilerGeneratedExpr extends TranslatedCompilerGeneratedElement,
-  TranslatedExprBase {
+  TranslatedExprBase
+{
   override string toString() { result = "compiler generated expr (" + generatedBy.toString() + ")" }
 
   abstract Type getResultType();

csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll

@@ -87,22 +87,6 @@ class Operand extends TStageOperand {
     this.getDefinitionOverlap() instanceof MustExactlyOverlap
   }
 
-  /**
-   * DEPRECATED: renamed to `getUse`.
-   *
-   * Gets the `Instruction` that consumes this operand.
-   */
-  deprecated final Instruction getUseInstruction() { result = this.getUse() }
-
-  /**
-   * DEPRECATED: use `getAnyDef` or `getDef`. The exact replacement for this
-   * predicate is `getAnyDef`, but most uses of this predicate should probably
-   * be replaced with `getDef`.
-   *
-   * Gets the `Instruction` whose result is the value of the operand.
-   */
-  deprecated final Instruction getDefinitionInstruction() { result = this.getAnyDef() }
-
   /**
    * Gets the overlap relationship between the operand's definition and its use.
    */

csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll

@@ -32,12 +32,6 @@ module AliasModels {
      */
     predicate isParameter(ParameterIndex index) { none() }
 
-    /**
-     * Holds if this is the input value of the parameter with index `index`.
-     * DEPRECATED: Use `isParameter(index)` instead.
-     */
-    deprecated final predicate isInParameter(ParameterIndex index) { this.isParameter(index) }
-
     /**
      * Holds if this is the input value pointed to by a pointer parameter to a function, or the input
      * value referred to by a reference parameter to a function, where the parameter has index
@@ -71,13 +65,6 @@ module AliasModels {
      */
     predicate isQualifierObject() { none() }
 
-    /**
-     * Holds if this is the input value pointed to by the `this` pointer of an instance member
-     * function.
-     * DEPRECATED: Use `isQualifierObject()` instead.
-     */
-    deprecated final predicate isInQualifier() { this.isQualifierObject() }
-
     /**
      * Holds if this is the input value of the `this` pointer of an instance member function.
      *
@@ -182,13 +169,6 @@ module AliasModels {
      */
     predicate isQualifierObject() { none() }
 
-    /**
-     * Holds if this is the output value pointed to by the `this` pointer of an instance member
-     * function.
-     * DEPRECATED: Use `isQualifierObject()` instead.
-     */
-    deprecated final predicate isOutQualifier() { this.isQualifierObject() }
-
     /**
      * Holds if this is the value returned by a function.
      *
@@ -208,12 +188,6 @@ module AliasModels {
      */
     predicate isReturnValue() { none() }
 
-    /**
-     * Holds if this is the value returned by a function.
-     * DEPRECATED: Use `isReturnValue()` instead.
-     */
-    deprecated final predicate isOutReturnValue() { this.isReturnValue() }
-
     /**
      * Holds if this is the output value pointed to by the return value of a function, if the function
      * returns a pointer, or the output value referred to by the return value of a function, if the
@@ -234,14 +208,6 @@ module AliasModels {
      */
     predicate isReturnValueDeref() { none() }
 
-    /**
-     * Holds if this is the output value pointed to by the return value of a function, if the function
-     * returns a pointer, or the output value referred to by the return value of a function, if the
-     * function returns a reference.
-     * DEPRECATED: Use `isReturnValueDeref()` instead.
-     */
-    deprecated final predicate isOutReturnPointer() { this.isReturnValueDeref() }
-
     /**
      * Holds if `i >= 0` and `isParameterDeref(i)` holds for this is the value, or
      * if `i = -1` and `isQualifierObject()` holds for this value.

csharp/ql/test/library-tests/dataflow/library/FlowSummaries.ql

@@ -6,7 +6,8 @@ private class IncludeAllSummarizedCallable extends IncludeSummarizedCallable {
   IncludeAllSummarizedCallable() { exists(this) }
 }
 
-private class IncludeNeutralCallable extends RelevantNeutralCallable instanceof FlowSummaryImpl::Public::NeutralCallable {
+private class IncludeNeutralCallable extends RelevantNeutralCallable instanceof FlowSummaryImpl::Public::NeutralCallable
+{
   /** Gets a string representing the callable in semi-colon separated format for use in flow summaries. */
   final override string getCallableCsv() { result = Csv::asPartialNeutralModel(this) }
 }